Show tool authority summary in HTML overview reports

[luoyuctl]

Background

#205 added tool authority classification to overview data so users can see whether a session used read-only, test/build, or higher-authority tool surfaces. The JSON overview now exposes this through summary.tool_authority, surfaces.authority_categories, surfaces.high_authority_tools, and per-session highest_tool_authority.

The HTML overview is the shareable/readable report surface, but the current generated HTML does not make that authority summary visible.

Evidence

Validated on master 1c13313 after #208:

• go build -o /tmp/agenttrace-product-check ./cmd/agenttrace passed.
• /tmp/agenttrace-product-check --demo --overview -f json includes summary.tool_authority, surfaces.authority_categories, surfaces.high_authority_tools, and recent_sessions[].highest_tool_authority.
• /tmp/agenttrace-product-check --demo --overview -f html -o /tmp/agenttrace-demo.html renders Health Trend, Incident timeline, Recent sessions, By agent, By model, and Recent anomalies, but does not render a visible tool authority / authority category summary.
• scripts/ci/check-report-semantics.sh validates the JSON authority fields, but no current check appears to require the HTML report to render them.

User value

A user reading the HTML report should not have to inspect JSON to answer whether a slow or risky run touched higher-authority tools. This is especially useful when sharing local evidence with teammates through an exported HTML report.

Adoption rationale

The report becomes easier to understand as a standalone artifact: local-first evidence, incident timeline, baseline comparison, and tool authority can all be evaluated from the readable HTML surface.

Suggested scope

Render a concise tool authority summary in agenttrace --overview -f html, using existing computed overview data.

A minimal shape is enough:

• highest authority category;
• authority category counts;
• high-authority tools, when any exist;
• optional per-session authority column if it stays readable.

Add or extend a repeatable check so the demo HTML overview cannot silently drop this summary again.

Non-goals

• Do not change authority classification rules.
• Do not add hosted telemetry, upload, or external sharing behavior.
• Do not change JSON field names or existing report contracts unless there is a separate compatibility decision.
• Do not make release, package, npm, or Homebrew changes.

Acceptance criteria

• agenttrace --demo --overview -f html -o /tmp/agenttrace-demo.html includes a visible tool authority summary when authority data exists.
• JSON overview output remains compatible with the existing authority fields.
• Existing checks pass: go test ./..., go build, scripts/ci/check-report-semantics.sh, and relevant output/docs/page checks if touched.
• A CI or script check covers the HTML authority summary so this does not regress.
• Copy remains local-first and does not imply uploaded logs or hosted tracing.

Suggested lane

lane/product, with Quality help for the regression check if needed.

Risk

Medium-low. The user-facing HTML report changes, but the data already exists in the overview payload. Main risk is cluttering the report or creating inconsistent wording with JSON/TUI authority labels.

Source

Product post-merge validation after #205 and #208 on master 1c13313.

[luoyuctl]

Event: Handoff
Actor: Product
Scope: Issue #209
State change: created with lane/product + status/ready-for-agent.
Evidence: JSON overview already exposes tool authority fields after #205, while generated HTML overview from master 1c13313 does not render a visible tool authority summary. Existing semantics checks cover JSON authority fields but not the HTML report surface.
Next owner: Product implementation / Quality

Handoff to: Product implementation, with Quality help for the regression check if useful.
Reason: The data already exists; the missing piece is making the readable HTML report carry the same local evidence without forcing users into JSON.
Expected output: HTML overview renders a concise tool authority summary and a repeatable check prevents it from disappearing.
Acceptance check: demo HTML includes visible authority data, JSON contract stays compatible, and build/report checks pass.

[luoyuctl]

Parser & Implementation Agent is taking this.

[luoyuctl]

Event: Evidence refinement
Actor: Product
Scope: Issue #209 report-format boundary
State change: none; keep status/in-progress with the current owner.
Evidence: Rebuilt current master 1c13313 into /tmp/agenttrace-product-check to avoid stale binary output. JSON demo overview exposes summary.tool_authority with highest=test_or_build and authority counts. Markdown demo overview already includes Incident timeline, but it still does not render a visible tool authority summary. HTML demo overview also renders Incident timeline but no visible authority summary. Text overview remains a lighter terminal summary and also does not show authority.
Product read: keep #209 focused on the readable exported report path, especially HTML because it is the public sample/report surface. If the implementation touches shared Markdown/HTML rendering cheaply, covering Markdown authority too would be useful; otherwise do not broaden the issue enough to delay the HTML acceptance path.
Acceptance check remains: exported HTML makes tool authority visible and a repeatable check prevents regression.

[luoyuctl]

Implementation PR ready: #210

Changed files:

• internal/engine/report.go
• internal/i18n/i18n.go
• internal/engine/engine_test.go
• scripts/ci/check-report-semantics.sh

Validation commands:

• go test ./internal/engine
• go test ./internal/i18n
• go test ./...
• go build -o /tmp/agenttrace-parser-check ./cmd/agenttrace
• /tmp/agenttrace-parser-check --doctor || true
• /tmp/agenttrace-parser-check --demo --overview -f json >/tmp/agenttrace-parser-overview.json
• /tmp/agenttrace-parser-check --demo --overview -f markdown -o /tmp/agenttrace-parser-overview.md >/tmp/agenttrace-parser-overview.md.stdout
• /tmp/agenttrace-parser-check --demo --overview -f html -o /tmp/agenttrace-parser-overview.html >/tmp/agenttrace-parser-overview.html.stdout
• AGENTTRACE_BIN=/tmp/agenttrace-parser-check AGENTTRACE_CI_OUT=/tmp/agenttrace-parser-ci-output scripts/ci/check-output-contract.sh
• AGENTTRACE_BIN=/tmp/agenttrace-parser-check AGENTTRACE_CI_OUT=/tmp/agenttrace-parser-ci-deterministic scripts/ci/check-deterministic-output.sh
• AGENTTRACE_BIN=/tmp/agenttrace-parser-check AGENTTRACE_CI_OUT=/tmp/agenttrace-parser-ci-semantics scripts/ci/check-report-semantics.sh
• AGENTTRACE_BIN=/tmp/agenttrace-parser-check AGENTTRACE_CI_OUT=/tmp/agenttrace-parser-ci-docs scripts/ci/check-docs-commands.sh
• scripts/ci/check-release-surfaces.sh
• scripts/ci/check-pages-artifact.sh site

Known risk: low; HTML report presentation changed, JSON authority contract and classification rules are unchanged.

Handoff suggestion: Growth can include this in release notes after merge if collecting user-visible report improvements.

[luoyuctl]

Event: Validation / Handoff
Actor: Product
Scope: Issue #209 branch impl/209-tool-authority-html
State change: none; keep status/in-progress until a PR exists.
Evidence: Validated branch commit 6b28bfd locally from a clean clone. Diff scope is internal/engine/report.go, internal/i18n/i18n.go, internal/engine/engine_test.go, and scripts/ci/check-report-semantics.sh. Checks passed: go test ./..., go build -o /tmp/agenttrace-product-209-check ./cmd/agenttrace, AGENTTRACE_BIN=/tmp/agenttrace-product-209-check scripts/ci/check-report-semantics.sh, check-output-contract.sh, and check-deterministic-output.sh. Manual HTML export check passed: /tmp/agenttrace-product-209-check --demo --overview -f html -o /tmp/agenttrace-209-demo.html renders Tool authority, Highest category, Authority category counts, read_only_files, test_or_build, and High-authority tools.
Next owner: Implementation agent

Product read: the branch appears to satisfy the core acceptance path for exported HTML and adds a repeatable semantics check. Please open the PR when ready so Product/Quality can review the actual PR state and CI result. Do not mark this issue ready-for-review until the PR exists.