Close the deferred Vault item 4: a read-only endpoint proving a selected
vault entry is recallable by CORE's actual exact CGA machinery, surfaced
in the entry inspector.
Backend (read-only, cold-persisted only):
- GET /vault/entries/{index}/recall rehydrates the persisted VaultStore
(VaultStore.from_dict — bit-exact versors, no reprojection) and runs the
real VaultStore.recall using the entry's own stored versor as the query.
Exact cga_inner scan — never ANN / cosine / approximate.
- recall's +inf exact-self-match sentinel never crosses the boundary: the
genuine finite cga_inner is reported plus an exact_self_match flag. The
raw versor never leaves the engine — only content-addressed digests.
- Trust boundary: caller-controlled index -> 404 (out of range / non-int);
absent persisted snapshot -> 501. The file is never written; the live
runtime is never touched; recall is deterministic over persisted bytes.
Frontend:
- "Exact CGA Recall" inspector panel, collapsed by default so the read is
opt-in (the query hook only mounts on expand). Copy says "exact CGA
recall" / cga_inner — never similarity / relevance / score / ANN /
cosine. Honestly surfaces that a byte-identical self-match is promoted
ahead of metric ranking (CGA null-vector self inner-product ~0).
INV-24: register workbench/readers.py in VAULT_RECALL_SITES as
EVIDENCE_TELEMETRY (operator inspection evidence, not claim-shaping), and
tighten the recall-site detector to recognise VaultStore.from_dict factory
bindings so the obligation is real rather than silently bypassed.
Tests: backend 501/404/self-recall/determinism/no-mutation/JSON-safety +
API status codes; frontend collapsed-doctrine + expanded self-recall
evidence. Full workbench suite (192) + architectural invariants (61) +
vault-touching vitest (70) all green.
The /health endpoint was the only W-026 API route with no UI consumer.
Surface it as a liveness indicator (colored dot + label) in the status
footer, isolated from /runtime/status so a live server still reads
"Healthy" even when runtime status is degraded.
- types: HealthStatus matching the server's {"status":"ok"} payload
- client: fetchHealth() with a short 3s timeout for fast failure
- queries: useHealth() polling every 15s, retry disabled
- footer: HealthIndicator rendered in both normal and degraded branches;
any non-ok status fails safe to "Unhealthy"
- tests: healthy / errored / non-ok / checking / survives-runtime-failure
The L10 heartbeat (chat/always_on, #747) holds CORE alive over uptime but had no
surface. This adds the read-only Lived Life route that renders the continuous-life
evidence: the heartbeat over uptime + the resume-as-same-life verdict — both halves
of "one continuous life" on one surface.
Persist-first, never recompute engine-owned values:
- chat/always_on: serialize_report + write_lived_life persist a run deterministically
(sorted keys) to engine_state/lived_life.json; run_continuous gains an opt-in
report_path so a real continuous-life run leaves its evidence where the workbench
reads it. closure_ceiling is persisted so the artifact is self-describing.
- workbench/lived_life.py: projection + a fail-closed validate() gate — the wrong=0
analogue for the continuity surface: closure_held/closure_observed/totals/converged
are each re-checked against the per-beat measurements, and resume_status is re-checked
against identity-vs-current-substrate, so a tampered artifact RAISES rather than
rendering a false claim (a beat lying about a breached ceiling, an inflated closure,
a miscounted total, a falsely-claimed resume).
- workbench/readers.lived_life(): reads the artifact, computes the resume verdict from
the persisted identity vs the canonical engine_identity_for_config (fail-soft ->
"unknown", like IdentityContinuity). Honest absence when no run has been persisted.
- GET /lived-life + LivedLife/LivedLifeHeartbeat schemas (snapshot regenerated; the
schema-drift gate proves every field is mirrored in src/types/api.ts).
The resume verdict made felt: would_resume / substrate_changed / unknown IS the L11
reboot guarantee (a reboot recomputes identity and refuses if it differs) — so the
surface shows this life wakes up as ITSELF, not a copy. The per-reboot lineage chain
stays owned by Runs > Identity (honest cross-link).
Frontend: /lived-life route (Evidence section, route count 15 -> 16). Renders the
headline (heartbeats, closure-held-by-construction, learned-while-idle, at-rest, resume
pill), the summary, the heartbeat timeline (closure flat below the ceiling — read, never
repaired), and the resume verdict. Honest absence + ADR-0162 route conformance
(loading/error/empty), fail-closed like Vault/Calibration.
Tests (non-vacuous): 12 backend (every tamper case raises; resume tracks identity vs
substrate; run_continuous(report_path) round-trips a readable+valid artifact) + 4
frontend render tests (recorded life renders; a breached beat shows the warning, never a
false "held"; a changed substrate shows would-refuse, never a false resume; absent shows
honest absence). All workbench Python (167) + affected vitest (167) + tsc + vite build
green; architectural invariants green.
engine_state/lived_life.json is runtime state (gitignored, ADR-0146 pattern).
Read-only contents tabs over GET /logos/packs/{id}/contents:
- Lexicon (VirtualizedList + SearchInput + status/domain filters; dangling-link
flag cross-referenced from the safety report, never recomputed)
- Glosses (linked entry ids) and Morphology (operator chain rendered in schema
order — root/prefix/stem/suffix never re-sorted)
- three pack-scoped evidence subjects (logos_entry/gloss/morphology) with
logos_*:<packId>/<subId> address grammar, RightInspector projections, and
EvidenceChainRail derivations
- contents fetched eagerly on pack-select; /alignment stays deferred to LG-4
Full workbench-ui vitest: 506 passed, clean exit; build clean.
Read-only /logos frontend route (Wave M CORE-Logos read-only wave, LG-2):
- route registered via WORKBENCH_ROUTES + lazy ROUTE_ELEMENTS (Substrate section)
- Overview / Identity / Safety tabs over live /logos/packs, /{id}, /safety only
(no /contents or /alignment — those are LG-3 / LG-4)
- 10 Logos* TS interfaces mirrored; NOT_YET_MIRRORED shrunk back to empty
- SafetyVerdict UI badge + dump-enums.py source + enum-snapshot + coverage test
- logos_pack evidence subject (logos:<pack_id>) + round-trip
- bottom strip "proposal mode: none — read-only"; holonomy rendered as
missing_evidence (no tab, no proof card); invalid alignment targets surfaced
honestly in Safety; verdict never mapped to "clear" for warning/unknown
Depends on LG-1 (#737). No mutation endpoints, no engine math in the UI.
The "they'd want to use it" first-run surface: a curated narrative that makes
the engine's discipline legible to a newcomer — bring a claim from any model and
watch it get decided, refused, or replayed. Proposer authority ignored.
Honest by construction (the risk with a narrative surface is theater):
- workbench/tour.py determinism_tour() is a curated ordered narrative BOUND to
the real demo registry. Intro (provider-agnostic thesis) → three demo steps
(deductive entailment decides only on engine+oracle agreement; epistemic
truth-state refuses a wrong proposer; proof-carrying promotion ignores
proposer authority) → payoff (replay-to-same-hash + the citable evidence
bundle).
- Each demo step's what_this_proves / what_this_does_not_prove cards and the
demo title are PULLED FROM THE REAL DEMO SPEC — never re-authored — so the
tour can never claim more than the demo it points at.
- A step referencing a missing demo FAILS CLOSED (KeyError), not a dead link.
Tests assert both (cards == spec; phantom demo raises).
Backend: schemas.py DeterminismTour/TourStep; GET /tour. schema-snapshot regen.
Frontend: /tour route registered in the registry (Determinism section, 14
routes; nav/palette/guide counts updated); TourRoute — thesis hero + ordered
step cards with the honesty cards + links to the real demos / replay.
Validation: 140 workbench Python tests incl. tour drift guards; 472/472 frontend
incl. routes/routeConformance/routes.docs (guide↔registry), Shell+palette counts
(14), schemaDrift, and the tour UI test; pnpm build clean; git diff --check
clean. No serving-path imports.
The "they'd want to use it" deliverable: a turn's evidence exported as ONE
deterministic, content-addressed, citable artifact — composing the Phase-C
evidence (pipeline + field) with the trace and the calibration leeway verdict.
Backend (read-only, no engine execution):
- schemas.py: EvidenceBundle.
- workbench/evidence_bundle.py: build_evidence_bundle(entry) assembles a turn
journal entry into the bundle and computes bundle_digest. The digest
content-addresses the DETERMINISTIC cognitive evidence only — journal
position + wall-clock (turn_id, journal_digest, replay_reproducer,
generated_from) are carried for provenance but EXCLUDED, so the same turn
content reproduces the same digest regardless of journal position.
- api.py: GET /trace/{turn_id}/bundle. schema-snapshot.json regenerated.
The bundle carries a replay *reproducer* command (how to verify) rather than a
live-run replay, so the artifact itself stays deterministic — verification is
the consumer's step: re-run the prompt sealed, confirm trace_hash, recompute the
bundle, check the digest.
Frontend:
- types/api.ts EvidenceBundle; client/query hook; Trace route **Bundle** tab —
citable digest, "what this proves / does not prove" honesty note, the
reproducer, and a deterministic JSON download (Blob anchor, leak-safe).
Validation: 135 workbench Python tests incl. non-vacuous bundle guards (digest
reproducible, journal-position/wall-clock excluded, any evidence change flips
the digest, missing Phase-C evidence honest); 468/468 frontend incl. schemaDrift
+ the citable-download bundle test; pnpm build clean; git diff --check clean. No
serving-path imports.
Makes the CL(4,1) field geometry legible, honestly. The engine owns the field;
this surfaces ONLY the exact scalar invariants it computes — never the raw
multivector — so the workbench shows "this is the geometry, it's exact, it
can't fake coherence" without a decorative blob or any motion.
Persist-first (the C3 gating work was Python, not React): the honest scalars
were computed live per turn but discarded. Now captured per turn into the
journal so a read-only surface has real evidence.
Backend:
- workbench/field_evidence.py: FieldEvidence computed from the engine result —
exact versor_condition, field_valid (vs the 1e-6 ceiling), a content-
addressed field_digest (sha256 of the engine-canonical array bytes), and
cga_inner(before, after) as the exact transition value. Raw field bytes
never cross the boundary: only floats + digests. validate() is fail-closed —
field_valid can never disagree with versor_condition vs the ceiling (the
wrong=0 analogue for the geometry). No engine math re-implemented
(versor_condition / cga_inner imported from algebra; bytes via array_codec).
- workbench/schemas.py: FieldEvidence dataclass; field_evidence on
ChatTurnResult + TurnJournalEntrySchema. schema-snapshot.json regenerated.
- workbench/journal.py + api.py: persisted at from_chat_turn; first-class read
endpoint GET /trace/{turn_id}/field (trace facet, consistent with /pipeline).
- workbench/replay.py: field_evidence classified CRITICAL — replay now also
proves field determinism (digest + scalars must match on re-execution).
Frontend:
- types/api.ts FieldEvidence + field_evidence passthrough; client/query hook;
FieldInvariantCard (measured value vs ceiling, cga_inner transition, digests;
honest missing_evidence; no blob, no motion); Trace route Field tab.
Honest-empty for pre-widening journal rows (missing_evidence). Deferred:
cross-turn field-coherence trends, session-level field persistence.
Validation: 138 workbench/practice Python tests (incl. non-vacuous field guards
+ replay field-determinism); 465/465 frontend incl. schemaDrift; pnpm build
clean; git diff --check clean. No generate.derivation / reliability_gate /
stream / field.propagate / vault.store imports.
Lands the Phase C "make cognition legible" slice plus Phase A residue, all
backend-reader-first over real engine data (no theater, read-only doctrine
intact, zero serving-path imports).
C1-a — Cognitive pipeline record (persistence-first, per #729 worthiness edit):
- workbench/pipeline_record.py: curated CognitivePipelineRecord over the real
CognitiveTurnResult (input → intent → proposition_graph → articulation_target
→ realizer → walk_telemetry → trace_hash). Raw field multivectors are
DELIBERATELY excluded; _assert_no_raw_field_payload recursively rejects raw
field keys, and validate_pipeline_record fails closed on missing/duplicate
stages, non-recorded status, or dangling edges — the UI can never receive a
partial record that claims to be complete.
- test_workbench_pipeline_record.py: non-vacuous guards — missing stage,
monkeypatched new required stage, and injected raw {"F": [...]} each raise.
C2-a — Contemplation as a process: /contemplation route over real persisted
contemplation/runs/*.json (glob reader; honest-empty when absent).
C4-a — Identity continuity (L10/L11): RunDetail.identity_continuity + Runs
Identity tab, sourced from the real core.engine_identity (engine_identity /
parent_engine_identity lineage relation, re-derived to verify).
Demo Theater: renders backend-owned proof-promotion + entailment DAGs.
Phase A residue: density preference wired end-to-end (settings → shell → tokens);
cross-route consistency touch-ups.
Infra: local API CORS now echoes only validated 127.0.0.1/localhost origins
(hostname-checked, not arbitrary reflection) so Vite fallback ports work.
Route chunk-split keeps the build warning-free.
Cleanup: corrected the stale ADR-0175 practice-lane assertions (build_report is
6 correct / 0 wrong / 44 refused after the current serving lane; wrong=0 held)
and the two registry-derived count tests (LeftNav + CommandPalette 12 → 13 for
the new Contemplation route).
Docs: runtime_contracts.md (pipeline-record contract), UI-UX-GUIDE,
api-contract-v1, data-shapes-v1, wave-M-worthiness, phase-a-residue-ledger.
Validation: 106 workbench/practice Python tests green (incl. wrong=0 lane +
pipeline-record fail-closed guards); 459/459 frontend; pnpm build clean;
git diff --check clean. No generate.derivation / reliability_gate / stream /
field.propagate / vault.store imports.
Consumes the B1 readers (#724). The route where you SEE 'the engine earns
the right to guess' (ADR-0175).
- list (failures-first, server-ordered): per class a reliability bar
(Wilson floor vs the PROPOSE/SERVE θ markers — a class earns the right
when its fill crosses the marker), correct/refused/wrong counts (wrong in
the contradicted token), and a verdict pill (earned SERVE / earned
PROPOSE / not yet licensed)
- serving strip: the discipline's RESULT — live correct/refused/wrong per
lane, wrong=0 in the verified token, with source DigestBadges
- detail (Panel + TabBar): Counts / License math / Raw. The License-math
tab shows the honest derivation (measured ≥ θ → licensed) and states
the numbers come from core.reliability_gate, not the workbench
- fail-closed: an empty/absent arena ledger (501 evidence_unavailable)
renders the honest absence card pointing at the practice lane, not an
error
- nav entry (12th) + routeConformance row + Shell nav assertion updated
Token-only (hexScan green); VirtualizedList + j/k; full vitest 398 green.
First R3 (Theater) piece. Reworks the stale artifact-keyed ReplayRoute into
the turn-keyed hero over the #716 sealed-replay backend, and fully retires
the dead W-026 artifact-keyed machinery on both sides (the NOT_YET_MIRRORED
comment anticipated this).
The hero makes determinism *felt*: pick a journaled turn, CORE re-executes
its prompt in a sealed fresh runtime, and the result renders as a hash
verdict (≡ equivalent / ≠ diverged) + the original/replay DigestBadges + a
leaf diff (critical weighted above informational, each with a ≠ glyph). The
'What this proves' card surfaces comparison_basis + origin_state and states
the honest limit: a divergence means nondeterminism OR origin-state
influence, never rendered on its own as a determinism failure.
Retirement (verified zero serving uses):
- Python schemas.py: removed ReplayComparison/ReplayDivergence/ReplayStatus/
ReplayDivergenceSeverity; scripts/dump-enums.py drops the two replay enums;
both snapshots regenerated (deterministic: dump == committed)
- TS: removed ReplayComparison/ReplayDivergence/ReplayDivergenceSeverity;
added TurnReplayComparison/TurnReplayDivergence (+ basis/origin/severity
unions); NOT_YET_MIRRORED now empty (every engine schema mirrored)
- badges: removed ReplayStatusBadge + ReplayDivergenceSeverityBadge +
meta/enums + their enumCoverage cases (hero renders severity inline)
- api: fetchReplayComparison/useReplayComparison -> fetchTurnReplay/
useTurnReplay (/replay/<turnId>)
- deleted ArtifactList, ReplayComparisonPanel, ReplayDiffViewer,
ReplayMetadataTable, old replay.test.tsx
- App route /replay/:artifactId? -> /replay/:turnId?; conformance row
turn-keyed (loading 'Loading turns...', empty 'No turns recorded yet.')
Tests: ReplayRoute.test.tsx (equivalence hero + honesty card, diverged
critical leaf, informational-only label, replace-mode select, j/k spine).
Full vitest 358 green; workbench Python 34 green; both snapshots deterministic.
Follow-up flagged (not in this PR to keep it focused): the artifact query
hooks (useArtifacts/useArtifactDetail/fetchArtifacts*) are now orphaned but
entangled with the still-live artifact EvidenceSubject kind — a separate
cleanup once an Artifacts route or that subject's fate is decided.
Brief: docs/handoff/wave-R3-briefs-2026-06-13.md (all four R3 pieces).
Replaces VaultRoutePlaceholder with the real route over the R2-B
/vault read substrate (#712).
- TS mirrors VaultSummary/VaultEntry; both removed from NOT_YET_MIRRORED.
Also fixes a latent ErrorCode drift: adds 'evidence_unavailable' to the
TS union (present in Python schemas, missing in TS) — the route branches
on it.
- fail-closed is the design: a missing/unpersisted vault (the 501
evidence_unavailable signal, or persisted=false / entry_count=0) renders
the honest absence card as the PRIMARY state, naming the opt-in
RuntimeConfig.persist_session_state pointer — not a generic error, no
skeleton theater
- with data: summary strip (entry_count, store_count, reproject_interval,
max_entries, source_path) + VirtualizedList of entries with
epistemic_status / epistemic_state pills and versor_digest DigestBadge
- exact-recall doctrine: renders only backend fields; never computes or
displays a similarity/relevance proxy (runtime recall is exact cga_inner)
- selection publishes the vault_entry subject (inspect-param only, via
setSubject + setInspectorOpen; EvidenceUrlSync writes ?inspect=vault:N);
a URL-restored identity-only subject is hydrated once entries load
- Vault row added to routeConformance MOUNT_ROUTES — the fail-closed
absence asserted as the primary contract
- tests: fail-closed card (not error), summary+entries, no-similarity-score
doctrine, vault_entry subject publication, j/k spine
Token-only styling (hexScan green).
Replaces PacksRoutePlaceholder with the real triad route over the R2-B
/packs read substrate (#712).
- TS mirrors PackSource/PackSummary/PackDetail; PackSummary/PackDetail
removed from NOT_YET_MIRRORED (drift gate now enforces them)
- new design primitive TreeView (src/design/components/TreeView): a
deterministic, keyboard-driven JSON tree — object keys sorted, array
indices in order, no animation; ←/→ collapse/expand, ↑/↓ + j/k move,
Home/End jump, Enter toggles; registers its shortcuts only while focused
(KeyboardHelp never advertises tree controls when no tree is on screen)
- list pane: VirtualizedList + useListNavigation (j/k) + SearchInput; rows
show pack_id, source, version, language/modality, determinism_class pill
- detail pane: Panel + TabBar (Manifest / Checksums / Raw); Manifest renders
via TreeView; Checksums is the verify affordance — manifest_digest and
declared checksum as DigestBadges plus the per-field manifest checksums
table (the checksum-hashes-the-bytes-on-disk doctrine made visible); Raw
collapsed by default
- selection publishes the pack subject (R2-S), records /packs/<packId>
(replace), pushRecentItem on visit
- Packs row added to routeConformance MOUNT_ROUTES (loading 'Loading
packs...', error 'No packs mutation occurred.', empty 'No packs
discovered.' + core pack validate <path>)
- tests: TreeView (sorted/collapsed/expand/collapse/focus/click/empty) +
PacksRoute (list, replace-mode select + manifest tree, checksum verify
affordance, j/k spine)
Token-only styling (hexScan green).
Replaces the RunsRoutePlaceholder with the real triad route over the
R2-B /runs read substrate (#712).
- TS mirrors RunSource/RunSummary/RunTurnRef/RunDetail; all three classes
removed from NOT_YET_MIRRORED (drift gate now enforces them)
- list pane: VirtualizedList + useListNavigation (j/k) + SearchInput;
rows show source, session_id, turn_count, relative timestamp, a
checkpoint badge (present + revision vs 'no checkpoint'), and any
evidence_gap rendered honestly in-row (never hidden)
- detail pane: Panel + TabBar (Turns / Manifest / Raw); every turn row
is an anchor to /trace/<turn_id> (backend-provided trace_path) with the
trace_hash as a DigestBadge — the cross-link is the point of this route;
turn list pages via turn_limit ('Load more turns')
- selection publishes the run subject (R2-S) and records /runs/<sessionId>
in the URL (replace), pushRecentItem on visit
- Runs row added to routeConformance MOUNT_ROUTES (loading 'Loading
runs...', error 'No runs mutation occurred.', empty 'No runs recorded
yet.' + core chat)
- RunsRoute.test.tsx: list evidence, in-row gap, replace-mode URL select,
trace cross-link hrefs, manifest tab, j/k keyboard spine
Token-only styling (hexScan green); full vitest 339 green.
Full 'pnpm test' previously hung indefinitely (killed at CI walls,
misdiagnosed as teardown slowness). Two root causes found and fixed:
1. RightInspector.test.tsx called setSubject() during render with a fresh
object every pass -> infinite synchronous render loop (100% CPU spin,
blocks the event loop so no timeout can fire). Moved into useEffect.
2. Test QueryClients used retry:false but default gcTime (5 min) -> a live
GC timer per cached query kept workers from exiting. New shared
createTestQueryClient() with gcTime:0 adopted across all 7 test files.
Hardening so any future leak fails loudly instead of hanging:
- vite.config.ts: testTimeout/hookTimeout 10s, teardownTimeout 5s
- useManagedTimeout hook owns previously-bare setTimeouts in DigestBadge,
MetadataTable, RatificationCommandPanel (4 sites), CommandPalette focus
First-ever frontend CI lane (.github/workflows/workbench-ui.yml):
path-filtered to workbench-ui/** AND the workflow file itself,
pnpm install --frozen-lockfile + build + vitest, timeout-minutes 15.
Honesty fix: KeyboardHelp no longer advertises j/k, /, Enter (unbuilt
until R0d restores them registry-backed).
Route conformance test (ADR-0162 §6, executable): empty/error/loading
contracts asserted for Chat/Proposals/Evals/Replay; fixed the two gaps
it caught (ReplayRoute bare-div error branch -> ErrorState contract;
ArtifactList empty state gained a next action).
Result: 27 files / 181 tests pass, suite EXITS in 4.9s wall-clock
(was: indefinite hang).
