feat: ship production local assurance viewer in core

packages/casan-harness/README.md

@@ -5,6 +5,7 @@ Populated incrementally by Plan-01 (Phase 0→6). During migration, files move h
 `.specify/` wave-by-wave; the full harness gate must stay green (`PASS=64 FAIL=0`) after each phase.
 
 Layout:
+- `assets/local-viewer/` — production static UI for the Core Local Assurance Viewer
 - `scripts/` — bash + powershell gate logic (H1→H7), path resolver `casan-paths.sh`
 - `security/` — filter/policy rules (prompt-filter, pii-rules, output-policy, ...)
 - `governance/`, `agentops/` — H5/H6 code
@@ -12,6 +13,20 @@ Layout:
 - `templates/` — spec/plan templates
 - `tests/` — source-hub verification only; excluded from production installs
 
+Core visual reporting is intentionally lazy and zero-dependency:
+
+```bash
+casan report latest
+casan view
+casan report export --format html
+casan report export --h6 --format html
+```
+
+Prompt hooks only write canonical evidence and a small receipt. `casan view`
+starts a loopback-only, token-protected, read-only Python server on demand.
+No Node/npm, external font/CDN, Platform service or per-prompt HTML generation
+is required.
+
 Runtime state (logs, audit chain, tenant state) is NOT part of this package — it stays with
 the app under `CASAN_STATE_ROOT`. Domain data (golden-runs, corpus, input) lives in
 `apps/okr/domain/` under `CASAN_DOMAIN_ROOT`.