docs: design the one view that answers what actually ran (#135, #105)

[moonweave]

Design for the question behind #135 and the #105 comment: "Which project/plan/workspace did this task actually run against, what lane/model was observed, and where is its durable evidence?"

The design is shaped by an inventory of every identity fact — where it is recorded, whether it is bound to the signed bundle, and whether the verifier re-derives it — rather than by layout preference. That inventory produced a three-way split which the spec records: what is sayable today from bound and re-derived evidence, what is sayable with a label, what needs new capture, and what cannot honestly be said at all in the current architecture.

The last category is the important one. The observed model for Antigravity lanes is structurally unknowable — the provider falls back silently, the exit code does not change, and the transcript carries no model name — and every reviewer lane routes to Antigravity by policy. Codex's verified status means only that no rejection string appeared. Neither can be rendered as a confirmed model.

The rules that make the view honest: requested and observed never share a cell, and a missing observation is its own state rather than a fallback to the request; verifier truth and producer self-report never appear under the same heading; lane counts come from observation, not from the plan; and "team" never describes a single runner lane.

Phase 1 ships the whole layout from facts already available and is blocked only on witnessd #212, since building on a summary where the plan overwrites the observation would bake the conflation into the view. Phase 2 adds the capture phase 1 exposes as missing. Two things are deferred and named so they are not mistaken for oversight: the durable external workspace identifier, which requires re-deciding what the task boundary claims, and Depone re-derivation of the four declaration artifacts, which is a verifier contract change.

Documentation only.

🤖 Generated with Claude Code