feat: add final-report audit paste tool to web UI (Closes #431)

Expose /audit and /api/audit for local validator previews using
final_report_validator and review schema checks. Operators can paste
reports, auto-detect task kind, and get structured findings with
suggested next prompts and issue-comment drafts.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

webui/app.py

@@ -14,10 +14,15 @@ from webui.project_registry import find_project, load_registry, registry_to_dict
 from webui.project_views import render_project_detail, render_projects_list
 from webui.prompt_library import find_prompt, library_to_dict
 from webui.prompt_views import render_prompt_detail, render_prompts_page
+from final_report_validator import FINAL_REPORT_TASK_KINDS
+
+from webui.audit_validator import audit_report, audit_to_dict
+from webui.audit_views import render_audit_page
 from webui.queue_loader import load_queue_snapshot, snapshot_to_dict
 from webui.queue_views import render_queue_page
 
 _READ_ONLY_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
+_AUDIT_MUTATION_PATHS = frozenset({"/audit", "/api/audit"})
 
 
 def _stub_page(title: str, description: str) -> HTMLResponse:
@@ -126,13 +131,49 @@ async def runtime(_request: Request) -> HTMLResponse:
     )
 
 
-async def audit(_request: Request) -> HTMLResponse:
-    return _stub_page(
-        "Audit",
-        "Report audit will accept pasted final reports and run validator previews.",
+async def _parse_audit_form(request: Request) -> tuple[str, str | None]:
+    if request.method == "GET":
+        return "", None
+    content_type = (request.headers.get("content-type") or "").lower()
+    if "application/json" in content_type:
+        payload = await request.json()
+        if not isinstance(payload, dict):
+            return "", None
+        report_text = str(payload.get("report_text") or "")
+        task_kind = payload.get("task_kind")
+        return report_text, str(task_kind) if task_kind else None
+    form = await request.form()
+    report_text = str(form.get("report_text") or "")
+    task_kind = form.get("task_kind")
+    return report_text, str(task_kind) if task_kind else None
+
+
+async def audit(request: Request) -> HTMLResponse:
+    report_text, task_kind = await _parse_audit_form(request)
+    result = None
+    if request.method == "POST" and report_text.strip():
+        result = audit_report(report_text, task_kind=task_kind)
+    return HTMLResponse(
+        render_audit_page(
+            report_text=report_text,
+            task_kind=task_kind,
+            result=result,
+        )
     )
 
 
+async def api_audit(request: Request) -> JSONResponse:
+    if request.method == "GET":
+        return JSONResponse({
+            "usage": "POST JSON with report_text and optional task_kind",
+            "task_kinds": sorted(FINAL_REPORT_TASK_KINDS),
+        })
+    report_text, task_kind = await _parse_audit_form(request)
+    if not report_text.strip():
+        return JSONResponse({"error": "report_text required"}, status_code=400)
+    return JSONResponse(audit_to_dict(audit_report(report_text, task_kind=task_kind)))
+
+
 async def worktrees(_request: Request) -> HTMLResponse:
     return _stub_page(
         "Worktrees",
@@ -148,6 +189,9 @@ async def leases(_request: Request) -> HTMLResponse:
 
 
 async def method_not_allowed(request: Request, _exc: Exception) -> Response:
+    path = request.url.path
+    if path in _AUDIT_MUTATION_PATHS and request.method == "POST":
+        return JSONResponse({"error": "not_found"}, status_code=404)
     if request.method not in _READ_ONLY_METHODS:
         return JSONResponse(
             {"error": "read-only-mvp", "detail": f"{request.method} not permitted"},
@@ -172,7 +216,8 @@ def create_app() -> Starlette:
             Route("/prompts/{prompt_id}", prompt_detail, methods=["GET"]),
             Route("/api/prompts", api_prompts, methods=["GET"]),
             Route("/runtime", runtime, methods=["GET"]),
-            Route("/audit", audit, methods=["GET"]),
+            Route("/audit", audit, methods=["GET", "POST"]),
+            Route("/api/audit", api_audit, methods=["GET", "POST"]),
             Route("/worktrees", worktrees, methods=["GET"]),
             Route("/leases", leases, methods=["GET"]),
         ],