{# Executive — Shared slide-over body (QA-049 / QA-055).

   ONE polymorphic Jinja template that renders the full audit-detail
   drawer body for BOTH the Findings tab and the Probes tab. Backed by
   two server endpoints:

     * GET /scan/<scan_id>/finding/<finding_id> → ``kind="finding"``
     * GET /scan/<scan_id>/probe?index=N|id=ID  → ``kind="probe"``

   Both endpoints fetch the underlying record (Finding or ProbeRun),
   marshal it into a uniform context, and render this fragment. The
   slide-over chrome (backdrop, header, close button) lives in
   ``_finding_slideover.html``; the client-side JS swaps THIS fragment
   into ``[data-slideover-body]`` on row click.

   Sections (gated by ``{% if kind == ... %}`` where they only apply
   to one mode):

     1. Header chips template — ``<template data-slideover-header>`` so
        the JS can hoist verdict pill / id / turn / timestamp / summary
        into the parent slide-over header without re-deriving them.
     2. Metadata — severity / agent / ASI / CSA / ATLAS / tier_floor /
        OWASP scenario / probe id.
     3. Run context (probe only) — agent / turn / timestamp / seed /
        strategy / mutator operators / attacker_refused.
     4. Exact prompt sent — verbatim, monospaced, length stat, copy
        button. Empty placeholder when not available.
     5. Target response — verbatim, monospaced, length stat, copy
        button. Empty placeholder when not available.
     6. Judge verdict + reasoning — verdict label + confidence + panel
        votes (when populated) + judge reasoning prose. Reasoning falls
        back to a "(no data available)" placeholder when not populated.
     7. Multi-turn chat conversation (multi-turn records only) — when
        ``ctx.conversation`` is populated the flat prompt/response/judge
        sections (3-5) are replaced by a chat thread: per turn an
        outgoing attacker-prompt bubble + an incoming target-response
        bubble + that turn's judge reasoning, closed by the rolled-up
        verdict. Single-turn records keep the flat layout.
     8. Evidence chain — link to the JSONL events for the scan, scoped
        by probe id when known.
     9. Reproduce CLI — copy-button monospaced snippet built from the
        scan id + probe id + seed.

   All ``ctx.*`` fields are operator-untrusted (Finding fields are
   user-derived; ProbeRun fields come from ``memory.jsonl``). Jinja
   autoescape applies to every emission. Never use ``|safe`` on these
   values.
#}
{%- set _kind = kind | default('probe') -%}
{%- set _verdict = ctx.verdict or 'unknown' -%}
{%- if _verdict == 'fail' -%}
  {%- set _verdict_label = 'EXPLOITED' -%}
{%- elif _verdict == 'pass' -%}
  {%- set _verdict_label = 'DEFENDED' -%}
{%- elif _verdict == 'inconclusive' -%}
  {%- set _verdict_label = 'INCONCLUSIVE' -%}
{%- else -%}
  {%- set _verdict_label = 'PENDING' -%}
{%- endif -%}
{# Recon is capability probing, not an ASI attack — the ctx builder flags it so
   we collapse the all-"—" finding metadata / run-context blocks below. #}
{%- set _is_recon = ctx.is_recon -%}

{# Header chips slot — JS hoists into ``[data-slideover-*]`` selectors
   on the parent slide-over header. Owning the chip set here means the
   operator sees a fresh header on every row open, regardless of which
   row was previously open. #}
<template data-slideover-header
          data-kind="{{ _kind }}"
          data-verdict="{{ _verdict }}"
          data-verdict-label="{{ _verdict_label }}"
          data-record-id="{{ ctx.record_id or '—' }}"
          data-turn="{{ ctx.turn if ctx.turn is not none else '—' }}"
          data-timestamp="{{ ctx.timestamp_label or '—' }}"
          data-summary="{{ ctx.summary or (_kind|capitalize ~ ' details') }}"
          data-severity-class="{{ ctx.severity_class or '' }}"
          data-severity-label="{{ ctx.severity_label or '' }}"></template>

<div class="exec-slideover-sheet" data-slideover-sheet data-slideover-kind="{{ _kind }}">

  {% if _is_recon %}
  {# ----- 1r. Recon header (capability probing — no ASI/finding metadata) ----- #}
  <p class="exec-probe__label">Recon probe</p>
  <p class="exec-probe__recon-note">
    Black-box capability recon — probing the agent's tools, memory, and surface
    to understand what it can do. This is reconnaissance, not an ASI attack, so
    finding metadata (severity, ASI / CSA category, MITRE ATLAS) and attack
    run-context do not apply.
  </p>
  <dl class="exec-probe__meta">
    <dt class="exec-probe__meta-dt">Agent</dt>
    <dd class="exec-probe__meta-dd"><code>{{ ctx.agent or 'recon-agent' }}</code></dd>
    <dt class="exec-probe__meta-dt">Turns</dt>
    <dd class="exec-probe__meta-dd"><code>{{ ctx.conversation | length }}</code></dd>
    <dt class="exec-probe__meta-dt">Timestamp</dt>
    <dd class="exec-probe__meta-dd"><code>{{ ctx.timestamp_label or '—' }}</code></dd>
  </dl>
  {% else %}
  {# ----- 1. Metadata ----- #}
  <p class="exec-probe__label">{% if _kind == 'finding' %}Finding metadata{% else %}Probe metadata{% endif %}</p>
  <dl class="exec-probe__meta">
    {% if _kind == 'finding' %}
      <dt class="exec-probe__meta-dt">Finding ID</dt>
      <dd class="exec-probe__meta-dd"><code>{{ ctx.record_id or '—' }}</code></dd>
      <dt class="exec-probe__meta-dt">Severity</dt>
      <dd class="exec-probe__meta-dd">
        {% if ctx.severity_label %}
          <code>{{ ctx.severity_label }}</code>
        {% else %}<span class="exec-probe__meta-empty">—</span>{% endif %}
      </dd>
    {% endif %}

    <dt class="exec-probe__meta-dt">Probe ID</dt>
    <dd class="exec-probe__meta-dd"><code>{{ ctx.probe_id or '—' }}</code></dd>

    <dt class="exec-probe__meta-dt">Agent</dt>
    <dd class="exec-probe__meta-dd">
      {% if ctx.agent %}<code>{{ ctx.agent }}</code>
      {% else %}<span class="exec-probe__meta-empty">—</span>{% endif %}
    </dd>

    <dt class="exec-probe__meta-dt">ASI category</dt>
    <dd class="exec-probe__meta-dd"><code>{{ ctx.asi_category or '—' }}</code></dd>

    <dt class="exec-probe__meta-dt">CSA category</dt>
    <dd class="exec-probe__meta-dd"><code>{{ ctx.csa_category or '—' }}</code></dd>

    <dt class="exec-probe__meta-dt">MITRE ATLAS</dt>
    <dd class="exec-probe__meta-dd">
      {% if ctx.mitre_atlas %}
        {% for t in ctx.mitre_atlas %}<code class="exec-probe__meta-chip">{{ t }}</code>{% endfor %}
      {% else %}<span class="exec-probe__meta-empty">—</span>{% endif %}
    </dd>

    {% if _kind == 'probe' %}
      <dt class="exec-probe__meta-dt">Severity</dt>
      <dd class="exec-probe__meta-dd">
        {%- if ctx.severity_label or ctx.severity -%}
          <code>{{ ctx.severity_label or ctx.severity }}</code>
        {%- else -%}<span class="exec-probe__meta-empty">—</span>{%- endif -%}
      </dd>
    {% endif %}

    {# Tier floor / OWASP scenario / Source YAML are probe-corpus provenance
       fields that a Finding never carries (always "—"), so they're hidden on
       the finding detail. Kept for probes, where a corpus seed may supply them. #}
    {% if _kind != 'finding' %}
    <dt class="exec-probe__meta-dt">Tier floor</dt>
    <dd class="exec-probe__meta-dd">
      {%- if ctx.tier_floor -%}<code>{{ ctx.tier_floor }}</code>
      {%- else -%}<span class="exec-probe__meta-empty">—</span>{%- endif -%}
    </dd>

    <dt class="exec-probe__meta-dt">OWASP scenario</dt>
    <dd class="exec-probe__meta-dd">
      {%- if ctx.owasp_scenario -%}<code>{{ ctx.owasp_scenario }}</code>
      {%- else -%}<span class="exec-probe__meta-empty">—</span>{%- endif -%}
    </dd>

    <dt class="exec-probe__meta-dt">Source YAML</dt>
    <dd class="exec-probe__meta-dd">
      {%- if ctx.source_yaml or ctx.source_path -%}
        <code>{{ ctx.source_yaml or ctx.source_path }}</code>
      {%- else -%}<span class="exec-probe__meta-empty">—</span>{%- endif -%}
    </dd>
    {% endif %}
  </dl>
  {% endif %}

  {# ----- 2. Run context (probe-only, non-recon — for findings the per-turn
       thread below carries the run context per child row; recon has no attack
       run-context). ----- #}
  {% if _kind == 'probe' and not _is_recon %}
  <p class="exec-probe__label">Run context</p>
  <dl class="exec-probe__meta">
    <dt class="exec-probe__meta-dt">Turn</dt>
    <dd class="exec-probe__meta-dd"><code>{{ ctx.turn if ctx.turn is not none else '—' }}</code></dd>

    <dt class="exec-probe__meta-dt">Timestamp</dt>
    <dd class="exec-probe__meta-dd"><code>{{ ctx.timestamp_label or '—' }}</code></dd>

    <dt class="exec-probe__meta-dt">Seed</dt>
    <dd class="exec-probe__meta-dd">
      {%- if ctx.seed or ctx.rng_seed -%}<code>{{ ctx.seed or ctx.rng_seed }}</code>
      {%- else -%}<span class="exec-probe__meta-empty">—</span>{%- endif -%}
    </dd>

    <dt class="exec-probe__meta-dt">Strategy</dt>
    <dd class="exec-probe__meta-dd">
      {%- if ctx.strategy -%}<code>{{ ctx.strategy }}</code>
      {%- else -%}<span class="exec-probe__meta-empty">—</span>{%- endif -%}
    </dd>

    <dt class="exec-probe__meta-dt">Mutator operators</dt>
    <dd class="exec-probe__meta-dd">
      {% if ctx.mutator_operators %}
        {% for m in ctx.mutator_operators %}<code class="exec-probe__meta-chip">{{ m }}</code>{% endfor %}
      {% else %}<span class="exec-probe__meta-empty">—</span>{% endif %}
    </dd>

    <dt class="exec-probe__meta-dt">Attacker refused</dt>
    <dd class="exec-probe__meta-dd">
      <code>{% if ctx.attacker_refused %}yes{% else %}no{% endif %}</code>
    </dd>
  </dl>
  {% endif %}

  {% if ctx.conversation %}
  {# ----- 3a. Multi-turn chat conversation -----
       Rendered as a chat thread: per turn, an outgoing prompt bubble followed
       by an incoming response bubble, in turn order. For attacks the whole
       thread is closed by the rolled-up judge verdict; recon (capability
       probing) has no verdict, so that block is suppressed and the bubbles use
       recon-neutral roles. The response bubbles are progressively enhanced by
       chat-render.js into Markdown (default) or pretty JSON. #}
  {%- set _out_role = 'Probe sent' if _is_recon else 'Attacker prompt' -%}
  {%- set _in_role = 'Agent response' if _is_recon else 'Target response' -%}
  <p class="exec-probe__label">{% if _is_recon %}Recon conversation{% else %}Attack conversation{% endif %}</p>
  <ol class="exec-chat" aria-label="{% if _is_recon %}Recon probe conversation{% else %}Multi-turn attack conversation{% endif %}">
    {% for turn in ctx.conversation %}
      <li class="exec-chat__turn" data-turn="{{ turn.turn_no }}">
        <div class="exec-chat__turn-head">
          {% if _is_recon %}
            <span class="exec-chat__turn-no">iteration {{ turn.iteration }}</span>
          {% else %}
            <span class="exec-chat__turn-no">turn {{ turn.turn_no or turn.iteration }}{% if turn.max_turns %} / {{ turn.max_turns }}{% endif %}</span>
          {% endif %}
          {% if not _is_recon %}
            <span class="exec-verdict-pill exec-verdict-pill--{{ turn.verdict }}">{{ turn.verdict_label }}</span>
            {% if turn.confidence_pct %}
              <span class="exec-chat__turn-conf">{{ turn.confidence_pct }}</span>
            {% endif %}
          {% endif %}
        </div>
        <div class="exec-chat__bubble exec-chat__bubble--out">
          <span class="exec-chat__role">{{ _out_role }}</span>
          {# Attacker prompt stays verbatim — no Markdown/JSON rendering. #}
          <pre class="exec-chat__text">{{ turn.prompt or '(no data available)' }}</pre>
        </div>
        <div class="exec-chat__bubble exec-chat__bubble--in">
          <span class="exec-chat__role">{{ _in_role }}</span>
          {# Only the response is rendered (Markdown default / pretty JSON). #}
          <pre class="exec-chat__text" data-chat-render="auto">{{ turn.target_response or '(no data available)' }}</pre>
        </div>
        {% if turn.reasoning %}
          <div class="exec-chat__judge">
            <span class="exec-chat__role">Judge reasoning</span>
            <blockquote class="exec-chat__reason">{{ turn.reasoning }}</blockquote>
          </div>
        {% endif %}
      </li>
    {% endfor %}
  </ol>

  {% if not _is_recon %}
  {# Rolled-up verdict for the whole multi-turn attack (recon has no verdict). #}
  <p class="exec-probe__label">Judge verdict</p>
  <dl class="exec-probe__meta">
    <dt class="exec-probe__meta-dt">Verdict</dt>
    <dd class="exec-probe__meta-dd"><code>{{ _verdict_label }}</code></dd>

    <dt class="exec-probe__meta-dt">Confidence</dt>
    <dd class="exec-probe__meta-dd">
      {%- if ctx.confidence is not none and ctx.confidence > 0 -%}
        <code>{{ '%.2f' | format(ctx.confidence) }}</code>
      {%- else -%}<span class="exec-probe__meta-empty">—</span>{%- endif -%}
    </dd>
  </dl>
  {% endif %}

  {% else %}
  {# ----- 3. Exact prompt sent (single-turn layout) ----- #}
  <div class="exec-probe__label-row">
    <p class="exec-probe__label">Exact prompt sent</p>
    <span class="exec-probe__stats">{{ (ctx.prompt or '') | length }} chars</span>
    <button type="button"
            class="exec-probe__copy"
            data-copy-source="exec-slideover-prompt"
            aria-label="Copy exact prompt sent">Copy</button>
  </div>
  {% if ctx.prompt %}
    <pre class="exec-probe__prompt" id="exec-slideover-prompt">{{ ctx.prompt }}</pre>
  {% else %}
    <pre class="exec-probe__prompt exec-probe__prompt--empty"
         id="exec-slideover-prompt">(no data available)</pre>
  {% endif %}

  {# ----- 4. Target response ----- #}
  <div class="exec-probe__label-row">
    <p class="exec-probe__label">Target response</p>
    <span class="exec-probe__stats">{{ (ctx.target_response or '') | length }} chars</span>
    <button type="button"
            class="exec-probe__copy"
            data-copy-source="exec-slideover-response"
            aria-label="Copy target response">Copy</button>
  </div>
  {% if ctx.target_response %}
    <pre class="exec-probe__response" id="exec-slideover-response">{{ ctx.target_response }}</pre>
  {% else %}
    <pre class="exec-probe__response exec-probe__response--empty"
         id="exec-slideover-response">(no data available)</pre>
  {% endif %}

  {# ----- 5. Judge verdict ----- #}
  <p class="exec-probe__label">Judge verdict</p>
  <dl class="exec-probe__meta">
    <dt class="exec-probe__meta-dt">Verdict</dt>
    <dd class="exec-probe__meta-dd"><code>{{ _verdict_label }}</code></dd>

    <dt class="exec-probe__meta-dt">Confidence</dt>
    <dd class="exec-probe__meta-dd">
      {%- if ctx.confidence is not none and ctx.confidence > 0 -%}
        <code>{{ '%.2f' | format(ctx.confidence) }}</code>
      {%- else -%}<span class="exec-probe__meta-empty">—</span>{%- endif -%}
    </dd>

    <dt class="exec-probe__meta-dt">Panel votes</dt>
    <dd class="exec-probe__meta-dd">
      {% if ctx.panel_votes %}
        {% for v in ctx.panel_votes %}<code class="exec-probe__meta-chip">{{ v }}</code>{% endfor %}
      {% else %}<span class="exec-probe__meta-empty">—</span>{% endif %}
    </dd>
  </dl>

  <p class="exec-probe__label">Judge reasoning</p>
  {% if ctx.reasoning %}
    <blockquote class="exec-probe__reason">{{ ctx.reasoning }}</blockquote>
  {% else %}
    <p class="exec-probe__reason exec-probe__reason--empty">
      (no data available)
    </p>
  {% endif %}
  {% endif %}

  {# ----- 7. Evidence chain ----- #}
  <p class="exec-probe__label">Evidence chain</p>
  <p class="exec-probe__evidence">
    <a class="exec-probe__evidence-link"
       href="/scan/{{ scan_id }}/events{% if ctx.probe_id %}?probe={{ ctx.probe_id }}{% endif %}"
       target="_blank"
       rel="noopener">View JSONL events for this {{ _kind }}</a>
  </p>


</div>