fix(evidence): include auth headers for evidence-trail fetches

agents/examples/EVIDENCE_TRAIL_PEEK_20260208.json

@@ -0,0 +1,61 @@
+{
+  "task_id": "EVIDENCE_TRAIL_PEEK_20260208",
+  "agent_id": "codex-agent",
+  "prompt_ref": {
+    "id": "evidence-trail-peek",
+    "version": "v1",
+    "sha256": "2faa11e687cfb8778aea67883185c51b9f420149e9836fb451334ab0c0f157b1",
+    "path": "prompts/features/evidence-trail-peek@v1.md"
+  },
+  "declared_scope": {
+    "paths": [
+      "apps/web/src/components/evidence/EvidenceTrailPeek.tsx",
+      "apps/web/src/components/CopilotPanel.tsx",
+      "apps/web/src/panes/GraphPane.tsx",
+      "apps/web/src/telemetry/evidenceTrailPeek.ts",
+      "apps/web/src/config/features.ts",
+      "server/src/routes/evidence-trail-peek.ts",
+      "server/src/routes/__tests__/evidence-trail-peek.test.ts",
+      "server/src/app.ts",
+      "e2e/tests/evidence-trail-peek.cy.ts",
+      "docs/standards/evidence-trail-peek.md",
+      "docs/security/data-handling/evidence-trail-peek.md",
+      "docs/ops/runbooks/evidence-trail-peek.md",
+      "docs/roadmap/STATUS.json",
+      "packages/decision-ledger/decision_ledger.json",
+      "prompts/features/evidence-trail-peek@v1.md",
+      "prompts/registry.yaml"
+    ],
+    "domains": ["ui", "api", "telemetry", "documentation", "governance"],
+    "exclusions": [
+      ".github/workflows/codeql.yml",
+      ".github/workflows/*deploy*"
+    ]
+  },
+  "allowed_operations": ["create", "edit"],
+  "verification_requirements": {
+    "tier": "B",
+    "artifacts": [
+      "artifacts/ui/evidence-trail-peek/ui.test.report.json",
+      "artifacts/api/evidence-trail-peek/api.contract.report.json"
+    ]
+  },
+  "debt_budget": {
+    "permitted": 0,
+    "retirement_target": 0
+  },
+  "success_criteria": [
+    "Read-only endpoints return deterministic responses scoped by tenant.",
+    "UI overlay renders provenance timeline, top artifacts, and three verifiable claims.",
+    "Feature flag defaults off and is gated by runtime configuration.",
+    "Telemetry emits runtime-only metrics without PII."
+  ],
+  "stop_conditions": [
+    "Missing tenant scoping for evidence queries.",
+    "Endpoints require new data model or writes."
+  ],
+  "dependencies": [
+    "prompts/features/evidence-trail-peek@v1.md"
+  ],
+  "approvals": []
+}

apps/web/src/components/CopilotPanel.tsx

@@ -9,6 +9,9 @@ import { useToast } from '@/components/ui/use-toast';
 import { Play, RotateCcw, AlertTriangle, CheckCircle, Code, BookOpen } from 'lucide-react';
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogTrigger } from '@/components/ui/dialog';
+import { EvidenceTrailPeek } from '@/components/evidence/EvidenceTrailPeek';
+import { useFeatureFlag } from '@/hooks/useFeatureFlag';
+import { features } from '@/config/features';
 
 // Define types locally if not available globally
 interface TranslationResult {
@@ -22,6 +25,16 @@ interface TranslationResult {
   citations?: { id: string; source: string; url?: string; confidence: number }[];
 }
 
+const buildAnswerId = (result: TranslationResult | null) => {
+  if (!result) return undefined;
+  const astId = (result as TranslationResult & { ast?: { id?: string } }).ast?.id;
+  if (astId) return String(astId);
+  if (result.cypher) {
+    return `cypher-${result.cypher.slice(0, 24).replace(/\s+/g, '-')}`;
+  }
+  return undefined;
+};
+
 export function CopilotPanel() {
   const [prompt, setPrompt] = useState('');
   const [result, setResult] = useState<TranslationResult | null>(null);
@@ -30,6 +43,7 @@ export function CopilotPanel() {
   const [loading, setLoading] = useState(false);
   const [activeTab, setActiveTab] = useState('prompt');
   const { toast } = useToast();
+  const evidenceTrailEnabled = useFeatureFlag('evidenceTrailPeek', features.evidenceTrailPeek);
 
   // jQuery ref for the action panel
   const actionPanelRef = useRef<HTMLDivElement>(null);
@@ -139,6 +153,14 @@ export function CopilotPanel() {
         <CardHeader className="pb-2">
           <CardTitle className="flex justify-between items-center">
             <span>Copilot v0.9</span>
+            {evidenceTrailEnabled && result && (
+              <EvidenceTrailPeek
+                answerId={buildAnswerId(result)}
+                triggerLabel="Evidence trail"
+                triggerVariant="outline"
+                contextLabel="Copilot answer"
+              />
+            )}
             {result?.isValid === false && (
               <Badge variant="destructive">Invalid Syntax</Badge>
             )}