FE-1141: Add readable run evidence and graph traceability

memory/PLAN.md

@@ -227,9 +227,9 @@ Brunch-next has delivered the original composition spine: the host, sealed Pi pr
 - **Linear:** [FE-1166](https://linear.app/hash/issue/FE-1166/greenfield-executor-run-substrate-and-verify-policy)
 - **Branch:** `ka/fe-1166-greenfield-executor-harness` (stacks on `ka/fe-1114-executor-replanning` / PR #300)
 - **Kind:** structural / executor run environment policy
-- **Status:** active; scoped in `memory/cards/executor-run-environment--substrate-verify.md`.
+- **Status:** active. Substrate/verify policy is built on PR #302; follow-up live failure scope is open in `memory/cards/executor-run-environment--actionable-slice-request.md` (buildable next after FE-1166 tie-off). Current scope cards: `memory/cards/executor-run-environment--substrate-verify.md`; `memory/cards/executor-run-environment--actionable-slice-request.md`.
 - **Objective:** Separate run substrate and verify target from source-copy policy so greenfield fixture runs can use an isolated run directory and product-owned verification profile instead of always starting from a host git worktree and hardcoded `npm run verify`.
-- **Traceability:** FE-1114 follow-up live-run evidence; `src/executor/worktree.ts`, `src/executor/test-result.ts`, `src/app/test-runner-port.ts`, `src/.pi/extensions/executor/execute-run-create/index.ts`.
+- **Traceability:** FE-1114 follow-up live-run evidence; `src/executor/worktree.ts`, `src/executor/test-result.ts`, `src/app/test-runner-port.ts`, `src/.pi/extensions/executor/execute-run-create/index.ts`; follow-up worker-request evidence from run `run-mrbyf8u9` recorded in `memory/cards/executor-run-environment--actionable-slice-request.md`.
 
 <!-- elicitation-gap-guidance (FE-1116) full definition archived to docs/archive/PLAN_HISTORY.md (2026-07-03 ln-sync);
      durable truth: D99-L, D101-L, D102-L, I52-L, I56-L, closure oracle

memory/SPEC.md

@@ -173,7 +173,7 @@ The POC's purpose is to prove three things: (a) that pi's coding-agent harness c
 | D20-L | Command execution owns the pre-M6 authority seam. Callers submit product commands to a Brunch `CommandExecutor` and receive a structured result; they do not call a standalone authority service or graph persistence directly. The executor is the public mutation boundary that hides attribution, optimistic concurrency, ...                                                                              | See archive snapshot for full rationale.                                     | active |
 | D27-L | Review-set proposals are structured entity-draft payloads; batch acceptance is one atomic `CommandExecutor` call. The elicitor's review-set proposal is carried inside a structured-exchange `present_review_set` → declared `ask` continuation flow (terminal carries the preserved `request_review` result-detail vocabulary; D116-L replaced the registered `request_response` collector) rather than as a standalone `brunch.review_set_proposal` transcrip ... | [`src/graph/policy/category-policy.ts`](src/graph/policy/category-policy.ts) | active |
 | D53-L | `mutateGraph` / `mutate_graph` is the canonical atomic authored graph-mutation grammar. The direct-commit tool for concept acceptance and the shared command seam for review-set acceptance/capture now use one operation language: `{ createBasis, ops }`, ...                                                                                                                                               | [`src/graph/policy/category-policy.ts`](src/graph/policy/category-policy.ts) | active |
-| D111-L | Execute-mode orchestration is a pure product core over injected capability ports (FE-1089–FE-1118 cutover). `src/executor/` owns run-lifecycle contracts and helpers (plan check/outline → plan file → run → worktree → populate/source-copy → reports → slice execute/agent/test → complete → Petri export → run-local promotion → host-promotion preflight/apply); real git/subprocess/SDK effects enter only through `ExecutionPorts` implementations in `src/app/*-port.ts`, injected by Pi composition and exposed as executor-only `execute_*` tools. Host apply stays behind explicit acceptance (`acceptedCommitSha`). Registered here 2026-07-06 during ln-sync: the executor code formerly cited this decision as "D101-L", colliding with the elicitation-scratchpad D101-L; IDs reassigned, no content change. | [`src/executor/TOPOLOGY.md`](src/executor/TOPOLOGY.md) | active |
+| D111-L | Execute-mode orchestration is a pure product core over injected capability ports (FE-1089–FE-1118 cutover). `src/executor/` owns run-lifecycle contracts and helpers (plan check/outline → plan file → run → worktree → populate/source-copy → reports → slice execute/agent/test → complete → Petri export → run-local promotion → host-promotion preflight/apply); agent/test/promotion capabilities enter through `ExecutionPorts` implementations in `src/app/*-port.ts`, injected by Pi composition and exposed as executor-only `execute_*` tools. Narrow exception (FE-1166): `empty_dir` run workspaces may initialize a run-local git repo directly inside `worktree.ts`; this is bounded to the run artifact and is not a host git capability surface. Host apply stays behind explicit acceptance (`acceptedCommitSha`). Registered here 2026-07-06 during ln-sync: the executor code formerly cited this decision as "D101-L", colliding with the elicitation-scratchpad D101-L; IDs reassigned, no content change. | [`src/executor/TOPOLOGY.md`](src/executor/TOPOLOGY.md) | active |
 | D112-L | The execute-mode run driver is a generic `drive()` loop over a pure `RunScheduler` seam (FE-1125): `run.json` status is the loop state, `linearScheduler` drives `created` → `promotion_prepared` end-to-end, and the set-returning `ready()` contract leaves room for a future `PetriScheduler`. Host promotion/land stays off the driven chain as a separately-accepted surface. Formerly cited in code as "D102-L" (collision with the neutral-seed D102-L); reassigned 2026-07-06. | [`src/executor/TOPOLOGY.md`](src/executor/TOPOLOGY.md) | active |
 
 #### Transport & client
@@ -344,7 +344,7 @@ The POC's purpose is to prove three things: (a) that pi's coding-agent harness c
 | I55-L | No committed `.fixtures/runs/**` promoted-evidence file contains an absolute developer-workstation path (`/Users/<user>/…`, `/home/<user>/…`); leaked cwd/prompt-resource/tool-call paths are normalized to a portable placeholder (`<repo>`, `<workbench>`, `<ephemeral-workspace>`, `<external-source>`) that preserves replay/review value without machine-specific roots. `.fixtures/seeds/**` is out of scope — curated source-domain input, not run evidence. | covered (`npm run check:promoted-run-paths` enumerates via `git ls-files .fixtures/runs`, wired into `npm run check`)                                                                                                                                                                                                                                                                                                                                                                                                                     | requirement 24                                               |
 | I56-L | Session-local elicitation-gap scratchpad entries are non-authoritative: no graph reader, projection, plan reader, or capability-readiness judgment may treat a scratchpad entry as spec truth or as a gate. Durable truth is the graph; the scratchpad only guides the elicitor's asking.                                                                                                                                                                           | covered (`session/elicitation-scratchpad.ts` fold + `brunch-data/elicitation/scratchpad-tools.ts` prove the one-carrier/branch-reconstruction half; readiness stays graph-facts-only and resolves with an empty scratchpad, proven by `agents/contexts/seeds/__tests__/origination.test.ts` and `src/graph/__tests__/elicitation-gap-guidance-closure.test.ts`'s absence guard)                                                                                                                                                           | D101-L; D65-L, D74-L                                         |
 | I57-L | For every superseding proposal chain (`present_review_set`, `present_candidates`, `present_digest`), projection and capture consume only the accepted terminal payload. Cancelled chains contribute no offer payload; rejected review offers are dead; prior offers stay transcript history only.                                                                                                                                                              | covered by `exchange-capture-contract` (2026-07-03): request/review outcome conduct homes, sweep-window exclusions (`present_*`/reserved `capture_*` stay out of the sweep tail), and `acceptReviewSet` persisted-code honesty via the canonical `formatMutateGraphResult` receipt are pinned; forbidden carriers stay out structurally (registered-tool-list test, closed typed `mutate_graph` schema). FE-1136 adds the digest chain witness: `present-digest-supersession-proof.test.ts` drives live-shaped `present_digest` regeneration (request changes ×2 → approve) and cancellation fixtures through the real `projectCaptureSweepWindow`, proving only the accepted terminal echo carries digest payload into the sweep and a cancelled chain carries no offer payload; one probe feeds the sweep from a product-minted terminal built by `acceptedResponseFromParams` — since the 2026-07-08 witness audit it enters the sweep as the real persisted message (toolName `ask`), so the witness rides the real RPC answering path and the real wire shape, not projection-only harness wiring. That audit caught and fixed a live regression the old fixtures masked: the sweep classifier admitted only `request_*` toolNames, silently excluding every post-D116-L terminal (all persist under `ask`); the classifier now admits `ask` plus legacy `request_*`, pinned by a named regression test in `sweep-watermark.test.ts`. The end-to-end story is walkthrough-witnessed (2026-07-06, FE-1136 card 4): live-model session drove reference-source → digest offer → request-changes regeneration → approve (terminal echoed the accepted abstract) → advisory review-set map with honest `formatMutateGraphResult` receipt; only the accepted terminal's echo reached capture. FE-1164 witness-gap closure adds `present-candidates-supersession-proof.test.ts`: `present_candidates` regeneration, cancellation, one deliberately legacy-wrapped terminal, and a product-minted `acceptedResponseFromParams` terminal now prove only accepted candidate choice/options payload enters the sweep while cancelled chains contribute no offer payload.                                                                 | D28-L; D80-L, D81-L, D82-L, D106-L, D110-L                           |
-| I58-L | Every execute-mode lifecycle helper advances run metadata with at most one explicit, declared side effect; real git/subprocess/SDK effects are delegated to injected `ExecutionPorts`; port failure leaves run metadata unadvanced; no executor helper mutates the graph; host mutation is limited to the explicitly-accepted file apply in `host-promotion.ts`.                                                                                                | covered (`src/executor/__tests__/` per-helper suites with `fake-ports.ts`; app-layer port tests in `src/app/__tests__/` incl. real-temp-git-repo host-promotion apply/conflict proofs). Formerly cited in executor code as "I56-L" (collision with the scratchpad I56-L); reassigned 2026-07-06.                                                                                                                                                                                                                          | D111-L, D112-L                                               |
+| I58-L | Every execute-mode lifecycle helper advances run metadata with at most one explicit, declared side effect; agent/test/promotion effects are delegated to injected `ExecutionPorts`; the FE-1166 `empty_dir` exception may run direct git initialization only inside the isolated run worktree and must fail without advancing metadata when that initialization fails; no executor helper mutates the graph; host mutation is limited to the explicitly-accepted file apply in `host-promotion.ts`.                                                                                                | covered (`src/executor/__tests__/` per-helper suites with `fake-ports.ts`; app-layer port tests in `src/app/__tests__/` incl. real-temp-git-repo host-promotion apply/conflict proofs; `worktree.test.ts` covers `empty_dir` isolation, exact-root repair, and stale marker cleanup). Formerly cited in executor code as "I56-L" (collision with the scratchpad I56-L); reassigned 2026-07-06.                                                                                                                                                                                                                          | D111-L, D112-L                                               |
 | I59-L | No provider turn fires without a resolvable allowlisted model: UI-capable orientation junctures (J1–J6) do not trigger, kick composition is not invoked there, and no-UI degraded paths resolve through origination's `no_model_available` skip; the no-auth warning (workspace dialog banner + in-chrome notice) is the only interactive surface the user sees. Session/spec creation and all non-model product functions remain available.                                                                | covered (alpha-release inner loop: `src/.pi/extensions/session-orientation/__tests__/registrar.test.ts` and `juncture.test.ts` prove UI-capable J1–J6 suppression + live re-read while preserving no-UI degradation; `src/.pi/components/workspace-dialog/component.test.ts`, `src/app/__tests__/brunch-tui.test.ts`, and `src/app/model-policy.test.ts` prove boot preflight + single-source warning copy; `src/session/__tests__/originate-assistant-turn.test.ts` keeps the `no_model_available` backstop covered) | D113-L, D115-L; req 29                                       |
 
 ## Future Direction Register
@@ -484,7 +484,7 @@ The POC's purpose is to prove three things: (a) that pi's coding-agent harness c
 | **Coherence verdict**                    | Per-spec product state (`coherent` / `incoherent`) emitted by validators and visible to both UI and agent.                                                                                                                                                                                        |
 | **Command layer**                        | The single Brunch-owned mutation surface. Validates, gates concurrency, audits, emits events, triggers coherence. Its public mutation entry point is the `CommandExecutor`, …                                                                                                                     |
 | **Command executor**                     | The deep module that accepts Brunch product commands plus execution context and returns structured command results (`ok`, `needs_human`, `policy_blocked`, `version_conflict`, `structural_illegal`). …                                                                                           |
-| **ExecutionPorts**                       | The injected capability-port bundle (git worktree, agent runner, test runner, run-local git land, host-promotion) through which the pure execute-mode core in `src/executor/` reaches real effects; implementations live in `src/app/*-port.ts` and are wired by Pi composition (D111-L, I58-L).  |
+| **ExecutionPorts**                       | The injected capability-port bundle (git worktree, agent runner, test runner, run-local git land, host-promotion) through which the execute-mode core in `src/executor/` reaches app/host capabilities; implementations live in `src/app/*-port.ts` and are wired by Pi composition. FE-1166's `empty_dir` git initialization is the bounded run-local exception, owned by `worktree.ts`, not an app-layer host capability (D111-L, I58-L).  |
 | **mutateGraph**                          | Canonical atomic authored graph-mutation command/tool. Takes `{ createBasis, ops }`, where `ops` can create, patch, …                                                                                                                                                                             |
 | **propose-graph**                        | Capability-readiness id for the direct-commit graph-write mechanism. The agent may present a concept-level commitment and, after user acceptance, …                                                                                                                                               |
 | **project-graph**                        | Capability-readiness id for the review-set graph-write mechanism. The agent derives nodes and edges from existing graph truth (e.g. projecting requirements from upstream goals/constraints), presents them for review, …                                                                         |

memory/cards/executor-replanning--web-inspect-metadata.md

@@ -2,7 +2,7 @@
 
 Frontier: executor-replanning
 Linear:   FE-1114
-Status:   active
+Status:   superseded
 Mode:     single
 Created:  2026-07-07
 
@@ -11,6 +11,7 @@ Created:  2026-07-07
 - Seam: web run observer presentation.
 - Builds on: `executor-replanning--inspect-metadata.md`.
 - Posture: proving.
+- Superseded by: `memory/cards/executor-run-observer--readable-run-evidence.md`, which absorbs this narrow metadata display into the broader readable run evidence + graph traceability scope to avoid overlapping `/runs` UI work.
 
 ## Target Behavior