Expose chunk plan provenance and safe diagnostics

internal/core/diagnostics/artifacts.go

@@ -8,6 +8,7 @@ const (
 	ArtifactCheckpointEvents   = "checkpoint-events.json"
 	ArtifactSourceDocument     = "source-document.json"
 	ArtifactRunManifest        = "run-manifest.json"
+	ArtifactChunkPlan          = "chunk-plan.json"
 	ArtifactRunReport          = "run-report.json"
 	ArtifactWarnings           = "warnings.json"
 	ArtifactErrorLog           = "error.log"

internal/core/diagnostics/artifacts_test.go

@@ -10,6 +10,7 @@ func TestArtifactNamesUseExtractionOrientedNames(t *testing.T) {
 		ArtifactResolvedReferences,
 		ArtifactSourceDocument,
 		ArtifactRunManifest,
+		ArtifactChunkPlan,
 		ArtifactRunReport,
 		ArtifactWarnings,
 		ArtifactErrorLog,

internal/core/diagnostics/run_dir.go

@@ -167,6 +167,10 @@ func (r *RunDirectory) WriteRunManifest(manifest artifacts.RunManifest) error {
 	return r.WriteJSONArtifact(ArtifactRunManifest, manifest)
 }
 
+func (r *RunDirectory) WriteChunkPlan(summary artifacts.ChunkPlanSummary) error {
+	return r.WriteJSONArtifact(ArtifactChunkPlan, summary)
+}
+
 func (r *RunDirectory) WriteRunReport(payload any) error {
 	return r.WriteJSONArtifact(ArtifactRunReport, payload)
 }

internal/core/diagnostics/run_dir_test.go

@@ -200,6 +200,9 @@ func TestWriteTypedArtifacts(t *testing.T) {
 	if err := runDir.WriteRunManifest(artifacts.RunManifest{RunID: "run-1"}); err != nil {
 		t.Fatalf("WriteRunManifest: %v", err)
 	}
+	if err := runDir.WriteChunkPlan(artifacts.ChunkPlanSummary{Mode: "auto", RequestedModule: "chunk/test", LookupStatus: "invalid", LookupReason: "stored chunk plan failed validation", ValidationStatus: "not_run", PublicationStatus: "not_published"}); err != nil {
+		t.Fatalf("WriteChunkPlan: %v", err)
+	}
 	if err := runDir.WriteRunReport(map[string]any{"ok": true}); err != nil {
 		t.Fatalf("WriteRunReport: %v", err)
 	}
@@ -213,6 +216,7 @@ func TestWriteTypedArtifacts(t *testing.T) {
 		ArtifactResolvedReferences,
 		ArtifactSourceDocument,
 		ArtifactRunManifest,
+		ArtifactChunkPlan,
 		ArtifactRunReport,
 		ArtifactWarnings,
 	} {
@@ -220,6 +224,15 @@ func TestWriteTypedArtifacts(t *testing.T) {
 			t.Fatalf("expected artifact %q: %v", name, err)
 		}
 	}
+	chunkSummary, err := os.ReadFile(filepath.Join(runDir.Path(), ArtifactChunkPlan))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, forbidden := range []string{"units", "annotations", "source content", "prompt", "response", "raw invalid"} {
+		if strings.Contains(string(chunkSummary), forbidden) {
+			t.Fatalf("chunk plan summary leaked %q: %s", forbidden, chunkSummary)
+		}
+	}
 }
 
 func TestWriteRedactedEffectiveConfigWritesPayloadReturnedByProvider(t *testing.T) {