{# QA-005 — Reflection feed. Renders the slot from ``_findings_feed.html`` as a live, paginated stream of agent reflections. Cards are hydrated by ``reflections.js`` which subscribes to ``/scans//reflections.sse``. The PII redaction that ran in ``memory.write_reflection`` (memory.py) is passed through verbatim — we render whatever the redactor produced (e.g. ``[REDACTED:PHONE_NUMBER]``) so the dashboard never re-exposes anything the CLI feed already scrubbed. The cards collapse by default to a single-line preview (agent + ASI + verdict + truncated prompt). Click anywhere on the header to expand. Filter chips toggle ``hidden`` on non-matching cards in place. #}
Reflections

Every attack, open to inspection.

Each card is one turn — the prompt the attacker sent, the target's reply, the evaluator's verdict, the reasoning. Filter by agent, ASI, verdict, seed id, or severity. "Copy as curl" replays the attack against the target endpoint locally.

{# Empty state when no reflections have streamed in yet. JS hides this as soon as the first card lands. #}

Waiting for the first reflection — the swarm is still spinning up.

    {# Endpoint hint for the "copy as curl" button. The dashboard does not know the target endpoint directly; the JS reads this and uses it to reconstruct the curl one-liner. When unknown we fall back to a placeholder the operator can edit before pasting. #}