feat(inbox): render the signal report artefact log

[oliverb123]

Problem

Signal reports now accumulate a richer set of artefacts on the backend — code references, diffs, pushed commits, task runs, and notes — alongside the existing judgments and findings. The inbox had no way to surface them, so all that work-log context was invisible to reviewers.

This is the PostHog Code side of the artefact-log feature. The backend half (new artefact types, the append-only log, per-commit diffs, attribution, and unlabelled task↔report associations) lands in PostHog/posthog#61545.

Changes

Adds a chronological activity log to the right column of the report detail pane (below the status sections), rendering every artefact type with a tailored body rather than raw JSON:

• Code references / line references — syntax-highlighted code blocks with the relevant span and note.
• Code diffs — unified-diff rendering with add/remove coloring (DiffBlock).
• Commits — one artefact per pushed commit (message, sha, repo@branch), with a collapsible "View diff" that fetches the commit-vs-parent diff on demand from the backend endpoint; missing/rewritten commits surface a clean message instead of a raw error, and oversized diffs show a truncation notice.
• Task runs — loads the linked task and expands to its full conversation log via TaskLogsPanel. Badged from the artefact's (product, type): signals-pipeline runs show Research / Implementation; custom agents show their humanized product + type.
• Notes / judgments / findings / reviewers — each rendered as a point-in-time entry with a relative timestamp; judgment reasoning and long notes are collapsed behind a toggle.
• Attribution byline — every entry shows who produced it ("by Oliver" for user writes, "by agent" for task-attributed writes; system/pipeline writes show nothing), from the API's created_by / task_id attribution fields.
• A dev-only raw-JSON inspector on each row (hidden in release builds, same pattern as other dev-only controls).

Beyond rendering, this PR also tracks the backend's model changes:

• The signed-commit hook — after every successful git_signed_commit push, the harness automatically records one commit artefact per pushed commit on every signal report the task is associated with, attributed via the X-PostHog-Task-Id header. Best-effort: an artefact failure can never fail a commit that already landed. Credentials come from the sandbox env (live agentsh env file first), so it works identically in the Claude in-process server and the Codex stdio child.
• Artefact-derived task association — SignalReportTask is gone from the backend; a task_run artefact is the task↔report association. The Runs bars and the activity log now read the same artefacts: each association, its start time, and its purpose badge (Research / Implementation for the signals pipeline, humanized product + type for custom agents) all derive from the report's task_run artefacts. getSignalReportTasks and the SignalReportTask type are deleted (desktop + mobile).

Artefact content types are hand-written in packages/shared/src/domain-types.ts — every artefact extends a shared SignalReportArtefactBase carrying timestamps plus attribution — and normalized in packages/api-client's posthog-client.ts (the task_run content carries product/type, matching the backend).

How did you test this?

• pnpm typecheck — passes.
• biome check — clean on all changed files.
• vitest — git, agent, and app suites green, including new unit tests for the signed-commit hook (one POST per commit per report, header attribution, failures swallowed, no-op without a task or credentials).
• Manual: rendered a report seeded with one of each artefact type against a local backend; verified the commit diff loads against a real pushed commit, the task_run entry expands to the conversation log, and the timeline orders correctly by timestamp.
• No automated component tests were added for these renderers.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

---

Created with PostHog Code

[github-actions]

React Doctor could not complete this scan.

No React dependency found in /tmp/react-doctor-baseline-EYvgBU/package.json. Add "react" to dependencies (or peerDependencies) and re-run.

_{Reviewed by React Doctor for commit f8794f9.}

[greptile-apps]

Comments Outside Diff (1)

1. apps/code/src/renderer/features/inbox/components/detail/ArtefactTaskRun.tsx, line 814-819 (link)

   Eager task fetches vs. lazy diff fetches

   ArtefactPushedBranch only fetches the diff when the user expands the row (enabled: expanded), but ArtefactTaskRun fires getTask immediately on mount regardless of whether the row is expanded. In a report with many task_run artefacts this generates N simultaneous API calls as soon as the detail pane opens. The task title displayed in the collapsed state is the only reason for eager loading, but content.task_id could be used as the fallback text (it already is, on line 851) until the user expands the row, which would allow lazy loading here too.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: apps/code/src/renderer/features/inbox/components/detail/ArtefactTaskRun.tsx
   Line: 814-819
   
   Comment:
   **Eager task fetches vs. lazy diff fetches**
   
   `ArtefactPushedBranch` only fetches the diff when the user expands the row (`enabled: expanded`), but `ArtefactTaskRun` fires `getTask` immediately on mount regardless of whether the row is expanded. In a report with many `task_run` artefacts this generates N simultaneous API calls as soon as the detail pane opens. The task title displayed in the collapsed state is the only reason for eager loading, but `content.task_id` could be used as the fallback text (it already is, on line 851) until the user expands the row, which would allow lazy loading here too.
   
   How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
apps/code/src/renderer/features/inbox/components/detail/ArtefactTaskRun.tsx:814-819
**Eager task fetches vs. lazy diff fetches**

`ArtefactPushedBranch` only fetches the diff when the user expands the row (`enabled: expanded`), but `ArtefactTaskRun` fires `getTask` immediately on mount regardless of whether the row is expanded. In a report with many `task_run` artefacts this generates N simultaneous API calls as soon as the detail pane opens. The task title displayed in the collapsed state is the only reason for eager loading, but `content.task_id` could be used as the fallback text (it already is, on line 851) until the user expands the row, which would allow lazy loading here too.

### Issue 2 of 2
apps/code/src/renderer/features/inbox/components/detail/ArtefactTaskRun.tsx:37-38
`getTask` already returns `Task` internally (it does its own `as unknown as Task` cast). The additional cast here is redundant and suggests a type mismatch that isn't actually present. Removing the outer cast makes the intent clear.

```suggestion
    (client) => client.getTask(content.task_id),
```

_{Reviews (1): Last reviewed commit: "feat(inbox): render the signal report ar..." | Re-trigger Greptile}

[greptile-apps]

getTask already returns Task internally (it does its own as unknown as Task cast). The additional cast here is redundant and suggests a type mismatch that isn't actually present. Removing the outer cast makes the intent clear.

Suggested change

	async (client) =>
	(await client.getTask(content.task_id)) as unknown as Task,
	(client) => client.getTask(content.task_id),

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/code/src/renderer/features/inbox/components/detail/ArtefactTaskRun.tsx
Line: 37-38

Comment:
`getTask` already returns `Task` internally (it does its own `as unknown as Task` cast). The additional cast here is redundant and suggests a type mismatch that isn't actually present. Removing the outer cast makes the intent clear.

```suggestion
    (client) => client.getTask(content.task_id),
```

How can I resolve this? If you propose a fix, please make it concise.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[oliverb123]

Done in dd2d85b — getTask already returns Task, so the outer cast was redundant and is removed.