docs: design the one view that answers what actually ran (#135, #105)

docs/superpowers/specs/2026-07-26-run-identity-view-design.md

@@ -0,0 +1,95 @@
+# One view that answers what actually ran — design
+
+Date: 2026-07-26
+Status: Design agreed, phase 1 ready to build.
+Closes the design question behind ORRO #135 and the #105 comment.
+
+## The question this must answer
+
+The operator's words: *"Which project/plan/workspace did this task actually run against, what lane/model
+was observed, and where is its durable evidence?"*
+
+Today the answer requires opening several directories and reading a session transcript. The data mostly
+exists; it is scattered, and — more seriously — requested values are rendered under headings that read
+as observation.
+
+## What we are allowed to say
+
+An inventory of every identity fact (where it is recorded, whether it is bound to the signed bundle,
+and whether the verifier re-derives it) produced a three-way split. That split, not layout taste, is
+what shapes this view.
+
+**Sayable today, already bound and re-derived.** Requested model from the runner receipt's invocation
+argv; the lane's base git HEAD and working-tree status from the signed run-intent; budget and timeout;
+worktree and task id; lane start/end commits, which Depone already cross-checks against the worktree
+receipt; the evidence directory with per-artifact content hashes.
+
+**Sayable today with a label.** Roadmap item and step, which are recorded but transcribed rather than
+bound. Requested adapter, model source and tier, which are plan-side values. The reference-adapter and
+placeholder-fallback flags, which already exist in JSON and are simply missing from the text.
+
+**Needs new capture.** The observed model as a field — the Claude adapter already extracts it from the
+stream and discards it. Model and tier on the ledger lane, whose absence is why the distinct-model
+count is entirely request-derived. Repository identity: no artifact records the repo path, name, or
+remote anywhere. A durable external workspace identifier, which does not exist and whose addition
+changes what the task boundary claims.
+
+**Not sayable, ever, in the current architecture.** The observed model for Antigravity lanes: the
+provider silently falls back, the exit code does not change, and the transcript carries no model name.
+Since every reviewer lane routes to Antigravity by policy, the most honest statement about a review is
+"gemini-3.5-flash was requested; the provider returned no identity signal". Equally, the Codex
+`verified` status means only that no rejection string appeared — it is not confirmation that the model
+ran, and rendering it as "model confirmed" would be an overclaim.
+
+## Shape
+
+Six blocks, in this order, because it mirrors how the question is asked.
+
+**Identity** — repository, base commit, branch or worktree, task id.
+**Intent** — goal, profile, roadmap item and step.
+**Execution** — lane count stated plainly (`1 execution lane, 0 reviewer lanes`), then per lane the
+adapter and model as *two columns*: requested, and observed. When observation is impossible, the
+observed column says so in words rather than repeating the request.
+**Verification** — the Depone verdict. This is the only line in the view that is verifier truth.
+**Producer declarations (not verified)** — the four signed-but-not-re-derived declarations, if shown at
+all, live here and nowhere else.
+**Evidence** — run directory and the artifact hashes that matter.
+
+## The rules that make it honest
+
+Requested and observed never share a cell. A missing observation is rendered as its own state, never
+by falling back to the requested value. Where only a planned value exists, the block says requested.
+
+Verifier truth and producer self-report never appear under the same heading. The verification block
+carries the Depone verdict; declarations the verifier does not re-derive are quarantined in their own
+block with an explicit marker. witnessd #212 establishes that marker; this view consumes it.
+
+Lane counts come from observation, not from the plan. This is the defect #212 fixes at the source: the
+run summary currently spreads the plan over the ledger, so counts labelled as evidence are
+request-derived.
+
+"Team" and "multi-model" language never describes a single runner lane. A single-lane run says so.
+
+## Phasing
+
+**Phase 1** ships the whole layout using only facts already available, with the label rules above. It
+requires no new capture, and it is blocked only on witnessd #212, since building on top of a summary
+where the plan overwrites the observation would bake the conflation into the view.
+
+**Phase 2** adds the capture that phase 1 exposes as missing: repository identity, the observed model
+as a field, ledger lane model and tier. Each is a producer change and each should land with a test that
+a run whose plan and observation disagree reports the observation.
+
+**Deferred.** The durable external workspace identifier from the #105 comment. The current task
+boundary explicitly places external workspaces outside the evidence scope; adding an identifier means
+re-deciding that boundary, which deserves its own design rather than being smuggled in as a field.
+
+Also deferred, and worth naming so it is not mistaken for oversight: wiring Depone re-derivation for the
+four declaration artifacts. That is a verifier contract change, lands in Depone first, and is the only
+thing that would let those declarations graduate out of the quarantine block.
+
+## How we will know it worked
+
+An operator who has just finished a run can answer the original question from one command, and can tell
+— without asking us — which lines are verifier truth, which are producer self-report, and which are
+things the system cannot know.