Audited 2026-09-07 against site/app-prototype.html, current cockpit/ui, cockpit/src/bots.rs, Ampd.Projection.operator/0, and Ampd.CommandSpec. The prototype is a simulated design reference. Its numbers and bot grants are not live app records. Existing local modifications were retained.
Use Super to develop Super: select its repository and workspace, create a goal, choose a persistent planning or implementation bot, delegate bounded development work, observe progress and blockers, review a real diff and validation results, accept or reject the change, and recover that same work after restart.
The app currently supports conversation and reviewed setup proposals. This pass improves that usable surface; the full development cycle still needs the runtime and editor work below. A worker assignment does not start coding.
| Priority | Prototype feature | Current gap and required implementation | Acceptance check |
|---|---|---|---|
| P0 | Bots / Nav / Runtime rails | Keep the five prototype Nav groups, add record counts and attention badges; keep the useful workspace/goal/repository destinations added since the prototype. | Counts follow selected workspace; global records are labeled; withdrawal clears counts. |
| P0 | Mission statistics and guidance | Add setup gaps, linked next steps, worker state distribution, and recent validation outcome chart from the accepted frame. | No fake totals or success from START records; empty windows show no data. |
| P0 | Persistent bot identities | Add named local profiles, role instructions, groups, directory, dedicated creation/editing and bot pages, and separate conversation storage. Runtime-owned identities remain a subsequent contract. | Same-provider bots retain separate drafts, files, and messages across switching/restart. |
| P0 | Bot creation | Name, role, group, instructions, provider; validation and visible save errors; open the created bot page. | No grant or execution is implied by creation. Failed storage preserves the form and previous roster. |
| P0 | Bot-specific model and context | Persist per-bot provider preferences and histories, deliver role instructions through all native adapters, preserve existing default assistant history. | Provider payload contains the chosen role and unchanged reviewed proposal tools. |
| P0 | Runtime bot registry and observation | Define durable actor-bound bot identity, lifetime, workspace membership, operator inspection, and an actor-scoped bot projection. UI profile data must not serve as that authority. | Restart restores identity; bot cannot observe records outside its grants; operator view remains distinct. |
| P0 | Real delegation | Add ordered parent→child grant derivation across resource, duration, workspace, run, placement, budget and policy; atomic recursive revocation; durable delegation receipts and UI relationship pages. | Each widened dimension refuses independently; parent revocation invalidates descendants in the same operation; no local UI delegate array serves as authority. |
| P0 | Development execution | Connect bot planning to a bounded Carrier/worker execution loop with explicit admission, cancellation, tool policy, results and restart recovery. Preserve reviewed submission controls until that contract exists. | A Super task produces an actual isolated repository change and terminal outcome; retries cannot repeat accepted effects. |
| P0 | Editor and change review | Real file tree/read/edit, selected repository identity, isolated worktree, diff review, validation launch/results, accept/reject operation. | User can review exactly the changed bytes and their validation basis before accepting. |
| P0 | Evidence navigation | Existing three recent windows are real; add paged continuity-aware native reads, filtering, source/basis links and compare views. | Older evidence loads with preserved provenance; old records are never relabeled as current. |
| P0 | Actionable flags throughout work | Expand directory summaries into record-level goal/lane/worker blockers and clear actions; add consistent error, empty, unavailable and stale states. | Every actionable flag opens its actual record or operation; no heuristic “healthy” badge. |
| P0 | End-to-end dogfood and recovery | Test complete Super-on-Super loop, including provider failure, cancellation, worker interruption and restart. | Real diff, real validation evidence and explicit acceptance recorded; saved-world data preserved. |
| P1 | Goal proof stages | Add spec / in-tree / live-local / deployed / external badges bound to evidence for each goal, plus measured certification streaks and run identity. | Each stage opens supporting records; absent proof stays unknown. |
| P1 | Lane comparison and promotion | Add side-by-side lane diffs, independent budgets, supervision controls and winner promotion with merge obligations. | Promotion cannot bypass outstanding obligations or gates for the chosen basis. |
| P1 | Frozen inspector | Current record pages show current records and Activity shows local submissions. Add a distinct immutable invocation snapshot inspector with entry identity and citations. | Live updates cannot change the snapshot that justified a decision. |
| P1 | Editor attribution | Add agent gutters, changed-region claims and line-anchored conversations linked to evidence. | Each attribution identifies the actual author and source revision. |
| P1 | Bot board / citations | Implement the prototype's actor-scoped bot board and coherent frame-bound claims, observed-object validation and per-claim freshness. | Refuse unobserved citations; retain historical evidence without describing it as current. |
| P1 | Agents and supervision | Existing connected peers are not the prototype's full agents. Add identity/harness links, liveness/heartbeats, child supervision and restart telemetry. | Engine restart preserves bot identity/history and updates actual process state. |
| P1 | Capability catalogue and upgrades | Existing grants/requests/consent work. Add installed/discover catalogue, capability surface comparison, held upgrades and gateway status. | Widened upgrade is held and differences are reviewable. |
| P1 | Gates and replay | Add measured gate producer, source/run identity, replay and outcome history. | Gate green refers to tested bytes and measured gate results. |
| P1 | Rulings / obligations | Add durable obligation deadlines, due/overdue state, ruling history and linked work. | Due counts derive from real deadlines; completing a ruling updates its evidence. |
| P1 | Routines | Add scheduling, trigger and execution contracts, history, enable/disable and failure handling. | Restart does not duplicate a scheduled run. |
| P1 | Authority & budgets | Add real usage metering, budget limits and enforcement, with scoped summaries and refusal links. | Usage reflects measured events; exceeding a limit refuses work. |
| P2 | Fleet / placement | Add inventory, enrollment, presence, lane movement, placement constraints and measured utilization/cost, with citable eligibility derived from capability, budget and source-data policy. | Placement and capacity charts come from actual nodes. |
| P2 | Extended attachments/settings | Images/PDF ingestion, project restoration/export, retention controls, sandbox and network-policy visibility, selective encrypted sync/restore, and complete provider settings. | Supported content reaches the intended provider; unsupported content fails visibly. |
Implemented the first five rows' conversational/UI scope and added directory summary statistics. Profiles and groups are local presentation records. Bot pages explicitly identify the runtime delegation gap. This pass does not expose a fake Delegate button, fabricate agent activity, or turn profiles into runtime actors.
No runtime stores, grants, command allowlists, or authority rules were modified. Graphonomous tools were not available in this session; the existing task notes, repository instructions and current source supplied continuity.
Define and implement actor-bound bots and scoped observation projections.
Implement and verify durable capability delegation and revocation semantics.
Connect bounded execution to repository worktrees and real diff review.
Finish record-level flags, evidence paging, cancellation and recovery UX.
Perform the full Super-on-Super acceptance workflow with a real provider.
Validation results for the present UI pass are recorded in the delivery report.
Implemented explicit workspace registration, versioned profile editing and guarded removal through the ordered runtime. The directory now has actor-bound bot records in the existing loci store, with own-identity visibility on the existing agent projection. Native bot pages reflect confirming frames and retain local histories. Store restart and complete process restart preserve identity without adding grants.
The registry portion of the first remaining stage is complete. Actor-authenticated execution and the prototype's full scoped-observation/citation contract remain open. The next stage is real parent/child delegation, followed by bounded coding execution and diff review. Keep Bots for individuals; reserve Swarms for that coordinated team workflow. See the runtime contract.
Added the two requested Nav destinations beneath Editor and connected the manual local development loop: native repository selection, folder browsing, text editing and saving with conflict checks, real command execution with bounded output and process-group stopping, and an isolated local-browser preview. Linux preview layout uses an overlay so the browser remains inside its page without shrinking the cockpit.
This completes the manual inspect/edit/run/preview tools. It does not complete the P0 worktree/diff-review stage or give bots execution authority. The remaining MVP sequence above still applies to the autonomous runtime workflow. The next connection must tie registered bot actors and delegated work to worktrees, validation evidence, and reviewed changes. See the tool contract.
Verified: 18 native development-flow checks, 90 existing native app checks, 24 Rust tests (one unrelated desktop attachment test ignored), 18 JavaScript tests, and 35 WebView ACL checks. Release build and whitespace checks passed.
The development pages now use flat, full-height panels with file, interactive PTY and native browser tabs. CodeMirror provides real syntax highlighting and editor controls. Local shells survive navigation, and runtime workers with PRESENT terminals can be selected for the existing read-only watch transport. Explicit bot attachments link back to a file, shell, watched worker or browser tab. Window edges initiate native resize; Linux browser layout releases the main view minimum so active previews can shrink with the window.
Remaining P0 execution work: register agent-owned sessions with stable IDs and bot/lane/workspace ownership; connect admitted coding operations and cancellation; restore or clearly terminate ownership on restart; deliver execution and review results. Swarm delegation should share this registry, rather than discovering arbitrary processes or inventing browser/terminal ownership. See LOCAL_DEVELOPMENT.md.
Added read-only Git changes in Editor, record section tabs and scoped setup flags and worker-state bars. Reduced repeated session-control rebuilding and shell-output copying. The rich landing page still has measured WebKit painting lag; pausing its animation alone does not fix scrolling. The next P0 work is shared agent session ownership, delegation, bounded coding, revision-bound validation/acceptance and restart recovery. See the second-pass audit for implementation details, limits, priorities and current test results.
Implemented device-local file-tab and draft recovery, explicit browser-address restoration, ended-shell notices, recovery-copy management and patch snapshots attached to bot conversations. Draft recovery preserves native conflict detection and does not reopen repository access or execute commands automatically. See the recovery contract. This closes part of manual workbench continuity; agent-owned execution, Swarm delegation and revision-bound validation/acceptance remain open.
Conversation/Work tabs now show bot-owned lanes and workers, terminal availability, and real setup/detail actions. The complete bot → lane → worker path exposed and fixed a shared text-field prefill bug. Repository registration now follows the working native development chooser pattern. See BOT_WORK_PAGES_2026_09_07.md for scope and verification. Durable agent sessions, delegation, coding admission, cancellation and recovery remain open.
Native human-operated shells and browser tabs can now be linked to bot Work pages, reopened without recreating them, and preserved across main-page reload. Typed single-file provider proposals can be compared in Editor, staged as unsaved drafts and explicitly saved with disk-conflict protection. The isolated native provider-to-preview flow is verified; a real signed-in-provider dogfooding request is waiting on automatic approval review of its exact source payload/destination. See SHARED_SESSIONS_AND_CODE_REVIEW_2026_09_07.md. Swarm delegation and actor-authenticated execution remain separate open runtime work.