feat(corroborate): add cross-version combined dashboard view (#1771)

Signed-off-by: Nathan Hensley <nhensley@nvidia.com>

Author: njhensley

pkg/corroborate/doc.go

@@ -31,6 +31,16 @@
 // FAILING, UNTESTED. A verified-but-unallowlisted signer is admitted as a
 // zero-weight "reported" dot that can never reach CONFIRMED on its own.
 //
+// Each recipe's consensus is baked two ways. The strict per-version grids
+// (Tab.Versions, newest-first) count agreement only among runs at the SAME AICR
+// version, because a re-run against a different tool release is not a reproduction
+// of the same result. The relaxed cross-version grid (Tab.Combined) folds each
+// distinct signer's single latest run, version-blind, into one grid — the
+// dashboard's default "all versions" view, which surfaces every source that has
+// attested the recipe (including sources whose latest run predates the newest
+// release). Selecting a specific AICR version switches the renderer to that
+// version's strict grid.
+//
 // The generator (Generate) reads the source-keyed GCS layout (Contract 3:
 // results/<group>/<dashboard>/<tab>/<signer-id-hash>/<run-id>/{meta.json,
 // ctrf/<phase>.json}) from a local directory, derives each recipe's coordinate

pkg/corroborate/generate.go

@@ -556,10 +556,28 @@ func buildRecipe(agg *recipeAgg, sources map[string]Source) (Tab, Series, int) {
 		})
 	}
 
+	// Cross-version "all versions" grid: fold each signer's single latest run
+	// (latestAny, version-blind) into one consensus grid. This is the dashboard's
+	// default view — it includes every source that has attested this recipe, even
+	// sources whose latest run predates the newest release (which the newest strict
+	// grid, tabVersions[0], omits — such a source stays visible in its own version
+	// grid). A throwaway grid-signer set keeps the series column set (built from the
+	// per-version grids above) unchanged: a signer's latest run also lands in its
+	// own version grid, so this adds no series column the per-version pass missed.
+	// Consensus here counts agreement ACROSS versions — weaker than same-version
+	// reproduction — which the renderer surfaces explicitly.
+	combinedRows, combinedStates := computeGrid(unionRows(latestAny), signerIDs, latestAny, map[string]struct{}{})
+	combined := &TabVersion{
+		AICRVer:     "",
+		PhaseRollup: phaseRollup(combinedStates),
+		Tests:       combinedRows,
+	}
+
 	tab := Tab{
 		Recipe:   agg.name,
 		Coord:    coordMap(agg.criteria),
 		Versions: tabVersions,
+		Combined: combined,
 	}
 	// The time-series spans every build/version, so its union test set must come
 	// from ALL runs (not just each signer's newest), or a test that ran only in an

pkg/corroborate/generate_test.go

@@ -100,6 +100,23 @@ func findRowAtVersion(t *testing.T, idx Index, recipe, aicrVer, phase, name stri
 	return Row{}
 }
 
+// findCombinedRow returns a row from the recipe's cross-version Combined grid
+// (the dashboard's default "all versions" view).
+func findCombinedRow(t *testing.T, idx Index, recipe, phase, name string) Row {
+	t.Helper()
+	tab := findTab(t, idx, recipe)
+	if tab.Combined == nil {
+		t.Fatalf("recipe %s has no combined grid", recipe)
+	}
+	for _, r := range tab.Combined.Tests {
+		if r.Phase == phase && r.Name == name {
+			return r
+		}
+	}
+	t.Fatalf("row not found in combined grid: %s %s/%s", recipe, phase, name)
+	return Row{}
+}
+
 func findTab(t *testing.T, idx Index, recipe string) Tab {
 	t.Helper()
 	for _, g := range idx.Groups {
@@ -213,6 +230,23 @@ func TestGenerateEndToEnd(t *testing.T) {
 		t.Errorf("operator-health @ v0.14.0 = %q, want FAILING (nvidia's isolated older run)", got)
 	}
 
+	// Combined ("all versions") grid: each source's single latest run folded into
+	// one grid, with an empty AICRVer because it spans versions. In this fixture
+	// every source's newest run is v1.0.0, so combined matches the newest grid —
+	// operator-health CONFIRMED with the rogue reported dot. (The cross-version
+	// case where combined diverges from the newest grid is in
+	// TestGenerateCombinedCrossVersion.)
+	if tabA.Combined == nil {
+		t.Fatal("recipeA has no combined grid")
+	}
+	if tabA.Combined.AICRVer != "" {
+		t.Errorf("combined AICRVer = %q, want empty (spans versions)", tabA.Combined.AICRVer)
+	}
+	coh := findCombinedRow(t, idx, recipeA, "deployment", "operator-health")
+	if coh.Consensus != string(StateConfirmed) || coh.Reported != 1 {
+		t.Errorf("combined operator-health = %q reported=%d, want CONFIRMED reported=1", coh.Consensus, coh.Reported)
+	}
+
 	// Recipe B: FAILING + SINGLE + bare-intent (empty platform).
 	const recipeB = "h100-gke-cos-training"
 	if got := findRow(t, idx, recipeB, "deployment", "operator-health").Consensus; got != string(StateFailing) {
@@ -340,6 +374,76 @@ func TestGenerateConsensusKeyedByVerifiedIdentityNotIDHash(t *testing.T) {
 	}
 }
 
+func TestGenerateCombinedCrossVersion(t *testing.T) {
+	// The combined ("all versions") grid folds each source's single latest run
+	// across versions, so two allowlisted sources whose latest runs are at
+	// DIFFERENT AICR versions still corroborate (CONFIRMED). The strict newest
+	// per-version grid does not: at the newest version only the source that ran it
+	// appears (SINGLE). This is the behavior the dashboard's default view relies on.
+	const issuer = "https://token.actions.githubusercontent.com"
+	dir := t.TempDir()
+	writeRun := func(identity, idHash, runID, aicrVer, when string) {
+		t.Helper()
+		runDir := filepath.Join(dir, "results", "eks", "h100-ubuntu", "training", idHash, runID)
+		if err := os.MkdirAll(filepath.Join(runDir, "ctrf"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		meta := fmt.Sprintf(`{"schemaVersion":"aicr-corroboration-meta/v1",`+
+			`"coordinate":{"group":"eks","dashboard":"h100-ubuntu","tab":"training"},`+
+			`"recipe":"h100-eks-ubuntu-training",`+
+			`"signer":{"idHash":%q,"identity":%q,"issuer":%q,"class":"community","allowlisted":true},`+
+			`"runId":%q,"aicrVersion":%q,"attestedAt":%q}`, idHash, identity, issuer, runID, aicrVer, when)
+		if err := os.WriteFile(filepath.Join(runDir, "meta.json"), []byte(meta), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		ctrf := `{"reportFormat":"CTRF","results":{"tool":{"name":"aicr"},"summary":{},` +
+			`"tests":[{"name":"operator-health","status":"passed"}]}}`
+		if err := os.WriteFile(filepath.Join(runDir, "ctrf", "deployment.json"), []byte(ctrf), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Source A's latest run is an OLDER release; source B's latest is the newest.
+	// Two DISTINCT verified identities, so they are two distinct signers.
+	writeRun("https://github.com/org-a/attest/.github/workflows/a.yaml@refs/heads/main", "aaa", "run-a", "v0.14.0", "2026-06-10T01:00:00Z")
+	writeRun("https://github.com/org-b/attest/.github/workflows/b.yaml@refs/heads/main", "bbb", "run-b", "v1.0.0", "2026-06-20T01:00:00Z")
+
+	out := t.TempDir()
+	if _, err := Generate(context.Background(), Options{InputDir: dir, OutputDir: out}); err != nil {
+		t.Fatalf("Generate: %v", err)
+	}
+	idx := readIndex(t, filepath.Join(out, "data", "index.json"))
+	const recipe = "h100-eks-ubuntu-training"
+
+	// Newest version grid is v1.0.0; only source B ran it -> SINGLE.
+	tab := findTab(t, idx, recipe)
+	if len(tab.Versions) == 0 || tab.Versions[0].AICRVer != "v1.0.0" {
+		t.Fatalf("newest version = %+v, want v1.0.0 leading", tab.Versions)
+	}
+	if got := findRow(t, idx, recipe, "deployment", "operator-health").Consensus; got != string(StateSingle) {
+		t.Errorf("newest-version operator-health = %q, want SINGLE (only source B at v1.0.0)", got)
+	}
+
+	// Combined grid: both sources' latest runs pass -> CONFIRMED across versions,
+	// with both sources listed and their real per-run versions preserved.
+	if tab.Combined == nil || tab.Combined.AICRVer != "" {
+		t.Fatalf("combined grid = %+v, want present with empty AICRVer", tab.Combined)
+	}
+	comb := findCombinedRow(t, idx, recipe, "deployment", "operator-health")
+	if comb.Consensus != string(StateConfirmed) {
+		t.Errorf("combined operator-health = %q, want CONFIRMED (two sources, latest runs across versions)", comb.Consensus)
+	}
+	if len(comb.Signers) != 2 {
+		t.Fatalf("combined signers = %d, want 2 (both sources' latest runs)", len(comb.Signers))
+	}
+	gotVers := map[string]bool{}
+	for _, s := range comb.Signers {
+		gotVers[s.AICRVer] = true
+	}
+	if !gotVers["v0.14.0"] || !gotVers["v1.0.0"] {
+		t.Errorf("combined signer versions = %v, want both v0.14.0 and v1.0.0 (per-source run versions preserved)", gotVers)
+	}
+}
+
 func TestGenerateContextCanceled(t *testing.T) {
 	// An already-canceled context stops the walk/collect before any output is
 	// written and surfaces as an error rather than a partial dashboard.

pkg/corroborate/model.go

@@ -116,10 +116,14 @@ type Dashboard struct {
 	Tabs        []Tab  `json:"tabs"`
 }
 
-// Tab is one recipe (intent[-platform]). Its consensus is split per AICR
-// version so that corroboration only counts agreement at the SAME version
-// (cross-version agreement is not reproduction). Versions are newest-first;
-// the overview/landing summarize the newest (Versions[0]).
+// Tab is one recipe (intent[-platform]). Its consensus is baked two ways: the
+// strict per-version Versions grids (corroboration only counts agreement at the
+// SAME version, because cross-version agreement is not reproduction) and the
+// relaxed Combined grid (each source's single latest run, version-blind). The
+// renderer defaults to Combined ("all versions") so every source that has ever
+// attested the recipe is visible, and switches to a per-version grid when a
+// specific AICR version is selected. Versions are newest-first; a per-version
+// overview summarizes the newest (Versions[0]).
 type Tab struct {
 	// Recipe is the overlay metadata.name (the series-file slug).
 	Recipe string `json:"recipe"`
@@ -131,11 +135,25 @@ type Tab struct {
 	// Versions holds one baked consensus grid per AICR version present in the
 	// evidence, newest-first.
 	Versions []TabVersion `json:"versions"`
+
+	// Combined is the cross-version "all versions" consensus grid: each distinct
+	// signer's single latest run (version-blind) folded into one grid. It is the
+	// dashboard's default (non-strict) view — it surfaces every source that has
+	// attested the recipe, including sources whose latest run predates the newest
+	// release (which the newest strict grid, Versions[0], omits — such a source
+	// stays visible in its own version's Versions grid). Its own AICRVer is empty
+	// because it spans versions; each row's per-signer Latest.AICRVer still carries
+	// that source's real run version. Consensus here counts agreement ACROSS
+	// versions, which is weaker than same-version reproduction — the renderer makes
+	// that trade-off explicit and the strict Versions grids remain available.
+	Combined *TabVersion `json:"combined,omitempty"`
 }
 
-// TabVersion is one recipe's baked consensus grid for a single AICR version.
+// TabVersion is one recipe's baked consensus grid for a single AICR version, or
+// (when it is a Tab's Combined grid) the cross-version fold with an empty AICRVer.
 type TabVersion struct {
-	// AICRVer is the AICR version this grid's consensus was computed at.
+	// AICRVer is the AICR version this grid's consensus was computed at, or empty
+	// for a cross-version Combined grid.
 	AICRVer string `json:"aicrVer"`
 
 	// PhaseRollup maps each phase to its worst-first rollup state.