fix: repair composite input task 8 proofs

.superpowers/sdd/2026-08-12-composite-input-expressions/task-8-fix-report.md

@@ -0,0 +1,54 @@
+# Task 8 Repair Report
+
+## Scope
+
+This repair addresses both findings in `task-8-review.md` without changing
+production behavior:
+
+- The browser route regression no longer mocks `createDraftAuthoringClient` or
+  its mutation methods.
+- The Python vertical proof uses the normal `state.result` state/output path
+  instead of the unsupported `state.text` workaround explanation.
+
+## Browser Proof
+
+`DraftDetailRoute.authoring-sync.test.tsx` now constructs the production
+`createConsoleWriteExecutor`, keeps the production `createDraftAuthoringClient`
+and `callOperation` implementations, and stubs only `fetch` at the established
+connection contract boundary. The test:
+
+1. Returns a canonical RPC success envelope through the real response parser and
+   draft workspace decoder.
+2. Submits the composite editor form.
+3. Asserts the exact `/api/rpc` JSON body, including
+   `workflow.draft_workspaces.set_step_input_bindings`, `workspace_id`,
+   `revision`, `step_id`, and the recursive array expression payload.
+4. Asserts the returned revision and rehydrated path/literal editor values.
+
+This fails on incorrect encoder field names or a malformed canonical response;
+the route has no mocked authoring client left to conceal either error.
+
+## Python Proof
+
+`tests/wf_api/test_composite_input_workflow.py` now declares `state.result`,
+projects the capability's `text` result into `state.result`, and exposes that
+state value as public output `result`. The composite root object still combines
+`state.foo` with the literal `wowcool`, and the vertical run still produces
+`hello wowcool`.
+
+## Verification
+
+- `pnpm --dir web/apps/console test -- src/workspace/routes/DraftDetailRoute.authoring-sync.test.tsx --reporter=dot`: **2 passed**
+- `uv run pytest tests/wf_api/test_composite_input_workflow.py -q`: **1 passed**
+- `pnpm --dir web/apps/console test -- src/workspace/routes/DraftDetailRoute.authoring-sync.test.tsx src/workspace/domain/draft-authoring-client.test.ts src/workspace/domain/write-executor.test.ts src/connection/api.test.ts --reporter=dot`: **27 passed**
+- `pnpm --dir web/packages/rpc test -- --reporter=dot`: **135 passed, 3 skipped**
+- `pnpm --dir web/apps/console typecheck`: **passed**
+- `pnpm --dir web/packages/rpc typecheck`: **passed**
+- `pnpm --dir web/apps/console build`: **passed** with the existing large-chunk warning
+- `uv run ruff check tests/wf_api/test_composite_input_workflow.py`: **passed**
+- `uv run ruff format --check tests/wf_api/test_composite_input_workflow.py`: **passed**
+- `git diff --check`: **passed**
+
+No unclassified failure was encountered in the focused repair gates. The
+repository-wide baseline failures remain classified in `task-8-report.md` and
+were not re-labeled by this repair.

.superpowers/sdd/2026-08-12-composite-input-expressions/task-8-report.md

@@ -7,9 +7,11 @@
   item, and the final workflow output is `hello wowcool`.
 - Added remote CLI coverage using the existing RPC client/transport seam. The
   bindings file survives `wf draft set-input` as the exact composite payload.
-- Added a browser route regression that constructs the recursive editor state,
-  asserts the exact `set_step_input_bindings` client payload, and verifies the
-  canonical response rehydrates the editor.
+- Added a browser route regression through the real `createDraftAuthoringClient`,
+  write executor, `callOperation`, and mocked `/api/rpc` fetch seam. It asserts
+  the exact JSON-RPC method/target/params body, runs the canonical response
+  through the runtime decoders, and verifies that the recursive editor state
+  rehydrates.
 - Marked the data-shaping issue and Slice 5 complete, documented the Python
   canonical model and console editor, updated the live design-spec status, and
   archived the implementation plan.
@@ -63,11 +65,10 @@ tests or documentation changes. The repository's external review-dispatch
 tool was not available in this session, so no external reviewer result is
 claimed.
 
-One existing behavior remains worth tracking separately: the root expression
-proof uses a declared `state.text` output slot rather than the name `result`,
-because the current validator treats that particular state/output naming shape
-as invalid when combined with a root object binding. This does not affect the
-composite expression path and was not changed in Task 8.
+The root expression proof uses the ordinary `state.result` output slot. The
+capability's `text` result is projected into workflow state and then into the
+public `result` output, so this fixture exercises the normal state/output naming
+path without a validator workaround.
 
 ## Documentation