fix(reports): bind copied fixes to findings and route manual fixes without callbacks

[sxyseo]

Summary

Two follow-up fixes building on the merged Codex HTML report actions (PR #8):

• fix(reports): bind copied fixes to report findings so clipboard-copied fixes are associated with their source finding in the rendered report.
• fix(skills): route manual fixes without callbacks, allowing direct manual fix routing paths that do not require a callback round-trip.

Changes

• scripts/harness-analysis/render-report.mjs, renderers/html.mjs, renderers/html-interactions.mjs: associate copied fixes with findings.
• skills/better-harness/SKILL.md, references/manual-direct-fix.md: document and route manual direct fixes without callbacks.
• templates/reporting/html-visual.md, docs/better-harness-doc-links.mmd: update report guidance and the documentation link graph.
• Specs: docs/specs/2026-07-30-html-finding-fix-callback.md, docs/specs/2026-07-30-manual-direct-fix-routing.md.
• Tests: test/html-report-interactions.test.mjs, test/harness-report-render-cli.test.mjs, test/better-harness-skill.test.mjs.

Test plan

• node --test test/html-report-interactions.test.mjs test/harness-report-render-cli.test.mjs test/better-harness-skill.test.mjs
• node --test test/doc-link-graph.test.mjs
• npm test
• npm run pack:verify

Rebased onto latest upstream/main.

[phodal]

Review: scope creep beyond the two specs

The core HTML callback binding work (html.mjs / render-report.mjs and its tests) looks solid. However, several changes go beyond what the two specs authorize, and a few regressions slipped in.

1. SKILL.md description rewrite is out of spec scope

The original description lists eight trigger keywords (lifecycle controls, repeated work, project feedback, agent assets, session outcomes, repair planning, durable reports, finding-bound fixes) — this is the skill's trigger-routing surface. The PR collapses it to "reviews the outer coding-agent Harness or handles an explicitly requested manual or finding-bound fix", which:

• Degrades trigger recall for legitimate review invocations (e.g. "durable reports", "session outcomes").
• Broadens authority: "handles an explicitly requested manual … fix" turns /better-harness into a general-purpose fix command.
• Is covered by no AC in either spec (2026-07-30-manual-direct-fix-routing.md only asks for an entry router before Step 1), and is not mentioned in the PR body — an untraceable behavior change under the repo's change-traceability rules.

Request: revert the description. If manual fixes must be discoverable, append manual direct fixes to the existing keyword list instead of rewriting it.

2. Manual Direct Fix routing predicate is too broad

"If it expresses repair intent" is a fuzzy classifier and contradicts the spec's own non-goal ("Convert ordinary /better-harness reviews into code-changing tasks"). A request like "review my harness and fix issues" would bypass the entire evidence/review workflow and mutate code. Tighten the route to require an explicit fix instruction, and add a matching AC.

3. Step 5 silently drops the independent post-fix reassessment constraint

The PR deletes "Finding-bound repair uses [Finding-bound Fix] … A separate independent post-fix agent may update verified finding state" from Step 5. That is a behavioral guarantee (independent reassessment after repair), not covered by any AC, and the existing tests do not guard it. Please restore it.

4. Interaction regression for callback-less renders

html-interactions.mjs now reads only harness-report-actions. AC-3 claims a render without an action context stays "backward compatible" via an empty action binding — but Copy AI Fix buttons are still rendered unconditionally (2 per finding), and every click now fails with the missing-prompt error, whereas the previous code copied aiFixPrompt from harness-report-data. The validator passes while the interaction is broken, and no test covers this path. Either restore the fallback or add a regression test that defines the intended empty-binding behavior.

5. Smaller issues

• buildHtmlReportActions builds "\n\n<better-harness-fix-output>…" even when aiFixPrompt is empty, bypassing the old empty-prompt guard — users can copy a callback with no repair plan.
• The self-contained, shareable HTML now embeds absolute local paths (workspacePath, findingsPath). Sharing the report leaks local filesystem paths, and the callback is guaranteed to break off-machine.
• In test/html-report-interactions.test.mjs, the Windows fixture callback contains "C:\work\fixture" — \w is an invalid JSON escape, so the fixture's callback is unparseable. The test never parses it, so it passes, but it contradicts AC-3's "escapes Windows paths safely" claim.
• The spec evidence notes npm run preview smoke was skipped and that a packaged plugin backup was moved outside the repository — a task-external environment mutation worth flagging.

Summary of requested changes

1. Revert the description and Step 5 edits (append a keyword instead of rewriting).
2. Tighten the Manual Direct Fix trigger to explicit fix instructions and cover it with an AC.
3. Add a regression test for empty action binding + copy buttons, or restore the fallback.
4. Fix the Windows-path test fixture and the empty-aiFixPrompt guard.