bug(reporting): render the decision engine’s framework-aware remediation

[pengfei-threemoonslab]

Problem

The release-decision engine already produces a framework-aware rank-1 action for each insufficient-evidence gap. Two short-form renderers overwrite that decision with a generic MCP/OpenAPI/OpenAI-SDK sentence, so a confirmed Google ADK project is told to consider unrelated source formats.

This issue owns that projection bug only. The separate vocabulary question—how to distinguish heuristic action projections from evidence-backed semantic assertions—is tracked in #357.

Expected behavior

Console, GitHub summary, and terminal verifier output should render the decision’s own rank-1 evidence-gap action. Use the generic source-format sentence only when the engine cannot identify a framework or supply a concrete action.

Acceptance criteria

• A Google ADK-only result leads with the generated local inventory/declaration artifact and the exact google_adk manifest/evidence route.
• At least one framework in the decision engine’s inventory-key map has a regression proving renderer output agrees with release_decision.evidence_coverage.evidence_gaps[0].next_action.
• Console, GitHub step summary, verifier/agent control, and packet do not contradict the authoritative decision action.
• The generic fallback remains only for an unidentified/unsupported source shape.
• The route never invents binding, effect, authority, approval, or runtime evidence.
• The adopter-facing terminal output used by Epic: make the adoption walk compose — preview → init --local-review → verify #327 is the primary surface; a demoted scan-only message is not considered sufficient.

Non-goal

Changing the insufficient_evidence verdict or making human-owned declarations agent-executable.

[pengfei-threemoonslab]

Confirmed — with one correction that makes this much smaller than the issue frames it.

The framework-aware routing already exists in the decision engine. ci/release_decision.py:353-358:

_INVENTORY_MANIFEST_KEYS: tuple[tuple[str, str], ...] = (
    ("langchain", "langchain.tool_inventories"),
    ("crewai", "crewai.tool_inventories"),
    ("google_adk", "google_adk.tool_inventories"),
    ("n8n", "n8n.tool_inventories"),
)

google_adk.tool_inventories is a real manifest key (schemas/manifest/google_adk.py:20), and the gap action already points at it — the comment on that block says as much: "The gap action points the user at the exact manifest key; everything else degrades to the generic provide_source action."

The generic sentence is hardcoded in two renderer surfaces that never consult the decision:

• cli/_helpers.py:449-453 — the console summary
• ci/github_summary.py:44-45 — the GitHub step summary

Both emit the MCP/OpenAPI/OpenAI-SDK string on decision == "insufficient_evidence" unconditionally. So this is not "make the engine framework-aware"; it is "make two projections stop overwriting what the engine already decided." That fits the one-decision-engine rule squarely — a projection contradicting release_decision is a bug in the projection — and needs no new surface and no metric justification under the CONTRIBUTING.md gate.

Suggest the fix render the decision's own rank-1 evidence-gap action, with the generic string kept strictly as the fallback for the unidentified-framework case, and a test asserting the console text agrees with release_decision.evidence_coverage.evidence_gaps[0].next_action for at least one framework in _INVENTORY_MANIFEST_KEYS. There is precedent: #296 already fixed the framework-correctness of the low-confidence remedy (tool_inventories does not exist for openai_agents_sdk) inside the engine — the renderers were simply not brought along.

The second half is a genuinely separate concern. Labeling heuristic action projections as provisional versus evidence-backed semantic assertions — the effect: write / writes_data versus effect: unknown confusion — is a vocabulary question across console, JSON, and packet, not a routing fix. It is the more valuable of the two, and it is worth splitting if the first half gets picked up quickly. Note the tension to respect while doing it: making a heuristic projection look weaker must not make it look ignorable, since the conservative destructive-risk heuristic on delete_account is doing real work.

Labeled P2 / v0.17.0.