orb(dashboard): per-repo trust panel — ledger verify, anchor, decision records, calibration with coverage, attestation states

[JSONbored]

Context

Part of the ORB maintainer chat platform epic. The verification stack recently became real: the public ledger-verify endpoint (the #9120 fix), the external anchor with verify returning the chain hash (the #9122 fix), and published, digest-stable decision records (the #9123 fix) have all landed; the attested-backtest path (#8537/#8538) and per-tenant corpus export (#8539) are in flight. This issue renders that stack as a product surface: a per-repo trust panel inside the maintainer dashboard.

⚠️ Blocked by the unified tenant verification contract issue (this epic's milestone-42 sibling) — the panel renders that contract; do not invent a parallel taxonomy here. Do not start until it closes.

Requirements

1. A per-repo trust panel presenting, from the verification contract's matrix: live ledger-verify status (real call, not cached decoration), the latest external-anchor reference, decision-record lookup by digest (paste a digest from a PR comment → see the full published record), and the calibration/fairness summary — accuracy always with coverage and confidence interval, plus the certified-guarantee line where a guarantee is active.
2. When attestation envelopes exist for a run (orb: run the backtest replay inside the CoCo runtime class and persist its attestation envelope #8537), render the envelope reference and its verification path per docs+ui: extend verify-this-review with the attested-run verification path #8538; absent envelopes render as "not yet attested", never as an error.
3. The "not verifiable" boundary from the contract (live-gate execution, per Research: the attested-evaluation epic covers offline backtests only — decide whether the LIVE decision path needs attestation, and in what order #9141's recorded decision) is stated in-panel, in the contract's language — honesty is the feature.
4. Every panel figure links to its public artifact (endpoint or docs walkthrough) so a skeptical maintainer can leave the dashboard and reproduce the number.
5. Chat integration: the grounding backend's ledger/calibration tools and this panel present identical numbers from identical sources — one implementation, two renderings.

Deliverables

• The trust panel in apps/loopover-ui's app area (ui-kit components), fed by existing public/protected endpoints — no new verification mechanisms.
• Tests: render states (verified / anchor-stale / record-missing / not-yet-attested), figure-formatting rules (coverage+interval always present with accuracy), link integrity to the contract's artifacts.

Expected outcome

A maintainer can see — and independently re-derive — exactly how much of LoopOver's decision history is verified, from inside the product.

[linear-code]

JSO-6353

[JSONbored]

Design-pass addendum (2026-07-28) — presentation treatments for this panel

From the frontend design pass (system filed as #9568; prototype validates before implementation):

• Receipt/evidence treatment: the panel, decision records, and audit entries share the printed-record style from Design language: agency-accent semantics, ghost/dry-run treatment, receipt/evidence treatment, verdict stamp, Loop Ring #9568 (mono, hairline rules, tabular columns, digest serials) — "this part is evidence" legible at a glance.
• "Reproduce this" drawers: every figure gets a small affordance opening a drawer with the actual public curl for that figure and its live response, copy-ready. Requirement 4's "every figure links to its public artifact" upgraded from a link to a demonstration — the panel shows the user how to leave the dashboard and re-derive the number.
• Anchor chain visualization: the external-anchor history as a compact linked-hash rendering, each node hoverable to its anchor reference — tamper-evidence legible without crypto vocabulary.
• Calibration as intervals: the coverage+interval rule rendered structurally — the confidence interval is the graphic (a range bar with the point estimate as a tick inside it, coverage as fill beneath), so a bare scalar is unrenderable by construction.
• Digest lookup moment: live format validation on paste; a found record prints top-to-bottom (~400ms, static under reduced motion); not-found renders as a neutral evidence-absent state, never an error tone.

The public twin of this panel — an unauthenticated shareable /proof/:owner/:repo page + README badge over the same sources — is filed as #9569 (blocked on #9568, one-implementation-two-renderings with this panel).