feat(m3): interactive d3 tree-view reporter

[suzuke]

Summary

Stacked on #8 (M2 PR 14 worktree mutex). First M3 PR. Adds opt-in interactive d3.js v7 mode for the postmortem HTML reporter. Static reporter is NOT touched (byte-identical output preserved). Per spec §1: Reporter "+ interactive d3" for M3.

What's new

src/crucible/reporter/interactive.py (new, ~614 LOC including embedded JS)

• render_interactive_html(ledger_path, *, title, metric_lookup, metric_direction) -> str — same I/O contract as render_static_html. Output: self-contained HTML with d3.js v7 inlined.
• Vertical tidy-tree (d3.tree()) with click-to-expand-collapse, pan/zoom (d3.zoom()), and a sticky details pane sidebar showing full node metadata.
• Default-collapsed beyond depth 2 (reviewer round 1 gap feat(m1b): SearchStrategy Protocol + BFTS-lite + Evaluator trust boundary #3) — doom-loop runs (M2) routinely produce 100+ nodes; full-expand on load is unusable. Toolbar offers "Expand all" / "Collapse to depth 2" / "Fit to view".
• _safe_json_for_script(data) escapes </ → <\/ plus U+2028 / U+2029 line/paragraph separators before embedding in the <script> tag. Defends against XSS via user-controlled fields like node description.

src/crucible/reporter/_vendor/ (new)

• d3.v7.9.0.min.js — vendored verbatim from https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js (ISC License, Mike Bostock).
• LICENSE-d3.txt — full ISC license text + attribution chain.
• __init__.py — exposes read_d3_source() via importlib.resources (works in dev + installed wheel) plus D3_SHA256 pin and verify_d3_integrity() for tamper-detection.
• HTML output reproduces license attribution in <!-- ... --> comment + visible footer.

CLI

• crucible postmortem --html --html-mode={static,interactive} (default: static). Static mode is byte-stable for archival / diff tooling; interactive is for exploration.

__init__.py

• Exports render_interactive_html alongside existing render_static_html and render_comparison_html.

Reviewer trail

Round	Verdict	Findings
1 (design)	NEEDS_TWEAK	4 gaps: (1) d3 vendor story missing (version pin / license / importlib.resources path); (2) </script> XSS in embedded JSON; (3) default-collapse for deep trees; (4) test coverage holes (orphan styling, JSON round-trip, compare.py untouched tripwire)
2 (impl)	VERIFIED	All 4 closed. Reviewer ran end-to-end byte-counted source (281706 bytes vendored), SHA-hashed the d3 binary, ran the test suite. Two report-fact discrepancies noted: I claimed 480 LOC (actual 614) and 2650 passed (actual 2693 with 1 pre-existing unrelated failure). Both are PR-description issues, not code issues — corrected here. Plus 4 optional polish items, 4 of 5 applied in commit 99cbe1b.

Stats

• 2 commits (1b23b2b initial + 99cbe1b polish), 7 files changed (+1,173 / -13 LOC including 273 KB d3 vendored)
• 20 tests in test_reporter_interactive.py
• Full suite: 2693 passed / 1 pre-existing failure (test_agents.py async — unrelated to PR 15) / 4 skipped

Test plan

Round 1 gap #1 — d3 vendor / attribution

• d3 source inlined; header preserved (d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock)
• D3 version displayed in footer attribution
• ISC license attribution in HTML comment + footer
• No external <script src="...d3..." references (offline-first)
• D3 SHA-256 pin + integrity check (round-2 polish)

Round 1 gap #2 — </script> XSS escape

• Description containing </script><img src=x onerror=alert('xss')> does NOT break out of the script block — exact attack payload tested, asserts out.count("</script>") == 3 (own closures only) and <\/script> escape form appears
• Round-trip preserves the literal description string after JSON.parse
• U+2028 LINE SEPARATOR escaped to 

• U+2029 PARAGRAPH SEPARATOR escaped to 
 (round-2 polish)

Round 1 gap #3 — default-collapse

• Toolbar has id="btn-expand-all" / id="btn-collapse-all" / id="btn-fit"
• Embedded JS contains d.depth >= 2 collapse pattern

Round 1 gap #4 — test coverage

• Orphan node has is_orphan: true in payload + is-orphan CSS class
• Embedded JSON deserializes to same node-id set as TrialLedger.all_nodes() — catches silent JS-side regressions
• BFTS branching topology preserved (two siblings of same parent both present)
• Best marker on correct node (per metric_direction)
• Outcome colors per node (keep ≠ discard color hex pair)
• Empty ledger graceful "(no attempts)" message
• test_compare_module_untouched_signature_check — introspects inspect.signature(render_comparison_html) and asserts the parameter set matches M2 PR 11 contract exactly (reviewer scope-tripwire)
• Static reporter byte-equivalence smoke (no d3 / no tree-payload / no btn-expand-all markers)

Known limitations / non-blockers

• Best-metric link not clickable in interactive view (static reporter wraps best-id in <a href="#nodeId">). Wiring d3-layout coordinates to document anchors is non-trivial; reviewer agreed to defer.
• No keyboard a11y (Esc to collapse, arrow nav). Spec doesn't require; postmortem is desktop-mouse tool. Defer.
• nodeSize([34, 220]): very long node IDs + metric strings may clip past ~25 chars. Reviewer accepted as adequate default.

Migration / usage

# Existing flow — unchanged, byte-identical static output:
crucible postmortem --tag t1 --html

# New M3 interactive mode:
crucible postmortem --tag t1 --html --html-mode=interactive

Manual smoke

Rendered a 9-node BFTS-shaped ledger (/tmp/m3-d3-smoke.html, 287 KB total = 273 KB d3 + 14 KB our content). Verified:

• Three actual </script> closures (vendored d3 / JSON payload / inline JS)
• Tree renders with click-collapse, pan/zoom, details pane
• Best marker (★) on correct node
• Orphan node has dashed circle styling

🤖 Generated with Claude Code