From b2f84d23e17083e7a014ed1d128e0e65a512de42 Mon Sep 17 00:00:00 2001
From: Ytallo Layon <ytallo.layon@gmail.com>
Date: Thu, 6 Aug 2026 12:44:59 -0300
Subject: [PATCH] (MOT-4368) feat(e2e): surface semantic validation health

---
 .github/benchmark-site/README.md              |  23 +-
 .github/benchmark-site/execution-data.js      |  99 ++-
 .../benchmark-site/execution-data.test.cjs    | 100 ++-
 .github/benchmark-site/execution.html         |  35 +-
 .github/benchmark-site/execution.js           |  85 +--
 .github/benchmark-site/index.html             | 162 +++--
 .../overview-structure.test.cjs               |  51 ++
 .github/benchmark-site/overview.js            |  65 +-
 .github/benchmark-site/sample-executions.js   | 344 +---------
 .github/benchmark-site/styles.css             | 124 +++-
 .../scripts/collect_harness_e2e_benchmarks.py |  32 +-
 .../scripts/publish_harness_e2e_dashboard.py  | 586 +++++++++++++++++-
 .../scripts/serve_harness_e2e_dashboard.py    |  10 +-
 .../test_collect_harness_e2e_benchmarks.py    |  80 +++
 .../test_publish_harness_e2e_dashboard.py     | 234 +++++++
 .../tests/test_serve_harness_e2e_dashboard.py |  28 +-
 .../test_validate_harness_e2e_manifests.py    | 144 +++++
 .../scripts/validate_harness_e2e_manifests.py | 248 ++++++++
 .github/workflows/_harness-e2e.yml            |  20 +-
 .github/workflows/harness-e2e-benchmark.yml   |  17 +
 20 files changed, 1945 insertions(+), 542 deletions(-)
 create mode 100644 .github/benchmark-site/overview-structure.test.cjs
 create mode 100644 .github/scripts/tests/test_validate_harness_e2e_manifests.py
 create mode 100644 .github/scripts/validate_harness_e2e_manifests.py

diff --git a/.github/benchmark-site/README.md b/.github/benchmark-site/README.md
index b83c178a6..1210d3193 100644
--- a/.github/benchmark-site/README.md
+++ b/.github/benchmark-site/README.md
@@ -3,7 +3,7 @@
 This static shell replaces the generic benchmark-action index at
 `dev/harness-e2e/`. The workflow-generated `data.js` remains the source of truth
 for metric trends. `executions.js` indexes workflow attempts, and
-`runs/<execution-id>.json` supplies the complete retained reports.
+`runs/<execution-id>.json` supplies compact retained diagnostics.
 
 Import the default local report and serve the real dashboard from the repository
 root:
@@ -45,22 +45,23 @@ Metric names are stable identifiers:
 ```
 
 The execution index retains 100 workflow attempts. The latest 30 also retain the
-complete structured `results.json` content, including prompts, transcripts,
-session ids, gates, criteria, failures, retries, usage, and traces. The UI loads
-those reports only on the detail page and renders transcript-heavy sections only
-when expanded. Each run opens its transcript in a read-only dialog patterned
-after the Harness chat, with message and error filters, paired function calls
-and results, and recovered errors expanded by default. Diagnostic logs, stack
-files, and credentials remain in access-controlled Actions artifacts.
+allowlisted diagnostic projection: execution identity, scenario outcomes,
+scores, metrics, cost, duration, retries, hard gates, and failure messages.
+Prompts, transcripts, model responses, criteria, traces, and tool payloads are
+never copied into Pages. They remain in access-controlled Actions artifacts
+alongside diagnostic logs and stack files.
+Each publish also rewrites retained schema 2 detail files through the same
+allowlist and removes unreferenced run files before deploying Pages.
 
 Each full execution summary also carries compact per-scenario averages for
 tokens, wall time, cost, function calls, function-call errors, sessions, and
 turns. Tokens mean input plus output; cache-read tokens are already represented
 in input usage and are not added again. The execution table also exposes exact
-total tokens and function calls for every retained full report.
+total tokens and function calls for every retained diagnostic report.
 
-Efficiency is the primary overview. Its cards show the current operational suite
-totals, while deltas use only successful scenarios with the same subject,
+Operational health is the primary overview. Efficiency appears after the latest
+status, completeness, first actionable failure, KPIs, and scenario matrix. Its
+cards show current suite totals, while deltas use only successful scenarios with the same subject,
 scenario id, and behavioral contract fingerprint. New and changed scenarios
 collect five comparable executions before receiving a trend verdict. Removed
 scenarios remain visible as historical rows and never count as an efficiency
diff --git a/.github/benchmark-site/execution-data.js b/.github/benchmark-site/execution-data.js
index 59af9f2c4..8c9278d52 100644
--- a/.github/benchmark-site/execution-data.js
+++ b/.github/benchmark-site/execution-data.js
@@ -114,13 +114,56 @@
     return [...scenarios].sort();
   }
 
-  function normalizeStatus(value) {
-    if (["passed", "failed", "incomplete", "cancelled"].includes(value)) return value;
+  function normalizeStatus(value, execution = {}) {
+    const semanticStatuses = [
+      "passed",
+      "quality_advisory",
+      "hard_gate_failed",
+      "technical_failed",
+      "infra_failed",
+      "incomplete",
+      "cancelled",
+      "running",
+    ];
+    if (semanticStatuses.includes(value)) return value;
     if (value === "pass" || value === "success") return "passed";
-    if (value === "fail" || value === "failure") return "failed";
+    if (value === "cancelled") return "cancelled";
+
+    // Schema 2 collapsed every complete non-pass into `failed`. Reconstruct
+    // the semantic outcome from its retained blocking counters.
+    if (value === "fail" || value === "failed" || value === "failure") {
+      const totals = execution?.totals || {};
+      if (Number(totals.missing_reports || 0) > 0) return "incomplete";
+      if (Number(totals.technical_failures || 0) > 0) return "technical_failed";
+      if (Number(totals.hard_gate_failures || 0) > 0) return "hard_gate_failed";
+      if (String(execution?.conclusion || "") !== "success") return "infra_failed";
+      const subjects = Array.isArray(execution?.subjects) ? execution.subjects : [];
+      if (subjects.length && subjects.some((subject) => !subject?.passed)) {
+        return "quality_advisory";
+      }
+      return "infra_failed";
+    }
     return "incomplete";
   }
 
+  function normalizeScenarioStatus(value) {
+    const scenario = value && typeof value === "object" ? value : {};
+    const status = String(scenario.status || "");
+    if (status === "cancelled") return "cancelled";
+    if (status === "running") return "running";
+    if (status === "missing_report" || status === "incomplete") return "incomplete";
+    if (status === "technical_failed" || Number(scenario.technical_failures || 0) > 0) {
+      return "technical_failed";
+    }
+    if (status === "hard_gate_failed" || Number(scenario.hard_gate_failures || 0) > 0) {
+      return "hard_gate_failed";
+    }
+    if (status === "infra_failed") return "infra_failed";
+    if (status === "quality_advisory") return "quality_advisory";
+    if (scenario.passed || status === "passed" || status === "success") return "passed";
+    return "quality_advisory";
+  }
+
   function normalizeExecution(entry) {
     const execution = entry && typeof entry === "object" ? entry : {};
     const subjects = Array.isArray(execution.subjects)
@@ -131,7 +174,7 @@
       id: String(execution.id || ""),
       run_id: String(execution.run_id || ""),
       attempt: Number(execution.attempt) || 1,
-      status: normalizeStatus(execution.status),
+      status: normalizeStatus(execution.status, execution),
       conclusion: String(execution.conclusion || ""),
       event: String(execution.event || ""),
       actor: String(execution.actor || ""),
@@ -166,7 +209,7 @@
     const scenarios = listLegacyScenarios(subject).map((scenarioId) => {
       const score = subject.metrics?.quality?.[scenarioId]?.median_score;
       const passRate = subject.metrics?.quality?.[scenarioId]?.pass_rate;
-      return {
+      const scenario = {
         id: scenarioId,
         status: score?.status || passRate?.status || "unknown",
         passed: score?.passed ?? passRate?.passed ?? false,
@@ -185,6 +228,7 @@
         wall_time_seconds:
           metricValue(subject, "efficiency", scenarioId, "wall_time_seconds"),
       };
+      return { ...scenario, status: normalizeScenarioStatus(scenario) };
     });
     return {
       id: subject.id,
@@ -194,7 +238,7 @@
       engine_revision: subject.engineRevision || "",
       passed: Boolean(subject.passed),
       expected_reports: scenarios.length,
-      received_reports: scenarios.filter((scenario) => scenario.status !== "missing_report")
+      received_reports: scenarios.filter((scenario) => scenario.status !== "incomplete")
         .length,
       scenario_pass_rate:
         (metricValue(subject, "quality", "suite", "scenario_pass_rate") ?? 0) / 100,
@@ -340,6 +384,32 @@
     });
   }
 
+  function latestHealthModel(entry) {
+    const execution = normalizeExecution(entry);
+    const release = execution.release || {};
+    const releaseIdentity = [release.worker, release.version]
+      .filter(Boolean)
+      .join("@");
+    const firstFailure =
+      execution.first_failure && typeof execution.first_failure === "object"
+        ? execution.first_failure
+        : null;
+    return {
+      status: execution.status,
+      lane: String(execution.lane || "daily"),
+      identity:
+        releaseIdentity ||
+        String(release.tag || "") ||
+        String(execution.source?.sha || "").slice(0, 12) ||
+        "Unknown",
+      expectedReports: Number(execution.totals?.expected_reports || 0),
+      receivedReports: Number(execution.totals?.received_reports || 0),
+      availability: execution.availability,
+      firstFailure,
+      workflowUrl: execution.workflow_url,
+    };
+  }
+
   function executionsWithinDays(executions, days, now = Date.now()) {
     const windowDays = Number(days);
     if (!Number.isFinite(windowDays) || windowDays <= 0) return [...(executions || [])];
@@ -384,18 +454,17 @@
     const subject = execution?.subjects?.find((item) => item.id === row.subjectId);
     const scenario = subject?.scenarios?.find((item) => item.id === row.scenarioId);
     if (!scenario) return null;
-    const status =
-      scenario.status === "missing_report"
-        ? "incomplete"
-        : scenario.passed
-          ? "passed"
-          : "failed";
+    const status = normalizeScenarioStatus(scenario);
     return { ...scenario, status };
   }
 
   function matrixCellLabel(cell, status) {
-    if (status === "failed") return "×";
+    if (["failed", "hard_gate_failed", "technical_failed", "infra_failed"].includes(status)) {
+      return "×";
+    }
+    if (status === "quality_advisory") return "!";
     if (status === "cancelled") return "○";
+    if (status === "running") return "•";
     if (status !== "passed") return "–";
 
     const score = numberOrNull(cell?.median_score);
@@ -527,7 +596,7 @@
     const technicalFailures = Number(scenario.technical_failures) || 0;
     return {
       passed: Boolean(scenario.passed),
-      complete: scenario.status !== "missing_report",
+      complete: normalizeScenarioStatus(scenario) !== "incomplete",
       hardGateFailures,
       technicalFailures,
       score: numberOrNull(scenario.median_score),
@@ -936,12 +1005,14 @@
     filterExecutions,
     findExecution,
     groupRunFailures,
+    latestHealthModel,
     legacyExecution,
     matrixCell,
     matrixCellLabel,
     matrixRows,
     mergeExecutionHistory,
     normalizeExecution,
+    normalizeScenarioStatus,
     normalizeStatus,
     scenarioMetricSeries,
     scenarioMetricRows,
diff --git a/.github/benchmark-site/execution-data.test.cjs b/.github/benchmark-site/execution-data.test.cjs
index c249c0b6c..30a649835 100644
--- a/.github/benchmark-site/execution-data.test.cjs
+++ b/.github/benchmark-site/execution-data.test.cjs
@@ -10,11 +10,13 @@ const {
   filterExecutions,
   findExecution,
   groupRunFailures,
+  latestHealthModel,
   matrixCell,
   matrixCellLabel,
   matrixRows,
   mergeExecutionHistory,
   normalizeExecution,
+  normalizeScenarioStatus,
   scenarioMetricSeries,
   scenarioMetricRows,
   scenarioMetricsFromDetail,
@@ -62,10 +64,74 @@ test("normalizes execution status and availability", () => {
   });
 
   assert.equal(normalized.id, "99");
-  assert.equal(normalized.status, "failed");
+  assert.equal(normalized.status, "infra_failed");
   assert.equal(normalized.availability, "unavailable");
 });
 
+test("normalizes schema 2 failures without turning workflow failures into advisories", () => {
+  assert.equal(
+    normalizeExecution({
+      status: "failed",
+      conclusion: "failure",
+      totals: {},
+      subjects: [{ passed: false }],
+    }).status,
+    "infra_failed",
+  );
+  assert.equal(
+    normalizeExecution({
+      status: "failed",
+      conclusion: "success",
+      totals: { technical_failures: 1, hard_gate_failures: 1 },
+      subjects: [{ passed: false }],
+    }).status,
+    "technical_failed",
+  );
+  assert.equal(
+    normalizeExecution({
+      status: "failed",
+      conclusion: "failure",
+      totals: { hard_gate_failures: 1 },
+      subjects: [{ passed: false }],
+    }).status,
+    "hard_gate_failed",
+  );
+  assert.equal(
+    normalizeExecution({
+      status: "failed",
+      conclusion: "success",
+      totals: {},
+      subjects: [{ passed: false }],
+    }).status,
+    "quality_advisory",
+  );
+});
+
+test("builds the latest health identity, completeness, and compact first failure", () => {
+  const model = latestHealthModel(
+    execution({
+      status: "infra_failed",
+      lane: "daily",
+      release: { worker: "harness", version: "1.7.3" },
+      totals: { expected_reports: 19, received_reports: 0 },
+      first_failure: {
+        kind: "job",
+        job_name: "harness e2e build",
+        step_name: "Validate E2E manifests and lockfiles",
+        message: "provider-deepseek/Cargo.lock needs to be updated",
+      },
+    }),
+  );
+
+  assert.equal(model.status, "infra_failed");
+  assert.equal(model.lane, "daily");
+  assert.equal(model.identity, "harness@1.7.3");
+  assert.equal(model.expectedReports, 19);
+  assert.equal(model.receivedReports, 0);
+  assert.equal(model.firstFailure.step_name, "Validate E2E manifests and lockfiles");
+  assert.equal(model.workflowUrl, "");
+});
+
 test("merges manifest executions and finds a retained detail", () => {
   const history = mergeExecutionHistory(
     {
@@ -168,6 +234,9 @@ test("builds subject and scenario matrix rows with result cells", () => {
   assert.equal(cell.median_score, 92);
   assert.equal(matrixCellLabel(cell, cell.status), "92%");
   assert.equal(matrixCellLabel({ passed: false }, "failed"), "×");
+  assert.equal(matrixCellLabel(null, "infra_failed"), "×");
+  assert.equal(matrixCellLabel(null, "quality_advisory"), "!");
+  assert.equal(matrixCellLabel(null, "running"), "•");
   assert.equal(matrixCellLabel(null, "incomplete"), "–");
   assert.equal(matrixCellLabel(null, "cancelled"), "○");
   assert.equal(
@@ -176,6 +245,35 @@ test("builds subject and scenario matrix rows with result cells", () => {
   );
 });
 
+test("normalizes scenario outcomes with the shared blocking precedence", () => {
+  assert.equal(normalizeScenarioStatus({ status: "missing_report" }), "incomplete");
+  assert.equal(
+    normalizeScenarioStatus({ status: "cancelled", technical_failures: 1 }),
+    "cancelled",
+  );
+  assert.equal(
+    normalizeScenarioStatus({
+      passed: false,
+      hard_gate_failures: 1,
+      technical_failures: 1,
+    }),
+    "technical_failed",
+  );
+  assert.equal(
+    normalizeScenarioStatus({ passed: false, hard_gate_failures: 1 }),
+    "hard_gate_failed",
+  );
+  assert.equal(
+    normalizeScenarioStatus({ passed: false, hard_gate_failures: 0 }),
+    "quality_advisory",
+  );
+  assert.equal(
+    normalizeScenarioStatus({ passed: true, hard_gate_failures: 1 }),
+    "hard_gate_failed",
+  );
+  assert.equal(normalizeScenarioStatus({ passed: true }), "passed");
+});
+
 test("derives aggregate legacy entries from benchmark snapshots", () => {
   const history = mergeExecutionHistory(null, {
     lastUpdate: 1,
diff --git a/.github/benchmark-site/execution.html b/.github/benchmark-site/execution.html
index d4d948cba..dc837da0b 100644
--- a/.github/benchmark-site/execution.html
+++ b/.github/benchmark-site/execution.html
@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta
       name="description"
-      content="Complete Harness E2E workflow execution details and diagnostics."
+      content="Compact Harness E2E workflow health, metrics, and diagnostics."
     >
     <meta name="color-scheme" content="dark light">
     <title>Harness E2E execution detail</title>
@@ -130,18 +130,18 @@ <h2 id="configuration-heading">Configuration</h2>
             </section>
 
             <section id="scenarios" class="detail-section" aria-labelledby="scenarios-heading">
-              <div class="section-kicker">Complete result set</div>
+              <div class="section-kicker">Compact result set</div>
               <h2 id="scenarios-heading">Scenarios and runs</h2>
               <p id="scenario-intro" class="section-description"></p>
               <div id="scenario-details" class="scenario-details"></div>
             </section>
 
             <section id="raw-data" class="detail-section" aria-labelledby="raw-heading">
-              <div class="section-kicker">Source record</div>
-              <h2 id="raw-heading">Raw data</h2>
+              <div class="section-kicker">Public diagnostic record</div>
+              <h2 id="raw-heading">Diagnostic JSON</h2>
               <p class="section-description">
-                The structured views above preserve the source report. Use the raw record for fields
-                that do not yet have a dedicated visualization.
+                This allowlisted record contains metrics, gates, and failure messages. Prompts,
+                transcripts, model responses, and tool payloads are not published.
               </p>
               <div id="raw-actions" class="raw-actions"></div>
               <details id="raw-preview" class="raw-details">
@@ -153,28 +153,6 @@ <h2 id="raw-heading">Raw data</h2>
         </div>
       </div>
 
-      <dialog
-        id="session-transcript-dialog"
-        class="session-transcript-dialog"
-        aria-labelledby="session-transcript-title"
-      >
-        <div class="session-transcript-shell">
-          <header class="session-transcript-header">
-            <div>
-              <div class="section-kicker">Session transcript</div>
-              <h2 id="session-transcript-title">Execution conversation</h2>
-              <p id="session-transcript-context"></p>
-            </div>
-            <button
-              id="session-transcript-close"
-              class="session-transcript-close"
-              type="button"
-              aria-label="Close session transcript"
-            >×</button>
-          </header>
-          <div id="session-transcript-body" class="session-transcript-body"></div>
-        </div>
-      </dialog>
     </main>
 
     <footer>
@@ -194,7 +172,6 @@ <h2 id="session-transcript-title">Execution conversation</h2>
     </script>
     <script src="./dashboard-data.js"></script>
     <script src="./execution-data.js"></script>
-    <script src="./execution-transcript.js"></script>
     <script src="./executions.js"></script>
     <script>
       if (!window.HARNESS_EXECUTIONS) {
diff --git a/.github/benchmark-site/execution.js b/.github/benchmark-site/execution.js
index d70196f3f..e62a510da 100644
--- a/.github/benchmark-site/execution.js
+++ b/.github/benchmark-site/execution.js
@@ -39,11 +39,6 @@
     score: document.querySelector("#detail-score"),
     status: document.querySelector("#execution-status"),
     subtitle: document.querySelector("#execution-subtitle"),
-    transcriptBody: document.querySelector("#session-transcript-body"),
-    transcriptClose: document.querySelector("#session-transcript-close"),
-    transcriptContext: document.querySelector("#session-transcript-context"),
-    transcriptDialog: document.querySelector("#session-transcript-dialog"),
-    transcriptTitle: document.querySelector("#session-transcript-title"),
     title: document.querySelector("#execution-title"),
     workflowLink: document.querySelector("#workflow-link"),
     workflowRuntime: document.querySelector("#workflow-runtime"),
@@ -124,6 +119,10 @@
     if (normalized === "passed" || normalized === "success") {
       return { label: "Passed", css: "pass" };
     }
+    if (normalized === "quality_advisory") {
+      return { label: "Quality Advisory", css: "advisory" };
+    }
+    if (normalized === "running") return { label: "Running", css: "running" };
     if (normalized === "cancelled") return { label: "Cancelled", css: "cancelled" };
     if (
       normalized === "failed" ||
@@ -137,6 +136,14 @@
     return { label: titleCase(normalized || "incomplete"), css: "incomplete" };
   }
 
+  function availabilityLabel(availability) {
+    return {
+      full: "Compact diagnostics",
+      aggregate: "Aggregate only",
+      unavailable: "No report",
+    }[availability] || "Unknown data";
+  }
+
   function scenarioAnchor(subjectId, scenarioId) {
     return `scenario-${subjectId}-${scenarioId}`.replace(/[^a-zA-Z0-9_-]/g, "-");
   }
@@ -173,11 +180,7 @@
     elements.status.textContent = meta.label;
     elements.availability.className =
       `data-badge data-${execution.availability}`;
-    elements.availability.textContent = {
-      full: "Full report",
-      aggregate: "Aggregate only",
-      unavailable: "No report",
-    }[execution.availability];
+    elements.availability.textContent = availabilityLabel(execution.availability);
     elements.subtitle.textContent =
       `${formatDate(execution.completed_at || execution.started_at)} · ` +
       `attempt ${execution.attempt} · ${titleCase(execution.event || "unknown trigger")}`;
@@ -326,7 +329,7 @@
         ${metadataItem("Engine revision", revisions.join(", ") || "Unknown", { mono: true })}
         ${metadataItem("Judge protocol", protocols.join(", ") || "Unknown")}
         ${metadataItem("Requested runs", execution.requested_runs ?? "Unknown")}
-        ${metadataItem("Report availability", titleCase(execution.availability))}
+        ${metadataItem("Report availability", availabilityLabel(execution.availability))}
       </div>
     `;
   }
@@ -358,11 +361,7 @@
 
   function renderAggregateScenario(subject, scenario, options = {}) {
     const meta = statusMeta(
-      scenario.status === "missing_report"
-        ? "incomplete"
-        : scenario.passed
-          ? "passed"
-          : "failed",
+      window.HarnessExecutionData.normalizeScenarioStatus(scenario),
     );
     const anchor = scenarioAnchor(subject.id, scenario.id);
     const open = scenario.passed === false || options.soleScenario;
@@ -661,22 +660,14 @@
     `;
   }
 
-  function renderConversationLaunch(messages, run) {
-    const transcript = window.HarnessExecutionTranscript;
-    const events = transcript.normalizeTranscript(messages);
-    const summary = transcript.summarizeTranscript(events);
+  function renderConversationLaunch(run) {
     return `
       <section class="conversation-launch">
         <div>
-          <span>Session transcript</span>
-          <strong>${summary.messages} messages · ${summary.calls} functions</strong>
-          <small class="${summary.errors ? "has-errors" : ""}">
-            ${summary.errors
-              ? `${summary.errors} error${summary.errors === 1 ? "" : "s"} to inspect`
-              : `${escapeHtml(run.session_id || "No session id")} · read-only`}
-          </small>
+          <span>Public diagnostic detail</span>
+          <strong>Prompts and transcripts are not published</strong>
+          <small>${escapeHtml(run.session_id || "No session id")} · metrics and failures only</small>
         </div>
-        <button type="button" class="conversation-open">Open chat</button>
       </section>
     `;
   }
@@ -860,7 +851,7 @@
 
   function renderRawTab(panel, run) {
     panel.innerHTML = runSection(
-      "Complete run record",
+      "Compact diagnostic record",
       '<pre class="prompt-block"></pre>',
       { wide: true },
     );
@@ -870,15 +861,10 @@
   const RUN_TABS = [
     { id: "evaluation", label: "Evaluation", render: renderEvaluationTab },
     { id: "usage", label: "Usage", render: renderUsageTab },
-    { id: "prompt", label: "Prompt", render: renderPromptTab },
-    { id: "sessions", label: "Sessions", render: renderSessionsTab },
-    { id: "raw", label: "Raw", render: renderRawTab },
+    { id: "raw", label: "Diagnostic JSON", render: renderRawTab },
   ];
 
-  function renderRunContent(container, run, context) {
-    const messages = Array.isArray(run.transcript?.messages)
-      ? run.transcript.messages
-      : [];
+  function renderRunContent(container, run) {
     container.innerHTML = `
       <div class="run-overview">
         ${metricBlock("Score", compactNumber(run.score, 1))}
@@ -888,7 +874,7 @@
         ${metricBlock("Retries", compactNumber(run.retry_attempts?.length || 0, 0))}
         ${metricBlock("Session", run.session_id || "Unknown")}
       </div>
-      ${renderConversationLaunch(messages, run)}
+      ${renderConversationLaunch(run)}
       <div class="run-tabs" role="tablist" aria-label="Run diagnostics">
         ${RUN_TABS.map(
           (tab) =>
@@ -900,9 +886,6 @@
           `<div class="run-sections" role="tabpanel" data-panel="${tab.id}" hidden></div>`,
       ).join("")}
     `;
-    container.querySelector(".conversation-open")?.addEventListener("click", () => {
-      openConversationDialog(run, context);
-    });
     const buttons = [...container.querySelectorAll(".run-tabs button")];
     const activateRunTab = (tabId) => {
       RUN_TABS.forEach((tab) => {
@@ -933,8 +916,14 @@
     );
     if (!scenario) return "";
     const subjectId = record.subject_id;
-    const meta = statusMeta(scenario.passed ? "passed" : "failed");
     const aggregate = scenario.aggregate || {};
+    const meta = statusMeta(
+      window.HarnessExecutionData.normalizeScenarioStatus({
+        ...scenario,
+        hard_gate_failures: aggregate.hard_gate_failures,
+        technical_failures: aggregate.technical_failures,
+      }),
+    );
     const policy = scenario.execution_policy || {};
     const anchor = scenarioAnchor(subjectId, scenario.scenario_id);
     const failingRun = (scenario.runs || []).some(
@@ -1023,16 +1012,7 @@
           const container = element.querySelector(".run-content[data-pending='true']");
           if (!container) return;
           container.removeAttribute("data-pending");
-          renderRunContent(container, run, {
-            runIndex: index,
-            scenarioId: record.scenario_id,
-            subjectLabel: [
-              record.report?.subject?.provider,
-              record.report?.subject?.model,
-            ]
-              .filter(Boolean)
-              .join("/"),
-          });
+          renderRunContent(container, run);
         });
       });
     });
@@ -1066,7 +1046,7 @@
     }
     elements.scenarioIntro.textContent =
       execution.availability === "aggregate"
-        ? "The complete report expired after 30 executions. Historical aggregate metrics remain available."
+        ? "The compact diagnostic report expired after 30 executions. Historical aggregate metrics remain available."
         : "This workflow did not produce a complete benchmark report.";
     const aggregateCount = execution.subjects.reduce(
       (total, subject) => total + (subject.scenarios || []).length,
@@ -1242,7 +1222,6 @@
   }
 
   async function initialize() {
-    attachTranscriptDialogControls();
     attachAnchorNavigation();
     if (!execution) {
       elements.loading.hidden = true;
diff --git a/.github/benchmark-site/index.html b/.github/benchmark-site/index.html
index 10da97655..2c3773a9d 100644
--- a/.github/benchmark-site/index.html
+++ b/.github/benchmark-site/index.html
@@ -40,7 +40,7 @@
             Harness E2E
           </div>
           <h1 id="page-title">Execution dashboard</h1>
-          <p>Workflow-level health with scenario results and complete run diagnostics.</p>
+          <p>Workflow-level health with scenario results and compact run diagnostics.</p>
         </div>
         <div class="sync-block">
           <span id="sync-label">Last published</span>
@@ -55,13 +55,103 @@ <h2 id="empty-title">No executions published</h2>
       </section>
 
       <div id="overview-content">
+        <section class="panel latest-health" aria-labelledby="latest-health-heading">
+          <div class="latest-health-heading">
+            <div>
+              <div class="section-kicker">Latest daily execution</div>
+              <div class="latest-health-title">
+                <h2 id="latest-health-heading">Operational health</h2>
+                <span id="latest-status" class="status-pill status-incomplete">Waiting</span>
+              </div>
+            </div>
+            <a id="latest-run-link" class="button button-secondary" href="#">
+              View workflow <span aria-hidden="true">↗</span>
+            </a>
+          </div>
+          <dl class="latest-health-facts">
+            <div><dt>Lane</dt><dd id="latest-lane">—</dd></div>
+            <div><dt>Source / release</dt><dd id="latest-identity">—</dd></div>
+            <div><dt>Report completeness</dt><dd id="latest-completeness">—</dd></div>
+          </dl>
+          <div id="latest-failure" class="failure-callout" hidden>
+            <div>
+              <strong id="latest-failure-title">First actionable issue</strong>
+              <span id="latest-failure-detail"></span>
+            </div>
+            <a id="latest-failure-link" class="text-link" href="#" hidden>
+              Inspect job <span aria-hidden="true">↗</span>
+            </a>
+          </div>
+        </section>
+
+        <div class="section-divider-heading">
+          <div>
+            <div class="section-kicker">Outcome guardrails</div>
+            <h2>Latest execution health</h2>
+          </div>
+          <p>Efficiency improvements remain advisory when outcomes regress.</p>
+        </div>
+
+        <section class="kpi-grid execution-kpis" aria-label="Latest execution summary">
+          <article class="kpi-card kpi-primary">
+            <div class="kpi-label">Latest result</div>
+            <div id="kpi-status" class="kpi-value kpi-status-value">—</div>
+            <div id="kpi-status-caption" class="kpi-delta">No execution</div>
+            <div class="kpi-orbit" aria-hidden="true"></div>
+          </article>
+          <article class="kpi-card">
+            <div class="kpi-label">Scenario pass rate</div>
+            <div id="kpi-pass-rate" class="kpi-value">—</div>
+            <div id="kpi-coverage" class="kpi-delta">—</div>
+          </article>
+          <article class="kpi-card">
+            <div class="kpi-label">Quality score</div>
+            <div id="kpi-score" class="kpi-value">—</div>
+            <div class="kpi-delta">Mean of scenario medians</div>
+          </article>
+          <article class="kpi-card">
+            <div class="kpi-label">Reliability events</div>
+            <div id="kpi-failures" class="kpi-value">—</div>
+            <div class="kpi-delta">Gates, technical failures, and missing reports</div>
+          </article>
+          <article class="kpi-card">
+            <div class="kpi-label">Model cost</div>
+            <div id="kpi-cost" class="kpi-value">—</div>
+            <div id="kpi-runtime" class="kpi-delta">—</div>
+          </article>
+        </section>
+
+        <section class="panel health-panel" aria-labelledby="health-heading">
+          <div class="panel-heading">
+            <div>
+              <div class="section-kicker">Execution by execution</div>
+              <h2 id="health-heading">Scenario health matrix</h2>
+              <p class="trend-description">
+                Columns are workflow attempts. Select a cell to inspect that execution and scenario.
+              </p>
+            </div>
+            <div class="range-toggle" role="group" aria-label="Matrix execution count">
+              <button class="range-button active" type="button" data-count="14">14 runs</button>
+              <button class="range-button" type="button" data-count="30">30 runs</button>
+            </div>
+          </div>
+          <div class="matrix-legend" aria-label="Result legend">
+            <span><i class="matrix-key matrix-passed matrix-key-score" aria-hidden="true">92%</i> Score reached</span>
+            <span><i class="matrix-key matrix-quality_advisory" aria-hidden="true">!</i> Quality advisory</span>
+            <span><i class="matrix-key matrix-failed" aria-hidden="true">×</i> Blocking failure</span>
+            <span><i class="matrix-key matrix-incomplete" aria-hidden="true">–</i> Incomplete</span>
+            <span><i class="matrix-key matrix-cancelled" aria-hidden="true">○</i> Cancelled</span>
+          </div>
+          <div id="health-matrix" class="health-matrix-wrap" aria-live="polite"></div>
+        </section>
+
         <section
           class="panel efficiency-overview"
           aria-labelledby="efficiency-overview-heading"
         >
           <div class="panel-heading efficiency-heading">
             <div>
-              <div class="section-kicker">Primary view</div>
+              <div class="section-kicker">Efficiency after health</div>
               <h2 id="efficiency-overview-heading">Efficiency overview</h2>
               <p class="trend-description">
                 Every figure below — value, delta, and trend — reads the
@@ -130,66 +220,6 @@ <h2 id="efficiency-overview-heading">Efficiency overview</h2>
           </div>
         </section>
 
-        <div class="section-divider-heading">
-          <div>
-            <div class="section-kicker">Outcome guardrails</div>
-            <h2>Latest execution health</h2>
-          </div>
-          <p>Efficiency improvements remain advisory when outcomes regress.</p>
-        </div>
-
-        <section class="kpi-grid execution-kpis" aria-label="Latest execution summary">
-          <article class="kpi-card kpi-primary">
-            <div class="kpi-label">Latest result</div>
-            <div id="kpi-status" class="kpi-value kpi-status-value">—</div>
-            <div id="kpi-status-caption" class="kpi-delta">No execution</div>
-            <div class="kpi-orbit" aria-hidden="true"></div>
-          </article>
-          <article class="kpi-card">
-            <div class="kpi-label">Scenario pass rate</div>
-            <div id="kpi-pass-rate" class="kpi-value">—</div>
-            <div id="kpi-coverage" class="kpi-delta">—</div>
-          </article>
-          <article class="kpi-card">
-            <div class="kpi-label">Quality score</div>
-            <div id="kpi-score" class="kpi-value">—</div>
-            <div class="kpi-delta">Mean of scenario medians</div>
-          </article>
-          <article class="kpi-card">
-            <div class="kpi-label">Reliability events</div>
-            <div id="kpi-failures" class="kpi-value">—</div>
-            <div class="kpi-delta">Gates, technical failures, and missing reports</div>
-          </article>
-          <article class="kpi-card">
-            <div class="kpi-label">Model cost</div>
-            <div id="kpi-cost" class="kpi-value">—</div>
-            <div id="kpi-runtime" class="kpi-delta">—</div>
-          </article>
-        </section>
-
-        <section class="panel health-panel" aria-labelledby="health-heading">
-          <div class="panel-heading">
-            <div>
-              <div class="section-kicker">Execution by execution</div>
-              <h2 id="health-heading">Scenario health matrix</h2>
-              <p class="trend-description">
-                Columns are workflow attempts. Select a cell to inspect that execution and scenario.
-              </p>
-            </div>
-            <div class="range-toggle" role="group" aria-label="Matrix execution count">
-              <button class="range-button active" type="button" data-count="14">14 runs</button>
-              <button class="range-button" type="button" data-count="30">30 runs</button>
-            </div>
-          </div>
-          <div class="matrix-legend" aria-label="Result legend">
-            <span><i class="matrix-key matrix-passed matrix-key-score" aria-hidden="true">92%</i> Score reached</span>
-            <span><i class="matrix-key matrix-failed" aria-hidden="true">×</i> Failed</span>
-            <span><i class="matrix-key matrix-incomplete" aria-hidden="true">–</i> Incomplete</span>
-            <span><i class="matrix-key matrix-cancelled" aria-hidden="true">○</i> Cancelled</span>
-          </div>
-          <div id="health-matrix" class="health-matrix-wrap" aria-live="polite"></div>
-        </section>
-
         <section class="panel executions-panel" aria-labelledby="executions-heading">
           <div class="panel-heading executions-heading">
             <div>
@@ -208,9 +238,13 @@ <h2 id="executions-heading">All executions</h2>
               <select id="status-filter">
                 <option value="all">All statuses</option>
                 <option value="passed">Passed</option>
-                <option value="failed">Failed</option>
+                <option value="quality_advisory">Quality advisory</option>
+                <option value="hard_gate_failed">Hard gate failed</option>
+                <option value="technical_failed">Technical failure</option>
+                <option value="infra_failed">Infrastructure failure</option>
                 <option value="incomplete">Incomplete</option>
                 <option value="cancelled">Cancelled</option>
+                <option value="running">Running</option>
               </select>
             </label>
             <label>
@@ -322,7 +356,7 @@ <h2 id="scenario-history-title">Scenario</h2>
     </main>
 
     <footer>
-      <span>Harness E2E · 100 summaries · 30 complete reports</span>
+      <span>Harness E2E · 100 summaries · 30 compact diagnostic reports</span>
       <a href="https://github.com/iii-hq/workers/tree/main/harness/tests/e2e">
         Suite documentation <span aria-hidden="true">↗</span>
       </a>
diff --git a/.github/benchmark-site/overview-structure.test.cjs b/.github/benchmark-site/overview-structure.test.cjs
new file mode 100644
index 000000000..dc8041e2f
--- /dev/null
+++ b/.github/benchmark-site/overview-structure.test.cjs
@@ -0,0 +1,51 @@
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const root = __dirname;
+const index = fs.readFileSync(path.join(root, "index.html"), "utf8");
+const execution = fs.readFileSync(path.join(root, "execution.html"), "utf8");
+const sampleExecutions = fs.readFileSync(
+  path.join(root, "sample-executions.js"),
+  "utf8",
+);
+const styles = fs.readFileSync(path.join(root, "styles.css"), "utf8");
+
+test("places operational health before scenarios, efficiency, and history", () => {
+  const latest = index.indexOf('class="panel latest-health"');
+  const matrix = index.indexOf('class="panel health-panel"');
+  const efficiency = index.indexOf('class="panel efficiency-overview"');
+  const executions = index.indexOf('class="panel executions-panel"');
+
+  assert.ok(latest >= 0);
+  assert.ok(latest < matrix);
+  assert.ok(matrix < efficiency);
+  assert.ok(efficiency < executions);
+});
+
+test("keeps hidden preview and diagnostic controls out of layout", () => {
+  assert.match(index, /id="preview-badge"[^>]+hidden/);
+  assert.match(styles, /\[hidden\]\s*\{[^}]*display:\s*none\s*!important;/s);
+});
+
+test("offers every semantic execution status as a filter", () => {
+  for (const status of [
+    "passed",
+    "quality_advisory",
+    "hard_gate_failed",
+    "technical_failed",
+    "infra_failed",
+    "incomplete",
+    "cancelled",
+    "running",
+  ]) {
+    assert.match(index, new RegExp(`<option value="${status}">`));
+  }
+});
+
+test("publishes diagnostics without transcript or prompt surfaces", () => {
+  assert.doesNotMatch(execution, /execution-transcript\.js|session-transcript-dialog/);
+  assert.match(execution, /Prompts,\s*transcripts, model responses/s);
+  assert.doesNotMatch(sampleExecutions, /["'](?:prompt|transcript)["']\s*:/);
+});
diff --git a/.github/benchmark-site/overview.js b/.github/benchmark-site/overview.js
index cd0fdd3c2..4c6ed91bf 100644
--- a/.github/benchmark-site/overview.js
+++ b/.github/benchmark-site/overview.js
@@ -121,6 +121,15 @@
     kpiScore: document.querySelector("#kpi-score"),
     kpiStatus: document.querySelector("#kpi-status"),
     kpiStatusCaption: document.querySelector("#kpi-status-caption"),
+    latestCompleteness: document.querySelector("#latest-completeness"),
+    latestFailure: document.querySelector("#latest-failure"),
+    latestFailureDetail: document.querySelector("#latest-failure-detail"),
+    latestFailureLink: document.querySelector("#latest-failure-link"),
+    latestFailureTitle: document.querySelector("#latest-failure-title"),
+    latestIdentity: document.querySelector("#latest-identity"),
+    latestLane: document.querySelector("#latest-lane"),
+    latestRunLink: document.querySelector("#latest-run-link"),
+    latestStatus: document.querySelector("#latest-status"),
     lastUpdate: document.querySelector("#last-update"),
     matrix: document.querySelector("#health-matrix"),
     next: document.querySelector("#next-page"),
@@ -241,8 +250,13 @@
     return {
       passed: { label: "Passed", short: "", css: "pass" },
       failed: { label: "Failed", short: "×", css: "fail" },
+      quality_advisory: { label: "Quality advisory", short: "!", css: "advisory" },
+      hard_gate_failed: { label: "Hard gate failed", short: "×", css: "fail" },
+      technical_failed: { label: "Technical failure", short: "×", css: "fail" },
+      infra_failed: { label: "Infrastructure failure", short: "×", css: "fail" },
       incomplete: { label: "Incomplete", short: "–", css: "incomplete" },
       cancelled: { label: "Cancelled", short: "○", css: "cancelled" },
+      running: { label: "Running", short: "•", css: "running" },
     }[status] || { label: "Unknown", short: "?", css: "incomplete" };
   }
 
@@ -255,6 +269,43 @@
     );
   }
 
+  function renderLatestHealth() {
+    const latest = history.executions[0];
+    if (!latest) return;
+    const model = executionApi.latestHealthModel(latest);
+    const meta = statusMeta(model.status);
+    elements.latestStatus.textContent = meta.label;
+    elements.latestStatus.className = `status-pill status-${meta.css}`;
+    elements.latestLane.textContent = titleCase(model.lane);
+    elements.latestIdentity.textContent = model.identity;
+    elements.latestCompleteness.textContent = model.expectedReports
+      ? `${model.receivedReports}/${model.expectedReports} reports · ${dataLabel(model.availability)}`
+      : dataLabel(model.availability);
+
+    const workflowUrl = safeUrl(model.workflowUrl);
+    elements.latestRunLink.hidden = !workflowUrl;
+    if (workflowUrl) elements.latestRunLink.href = workflowUrl;
+
+    const issue = model.firstFailure;
+    elements.latestFailure.hidden = !issue;
+    if (!issue) return;
+    elements.latestFailure.classList.toggle("failure-advisory", issue.kind === "quality");
+    elements.latestFailureTitle.textContent =
+      issue.kind === "quality" ? "First quality advisory" : "First actionable failure";
+    const context = [
+      issue.job_name,
+      issue.step_name,
+      issue.subject_id,
+      issue.scenario_id,
+      issue.id,
+    ].filter(Boolean);
+    elements.latestFailureDetail.textContent =
+      `${context.length ? `${context.join(" · ")} — ` : ""}${issue.message || "No diagnostic message"}`;
+    const issueUrl = safeUrl(issue.url);
+    elements.latestFailureLink.hidden = !issueUrl;
+    if (issueUrl) elements.latestFailureLink.href = issueUrl;
+  }
+
   function renderKpis() {
     const latest = history.executions[0];
     if (!latest) return;
@@ -652,11 +703,9 @@
         const status =
           execution.status === "cancelled"
             ? "cancelled"
-            : !scenario || scenario.status === "missing_report"
+            : !scenario
               ? "incomplete"
-              : scenario.passed
-                ? "passed"
-                : "failed";
+              : executionApi.normalizeScenarioStatus(scenario);
         return { execution, metric, scenario, status };
       })
       .filter(Boolean)
@@ -1049,7 +1098,10 @@
       executions.forEach((execution) => {
         const cell = executionApi.matrixCell(execution, row);
         const cellStatus =
-          execution.status === "cancelled" ? "cancelled" : cell?.status || "incomplete";
+          cell?.status ||
+          (["cancelled", "running", "infra_failed"].includes(execution.status)
+            ? execution.status
+            : "incomplete");
         const meta = statusMeta(cellStatus);
         const cellLabel = executionApi.matrixCellLabel(cell, cellStatus);
         const data = document.createElement("td");
@@ -1074,7 +1126,7 @@
 
   function dataLabel(availability) {
     return {
-      full: "Full report",
+      full: "Diagnostic detail",
       aggregate: "Aggregate",
       unavailable: "No report",
     }[availability] || "Unknown";
@@ -1156,6 +1208,7 @@
     elements.empty.hidden = hasData;
     elements.content.hidden = !hasData;
     if (!hasData) return;
+    renderLatestHealth();
     renderKpis();
     renderEfficiency();
     renderMatrix();
diff --git a/.github/benchmark-site/sample-executions.js b/.github/benchmark-site/sample-executions.js
index acc5908f5..c31917e31 100644
--- a/.github/benchmark-site/sample-executions.js
+++ b/.github/benchmark-site/sample-executions.js
@@ -19,13 +19,15 @@
       event: index === 3 ? "workflow_dispatch" : "schedule",
       actor: index === 3 ? "iii-team" : "github-actions",
       conclusion:
-        execution.status === "passed"
+        execution.status === "passed" || execution.status === "quality_advisory"
           ? "success"
           : execution.status === "cancelled"
             ? "cancelled"
             : "failure",
-      availability: index < 3 ? "full" : "aggregate",
-      detail_path: index < 3 ? `runs/${id}.json` : null,
+      // Preview data intentionally uses aggregates only. The published Pages
+      // contract never includes prompts, transcripts, responses, or tool payloads.
+      availability: "aggregate",
+      detail_path: null,
       workflow_duration_seconds:
         (execution.totals?.wall_time_seconds || 0) + 104,
       execution: {
@@ -38,344 +40,12 @@
     };
   });
 
-  function modelArtifact(subject) {
-    return {
-      model: subject.model,
-      provider: subject.provider,
-      context_window: 1000000,
-      max_output_tokens: 128000,
-      supports_tools: true,
-      supports_vision: false,
-    };
-  }
-
-  function previewRun(execution, subject, scenario, runIndex) {
-    const status = scenario.passed
-      ? "passed"
-      : scenario.hard_gate_failures
-        ? "hard_gate_failed"
-        : "quality_failed";
-    const runId = `${execution.run_id.slice(-4)}-${scenario.id}-${runIndex + 1}`;
-    const recoveredError =
-      scenario.id === "reactive_automation" && runIndex === 1;
-    return {
-      run_id: runId,
-      session_id: `e2e_${runId}`,
-      prompt:
-        `Run the ${scenario.id} E2E scenario against ${subject.provider}/${subject.model}. ` +
-        "Use the registered tools, preserve the requested invariants, and report the evidence.",
-      wall_time_ms: Math.round(
-        ((scenario.wall_time_seconds || 30) * 1000) /
-          Math.max(1, execution.requested_runs || 3),
-      ),
-      score: scenario.median_score,
-      status,
-      hard_gates: [
-        {
-          id: "required_state_present",
-          passed: !scenario.hard_gate_failures,
-          reason: scenario.hard_gate_failures
-            ? "The expected state record was not found."
-            : "All expected state records were present.",
-        },
-      ],
-      criteria: [
-        {
-          id: "task_completion",
-          possible: 60,
-          awarded: Math.min(60, Math.round((scenario.median_score || 0) * 0.6)),
-          reason: "Awarded from the observed task result and persisted evidence.",
-        },
-        {
-          id: "tool_discipline",
-          possible: 40,
-          awarded: Math.min(40, Math.round((scenario.median_score || 0) * 0.4)),
-          reason: "Awarded for bounded tool use and a factual final response.",
-        },
-      ],
-      transcript: {
-        messages: [
-          {
-            entry_id: "message-1",
-            message: {
-              role: "user",
-              timestamp: "2026-07-30T12:00:00Z",
-              content: [
-                {
-                  type: "text",
-                  text: "Complete the benchmark task and record verifiable evidence.",
-                },
-              ],
-            },
-          },
-          {
-            entry_id: "message-2",
-            origin: "assistant",
-            message: {
-              role: "assistant",
-              model: subject.model,
-              provider: subject.provider,
-              timestamp: "2026-07-30T12:00:01Z",
-              content: [
-                {
-                  type: "text",
-                  text: "I will inspect the available functions, execute the scenario, and verify the resulting state.",
-                },
-                {
-                  type: "function_call",
-                  id: "call-worker-add",
-                  function_id: "worker::add",
-                  arguments: {
-                    source: { kind: "registry", name: "state" },
-                  },
-                },
-              ],
-            },
-          },
-          {
-            entry_id: "result-1",
-            origin: "function",
-            message: {
-              role: "function_result",
-              function_call_id: "call-worker-add",
-              function_id: "worker::add",
-              is_error: false,
-              timestamp: "2026-07-30T12:00:02Z",
-              details: { name: "state", status: "ready", version: "0.8.1" },
-              content: [
-                {
-                  type: "text",
-                  text: "{\"name\":\"state\",\"status\":\"ready\",\"version\":\"0.8.1\"}",
-                },
-              ],
-            },
-          },
-          {
-            entry_id: "message-3",
-            origin: "assistant",
-            message: {
-              role: "assistant",
-              model: subject.model,
-              provider: subject.provider,
-              timestamp: "2026-07-30T12:00:03Z",
-              content: [
-                {
-                  type: "function_call",
-                  id: "call-state-read",
-                  function_id: "state::get",
-                  arguments: { key: `benchmark:${scenario.id}:result` },
-                },
-              ],
-            },
-          },
-          {
-            entry_id: "result-2",
-            origin: "function",
-            message: {
-              role: "function_result",
-              function_call_id: "call-state-read",
-              function_id: "state::get",
-              is_error: recoveredError,
-              timestamp: "2026-07-30T12:00:04Z",
-              details: recoveredError
-                ? {
-                    error:
-                      "State was not available on the first read. The agent recovered and verified it on the next step.",
-                  }
-                : { value: { status: "verified", scenario: scenario.id } },
-              content: [
-                {
-                  type: "text",
-                  text: recoveredError
-                    ? "State was not available on the first read."
-                    : `{\"value\":{\"status\":\"verified\",\"scenario\":\"${scenario.id}\"}}`,
-                },
-              ],
-            },
-          },
-          {
-            entry_id: "message-4",
-            origin: "assistant",
-            message: {
-              role: "assistant",
-              model: subject.model,
-              provider: subject.provider,
-              timestamp: "2026-07-30T12:00:05Z",
-              content: [
-                {
-                  type: "text",
-                  text: recoveredError
-                    ? "The initial read failed, but the final state and required effects were independently verified."
-                    : "The final state and all required effects were verified successfully.",
-                },
-              ],
-            },
-          },
-        ],
-      },
-      metrics: {
-        complete: true,
-        root_session_id: `e2e_${runId}`,
-        totals: {
-          sessions: scenario.id === "reactive_automation" ? 7 : 1,
-          turns: scenario.id === "reactive_automation" ? 122 : 9,
-          function_calls: scenario.id === "reactive_automation" ? 151 : 6,
-          function_call_errors:
-            Number(scenario.hard_gate_failures || 0) + Number(recoveredError),
-          input_tokens: scenario.id === "reactive_automation" ? 1136424 : 18420,
-          output_tokens: scenario.id === "reactive_automation" ? 22648 : 2180,
-          cache_read_tokens: scenario.id === "reactive_automation" ? 1042368 : 12000,
-          reasoning_tokens: 0,
-          cost_usd:
-            (scenario.total_cost_usd || 0) /
-            Math.max(1, execution.requested_runs || 3),
-        },
-        by_session: [
-          {
-            session_id: `e2e_${runId}`,
-            depth: 0,
-            turns: 9,
-            function_calls: 6,
-            function_call_errors:
-              Number(scenario.hard_gate_failures || 0) + Number(recoveredError),
-            input_tokens: 18420,
-            output_tokens: 2180,
-            cache_read_tokens: 12000,
-            reasoning_tokens: 0,
-            cost_usd:
-              (scenario.total_cost_usd || 0) /
-              Math.max(1, execution.requested_runs || 3),
-          },
-        ],
-        traces: {
-          trace_count: 3,
-          span_count: 48,
-          error_span_count: scenario.hard_gate_failures || 0,
-          duration_ms: Math.round(scenario.wall_time_seconds * 1000),
-          by_session: [],
-        },
-      },
-      judge_attempts: scenario.passed ? 1 : 2,
-      judge_usage: {
-        input_tokens: 2900,
-        output_tokens: 240,
-        cost_usd: 0.014,
-      },
-      cost: {
-        subject_usd: (scenario.total_cost_usd || 0) * 0.8,
-        judge_usd: (scenario.total_cost_usd || 0) * 0.2,
-        total_usd: scenario.total_cost_usd,
-      },
-      retry_attempts: Array.from({ length: scenario.retries || 0 }, (_, retryIndex) => ({
-        run_id: `${runId}-retry-${retryIndex + 1}`,
-        session_id: `retry_${runId}_${retryIndex + 1}`,
-        wall_time_ms: 12000,
-        status: "subject_error",
-        cost: { subject_usd: 0.02, judge_usd: 0, total_usd: 0.02 },
-        failures: [{ phase: "execute", message: "Transient provider timeout." }],
-      })),
-      failures: scenario.passed
-        ? []
-        : [
-            {
-              phase: scenario.hard_gate_failures ? "evaluate" : "collect",
-              message: scenario.hard_gate_failures
-                ? "A required hard gate did not pass."
-                : "The score did not meet the scenario threshold.",
-            },
-          ],
-    };
-  }
-
-  function previewDetail(execution) {
-    const reports = [];
-    execution.subjects.forEach((subject) => {
-      subject.scenarios.forEach((scenario) => {
-        const runs = Array.from(
-          { length: execution.requested_runs || 3 },
-          (_, index) => previewRun(execution, subject, scenario, index),
-        );
-        reports.push({
-          subject_id: subject.id,
-          scenario_id: scenario.id,
-          available: true,
-          report: {
-            subject: modelArtifact(subject),
-            judge: {
-              model: subject.judge?.model || "claude-sonnet-4-6",
-              provider: subject.judge?.provider || "anthropic",
-              context_window: 1000000,
-              max_output_tokens: 128000,
-              supports_tools: true,
-              supports_vision: true,
-            },
-            judge_protocol: "plain-json",
-            engine_revision: subject.engine_revision,
-            passed: scenario.passed,
-            scenarios: [
-              {
-                scenario_id: scenario.id,
-                scenario_version: scenario.scenario_version || 1,
-                threshold: scenario.threshold,
-                execution_policy: {
-                  max_turns: scenario.id === "reactive_automation" ? 64 : 16,
-                  max_total_tokens:
-                    scenario.id === "reactive_automation" ? 2000000 : 250000,
-                  stuck_timeout_seconds: 600,
-                },
-                aggregate: {
-                  runs: runs.length,
-                  scored_runs: runs.filter((run) => run.score !== null).length,
-                  passed_runs: runs.filter((run) => run.status === "passed").length,
-                  required_passes: 2,
-                  pass_rate: scenario.pass_rate,
-                  median_score: scenario.median_score,
-                  hard_gate_failures: scenario.hard_gate_failures,
-                  technical_failures: scenario.technical_failures,
-                  cost: {
-                    subject_usd: (scenario.total_cost_usd || 0) * 0.8,
-                    judge_usd: (scenario.total_cost_usd || 0) * 0.2,
-                    total_usd: scenario.total_cost_usd,
-                  },
-                },
-                passed: scenario.passed,
-                runs,
-              },
-            ],
-          },
-        });
-      });
-    });
-    return {
-      schema_version: 2,
-      execution: execution.execution,
-      generated_at: execution.completed_at,
-      lane: execution.lane,
-      source: execution.source,
-      workflow_url: execution.workflow_url,
-      release: execution.release,
-      requested_runs: execution.requested_runs,
-      subjects: execution.subjects,
-      reports,
-    };
-  }
-
-  const details = Object.fromEntries(
-    executions
-      .filter((execution) => execution.availability === "full")
-      .map((execution) => {
-        const detail = previewDetail(execution);
-        execution.scenario_metrics = executionApi.scenarioMetricsFromDetail(detail);
-        return [execution.id, detail];
-      }),
-  );
-
   window.HARNESS_EXECUTIONS = {
-    schema_version: 2,
+    schema_version: 3,
     last_update: executions[0]?.completed_at,
     repo_url: "https://github.com/iii-hq/workers",
     retention: { summaries: 100, details: 30 },
     executions,
   };
-  window.HARNESS_EXECUTION_DETAILS = details;
+  window.HARNESS_EXECUTION_DETAILS = {};
 })();
diff --git a/.github/benchmark-site/styles.css b/.github/benchmark-site/styles.css
index b58cf3421..f375752b5 100644
--- a/.github/benchmark-site/styles.css
+++ b/.github/benchmark-site/styles.css
@@ -30,6 +30,10 @@
   box-sizing: border-box;
 }
 
+[hidden] {
+  display: none !important;
+}
+
 html {
   background: var(--bg);
   scroll-behavior: smooth;
@@ -473,6 +477,15 @@ a:focus-visible {
   font-size: 0.78rem;
 }
 
+.failure-callout.failure-advisory {
+  border-color: rgba(255, 209, 102, 0.24);
+  background: rgba(255, 209, 102, 0.055);
+}
+
+.failure-callout.failure-advisory strong {
+  color: var(--warning);
+}
+
 .failure-callout span {
   color: var(--text-soft);
   font-size: 0.72rem;
@@ -1154,7 +1167,71 @@ footer {
   margin-top: 4px;
 }
 
+.latest-health {
+  padding: 26px 30px;
+  border-color: rgba(199, 255, 74, 0.18);
+  background:
+    radial-gradient(circle at 100% 0, rgba(199, 255, 74, 0.075), transparent 34%),
+    var(--surface);
+}
+
+.latest-health-heading,
+.latest-health-title {
+  display: flex;
+  align-items: center;
+}
+
+.latest-health-heading {
+  justify-content: space-between;
+  gap: 24px;
+}
+
+.latest-health-title {
+  flex-wrap: wrap;
+  gap: 14px;
+}
+
+.latest-health-title h2 {
+  margin: 0;
+  font-size: 1.45rem;
+  font-weight: 590;
+  letter-spacing: -0.035em;
+}
+
+.latest-health-facts {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 12px;
+  margin: 22px 0 0;
+}
+
+.latest-health-facts > div {
+  min-width: 0;
+  padding: 13px 14px;
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  background: rgba(255, 255, 255, 0.022);
+}
+
+.latest-health-facts dt {
+  color: var(--text-muted);
+  font-size: 0.61rem;
+  font-weight: 700;
+  letter-spacing: 0.07em;
+  text-transform: uppercase;
+}
+
+.latest-health-facts dd {
+  margin: 7px 0 0;
+  overflow: hidden;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+  font-size: 0.72rem;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
 .efficiency-overview {
+  margin-top: 24px;
   padding: 30px;
   overflow: hidden;
   border-color: rgba(123, 199, 255, 0.22);
@@ -1646,6 +1723,14 @@ footer {
   color: var(--warning);
 }
 
+.text-advisory {
+  color: var(--warning);
+}
+
+.text-running {
+  color: var(--accent-blue);
+}
+
 .text-cancelled {
   color: var(--text-soft);
 }
@@ -1656,6 +1741,18 @@ footer {
   color: var(--text-soft);
 }
 
+.status-advisory {
+  border-color: rgba(255, 209, 102, 0.28);
+  background: rgba(255, 209, 102, 0.08);
+  color: var(--warning);
+}
+
+.status-running {
+  border-color: rgba(123, 199, 255, 0.28);
+  background: rgba(123, 199, 255, 0.08);
+  color: var(--accent-blue);
+}
+
 .health-panel,
 .executions-panel {
   margin-top: 20px;
@@ -1881,12 +1978,27 @@ footer {
   color: var(--success);
 }
 
-.matrix-failed {
+.matrix-failed,
+.matrix-hard_gate_failed,
+.matrix-technical_failed,
+.matrix-infra_failed {
   border-color: rgba(255, 120, 111, 0.3);
   background: rgba(255, 120, 111, 0.13);
   color: var(--danger);
 }
 
+.matrix-quality_advisory {
+  border-color: rgba(255, 209, 102, 0.3);
+  background: rgba(255, 209, 102, 0.1);
+  color: var(--warning);
+}
+
+.matrix-running {
+  border-color: rgba(123, 199, 255, 0.3);
+  background: rgba(123, 199, 255, 0.1);
+  color: var(--accent-blue);
+}
+
 .matrix-incomplete {
   border-color: rgba(255, 209, 102, 0.3);
   background: rgba(255, 209, 102, 0.1);
@@ -3358,6 +3470,15 @@ footer {
     flex-direction: column;
   }
 
+  .latest-health-heading {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
+  .latest-health-facts {
+    grid-template-columns: 1fr;
+  }
+
   .kpi-grid {
     grid-template-columns: repeat(2, minmax(0, 1fr));
   }
@@ -3498,6 +3619,7 @@ footer {
   }
 
   .latest-release,
+  .latest-health,
   .trend-panel,
   .history-panel {
     padding: 22px 18px;
diff --git a/.github/scripts/collect_harness_e2e_benchmarks.py b/.github/scripts/collect_harness_e2e_benchmarks.py
index e5f7f343d..f4d065d4d 100644
--- a/.github/scripts/collect_harness_e2e_benchmarks.py
+++ b/.github/scripts/collect_harness_e2e_benchmarks.py
@@ -72,6 +72,24 @@ def optional_number(value: Any, label: str) -> float | None:
     return require_number(value, label)
 
 
+def semantic_result_status(
+    *,
+    passed: bool,
+    hard_gate_failures: int,
+    technical_failures: int,
+    complete: bool = True,
+) -> str:
+    if not complete:
+        return "incomplete"
+    if technical_failures:
+        return "technical_failed"
+    if hard_gate_failures:
+        return "hard_gate_failed"
+    if not passed:
+        return "quality_advisory"
+    return "passed"
+
+
 def parse_subjects(raw: str) -> list[dict[str, str]]:
     try:
         subjects = json.loads(raw)
@@ -385,7 +403,11 @@ def collect(
             if isinstance(report.get("judge"), dict):
                 resolved_judge = report["judge"]
 
-            status = "passed" if report_passed else "failed"
+            status = semantic_result_status(
+                passed=report_passed,
+                hard_gate_failures=hard_gates,
+                technical_failures=technical,
+            )
             extra = {
                 **base_extra,
                 "judge": report.get("judge") or base_extra["judge"],
@@ -545,6 +567,12 @@ def collect(
             and subject_passed == expected_count
             and technical_failures == 0
         )
+        suite_status = semantic_result_status(
+            passed=suite_passed,
+            hard_gate_failures=hard_gate_failures,
+            technical_failures=technical_failures,
+            complete=all_reports_present,
+        )
         engine_revision = (
             next(iter(engine_revisions)) if len(engine_revisions) == 1 else None
         )
@@ -573,7 +601,7 @@ def collect(
             "scenario": "suite",
             "requested_runs": config.requested_runs,
             "passed": suite_passed,
-            "status": "passed" if suite_passed else "failed",
+            "status": suite_status,
             "expected_reports": expected_count,
             "received_reports": report_count,
         }
diff --git a/.github/scripts/publish_harness_e2e_dashboard.py b/.github/scripts/publish_harness_e2e_dashboard.py
index 21c86bd9b..93c40b03c 100644
--- a/.github/scripts/publish_harness_e2e_dashboard.py
+++ b/.github/scripts/publish_harness_e2e_dashboard.py
@@ -9,8 +9,15 @@
 from pathlib import Path
 from typing import Any
 
-SCHEMA_VERSION = 2
+SCHEMA_VERSION = 3
 MANIFEST_PREFIX = "window.HARNESS_EXECUTIONS = "
+FAILURE_CONCLUSIONS = {
+    "action_required",
+    "failure",
+    "startup_failure",
+    "stale",
+    "timed_out",
+}
 
 
 class PublishError(ValueError):
@@ -44,6 +51,37 @@ def load_manifest(path: Path) -> dict[str, Any]:
     return value
 
 
+def validate_artifact_identity(
+    value: dict[str, Any] | None,
+    metadata: dict[str, Any],
+    *,
+    label: str,
+) -> tuple[dict[str, Any] | None, dict[str, Any] | None]:
+    if value is None:
+        return None, None
+    execution = value.get("execution")
+    if not isinstance(execution, dict):
+        return None, {
+            "kind": "artifact_identity",
+            "message": f"Ignored {label}: execution identity is missing",
+        }
+    actual_run_id = str(execution.get("run_id") or "")
+    actual_attempt = int(
+        optional_number(execution.get("attempt") or execution.get("run_attempt"))
+        or 0
+    )
+    expected_run_id = str(metadata["run_id"])
+    expected_attempt = int(metadata["attempt"])
+    if actual_run_id == expected_run_id and actual_attempt == expected_attempt:
+        return value, None
+    actual = f"{actual_run_id or 'unknown'} attempt {actual_attempt or 'unknown'}"
+    expected = f"{expected_run_id} attempt {expected_attempt}"
+    return None, {
+        "kind": "artifact_identity",
+        "message": f"Ignored {label} from {actual}; expected {expected}",
+    }
+
+
 def optional_number(value: Any) -> float | None:
     if isinstance(value, bool) or not isinstance(value, (int, float)):
         return None
@@ -219,6 +257,246 @@ def build_execution_efficiency_totals(detail: dict[str, Any]) -> dict[str, float
     }
 
 
+def _pick(value: Any, keys: tuple[str, ...]) -> dict[str, Any]:
+    source = value if isinstance(value, dict) else {}
+    return {key: source[key] for key in keys if key in source}
+
+
+def _public_failures(value: Any) -> list[dict[str, Any]]:
+    if not isinstance(value, list):
+        return []
+    return [
+        _pick(failure, ("phase", "message"))
+        for failure in value
+        if isinstance(failure, dict)
+    ]
+
+
+def _public_gates(value: Any) -> list[dict[str, Any]]:
+    if not isinstance(value, list):
+        return []
+    return [
+        _pick(gate, ("id", "passed", "reason"))
+        for gate in value
+        if isinstance(gate, dict)
+    ]
+
+
+def _public_metrics(value: Any) -> dict[str, Any] | None:
+    if not isinstance(value, dict):
+        return None
+    totals = _pick(
+        value.get("totals"),
+        (
+            "input_tokens",
+            "output_tokens",
+            "cache_read_tokens",
+            "cache_creation_tokens",
+            "reasoning_tokens",
+            "function_calls",
+            "function_call_errors",
+            "sessions",
+            "turns",
+            "cost_usd",
+        ),
+    )
+    return {"totals": totals} if totals else None
+
+
+def _public_retry(value: Any) -> dict[str, Any] | None:
+    if not isinstance(value, dict):
+        return None
+    retry = _pick(value, ("run_id", "session_id", "wall_time_ms", "status"))
+    retry["cost"] = _pick(value.get("cost"), ("subject_usd", "judge_usd", "total_usd"))
+    retry["failures"] = _public_failures(value.get("failures"))
+    return retry
+
+
+def _public_run(value: Any) -> dict[str, Any] | None:
+    if not isinstance(value, dict):
+        return None
+    run = _pick(
+        value,
+        (
+            "run_id",
+            "session_id",
+            "wall_time_ms",
+            "score",
+            "status",
+            "judge_attempts",
+        ),
+    )
+    metrics = _public_metrics(value.get("metrics"))
+    if metrics is not None:
+        run["metrics"] = metrics
+    run["cost"] = _pick(value.get("cost"), ("subject_usd", "judge_usd", "total_usd"))
+    run["hard_gates"] = _public_gates(value.get("hard_gates"))
+    run["failures"] = _public_failures(value.get("failures"))
+    retries = [
+        retry
+        for item in value.get("retry_attempts", [])
+        if (retry := _public_retry(item)) is not None
+    ] if isinstance(value.get("retry_attempts"), list) else []
+    run["retry_attempts"] = retries
+    return run
+
+
+def _public_scenario(value: Any) -> dict[str, Any] | None:
+    if not isinstance(value, dict):
+        return None
+    scenario = _pick(
+        value,
+        ("scenario_id", "scenario_version", "passed", "threshold"),
+    )
+    aggregate = _pick(
+        value.get("aggregate"),
+        (
+            "runs",
+            "scored_runs",
+            "passed_runs",
+            "required_passes",
+            "pass_rate",
+            "median_score",
+            "hard_gate_failures",
+            "technical_failures",
+        ),
+    )
+    raw_aggregate = value.get("aggregate")
+    if isinstance(raw_aggregate, dict):
+        aggregate["cost"] = _pick(
+            raw_aggregate.get("cost"),
+            ("subject_usd", "judge_usd", "total_usd"),
+        )
+    scenario["aggregate"] = aggregate
+    scenario["runs"] = [
+        run
+        for item in value.get("runs", [])
+        if (run := _public_run(item)) is not None
+    ] if isinstance(value.get("runs"), list) else []
+    return scenario
+
+
+def _public_subject_summary(value: Any) -> dict[str, Any] | None:
+    if not isinstance(value, dict):
+        return None
+    subject = _pick(
+        value,
+        (
+            "id",
+            "model",
+            "provider",
+            "engine_revision",
+            "passed",
+            "expected_reports",
+            "received_reports",
+            "scenario_pass_rate",
+            "report_coverage",
+            "hard_gate_failures",
+            "technical_failures",
+            "retry_attempts",
+            "total_cost_usd",
+            "wall_time_seconds",
+        ),
+    )
+    subject["judge"] = _pick(value.get("judge"), ("model", "provider", "protocol"))
+    subject["scenarios"] = [
+        _pick(
+            scenario,
+            (
+                "id",
+                "status",
+                "passed",
+                "threshold",
+                "runs",
+                "median_score",
+                "pass_rate",
+                "hard_gate_failures",
+                "technical_failures",
+                "retries",
+                "total_cost_usd",
+                "wall_time_seconds",
+            ),
+        )
+        for scenario in value.get("scenarios", [])
+        if isinstance(scenario, dict)
+    ] if isinstance(value.get("scenarios"), list) else []
+    return subject
+
+
+def compact_public_detail(
+    detail: dict[str, Any],
+    metadata: dict[str, Any],
+) -> dict[str, Any]:
+    """Project raw execution evidence into the diagnostics-safe Pages contract."""
+    public_metadata = _pick(
+        metadata,
+        (
+            "id",
+            "run_id",
+            "attempt",
+            "workflow_name",
+            "workflow_url",
+            "event",
+            "actor",
+            "started_at",
+            "completed_at",
+            "conclusion",
+            "head_sha",
+            "head_branch",
+            "repository",
+        ),
+    )
+    public = {
+        "schema_version": SCHEMA_VERSION,
+        "execution": {
+            **_pick(
+                detail.get("execution"),
+                ("id", "run_id", "attempt", "event", "actor", "workflow_url"),
+            ),
+            **public_metadata,
+        },
+        "generated_at": str(detail.get("generated_at") or ""),
+        "lane": str(detail.get("lane") or "daily"),
+        "source": _pick(detail.get("source"), ("sha", "ref", "repository")),
+        "workflow_url": str(detail.get("workflow_url") or metadata.get("workflow_url") or ""),
+        "release": _pick(
+            detail.get("release"),
+            ("tag", "worker", "version", "url", "registry_tag"),
+        ),
+        "requested_runs": detail.get("requested_runs"),
+        "subjects": [
+            subject
+            for item in detail.get("subjects", [])
+            if (subject := _public_subject_summary(item)) is not None
+        ] if isinstance(detail.get("subjects"), list) else [],
+        "reports": [],
+    }
+    reports = detail.get("reports", [])
+    if not isinstance(reports, list):
+        return public
+    for record in reports:
+        if not isinstance(record, dict):
+            continue
+        public_record = _pick(record, ("subject_id", "scenario_id", "available"))
+        report = record.get("report")
+        if isinstance(report, dict):
+            public_record["report"] = {
+                "subject": _pick(report.get("subject"), ("model", "provider")),
+                "judge": _pick(report.get("judge"), ("model", "provider", "protocol")),
+                "engine_revision": report.get("engine_revision"),
+                "passed": report.get("passed"),
+                "scenarios": [
+                    scenario
+                    for item in report.get("scenarios", [])
+                    if (scenario := _public_scenario(item)) is not None
+                ] if isinstance(report.get("scenarios"), list) else [],
+            }
+        else:
+            public_record["report"] = None
+        public["reports"].append(public_record)
+    return public
+
+
 def elapsed_seconds(started_at: str, completed_at: str) -> float | None:
     if not started_at or not completed_at:
         return None
@@ -235,21 +513,196 @@ def execution_status(
     subjects: list[dict[str, Any]],
     expected_reports: int,
     received_reports: int,
+    hard_gate_failures: int,
+    technical_failures: int,
+    *,
+    has_failed_job: bool = False,
 ) -> str:
     if conclusion == "cancelled":
         return "cancelled"
-    if not subjects or expected_reports == 0 or received_reports < expected_reports:
+    if not conclusion:
+        return "running"
+    if not subjects or expected_reports == 0:
+        if conclusion in FAILURE_CONCLUSIONS or has_failed_job:
+            return "infra_failed"
         return "incomplete"
-    if conclusion != "success" or not all(
-        bool(subject.get("passed")) for subject in subjects
-    ):
-        return "failed"
+    if received_reports < expected_reports:
+        return "incomplete"
+    if technical_failures:
+        return "technical_failed"
+    if hard_gate_failures:
+        return "hard_gate_failed"
+    if conclusion != "success" or has_failed_job:
+        return "infra_failed"
+    if not all(bool(subject.get("passed")) for subject in subjects):
+        return "quality_advisory"
     return "passed"
 
 
+def _compact_message(value: Any, fallback: str) -> str:
+    message = " ".join(str(value or "").split()) or fallback
+    return message[:500]
+
+
+def failed_job_diagnostic(jobs_document: dict[str, Any] | None) -> dict[str, Any] | None:
+    jobs = jobs_document.get("jobs", []) if jobs_document else []
+    if not isinstance(jobs, list):
+        return None
+    failed_jobs = [
+        job
+        for job in jobs
+        if isinstance(job, dict) and job.get("conclusion") in FAILURE_CONCLUSIONS
+    ]
+    failed_jobs.sort(key=lambda job: (str(job.get("started_at") or ""), str(job.get("name") or "")))
+    if not failed_jobs:
+        return None
+    job = failed_jobs[0]
+    steps = job.get("steps", [])
+    failed_steps = [
+        step
+        for step in steps
+        if isinstance(step, dict) and step.get("conclusion") in FAILURE_CONCLUSIONS
+    ] if isinstance(steps, list) else []
+    failed_steps.sort(
+        key=lambda step: (
+            int(optional_number(step.get("number")) or 0),
+            str(step.get("name") or ""),
+        )
+    )
+    step = failed_steps[0] if failed_steps else None
+    job_name = str(job.get("name") or "workflow job")
+    step_name = str(step.get("name") or "") if step else ""
+    return {
+        "kind": "job",
+        "job_name": job_name,
+        "step_name": step_name,
+        "message": _compact_message(
+            f"{job_name}: {step_name}" if step_name else f"{job_name} failed",
+            "Workflow job failed",
+        ),
+        "url": str(job.get("html_url") or ""),
+    }
+
+
+def _report_scenarios(detail: dict[str, Any] | None) -> list[tuple[str, str, dict[str, Any]]]:
+    reports = detail.get("reports", []) if detail else []
+    if not isinstance(reports, list):
+        return []
+    result = []
+    for report_entry in reports:
+        if not isinstance(report_entry, dict) or not report_entry.get("available"):
+            continue
+        report = report_entry.get("report", {})
+        scenarios = report.get("scenarios", []) if isinstance(report, dict) else []
+        if not isinstance(scenarios, list):
+            continue
+        for scenario in scenarios:
+            if isinstance(scenario, dict):
+                result.append(
+                    (
+                        str(report_entry.get("subject_id") or ""),
+                        str(scenario.get("scenario_id") or report_entry.get("scenario_id") or ""),
+                        scenario,
+                    )
+                )
+    return result
+
+
+def report_diagnostic(
+    status: str,
+    snapshot: dict[str, Any] | None,
+    detail: dict[str, Any] | None,
+) -> dict[str, Any] | None:
+    if status == "incomplete" and snapshot:
+        for subject in snapshot.get("subjects", []):
+            if not isinstance(subject, dict):
+                continue
+            for scenario in subject.get("scenarios", []):
+                if isinstance(scenario, dict) and scenario.get("status") == "missing_report":
+                    subject_id = str(subject.get("id") or "")
+                    scenario_id = str(scenario.get("id") or "")
+                    return {
+                        "kind": "missing_report",
+                        "subject_id": subject_id,
+                        "scenario_id": scenario_id,
+                        "message": f"Missing report for {subject_id}/{scenario_id}",
+                    }
+
+    if status == "technical_failed":
+        for subject_id, scenario_id, scenario in _report_scenarios(detail):
+            runs = scenario.get("runs", [])
+            if not isinstance(runs, list):
+                continue
+            for run in runs:
+                failures = run.get("failures", []) if isinstance(run, dict) else []
+                if not isinstance(failures, list) or not failures:
+                    continue
+                failure = next((item for item in failures if isinstance(item, dict)), None)
+                if failure:
+                    return {
+                        "kind": "technical",
+                        "subject_id": subject_id,
+                        "scenario_id": scenario_id,
+                        "phase": str(failure.get("phase") or "execute"),
+                        "message": _compact_message(
+                            failure.get("message"), "Technical execution failure"
+                        ),
+                    }
+
+    if status == "hard_gate_failed":
+        for subject_id, scenario_id, scenario in _report_scenarios(detail):
+            runs = scenario.get("runs", [])
+            if not isinstance(runs, list):
+                continue
+            for run in runs:
+                gates = run.get("hard_gates", []) if isinstance(run, dict) else []
+                if not isinstance(gates, list):
+                    continue
+                gate = next(
+                    (
+                        item
+                        for item in gates
+                        if isinstance(item, dict) and not item.get("passed", False)
+                    ),
+                    None,
+                )
+                if gate:
+                    return {
+                        "kind": "hard_gate",
+                        "subject_id": subject_id,
+                        "scenario_id": scenario_id,
+                        "id": str(gate.get("id") or ""),
+                        "message": _compact_message(gate.get("reason"), "Hard gate failed"),
+                    }
+
+    if status == "quality_advisory" and snapshot:
+        for subject in snapshot.get("subjects", []):
+            if not isinstance(subject, dict):
+                continue
+            for scenario in subject.get("scenarios", []):
+                if not isinstance(scenario, dict) or scenario.get("passed"):
+                    continue
+                score = optional_number(scenario.get("median_score"))
+                threshold = optional_number(scenario.get("threshold"))
+                description = "Quality result did not meet the scenario threshold"
+                if score is not None and threshold is not None:
+                    description = f"Median score {score:g} is below threshold {threshold:g}"
+                return {
+                    "kind": "quality",
+                    "subject_id": str(subject.get("id") or ""),
+                    "scenario_id": str(scenario.get("id") or ""),
+                    "message": description,
+                }
+    return None
+
+
 def build_summary(
     snapshot: dict[str, Any] | None,
     metadata: dict[str, Any],
+    *,
+    detail: dict[str, Any] | None = None,
+    jobs_document: dict[str, Any] | None = None,
+    artifact_failure: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     subjects = snapshot.get("subjects", []) if snapshot else []
     if not isinstance(subjects, list):
@@ -295,11 +748,22 @@ def build_summary(
     )
     missing_reports = max(0, expected_reports - received_reports)
     conclusion = metadata["conclusion"]
+    job_failure = failed_job_diagnostic(jobs_document)
     status = execution_status(
         conclusion,
         valid_subjects,
         expected_reports,
         received_reports,
+        hard_gate_failures,
+        technical_failures,
+        has_failed_job=job_failure is not None,
+    )
+    first_failure = (
+        job_failure or artifact_failure
+        if status == "infra_failed"
+        else report_diagnostic(status, snapshot, detail)
+        or artifact_failure
+        or job_failure
     )
     snapshot_execution = snapshot.get("execution", {}) if snapshot else {}
     if not isinstance(snapshot_execution, dict):
@@ -317,6 +781,7 @@ def build_summary(
         "completed_at": metadata["completed_at"],
         "conclusion": conclusion,
         "status": status,
+        "first_failure": first_failure,
         "workflow_duration_seconds": elapsed_seconds(
             metadata["started_at"], metadata["completed_at"]
         ),
@@ -368,11 +833,58 @@ def sort_key(execution: dict[str, Any]) -> tuple[str, int]:
     return str(timestamp), int(execution.get("attempt") or 0)
 
 
+def _metadata_from_summary(execution: dict[str, Any]) -> dict[str, Any]:
+    source = execution.get("source", {})
+    if not isinstance(source, dict):
+        source = {}
+    return {
+        "id": str(execution.get("id") or ""),
+        "run_id": str(execution.get("run_id") or ""),
+        "attempt": int(optional_number(execution.get("attempt")) or 1),
+        "workflow_name": str(execution.get("workflow_name") or ""),
+        "workflow_url": str(execution.get("workflow_url") or ""),
+        "event": str(execution.get("event") or ""),
+        "actor": str(execution.get("actor") or ""),
+        "started_at": str(execution.get("started_at") or ""),
+        "completed_at": str(execution.get("completed_at") or ""),
+        "conclusion": str(execution.get("conclusion") or ""),
+        "head_sha": str(source.get("sha") or ""),
+        "head_branch": str(source.get("ref") or ""),
+        "repository": str(source.get("repository") or ""),
+    }
+
+
+def sanitize_retained_details(
+    site_dir: Path,
+    manifest: dict[str, Any],
+) -> None:
+    """Migrate retained schema 2 reports before the updated site is published."""
+    runs_dir = site_dir / "runs"
+    for execution in manifest.get("executions", []):
+        if not isinstance(execution, dict):
+            continue
+        relative_path = execution.get("detail_path")
+        if not isinstance(relative_path, str) or not relative_path.startswith("runs/"):
+            continue
+        candidate = site_dir / relative_path
+        if candidate.parent != runs_dir or not candidate.is_file():
+            continue
+        retained = load_json(candidate)
+        if retained is None:
+            continue
+        public_detail = compact_public_detail(
+            retained,
+            _metadata_from_summary(execution),
+        )
+        candidate.write_text(json.dumps(public_detail, indent=2, sort_keys=True) + "\n")
+
+
 def publish(
     site_dir: Path,
     *,
     snapshot_path: Path | None,
     detail_path: Path | None,
+    jobs_path: Path | None = None,
     metadata: dict[str, Any],
     repo_url: str,
     max_summaries: int,
@@ -388,9 +900,33 @@ def publish(
     runs_dir.mkdir(parents=True, exist_ok=True)
     manifest_path = site_dir / "executions.js"
     manifest = load_manifest(manifest_path)
-    snapshot = load_json(snapshot_path)
-    detail = load_json(detail_path)
-    summary = build_summary(snapshot, metadata)
+    sanitize_retained_details(site_dir, manifest)
+    raw_snapshot = load_json(snapshot_path)
+    raw_detail = load_json(detail_path)
+    snapshot, snapshot_identity_failure = validate_artifact_identity(
+        raw_snapshot,
+        metadata,
+        label="benchmark snapshot",
+    )
+    detail, detail_identity_failure = validate_artifact_identity(
+        raw_detail,
+        metadata,
+        label="execution detail",
+    )
+    summary_snapshot = snapshot or detail
+    artifact_failure = (
+        snapshot_identity_failure or detail_identity_failure
+        if summary_snapshot is None
+        else None
+    )
+    jobs_document = load_json(jobs_path)
+    summary = build_summary(
+        summary_snapshot,
+        metadata,
+        detail=detail,
+        jobs_document=jobs_document,
+        artifact_failure=artifact_failure,
+    )
 
     existing_by_id = {
         str(entry.get("id")): entry
@@ -398,7 +934,11 @@ def publish(
         if isinstance(entry, dict) and entry.get("id")
     }
     previous = existing_by_id.get(metadata["id"])
-    if snapshot is None and previous:
+    if (
+        snapshot is None
+        and previous
+        and previous.get("availability") in {"aggregate", "full"}
+    ):
         preserved = dict(previous)
         preserved.update(
             {
@@ -418,19 +958,17 @@ def publish(
         summary = preserved
 
     if detail is not None:
-        detail["schema_version"] = SCHEMA_VERSION
-        execution_metadata = detail.get("execution", {})
-        if not isinstance(execution_metadata, dict):
-            execution_metadata = {}
-        detail["execution"] = {**execution_metadata, **metadata}
+        scenario_metrics = build_scenario_metrics(detail)
+        efficiency_totals = build_execution_efficiency_totals(detail)
+        public_detail = compact_public_detail(detail, metadata)
         relative_detail_path = f"runs/{metadata['id']}.json"
         (site_dir / relative_detail_path).write_text(
-            json.dumps(detail, indent=2, sort_keys=True) + "\n"
+            json.dumps(public_detail, indent=2, sort_keys=True) + "\n"
         )
         summary["availability"] = "full"
         summary["detail_path"] = relative_detail_path
-        summary["scenario_metrics"] = build_scenario_metrics(detail)
-        summary["totals"].update(build_execution_efficiency_totals(detail))
+        summary["scenario_metrics"] = scenario_metrics
+        summary["totals"].update(efficiency_totals)
 
     existing_by_id[metadata["id"]] = summary
     executions = sorted(existing_by_id.values(), key=sort_key, reverse=True)
@@ -457,6 +995,16 @@ def publish(
             "aggregate" if entry.get("subjects") else "unavailable"
         )
 
+    retained_paths = {
+        str(entry.get("detail_path"))
+        for entry in executions
+        if isinstance(entry.get("detail_path"), str)
+        and str(entry["detail_path"]).startswith("runs/")
+    }
+    for candidate in runs_dir.glob("*.json"):
+        if f"runs/{candidate.name}" not in retained_paths:
+            candidate.unlink()
+
     updated = {
         "schema_version": SCHEMA_VERSION,
         "mode": site_mode,
@@ -481,6 +1029,7 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--site-dir", type=Path, required=True)
     parser.add_argument("--snapshot", type=Path)
     parser.add_argument("--detail", type=Path)
+    parser.add_argument("--jobs", type=Path)
     parser.add_argument("--run-id", required=True)
     parser.add_argument("--attempt", type=int, required=True)
     parser.add_argument("--workflow-name", required=True)
@@ -527,6 +1076,7 @@ def main(argv: list[str] | None = None) -> int:
         args.site_dir,
         snapshot_path=args.snapshot,
         detail_path=args.detail,
+        jobs_path=args.jobs,
         metadata=metadata,
         repo_url=args.repo_url,
         max_summaries=args.max_summaries,
diff --git a/.github/scripts/serve_harness_e2e_dashboard.py b/.github/scripts/serve_harness_e2e_dashboard.py
index 8d10e802d..8e905b3c2 100644
--- a/.github/scripts/serve_harness_e2e_dashboard.py
+++ b/.github/scripts/serve_harness_e2e_dashboard.py
@@ -326,6 +326,12 @@ def import_report(
         quality, efficiency, snapshot, execution = collect(config)
         if report.get("judge") is None:
             snapshot["subjects"][0]["judge"] = {}
+        has_blocking_failure = any(
+            int(subject.get("hard_gate_failures") or 0) > 0
+            or int(subject.get("technical_failures") or 0) > 0
+            for subject in snapshot["subjects"]
+            if isinstance(subject, dict)
+        )
         write_outputs(output_dir, quality, efficiency, snapshot, execution)
         publish(
             site_dir,
@@ -341,7 +347,9 @@ def import_report(
                 "actor": getpass.getuser(),
                 "started_at": started_at,
                 "completed_at": completed_at,
-                "conclusion": "success" if bool(report.get("passed")) else "failure",
+                # Quality is advisory in CI and must remain advisory in a local
+                # import. Only technical and hard-gate outcomes fail the run.
+                "conclusion": "failure" if has_blocking_failure else "success",
                 "head_sha": source_sha,
                 "head_branch": source_ref,
                 "repository": repo_name,
diff --git a/.github/scripts/tests/test_collect_harness_e2e_benchmarks.py b/.github/scripts/tests/test_collect_harness_e2e_benchmarks.py
index 1bea216e5..cfe07a54a 100644
--- a/.github/scripts/tests/test_collect_harness_e2e_benchmarks.py
+++ b/.github/scripts/tests/test_collect_harness_e2e_benchmarks.py
@@ -11,9 +11,89 @@
     CollectionConfig,
     CollectionError,
     collect,
+    semantic_result_status,
 )
 
 
+def test_semantic_result_status_uses_blocking_precedence() -> None:
+    assert (
+        semantic_result_status(
+            passed=False,
+            hard_gate_failures=1,
+            technical_failures=1,
+        )
+        == "technical_failed"
+    )
+    assert (
+        semantic_result_status(
+            passed=False,
+            hard_gate_failures=1,
+            technical_failures=0,
+        )
+        == "hard_gate_failed"
+    )
+    assert (
+        semantic_result_status(
+            passed=False,
+            hard_gate_failures=0,
+            technical_failures=0,
+        )
+        == "quality_advisory"
+    )
+    assert (
+        semantic_result_status(
+            passed=True,
+            hard_gate_failures=0,
+            technical_failures=0,
+            complete=False,
+        )
+        == "incomplete"
+    )
+    assert (
+        semantic_result_status(
+            passed=True,
+            hard_gate_failures=0,
+            technical_failures=0,
+        )
+        == "passed"
+    )
+
+
+@pytest.mark.parametrize(
+    ("passed", "hard_gates", "technical", "expected"),
+    (
+        (False, 0, 0, "quality_advisory"),
+        (False, 1, 0, "hard_gate_failed"),
+        (False, 0, 1, "technical_failed"),
+    ),
+)
+def test_collects_semantic_scenario_status(
+    tmp_path: Path,
+    passed: bool,
+    hard_gates: int,
+    technical: int,
+    expected: str,
+) -> None:
+    write_report(
+        tmp_path,
+        subject_id="glm",
+        scenario_id="direct_answer",
+        passed=passed,
+        hard_gate_failures=hard_gates,
+        technical_failures=technical,
+    )
+
+    quality, _, snapshot, _ = collect(config(tmp_path, ["direct_answer"]))
+
+    assert snapshot["subjects"][0]["scenarios"][0]["status"] == expected
+    scenario_metric = next(
+        metric
+        for metric in quality
+        if metric["name"] == "quality::glm::direct_answer::median_score"
+    )
+    assert json.loads(scenario_metric["extra"])["status"] == expected
+
+
 def write_report(
     root: Path,
     *,
diff --git a/.github/scripts/tests/test_publish_harness_e2e_dashboard.py b/.github/scripts/tests/test_publish_harness_e2e_dashboard.py
index 76e8a75bc..7b672d6d2 100644
--- a/.github/scripts/tests/test_publish_harness_e2e_dashboard.py
+++ b/.github/scripts/tests/test_publish_harness_e2e_dashboard.py
@@ -6,10 +6,14 @@
 from pathlib import Path
 
 from publish_harness_e2e_dashboard import (
+    build_summary,
     build_execution_efficiency_totals,
+    compact_public_detail,
     contract_fingerprint,
+    execution_status,
     load_manifest,
     publish,
+    report_diagnostic,
     scenario_contract,
 )
 
@@ -157,6 +161,7 @@ def publish_run(
     include_snapshot: bool = True,
     include_detail: bool = True,
     conclusion: str = "success",
+    jobs: dict | None = None,
 ) -> dict:
     inputs = root / "inputs"
     snapshot_path = (
@@ -172,10 +177,16 @@ def publish_run(
         if include_detail
         else None
     )
+    jobs_path = (
+        write_json(inputs / f"{run_id}-{attempt}-jobs.json", jobs)
+        if jobs is not None
+        else None
+    )
     return publish(
         root / "site",
         snapshot_path=snapshot_path,
         detail_path=detail_path,
+        jobs_path=jobs_path,
         metadata=metadata(run_id, attempt, conclusion=conclusion),
         repo_url="https://github.com/iii-hq/workers",
         max_summaries=3,
@@ -240,6 +251,121 @@ def test_records_cancelled_execution_without_artifacts(tmp_path: Path) -> None:
     assert execution["subjects"] == []
 
 
+def test_publishes_schema_three_and_classifies_semantic_outcomes() -> None:
+    complete_subjects = [{"passed": True}]
+    advisory_subjects = [{"passed": False}]
+
+    assert execution_status("", [], 0, 0, 0, 0) == "running"
+    assert execution_status("cancelled", [], 0, 0, 0, 0) == "cancelled"
+    assert execution_status("failure", [], 0, 0, 0, 0) == "infra_failed"
+    assert execution_status("success", complete_subjects, 2, 1, 0, 0) == "incomplete"
+    assert (
+        execution_status("failure", complete_subjects, 1, 1, 0, 1)
+        == "technical_failed"
+    )
+    assert (
+        execution_status("failure", complete_subjects, 1, 1, 2, 0)
+        == "hard_gate_failed"
+    )
+    assert (
+        execution_status("success", advisory_subjects, 1, 1, 0, 0)
+        == "quality_advisory"
+    )
+    assert execution_status("success", complete_subjects, 1, 1, 0, 0) == "passed"
+
+
+def test_failed_build_without_artifacts_uses_first_failed_job(tmp_path: Path) -> None:
+    jobs = {
+        "jobs": [
+            {
+                "name": "harness e2e build",
+                "conclusion": "failure",
+                "started_at": "2026-07-06T06:00:00Z",
+                "html_url": "https://github.com/iii-hq/workers/actions/runs/10000000006/job/1",
+                "steps": [
+                    {"number": 1, "name": "Checkout", "conclusion": "success"},
+                    {
+                        "number": 2,
+                        "name": "Validate E2E manifests and lockfiles",
+                        "conclusion": "failure",
+                    },
+                ],
+            }
+        ]
+    }
+    manifest = publish_run(
+        tmp_path,
+        "10000000016",
+        include_snapshot=False,
+        include_detail=False,
+        conclusion="failure",
+        jobs=jobs,
+    )
+
+    execution = manifest["executions"][0]
+    assert manifest["schema_version"] == 3
+    assert execution["status"] == "infra_failed"
+    assert execution["first_failure"] == {
+        "kind": "job",
+        "job_name": "harness e2e build",
+        "step_name": "Validate E2E manifests and lockfiles",
+        "message": "harness e2e build: Validate E2E manifests and lockfiles",
+        "url": "https://github.com/iii-hq/workers/actions/runs/10000000006/job/1",
+    }
+    assert "steps" not in json.dumps(execution)
+
+
+def test_quality_only_failure_is_advisory_and_surfaces_score() -> None:
+    value = snapshot("10000000017", passed=False)
+    subject = value["subjects"][0]
+    subject["hard_gate_failures"] = 0
+    subject["scenarios"][0]["hard_gate_failures"] = 0
+
+    summary = build_summary(value, metadata("10000000017"))
+
+    assert summary["status"] == "quality_advisory"
+    assert summary["first_failure"] == {
+        "kind": "quality",
+        "subject_id": "glm",
+        "scenario_id": "direct_answer",
+        "message": "Median score 60 is below threshold 80",
+    }
+
+
+def test_hard_gate_event_blocks_even_when_subject_aggregate_passed() -> None:
+    value = snapshot("10000000018", passed=True)
+    value["subjects"][0]["hard_gate_failures"] = 1
+    value["subjects"][0]["scenarios"][0]["hard_gate_failures"] = 1
+
+    summary = build_summary(value, metadata("10000000018", conclusion="failure"))
+
+    assert summary["status"] == "hard_gate_failed"
+
+
+def test_extracts_first_technical_and_hard_gate_diagnostics() -> None:
+    value = detail("10000000020")
+    run = value["reports"][0]["report"]["scenarios"][0]["runs"][0]
+    run["failures"] = [{"phase": "execute", "message": "provider unavailable"}]
+    run["hard_gates"] = [
+        {"id": "required_state", "passed": False, "reason": "state missing"}
+    ]
+
+    assert report_diagnostic("technical_failed", None, value) == {
+        "kind": "technical",
+        "subject_id": "glm",
+        "scenario_id": "direct_answer",
+        "phase": "execute",
+        "message": "provider unavailable",
+    }
+    assert report_diagnostic("hard_gate_failed", None, value) == {
+        "kind": "hard_gate",
+        "subject_id": "glm",
+        "scenario_id": "direct_answer",
+        "id": "required_state",
+        "message": "state missing",
+    }
+
+
 def test_duplicate_event_does_not_downgrade_existing_full_report(
     tmp_path: Path,
 ) -> None:
@@ -296,3 +422,111 @@ def test_publishes_average_run_metrics_by_scenario(tmp_path: Path) -> None:
             },
         }
     ]
+
+
+def test_public_detail_excludes_prompts_transcripts_and_payloads(tmp_path: Path) -> None:
+    raw = detail("10000000019")
+    run = raw["reports"][0]["report"]["scenarios"][0]["runs"][0]
+    run.update(
+        {
+            "prompt": "SECRET_PROMPT_MARKER",
+            "transcript": {
+                "messages": [
+                    {
+                        "role": "assistant",
+                        "content": "SECRET_TRANSCRIPT_MARKER",
+                        "arguments": {"token": "SECRET_TOOL_ARGUMENT_MARKER"},
+                    }
+                ]
+            },
+            "criteria": [
+                {"id": "private", "reason": "SECRET_CRITERION_MARKER"}
+            ],
+            "hard_gates": [
+                {"id": "required_state", "passed": False, "reason": "state missing"}
+            ],
+            "failures": [{"phase": "execute", "message": "provider unavailable"}],
+        }
+    )
+    compact = compact_public_detail(raw, metadata("10000000019"))
+
+    encoded = json.dumps(compact)
+    for marker in (
+        "SECRET_PROMPT_MARKER",
+        "SECRET_TRANSCRIPT_MARKER",
+        "SECRET_TOOL_ARGUMENT_MARKER",
+        "SECRET_CRITERION_MARKER",
+    ):
+        assert marker not in encoded
+    for forbidden_key in ('"prompt"', '"transcript"', '"criteria"', '"arguments"'):
+        assert forbidden_key not in encoded
+    public_run = compact["reports"][0]["report"]["scenarios"][0]["runs"][0]
+    assert public_run["hard_gates"] == [
+        {"id": "required_state", "passed": False, "reason": "state missing"}
+    ]
+    assert public_run["failures"] == [
+        {"phase": "execute", "message": "provider unavailable"}
+    ]
+    assert public_run["metrics"]["totals"]["input_tokens"] == 100
+
+    inputs = tmp_path / "inputs"
+    manifest = publish(
+        tmp_path / "site",
+        snapshot_path=write_json(inputs / "snapshot.json", snapshot("10000000019")),
+        detail_path=write_json(inputs / "detail.json", raw),
+        metadata=metadata("10000000019"),
+        repo_url="https://github.com/iii-hq/workers",
+        max_summaries=3,
+        max_details=2,
+    )
+    published = (tmp_path / "site" / manifest["executions"][0]["detail_path"]).read_text()
+    assert "SECRET_" not in published
+    assert '"prompt"' not in published
+    assert '"transcript"' not in published
+
+
+def test_next_publish_sanitizes_retained_schema_two_details(tmp_path: Path) -> None:
+    first = publish_run(tmp_path, "10000000021")
+    retained_path = tmp_path / "site" / first["executions"][0]["detail_path"]
+    legacy = detail("10000000021")
+    legacy["reports"][0]["report"]["scenarios"][0]["runs"][0][
+        "prompt"
+    ] = "SECRET_RETAINED_PROMPT"
+    retained_path.write_text(json.dumps(legacy))
+
+    publish_run(tmp_path, "10000000022")
+
+    migrated = retained_path.read_text()
+    assert "SECRET_RETAINED_PROMPT" not in migrated
+    assert '"prompt"' not in migrated
+    assert json.loads(migrated)["schema_version"] == 3
+
+
+def test_ignores_artifacts_from_a_previous_attempt(tmp_path: Path) -> None:
+    current_metadata = metadata("10000000023", attempt=2, conclusion="failure")
+    stale_snapshot = snapshot("10000000023", attempt=1)
+    stale_detail = detail("10000000023", attempt=1)
+    stale_detail["reports"][0]["report"]["scenarios"][0]["runs"][0][
+        "prompt"
+    ] = "SECRET_STALE_ATTEMPT"
+    inputs = tmp_path / "inputs"
+
+    manifest = publish(
+        tmp_path / "site",
+        snapshot_path=write_json(inputs / "snapshot.json", stale_snapshot),
+        detail_path=write_json(inputs / "detail.json", stale_detail),
+        metadata=current_metadata,
+        repo_url="https://github.com/iii-hq/workers",
+        max_summaries=3,
+        max_details=2,
+    )
+
+    execution = manifest["executions"][0]
+    assert execution["id"] == "10000000023-2"
+    assert execution["status"] == "infra_failed"
+    assert execution["availability"] == "unavailable"
+    assert execution["subjects"] == []
+    assert execution["detail_path"] is None
+    assert execution["first_failure"]["kind"] == "artifact_identity"
+    assert "expected 10000000023 attempt 2" in execution["first_failure"]["message"]
+    assert not list((tmp_path / "site/runs").glob("*.json"))
diff --git a/.github/scripts/tests/test_serve_harness_e2e_dashboard.py b/.github/scripts/tests/test_serve_harness_e2e_dashboard.py
index 70aaed921..85fd721ab 100644
--- a/.github/scripts/tests/test_serve_harness_e2e_dashboard.py
+++ b/.github/scripts/tests/test_serve_harness_e2e_dashboard.py
@@ -199,9 +199,35 @@ def test_accumulates_changed_reports_and_preserves_failures(
 
         manifest = load_manifest(site / "executions.js")
         self.assertEqual(len(manifest["executions"]), 2)
-        self.assertEqual(manifest["executions"][0]["status"], "failed")
+        self.assertEqual(manifest["executions"][0]["status"], "hard_gate_failed")
         self.assertEqual(manifest["executions"][1]["status"], "passed")
 
+    @patch(
+        "serve_harness_e2e_dashboard.repository_url",
+        return_value="https://github.com/iii-hq/workers",
+    )
+    @patch(
+        "serve_harness_e2e_dashboard.git_value",
+        side_effect=fake_git_value,
+    )
+    def test_keeps_quality_only_local_result_advisory(
+        self,
+        _git_value,
+        _repository_url,
+    ) -> None:
+        quality = scenario("direct_answer", score=40, passed=False)
+        quality["aggregate"]["hard_gate_failures"] = 0
+        quality["runs"][0]["status"] = "quality_failed"
+        results = write_report(
+            self.root / "quality/results.json",
+            report(quality, passed=False),
+        )
+
+        build_local_dashboard([results], site_dir=self.root / "site")
+
+        manifest = load_manifest(self.root / "site/executions.js")
+        self.assertEqual(manifest["executions"][0]["status"], "quality_advisory")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/.github/scripts/tests/test_validate_harness_e2e_manifests.py b/.github/scripts/tests/test_validate_harness_e2e_manifests.py
new file mode 100644
index 000000000..2f46bbc6a
--- /dev/null
+++ b/.github/scripts/tests/test_validate_harness_e2e_manifests.py
@@ -0,0 +1,144 @@
+"""Tests for the Harness E2E manifest preflight."""
+
+from __future__ import annotations
+
+import io
+import json
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+from validate_harness_e2e_manifests import (
+    CORE_SOURCE_WORKERS,
+    Component,
+    PreflightInputError,
+    emit_annotations,
+    resolve_components,
+    validate_components,
+)
+
+
+SUBJECTS = json.dumps(
+    [
+        {"id": "glm", "model": "glm-5", "provider": "zai"},
+        {"id": "codex", "model": "gpt-5", "provider": "openai"},
+    ]
+)
+
+
+class ManifestPreflightTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temporary_directory = tempfile.TemporaryDirectory()
+        self.root = Path(self.temporary_directory.name)
+
+    def tearDown(self) -> None:
+        self.temporary_directory.cleanup()
+
+    def test_resolves_core_and_deduplicated_source_providers(self) -> None:
+        components = resolve_components(
+            self.root,
+            stack_mode="source",
+            subjects_json=SUBJECTS,
+            judge_provider="openai",
+        )
+
+        self.assertEqual(
+            [component.name for component in components],
+            [
+                *CORE_SOURCE_WORKERS,
+                "provider-openai",
+                "provider-zai",
+                "harness",
+            ],
+        )
+        self.assertEqual(
+            components[-1].expected_binaries,
+            ("harness", "harness-e2e"),
+        )
+
+    def test_registry_mode_only_validates_the_runner_workspace(self) -> None:
+        components = resolve_components(
+            self.root,
+            stack_mode="registry",
+            subjects_json=SUBJECTS,
+            judge_provider="anthropic",
+        )
+
+        self.assertEqual([component.name for component in components], ["harness"])
+
+    def test_rejects_unsafe_or_malformed_provider_inputs(self) -> None:
+        for subjects, judge in (
+            ('[{"provider":"../openai"}]', "anthropic"),
+            (SUBJECTS, "../anthropic"),
+            ("{}", "anthropic"),
+        ):
+            with self.subTest(subjects=subjects, judge=judge):
+                with self.assertRaises(PreflightInputError):
+                    resolve_components(
+                        self.root,
+                        stack_mode="source",
+                        subjects_json=subjects,
+                        judge_provider=judge,
+                    )
+
+    def test_accumulates_metadata_and_binary_failures(self) -> None:
+        first = Component("one", self.root / "one/Cargo.toml", ("one",))
+        second = Component("two", self.root / "two/Cargo.toml", ("two",))
+        first.manifest.parent.mkdir()
+        second.manifest.parent.mkdir()
+        first.manifest.write_text("[package]\nname='one'\n")
+        second.manifest.write_text("[package]\nname='two'\n")
+
+        responses = [
+            Mock(returncode=101, stdout="", stderr="lock file needs to be updated"),
+            Mock(
+                returncode=0,
+                stdout=json.dumps(
+                    {
+                        "packages": [
+                            {"targets": [{"name": "other", "kind": ["bin"]}]}
+                        ]
+                    }
+                ),
+                stderr="",
+            ),
+        ]
+        with patch(
+            "validate_harness_e2e_manifests.subprocess.run",
+            side_effect=responses,
+        ) as run:
+            failures = validate_components([first, second], root=self.root)
+
+        self.assertEqual(len(failures), 2)
+        self.assertEqual(failures[0].message, "lock file needs to be updated")
+        self.assertEqual(
+            failures[1].message,
+            "missing expected binary target(s): two",
+        )
+        self.assertEqual(run.call_count, 2)
+        self.assertEqual(
+            run.call_args_list[0].args[0][1:4],
+            ["metadata", "--locked", "--no-deps"],
+        )
+
+    def test_missing_manifests_are_annotated_together(self) -> None:
+        components = [
+            Component("one", self.root / "one/Cargo.toml", ("one",)),
+            Component("two", self.root / "two/Cargo.toml", ("two",)),
+        ]
+
+        failures = validate_components(components, root=self.root)
+        output = io.StringIO()
+        with redirect_stdout(output):
+            emit_annotations(failures, root=self.root)
+
+        rendered = output.getvalue()
+        self.assertEqual(rendered.count("::error "), 2)
+        self.assertIn("file=one/Cargo.toml", rendered)
+        self.assertIn("file=two/Cargo.toml", rendered)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/scripts/validate_harness_e2e_manifests.py b/.github/scripts/validate_harness_e2e_manifests.py
new file mode 100644
index 000000000..63e1ddb3a
--- /dev/null
+++ b/.github/scripts/validate_harness_e2e_manifests.py
@@ -0,0 +1,248 @@
+#!/usr/bin/env python3
+"""Fail fast when the Harness E2E source stack cannot build with locked manifests."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Sequence
+
+
+CORE_SOURCE_WORKERS = (
+    "database",
+    "state",
+    "queue",
+    "session-manager",
+    "llm-router",
+    "context-manager",
+    "iii-directory",
+    "cron",
+    "web",
+    "fp",
+)
+SAFE_PROVIDER = re.compile(r"^[A-Za-z0-9_-]+$")
+
+
+class PreflightInputError(ValueError):
+    """Raised when the requested E2E stack cannot be resolved safely."""
+
+
+@dataclass(frozen=True)
+class Component:
+    name: str
+    manifest: Path
+    expected_binaries: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class ValidationFailure:
+    component: Component
+    message: str
+
+
+def parse_subject_providers(raw: str) -> list[str]:
+    try:
+        subjects = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise PreflightInputError(f"subjects JSON is invalid: {exc}") from exc
+    if not isinstance(subjects, list) or not subjects:
+        raise PreflightInputError("subjects must be a non-empty JSON array")
+
+    providers: list[str] = []
+    for index, subject in enumerate(subjects):
+        if not isinstance(subject, dict):
+            raise PreflightInputError(f"subjects[{index}] must be an object")
+        provider = subject.get("provider")
+        if not isinstance(provider, str) or not SAFE_PROVIDER.fullmatch(provider):
+            raise PreflightInputError(
+                f"subjects[{index}].provider must match {SAFE_PROVIDER.pattern}"
+            )
+        providers.append(provider)
+    return providers
+
+
+def resolve_components(
+    root: Path,
+    *,
+    stack_mode: str,
+    subjects_json: str,
+    judge_provider: str,
+) -> list[Component]:
+    if stack_mode not in {"source", "registry"}:
+        raise PreflightInputError("stack mode must be source or registry")
+    if not SAFE_PROVIDER.fullmatch(judge_provider):
+        raise PreflightInputError(
+            f"judge provider must match {SAFE_PROVIDER.pattern}"
+        )
+
+    components: list[Component] = []
+    if stack_mode == "source":
+        components.extend(
+            Component(worker, root / worker / "Cargo.toml", (worker,))
+            for worker in CORE_SOURCE_WORKERS
+        )
+        providers = sorted(set(parse_subject_providers(subjects_json)) | {judge_provider})
+        components.extend(
+            Component(
+                f"provider-{provider}",
+                root / f"provider-{provider}" / "Cargo.toml",
+                (f"provider-{provider}",),
+            )
+            for provider in providers
+        )
+
+    # The root Harness manifest owns the runner workspace in both stack modes.
+    components.append(
+        Component(
+            "harness",
+            root / "harness" / "Cargo.toml",
+            ("harness", "harness-e2e"),
+        )
+    )
+    return components
+
+
+def _metadata_binaries(metadata: dict[str, Any]) -> set[str]:
+    packages = metadata.get("packages", [])
+    if not isinstance(packages, list):
+        return set()
+    return {
+        str(target.get("name"))
+        for package in packages
+        if isinstance(package, dict)
+        for target in package.get("targets", [])
+        if isinstance(target, dict)
+        and isinstance(target.get("kind"), list)
+        and "bin" in target["kind"]
+        and target.get("name")
+    }
+
+
+def validate_component(
+    component: Component,
+    *,
+    root: Path,
+    cargo: str = "cargo",
+) -> ValidationFailure | None:
+    try:
+        relative_manifest = component.manifest.relative_to(root)
+    except ValueError:
+        return ValidationFailure(component, "manifest resolves outside the repository")
+    if not component.manifest.is_file():
+        return ValidationFailure(component, f"missing manifest: {relative_manifest}")
+
+    command = [
+        cargo,
+        "metadata",
+        "--locked",
+        "--no-deps",
+        "--format-version",
+        "1",
+        "--manifest-path",
+        str(relative_manifest),
+    ]
+    try:
+        result = subprocess.run(
+            command,
+            cwd=root,
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+    except OSError as exc:
+        return ValidationFailure(component, f"cannot execute cargo metadata: {exc}")
+
+    if result.returncode != 0:
+        diagnostic = (result.stderr or result.stdout).strip()
+        return ValidationFailure(
+            component,
+            diagnostic or f"cargo metadata exited with status {result.returncode}",
+        )
+
+    try:
+        metadata = json.loads(result.stdout)
+    except json.JSONDecodeError as exc:
+        return ValidationFailure(component, f"cargo metadata returned invalid JSON: {exc}")
+    if not isinstance(metadata, dict):
+        return ValidationFailure(component, "cargo metadata did not return an object")
+
+    available_binaries = _metadata_binaries(metadata)
+    missing_binaries = sorted(set(component.expected_binaries) - available_binaries)
+    if missing_binaries:
+        return ValidationFailure(
+            component,
+            "missing expected binary target(s): " + ", ".join(missing_binaries),
+        )
+    return None
+
+
+def validate_components(
+    components: Sequence[Component],
+    *,
+    root: Path,
+    cargo: str = "cargo",
+) -> list[ValidationFailure]:
+    failures = []
+    for component in components:
+        if failure := validate_component(component, root=root, cargo=cargo):
+            failures.append(failure)
+    return failures
+
+
+def _command_value(value: str) -> str:
+    return value.replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+
+
+def emit_annotations(failures: Sequence[ValidationFailure], *, root: Path) -> None:
+    for failure in failures:
+        try:
+            manifest = failure.component.manifest.relative_to(root)
+        except ValueError:
+            manifest = failure.component.manifest
+        print(
+            "::error "
+            f"title={_command_value(f'Invalid {failure.component.name} manifest')},"
+            f"file={_command_value(str(manifest))}::"
+            f"{_command_value(failure.message)}"
+        )
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--repository-root", type=Path, default=Path.cwd())
+    parser.add_argument("--stack-mode", choices=("source", "registry"), required=True)
+    parser.add_argument("--subjects-json", required=True)
+    parser.add_argument("--judge-provider", required=True)
+    parser.add_argument("--cargo", default="cargo")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    root = args.repository_root.resolve()
+    try:
+        components = resolve_components(
+            root,
+            stack_mode=args.stack_mode,
+            subjects_json=args.subjects_json,
+            judge_provider=args.judge_provider,
+        )
+    except PreflightInputError as exc:
+        print(f"::error title=Invalid Harness E2E stack::{_command_value(str(exc))}")
+        return 2
+
+    failures = validate_components(components, root=root, cargo=args.cargo)
+    if failures:
+        emit_annotations(failures, root=root)
+        print(f"Harness E2E manifest preflight failed for {len(failures)} component(s).")
+        return 1
+    print(f"Validated {len(components)} locked Harness E2E manifest(s).")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/.github/workflows/_harness-e2e.yml b/.github/workflows/_harness-e2e.yml
index b3e3adb37..85f116e8c 100644
--- a/.github/workflows/_harness-e2e.yml
+++ b/.github/workflows/_harness-e2e.yml
@@ -232,6 +232,22 @@ jobs:
               ;;
           esac
 
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: ${{ inputs.coverage && 'clippy,llvm-tools' || 'clippy' }}
+
+      - name: Validate E2E manifests and lockfiles
+        env:
+          SUBJECTS: ${{ inputs.subjects }}
+          JUDGE_PROVIDER: ${{ inputs.judge_provider }}
+          STACK_MODE: ${{ inputs.stack_mode }}
+        run: >-
+          python3 .github/scripts/validate_harness_e2e_manifests.py
+          --repository-root "$GITHUB_WORKSPACE"
+          --stack-mode "$STACK_MODE"
+          --subjects-json "$SUBJECTS"
+          --judge-provider "$JUDGE_PROVIDER"
+
       - name: Install published iii release
         if: inputs.stack_mode == 'source'
         id: engine
@@ -257,10 +273,6 @@ jobs:
             echo "version=$version"
           } >> "$GITHUB_OUTPUT"
 
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: ${{ inputs.coverage && 'clippy,llvm-tools' || 'clippy' }}
-
       - name: Restore E2E Rust cache
         uses: Swatinem/rust-cache@v2
         with:
diff --git a/.github/workflows/harness-e2e-benchmark.yml b/.github/workflows/harness-e2e-benchmark.yml
index a4d621a81..d4f2105ca 100644
--- a/.github/workflows/harness-e2e-benchmark.yml
+++ b/.github/workflows/harness-e2e-benchmark.yml
@@ -81,6 +81,22 @@ jobs:
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ github.token }}
 
+      - name: Collect workflow job diagnostics
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          mkdir -p target/harness-e2e-run
+          gh api --paginate --slurp \
+            "repos/$GITHUB_REPOSITORY/actions/runs/$RUN_ID/jobs?filter=all&per_page=100" \
+            | jq '{
+                total_count: ([.[] | .total_count // 0] | max // 0),
+                jobs: [.[] | .jobs[]]
+              }' \
+            > target/harness-e2e-run/jobs.json
+
       - name: Resolve benchmark source
         id: benchmark
         if: steps.compact.outcome == 'success'
@@ -251,6 +267,7 @@ jobs:
             --site-dir pages-source/dev/harness-e2e \
             --snapshot target/harness-e2e-benchmark/snapshot.json \
             --detail target/harness-e2e-dashboard/execution.json \
+            --jobs target/harness-e2e-run/jobs.json \
             --run-id "$RUN_ID" \
             --attempt "$RUN_ATTEMPT" \
             --workflow-name "$WORKFLOW_NAME" \