feat(cicd): add bounded pipeline evidence

scripts/src/cicd-branch-follower.ts

@@ -25,6 +25,7 @@ import { renderControllerManifests, renderControllerReconcileJob, waitForJobShel
 import { buildDebugStep } from "./cicd-debug";
 import { runNativeHwlabControlPlaneRefresh } from "./cicd-hwlab-refresh";
 import { nativeCicdScriptLoadShell, readNativeObjectBundle } from "./cicd-native-bundle";
+import { compactRefreshEvidence, followerEvidenceSummary } from "./cicd-evidence";
 import { runNativeK8sJob, runNativeTektonPipelineRun } from "./cicd-native";
 import { argoApplicationReady, nativeArgoSummary, nativeGitMirrorReady, nativeGitMirrorRequired, nativeGitMirrorSummary, nativePipelineRunSummary, nativeRuntimeSummary, pipelineRunSucceeded, runtimeTargetShaFromWorkloads, runtimeWorkloadsReady } from "./cicd-native-summary";
 import { invalidRuntimeReuseConfig, missingRuntimeReuseConfig, parseRuntimeReuseConfig, RUNTIME_REUSE_CONFIG_PATH, runtimeReuseService, summarizeRuntimeReuseConfig, type RuntimeReuseConfig } from "./cicd-reuse-config";
@@ -1884,6 +1885,7 @@ async function readAdapterStatus(registry: BranchFollowerRegistry, follower: Fol
       reuseConfig: observedSha === null ? null : summarizeRuntimeReuseConfig(requireFollowerRuntimeReuseConfig(follower, observedSha, Math.min(timeoutSeconds, 5))),
       gitMirror: nativeGitMirrorSummary(bundle.gitMirror),
       tekton: nativePipelineRunSummary(bundle.pipelineRun),
+      pipeline: bundle.pipeline,
       taskRuns: bundle.taskRuns,
       planArtifacts: bundle.planArtifacts,
       argo: nativeArgoSummary(bundle.argoApplication),
@@ -1950,6 +1952,11 @@ function mergeFollowerStatus(
   const lastTriggeredSha = live?.lastTriggeredSha ?? stringOrNull(stored.lastTriggeredSha);
   const lastSucceededSha = live?.lastSucceededSha ?? stringOrNull(stored.lastSucceededSha);
   const timings = live === null ? storedFollowerTimingsForStatus(follower, asOptionalRecord(stored.timings), phase, observedSha) : buildFollowerTimings(follower, live, undefined, asOptionalRecord(stored.timings), phase);
+  const evidence = followerEvidenceSummary({
+    observedSha,
+    livePayload: asOptionalRecord(live?.payload),
+    storedCommand: asOptionalRecord(stored.command),
+  });
   const reconcileTimeline = compactReconcileTimeline(asOptionalRecord(stored.command)?.reconcileTimeline, follower.id) ?? {
     bounded: true,
     missingReason: "stored state lacks reconcileTimeline; old data cannot be reconstructed",
@@ -1981,6 +1988,7 @@ function mergeFollowerStatus(
     live: liveRequested,
     message: live?.message ?? stringOrNull(stored.decision) ?? "no controller state yet",
     timings: detailed ? timings : compactListTimings(timings),
+    evidence: detailed ? evidence : null,
     reconcileTimeline: detailed ? reconcileTimeline : null,
     drilldown: `bun scripts/cli.ts cicd branch-follower status --follower ${follower.id} --live`,
   };
@@ -2285,10 +2293,12 @@ function compactNativePayload(payload: Record<string, unknown> | null): Record<s
     reuseConfig: summarizeRuntimeReuseConfigFromRecord(asOptionalRecord(payload.reuseConfig)),
     gitMirror: asOptionalRecord(payload.gitMirror),
     tekton: asOptionalRecord(payload.tekton),
+    pipeline: asOptionalRecord(payload.pipeline),
     taskRuns: compactTaskRunsPayload(asOptionalRecord(payload.taskRuns)),
     planArtifacts: compactPlanArtifactsPayload(asOptionalRecord(payload.planArtifacts)),
     argo: asOptionalRecord(payload.argo),
     runtime: asOptionalRecord(payload.runtime),
+    refreshEvidence: compactRefreshEvidence(asOptionalRecord(asOptionalRecord(payload.nativeCapabilities)?.controlPlaneRefresh)),
     errors: Array.isArray(payload.errors) ? payload.errors.slice(0, 5) : [],
     statusAuthority: stringOrNull(payload.statusAuthority),
     parsedDownstreamCliOutput: false,

scripts/src/cicd-debug.ts

@@ -398,6 +398,7 @@ function compactStatusGates(payload: Record<string, unknown> | null): Record<str
     },
     tekton: tekton === null ? null : {
       name: stringOrNull(tekton.name),
+      pipelineRefName: stringOrNull(tekton.pipelineRefName),
       succeeded: tekton.succeeded === true ? true : tekton.succeeded === false ? false : null,
       reason: stringOrNull(tekton.reason),
       startTime: stringOrNull(tekton.startTime),
@@ -426,6 +427,8 @@ function compactStatusGates(payload: Record<string, unknown> | null): Record<str
       nonReadyResources: Array.isArray(argo.nonReadyResources) ? argo.nonReadyResources.slice(0, 5) : [],
       ready: argo.ready === true,
     },
+    pipeline: compactPipeline(payload.pipeline),
+    refreshEvidence: compactRefreshEvidence(payload.refreshEvidence),
     runtime: runtime === null ? null : {
       ready: runtime.ready === true,
       targetSha: stringOrNull(runtime.targetSha),
@@ -436,6 +439,32 @@ function compactStatusGates(payload: Record<string, unknown> | null): Record<str
   };
 }
 
+function compactPipeline(value: unknown): Record<string, unknown> | null {
+  const pipeline = asOptionalRecord(value);
+  if (pipeline === null) return null;
+  return {
+    metadata: asOptionalRecord(pipeline.metadata),
+    spec: asOptionalRecord(pipeline.spec),
+  };
+}
+
+function compactRefreshEvidence(value: unknown): Record<string, unknown> | null {
+  const refresh = asOptionalRecord(value);
+  if (refresh === null) return null;
+  return {
+    jobName: stringOrNull(refresh.jobName),
+    namespace: stringOrNull(refresh.namespace),
+    status: stringOrNull(refresh.status),
+    pipeline: stringOrNull(refresh.pipeline),
+    sourceCommit: stringOrNull(refresh.sourceCommit),
+    sourceStageRef: stringOrNull(refresh.sourceStageRef),
+    elapsedMs: numberOrNull(refresh.elapsedMs),
+    sourceAuthority: stringOrNull(refresh.sourceAuthority),
+    statusAuthority: stringOrNull(refresh.statusAuthority),
+    parsedDownstreamCliOutput: false,
+  };
+}
+
 function arrayRecords(value: unknown): Record<string, unknown>[] {
   return Array.isArray(value) ? value.filter((item): item is Record<string, unknown> => typeof item === "object" && item !== null && !Array.isArray(item)) : [];
 }

scripts/src/cicd-drilldown-render.ts

@@ -268,6 +268,26 @@ function nativeGateRows(native: Record<string, unknown> | null): unknown[][] {
     const status = runtime.ready === true ? (runtime.aligned === true ? "ready/aligned" : "ready/stale") : "not-ready";
     rows.push(["runtime", status, `${shortSha(stringOrNull(runtime.targetSha))}/${shortSha(stringOrNull(runtime.expectedSha))}`, stringOrNull(runtime.namespace) ?? "-"]);
   }
+  const pipeline = asOptionalRecord(native.pipeline);
+  if (pipeline !== null) {
+    const runtimeReady = asOptionalRecord(asOptionalRecord(pipeline.spec)?.runtimeReadyTask);
+    const when = arrayRecords(runtimeReady?.when)[0];
+    rows.push([
+      "pipeline",
+      runtimeReady?.present === true ? "runtime-ready-present" : "runtime-ready-absent",
+      when === undefined ? "-" : `${stringOrNull(when.input) ?? "-"} ${stringOrNull(when.operator) ?? "-"} ${arrayTextItems(when.values).join(",") || "-"}`,
+      stringOrNull(asOptionalRecord(pipeline.metadata)?.name) ?? "-",
+    ]);
+  }
+  const refresh = asOptionalRecord(native.refreshEvidence);
+  if (refresh !== null) {
+    rows.push([
+      "control-plane-refresh",
+      stringOrNull(refresh.status) ?? "-",
+      `${shortSha(stringOrNull(refresh.sourceCommit))}/${stringOrNull(refresh.pipeline) ?? "-"}`,
+      stringOrNull(refresh.jobName) ?? "-",
+    ]);
+  }
   for (const error of arrayTextItems(native.errors).slice(0, 5)) rows.push(["error", "present", error, "-"]);
   return rows;
 }

scripts/src/cicd-evidence.ts

@@ -0,0 +1,63 @@
+// SPEC: PJ2026-01060703 CI/CD branch follower bounded evidence helpers.
+// Responsibility: compact pipeline/runtime-ready and refresh evidence for status/drill-down output.
+
+export function compactRefreshEvidence(value: Record<string, unknown> | null): Record<string, unknown> | null {
+  if (value === null) return null;
+  const summary = asOptionalRecord(value.summary);
+  if (summary === null) return null;
+  return {
+    jobName: stringOrNull(value.jobName) ?? stringOrNull(summary.jobName),
+    namespace: stringOrNull(value.namespace) ?? stringOrNull(summary.namespace),
+    status: stringOrNull(summary.status),
+    pipeline: stringOrNull(summary.pipeline),
+    sourceCommit: stringOrNull(summary.sourceCommit),
+    sourceStageRef: stringOrNull(summary.sourceStageRef),
+    elapsedMs: numberOrNull(summary.elapsedMs),
+    sourceAuthority: stringOrNull(summary.sourceAuthority),
+    statusAuthority: stringOrNull(summary.statusAuthority),
+    parsedDownstreamCliOutput: false,
+  };
+}
+
+export function followerEvidenceSummary(input: {
+  observedSha: string | null;
+  livePayload: Record<string, unknown> | null;
+  storedCommand: Record<string, unknown> | null;
+}): Record<string, unknown> | null {
+  const livePayload = input.livePayload;
+  const storedPayload = asOptionalRecord(input.storedCommand?.payload);
+  const payload = livePayload ?? storedPayload;
+  if (payload === null) return null;
+  const tekton = asOptionalRecord(payload.tekton);
+  const pipeline = asOptionalRecord(payload.pipeline);
+  const refresh = asOptionalRecord(payload.refreshEvidence);
+  if (tekton === null && pipeline === null && refresh === null) return null;
+  const pipelineRefName = stringOrNull(tekton?.pipelineRefName);
+  const pipelineName = stringOrNull(asOptionalRecord(pipeline?.metadata)?.name);
+  const refreshPipeline = stringOrNull(refresh?.pipeline);
+  const refreshSourceCommit = stringOrNull(refresh?.sourceCommit);
+  return {
+    pipelineRunRefName: pipelineRefName,
+    pipeline,
+    refresh: refresh === null
+      ? null
+      : {
+          ...refresh,
+          pipelineRefMatches: pipelineRefName === null || refreshPipeline === null ? null : pipelineRefName === refreshPipeline,
+          pipelineSpecMatches: pipelineName === null || refreshPipeline === null ? null : pipelineName === refreshPipeline,
+          sourceCommitMatches: input.observedSha === null || refreshSourceCommit === null ? null : input.observedSha === refreshSourceCommit,
+        },
+  };
+}
+
+function asOptionalRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : null;
+}
+
+function stringOrNull(value: unknown): string | null {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+
+function numberOrNull(value: unknown): number | null {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}

scripts/src/cicd-native-bundle.ts

@@ -59,6 +59,7 @@ export function readNativeObjectBundle(registry: BranchFollowerRegistry, followe
     source: sourceRecord,
     gitMirror: asOptionalRecord(parsed.objects.gitMirror),
     pipelineRun: asOptionalRecord(parsed.objects.pipelineRun),
+    pipeline: asOptionalRecord(parsed.objects.pipeline),
     taskRuns: asOptionalRecord(parsed.objects.taskRuns),
     planArtifacts: asOptionalRecord(parsed.objects.planArtifacts),
     argoApplication: asOptionalRecord(parsed.objects.argoApplication),

scripts/src/cicd-native-summary.ts

@@ -50,6 +50,7 @@ export function nativePipelineRunSummary(pipelineRun: Record<string, unknown> |
   return {
     name: stringOrNull(metadata?.name),
     namespace: stringOrNull(metadata?.namespace),
+    pipelineRefName: stringOrNull(asOptionalRecord(pipelineRun.spec)?.pipelineRef?.name),
     succeeded: pipelineRunSucceeded(pipelineRun),
     reason: stringOrNull(condition?.reason),
     startTime: stringOrNull(status?.startTime),

scripts/src/cicd-native.ts

@@ -52,6 +52,7 @@ export function runNativeK8sJob(namespace: string, jobName: string, manifest: Re
     polls: numberOrNull(parsed?.polls) ?? 0,
     elapsedMs: numberOrNull(parsed?.elapsedMs) ?? 0,
     logsTail: stringOrNull(parsed?.logsTail),
+    summary: asOptionalRecord(parsed?.summary),
     conditionReason: stringOrNull(parsed?.conditionReason),
     conditionMessage: stringOrNull(parsed?.conditionMessage) ?? (result.exitCode === 0 ? null : tailText(result.stderr || result.stdout, 500)),
     statusAuthority: "kubernetes-api-serviceaccount",
@@ -70,6 +71,10 @@ function parseJsonObject(text: string): Record<string, unknown> | null {
   }
 }
 
+function asOptionalRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : null;
+}
+
 function stringOrNull(value: unknown): string | null {
   return typeof value === "string" && value.length > 0 ? value : null;
 }

scripts/src/cicd-render.ts

@@ -110,6 +110,7 @@ function renderStatusHuman(payload: Record<string, unknown>, _options: ParsedOpt
   const next = asOptionalRecord(payload.next);
   const errors = Array.isArray(payload.errors) ? payload.errors : [];
   const timingRows = followers.flatMap(timingRowsForFollower).slice(0, 48);
+  const evidenceRows = followers.flatMap(evidenceRowsForFollower).slice(0, 48);
   const reconcileRows = followers.flatMap(reconcileRowsForFollower).slice(0, 48);
   return [
     `CI/CD BRANCH-FOLLOWER STATUS (${payload.ok === false ? "degraded" : "ok"})`,
@@ -121,6 +122,7 @@ function renderStatusHuman(payload: Record<string, unknown>, _options: ParsedOpt
     "",
     table(["FOLLOWER", "PHASE", "ADAPTER", "OBSERVED", "TARGET", "TRIGGERED", "SUCCEEDED", "IN_FLIGHT", "BUDGET", "MESSAGE"], rows),
     timingRows.length === 0 ? "" : `\nSTAGE TIMINGS\n${table(["FOLLOWER", "STAGE", "STATUS", "SECONDS", "BUDGET", "OBJECT"], timingRows)}`,
+    evidenceRows.length === 0 ? "" : `\nEVIDENCE\n${table(["FOLLOWER", "TYPE", "STATUS", "DETAIL", "OBJECT"], evidenceRows)}`,
     reconcileRows.length === 0 ? "" : `\nRECONCILE TIMELINE\n${table(["FOLLOWER", "STEP", "STATUS", "SECONDS", "STARTED", "OBJECT"], reconcileRows)}`,
     errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`,
     "",
@@ -233,6 +235,28 @@ function reconcileRowsFromRunOnce(payload: Record<string, unknown>, followers: R
   return followers.flatMap(reconcileRowsForFollower);
 }
 
+function evidenceRowsForFollower(item: Record<string, unknown>): unknown[][] {
+  const evidence = asOptionalRecord(item.evidence);
+  if (evidence === null) return [];
+  const rows: unknown[][] = [];
+  rows.push([item.id, "pipelineRef", "observed", stringOrNull(evidence.pipelineRunRefName) ?? "-", stringOrNull(item.pipelineRun) ?? "-"]);
+  const pipeline = asOptionalRecord(evidence.pipeline);
+  if (pipeline !== null) {
+    const runtimeReady = asOptionalRecord(asOptionalRecord(pipeline.spec)?.runtimeReadyTask);
+    const when = arrayRecords(runtimeReady?.when)[0];
+    rows.push([
+      item.id,
+      "pipelineSpec",
+      runtimeReady?.present === true ? "runtime-ready-present" : "runtime-ready-absent",
+      when === undefined ? "-" : `${stringOrNull(when.input) ?? "-"} ${stringOrNull(when.operator) ?? "-"} ${arrayText(when.values) || "-"}`,
+      stringOrNull(asOptionalRecord(pipeline.metadata)?.name) ?? "-",
+    ]);
+  }
+  const refresh = asOptionalRecord(evidence.refresh);
+  if (refresh !== null) rows.push([item.id, "refresh", stringOrNull(refresh.status) ?? "-", `${shortSha(stringOrNull(refresh.sourceCommit))}/${boolMatch(refresh.pipelineRefMatches)}/${boolMatch(refresh.pipelineSpecMatches)}`, stringOrNull(refresh.pipeline) ?? "-"]);
+  return rows;
+}
+
 function reconcileRowsForFollower(item: Record<string, unknown>): unknown[][] {
   return reconcileRowsForTimeline(asOptionalRecord(item.reconcileTimeline), stringOrNull(item.id));
 }
@@ -261,6 +285,10 @@ function formatSeconds(value: number | null): string {
   return value === null ? "-" : `${value}s`;
 }
 
+function boolMatch(value: unknown): string {
+  return value === true ? "match" : value === false ? "mismatch" : "-";
+}
+
 function asOptionalRecord(value: unknown): Record<string, unknown> | null {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : null;
 }

scripts/src/cicd-types.ts

@@ -222,6 +222,7 @@ export interface NativeObjectBundle {
   source: Record<string, unknown> | null;
   gitMirror: Record<string, unknown> | null;
   pipelineRun: Record<string, unknown> | null;
+  pipeline: Record<string, unknown> | null;
   taskRuns: Record<string, unknown> | null;
   planArtifacts: Record<string, unknown> | null;
   argoApplication: Record<string, unknown> | null;
@@ -267,6 +268,7 @@ export interface NativeK8sJobResult {
   polls: number;
   elapsedMs: number;
   logsTail: string | null;
+  summary: Record<string, unknown> | null;
   conditionReason: string | null;
   conditionMessage: string | null;
   statusAuthority: "kubernetes-api-serviceaccount";