feat(r5c-lab): cycle scorecard Markdown render + /v1 endpoint + summary link

[alexnikolskiy]

R5c-lab — Cycle Scorecard Markdown (Lab side)

Renders a closed-cycle CycleScorecard (R5a/R5b, cycle-scorecard-v1) as human-readable Russian Markdown and surfaces it Lab-side. Deterministic, LLM-free, no migration, no new env var.

Durable contract: docs/superpowers/specs/2026-07-15-r5c-lab-cycle-scorecard-markdown-spec.md. Plan: docs/superpowers/plans/2026-07-15-r5c-cycle-scorecard-markdown.md.

What ships

• Pure renderer renderCycleScorecardMarkdown(sc): string + escaping helpers (inlineCode/tableCell/codeCell). Covers all four terminal states (accepted / rejected / skipped / abandoned), the "выбрано N из {eligible}" line, independent eligible/considered rendering (each with its own unavailable-reason), the aggregate baseline/candidate/Δ table with the four RevisionEvaluatorPolicy thresholds (R5a explainability), trade-split veto detail, holdout robustness + lowConfidence ⚠️ marker, and the hypothesis roster. Machine enums/reasons rendered verbatim in backticks.
• Read-API markdown surface — GET /v1/cycles/:correlationId/scorecard?format=markdown → text/markdown on 200; the JSON 404 error envelope is preserved byte-identically (markdown never emitted on 404); default (no format) unchanged JSON.
• Shared /v1 path contract — src/read-api/paths.ts (READ_API_V1_PREFIX, CYCLE_SCORECARD_ROUTE, cycleScorecardMarkdownUrl). Route registration, read-app.ts V1_PATHS + mount, and the URL builder all derive from the same constants (real centralization, proven by an e2e drift test that drives the built URL through the mounted app).
• Completion-summary link — RunCycleCompletionSummary.links.scorecardUrl, built unconditionally from the required task.correlationId (relative canonical /v1/... path). Not gated on a scorecard-row read (the summary is emitted before the async row lands) and not safe()-wrapped.

Out of scope → R5d (Office consumer, separate PR)

Office rendering the markdown into the chat needs its own work (DTO mirror gains scorecardUrl, authenticated text/markdown fetch, launch moment + bounded retry on 404, chat render) and a retry-lifecycle design. The spec pins the R5d obligations, including the security invariant: Office treats scorecardUrl as a relative canonical /v1/cycles/... path + configured Lab base URL, never an arbitrary absolute URL from the DTO.

Verification

• Full suite 3721 passed / 0 failed (86 pre-existing gated-pg skips); pnpm typecheck exit 0; read-boundary guard green.
• Built via subagent-driven development: per-task spec+quality review (all Spec ✅ / Approved, 0 Critical/0 Important) + final whole-branch review (opus). The one Important the final review found — inlineCode not stripping newlines (spec Contract-3 deviation + latent markdown-injection for prose code spans) — is fixed and re-reviewed; golden snapshot unchanged.

Follow-ups (accepted Minor, non-blocking)

• signedNum(0) renders +0 (cosmetic); ?format=<other>→JSON and holdout mode:'trade_based' with t absent are untested paths (both safe by construction).

🤖 Generated with Claude Code