mlcyclops
diff --git a/‎DECISIONS.md‎
Lines changed: 72 additions & 0 deletions b/‎DECISIONS.md‎
Lines changed: 72 additions & 0 deletions
diff --git a/‎Makefile‎
Lines changed: 4 additions & 0 deletions b/‎Makefile‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎PROGRESS.md‎
Lines changed: 5 additions & 0 deletions b/‎PROGRESS.md‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎desktop/dev.ts‎
Lines changed: 29 additions & 2 deletions b/‎desktop/dev.ts‎
Lines changed: 29 additions & 2 deletions
@@ -11514,3 +11514,75 @@ subcommand; `acp` never routes to tui; help flags exit 0 spawning nothing) via t
 
 **Related.** ADR-0150 (`lucid tui`), ADR-0155/0156 (Neovim surface), ADR-0038 (launcher trust anchor),
 invariants #3/#4 (fail-closed, gate can't be omitted - both untouched).
+## ADR-0162 - P-REPORT.9: multi-repo remote fetch + PR aggregation for the Engineering Report
+
+**Date:** 2026-07-05
+**Status:** Accepted. **P-REPORT.9 BUILT + tested.**
+
+### Context
+
+Product ask: the Engineering Report was blind to anything not already committed on ONE repo's local
+default branch. It reads `DECISIONS.md`/`PROGRESS.md` from the app repo plus a local `git diff
+HEAD~10..HEAD` (`gitChangeInputs`, dev.ts) - it never fetched remotes, never spanned other branches,
+never saw the other repos a user tracks, and had no concept of pull requests. Users running against
+several remote repos (feature branches, PRs, `master` moving upstream) got a report missing the newest
+work. They asked to pick which repos to include, verify their remotes, add missing ones, pull the latest,
+and fold recent commits + PRs into one comprehensive report - targeting only the repos they choose.
+
+### Decision
+
+1. **Fetch-only sync, never pull.** The user picked fetch-only over `git pull`: `git fetch --prune
+   --no-tags origin` per selected repo downloads remote commits/branches READ-ONLY - it never mutates the
+   working tree or current branch, so it can't conflict across many repos with uncommitted work. `pull`
+   and merge modes are deliberately out of scope (recorded as a follow-up, not a silent omission).
+2. **A PURE renderer + a desktop collector, mirroring change_graph.ts / gitOut.**
+   `harness/brief/repo_activity.ts` is pure (raw git/gh strings → `RepoActivity` → a "Cross-repo activity"
+   annex markdown; no I/O, no Date) so it is fixture-tested. `desktop/repo_collect.ts` does the spawning:
+   fetch, `git for-each-ref` branch enumeration (local heads + `origin/*`, remote HEAD symref filtered,
+   capped at 8 by recency), `git log` per branch, the window diff for line totals, and gh for PRs.
+3. **PRs via the `gh` CLI, opt-in per repo, GitHub only.** A per-row toggle, enabled only when the remote
+   is GitHub AND `gh auth status` succeeds (cached 60s). Non-GitHub / unauthed / not-requested each yield
+   an explicit `prStatus` that the annex renders as an honest "PRs skipped: <reason>" line. gh runs with
+   `cwd` = the repo so it reads the origin remote itself.
+4. **Repo source = workspaces ∪ recents ∪ a new `reportRepos` list** (settings_store.ts). "Add repo"
+   takes a local path (validated `isGitRepo`) or a clone URL (reusing `cloneRepo`) and persists into
+   `reportRepos` WITHOUT calling `setWorkspace`/`backend.restart()` - tracking a repo for reporting must
+   never hijack the active omp session. The picker shows each repo's remote URL as the "verify" surface.
+5. **`/api/brief` gains a POST path** `{ role, save, repos:[{path,fetch,prs}], window }`; when `repos` is
+   present it appends the cross-repo annex for ALL roles. GET (single-repo default) is unchanged, so a
+   plain Generate reproduces the prior brief exactly (back-compat). Two new endpoints: `GET
+   /api/report/repos` (candidates + gh-auth) and `POST /api/report/repos/add`.
+
+### Security
+
+- **First-party control-plane egress**, exactly like `cloneRepo` (ADR-0111): server-side `Bun.spawn` of
+  git/gh behind the loopback + per-launch-token gate (ADR-0022/0024), NOT the agent tool gate. Fetch is
+  read-only with a 25s per-repo timeout; every step is fail-soft (a failed fetch still yields local refs,
+  flagged; a bad repo contributes an empty labeled entry, never a throw or a blank).
+- **Untrusted external content (invariant #5).** Commit subjects, PR titles, and author names are
+  externally authored. `clean()` collapses newlines, strips code-fence/inline-code breakout, escapes HTML,
+  escapes table pipes, and length-caps every field before it enters the markdown. The annex carries a
+  provenance line stating the text is DATA, never instructions - it holds when the brief later flows to
+  TTS / NotebookLM / the KG (`reportToKg`).
+
+### Deliberate deltas / scope
+
+The brief NARRATIVE still comes from the primary repo's DECISIONS/PROGRESS; only the additive annex is
+cross-repo (broadening the narrative source is a follow-up). Non-GitHub PR providers (GitLab MRs, Azure
+DevOps) are out of scope - detected and skipped with a reason, not half-supported.
+
+### Verification
+
+`bun test harness` 826 pass / 0 fail (+25 `repo_activity.test.ts`: URL parse GitHub-vs-not, commit/PR
+parse, cross-branch dedup + totals, fetch-failure surfacing, each PR-skip reason, per-branch cap, and
+untrusted-text escaping / fence-breakout). `make demo-P-REPORT.9` green. Renderer bundles clean. Live
+against real repos: `listReportRepos()` resolved GitHub + GitLab + Azure-DevOps remotes and flagged
+non-git folders; `collectRepoActivity` enumerated commits across feature/master/release branches with
+line totals, and the annex escaped `&`. The 5 pre-existing `fs_browse.test.ts` env failures are unrelated.
+
+### Relates to
+
+ADR-0116/0117 (the Reports panel + brief store this extends), ADR-0072 (the Engineering Update engine),
+ADR-0030 (`gitChangeInputs`, reused pattern), ADR-0111 (`cloneRepo` first-party git precedent),
+ADR-0022/0024 (the loopback + token gate the endpoints sit behind), CLAUDE.md invariants #3 (fail-closed),
+#5 (untrusted content delimited/as-data), #9 (stable ids).
@@ -463,6 +463,10 @@ demo-P-FIGMA.2: ## P-FIGMA.2 (ADR-0154): after /figma import, a guided step —
 demo-P-SANDBOX.1: ## P-SANDBOX.1 (ADR-0157): the runtime execution boundary — sandbox seam (bwrap/noop), canNetwork/canExec caps ENFORCED at the omp spawn (suspicious-chain downgrade = real --unshare-net), managed require-isolation fail-closes, disclosed passthrough elsewhere
 	$(BUN) run harness/scripts/demo_p_sandbox_1.ts
 
+.PHONY: demo-P-REPORT.9
+demo-P-REPORT.9: ## P-REPORT.9 (ADR-0162): multi-repo remote fetch + PR aggregation for the Engineering Report — remote-URL parse (GitHub vs not), commits aggregated across branches (deduped) + line totals, the Cross-repo activity annex, fail-soft on a failed fetch (local refs still shown), PRs skipped with a reason on non-GitHub/unauthed remotes, and untrusted commit/PR text neutralized (no HTML/fence breakout)
+	$(BUN) run desktop/scripts/demo_p_report_9.ts
+
 .PHONY: dashboards
 dashboards: ## Materialize dashboard CSVs from a DuckDB into observable/docs/data (DB=path)
 	$(BUN) run harness/scripts/materialize_dashboards.ts $(DB) observable/docs/data
 
@@ -3080,3 +3080,8 @@ Roadmap phases (each its own future increment + ADR for its frozen-contract delt
 - **shipped:** harness/runs/sandbox_exec.ts (SandboxBackend bwrap|noop, pure resolveBackend, wrapForProfile = the single fail-closed decision point: managed require-isolation unsatisfiable => refuse; canExec:false => refuse-exec; canNetwork:false on a passthrough => refuse, under bwrap => --unshare-net total deny - the chooseProfile suspicious downgrade is finally REAL); wired at BOTH spawns (lucid_acp execGated: refused resolution = exit 1 pre-spawn like the scanner preflight + loud sandboxDisclosure() passthrough line; acp_backend resolveSandboxPlan: managed-require w/o backend spawns with EVERY exec permission denied + audited via existing SecurityEvent - no new EventNames, P-SANDBOX.3 owns those); security.exec.requireIsolation managed knob (+ GPO ExecRequireIsolation), tighten-only. 16+4 new tests (801 green), tsc x3 clean, standalone launcher still compiles, demo-P-SANDBOX.1 green. Merge housekeeping: local marketplace ADR renumbered 0156->0158 (upstream took 0156/0157).
 - **stubbed:** bwrap mount plan binds $HOME rw (fs containment stays omp --isolate's; network is the v1 boundary); seccomp deferred (needs a compiled BPF fd); agent_run.ts spawnGatedOmp not yet routed through the seam; macOS/Windows have NO isolating backend (disclosed passthrough) until P-SANDBOX.4.
 - **next:** P-SANDBOX.2 - egress_proxy.ts (loopback DNS + CONNECT proxy consulting egressDecisionDetailed) for canNetwork:true profiles; the increment that directly answers the DNS-TXT exfil.
+
+**P-REPORT.9 - multi-repo remote fetch + PR aggregation for the Engineering Report (ADR-0162)**
+- **shipped:** harness/brief/repo_activity.ts (PURE: parseRemoteUrl/parseCommits/parsePrJson/buildRepoActivity + renderRepoActivityAnnex → the "Annex C - Cross-repo activity" markdown; clean() neutralizes untrusted commit/PR text - HTML escape + fence-breakout strip + pipe escape + cap, invariant #5); desktop/repo_collect.ts (fetch-only `git fetch --prune --no-tags`, for-each-ref branch enumeration capped at 8 by recency w/ origin-HEAD filtered, per-branch git log, window diff totals, gh PR list opt-in behind ghAvailable cache; listReportRepos/addReportRepo/collectRepoActivity - first-party spawn like cloneRepo, fail-soft + timeouts); /api/brief POST path + /api/report/repos(/add) endpoints; settings_store reportRepos; bridge reportRepos/addReportRepo + engineeringBrief(repos); Reports-panel repo picker (checkable rows + remote-URL verify surface + per-repo PR toggle gated on GitHub+gh-auth + Add-repo path/URL + Fetch-latest checkbox) + .rp-repo* styles. 25 tests + demo-P-REPORT.9 green; harness 826 pass/0 fail; verified live against real GitHub/GitLab/Azure-DevOps remotes.
+- **stubbed:** fetch-only (no pull/merge - deliberate); brief NARRATIVE still primary-repo DECISIONS/PROGRESS (only the annex is cross-repo); PRs GitHub-only (GitLab MRs / Azure DevOps detected + skipped-with-reason, not supported); no per-fetch formal audit event yet (fetch status is surfaced in the annex, reach-out is loopback first-party).
+- **next:** P-REPORT.10 candidates - GitLab/Azure PR providers; a formal SecurityEvent per fetch/PR reach-out; optional pull (ff-only) as an explicit opt-in; cross-repo narrative synthesis.
@@ -16,6 +16,8 @@ import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { buildEngineeringUpdate, renderEngineeringBrief, buildPodcastScript, renderScript, type PodcastBackend, type BriefRole } from "../harness/brief/engineering_update.ts";
 import { buildComplianceRows, renderPoamCsv, renderCkl } from "../harness/brief/compliance.ts"; // P-REPORT.6/.8: POA&M + CKL
 import { buildChangeGraph, buildSchemaChanges, renderAnnexes } from "../harness/brief/change_graph.ts"; // P-REPORT.8: report annexes
+import { renderRepoActivityAnnex } from "../harness/brief/repo_activity.ts"; // P-REPORT.9: cross-repo activity annex
+import { addReportRepo, collectRepoActivity, ghAvailable, listReportRepos, type RepoSelection } from "./repo_collect.ts"; // P-REPORT.9 (ADR-0162)
 import { loadChatBg, saveChatBg, type ChatBg } from "./chat_bg.ts"; // P-APPEAR.1: personalized chat background
 import { ingestCodeGraph, loadCodeGraph } from "./code_graph.ts"; // P-KG-CODE.1: workspace code graph
 import { ingestSymbolGraph, loadSymbolGraph } from "./symbol_graph.ts"; // P-KG-SYM.1: AST symbol graph
@@ -544,7 +546,10 @@ const server = Bun.serve({
       if (p === "/api/brief") {
         // P-REPORT.1 (ADR-0116): `?role=` tailors which sections lead + the framing; `?save=1` persists the
         // brief to the report store (so the Reports panel lists it). The goal-modal preview omits save.
-        const roleRaw = url.searchParams.get("role");
+        // P-REPORT.9 (ADR-0162): a POST body `{ role, save, repos, window }` additionally aggregates recent
+        // commits + PRs across the SELECTED repos (fetched read-only) into a Cross-repo activity annex.
+        const body = req.method === "POST" ? await readBody<{ role?: unknown; save?: unknown; repos?: unknown; window?: unknown }>(req) : {};
+        const roleRaw = url.searchParams.get("role") ?? (body.role != null ? String(body.role) : null);
         const role: BriefRole | undefined = roleRaw === "developer" || roleRaw === "security" || roleRaw === "manager" || roleRaw === "executive" ? roleRaw : undefined;
         const repo = join(import.meta.dir, "..");
         const rd = (f: string) => { try { return existsSync(join(repo, f)) ? readFileSync(join(repo, f), "utf8") : ""; } catch { return ""; } };
@@ -557,9 +562,31 @@ const server = Bun.serve({
           const gi = gitChangeInputs(repo);
           brief += "\n\n" + renderAnnexes(buildChangeGraph(gi.numstat, gi.nameStatus, gi.range), buildSchemaChanges(gi.numstat, gi.nameStatus));
         }
-        const savedRel = url.searchParams.get("save") === "1" ? saveBrief(Date.now().toString(36), role ?? "executive", brief) : null;
+        // P-REPORT.9: cross-repo activity annex, only when repos were selected (POST). Fetch is read-only;
+        // the annex is appended for ALL roles (it's the whole point of selecting extra repos).
+        const rawRepos = Array.isArray(body.repos) ? (body.repos as unknown[]) : [];
+        const sel: RepoSelection[] = rawRepos
+          .map((r) => (r && typeof r === "object" ? r as Record<string, unknown> : {}))
+          .filter((r) => typeof r.path === "string" && r.path)
+          .map((r) => ({ path: String(r.path), fetch: r.fetch !== false, prs: r.prs === true }));
+        if (sel.length) {
+          const window = Number(body.window) || 10;
+          const activities = await collectRepoActivity(sel, { fetch: true, prs: false, window });
+          brief += "\n\n" + renderRepoActivityAnnex(activities);
+        }
+        const doSave = url.searchParams.get("save") === "1" || body.save === true;
+        const savedRel = doSave ? saveBrief(Date.now().toString(36), role ?? "executive", brief) : null;
         return json({ ok: true, data: { brief, scriptText: renderScript(buildPodcastScript(u, role)), counts, role: role ?? "", savedRel } });
       }
+      // P-REPORT.9 (ADR-0162): the candidate repos for a report (workspace ∪ recents ∪ report-only tracked)
+      // + whether `gh` is authenticated (drives the PR toggle). Read-only; safe to poll.
+      if (p === "/api/report/repos") return json({ ok: true, data: { repos: await listReportRepos(), ghAuth: await ghAvailable() } });
+      // Add a report-target repo by local path or clone URL. Does NOT change the active workspace.
+      if (p === "/api/report/repos/add" && req.method === "POST") {
+        const b = await readBody<{ path?: unknown; url?: unknown }>(req);
+        const r = await addReportRepo({ path: b.path != null ? String(b.path) : undefined, url: b.url != null ? String(b.url) : undefined });
+        return json({ ok: r.ok, data: { repos: await listReportRepos(), ghAuth: await ghAvailable(), error: r.error } });
+      }
       // P-REPORT.8: STIG Viewer .ckl export of the security control crosswalk (native XML checklist).
       if (p === "/api/brief/ckl") {
         const repo = join(import.meta.dir, "..");