Adds `workbench-ui/src/app/routes.ts` as the single source of truth for
navigation routes. App, LeftNav, the command palette, ⌘-digit shortcuts,
and the landing-route preference now all derive from `WORKBENCH_ROUTES`.
Fixes the live palette-drift bug: the command palette's hand-maintained
NAV_COMMANDS listed 10 routes and silently dropped Demos and Calibration,
so they were unreachable via ⌘K. The landing-route tuple was likewise
missing Replay and Calibration. Deriving every list from one registry
makes that drift structurally impossible.
- routes.ts carries a `section` field for grouped wayfinding nav
(Converse · Cognition · Determinism · Evidence · Discipline ·
Substrate · Settings) — a display skin only; one workbench, one
address space, one Evidence Chain Rail.
- App is data-driven via ROUTE_ELEMENTS (route id → element); a registry
route without an element fails routes.test rather than rendering undefined.
- Honest keyboard model: ten routes pin ⌘1–0; Demos and Calibration are
palette-only (no chord advertised).
- routes.test.tsx guards the contract: element-map parity, unique
ids/paths/digits, landing-route coverage (Replay + Calibration), and
palette reachability of every command-visible route.
Verified: pnpm build green; routes/Shell/CommandPalette/routeConformance/
prefs/Settings + hexScan/schemaDrift/enumCoverage suites all pass (108 tests).
The docs/proposal-artifact-substrate-v1 work (#727) — wave-m-consolidation-b3.5,
core-logos-studio-plan, proposal-artifact-substrate-v1 — is the authoritative
consolidation and supersedes the parallel 'Phase A' I'd just drafted. Reconciling
to one source of truth:
- FOLD IN the one genuine gap b3.5 missed (a design review caught it): the
Calibration centerpiece undersells — the reader reads the sub-N_MIN committed
practice report.json, so on live data no class shows licensed, while the
earned state (additive 95/5/100, PROPOSE-licensed) sits in the disagreeing
ratification_queue.json. Added as a diagnosis addendum + a Deliverable-2
acceptance criterion (make the committed practice artifacts coherent; show
≥1 earned class). Data-side fix, not a re-derivation.
- FOLD IN the grouped-navigation idea: a field on the route registry
(Deliverable 1) + the organism's-loop grouping (Converse/Cognition/Evidence/
Determinism/Discipline/Substrate/Settings), with the correction that
'core-logos' is the language/manifold Studio surface, not the cognition cluster.
- REDIRECT wave-M-worthiness.md's consolidation section to point at b3.5 instead
of defining a parallel Phase A.
- SCRAP duplicates: wave-M-phaseA-briefs (duplicated b3.5) and
workbench-ui-ux-guide-brief (superseded by b3.5 Deliverable 4).
Boils the design review and the information-architecture decision into one
integration. Phase B's heart (calibration/serving discipline) is done;
Phase A (Structure & Polish) now runs BEFORE resuming Phase C because two of
its items are structural prerequisites the Cognition cluster lands into.
Key synthesis: the command-palette drift bug and the grouped-nav idea are
the SAME fix — navigation derives from one registry that also encodes
structure. Standing IA constraint: one workbench, one address space, one
Chain Rail; grouping is a wayfinding skin, never an architectural fork; no
separate workbenches (the single evidence model is the thesis); 'levels' are
depth-within-a-surface, not top-level categories.
Phase A brief pack (wave-M-phaseA-briefs):
- A1: navigation registry (one source of truth) + grouped nav by the
organism's loop (Converse/Cognition=core-logos/Evidence/Determinism/
Discipline/Substrate/Settings) + palette fix (Demos+Calibration are
currently unreachable via ⌘K; the ⌘1-0 map is stale)
- A2: Calibration earned-state — the centerpiece undersells (reads the
sub-N_MIN report.json; the earned license lives in the disagreeing
ratification_queue). Primary fix: regenerate coherent practice artifacts;
fallback: reader surfaces both with provenance
- A3: Doctrine station ('how this UI can't lie') — elevate contracts/checks
into a first-class surface; trails, larger
Parked: B4 (needs engine-side license stamping; no re-derivation),
Calibration EvidenceSubject kind.
An always-present invariant in the TopBar chrome: the live serving triplet
(N correct · N refused · 0 wrong) aggregated across lanes from
/serving/metrics, the wrong count load-bearing — 0 in the verified token,
>0 in the contradicted token. It is a MIRROR, never a hard-coded zero:
renders a non-zero wrong honestly, and an honest 'metrics unavailable' when
the reports can't be read. Links to the Calibration route (the discipline
behind the number).
Tests: aggregate triplet + 0-wrong, non-zero-wrong-honest (not hard-coded),
metrics-unavailable-not-fake-zero. (Adds fetchServingMetrics/useServingMetrics
locally; unioned with B2 on rebase.)
Consumes the B1 readers (#724). The route where you SEE 'the engine earns
the right to guess' (ADR-0175).
- list (failures-first, server-ordered): per class a reliability bar
(Wilson floor vs the PROPOSE/SERVE θ markers — a class earns the right
when its fill crosses the marker), correct/refused/wrong counts (wrong in
the contradicted token), and a verdict pill (earned SERVE / earned
PROPOSE / not yet licensed)
- serving strip: the discipline's RESULT — live correct/refused/wrong per
lane, wrong=0 in the verified token, with source DigestBadges
- detail (Panel + TabBar): Counts / License math / Raw. The License-math
tab shows the honest derivation (measured ≥ θ → licensed) and states
the numbers come from core.reliability_gate, not the workbench
- fail-closed: an empty/absent arena ledger (501 evidence_unavailable)
renders the honest absence card pointing at the practice lane, not an
error
- nav entry (12th) + routeConformance row + Shell nav assertion updated
Token-only (hexScan green); VirtualizedList + j/k; full vitest 398 green.
First Wave M / Phase B piece (GATING): read-only backend that makes the
calibrated-learning / serving-discipline loop inspectable — 'the engine
earns the right to guess', ADR-0175.
The workbench computes NONE of these numbers:
- GET /calibration/classes — per-class gold-tether view from the persisted
practice arena ledger (evals/gsm8k_math/practice/v1/report.json per_class).
Each class's reliability_floor is the engine's own one-sided Wilson
conservative_floor (via ClassTally.reliability); PROPOSE (θ=0.85) / SERVE
(θ=0.99) license verdicts come from core.reliability_gate.license_for.
Failures-first ordering. A test proves the reader's floor equals a direct
conservative_floor() call — no re-implementation.
- GET /serving/metrics — the live correct/refused/wrong counts read unchanged
from the committed train_sample + holdout_dev report.json (currently
4/46/0 and 5/495/0 — wrong=0). Never re-runs a lane.
Honest current state: the committed practice ledger's three classes
(additive/divisive/multiplicative) are all below N_MIN=10, so none has
earned a license yet — the reader shows exactly that, no fake green light.
- workbench/calibration.py: pure readers; imports core.reliability_gate;
EvidenceUnavailableError -> 501 (fail-closed) when the artifact is absent.
- schemas + TS mirrors (CalibrationClass, ServingMetrics); both snapshots
regenerated (deterministic); both drift gates pass.
- trust boundary: read-only over committed artifacts + engine-owned
derivation; no execution, no mutation, no license ever changed.
Verified: 30 Python tests (incl. the no-reimplementation proof + fail-closed),
390 vitest, both schema drift gates, snapshots deterministic.
A teach-everything, indexed docs/workbench/UI-UX-GUIDE.md: thesis + evidence
model, the 11 routes (purpose/evidence/usage/states each), the design system
+ primitives, the full keyboard map, the doctrine gates as honesty proof,
replay-in-depth, glossary. Scoped for a mid-tier model: documentation over
shipped code, accuracy-over-completeness, Markdown-only, ground every claim
in the real components. Dispatch-ready.
scripts/workbench — a single robust entrypoint so a fresh clone runs the
Workbench the FIRST time, not sometimes:
- doctor: fail-loud preflight (uv, node>=20, pnpm via corepack, curl) — each
failure prints the exact fix, never a half-started UI
- setup: idempotent — uv venv + editable CORE install + pnpm frozen install,
only when actually missing; re-runs instant
- up: health-gated start of the stdlib API (:8765 /health) + Vite UI (:5173),
reuses already-healthy ports, invokes vite directly so Ctrl+C tears down
both cleanly (TERM-then-KILL, EXIT trap); logs to /tmp/core-workbench-*.log
- pure-Python backend (numpy) — no Rust build required to run the Workbench
- API_PORT / UI_PORT overridable
Tested end-to-end: up in ~5s (API /health 200, UI 200), clean teardown
frees both ports. README gains a 'CORE Workbench — one command' quick-start
as the most-discoverable visual entry, with the first-time-works guarantees
spelled out for an external evaluator.
Wave M takes the workbench to mastery and closes its biggest design gap:
it surfaces the teaching/ratification loop but is blind to the
calibrated-learning / serving-discipline loop (gold-tether arena, reliability
gate, Wilson floor vs θ ceiling, 'the engine earns the right to guess') and
to cognition itself (pipeline stages, field substrate, identity continuity).
Lens: Anthropic + xAI as target users who'd WANT to use it.
- wave-M-worthiness.md: full plan, Phases A–E, the missing-surfaces table,
the backend-reader-first / never-re-implement-engine-math disciplines,
execution order (B→C→D, A parallel).
- wave-M-phaseB-calibration-briefs: executable Phase B pack grounded in the
real core/reliability_gate shapes (ClassTally / conservative_floor /
license_for / Action θ) and the committed report.json evidence — B1
readers (GATING, Python), B2 Calibration route, B3 wrong=0 global frame,
B4 leeway wiring. Dependency DAG + STOP gates + no-theater rules.
First R3 (Theater) piece. Reworks the stale artifact-keyed ReplayRoute into
the turn-keyed hero over the #716 sealed-replay backend, and fully retires
the dead W-026 artifact-keyed machinery on both sides (the NOT_YET_MIRRORED
comment anticipated this).
The hero makes determinism *felt*: pick a journaled turn, CORE re-executes
its prompt in a sealed fresh runtime, and the result renders as a hash
verdict (≡ equivalent / ≠ diverged) + the original/replay DigestBadges + a
leaf diff (critical weighted above informational, each with a ≠ glyph). The
'What this proves' card surfaces comparison_basis + origin_state and states
the honest limit: a divergence means nondeterminism OR origin-state
influence, never rendered on its own as a determinism failure.
Retirement (verified zero serving uses):
- Python schemas.py: removed ReplayComparison/ReplayDivergence/ReplayStatus/
ReplayDivergenceSeverity; scripts/dump-enums.py drops the two replay enums;
both snapshots regenerated (deterministic: dump == committed)
- TS: removed ReplayComparison/ReplayDivergence/ReplayDivergenceSeverity;
added TurnReplayComparison/TurnReplayDivergence (+ basis/origin/severity
unions); NOT_YET_MIRRORED now empty (every engine schema mirrored)
- badges: removed ReplayStatusBadge + ReplayDivergenceSeverityBadge +
meta/enums + their enumCoverage cases (hero renders severity inline)
- api: fetchReplayComparison/useReplayComparison -> fetchTurnReplay/
useTurnReplay (/replay/<turnId>)
- deleted ArtifactList, ReplayComparisonPanel, ReplayDiffViewer,
ReplayMetadataTable, old replay.test.tsx
- App route /replay/:artifactId? -> /replay/:turnId?; conformance row
turn-keyed (loading 'Loading turns...', empty 'No turns recorded yet.')
Tests: ReplayRoute.test.tsx (equivalence hero + honesty card, diverged
critical leaf, informational-only label, replace-mode select, j/k spine).
Full vitest 358 green; workbench Python 34 green; both snapshots deterministic.
Follow-up flagged (not in this PR to keep it focused): the artifact query
hooks (useArtifacts/useArtifactDetail/fetchArtifacts*) are now orphaned but
entangled with the still-live artifact EvidenceSubject kind — a separate
cleanup once an Artifacts route or that subject's fate is decided.
Brief: docs/handoff/wave-R3-briefs-2026-06-13.md (all four R3 pieces).
Replaces SettingsRoutePlaceholder, completing all six placeholder routes.
- workbenchPrefs.ts: typed localStorage prefs with safe parse + live
same-tab sync (useWorkbenchPrefs). Every pref has a real consumer — no
toggle that does nothing:
* landingRoute -> consumed by the App index redirect (Navigate)
* inspectorDefaultOpen -> consumed by EvidenceProvider initial state
(EvidenceUrlSync still force-opens on a ?inspect= deep link)
- SettingsRoute: two panels. Preferences (landing route select + inspector
default switch, applied on next load, survive reload). Runtime (read-only
/runtime/status: backend, git_revision DigestBadge, engine_state_present,
checkpoint_revision, revision_warning with warning token, active_session_id,
mutation_mode) under the standing statement 'Engine configuration is
CLI-only. This page mutates nothing on the server.'
- no backend change, no new schema/subject, no NOT_YET_MIRRORED change, no
engine mutation of any kind
- bespoke conformance block (Settings has no empty state — the prefs panel
always renders); asserts the loading label + CLI-only statement + the
error contract over the status fetch
- tests: workbenchPrefs (defaults / persist+reload / invalid+malformed
fallback / partial merge) + SettingsRoute (both panels, landing-route
persistence, inspector toggle, error-without-mutation)
DEFERRED (flagged, not shipped as theater): list-density pref — honest
wiring requires threading a density token through every list row, a
separate change; shipping a control that does nothing would violate
ADR-0160 (audit-native, not analytics theater). Token-only styling
(hexScan green); full vitest 363 green.
Replaces VaultRoutePlaceholder with the real route over the R2-B
/vault read substrate (#712).
- TS mirrors VaultSummary/VaultEntry; both removed from NOT_YET_MIRRORED.
Also fixes a latent ErrorCode drift: adds 'evidence_unavailable' to the
TS union (present in Python schemas, missing in TS) — the route branches
on it.
- fail-closed is the design: a missing/unpersisted vault (the 501
evidence_unavailable signal, or persisted=false / entry_count=0) renders
the honest absence card as the PRIMARY state, naming the opt-in
RuntimeConfig.persist_session_state pointer — not a generic error, no
skeleton theater
- with data: summary strip (entry_count, store_count, reproject_interval,
max_entries, source_path) + VirtualizedList of entries with
epistemic_status / epistemic_state pills and versor_digest DigestBadge
- exact-recall doctrine: renders only backend fields; never computes or
displays a similarity/relevance proxy (runtime recall is exact cga_inner)
- selection publishes the vault_entry subject (inspect-param only, via
setSubject + setInspectorOpen; EvidenceUrlSync writes ?inspect=vault:N);
a URL-restored identity-only subject is hydrated once entries load
- Vault row added to routeConformance MOUNT_ROUTES — the fail-closed
absence asserted as the primary contract
- tests: fail-closed card (not error), summary+entries, no-similarity-score
doctrine, vault_entry subject publication, j/k spine
Token-only styling (hexScan green).
Replaces PacksRoutePlaceholder with the real triad route over the R2-B
/packs read substrate (#712).
- TS mirrors PackSource/PackSummary/PackDetail; PackSummary/PackDetail
removed from NOT_YET_MIRRORED (drift gate now enforces them)
- new design primitive TreeView (src/design/components/TreeView): a
deterministic, keyboard-driven JSON tree — object keys sorted, array
indices in order, no animation; ←/→ collapse/expand, ↑/↓ + j/k move,
Home/End jump, Enter toggles; registers its shortcuts only while focused
(KeyboardHelp never advertises tree controls when no tree is on screen)
- list pane: VirtualizedList + useListNavigation (j/k) + SearchInput; rows
show pack_id, source, version, language/modality, determinism_class pill
- detail pane: Panel + TabBar (Manifest / Checksums / Raw); Manifest renders
via TreeView; Checksums is the verify affordance — manifest_digest and
declared checksum as DigestBadges plus the per-field manifest checksums
table (the checksum-hashes-the-bytes-on-disk doctrine made visible); Raw
collapsed by default
- selection publishes the pack subject (R2-S), records /packs/<packId>
(replace), pushRecentItem on visit
- Packs row added to routeConformance MOUNT_ROUTES (loading 'Loading
packs...', error 'No packs mutation occurred.', empty 'No packs
discovered.' + core pack validate <path>)
- tests: TreeView (sorted/collapsed/expand/collapse/focus/click/empty) +
PacksRoute (list, replace-mode select + manifest tree, checksum verify
affordance, j/k spine)
Token-only styling (hexScan green).
Replaces the RunsRoutePlaceholder with the real triad route over the
R2-B /runs read substrate (#712).
- TS mirrors RunSource/RunSummary/RunTurnRef/RunDetail; all three classes
removed from NOT_YET_MIRRORED (drift gate now enforces them)
- list pane: VirtualizedList + useListNavigation (j/k) + SearchInput;
rows show source, session_id, turn_count, relative timestamp, a
checkpoint badge (present + revision vs 'no checkpoint'), and any
evidence_gap rendered honestly in-row (never hidden)
- detail pane: Panel + TabBar (Turns / Manifest / Raw); every turn row
is an anchor to /trace/<turn_id> (backend-provided trace_path) with the
trace_hash as a DigestBadge — the cross-link is the point of this route;
turn list pages via turn_limit ('Load more turns')
- selection publishes the run subject (R2-S) and records /runs/<sessionId>
in the URL (replace), pushRecentItem on visit
- Runs row added to routeConformance MOUNT_ROUTES (loading 'Loading
runs...', error 'No runs mutation occurred.', empty 'No runs recorded
yet.' + core chat)
- RunsRoute.test.tsx: list evidence, in-row gap, replace-mode URL select,
trace cross-link hrefs, manifest tab, j/k keyboard spine
Token-only styling (hexScan green); full vitest 339 green.
The multi-line git commit -m message had body lines at column 1, which
terminated the run: | literal block — GitHub could not load the workflow
file, producing a path-named failure run on EVERY push to every branch
since the file landed. Rewritten as paragraph-style -m flags; triggers
unchanged (workflow_dispatch only, CONTEMPLATION_ENABLED gate intact).
Replaces the W-026 501 stub. Re-executes a journaled prompt in a sealed
fresh runtime (ChatRuntime(no_load_state=True): no checkpoint load, no
checkpoint write, no proposal lineage) and compares the envelope
leaf-by-leaf against the recorded TurnJournalEntry.
Design correction vs the scoping doc (amended in-doc): journaled turns
each ran in a fresh ChatRuntime(), never one continuous session, so
genesis-PREFIX replay would manufacture spurious divergence; shipped
basis is sealed_fresh_runtime_single_turn (O(1)). origin_state:
"unrecorded" — the journal does not record whether the original turn's
runtime loaded a checkpoint, so divergence is reported as nondeterminism
OR origin-state influence, never disambiguated.
- workbench/replay.py: pure comparison + injected executor; every
TurnJournalEntry field classified critical/informational exactly once
(exhaustiveness enforced by test)
- api.py: route wiring under _CHAT_TURN_LOCK; runtime failure -> 500
runtime_unavailable, no comparison may be fabricated
- schemas: additive TurnReplayComparison/TurnReplayDivergence (W-026
artifact-keyed pair retires with the frontend Replay Moment PR)
- tests: 10 obligations incl. tamper-prompt, tamper-leaf precision,
no-execution-no-comparison, no-trace (journal + engine_state bytes),
wall-clock tolerance, sealed-construction proof
- snapshot regenerated; NOT_YET_MIRRORED debt entries for the two new
classes (mirrors land with the frontend PR)
- api-contract-v1.md § Replay rewritten for the turn-keyed shape
Decides sealed genesis-prefix replay semantics against the actual
constraints (single rolling post-turn checkpoint; journal appended only
by the workbench handler, so history completeness is unprovable today).
Response carries comparison_basis + history_complete so the UI never
oversells; typed refusals; five MEANINGFULLY-FAILS proof obligations.
Reconciles a stale local edit with the upstream roadmap: the deductive
entailment authority demo (PR #700) moves under Demonstrated with its
evidence caveat, and the merged-boundary count is corrected to five
(#687, #688, #690, #696, #700). Next proposed target: Embodied Authority
Simulation Demo.
- EvidenceChainRail: the spine's seven stages rendered per subject with
the honesty contract — lit/hollow/dim derive ONLY from carried fields
(a trace hash lights 'replay' as RECORDED, never as verified); pure
deriveStages() with meaningfully-fail tests (remove one field -> exactly
its stage hollows).
- Hash display standard: DigestBadge default 12-char + copy everywhere;
CopyableHash consolidated away (2 call sites swapped, file deleted).
- Typography: tabular-nums on MetadataTable values + eval metrics;
text-wrap balance on Panel titles + EmptyState statements.
- Selection unification: new --color-selected-bg/-border tokens; selected
(persistent) vs focused (transient) now visually distinct across
Proposals/Replay/Evals lists; focus-ring no longer doubles as selection.
- EmptyState gains a deterministic monochrome inline-SVG glyph.
- Panel adopted in Evals lane list + Proposals queue.
- Doctrine-as-tests: hexScan (no palette literals outside tokens.css/
generated tokens.ts) + schemaDrift gate (scripts/dump-schemas.py AST
walk -> schema-snapshot.json -> every dataclass field mirrored in
types/api.ts; explicit shrink-only NOT_YET_MIRRORED debt list).
The drift gate caught real drift on first run: ChatTurnResult.turn_id
existed in Python, missing from TS — now mirrored.
Verified: build green; vitest 36 files / 279 tests EXIT=0; playwright
12/12; dump-schemas.py runs clean.
