Operator UI: Exact Contracts Register

Workflow presentation and debug graph nodes expose required purpose: product or git-correction. Correction retains the real configured agent/session, with source_ready/blocked/failed outcomes; native:verified:<entry> edges mean a native-verified continuation, not product DONE or approval. A same-name authored OFF node remains product. The provisioned classic-git profile selects native execution; source availability does not establish deployment or release qualification.

Card detail has required source: { mode: 'native' | 'off', facts }, where facts is the redacted current nullable card Git selection. Overview's Source ownership section shows mode, private branch/observed tip, parent selection, correction requirement and last completed delivery when present. Null facts under native mode mean no initialized selection yet, not OFF. Recorded selections are not live checkout verification or product acceptance. Stopped/queued status alone does not prove source returned. Execution evidence distinguishes bootstrap (no activation/session link), actual sequential commands and terminated commands with unknown effects; absent logical completion must never be presented as success.

checkpoint_source displays a private source checkpoint and the observed branch/tip, explicitly not product acceptance. Refusal is not a successful checkpoint or delivery.

The three code_quality_* tools render as configured-source analysis with operation, contract/invocation identity, outcome, flat counts/coverage, bounded report and named work artifacts. Label these as analysis evidence, not acceptance; artifact references remain mutable Files resources with ordinary privacy/availability limits. Failure results may retain useful diagnostic evidence. No provisioning fields appear in public effective configuration. Report omission labels/full links must remain visible. Canonical work:/// Markdown links in current and historical report bodies navigate to the ordinary Files output view. The renderer validates the scoped URL and maps it to a same-origin Files route before HTML sanitization; it does not allow custom schemes through the sanitizer. Files still owns authentication, path admission, redaction and availability. Invalid/noncanonical work links are not navigable.

Observed collection Request/Result presentation

The two named tool presenters show requested collections/query/intent/limit and safe view statuses. Query results show ordinal rank, contributing channels, transformed, excerpt_truncated, location:unavailable, attributable excerpt and collection/path memberships linked to Files with preview=source and the exact project-relative path, without a metadata/output root label. This Current source preview uses the existing protected content API and selected-preview owner, not a third directory browser. It reads no directory listing and leaves both listing observations unchanged. Refresh/reconnect refresh only the current selected source (joining an in-flight route read); navigation/unmount cancel superseded preview requests. Metadata/Output buttons return to those existing browsers. Current source may differ from the indexed excerpt or be missing, blocked, oversized, non-text or unauthorized; clicking never refreshes indexing. Source content retains its existing read/redaction policy, not arbitrary-secret certification or a promise of retrieval excerpt redaction. Generic historical path strings remain unchanged; only observed-result memberships gain this explicit navigation. Show exhaustive:false, failed/unavailable channels, candidate/output limits and filtering starvation; never display raw native IDs, endpoints, scores, vectors or error payloads. Do not interpret an observed reference as a definition or activated skill. Opaque historical tool results retain ordinary safe generic rendering; no durable conversation reinterpretation or external-receipt body expansion is introduced.

This register owns exact presentation and navigation for the operator web UI. Use the needs register for stable F requirements and owner decisions, the system specification for backend behavior, and the runbook for procedures. Presentation of retained evidence never grants mutation authority or certifies current execution.

Product model

Inspect backend projections; request project Start/Stop/Pause/Resume through enabled internal Analyst chat or configured external MCP tools. Only capability-gated, confirmed Restart server is a direct runtime UI mutation, and it starts no work. Cards, records, queues, processes, routes and settings have no direct mutation affordances. Displayed permissions never reserve invocation-time admission.
Every view, copied value, link and tool payload uses backend-owned safe projection. Provider exchange metadata is not raw HTTP, a prompt or a private-reasoning view.
There is no token-entry, sign-out, provider-secret or bootstrap UI. Expected browser deployment is auth-disabled behind deployment-owned isolation. Backend bearer support remains. Unauthorized states do not ask for a token or offer an in-browser remedy. Manual bearer-browser provisioning is an operator deployment task, documented in private browser credential setup, not a new UI affordance.
Tombstones stay absent from discovery. Exact known history/version/diff, historical card.json and retained-conversation access never permits a deleted-card inventory, replacement search, restoration, forensic browser or orphan scan.
No visit timestamps, unread/read models or saved reading positions survive views/ visits. Ephemeral logical Back and mounted scroll/pause-follow stability are mechanics.

The topic owners below separate runtime observation, exact navigation, hierarchy, records, conversations, Analyst availability, Files/evidence and System diagnostics. Shared JSON and legibility contracts apply across them without changing wire data.

Shared JSON data display

Dedicated JSON data displays share lossless lexical decoration: keys, strings, numbers, booleans and null are visually distinguishable, while punctuation and plain text retain the normal foreground. The renderer consumes an already safe public string, never parses, validates, reformats, decodes embedded JSON strings, or redacts it. Incomplete or malformed display text remains fully visible. Escaped text nodes, not content-derived HTML, classes, links or event handlers, carry the exact supplied text. Selection across token spans is continuous; existing copy controls copy that same string, including whitespace and numeric spelling.

JSON data uses monospace 14–16px type (14px baseline, 1.5 line height) and token contrast of at least 4.5:1 against the actual background, including inline structured fields. Decoration is not the sole carrier of value, type or status. Above 1,000,000 UTF-16 code units, rendering is exact plain text without tokens; this is a highlighting cost bound, not a transport limit or copy truncation. Native disclosures, initial open/closed state, focus, labels, owner scrolling, redaction and existing copy availability remain unchanged. Noncopyable inspectors do not gain copy controls.

This contract covers conversation safe-original request/result envelopes and explicitly structured semantic fields/content, compacted facts/continuation and retained instruction metadata, provider exchange metadata, System configuration, graph/error details, card history/snapshots and lifecycle results, and Files JSON. Formatting and JSON classification remain producer-owned. Ordinary prose, logs, stdout/stderr, commands, patches/diffs, text slices/partial hex, instruction and summary bodies, Markdown/YAML and authored Markdown code examples are excluded; JSON-looking text and JSONL/NDJSON icons do not opt a surface into JSON rendering. This is neither an editor nor a model-wire inspector.

Image result presentation

Each actual typed image occurrence exposes Inspect image, including generic presenters and every admitted producer; missing/malformed optional producer metadata never hides the action. Arbitrary image-looking JSON/text/URLs expose no action. Both Analyst and card current/historical callers explicitly supply the displayed session and segment identities. Inspection stays pinned on refresh and never retargets to a latest segment or current source. Owner/session/version departure closes the caller-local dialog.

The shared dialog labels conversation pixels Image shown to model and Recorded model-input snapshot; not proof of delivery or perception, plus one-based content position and descriptor sent dimensions. Strict view_image metadata uses its admitted workspace source label; indexed native MCP normalization facts use the literal Native MCP capture as presentation text, never an invented source_path. Both share normalization invariants for source/orientation-adjusted/sent dimensions, orientation, resizing, scale and maximum dimension. This optional enrichment must match the selected descriptor's sent dimensions. Missing, invalid, extra-field (including a foreign MCP source_path) or mismatched facts say Original dimensions not recorded, without hiding typed image actions or changing their exact locators. Metadata labels never authorize fetching. No original-view toggle or automatic source loading exists.

Fit defaults to min(1, viewport width/image width, viewport height/image height), recomputed on resize, never upscaled. 1:1 means one image pixel per CSS pixel at 100% browser zoom, not physical-device pixels; its focusable viewport scrolls both axes from a reachable origin. Previous/Next traverse only image occurrences in the same selected result, preserving intervening content positions and disabling boundaries. Tab/Shift-Tab stay in Dialog; native arrow/Page scrolling is not image navigation. Escape or Close returns focus to the inspect action without jumping. The underlying single conversation owner retains history, expanded details and scroll/follow policy, with arrival-driven scrolling suppressed while open and no close-time catch-up jump. Narrow/wide layouts keep controls onscreen.

Binary fetches use the existing bearer-header authority, never token URLs or direct API image elements. Loading, unauthorized/forbidden, unavailable and decode failure are explicit; replacement/error/close/departure/unmount clear pixels, abort departed requests and revoke object URLs. Late responses cannot replace the current selection. Refresh retries the same exact locator. No global viewer registry or visit state exists.

The combined Inspect image row for successful view_image labels Image snapshot recorded with sent dimensions and safe source/upright/sent, orientation, spatial resize, scale and maximum metadata. Source paths in call/result presentation are text, not automatic Files preview links. Safe-original disclosure and copy include only strict descriptors and safe metadata, never PNG/base64/data URLs or internal physical snapshot paths. REST and websocket entries share that boundary. Failures retain ordinary failure presentation. Recording is not a model-delivery/perception receipt; this UI is not an exact-request viewer. Provider evidence retains bounded approved request parameters, not full materialized requests. Image-bearing HTTP error previews are suppressed while structured failure classification, status and safe diagnostics remain. Authenticated binary reads use GET /api/agents/:id/conversation/images with exact segment_version, segment_id, message_id, zero-based content_index and image_id. The selected public successful executed result is authority, not a UUID, URL, source path or producer metadata. Invalid locators fail 400, absent selections 404, mismatched segment UUID 409; broken referenced state remains bounded unavailable, never source fallback. Responses are byte-identical selected PNGs, no-store and nosniff.

Successful optional content is an ordered nonempty array of strict text/image blocks, not a singular image field. Inside the paired Result half, each text block has Returned text · content N and explicit text classification; each image block has Typed image descriptor · content N, explicit JSON classification and its own metadata disclosure. N is the one-based recorded content position. Preserve every occurrence/order without extra timeline rows, duplicate anchors, thumbnails or nested vertical scrollports. Both Request/Result anchors and complete safe-original copy remain unchanged. Generic descriptor inspection does not require source_path or view_image metadata and does not promote nested data.image, image_url or JSON-looking text. It does not prove a tool is an image producer. view_image selects one workspace descriptor; configured native MCP production selects every native image in content order. MCP envelope metadata and indexed capture dimensions/orientation/resize/scale/bound are separate explicit JSON sections, with no required or fabricated source_path and no duplicate native text/descriptors.

Configured MCP presentation

Concise MCP lifecycle/discovery presenters show recorded ready/stopped outcomes (including context-loss caution) and complete JSON input schemas, not browser controls or delivery claims. Authenticated POST lifecycle routes use the shared operator contract/auth machinery and strict empty bodies, including mcp.restart (POST /api/mcp/servers/:name/restart, {}). Recorded restart input keeps its action visible; a successful running result renders the reported ready fact only, not present readiness, remote restart or target continuity. Failure or missing outcome remains unreported, never inferred success. Restart is stop-first, non-atomic and may lose context; failed containment retains the old owner and interrupted effects can remain unknown, with no replay. No new browser controls or default role grants are added. MCP observations show starting|running|stopped|error (running means ready after discovery), definitionSource:operator|agent|null, containmentFailed, inspectable bindingId and safe processId (null after retirement or for HTTP). A null source with containment failure is a removed retained blocker, not an available definition. Starting exposes no ready tools. Process association grants no wait/kill authority and promises no captured protocol output. Registration/removal presenters show recorded publication/containment facts; no topology controls are added. The mcp_server_replace presenter shows the requested server and safely projected connection, then recorded serverName, replaced and status: Definition replaced · not launched is a definition-publication fact, not readiness or target termination. Both registration and replacement suppress arbitrary env values structurally, including malformed rejected inputs, and redact URL/command secrets before live or historical presentation. Raw definition reads remain denied; no topology editor or endpoint is added. The mcp_catalog_refresh presenter shows requested server/connection and recorded returned server, bindingId, catalogId and tool count. Refresh recorded requires a successful result with those supporting facts; failed, uncertain or missing facts never acquire that success label. Error details and raw facts stay accessible. This is not present readiness or target-continuity evidence. Discovery results and call request details disclose recorded catalogId when present; historical absence stays absent. System UI refresh only fetches observations: it does not send remote tools/list. There is no new button, endpoint or polling behavior. Loaded current instructions show browser guidance only when actually composed, never dynamic discovery or full historical wire. Retained ordinary MCP data stays opaque inspectable JSON, not retrospectively complete or an attachment/delivery claim. Safe originals/copy, paired exact anchors and one reading surface remain unchanged.

Repair visibility and selection identity

No degraded UI, repair button or attic browser is provided. Strict startup failure keeps readiness unavailable; repair is the separately consented offline CLI procedure. Files omits .saivage/repair-attic and resolved aliases from parent listings and rejects direct directory/content/preview access before attic bytes or directory contents are inspected. Similarly named ordinary siblings remain accessible. Missing owning-card current/historical record:/// URLs show Card not found, distinct from existing-card record/version misses and consumed corruption.

Current card/record freshness uses exact head_id plus mutable revision, not numeric revision equality or old authored reviewer text. Historical selections have no current identity. Conversation incremental/sync baselines use exact segment UUID and version; rollback or re-created ordinal forces replace/refetch rather than mixing retained cursors/messages or suppressing lower-version invalidation.

Synthetic runtime:repair FAILED v1 is shown through ordinary canonical card and Files projections, including loss status.md and bootstrap placeholder requirements. No previous completion/verdict is implied. FAILED rejects direct activation while FAILED, not an operator-only repair hold: later explicit healthy-ancestor Run can let its active Planner reopen to CHANGED and execute unchanged placeholders. Guidance to replace requirements first is not enforced. Former physical children are unlinked/ignored, not recovered or listed through an attic inventory.

Runtime observation and the global strip

Explicit work GC has no UI button or dashboard. Its private hold uses existing pausing/paused observations, not a new public runtime status. New Analyst submissions, mutations and independent MCP lifecycle actions can fail with temporary GC-busy; present the existing action error without claiming a queued submission or completed effect. HTTP held ingress uses 409 WorkGcBusy with Work garbage collection is busy. Read-only views and project Stop remain usable. Start/Resume rejection never releases the hold. An ordinary Pause withdraws GC's automatic-resume intent; Stop/close/restart cancels GC and defeats that restoration. No transcript, execution-evidence or historical-selection semantics change.

Outstanding named-agent execution includes overload/backoff, not just wire consumption. Provider refresh shows advisory cooling/reason/deadline, not a send countdown. Compaction in-flight is one logical summary call; overload retries add no completed folds. Exchanges may appear only at settlement. A provider wait is not the exact tool/child/process barrier. Pause can remain pausing while admitted work continues; Stop is containment, not evidence that every effect was undone.

The browser runtime authority is the accepted runtime.status observation used together: runtime lifecycle label, currentCardId, and actorRuntime.cards positions. GET /api/state supplies project identity and its separately qualified facts (availability). There is no fallback between these independently sampled fields, and /api/state's runtime.current_card_id is not a selector rule for the UI.
After successful fresh startup settlement, accepted runtime and fresh card detail/tree/cockpit observations show stopped runtime, null current card, no executing autonomous participant, and the interrupted linked cards' actual stopped lifecycles before any Run. No work starts until an explicit Run. Recorded notices, uncertainty-only mates, and lifecycle rows remain separate evidence; the UI adds no synthetic status or inferred explanation. Same-process project Stop may instead leave durable running cards even while runtime is stopped; display their canonical status without rewriting it. A disconnected view retains only its last accepted observation, not a claim about current startup outcome. A startup-produced configured-global failed mate means uncertain prior effects, not a new submission/check, recovery notice, or active owner. Existing tool-result presentation applies; no new UI state or action is inferred.
Socket connection and REST acceptance are independent observations, each displayed with its own condition (loading, refreshing, refresh-failed, retained error, unauthorized, not loaded). No aggregate green light; the strip may say some observations are unavailable while individual facts retain their last successful labels. Age-based staleness is never inferred.
Terminal socket Unauthorized appears only on a validated ticket-endpoint 401 or close code 1008; every other failure is an ordinary reconnect.

Current-work identity/link comes only from the accepted runtime observation: Current work unknown before acceptance, Current work unavailable on runtime unauthorized (no retained identity link), the observed card ID, or No current work for accepted null. Selected-card inspection never supplies this identity. Current-card detail has a separate admission-local outcome. Exact notice copy is:

Detail/runtime condition	Strip notice and problem attribution
B loading	`Current card B details loading.`; retained A problem is `Last-known card A: <error>` or `Last-known card A is <status>.`
B authoritative 404	`Current card B details unavailable (card not found).`; retained problem stays last-known, primary identity stays B
B transport/server/parse failure	`Current card B details could not be loaded.`; retained problem stays last-known
B successfully observed with matching detail	`Current card B: <error>` or `Current card B is <status>.`, when a lifecycle problem exists
Accepted null or unknown runtime	Retained problems are last-known; no current-detail loading/missing claim
Return A, pending or failed new read	Retained A remains last-known even though IDs match
Runtime or detail unauthorized	`Current card details unavailable (unauthorized).`; no retained lifecycle problem text

<status> is failed, blocked or cancelled when there is no lifecycle error. Notices use fixed safe wording, never raw request errors; authorized server-filtered lifecycle errors use text interpolation, not HTML. Healthy retained detail creates no historical notice. “Current” requires matching runtime identity and success for this admission, not atomic synchronization, continuous freshness or socket liveness.

Restart availability comes solely from the restart_server_available boolean. The confirmation dialog explains shutdown versus project halt, requires exact text RESTART SERVER, supports Cancel, traps/restores focus, and disables duplicate sending. Submission is the strict JSON request {confirmation:'RESTART SERVER'} to the auth-gated restart_server operation; restart_scheduled acknowledges scheduled shutdown, not replacement readiness. The application-owned RestartPort terminal coordination shared with the Analyst restart path is unchanged.
The Updates disclosure states exactly: cards, conversations, and records refresh through permitted WebSocket invalidation hints and reconnect snapshots of eligible mounted/accepted resources; hints are not data or guaranteed delivery; reconnect does not certify a successful REST observation. Files has no invalidation resource or polling: navigation and explicit Refresh read files, and mounted connection-open/connected-registration refresh attempts read the represented directory and still-selected preview. Attempts do not guarantee successful reads. Processes and Events have no invalidation resource and use explicit Refresh.

Executions and selected output files

Executions is a separate card facet, not an agent or conversation. It reads GET /api/cards/:id/executions in retained row order (default 50, maximum 100 rows; optional exact after row UUID cursor), and GET /api/cards/:id/executions/:invocationId for bounded detail. Both require operator authentication and supported linked live-card or exact tombstone access. Every request strictly consumes the complete exact card-owned log; pagination never certifies only a prefix. A missing lazy log says No retained execution evidence, not “never ran.” An unmatched start says no completion retained; effects unknown, never “running,” “cancelled,” or “successful.” No process probing, completion append, replay, orphan discovery, or synthetic session occurs.
Rows and detail discriminate family: action from family: native. Native detail presents step, actual activation/parent and optional node/ordinal, reported effects, refs/OIDs, outcome and source return, without operation/provider fields. Incomplete native attempts have unknown effects/return, not live status or a verdict.
Action execution detail presents the exact qualified operation/contract/provider, activation, node/ordinal or postcommit hook and committed artifact selection, entry/finish times, safe command/cwd/argv, retained inputs/fields, disposition, outcome, leader exit/signal/error, timeout/interruption and group/capture facts. Private configuration and environment are not public fields. Text is escaped and outbound-redacted. Detail bounds process starts to 100 and explicitly marks omitted starts; it does not infer live invocation status from retained rows.
Execution files are selected only by source-row UUID plus reference ordinal: GET /api/cards/:id/executions/:invocationId/files/:fileKey and GET /api/cards/:id/executions/:invocationId/files/:fileKey/download. No caller-chosen path is admitted. The existing Files owner applies containment, alias/attic refusal, confidentiality and bounded UTF-8 text consumption before either preview or download. Both return the same redacted text, never a raw secret/configuration download. Malformed UTF-8, NUL, control-dominated content and images are refused, including otherwise supported ordinary Files rasters; missing selected content is unavailable, with no replacement search. Declared absent artifacts have no link. Generated artifacts are labeled mutable current workspace source (not historical content); captured output references remain actual capture sources. Errors omit private paths/content. Conversations continue to show real agents.

For API clients, an empty retained execution list is exactly {"rows":[],"next_cursor":null}. Use the returned row UUID as after, not a timestamp or inferred ordinal. List rows carry row_id, invocation_id, timestamp, kind, operation, contract_version, binding and nullable disposition; the detail response adds exact provider, completion, safe shell facts, selected input/retained fields, known settlement/process observations and file selections. Required output_source is nullable; artifact_paths lists exact declared mutable selections; nullable output contains completed output source, size_bytes and sha256, not the report body or a verdict. The detail view distinguishes command-stdout from returned-text and absent output evidence. completion:"no completion retained; effects unknown" is not a process status. Example authenticated requests (substitute actual returned IDs; never place tokens in URLs):

bash

curl -H "Authorization: Bearer $SAIVAGE_API_TOKEN" \
  "$ORIGIN/api/cards/$CARD_ID/executions?limit=50"
curl -H "Authorization: Bearer $SAIVAGE_API_TOKEN" \
  "$ORIGIN/api/cards/$CARD_ID/executions/$INVOCATION_ID"
curl -H "Authorization: Bearer $SAIVAGE_API_TOKEN" \
  "$ORIGIN/api/cards/$CARD_ID/executions/$INVOCATION_ID/files/$FILE_KEY/download"

Conversation identity uses exact agent:<name>:<cardId|global> grammar. Malformed session routes show a distinct invalid-session state without mounting detail. Malformed card routes make no detail request and share typed Card not found.

Exact routes and workspace history

The singular route table is / (cockpit home: accepted current work, accepted No current work, or honest unknown/loading/error before acceptance), /cards (explicit tree/selection surface), /cards/:id?facet=overview|conversations|executions|records|evidence (card cockpit), /agents/:id?entry=… (the sole exact-session address, presented by the shared cockpit owner), /files, and /system?section=…&process=…. Retired destinations (/dashboard, /agents list, /debug) are removed with ordinary route-not-found and no redirects or aliases.
Evidence-link grammar /agents/<session>?entry=<marker> is retained. entry targeting is validated separately, located only in the addressed source, and reported missing without searching elsewhere. A rendered call or result target highlights, scrolls to, and focuses its exact canonical row without opening semantic details or safe original request/result payloads. Superseded render-delayed focus is cancelled. Tool-result IDs are not aliases for call IDs, and omitted or private rows are not promised rendered targets.
A resolved card-session address selects Conversations in its exact owning card cockpit. The represented tree, selected card, compact header, participant rail, and five tabs persist across exact participant selection. Conversations points to the current exact session (including a valid entry); another facet points to its exact card and drops session/entry refinements. Returning to Conversations opens the unselected card facet rather than retaining visit state.
After the first successful scoped membership observation, an unselected card Conversations facet with exactly one active session replaces itself with that canonical exact-session address. workspaceRoute owns this single-flight replacement and omits the synthetic empty source from browser and Analyst logical history; duplicate pending requests are inert. Explicit participant choices use ordinary push and remain in both histories. Failed replacement leaves the real empty facet in history and projects no uncommitted destination.
Workspace navigation intents keep singular target kinds: card → card cockpit; transcript → exact session reader; process/process_list → System Processes; agent_session_list → System Participants. Failed or malformed navigation results are inert. Logical Back pops without re-recording the restored destination.
Analyst chat context is a detached {view, entityId, refinement} copy captured at Send, not a live route. Views are cockpit/files/system or null; entity identity is opaque and refinements are opaque string metadata (not evidence of reading a facet or entry). The strict serialized context is bounded to 2048 UTF-8 bytes; invalid input preserves the draft and reports the send error, without truncating identity or retrying. Server preparation may add only a bounded linked-card or owning-card snapshot for exact cockpit card/session identity; Files/System identity supplies no content. Displayed context is not evidence the Analyst has read it.
A rejected capacity submission is not automatically resent. A later explicit Send is a fresh submission on retained history; earlier ingress, compaction or tool effects/results may already be present. Rejection is not a success acknowledgement or proof of no effects; existing error/draft handling is unchanged.
Analyst form/Enter submission and System participant refresh consume action failures at their UI event boundaries. Store-owned send feedback/restored drafts and initial/refresh inventory errors remain visible; failed sends do not run success-only composer focus. Targeted global membership observations retain sibling sessions and explicit System selection.

Shared card context and work-first Overview

The shared card header stays compact on every cockpit facet and on the exact card-session reader: title, type, one lifecycle badge, exact identity, represented path, and one plain-language Observed workflow step lead. Exact position/state/node/ordinal, configured outcomes and conditions, the complete configured workflow, and publication facts live in the initially closed Workflow & technical details disclosure. Header and Participants consume workflows.presentation for the exact detail type, including all entries, nodes, configured/runtime edges, terminals, and record labels. Same-type pending reads are shared; detail arrival/type changes select only matching facts, accepted facts are immutable for the server incarnation, and failed reads offer explicit retry. System alone retains rich Debug Graph installed bindings. None of these structural facts supplies liveness or runtime ownership. The header is a named, keyboard-focusable scrollport bounded to at most 45% of the available center/session height; expanding it preserves an independently usable body scrollport. An unavailable card flow retains exact identity and its explicit warning rather than fabricating hierarchy or workflow context.
Overview is work-first, in this order: Objective, Activity and participants, Recorded result and records, Problems and waiting, then Parent and related work. Detailed workflow mechanics remain available from the shared header rather than leading the reading order.

Request ownership and retained observations

Departing plain resource owners cancel pending reads; superseded success/failure cannot change the current view or clear newer loading. System and diagnostic/MCP refreshes retain last-good values on failure; file selection/exact-session resolution clear departed content. These are resource-owner rules, not a new universal request abstraction or a replacement for Cards freshness and conversation leases.

Current-card orientation separately retains the last accepted detail, identified by its own ID, and current admission outcome: idle|loading|observed|not-found|failed|unauthorized. Each accepted non-null identity/admission transition starts one read and clears the prior outcome. Returning after another identity, null or revoked admission reads again even when the old detail ID matches. Null/unaccepted/runtime-unauthorized observations cancel pending work and set idle without erasing detail; unchanged identity/admission creates no refresh trigger. Only owned success replaces detail. Owned failure classifies acquisition, not deletion; late/cancelled callbacks do nothing. Runtime refresh-failure retention is unchanged.

Card tree and hierarchy

Hierarchy slices are the sole render authority. Discovery states are undiscovered, loading, error, loaded-empty (configured-empty types), loaded-nonempty, and confirmed-leaf; disclosure means "discover children", not "has children". Committed sibling order comes only from the parent's accepted slice. Stable identity is distinct from the mutable display path (logical_path).
Tree rows are color-only (owner decision 2026-09-25); lifecycle text remains available on selected-card surfaces, not repeated on every tree row. The cockpit provides no card title/state search or filter. Operator card/work discovery by known identity, title, or state is exclusively Analyst-mediated; manual tree browsing and exact card navigation remain available.
At scale, load the root and necessary represented ancestor slices, then only requested immediate children. No bootstrap global inventory or transcript fan-out.

Records, versions, and diffs

Content state, authorship and installed declarations

Accepted records expose the strict author union, not writer_agent. Records shows Agent · name, External credential holder · principal, Runtime · bootstrap/repair, or Action output · operation · source · node · disposition for the selected accepted content, alongside its positive accepted document version. An external credential-holder label is not proof of a particular person or model. The source distinguishes command-stdout from returned-text; neither is an agent verdict or approval. Shell failed, signalled and timed_out remain factual dispositions even when a complete capture was published; complete capture does not mean complete program work. Executions and its capture inspection remain separate from normal retained record content. Baseline and effective drafts have no author; a prior accepted author's label appears only with explicitly separate prior accepted content. History preserves each invocation's author, even when two versions have equal bytes and an empty text diff. Record reads use content_author for the selected acceptance and null for baseline/draft; historical reads never borrow today's author. All content and metadata use the existing outbound confidentiality projection, including download.

Current record body APIs expose nullable baseline and draft document version,target_version with content/hash/timestamps. Absence, established empty head, baseline0, draft0/target1, positive draft and acceptance remain distinct. Overview/Records/observations label Baseline v0 — not authored or accepted and Draft for vN, with the same nonauthored warning on draft0. Accepted backing is separate, never promoted over ineligible effective content. Recorded selections use {kind:'baseline',version:0} or {kind:'draft',version,target_version,accepted_backing}; no unfilled or template reconstruction exists. Safe full content stays readable. Current head UUID/revision remain strict nonnullable fields. Historical accepted HTTP responses omit mutation revision; VFS/tool metadata and sliced reads expose version:N,revision:null,head_id:null. Current-relative diffs report the exact current stamp; version-to-version diffs report document versions only. Selected history labels say accepted document version, never an inferred record revision. Immutable entry/provenance, including observed card mutation revision, remains factual. Baseline/drafts have no immutable history locator or v0 history entry. Existing Analyst open-draft conflict remains unchanged.

Compiled workflow records[] requires nullable initialization:{format_version:1,template} beside name and bootstrap; authenticated Debug graphs expose the same selected choices through existing privacy filtering. These describe installed compiled configuration, not historical scaffold text, author evidence or hot-reload state. Nodes expose ordered initialize_records independently of record completion requirements. Workflow presentation and Debug Graphs also expose nullable output_record: the exact compiled own-card report name, or null for unbound nodes. This is structural configuration, not evidence that a report was published or a verdict accepted.

Record declarations render in declaration order; descriptor reads precede content reads; each record is fetched independently. Exactly one record is the bootstrap record. Overview consumes these same selected-card CardStore descriptor and current-record slots; it adds no overview endpoint, cache, summary authority, or persistence contract. Once selected detail is admitted, the descriptor read and each exact current-record read retain independent request ownership and outcomes.
Overview labels the configured bootstrap:true record as Objective regardless of its custom name and presents every other declared record in declaration order under that exact name. A source's effective_content_source determines baseline versus draft versus accepted content, with the labels above, while accepted content is Accepted. An accepted HTTP observation is not acceptance of the work. Arbitrary records are not classified as progress, review, constraints, or completion from their names or Markdown. Objective descriptor loading, initial content failure, empty effective content, and retained stale content remain distinct; missing required content is an error, not a fabricated absent objective.
Each record shows a deterministic plain-text excerpt of at most 600 source characters and makes its complete content directly readable in a Full content disclosure through the existing sanitized Markdown presentation. Records & History is additional generic navigation to facet=records, with no promised record focus and no record/version query refinement.
Record request outcomes follow the fixed table: initial required 404 is an initial error with no accepted value; initial optional 404 is accepted empty; refresh 404 after accepted content retains it visibly stale with exact Retry; refresh 404 after accepted-empty optional retains unchanged empty success with no Retry; any non-404 refresh failure retains the accepted state visibly stale with exact Retry. The required bootstrap record never accepts absent content. Unexpected strict HTTP 500 failures are opaque and never reinterpreted as absence. Each source owns its loading, current-observation, stale, error, and exact Retry presentation: failure of one optional record does not hide the objective, recorded result, or other usable records, and Retry does not reload unrelated successful records. Parent-detail 404 tears down card-owned reads.

Historical selection and comparison

Selected card/record history is a committed immutable ordinary/accepted predecessor document: a failed history or exact selected-version request (sparse card versions or consecutive accepted record document versions) is an ordinary selection-local error that preserves accepted current and metadata state, never a separate availability state.
Records-facet record/version query refinement waits for matching card, successful definitions, and completion of the initial current-record load; a pending current refresh also delays refinement. Failed definitions remain an error; an undeclared requested record is explicitly unavailable, without a synthetic slot or dropped query. History and exact version reads are independent. Manual History, catalog selection, selected-version Retry and Retry diff are unavailable during initial current loading; pending actions are not queued. Once it settles, including failure, those controls are usable. This admission restriction never hides historical output: current failure remains visible alongside independent history/selection loading, local error/Retry, or selected content and provenance. Missing exact versions never substitute current content; a diff error does not hide selected content. Manual controls remain usable during current refresh. Current completion, success or failure, preserves independently changed catalogs, historical selections and diffs, including their loading and errors. A null selection stays null; a retained diff keeps its own observed target head identity, not a relabelled or recomputed observation of the new current head.
Card versions expose publication facts and current-relative differences. Null change metadata means attribution unavailable; no author or cause is inferred. Record revisions keep their own sequences. Overview explains that card revision counts all card mutations, including enqueue/removal, while each record has its own revision sequence, and neither measures work completed. When displayed, record head revision and accepted source revision remain distinct.
Catalogs contain only retained ordinary card or accepted record entries; totals count entries, not maximum revisions. Current revision need not have a selectable artifact. Loaded catalogs do not veto exact card/record version requests: success or missing selection comes from the server, with selection-local errors preserving current detail. Explicit absent selectors show a local error, never a first-entry/nearest fallback. Current draft is not synthesized into history and has no immutable locator; current record URLs remain reusable, with nullable accepted_version_url separately linking latest acceptance.
Card diffs tag their target as {kind:'version',version} or {kind:'current',head_id,version_seq,history_version}. Record current-side diffs tag head_id and mutable revision separately from immutable accepted sides. Card detail and current record metadata/content require the exact published head UUID; numeric revisions alone are not current selection identity. Accepted browser resource scopes retain that identity without inventing an immutable draft locator or a new verdict from old reviewer text. Redaction precedes comparison. Files card.json projects current head identity/metadata and selected ordinary content; card.json?v=N projects exact immutable history. Sizes/hashes/times describe those virtual bytes, never physical heads/history/mailbox files. Previous slots have no UI/browser or ordinary read API and are never a fallback.
Card history card/final_card uses the strict minimal outbound card shape: no nine null-only placeholders (subtype, assigned_to, metrics, estimate, started_at, duration_ms, status_text_author_session_id, latest_self_report, metadata). Lifecycle workflow results identify the actual agent/action executor. Files historical ordinary/tombstone wrappers use format4; current card-current remains versionless. Historical opaque tool results remain recorded facts, not current card objects.
Accepted provenance displays observed card_version_seq separately from card_history_version and its immutable ordinary locator. Queue-only current revisions never become fabricated historical URLs. Current draft and latest accepted content remain visibly distinct. Pending-only mailbox reachability promises neither a queue audit nor physical erasure; delivered conversation text remains independently readable, and private mailbox paths/bodies never leak through Files.
A lifecycle result is neutrally labeled Recorded result, with its summary quoted through the existing bounded one-liner and complete JSON/provenance one disclosure away. No result recorded makes no progress claim. For done, Overview says Accepted as done; not independently verified correctness; a failed completion timestamp is Ended, never accepted completion. lifecycle.error is reported once. When stopped, cancelled, changed, or running detail supplies no reason, Overview says that no reason is supplied by current card detail and points to records and conversations as possible context; it never derives a wait cause from time, graph position, session activity, or child lifecycle.

Exact displayed-current-diff request contract

text

pivot.ui-cards-diff-current-request = {"currentness":{"abortPreviousOwner":true,"acceptedSideCondition":["retained.cardId===key.cardId","retained.fromSeq===key.fromSeq"],"fences":["success:diffOwner===owner","rejection:diffOwner===owner","finalization:diffOwner===owner"],"freshOwner":["controller","promise"],"retainedKey":"original-request-key","selectionGuards":["selectedCardId===key.cardId","cardHistorySelectedVersion===key.fromSeq"]},"key":[{"name":"cardId","type":"string"},{"name":"fromSeq","type":"number"},{"name":"to","type":"'current'"}],"request":{"operation":"cards.diff","params":{"id":"key.cardId"},"query":{"from":"String(key.fromSeq)","to":"key.to"},"signal":"forwarded"},"reuse":{"invalidationGates":["scope=diff","visible","retained-key"],"reconnectGates":["visible","retained-key","freshness!=refresh-failed"],"refresh":"startDiff(cardHistoryDiffKey, reason)","retry":"refreshDiff(invalidated)"},"selection":{"construction":{"cardId":"cardId","fromSeq":"version","to":"current"},"frozen":true,"startArgument":"key"}}

Conversation readers

Recorded preparation and record observations

Prepared format-12 activation evidence uses activation_id, caller, card, parent_direction, role_text and node. Card ingress records actual activation and stable orientation. Globals have null activation/card/parent and a global caller. Parent callers retain exact card/session/source-input/call/tool provenance and rendered direction. Independently filter text and metadata. Non-model ingress is not_applicable; missing recording is unavailable, never current configuration.

At the prepared boundary, Parent activation direction and Caller and card orientation disclose complete safe values with full copy. Root/global explicitly have no parent direction. Source-ordered record_prompt is Recorded workflow instruction, with initial/changed provenance. Recorded record observations names the owning read/mutation/preparation/prompt, selection/view, accepted/draft/ absence, and metadata/slice/full_body/reference_only/excerpt exposure. Slice coordinates are exact; excerpt is not complete body or a contiguous source interval.

Oversized prompt JSON contains a marked encoded/redacted display preview. Its notice counts omitted display bytes, not source offsets; a versionless link reads latest effective content, possibly a newer draft. Decode no fragments and reconstruct no omitted history. Full APIs, pagination and immutable links retain their existing contracts; this adds neither a new workflow nor a completeness claim.

Compacted descriptors retain original coordinates/time, not fresh timeline entries. Inspect immutable record evidence selects only the recorded accepted locator, including backing, not today's record/template or request bytes. Preparation descriptors explicitly say full prepared text was not recorded. Public policy omits internal hashes, templates and evidence arguments, independently of prose redaction, including protected copies/facts. Current/history/protected copy preserves the same server-filtered JSON-quoted string, not decoded/raw originals. The browser neither decodes nor becomes a redaction owner; canonical history remains unchanged.

Segment selection, reading and tool exchanges

Explicit JSON tool data and context/technical JSON use the shared JSON data-display contract; string-valued prose and output heads remain text. Safe-original strings are not reconstructed.

Orientation reads Conversation — current segment N or Conversation — exact segment N. Retained conversation and compacted context are used in request assembly, not an exact model request. Recorded prepared role/node evidence is inspectable at source boundaries; tool definitions, arbitrary dynamic context, protocol encoding and private replay are not reconstructed here.
Each source activation retains Activation entry recorded and shows Prepared instructions, agent/node identity and recorded time. Independently expandable Role instructions and Node <id> instructions use a labeled instruction band/border/background, not color alone; full safe text wraps inline and Copy copies all public text. Explain privacy-filtered recorded instructions and preparation, not delivery or interpretation. Admission, cancellation, routing failure, turn-start or successful exchange never upgrades this to Delivered. Raw activation details contain only projected public fields.
Explicit absence reads Historical instructions unavailable — not recorded; non-model ingress reads No model invocation for this ingress. Never substitute current templates. Marked user text is Recorded workflow instruction at its existing source position, with Recorded context — delivery not established, full safe text/copy, links, source anchors and time. Marked repair retains Repair instruction recorded in its single diagnostic disclosure plus the workflow-origin explanation. Protected details retain provenance, coordinates and policy; unmarked ordinary context stays ordinary without inferred origin.
A segment/tail starting after its activation says the start is outside the displayed segment/tail, not that instructions never existed. Compacted views explain earlier activation instructions are in indexed source history and offer Inspect source segment N using the exact known source_version; no automatic chain crawl or guessed adjacent version. Historical and card/global readers share the same renderer. Incremental arrival never relocates or duplicates instruction rows; changed segment identity replaces the baseline as before. Existing current configuration, technical/exchange, tool/image, search/jump and follow features remain.
One conversation-owned scroll surface contains orientation, context, disclosures and timeline; expanded prose, code, instructions, stdout/stderr and raw payloads grow in normal flow, not nested vertical scrollports. Tree and Analyst remain independent panes. About this conversation is initially closed and explains retained basis and grouping.
Actual selected compacted genesis is separate from source rows, under initially closed Compacted context · from segment N. Counts, source/selected segments, required-fact presence and between-rounds or inherited-open-round continuation appear inside. Accumulated summary, Retained instructions (N), Required model facts, and Source and continuation are independent, keyboard-operable and initially closed. Accumulated summary may be a fixed code-owned declared-omission notice, not a completed LLM summary or task approval. Render its full safe text without interpreting it. Internal-summary refusal evidence is distinct from canonical primary-refusal counters. Completed-fold progress counts validated LLM calls only; local omission adds zero. No new API field, screen or counter is required. Full safe summary and all ordered instructions remain inspectable without preview truncation; individual instructions disclose full content, protection and exact source coordinates/identity. Original adjacency to summarized prose is not preserved. Facts are retained context, not fresh occurrences or liveness; continuation is not another activation entry. Current readers may include notices derived from compacted facts, not fresh physical events. Ordinary null context means no selected compacted genesis, not no system prompt.
Only ordinary typed system-role text uses Recorded system context, initially closed at its exact source position with full safe content, role, identity and time. Node-looking prose is not interpreted as current compiled authority. Diagnostics, refusals, activation entries and tool statuses remain visible. Exact entry targeting reveals the needed disclosure and focuses/highlights its original anchor.
The inspector has no Expand all, Collapse all or Pause auto-scroll controls; Analyst controls remain. useAgentTimeline is the sole accepted-arrival following owner, not the Analyst frame callback. Scroll-away pauses implicit bottom following; inspector Jump to latest resumes current following. Analyst Jump clears unseen count and moves once without unchecking explicit Pause; later arrivals follow only when pinned and Pause is off. Counts track source-entry arrivals, not combined visual row count. History/entry targeting never auto-follows. Disclosure changes do not force a bottom jump. Same accepted identity refresh preserves disclosures; session/segment identity replacement (even at the same ordinal) or leaving resets them. No cross-visit viewing state is retained.
Current REST responses and cursors carry segment_id (immutable entry UUID) and displayed segment_version; incremental queries require both plus since. Segment-changed errors carry requested/current IDs and versions before cursor lookup. Append requires the same session and segment identity/version. Changed identity, including a lower ordinal or a new UUID at the same ordinal and retained cursor, forces baseline replacement/refetch. Sync coalesces in accepted connection order, not greatest numeric version, and keeps existing epoch protection. Catalog/content retain immutable entry_id; numeric navigation alone is not an old-identity handle.
/agents/:id?segment=N&entry=ID selects ordinal N in the present catalog and optionally its exact row. segment is a scalar decimal [1-9][0-9]* with a positive safe integer value; absence selects current. Invalid values render Invalid segment selection without a version-content request or current fallback. Explicit selection reads the requested version even when equal to current and opens Segment history. entry is any nonempty scalar router-decoded string, preserved verbatim: no trim, case folding, extra decoding, UUID restriction, prefix parsing, or reconstructed ID. Missing, empty, or nonscalar values give no target; unknown opaque IDs reach ordinary missing-entry presentation. Vue Router builds encoded query values.
The segment-local activation index is initially closed with summary Activation entries · N, and coverage inside; explicit malformed-marker warnings remain outside. It projects public markers in physical source order and labels each Activation entry recorded, configured participant and recorded time, with copyable recorded identities and Open entry. Every link carries the observed numeric segment and full marker row ID; marker-only rounds render actual escaped transcript anchors, focused/highlighted by exact identity. Coverage says Markers retained in this segment only; earlier entries may have been compacted. Entry does not prove a provider call or completion. Empty accepted coverage says No activation markers retained in this segment. Claimed malformed markers produce explicit projection failure, not empty coverage. Inherited-open-round genesis is Continuation context, not a new marker, inferred node, timestamp or location; omitted markers are not searched for. This index applies only to the ordinary exact reader, not the unchanged identity-resolved Analyst inspector exception.
Current loading/error/retained-stale state follows the current reader; an accepted explicit segment is independent of current refresh failures and arrivals. Missing exact segment, failed read, and entry absent within a successfully accepted segment are distinct. Entry-only links report absence only in the current segment. Route changes retarget even without content changes; cold load, reload and Back retain exact selection. Historical inspection is not stolen by live hints or auto-scroll. No stitched transcript, second conversation owner, catalog crawl, adjacent-version guess or all-history search exists.
One focused exact session reader exists (shared store selection with owner-local request lifetimes and teardown before a newer selection). System session opening, evidence links, and card participant selection all reach the canonical address and mount the same exclusive reader inside the shared cockpit owner, never two instances. Reading offsets and arrival counters are discarded on leaving the inspector.
Canonical entries preserve physical source order; visual tool grouping brings an exact matched result to its call position. Corrections, recovery and other messages remain separate in their original relative order. Tool call, successful result, failed result, and No result recorded are distinct; the last proves neither pending execution nor permission to replay. Compaction is presented as separate system activity (completed summary calls, in-flight state, elapsed, last-known on failed refresh), never as agent liveness, heartbeat, percentage, or ETA. model_recovered uncertainty, failed uncertainty-only mates, later activation, and lifecycle corrections remain separate facts.
A matched exchange renders once at the call position, suppressing only its standalone result: matching requires equal session/source-input/call identity recovered from canonical message IDs. Provider call-ID reuse alone neither pairs nor suppresses rows; current and exact-history readers never borrow a mate from another selected segment. Visually empty rounds are omitted. call → prose → result → correction displays combined → prose → correction; Result recorded later marks intervening entries. Details preserve both original source positions/times and intervening-entry count, never backdated knowledge, invented duration or author attribution. Interleaved calls each own their row. Compact default summaries use friendly action, meaningful abbreviated target and honest outcome, not repeated exact tool codes, routine timestamps or stdout badges. An unmatched call says No result recorded; independently evidenced live Analyst pending state may say Awaiting result. An unmatched result stays at its source position with Requested context unavailable. A mate arrival updates the call-keyed row inline, preserving expansion and reading location without a duplicate visual row.
Request and Result retain distinct unique exact DOM anchors. Cold/Back/refresh route targets and inline links reveal the owning row and correct half before owner-local scroll/focus. No hidden duplicate result or unconstrained ancestor scrolling exists. Each image action retains its exact matched result's message/content/image identity and selected session/segment provenance, including when provider call IDs repeat.
Tool settlement is distinct from domain outcome: Running at observation is not completion; Process failed · exit N can accompany successful settlement; Exited · exit 0 is not proof that tests passed. Effects uncertain proves neither execution nor non-execution and implies no replay. Errors, refusal, partial propagation, confirmation and uncertainty stay visible outside disclosure. Essential qualifiers (including delivery not reported, restart required/not contained, and omitted/truncated/partial coverage) are never clipped or hidden to shorten a row. At most one short faithful reason/observation supplements the outcome; full error, refusal and propagation prose belongs in expanded semantic detail, not the default. A draft update is not acceptance; its accepted URL may select a retained older version. Accepted principal effects and partial propagation are separate facts. Restart confirmation_required is not restarted; navigation publication is not browser receipt. Unexpected projection shapes show presentation unavailable, not a green completion or a normalized alternate payload.
First expansion shows Request then Result, each with named tool-specific sections for the full supplied operation, target, arguments and content and recorded observations/effects. Supplied edit old/new strings are not complete before/after snapshots. Stdout and stderr disclose independently with actual output links and recorded head completeness/byte coverage. Slices, selected pages/tails, omissions and truncation remain explicit; opening Files does not fill historical evidence. Expansion performs no content fetch or current-data enrichment. Secondary Safe original request and Safe original result copy the complete received public strings through the final character, not reserialized summaries, private durable bytes or provider wire. All content and supported links use the same source-owned public projection for current and selected history. Recorded workspace locations in Request, safe-original JSON and full copy are server-filtered independently of execution outcome, including rejected calls and calls with no recorded result. These are not unsanitized execution arguments; strict valid record selections and exact evidence/source identities remain usable.
Tool summaries in the exact-session reader and Analyst panel keep the target on one visual line with meaningful abbreviation and width-dependent ellipsis, not wrapping long commands, paths or queries into a payload-sized block. Ordinary action/target/outcome rows fit one line when the pane has room; narrow panes deliberately stack a small number of lines while retaining a readable nonzero target slot. Action and essential outcomes remain legible without overlap; critical qualifications may take extra lines and are never line-clamped. The combined target is bounded to 48 displayed characters and the optional reason/observation to 56, including ellipses; these are local display bounds, not API or source-data limits. Details remain keyboard-operated through the native disclosure button; useful resource links stay exact, separate and focusable. Full commands, paths, queries, results and errors are directly available in expanded Request/Result semantic sections, not only tooltips or RAW. Secondary safe-original disclosures preserve complete request/result strings and exact copy through the final character.
Diagnostics remain at their original source anchors. Model issue keeps a faithful error excerpt visible; Repair instruction recorded is neutral, not achieved repair; Interrupted activation · effects uncertain is not recovery success. Initially closed full safe technical bodies retain role/time/identity, are selectable/copyable and open on exact targeting. Refusal and uncertainty remain visible without expansion. This changes no runtime repair/recovery behavior.
Technical details is initially closed and lazily fetches existing session-scoped latest recorded exchange metadata, with Refresh; it is not historical-segment metadata or an exact request. Activation raw identities/JSON/time are secondary inline details; marker existence remains visible as Activation entry recorded.
Currently configured instructions is a separate initially closed inline disclosure in both readers. agents.currentInstructions reads composed static text from loaded server configuration, not latest disk bytes, historical snapshots or in-flight inputs. Show the selected global binding once or all matching workflow nodes in declaration order, never infer a node from a marker or deduplicate distinct bindings. Retained tombstones say retained-card orientation using current templates. Historical views explicitly say Current server configuration — not the instructions recorded for this historical segment. Recorded system text and compacted context stay separate. Opening reads once; while open Refresh explicitly reads again. Close/departure/session change aborts and discards content/error, reopening reads afresh, and stale completions are fenced locally. Same-session transcript/history refresh does not refetch, reset or jump this view. A held-open value is a last fetched observation, not live tracking. Refresh failure leaves an error/no-current-content, not a silently fresh retained value. Invalid identity makes no request; loading/401/404/503 remain inside the disclosure without replacing retained history. Copy is the complete safe received instruction string. There is no dynamic context, tool definition, private replay, wire body, provider/auth configuration, raw original escape hatch, polling or cross-visit cache. Existing operator authentication and post-composition outbound redaction apply.
Current content, compacted summary context, retained instructions, and an explicitly selected historical segment remain separate; no stitched cross-segment transcript. Summary prose is inspectable historical context, not execution/acceptance evidence; prepared provider-private context is not exposed. Private Responses producer identifiers and their field are excluded from public current/history/context DTOs and copied transcript values; this does not remove existing public routing/account aliases.
Ordinary segments return segment_context:null. Compacted current/history REST reads and read_agent_session share exactly {kind,source_version, covered_through_message_id,summary_text,protected_prompts,required_model_facts, continuation}. Protected messages retain explicit outbound projection/redaction; their projected extraction coordinates use segment_version and row_index, required-model-fact members retain camelCase, and inherited-continuation activation retains snake_case. No recursive key conversion occurs. There are no compaction checksum, lineage, group-count, disposition, or coverage objects. This changes no rendered history needs, segment identities, cursors, catalog navigation, or separation of context from transcript evidence.
Participant rails show backend-decorated active · busy or inactive · idle meaning only. The browser performs no join with actor state, process state, or graph agent mappings, and derives no agent/session liveness or ownership from them. Configured node/role labels are workflow facts; one agent on several nodes shows every association with one exact session selection.
For a direct session entry, the exact session scope resolves first. Card scope then claims the existing CardStore selection/detail owner; no detached card context reader exists, while the transcript remains independently usable. Loading or initial card failure leaves Conversations active and disables the other four facet labels. An unavailable card flow keeps the exact card identity and says Card flow unavailable; it does not identify tombstone state, search for a replacement, infer hierarchy, or mount card membership reads. A retained admitted detail stays visibly stale on refresh failure; a later authoritative 404 removes card-owned subordinates but retains the exact reader. Global scope shows global purpose and the same exact reader, not a card header, selected card, participant rail, or card tabs.
The identity-resolved, read-only Analyst-session inspection exception (via GET /api/chat) is retained; its inspector and the ordinary Analyst conversation consumer are never mounted together.

Analyst panel and external-only mode

Mount the interactive desktop/mobile Analyst pane only after backend identity resolves with internal_enabled:true, except while its exact read-only inspector owns the transcript. Pending/error availability mounts no composer and never authorizes sending. Availability failure remains visible. Suppression removes the pane, skip link/target, mobile tab/activity indicator and focus shortcut/help entry, and gives the workspace its width back. The exact disabled Analyst inspector explains that interaction is disabled and retained history is read-only. Hiding never deletes browser drafts or server history. Internal/both retain ordinary busy, draft, navigation and focus behavior. External operations are visible through canonical records and bounded audit projections, never synthesized chat messages.
The backend identity response is exactly session_id, mode (internal|external|both), internal_enabled and external_enabled. These capabilities expose no listener port, credential or allowlist. External-only POST /api/chat fails409 with {error:'analyst_disabled',message:'Internal Analyst interaction is disabled.'} before actor/provider/ingress, including direct application submission. Retained identity and exact read-only history routes remain available. External settled receipts use authenticated GET /api/external-tool-calls and are not conversation turns, provider evidence or verified model/person identities.
The Analyst is shared, not a private browser task. Busy denial preserves newer draft edits, is not queued or retried, and browser closure is not cancellation. Identity comes from GET /api/chat.
A local UTF-8 context-limit failure or server redaction-budget HTTP 400 keeps the unsent draft and displays the ordinary send error; neither retries nor submits a no-focus substitute. A newly accepted request by another client captures that client's own route independently.
Readiness explanations distinguish settled paused/stopped from other lifecycles and never act as HTTP health, a reservation, or an operation-specific admission gate.
The restart composer acknowledgement keeps the exact confirmation_required/scheduled discrimination and the literal RESTART SERVER message.
Analyst notification results retain ordinary chat/tool-result presentation: queued confirms enqueue; pending_tool_settlement is not a completed stop, and interrupted lists completed stopped cards, not delivery or model action. not_applicable does not start a Run; Pause needs explicit Resume. No queue field, new control, receipt refresh, or timeline state is presented. Delivery not reported remains explicit. suppressed retains its reason and any reported stopped IDs; neither suppression nor queue success promises receipt, handling or re-entry. Failed queue refusal preserves the recorded reason/status.

Files, processes, and evidence

Text, private namespaces and current images

Physical text previews consume complete UTF-8 files up to 1,048,576 raw bytes (1 MiB), without truncation. CJK, emoji and other Unicode text are supported; BOM, CRLF, whitespace and trailing newline are preserved subject to outbound redaction. Empty text is valid. Malformed UTF-8, NUL and control-dominated content return 415; oversized text returns 413. This is a bounded text heuristic, not a promise to recognize every binary format. Canonical virtual card/record projections and record:/// reads retain their separate projection and cap rules.
.saivage/diagnostics and descendants are private: parent listings omit them; direct list/content/image reads and project/work aliases or resolved symlinks refuse them before subtree readdir, content inspection, sniffing or decoding. Opt-in failed-provider diagnostics contain sensitive projected request text and local hashes, not public evidence. No UI inspector/export/control or API link is provided. Canonical exchange evidence remains metadata-only; a private explicit content_filter observation may coexist with canonical ok. Content-policy historical refusal counts are not a complete census of internal-summary refusals.
Eligible ordinary static PNG/JPEG/WebP are recognized by content and successful decode, not extension. files.content returns strict image metadata without binary/base64; authenticated GET /api/files/image?path=... freshly admits and decodes current bytes and returns their unmodified detected MIME. The shared dialog says Current source, path and fetched decoded natural dimensions, never stale metadata dimensions. Source is bounded to 32 MiB/40M pixels; unsupported/animated/corrupt input has no substitute preview. Existing text, Markdown, JSON and copy/redaction behavior remains unchanged.
Both Files reads preserve lexical/resolved-path and canonical-card dispatch admission before inspection. Physical conversations, config/auth/private paths, attic and aliases remain refused; redacted credential/config surfaces cannot become raw binary. There is no internal storage browser or pixel-redaction promise.
Files JSON display and copy use the exact received safe content string under the shared JSON data-display contract, not a parsed and pretty-printed reconstruction. Whitespace, duplicate keys, escapes and number spelling/precision are preserved. This is projected/redacted received text, not a claim to expose private original file bytes. Existing JSON content type, +json or .json path classification is unchanged; text logs remain text.

Listing freshness and virtual records

Files is the canonical virtual-file read-only browser (metadata/output roots, breadcrumbs, card.json[?v=N] format reads, typed failures, safe redaction notice). Physical persistence paths are never disclosed. Files and previews expose explicit Refresh and permitted resource-local Retry; a failed historical read preserves usable listing/current state.
Metadata and Output each retain one independent listing observation and a 30-second age advisory: This directory listing was read at least 30 seconds ago. Refresh to read it again. Only that listing's accepted successful read (including empty) resets its deadline. Pending/failed/superseded reads and preview/image reads do not reset it; the deadline performs no network read. Failed navigation retains the prior represented path, rows and age. Initial failure is not an accepted empty listing; loading and root-local errors are explicit. Unauthorized presentation takes priority over the age advisory.
Mounted reconnect/connected-registration refresh joins any pending route resolution; otherwise it reads the represented directory (the parent for a deep-file selection), then the still-selected preview under route/selection fences. Ordinary listing failure does not suppress the independent preview attempt. Listing success cannot clear a typed preview failure, and preview success cannot clear listing error/age. Neither connection nor absence of an age warning certifies current file contents or live filesystem watching.
Current and historical record:/// preview HTTP 404 {error:'workspace_card_not_found',path,card_id} displays Card not found, retaining the requested identity. Existing-card record/content and historical-version misses keep their distinct failures; corruption is not presented as missing-card.
Current and exact accepted record:/// previews receive backend text redaction, including current drafts; authenticated Files access is not a raw-record escape hatch. Redaction flags mean the policy was applied, even when ordinary prose is unchanged. Record-URL size describes source bytes, not necessarily the displayed projected text length.
Read-only presentation is not a promise of non-mutating backend consumption: exact owners may discard a current growing file's proven torn final suffix only after full retained-prefix validation. Older conversation segments stay immutable; complete corruption remains unavailable/error, and publication uncertainty is fatal before a response, not translated to not-found or Retry. No browser repair action or new control is introduced.

Process rows carry supplied owner/card identity, status, and canonical work:/// log references. Successfully stopped scope-tree selections disappear after terminal settlement and retirement. Retirement does not erase a known link or promise retention; there is no terminate control or process-history cache.
Unavailable current rows display Evidence unavailable, group uncertainty and Leader exit observed (actual code/signal/time or Not observed). A running row with leader exit displays Awaiting group/output settlement, not confirmed leader liveness. Stdout/stderr show Stream open, EOF observed, Closed without observed EOF, or Not captured by runner, independently of Capture failed diagnostics: EOF and failure can appear together. Unavailable has no completion time; later activations cannot take ownership, and service-level intervention requires the operator. Running rows sort first, unavailable next, then terminal observations; log browsing and explicit Refresh remain read-only.
Historical process-list results remain Recorded observation (not a live monitor). Supplied evidence is shown with safe-original disclosure; old omitted evidence stays unrecorded, never synthesized or refreshed. Failed command chips show their recorded failure text without new successful payload or history rewrite.
Evidence is a source-labeled navigation index: card-version, per-record revision, and per-session segment catalogs open on demand with exact links into their owning readers and coverage labels. A session segment link includes segment=N, rather than merely opening the session's current content. The card events tail uses GET /api/events with selection:'newest_tail', limit 50, offset 0, and the card filter; explicit oldest-page browsing uses contract-valid offset/limit. Each response is a fresh bounded observation with returned coverage/total; chronological physical order is preserved within a response; no session/since filter, polling, WebSocket replay, or invented invalidation exists. Independent sources are juxtaposed only as grouped facts anchored in durable publication order, never as one canonical cross-session order.

System surface

Configuration, provider exchange metadata and technical graph/error JSON use the shared JSON data-display contract, after their existing safe projection and formatting. Instruction bodies remain prose; installed bindings remain distinct from saved configuration.
Events presents informational operator_runtime_control rows with their bounded result: Pause/Resume returned runtime status: …, Stop returned stopped; execution contained (contained: true) or execution not newly contained (contained: false), Restart scheduled — shutdown and replacement readiness not established, or the explicit body-not-allowed/restart-unavailable rejection. These global rows have no synthetic card link and are excluded from Errors and card-filtered Events. Errors explicitly includes runtime diagnostics, actionable errors and failed MCP invocations only, including returned native isError:true envelopes. When the invocation event has no optional error text, the existing message is MCP tool <tool> invocation failed, with source mcp:<server> and the catalog's informational severity. Safe native diagnostics remain in the failed tool result, not copied into Events/Errors. Invocation outcome is not a guarantee of subsequent projection or model delivery. Direct controls record known handler returns and explicit handler rejections; status reads, pre-handler denials, thrown failures and transport loss have no promised row. Missing evidence does not authorize repeating a command. Analyst tool evidence remains in conversations, not duplicate control events.
System consolidates State, Operator observation, Participants (global and cross-card inventory), Errors, Events (no card filter), Processes, MCP, Provider availability, Configuration, Installed workflows/bindings, Actions, and manual Doctor. Sections read on selection; opening System fetches none of them.
Operator observation is diagnostic-only: it directs operators to Cockpit for current runtime and activation ownership and System > Errors for durable command, precondition, activation, and actionable-error evidence. Ask the Analyst to run, pause, resume, or stop the project; project Stop does not shut down the server or replace the distinct confirmed Restart Server action.
Provider states are process-local (process_local_reset_on_restart); expiry eligibility differs from recorded cooling; no durable health history, base URL, or inferred cost is shown. Saved effective configuration and installed workflow/model/tool bindings are labeled separately; no editor, prompt-body viewer, or hot reload exists. Actions show retained settled actor/target/time/result rows without guaranteed audit completeness: only the bounded audited Analyst mutation surface currently produces them, while historical Planner rows remain readable. Oversight appears as an ordinary global participant conversation with epoch diagnostics (waiting/checking/unavailable) and no manual check, configuration editor, or trigger.

Shared legibility

Presentation-only layer over the surfaces above; no request, contract, or honesty-rule changes. Owners: web/src/utils/legibility.ts and web/src/components/ui/ExactValue.vue.

Tiers: Primary plain-language facts (state, trajectory, participants, problems, outcome) lead at reading size; Secondary support (titles, humanized times, counts, exact liveness pairs) stays visible muted or, on Overview, in the adjacent Session details disclosure; Tertiary exact identities (IDs, UUIDs, hashes, raw payloads) remain exact and copyable but never lead.
livenessPhrase maps exactly the two contract-enforced pairs (active · busy, inactive · idle); any other pair renders the exact backend words unchanged.
positionGloss supplies the primary Observed workflow step only from the per-type compiled-workflow presentation (node → owning agent's step; terminal → configured end states). Exact raw position belongs in Workflow & technical details; without matching presentation the UI states that workflow details are unavailable rather than guessing a role or business milestone.
The recorded-result one-liner quotes the backend-recorded summary verbatim (120-char truncation; full JSON one disclosure away); key listing exists only for future summary-less shapes.
Card-tree rows are color-only (owner decision 2026-09-25); non-color status meaning lives on the selected surfaces (flow-header badge, Overview situation and lists).
The provider-exchange surface is named Provider exchange metadata everywhere; segment-context and retained-instruction IDs render compact with full values in title and copy. Its existing copyable Settlement JSON retains known provider-reported token fields, including explicit zeros, without fabricated null/zero counters or totals. Successful exchanges explain that unreported values are unknown, not zero; cached input is part of input and reasoning output part of output. An ok exchange without usage shows Token usage not reported. Error and no-exchange states remain distinct. This is latest-attempt metadata, not accounting, aggregation, or a history dashboard.
Record diffs carry a "Changes from previous version" label; card-version diffs carry explicit Before/After columns; EventsPanel coverage counts derive from returned data, never the request limit.
ExactValue is the exact-identity carrier: mono, full value in title, copy button with accessible name and transient Copied feedback.

Operator UI: Exact Contracts Register

Observed collection Request/Result presentation

Product model

Shared JSON data display

Image result presentation

Configured MCP presentation

Repair visibility and selection identity

Runtime observation and the global strip

Executions and selected output files

Identity, routes, and navigation

Exact routes and workspace history

Shared card context and work-first Overview

Request ownership and retained observations

Card tree and hierarchy

Records, versions, and diffs

Content state, authorship and installed declarations

Historical selection and comparison

Exact displayed-current-diff request contract

Conversation readers

Recorded preparation and record observations

Segment selection, reading and tool exchanges

Analyst panel and external-only mode

Files, processes, and evidence

Text, private namespaces and current images

Listing freshness and virtual records

Process observations and evidence navigation

System surface

Shared legibility

Operator UI: Exact Contracts Register ​

Observed collection Request/Result presentation ​

Product model ​

Shared JSON data display ​

Image result presentation ​

Configured MCP presentation ​

Repair visibility and selection identity ​

Runtime observation and the global strip ​

Executions and selected output files ​

Identity, routes, and navigation ​

Exact routes and workspace history ​

Shared card context and work-first Overview ​

Request ownership and retained observations ​

Card tree and hierarchy ​

Records, versions, and diffs ​

Content state, authorship and installed declarations ​

Historical selection and comparison ​

Exact displayed-current-diff request contract ​

Conversation readers ​

Recorded preparation and record observations ​

Segment selection, reading and tool exchanges ​

Analyst panel and external-only mode ​

Files, processes, and evidence ​

Text, private namespaces and current images ​

Listing freshness and virtual records ​

Process observations and evidence navigation ​

System surface ​

Shared legibility ​

Operator UI: Exact Contracts Register

Observed collection Request/Result presentation

Product model

Shared JSON data display

Image result presentation

Configured MCP presentation

Repair visibility and selection identity

Runtime observation and the global strip

Executions and selected output files

Identity, routes, and navigation

Exact routes and workspace history

Shared card context and work-first Overview

Request ownership and retained observations

Card tree and hierarchy

Records, versions, and diffs

Content state, authorship and installed declarations

Historical selection and comparison

Exact displayed-current-diff request contract

Conversation readers

Recorded preparation and record observations

Segment selection, reading and tool exchanges

Analyst panel and external-only mode

Files, processes, and evidence

Text, private namespaces and current images

Listing freshness and virtual records

Process observations and evidence navigation

System surface

Shared legibility