feat(agent,webapp): code-grounded investigation evidence (review F5-F7)

- source/span evidence refs are structured fields; nothing canonicalizes
  silently — a bad ref fails the tool call by name; full URIs are
  validated for kind and project/env scope
- source URIs resolve to the GitHub blob at the pinned SHA
- executor-generated investigation actions: Show code only when concluded,
  code-addressable, and the file was read this turn at the pinned snapshot;
  typed follow-ups emit intents like chart actions; the card takes onIntent
- the live panel resolves card evidence links through the resolve action
  (sync facade with a per-URI cache)
- wake narration names terminal_unsatisfied as an answer, not a timeout

Author: kathiekiwi

apps/webapp/app/components/dashboard-agent/DashboardAgentChat.tsx

@@ -15,6 +15,7 @@ import { createTranscriptOrder, orderTranscript } from "./message-order";
 import { appendRunFilters, pendingNavigateIntents } from "./navigate-target";
 import type { AgentPageContext } from "./page-context-types";
 import { useAgentMessageQuota } from "./useAgentMessageQuota";
+import { useTriggerUriResolver } from "./useTriggerUriResolver";
 import { WatchChips, type WatchChip } from "./WatchChips";
 
 /**
@@ -267,6 +268,10 @@ export function DashboardAgentChat({
   // owns the environment scope the resolver needs); the intent's runs-list
   // filters are applied on top. Same-origin, so this is a client-side navigation
   // — the panel lives in the env layout and survives it.
+  // Sync facade over the same `resolve` action — evidence and card links render
+  // as raw URIs on first paint and become links once the server answers.
+  const resolveUri = useTriggerUriResolver(actionPath);
+
   const goTo = useCallback(
     async (intent: Extract<AgentIntent, { kind: "navigate" }>) => {
       const body = new FormData();
@@ -381,6 +386,7 @@ export function DashboardAgentChat({
           onIntent={handleIntent}
           pagePaths={pagePaths}
           watches={watches}
+          resolveUri={resolveUri}
         />
       )}
       {/* The Free plan's message cap occupies the composer slot: at the cap the

apps/webapp/app/components/dashboard-agent/InvestigationCard.test.ts

@@ -31,4 +31,19 @@ describe("InvestigationCard purity", () => {
     expect(source).toMatch(/resolveUri/);
     expect(source).not.toMatch(/\/orgs\//);
   });
+
+  it("hands its actions to the host as intents, and never composes its own", () => {
+    // The actions row is exactly the chart's seam: the button emits the block's
+    // intent and the host decides. So the card reads `capabilities.actions` and
+    // calls `onIntent` — it never builds a prompt or a target itself.
+    expect(source).toMatch(/capabilities\?\.actions/);
+    expect(source).toMatch(/onIntent\(action\.intent\)/);
+    expect(source).not.toMatch(/kind:\s*"(ask|navigate)"/);
+    // The same row component the rest of the chat uses, so there's one button row.
+    expect(source).toMatch(/ChatActionsRow/);
+  });
+
+  it("renders nothing action-shaped without a host to hand intents to", () => {
+    expect(source).toMatch(/if \(!onIntent \|\| actions\.length === 0\) return null;/);
+  });
 });

apps/webapp/app/components/dashboard-agent/InvestigationCard.tsx

@@ -20,8 +20,10 @@
  */
 import { ChevronDownIcon, ChevronRightIcon } from "@heroicons/react/20/solid";
 import type {
+  AgentIntent,
   Evidence,
   HypothesisVerdict,
+  InvestigationAction,
   InvestigationBlock,
   InvestigationHypothesis,
   InvestigationSeverity,
@@ -37,7 +39,7 @@ import {
   SeverityBadge,
   VerdictBadge,
 } from "./agent-badges";
-import { ChatPendingTool } from "./chat-layout";
+import { ChatActionsRow, ChatPendingTool } from "./chat-layout";
 import type { ResolvedUri } from "./ReportView";
 
 const SEVERITY_LABELS: Record<InvestigationSeverity, string> = {
@@ -135,15 +137,57 @@ function HypothesisRow({
   );
 }
 
+/**
+ * The card's footer actions — "Show code" and the follow-ups.
+ *
+ * Every one of them is server-decided: the executor only attaches an action when
+ * the thing it offers really is available (a source location it saw read at the
+ * pinned commit, an error group that exists). So there is nothing to validate — the
+ * card hands the intent to the host, exactly like the chart's action row, and
+ * renders nothing when there is no host to hand it to.
+ */
+function InvestigationActions({
+  actions,
+  onIntent,
+}: {
+  actions: InvestigationAction[];
+  onIntent?: (intent: AgentIntent) => void;
+}) {
+  if (!onIntent || actions.length === 0) return null;
+  return (
+    <div className="border-t border-grid-bright pt-4">
+      <ChatActionsRow>
+        {actions.map((action, i) => (
+          <Button
+            key={action.kind}
+            // The first action is the one to take; the rest are alternatives.
+            variant={i === 0 ? "primary/small" : "secondary/small"}
+            onClick={() => onIntent(action.intent)}
+          >
+            {action.label}
+          </Button>
+        ))}
+      </ChatActionsRow>
+    </div>
+  );
+}
+
 export function InvestigationCard({
   block,
   /** Start expanded — used by the gallery states that review the detail view. */
   defaultExpanded = false,
   resolveUri,
+  /**
+   * Where the footer actions go. The card never navigates or asks on its own —
+   * it emits an intent and the host honours it (or doesn't), the same seam the
+   * chart's actions use. Without it the row isn't rendered.
+   */
+  onIntent,
 }: {
   block: InvestigationBlock;
   defaultExpanded?: boolean;
   resolveUri?: ResolveUri;
+  onIntent?: (intent: AgentIntent) => void;
 }) {
   const [expanded, setExpanded] = useState(defaultExpanded);
   const investigation = block.investigation;
@@ -242,6 +286,8 @@ export function InvestigationCard({
               </div>
             ) : null}
           </div>
+
+          <InvestigationActions actions={block.capabilities?.actions ?? []} onIntent={onIntent} />
         </div>
       </div>
       {/* Progress lives outside the card, on the left — the same line the chat

apps/webapp/app/components/dashboard-agent/useTriggerUriResolver.ts

@@ -0,0 +1,52 @@
+import { isTriggerUri } from "@internal/dashboard-agent-contracts";
+import { useCallback, useEffect, useRef, useState } from "react";
+import type { ResolvedUri } from "./ReportView";
+
+/**
+ * A synchronous `resolveUri` for the cards, backed by the panel's async
+ * `resolve` action. Resolution needs the server (environment scope, connected
+ * repository), but the cards read links during render — so the first render of
+ * a URI returns null (the card shows the raw URI), the answer is fetched once,
+ * and the re-render turns it into a link. Failures cache as null, so a URI the
+ * server can't resolve is asked about exactly once.
+ */
+export function useTriggerUriResolver(actionPath: string): (uri: string) => ResolvedUri | null {
+  const [resolved, setResolved] = useState<Record<string, ResolvedUri | null>>({});
+  // URIs the cards asked about this render; a ref because it's written during render.
+  const seen = useRef(new Set<string>());
+  const requested = useRef(new Set<string>());
+
+  const resolveUri = useCallback(
+    (uri: string): ResolvedUri | null => {
+      if (!isTriggerUri(uri)) return null;
+      if (!(uri in resolved)) seen.current.add(uri);
+      return resolved[uri] ?? null;
+    },
+    [resolved]
+  );
+
+  // No dependency array on purpose: after every render, fetch whatever the
+  // cards asked about that hasn't been requested yet.
+  useEffect(() => {
+    const toFetch = [...seen.current].filter((uri) => !requested.current.has(uri));
+    for (const uri of toFetch) {
+      requested.current.add(uri);
+      const body = new FormData();
+      body.set("intent", "resolve");
+      body.set("uri", uri);
+      fetch(actionPath, { method: "POST", body })
+        .then((res) => (res.ok ? (res.json() as Promise<{ path?: string; label?: string }>) : null))
+        .then((data) => {
+          setResolved((prev) => ({
+            ...prev,
+            [uri]: data?.path ? { url: data.path, label: data.label ?? uri } : null,
+          }));
+        })
+        .catch(() => {
+          setResolved((prev) => ({ ...prev, [uri]: null }));
+        });
+    }
+  });
+
+  return resolveUri;
+}

apps/webapp/app/components/dashboard-agent/view-catalog.tsx

@@ -59,7 +59,14 @@ export function ViewBlocks({
           // The one progressive block: revisions share the investigationId, so
           // latest-wins above keeps a single live card.
           case "investigation":
-            return <InvestigationCard key={key} block={block} resolveUri={resolveUri} />;
+            return (
+              <InvestigationCard
+                key={key}
+                block={block}
+                resolveUri={resolveUri}
+                onIntent={onIntent}
+              />
+            );
           case "report":
             return (
               <ReportView

apps/webapp/app/services/resolveTriggerUri.server.ts

@@ -43,13 +43,29 @@ export type TriggerUriScope = {
   slug: string;
   project: { slug: string; externalRef: string };
   organization: { slug: string };
+  /**
+   * The project's connected repository, when the caller resolved one. Only a
+   * `source` URI needs it: the URI carries the commit and the repo-relative path,
+   * but "which repo" lives on the project's GitHub connection
+   * (`ConnectedGithubRepository.repository.fullName`) or on the deployment's git
+   * metadata (`WorkerDeployment.git.remoteUrl`) — either is enough here. Omit it
+   * and a source URI resolves to nothing, which is the honest answer for a
+   * project with no repo connected.
+   */
+  repository?: { fullName?: string | null; remoteUrl?: string | null } | null;
 };
 
 export type ResolvedTriggerUri = {
   /** Short human label for the resource, e.g. a run id or a queue name. */
   label: string;
-  /** Dashboard path, relative to the app origin. */
+  /** Dashboard path, relative to the app origin — unless `external` is set. */
   url: string;
+  /**
+   * True when `url` is an absolute link off the dashboard (today: a GitHub blob
+   * for a `source` URI). A host must open it as a link, never hand it to the
+   * router.
+   */
+  external?: boolean;
 };
 
 /**
@@ -71,6 +87,44 @@ export function resolveTriggerUri(
   return resolveInScope(scope, parsed.data);
 }
 
+const GITHUB_ORIGIN = "https://github.com";
+/** `owner/repo` — GitHub's own character set, and nothing that could add a path. */
+const FULL_NAME = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+
+/**
+ * The repository's canonical `https://github.com/{owner}/{repo}` base, or null.
+ *
+ * `fullName` is the reliable input (it comes off the GitHub connection);
+ * `remoteUrl` is the deployment's own git metadata, so it can be an SSH remote or
+ * carry credentials and is normalized the same way the deployments UI does it
+ * (see `BranchesPresenter`). Anything that isn't github.com is rejected rather
+ * than guessed at — a wrong link is worse than no link.
+ */
+function githubRepoBaseUrl(repository: TriggerUriScope["repository"]): string | null {
+  const fullName = repository?.fullName?.trim();
+  if (fullName && FULL_NAME.test(fullName)) return `${GITHUB_ORIGIN}/${fullName}`;
+
+  const remoteUrl = repository?.remoteUrl?.trim();
+  if (!remoteUrl) return null;
+
+  const normalized = remoteUrl
+    .replace(/^git@github\.com:/, `${GITHUB_ORIGIN}/`)
+    .replace(/^ssh:\/\/git@github\.com\//, `${GITHUB_ORIGIN}/`)
+    .replace(/\.git$/, "");
+
+  let url: URL;
+  try {
+    url = new URL(normalized);
+  } catch {
+    return null;
+  }
+  if (url.hostname !== "github.com") return null;
+
+  const path = url.pathname.replace(/^\/+|\/+$/g, "");
+  if (!FULL_NAME.test(path)) return null;
+  return `${GITHUB_ORIGIN}/${path}`;
+}
+
 /** True when the URI names this exact project and environment. */
 function isInScope(scope: TriggerUriScope, parsed: ParsedTriggerUri): boolean {
   return parsed.projectRef === scope.project.externalRef && parsed.environmentId === scope.id;
@@ -128,11 +182,26 @@ function resolveInScope(
         label: parsed.version,
         url: v3DeploymentVersionPath(organization, project, environment, parsed.version),
       };
+    case "source": {
+      // A source citation is the investigation card's code grounding, so it has
+      // to be clickable: the URI already pins the commit and the repo-relative
+      // path, and the connected repo says where that lives. Without a repo
+      // connection there is nothing to open — the label still renders.
+      const base = githubRepoBaseUrl(scope.repository);
+      const label = parsed.line === undefined ? parsed.path : `${parsed.path}:${parsed.line}`;
+      if (!base) return null;
+      const path = parsed.path.split("/").map(encodeURIComponent).join("/");
+      const fragment = parsed.line === undefined ? "" : `#L${parsed.line}`;
+      return {
+        label,
+        url: `${base}/blob/${encodeURIComponent(parsed.sha)}/${path}${fragment}`,
+        external: true,
+      };
+    }
     // No dashboard page exists for these yet. Returning null keeps the caller
     // honest (it renders a label with no link) instead of inventing a URL that
     // 404s. Add a case here the day the page ships.
     case "report":
-    case "source":
     case "investigation":
       return null;
     default: {