Person C: blue-team gap fixes, dashboard, demo, docs (C1–C11)

[ezzy1630]

Implements Person C's deliverables (C1–C11) from docs/spec_person_c_repro_blue_demo.md. Branched off the shared baseline 2ca46dc (pushed here as person-c-base) so this PR shows only Person C's work — it does not include Person A's in-progress infra/ WIP.

Summary

An audit of the existing blue-team pipeline (C1–C8) against the spec's acceptance criteria found six gaps; all were closed test-first. The dashboard (C9), demo assets (C10), and final docs (C11) were then built.

164 tests pass · ruff clean · dashboard verified over HTTP.

C1–C8 — blue-team gap fixes (713b08c)

• C1 repro_writer — added the missing ## Confidence and Caveats section (replay reliability, root-cause certainty, evidence basis).
• C4 triage — added the missing repro_rate term to the priority formula (severity_weight × blast_radius × repro_rate / fix_complexity).
• C5 patch_generator — added expected_tests + confidence to PatchCandidate and the generation prompt/parser.
• C6 test_generator — added the third test type, a policy regression test that catches silent bypasses (behavior blocked but telemetry missing).
• C7 patch_verifier — expanded 3 gates → 6: diff-applies, control-plane weakening detection (7 checks), and telemetry-evidence.
• C8 regression_runner — surfaced flaky (oscillating) tests.

Interface changes are additive optional fields only (PatchCandidate, RegressionTestInput, RegressionRunResult) — backward-compatible with Person A's schema, no DB migration.

C9 — dashboard (fb0ed61)

Expanded infra/dashboard.py from 4 to the 8 spec views (overview, coverage heatmap, finding timeline, repro packages, blue team, evidence timeline, search intelligence, cost/model). Each view is a read-only query function with a matching /api/* endpoint. The page now builds its DOM with textContent instead of innerHTML, so LLM-authored KB text cannot inject markup. Adds test/test_dashboard.py (12 tests).

C10 — demo assets (5e08ad1)

• demo/seed_demo_db.py — deterministic, fully-populated KB seeded from the General Analysis "Securing Coding Agents" adversarial corpus + detection catalog.
• demo/run_hackathon_demo.sh — one-command runner; fallback mode needs no credentials, live mode runs one real cycle.
• demo/README.md, docs/demo_script.md, docs/judge_quickstart.md.

C11 — docs (a0900b0)

• README refresh: architecture diagram, "why continuous red/blue testing", project-status section.
• docs/pitch_script.md and docs/zone_failure_class_mapping.md (18 zones ↔ whitepaper failure classes).

Verification

• uv run pytest — 164 passed
• uv run ruff check — clean
• Dashboard serves all 8 endpoints over real HTTP against the seeded demo DB
• demo/seed_demo_db.py is idempotent

Notes for reviewers

• Base branch person-c-base is the shared committed baseline (2ca46dc) — review only the 5 commits on top.
• The Rust MCP server Argyph was evaluated for integration and intentionally not wired in: it is redundant with MonkeyClaw's existing infra/codebase_indexer.py + search_codebase, and would cross into Person A's infra/ ownership.

🤖 Generated with Claude Code