feat(reports): attestation kind selector + kind-aware CSV download (B1b) (#642)

Wire the Framework Attestation kind (B1a backend) into the Reports UI:

- Header gains a report-kind selector (Executive / Attestation), a
  host:write affordance beside the scope pickers. The generate body
  sends kind only when attestation is chosen; executive stays the
  implicit default.
- The detail header's primary download is now kind-aware: an executive
  report offers Download PDF, an attestation report offers Download CSV
  (the per-host, per-rule evidence face). JSON (the signed canonical
  face) is offered for both. downloadReportFace accepts the csv format.
- kindLabel maps attestation to "Attestation" for the Library type chip.
- Widen the Report.kind wire enum to [executive, attestation] and
  regenerate server.gen.go + schema.d.ts.

Spec frontend-reports v1.6.0: C-09 + AC-10 (source-inspection test).
AC-07 assertion updated for the kind-aware primary control.

Author: remyluslosius

api/openapi.yaml

@@ -5403,7 +5403,7 @@ components:
         title: {type: string}
         kind:
           type: string
-          enum: [executive]
+          enum: [executive, attestation]
         scope_label: {type: string}
         scope: {$ref: '#/components/schemas/ReportScope'}
         data_as_of: {type: string, format: date-time}

frontend/src/api/schema.d.ts

@@ -3585,7 +3585,7 @@ export interface components {
             id: string;
             title: string;
             /** @enum {string} */
-            kind: "executive";
+            kind: "executive" | "attestation";
             scope_label: string;
             scope: components["schemas"]["ReportScope"];
             /** Format: date-time */

frontend/src/pages/reports/ReportsPage.tsx

@@ -67,6 +67,7 @@ function asExecutiveContent(content: Report['content']): ExecutiveContent {
 
 function kindLabel(kind: Report['kind']): string {
   if (kind === 'executive') return 'Executive';
+  if (kind === 'attestation') return 'Attestation';
   return kind;
 }
 
@@ -85,7 +86,8 @@ export function ReportsPage() {
 
   const [tab, setTab] = useState<'library' | 'templates' | 'scheduled'>('library');
   const [selectedId, setSelectedId] = useState<string | null>(null);
-  // Scope for the next Generate. '' = all hosts / all frameworks.
+  // Kind + scope for the next Generate. '' = all hosts / all frameworks.
+  const [reportKind, setReportKind] = useState<'executive' | 'attestation'>('executive');
   const [scopeGroupId, setScopeGroupId] = useState<string>('');
   const [scopeFramework, setScopeFramework] = useState<string>('');
 
@@ -133,7 +135,12 @@ export function ReportsPage() {
 
   const generateMutation = useMutation({
     mutationFn: async () => {
-      const body: { group_id?: string; framework?: string } = {};
+      const body: {
+        kind?: 'executive' | 'attestation';
+        group_id?: string;
+        framework?: string;
+      } = {};
+      if (reportKind === 'attestation') body.kind = 'attestation';
       if (scopeGroupId) body.group_id = scopeGroupId;
       if (scopeFramework) body.framework = scopeFramework;
       const { data, error, response } = await api.POST('/api/v1/reports:generate', { body });
@@ -172,6 +179,29 @@ export function ReportsPage() {
           </div>
         </div>
         <div style={{ display: 'flex', alignItems: 'center', gap: 8, flexShrink: 0 }}>
+          {canGenerate && (
+            <select
+              aria-label="Report kind"
+              value={reportKind}
+              onChange={(e) => setReportKind(e.target.value as 'executive' | 'attestation')}
+              disabled={generateMutation.isPending}
+              title="Executive summary (leadership) or Framework Attestation (auditor CSV evidence)"
+              style={{
+                height: 34,
+                padding: '0 10px',
+                borderRadius: 'var(--ow-radius-sm, 6px)',
+                border: '1px solid var(--ow-line)',
+                background: 'var(--ow-bg-2)',
+                color: 'var(--ow-fg-0)',
+                fontFamily: 'inherit',
+                fontSize: 13,
+                cursor: generateMutation.isPending ? 'default' : 'pointer',
+              }}
+            >
+              <option value="executive">Executive</option>
+              <option value="attestation">Attestation</option>
+            </select>
+          )}
           {canGenerate && (
             <select
               aria-label="Report scope"
@@ -439,7 +469,7 @@ function LibraryTab({
 // session cookie authenticates it (same-origin credentials) and no CSRF
 // token is needed; the filename comes from the server's
 // Content-Disposition. Errors are surfaced to the caller.
-async function downloadReportFace(id: string, format: 'pdf' | 'json'): Promise<void> {
+async function downloadReportFace(id: string, format: 'pdf' | 'json' | 'csv'): Promise<void> {
   const res = await fetch(`/api/v1/reports/${id}/export?format=${format}`, {
     credentials: 'same-origin',
   });
@@ -565,12 +595,12 @@ function ReportDetail({
   id: string;
   onClose: () => void;
 }) {
-  const [downloading, setDownloading] = useState<'pdf' | 'json' | null>(null);
+  const [downloading, setDownloading] = useState<'pdf' | 'json' | 'csv' | null>(null);
   const [downloadError, setDownloadError] = useState<string | null>(null);
   const [verifying, setVerifying] = useState(false);
   const [verifyResult, setVerifyResult] = useState<VerifyResult | null>(null);
 
-  async function onDownload(format: 'pdf' | 'json') {
+  async function onDownload(format: 'pdf' | 'json' | 'csv') {
     setDownloading(format);
     setDownloadError(null);
     try {
@@ -615,6 +645,16 @@ function ReportDetail({
 
   const resolved = report ?? detailQ.data ?? null;
 
+  // The primary face follows the report kind: executive renders a one-page
+  // PDF, attestation renders the per-(host, rule) CSV evidence bundle. JSON
+  // is offered for both (it is the signed canonical face).
+  const isAttestation = resolved?.kind === 'attestation';
+  const primaryFace: 'pdf' | 'csv' = isAttestation ? 'csv' : 'pdf';
+  const primaryLabel = isAttestation ? 'Download CSV' : 'Download PDF';
+  const primaryTitle = isAttestation
+    ? 'Download the per-host, per-rule CSV evidence'
+    : 'Download the one-page executive PDF';
+
   return (
     <div
       role="dialog"
@@ -709,9 +749,9 @@ function ReportDetail({
               )}
               <button
                 type="button"
-                onClick={() => onDownload('pdf')}
+                onClick={() => onDownload(primaryFace)}
                 disabled={downloading !== null}
-                title="Download the one-page executive PDF"
+                title={primaryTitle}
                 style={{
                   height: 32,
                   padding: '0 12px',
@@ -727,7 +767,7 @@ function ReportDetail({
                   whiteSpace: 'nowrap',
                 }}
               >
-                {downloading === 'pdf' ? 'Preparing…' : 'Download PDF'}
+                {downloading === primaryFace ? 'Preparing…' : primaryLabel}
               </button>
               <button
                 type="button"

frontend/tests/pages/reports.test.ts

@@ -10,6 +10,9 @@
 //          honest loading / empty / error states via apiErrorMessage
 //   AC-04  only mutation is the generate POST (no PUT/DELETE); --ow-* tokens;
 //          no prose em-dash
+//   AC-10  report-kind selector (executive/attestation) drives the generate
+//          body; kind-aware primary download (csv for attestation, pdf
+//          otherwise); kindLabel maps attestation -> "Attestation"
 
 import { describe, expect, test } from 'vitest';
 import { readFileSync } from 'node:fs';
@@ -119,10 +122,12 @@ describe('frontend-reports — reports library page', () => {
     expect(PAGE_SRC.includes('Authorization')).toBe(false);
     // The blob is saved via an object URL.
     expect(PAGE_SRC).toContain('URL.createObjectURL');
-    // The detail renders Download PDF + JSON controls calling onDownload,
-    // with an in-flight disabled state and an error surface.
+    // The detail renders a primary (kind-aware) download + a JSON control
+    // calling onDownload, with an in-flight disabled state and an error
+    // surface. (The primary face is computed from the report kind in B1b;
+    // the literal "Download PDF" label still appears for executive reports.)
     expect(PAGE_SRC).toContain('Download PDF');
-    expect(PAGE_SRC).toMatch(/onDownload\('pdf'\)/);
+    expect(PAGE_SRC).toMatch(/onDownload\(primaryFace\)/);
     expect(PAGE_SRC).toMatch(/onDownload\('json'\)/);
     expect(PAGE_SRC).toContain('downloading');
     expect(PAGE_SRC).toContain('downloadError');
@@ -159,6 +164,24 @@ describe('frontend-reports — reports library page', () => {
     expect(PAGE_SRC).toMatch(/if \(scopeFramework\) body\.framework = scopeFramework/);
   });
 
+  // @ac AC-10
+  test('frontend-reports/AC-10 — report-kind selector + kind-aware download', () => {
+    // A kind select bound to reportKind, defaulting to executive.
+    expect(PAGE_SRC).toContain('reportKind');
+    expect(PAGE_SRC).toMatch(/<select[\s\S]*?value=\{reportKind\}/);
+    expect(PAGE_SRC).toContain('aria-label="Report kind"');
+    // The generate body sets kind only when attestation is chosen.
+    expect(PAGE_SRC).toMatch(/if \(reportKind === 'attestation'\) body\.kind = 'attestation'/);
+    // The primary download is kind-aware: csv face for attestation, pdf
+    // otherwise, with a Download CSV / Download PDF label switch.
+    expect(PAGE_SRC).toMatch(/primaryFace[^\n]*isAttestation \? 'csv' : 'pdf'/);
+    expect(PAGE_SRC).toContain('Download CSV');
+    // downloadReportFace accepts the csv format.
+    expect(PAGE_SRC).toMatch(/format: 'pdf' \| 'json' \| 'csv'/);
+    // The type chip labels attestation reports "Attestation".
+    expect(PAGE_SRC).toMatch(/kind === 'attestation'\) return 'Attestation'/);
+  });
+
   // @ac AC-04
   test('frontend-reports/AC-04 — generate is the only mutation, tokens, no em-dash', () => {
     // The only mutating call is the generate POST; no PUT/DELETE.