feat: deepen research intelligence output

docs/implementation-checkpoints.md

@@ -1,5 +1,13 @@
 # Implementation Checkpoints
 
+## 109 Full Intelligence Result Review
+
+Status: implementation complete; Mission Control release and live browser acceptance are pending.
+
+Expanded research prompts so frontier models produce comprehensive, evidence-led assessments rather than generic summaries. The bridge now requests investigation scope, method, 5-12 supported facts where available, explicit fact/inference/unsupported-claim separation, contradictions, missing proof, prioritized evidence-closing actions, verdict rationale, technical article structure, and publication/disclosure risk analysis. Schema-adjacent nested analyst briefs from Kimi, Grok, and Gemini are normalized into the canonical result instead of collapsing to placeholder text.
+
+The safety boundary is unchanged: models receive normalized evidence, cannot browse or execute package code through this action, and cannot submit sandbox artifacts, send disclosure, change customer controls, or publish content.
+
 ## 108 Guarded Agent Research Completion
 
 Status: complete in the local pilot and merged.

docs/intelligence-integrations.md

@@ -15,6 +15,8 @@ ChatGPT authentication pays for and identifies the model session. SecOpsAI OAuth
 
 SecOpsAI can use your local OpenCodex proxy so research analysis is not locked to one ChatGPT account.
 
+Research actions request evidence-led structured output rather than a chat-style paragraph. A completed case analysis includes an executive summary, confirmed facts, inferences, unsupported claims, contradictions, missing evidence, prioritized next steps, a confidence-scored verdict, evidence references, limitations, and publication risks. Mission Control presents these fields separately and retains the complete normalized result and job history.
+
 Configured on this machine:
 
 - `kimi/kimi-k2.7-code`

secopsai/codex_bridge.py

@@ -703,6 +703,19 @@ def _normalize_bridge_result(payload: dict[str, Any]) -> dict[str, Any]:
     items must become readable strings for human review cards.
     """
     result = dict(payload)
+    analyst_brief = result.get("analyst_brief")
+    if isinstance(analyst_brief, dict):
+        nested_map = {
+            "executive_summary": "summary",
+            "facts": "confirmed_facts",
+            "inferences": "inferences",
+            "limitations": "limitations",
+            "recommended_actions": "recommended_actions",
+            "next_steps": "recommended_actions",
+        }
+        for source, destination in nested_map.items():
+            if not _present(result.get(destination)) and _present(analyst_brief.get(source)):
+                result[destination] = analyst_brief[source]
     list_fields = (
         "confirmed_facts",
         "inferences",

secopsai/intelligence.py

@@ -266,17 +266,20 @@ def _bridge_context(action: Action, inputs: dict[str, Any], db_path: str | None)
 def _bridge_instructions(action: Action) -> str:
     action_guidance = {
         "analyze_research_case": (
-            "Also return confirmed_facts, inferences, unsupported_claims, contradictions, and missing_evidence as arrays. "
+            "Produce a comprehensive defensive research assessment, not a generic alert summary. Summarize the scope, method, strongest evidence, and conclusion in clear prose. "
+            "Return 5-12 confirmed_facts when evidence supports them, plus inferences, unsupported_claims, contradictions, and missing_evidence as arrays. "
             "A confirmed fact must cite supplied normalized evidence; otherwise classify it as an inference or unsupported claim. "
+            "Return prioritized recommended_actions that would close the most important evidence gaps, including static, registry, IOC, comparison, or sandbox steps as applicable. "
             "Return verdict_recommendation as credible, likely, inconclusive, not_substantiated, or benign; "
             "verdict_confidence as 0-100; verdict_rationale; and verdict_evidence_refs using only supplied evidence or pipeline step identifiers. "
             "Never downgrade a package merely because local exposure was not observed. "
         ),
         "generate_analyst_brief": (
-            "Also return an article_outline array. Keep it suitable for a technical draft, not publication-ready copy. "
+            "Write a substantial analyst brief with an executive summary, investigation scope, methodology, confirmed findings, implications, limitations, and prioritized next steps in the available schema fields. "
+            "Also return an article_outline array with 6-12 specific sections suitable for a technical research draft, not publication-ready copy. "
         ),
         "review_publication_safety": (
-            "Also return publication_risks as an array and disclosure_draft as review-only text. Do not approve or send either. "
+            "Assess evidentiary, attribution, privacy, operational, legal, disclosure, and reproducibility risks. Return specific publication_risks, corrective recommended_actions, and a detailed disclosure_draft as review-only text. Do not approve or send either. "
         ),
     }.get(action.name, "")
     return (
@@ -285,7 +288,8 @@ def _bridge_instructions(action: Action) -> str:
         "Do not execute commands, access files, browse, contact external parties, change product state, or approve publication. "
         f"{action_guidance}For actions other than analyze_research_case, set verdict_recommendation to inconclusive, "
         "verdict_confidence to 0, verdict_rationale to 'Verdict not assessed by this action', and verdict_evidence_refs to an empty array. "
-        "Return concise JSON matching the required output schema. Model output is evidence-bounded and subject to SecOpsAI guardrails."
+        "Use the available output limits fully when evidence warrants detail, while avoiding repetition. Return JSON matching the required output schema. "
+        "Model output is evidence-bounded and subject to SecOpsAI guardrails."
     )
 
 

tests/test_intelligence.py

@@ -409,3 +409,36 @@ def test_bridge_normalizes_kimi_style_structured_result():
     assert normalized["limitations"] == ["Runtime behavior was not observed."]
     validated = validate_bridge_result("analyze_research_case", normalized, provider="opencodex:kimi")
     assert validated["provider"] == "opencodex:kimi"
+
+
+def test_bridge_promotes_nested_analyst_brief_fields():
+    from secopsai.codex_bridge import _normalize_bridge_result
+
+    normalized = _normalize_bridge_result(
+        {
+            "analyst_brief": {
+                "executive_summary": "A detailed evidence-led executive summary.",
+                "facts": ["Fact one", "Fact two"],
+                "inferences": ["Inference one"],
+                "limitations": ["Runtime behavior was not observed."],
+                "next_steps": ["Run approved isolated analysis."],
+            },
+            "missing_evidence": ["Sandbox telemetry"],
+        }
+    )
+    assert normalized["summary"] == "A detailed evidence-led executive summary."
+    assert normalized["confirmed_facts"] == ["Fact one", "Fact two"]
+    assert normalized["inferences"] == ["Inference one"]
+    assert normalized["limitations"] == ["Runtime behavior was not observed."]
+    assert normalized["recommended_actions"] == ["Run approved isolated analysis."]
+
+
+def test_research_bridge_prompt_requests_evidence_led_depth():
+    from secopsai.intelligence import ACTIONS, _bridge_instructions
+
+    action = ACTIONS["analyze_research_case"]
+    prompt = _bridge_instructions(action)
+    assert "comprehensive defensive research assessment" in prompt
+    assert "5-12 confirmed_facts" in prompt
+    assert "prioritized recommended_actions" in prompt
+    assert "Use the available output limits fully" in prompt