update report h6

packages/casan-control-panel/README.md

@@ -23,6 +23,17 @@ Open http://127.0.0.1:5174 — panels show REAL metrics from `.specify/logs/**`.
 `incidents` · `tools` · `traceability` · `drift` · `cost` · `GET /healthz` (200 fresh /
 503 stale — fail-loud, mirrors `dashboard-server.py`).
 
+Harness reports:
+
+- `GET /api/v1/reports` — versioned H1–H7 report catalog and availability.
+- `GET /api/v1/reports/h6?project=<id>&from=<ISO>&to=<ISO>&run=<id>` — H6 AgentOps
+  report from the same runtime metrics, provider usage and alert files as the Control Panel.
+- `GET /api/v1/reports/h6/export?format=html|json&...` — standalone, print-ready HTML
+  or machine-readable JSON export. Both formats serialize the same filtered report object;
+  no maturity score is hard-coded.
+- `/reports/h6` — UI report view with project, time-range and run filters plus source-level
+  freshness and data-quality warnings.
+
 Metrics export: `GET /api/v1/metrics` provides Prometheus text exposition for
 aggregate freshness, run/failure/cost/token and H4/H5/action/incident counters.
 It intentionally contains no tenant, actor, trace, prompt or Evidence Pack
@@ -121,7 +132,11 @@ FinOps/SLO:
 
 Data sources + aggregation mirror `packages/casan-harness/tests/generate-agentops-dashboard.py`.
 App root + telemetry paths resolve via the same marker walk-up as `casan-paths.sh`
-(`.specify` or `packages/casan-harness`) and honor `CASAN_DASHBOARD_*` env overrides.
+(`.specify` or `packages/casan-harness`). The canonical source variables are
+`CASAN_TELEMETRY_METRICS_LOG`, `CASAN_TELEMETRY_PROVIDER_LOG`, and
+`CASAN_TELEMETRY_ALERTS_LOG`; legacy dashboard/control-panel names remain accepted as
+compatibility aliases. Freshness is calculated independently from each file's mtime using
+`CASAN_DASHBOARD_STALE_S` (default `3600`).
 
 ## Security posture (MVP)
 Binds `127.0.0.1` by default. Refuses a non-loopback bind under `CASAN_PROFILE=prod` /