Command Center Transformation Plan

Program: MIZ OKI Command Center — State-of-the-Art Frontend Transformation Charter: Master implementation prompt v1.0 (owner-supplied, 2026-08-05) Target package: miz-oki-command-center-ui/ Started: 2026-08-05 (Phase 0A) Last updated: 2026-08-29 — phase table and standing risks re-measured against the tree; console consolidation recorded (§3.1). The 2026-08-05 figures below are kept where they are historical measurements; where a risk has since closed, the row says so and names what closed it. Execution mode: multi-session program; verification-first; each phase gated Session branch: claude/miz-oki-command-center-ui-pacu82 (harness-designated; historical — the program has since run across many sessions and branches)

Per-item status lives in FRONTEND_MIGRATION_LEDGER.md, which is the finer-grained record. This file carries the macro-phase view; where the two disagree, the ledger wins and this table is the defect to fix.

1. Mission

Transform miz-oki-command-center-ui/ into the authoritative operator product for the governed MIZ OKI 3.5 platform. The product makes the platform's decision pathway operable, explainable, secure, testable, and trustworthy:

Evidence → Canonical Event Envelope → Temporal-Causal KG → Domain Reasoning
→ Scenario/Forecast/Counterfactual → Validation Passport → Decision Eligibility
→ Human Approval or Authorized Action → Outcome → Learning → Audit Replay

Canonical loop: SENSE → REASON → PLAN → VALIDATE → DECIDE → ACT → LEARN (SRPVDAL, seven-phase, authoritative).

The marketing site (# MIZ OKI 3.5/, mizoki3.com — design-canon LOCKED, human-approval deploys only) remains the narrative product. The Command Center is the operator product. The two share one backend; the console is an Operator Dossier, not a clone of the marketing dossier.

2. Non-negotiables (inherited from charter + repo authority docs)

• Browser never mints GCP identity tokens; all Cloud Run calls go through allowlisted same-origin route handlers using the lib/service-auth.ts OIDC pattern (audience = service ORIGIN; strict-mode fails loudly).
• No UI path bypasses Validation Passport → DCP → Approval → single-use ActionAuthorization → Action Runner. Stage 3 recommend-only is the default; the frontend never elevates autonomy.
• Intent/ORACLE is advisory evidence only; activation = registered holdout → uplift_export_cohort → guardrails → DCP. No audio-derived intent, ever.
• No direct vendor LLM calls from the frontend; AI work routes through Boss/Virtuoso.
• Truth discipline: built, pre-benchmark / advisory-only labels; every performance number carries exactly one evidence label (verified result / benchmark result / pilot result / design target / illustrative scenario). Mock data is never presented as live.
• No canon-pinned # MIZ OKI 3.5/ file is edited without explicit specific human approval. No deploys, workflow dispatches, or PRs without explicit owner instruction.
• No weakening of TypeScript/lint/tests/auth to pass gates; no destructive git operations; additive migration with redirects and flags, never rewrite-and-cutover.

3. Macro-phase map and gate status

Delivery follows the charter's 8-PR slice sequence (Foundation → Shell/auth → BFF/contracts → Governed Command Center → Domains/Intent/cells → Boss consolidation → Design/a11y/perf → Strictness/cleanup).

3.1 Console consolidation — the five destinations (2026-08-28/29)

The phase ladder above was authored against a package with six competing home pages. That is no longer the shape of the product. The consolidation shipped in five reviewed PRs and is serving:

The five destinations live under the app/(console)/ route group — the package's first and only route group — behind one ConsoleLayout carrying the destination nav and the posture bar. Serving revision at close of the arc: miz-oki-command-center-ui-00568-fd5 (deploy runs 33250550830, 33256476483). Terminal record: docs/reports/CONSOLE_DESTINATIONS_BUILD_2026-08-29.md.

/command-center is legacy. Six roots — /, /dashboard, /dashboard/modern, /command-center, /operate, /mizoki — now answer 307 → /decisions (next.config.mjs redirects(), kept in step with lib/console/destinations.ts RETIRED_ROOTS by lib/console/retired-roots.contract.test.ts). Only the competing roots redirect: /command-center/** children remain routable as deep links by design, so references to /command-center in this plan should be read as naming the legacy surface, not the destination. The successor surfaces are:

Fleet count. The registered fleet is 39 cells, not 36: the 36-cell Boss registry transcription (FLEET_REGISTRY) plus three additively-tracked Cloud Run services (cells 37–39: market-signal-ingest, cre-prospecting-core, cre-outreach-engine) carried under their own provenance in EXTENDED_FLEET_REGISTRY. TOTAL_REGISTERED_CELL_COUNT is the constant; the two tables are never blended, because they have different sources (docs/architecture/CELL_REGISTRY.md is the cell-number authority). Every "36" in this document that survives refers specifically to the Boss-registry transcription.

4. Program artifacts (this directory)

Outside this directory: docs/reports/CONSOLE_DESTINATIONS_BUILD_2026-08-29.md is the terminal record of the console consolidation arc (§3.1).

5. Standing risks the program must design around

Original measurement 2026-08-05; re-measured 2026-08-29. Each row keeps the original finding and states its current status. A closed row is kept, not deleted — it names the guard that keeps it closed, so a regression is legible.

1. npm ci is broken — package.json and package-lock.json were out of sync (missing aframe, three@0.184.0, three-bmfont-text, stats-gl, …; lockfile picomatch@2.3.2 vs required 4.0.5). Any CI relying on npm ci failed at install. CLOSED 2026-08-05 (Phase 0A.1, commit f37b40a) — lockfile regenerated under npm 12; swr and react-force-graph removed (0 imports each); npm ci exit 0. Held by the frontend-guard typecheck job, which runs npm ci on PRs and on main pushes.
2. Build escape hatches active — typescript.ignoreBuildErrors: true and eslint.ignoreDuringBuilds: true in next.config.mjs; strict: false in tsconfig; tsconfig include: **/*.ts swept the whole package. CLOSED 2026-08-06/07 (Phase 3H) — re-measured in-tree 2026-08-29: next.config.mjs carries ignoreDuringBuilds: false (line 130) and ignoreBuildErrors: false (line 133); tsconfig.json carries "strict": true. A regression here would make the build stop failing on type and lint errors, so treat any flip of these three literals as a gate removal, not a config tweak.
3. Zero tests — 0 test files in the package; no jest/vitest/playwright config; the test:* scripts were curl smoke calls. CLOSED — measured 2026-08-29: 149 test files; vitest run is npm test, Playwright drives test:e2e and test:a11y, and npm run verify chains lint → typecheck → test → build. Two curl smoke scripts (test:a2a, test:causal) survive under their own names and are not the test suite.
4. Auth effectively off — middleware.ts emptied protectedRoutes unless REQUIRE_AUTH=true; /dashboard and /boss sat in an ALWAYS-public allowlist (bypassing auth even when the flag was on); a legacy cookie fallback hardcoded userRole = 'engineer'. CLOSED IN CODE 2026-08-05…09 (Phase 1B) — deny-by-default policy core in lib/auth/route-guards.ts; /dashboard and /boss removed from the unconditional public list; the legacy trust-a-cookie branch deleted; roles read from app_metadata only, with absent claims UNPROVISIONED-and-denied. STILL GATED: middleware.ts:102 reads process.env.REQUIRE_AUTH === 'true', so enforcement in production remains an operator flip against real Supabase credentials — and per the 2026-08-09 measurement the legacy Firestore bridge is not a viable fallback (live rules deny sessions/{token} with 403). Build state is not enforcement state.
5. Scale — was 155 pages, 211 API routes, 260 components, 310 client-marked files, 68 hooks, 0 tests. Re-measured 2026-08-29: 173 pages, 278 API route handlers, 284 components, 149 test files, 7 layouts, 1 route group (app/(console)), 4 route-boundary files (error/global-error/loading/ not-found — all four were 0 at baseline). The package grew; the slice discipline that made it reviewable still applies.
6. Auto-merge automation — pushes to claude/* (and the other AI prefixes) land on main within seconds unless the protected-path gate refuses them. STILL TRUE, with one correction: the bot's -X theirs conflict resolution was retired 2026-08-24 — it now STOPS on conflict and files an [Auto-Merge Failed] issue instead of merging a wrong resolution. Docs-only commits under docs/frontend/** remain deploy-safe (no deploy-*.yml on.push.paths matches them); code commits under miz-oki-command-center-ui/** dispatch Deploy Command Center UI, so every such merge is a deploy decision.
7. Stale sibling docs — miz-oki-command-center-ui/CLAUDE.md described Next 14.2.32 / React 18 / Redux Toolkit against a package that was Next 15.5.21 / React 19 / Zustand+Query+SWR. CLOSED — re-measured 2026-08-29: that file now states Next.js 15.5.21, React 19, TypeScript 5.5.4, Zustand + TanStack Query, and Vitest 4, matching package.json (next@15.5.21, react@^19.0.0, zustand@^4.5.7, no @reduxjs/toolkit). swr was removed in 0A.1.

5.1 Findings carried forward from the 2026-08-29 re-measurement — all CLOSED or VERIFIED 2026-08-30

The heading kept its "open" wording for a day after every row below closed; each row carries its own closure evidence and none is open as of 2026-08-30.

• /service-health — CLOSED 2026-08-30 by retirement. It was 521 lines, zero network calls, and no NotWiredNote / illustrative / mock label anywhere in the file: the "PRODUCTION RISK" row of the 0A inventory, the last one open. Of the two admissible fixes — label, or retire — retire was taken. A label is the remedy for a fabricated section sitting BESIDE real reads (app/command-center/cells/page.tsx keeps its walkthrough that way, under a transcribed registry and measured probes). This page had no real read at all, so a banner would have left ~20 invented uptime figures, a fabricated critical alert, and a hardcoded log tail rendering below it; and the Zero-Mock Law's applied remedy for a wholly-fabricated surface is deletion of the fabrication — components/ui/section-label.tsx records that the illustrative-label primitive was itself removed once no fabricated section remained to label. What landed: the fabricated body is gone; the route stays reachable as a deep link and renders a retirement notice naming what was removed plus pointers to the surfaces that read; app/service-health/page.test.tsx pins it in both directions (7 tests — DOM assertions plus source-literal guards that fail if hardcoded rows, relative timestamps, uptime percentages, .a.run.app endpoints, useState/setInterval/Math.random, or an ungoverned fetch return; the guard was proven by seeding the regression and watching it fail); the service-health nav child was removed from config/navigation.ts, whose description "Real-time service monitoring" was the same unbacked claim; the stale /system-health docstring asserting this was "the actual dashboard" was corrected. Gates on the branch: tsc --noEmit 0, npm test 1096/1096 across 149 files, npm run lint 0 errors, npm run build exit 0. One correction to the successor claim carried in earlier notes: /estate is the Cells surface (the Estate index route); there is no /estate/cells. And /estate/** sits behind an operator/admin floor enforced server-side and fail-closed (app/(console)/estate/layout.tsx), so it is not reachable without a session-verified engineering role — the retirement page says so rather than implying a click-through. /system/health-dashboard (real probes via /api/system/health-all) is the health surface reachable without that role. Deployed and body-witnessed 2026-08-30. Landed 77ac7080 (the bot fast-forwarded main onto it, so there is no merge commit and no splice was possible); Frontend Guard re-ran the suite in CI green; deploy-ui run 33338507973 SUCCESS on that sha produced serving revision miz-oki-command-center-ui-00571-f65 at 100% (created 22:22:01Z inside that run's window; the run→revision pairing holds 1:1 across the four preceding deploys and no competing run existed in the window). This is deployed + serving-revision-confirmed, NOT production-body-verified. The production origin answers 307 → /login?from=%2Fservice-health, and the control route /decisions answers the identical shape — so an unauthenticated probe cannot distinguish this page from the mock it replaced; the unfixed image answers 307 there too, which is precisely the assertion rule 01 says not to accept. The body was witnessed instead by booting the production standalone bundle from a tree byte-identical to 77ac7080 (git diff empty on the route) with REQUIRE_AUTH=false locally: HTTP 200, the retirement banner, the [not-wired] note and all three pointers render, and the retired mock's strings (Neural Processor, 99.9, System Healthy, relative timestamps) return zero matches. Link targets probed on that boot: /estate 200 (rendering "Estate requires an engineering role" — the fail-closed gate, so the reachability caveat above is measured, not assumed), /estate/services 200, /system/health-dashboard 200, /system-health 200, and /estate/cells 404 — which is why the handoff's successor path was corrected rather than copied.
• app/[kernel] — CLOSED 2026-08-30, and the finding was half stale. The finding as carried read: "Any unmatched single-segment path is absorbed by it instead of 404ing… app/not-found.tsx now exists but cannot fire for single-segment paths while this route does." Re-measuring first changed the work, because that second sentence was not true on 2026-08-29: app/[kernel]/page.tsx has decided SERVER-side since 2026-08-08 (notFound() before the stream starts, so a real 404 status), test-pinned in app/[kernel]/page.test.tsx — unmatched single-segment paths DO 404 and not-found.tsx DOES fire. The genuine gap was one segment deeper: app/[kernel]/insights/page.tsx had no gate, so /<anything>/insights rendered a kernel header, a global nav strip and a RecommendationsCard for a kernel that does not exist, at HTTP 200. Both now gate on one exported list, app/[kernel]/known-kernels.ts — the seam that stops a kernel being added to one and not the other. The child was also migrated to Next 15 awaited params/searchParams; it had been destructuring them synchronously. Pinned by app/[kernel]/insights/page.test.tsx.
• Five test/scratch routes — CLOSED 2026-08-30 (gated, not deleted). /test-orchestration, /test-moa-integration, /causal-test, /kg-brain-test, /agent-ux now sit behind ENABLE_DEV_ROUTES (lib/dev-only-route.ts). Three properties are load-bearing: the gate is a SERVER component (a client notFound() throws after headers flush under streaming SSR and answers HTTP 200 — the defect the [kernel] gate was rewritten to fix), export const dynamic = 'force-dynamic' keeps the flag a per-request deploy value rather than baking the build machine's env into a prerendered 404, and the flag is fail-closed — only the exact string 'true' opens it ('TRUE', '1', 'yes', '', ' true' each asserted closed). Not deleted: Phase 2D non-goal 2 reserves permanent route removal for an owner decision, so the page bodies moved to sibling client modules. The gate's own test found work the grep missed — a first search of config/navigation.ts and app/** found two inbound links; the test's repo-wide walk found three more in components/. All five resolved: the /causal-test nav child removed (the operator surface for that capability is the existing causal-graphrag child) and app/boss/causal repointed there; BossNavigation's "MOA System" repointed at /services/orchestration (the documented canonical orchestration surface) with its duplicate "Orchestration" entry dropped; MIZOki30MOAMOEArchitecture's two "run the integration test" affordances and the now-actionless card holding one of them removed. lib/dev-only-route.test.ts fails if any live file links a gated route.
• /decisions/[id]/evidence — VERIFIED 2026-08-30, no change needed. It still fetches /api/boss/srpvdal/trace, which does not exist, and it is not broken: the page renders an honest "Trace read unavailable" state naming the missing route and stating explicitly that nothing shown below it is live evidence. app/decisions/[id]/evidence/page.test.tsx passes. The UI item is closed; the read gap itself stays open and is a backend item, not a UI one.

6. Definition of done

Per charter §6: one coherent operator story; single nav source; single Boss client/shell; single service-gateway pattern; strict TS with zero ignores; zero lint warnings; meaningful unit/integration/e2e/contract/a11y coverage; CI against the real package; WCAG 2.2 AA; visible freshness/source/claim labels everywhere; governance invariants intact (passport visible, approvals human-attributed, authorizations single-use, 501/hold/denial/timeout rendered honestly; audit replay reconstructs the pathway).