refactor(trace): enforce run-only diagnosis model

openspec/specs/mvp-demo-trace-acceptance/spec.md

@@ -2,27 +2,28 @@
 
 Provide a repeatable MVP demo flow that can run a chat diagnosis, expose its persisted execution trace, and submit feedback for the same diagnosis run.
 ## Requirements
-### Requirement: Diagnosis trace can be queried by session id
-The system SHALL expose a read-only HTTP endpoint `GET /api/diagnosis/{sessionId}/trace` that returns the persisted diagnosis trace for the requested session id. When `runId` is omitted, the endpoint SHALL return the latest diagnosis run for compatibility. When `runId` is provided, the endpoint SHALL return that exact run after validating it belongs to the path `sessionId`.
+### Requirement: Diagnosis trace requires an exact run
+The system SHALL expose a read-only HTTP endpoint `GET /api/diagnosis/{sessionId}/trace?runId=...` that returns only the specified diagnosis run after validating ownership.
 
-#### Scenario: Existing session latest trace is returned
-- **WHEN** a caller requests trace data for a session id that has at least one `diagnosis_run`
-- **THEN** the system returns a success response containing the resolved run id, session summary, run summary, ordered agent steps, ordered tool invocations, self-evaluation data, final answer, and feedback for the latest run
+#### Scenario: Missing runId is rejected
+- **WHEN** a caller omits `runId`
+- **THEN** the request is rejected without inferring a latest run
 
 #### Scenario: Existing session exact trace is returned
 - **WHEN** a caller requests trace data with `GET /api/diagnosis/{sessionId}/trace?runId=run-xxx`
 - **THEN** the system validates that `runId` belongs to `sessionId`
-- **AND** it returns a success response containing only the trace data for that run
+- **AND** it returns chat-session metadata, the exact run, ordered steps, ordered tool invocations, self-evaluation, answer, and feedback
+- **AND** it does not return a compatibility `session` projection
 
 #### Scenario: Missing session returns not found
-- **WHEN** a caller requests trace data for a session id that does not exist in `chat_session`, `diagnosis_run`, or historical compatibility data
+- **WHEN** a caller requests a sessionId/runId pair that does not exist in `diagnosis_run`
 - **THEN** the system returns a 404 response using the existing session-not-found error contract
 
 ### Requirement: Trace aggregation is read-only
 The system MUST build trace output from existing persisted diagnosis tables and MUST NOT mutate chat sessions, diagnosis runs, agent steps, tool invocations, feedback, or chat session state while serving the trace request.
 
 #### Scenario: Trace query does not change persisted state
-- **WHEN** a caller requests `GET /api/diagnosis/{sessionId}/trace`
+- **WHEN** a caller requests `GET /api/diagnosis/{sessionId}/trace?runId=run-xxx`
 - **THEN** the system reads `diagnosis_run`, `agent_step`, and `tool_invocation` records and returns an aggregate without saving any of those records
 
 #### Scenario: Exact trace query does not change persisted state
@@ -150,4 +151,3 @@ The MVP demo SHALL provide stable scenarios that explain how to demonstrate posi
 - **WHEN** a demo scenario is fixture-backed rather than live-scripted
 - **THEN** the documentation SHALL say so explicitly
 - **AND** it SHALL avoid promising deterministic live LLM output for that scenario
-