feat: add submission-level generated readouts

AGENTS.md

@@ -19,6 +19,7 @@ apps/
     coder-acp-copilot/          # GitHub Copilot worker (ACP SDK)
     coder-acp-claude-code/      # Claude Code worker (ACP SDK)
     report-generator/           # Post-run report generation
+    readout/                    # Submission-level generated readout
   model-scanners/               # Feature detection for Copilot and Anthropic models
   version-checkers/             # Poll for new agent/tool releases
   key-updaters/                 # GitHub auth cookie management for VS Code Web
@@ -69,6 +70,7 @@ Each worker implements the same queue-processor interface but adapts a different
 | `coder-acp-copilot` | GitHub Copilot | ACP SDK v0.14.1 |
 | `coder-acp-claude-code` | Claude Code | ACP SDK v0.13.1 |
 | `report-generator` | — | Copilot SDK |
+| `readout` | — | Copilot SDK |
 
 Workers consume tasks from Azure Storage Queues (named `queue-<worker-name>`) and write results to MongoDB and Blob Storage. Each has its own Dockerfile and docker-compose profile.
 

ENV_VARIABLES.md

@@ -889,6 +889,33 @@ Timeout for the Copilot SDK session used by the report-generator worker. If the
 
 Git commit hash embedded in reporter metadata. Automatically set during CI/CD builds. Used to track which version of the report-generator produced a given report.
 
+## Submission Readout Handler Configuration
+
+### AZURE_STORAGE_QUEUE_READOUT
+**Default:** `pp-readout-queue`
+**Type:** string
+
+Azure Storage Queue name for submission readout jobs. The scheduler enqueues
+`{ type: "readout", submissionId, submissionRunId }` only after
+`pp-observations` is done for every exact request/run pair in the current
+submission attempt.
+
+### READOUT_MODEL
+**Default:** `gpt-5.4`
+**Type:** string
+
+The Copilot SDK model used by the dedicated `pp-readout` worker to synthesize a
+schema-validated structured submission readout. Markdown is derived from the
+validated structured object.
+
+### READOUT_SESSION_TIMEOUT_MS
+**Default:** `300000` (5 minutes)
+**Type:** integer (milliseconds)
+
+Timeout for one readout-generation attempt. Exhausted generation or schema
+validation marks the exact current submission attempt's `pp-readout` handler as
+failed; historical and superseded attempts remain immutable.
+
 ## Scheduler Configuration
 
 ### SCHEDULER_POLL_INTERVAL_MS
@@ -936,13 +963,13 @@ TTL for the DAG dispatcher's in-memory cache of handler topology (the `services`
 **Default:** `post-processor-queue`
 **Type:** string
 
-Azure Storage Queue name used by both the scheduler (to enqueue post-processing work) and the post-processor worker (to dequeue). Must match between the two services. The `pp-taxonomy` observation handler shares this queue.
+Azure Storage Queue name used by both the scheduler (to enqueue post-processing work) and the post-processor worker (to dequeue). Must match between the two services. The `pp-observations` handler shares this queue.
 
 ### JUDGE_URL
 **Default:** falls back to `JUDGE_SERVICE_URL`, then `http://localhost:3002`
 **Type:** URL string
 
-Base URL of the judge service used by the `pp-taxonomy` post-process handler to evaluate observation criteria per iteration (snapshot + ATIF trajectory → boolean + evidence). The handler reuses the shared `JudgeClient`, so `JUDGE_CLIENT_TIMEOUT` / `JUDGE_CLIENT_RETRIES` apply. In K8s the post-processor reads `JUDGE_SERVICE_URL` from the `worker-config` ConfigMap (`envFrom`); in docker-compose the `post-processor` service sets `JUDGE_SERVICE_URL: http://judge:80` explicitly (it uses the `common-env` anchor, which — unlike `worker-env` — does not carry it). See issue #1156 and [docs/architecture/post-processing.md](docs/architecture/post-processing.md).
+Base URL of the judge service used by the `pp-observations` post-process handler to evaluate observation criteria per iteration (snapshot + ATIF trajectory → boolean + evidence). The handler reuses the shared `JudgeClient`, so `JUDGE_CLIENT_TIMEOUT` / `JUDGE_CLIENT_RETRIES` apply. In K8s the post-processor reads `JUDGE_SERVICE_URL` from the `worker-config` ConfigMap (`envFrom`); in docker-compose the `post-processor` service sets `JUDGE_SERVICE_URL: http://judge:80` explicitly (it uses the `common-env` anchor, which — unlike `worker-env` — does not carry it). See issue #1156 and [docs/architecture/post-processing.md](docs/architecture/post-processing.md).
 
 ### SCHEDULER_URL
 **Default:** (not set)