WORKING PROTOTYPE

The decision console, wired.

Five destinations, all navigable — pick a destination in the app bar, then a page in the row beneath it. Filter and sort the inbox, open a record, approve it. The read-state switcher under the table forces every honest state the real BFF can return, so you can see what the operator sees when a service is down.

Console

System states

Component contract

3.5

L0 · Stage 3 recommend-only

DEL floor 80.0

Writebacks off mycocoons · approver

        {{ table.source }}
        {{ table.trace }}
      

{{ table.noteTag }} {{ table.note }}

{{ panels.noteTag }} {{ panels.note }}

QUEUE

DOMAIN

GATE REASON

SORT

live

/api/bff/approvals/pending · polled 60s · trace 4f2a-90bd-11e7

Bulk approval is deliberately unavailable — each authorization binds to one action and redeems once, so a single click cannot cover four of them.

PROPOSED ACTION

DEL

VALUE

WHY IT STOPPED

AGE

EVIDENCE

{{ row.meta }}

{{ row.value }}

{{ row.age }}

Nothing matches these filters.

The read succeeded — this is an empty result, not a failure. An empty queue on "needs you" is the healthy end state, so it never renders as an error.

READING /api/bff/approvals/pending

Skeletons carry no numbers. A placeholder digit that lands wrong is worse than a blank row.

Live queue unavailable (tenant_required)

No verified tenant on this session. The queue is tenant-scoped and the tenant comes only from an authenticated session — auth enforcement is not active in this deployment, so the read refuses rather than guessing a tenant.

trace 8b31-4f00-2c9d

[not-wired] the illustrative walkthrough queue renders only in DEMO_MODE. In this state the operator sees the reason and nothing that could be mistaken for their data.

Read failed (502 upstream_error)

service-approval-routing refused the read. This is the only state that renders in red — a missing wire and a broken wire are different problems and must not look the same.

trace c07d-1a44-9fe2 · retried 2×

The latest refresh failed — showing the last successful read

Data below may be stale. The rows and the warning render together; what never happens is live rows sitting beside illustrative ones.

PROPOSED ACTION

DEL

VALUE

WHY IT STOPPED

AGE

EVIDENCE

{{ row.meta }}

{{ row.value }}

{{ row.age }}

FORCE READ STATE

Design control, not a product feature — the real states come from the BFF.

{{ rec.meta }}

GOVERNED PATHWAY

{{ step.trace }}

YOUR GATE

Approve

Reject

Binds your verified identity as the named approver. Role and tenant-queue membership are re-checked server-side on the call — the actor is never request input.

                {{ line.text }}

              

WHY THE PLATFORM BELIEVES THIS

DEL score composition

            {{ fx.text }}

          

Loop

Seven phases, one view. The five separate SRPVDAL pages in the current app collapse to this, and the gaps are drawn in rather than filled.

SENSE → LEARN

Acquisition — every source, with its real state

The canonical gate

One governed receiver per provider. A second gate is never the answer.

Consent fails closed: absent consent drops the event and counts it. EU and unknown regions are denied server-side.

available_to_model_at is set by first ingest and refused from callers. That bitemporal law is why lineage on a decision record can be trusted.

Synthetic data is quarantined to the training plane by construction, and the canonical leg refuses it categorically.

Person-touching backfills stay on the consent-gated doors. That is consent parity by construction, not by policy.

Governance

The audit surface. Claim labels, flag posture, the autonomy ladder, and a ledger that has to be provably intact for any of it to mean anything.

chain intact

Capability status — the declared table, probed

Drift register: none — every probed flag matches its declared status.

Flag posture

Each literal is ast-pinned with a fail-if-flipped test. Flipping one in a console would be a lie about where authority lives.

Audit ledger

Sequence{{ ledgerSeq }}

Duplicateszero

Held under20 concurrent writers

Signing authority2 services

Autonomy ladder — certified per account × action class

Promotion gates: Brier ≤ 0.20 · AUC ≥ 0.72 · stable lift over 2 purchase cycles · the decision stays human

This tenant sits at L0. The ladder is drawn in full because the operator needs to see the distance, not just the rung.

Estate

Engineering only, behind one door and role-gated. Everything an operator never needs, kept somewhere they can still find it.

39 registered cells

Probes, read correctly

Registry keys healthy34 / 41

Governance services11 / 11 · 0 failures

Unauth on locked cell403 healthy

DATED 2026-07-22 · NOT A LIVE READ

Registry keys, not cells — 41 keys against 39 registered cells, and the registry says measure before quoting. The seven unhealthy keys are URL mismatches, one 503, and one cold start. Never HTTP-probe a locked-ingress service and call the refusal an outage.

Model registry

Every call routes through virtuoso_call. Model strings are governed by the registry, never hardcoded at a call site.

Known, and stated

The UI has no CI type gate — build errors are ignored by config and held against a local baseline.

The service registry still reads designed for cells 33–36 and has no row for 37. The Cell Registry outranks it.

Cells 3 and 26 each map one number to two services. A plan naming a free number is evidence the plan is old.

System states

The four screens an operator hits when something is wrong with their session rather than with the platform. Each one names the reason and offers exactly one way forward.

{{ st.trace }}

Component contract

Six primitives exist in the repo today and carry the honesty discipline. Five more are proposed by the screens above. The rule that makes the contract work: a page composes primitives and never renders a raw fetch result itself.

COMPOSED FROM THE DESIGN SYSTEM, NOT REBUILT

Wordmark · Icon · Button · Badge
The chrome mark, the nav and queue icons, every tab and chip, and the live badge all mount the bound bundle. The surface runs on theme-intel, so the mark's accent resolves to cyan from the tokens rather than a literal.

One gap worth filing. The DS Badge ships three tones — neutral, live, cyan. This console needs warn and error, which is exactly the tri-state the honesty discipline runs on. Until they exist, the amber and red pills here are local, and that is a design-system request rather than a licence to hand-roll.

SHIPPED IN THE APP — KEEP THE API, WIDEN THE USE

{{ c.name }}

{{ c.props }}

PROPOSED — WHAT THESE SCREENS NEED NEXT

{{ c.name }}

{{ c.props }}

The four states, and who owns them

LIVEthe BFF answered — the page renders data and a trace id

UNAVAILABLEthe BFF classified a reason — the page renders the reason verbatim

ERRORunexpected failure — the only red state, always with a trace

[not-wired]no read API exists — the author states the gap, not the component

Banned by the contract

A number without a source and a freshness label.

Live rows rendered beside illustrative rows — the exact state-blending the approvals page was patched to prevent.

A zero standing in for an unavailable read.

A mutation button enabled before whoami confirms the role.

Bulk actions over anything that mints a single-use authorization.