QA: harden Control Center trust UI

[00PrabalK00]

Scope

Surgical QA of the v0.9.0 Control Center trust layer only: ControlCenter methods (flight_records, flight_record, timeline, worktree_board, context_packets, roi, _worktree_schedules), the read-only /api/* endpoints, and the app.js trust views (timelineView, worktreeBoardView, laneCard, flightRecordView, roiView, contextPacketView, bindFlightRecords, bindContextPackets).

Defects found

XSS — none exploitable (rendering already safe)

Audited every interpolation in the trust views. All user/task-controlled strings (task title/objective, agent, branch, lane role, file/owned paths, schedule objective, lane name) are already wrapped in escapeHtml(...). The only unescaped interpolations were the data-task attribute values, which today hold strictly server-generated T%04d ids (not user-controllable), so there was no live XSS hole.

Hardened anyway (defense-in-depth): data-task in flightRecordView, contextPacketView, and taskTable now go through escapeHtml. These values are read back via dataset.task into API/inspect calls, so escaping prevents attribute breakout should id formats ever change.

Robustness — confirmed solid

• Empty store (no db_file, no tasks): all trust endpoints return HTTP 200 with sane empty JSON — verified no 500/traceback.
• /api/flight-record?task=BOGUS raises ValueError/FlightRecordError, both caught by the handler and returned as a clean 400 JSON error.
• context_packets already has a broad except that degrades to empty/None fields when intel functions raise.
• Trust endpoints are GET/read-only and not gated by the POST mutation token; mutations still require it.

Tests added (+9, all green)

tests/test_control_center.py:

1. test_trust_endpoints_on_empty_store_return_200_and_sane_json
2. test_flight_record_with_bogus_task_returns_clean_400 (BOGUS / T9999 / empty)
3. test_timeline_and_board_with_standalone_worktree_only
4. test_timeline_and_board_with_scheduled_lanes
5. test_timeline_and_board_empty_when_nothing_scheduled
6. test_context_packets_degrade_when_intel_raises (monkeypatches score_intel/gather_context_intel)
7. test_trust_endpoints_are_get_readable_without_token (+ mutation still 403)
8. test_trust_endpoints_preserve_malicious_strings_verbatim_for_ui_escaping
9. test_app_js_escapes_user_controlled_trust_values (static XSS guard: asserts every trust-view interpolation is escapeHtml-wrapped and forbids known-unsafe patterns)

Verification

GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null python -m unittest discover -s tests → 295 tests OK. Git-backed tests persist identity in setUp; HTTP servers bind 127.0.0.1:0 and shut down in finally.

🤖 Generated with Claude Code