Tasks: GET /api/v1/sessions/transcript

Derived from design.md and testing-plan.md. Ticket: #209.

Task list

• [x] 1. get_transcript in core/sessions.py
  • Endpoint resolution (closed + PR endpoints), harness gate, id validation, per-character munge + CLAUDE_CONFIG_DIR, fallback scan, containment check, bounded tail, malformed-line wrapping, the read-shaped return.
  • Depends on: none
  • Requirements: R1.1–R1.4, R2.1–R2.5
  • Test: T1 — test_core_sessions.py (red→green)
• [x] 2. GET /api/v1/sessions/transcript route + contract
  • One delegation line, operationId: sessionTranscript, tail validated ge=0; the authored OpenAPI file gains the path.
  • Depends on: 1
  • Requirements: R2.6, R3.1
  • Test: T2, T3 (red→green)
• [x] 3. session_transcript MCP tool
  • One-liner binding beside the other reads in api/mcp.py.
  • Depends on: 1
  • Requirements: R3.2
  • Test: T2 (tool registration asserted in the existing MCP integration suite)
• [x] 4. Integration scenarios
  • test_transcript_integration.py with Gherkin docstrings: served tail, closed session, no-session/cursor/missing-file 404s, traversal + symlink negatives.
  • Depends on: 2
  • Requirements: R1, R2; abuse cases 1, 3, 4
  • Test: T2, T8
• [x] 5. UI: the trace panel goes live
  • types.ts + client.ts transcript(), demo fixture + transport answer, transcriptPath munge fix, transcriptTurns projection, WorkItemDetail.tsx rows + fallback, stale copy removed (App.tsx, docstrings, ui/README.md), tests.
  • Depends on: 2
  • Requirements: R4.1–R4.4
  • Test: T15
• [x] 6. Docs + decision
  • docs/capabilities/control-plane.md (current behaviour + history row), ui/README.md § Not yet served, docs/decisions/decision-079.md (the fail-closed file boundary; no redaction; no CLI verb; no Cursor).
  • Depends on: 1–5
  • Requirements: R3, R4.3
  • Test: T12, T14
• [x] 7. Verification
  • Execute the plan, tick activities with evidence under evidence/.
  • Depends on: 1–6
  • Requirements: all
  • Test: the plan itself