[deep-report] Fix graderManifestEntry write/read schema drift between compiler and CLI (silent field loss)

[github-actions]

Description

pkg/workflow/compiler_yaml_graders.go:67 (compiler-side, writes the grader manifest JSON) and pkg/cli/audit_report_graders.go:67 (CLI-side, reads it back for gh aw audit) each independently declare a graderManifestEntry struct. Both share ID, Name, Unit, Direction, Threshold, but the writer's struct has 8 more fields (Description, Source, Enabled, Max, Min, Digest, Run, Config) that the CLI-side reader silently drops when parsing the manifest back.

Why this matters

This is a write/read pair for the same JSON file maintained as two independently-evolving type definitions. Any new field added to the compiler's manifest schema silently fails to reach the audit report reader — the same failure mode already observed for AwInfo/AuditEngineConfig drift (AgentRuntime field). Because the two structs match on the fields they share, this kind of drift produces no test failure and no visible symptom until someone goes looking for a field that "should" be there.

Suggested Change

Move the shared read/write schema into pkg/types (following the existing BaseMCPServerConfig pattern already used to prevent MCP-config duplication between parser and workflow), so pkg/workflow and pkg/cli both import one canonical struct instead of maintaining two independently-evolving JSON contracts for the same manifest file.

Expected Impact

Eliminates a silent-data-loss class of bug where compiler-side grader manifest fields never reach the audit report, without needing to notice the gap first.

Suggested Agent

New Agent / general-purpose Go refactor.

Estimated Effort

Medium (2-3 hours — cross-package type move plus updating both call sites)

Data Source

DeepReport analysis 2026-08-28, source: Typist Go Type Consistency Analysis (discussion #56632), Cluster 8.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🔬 Deep Report · claude · agent · 236.5 AIC · ⌖ 8.15 AIC · ⊞ 12.4K · ◷

• expires on Aug 30, 2026, 1:52 PM UTC-08:00

[github-actions]

This issue was automatically closed because it expired on 2026-08-30T21:52:21.489Z.

Closed by Workflow