[schickling-assistant]

Problem

Client control v1 needs a web test client: it receives device commands, signs results with its own device key, shows an indicator with revoke, and passes one journey that an independent DOM check verifies. The web app has none of this.

Change (generated-contract source integration; test mode stays disabled)

• A non-extractable WebCrypto P-256 identity, stored atomically in IndexedDB, that signs supplied bytes.
• Read-only secondary identity evidence: opens the identity database without upgrade, aborts creation, reads only the existing record and exports the public SEC1 point. Daemon enrollment/signature verification remains primary; local pairing id is unavailable. E3 excludes exactly identity DB/store/key, fractal_device, fractal_pair, and wf.c/session.person; profiles are not reset per journey.
• The foreground policy: the document is visible AND the window has focus.
• A typed navigation interface for NowRoot and the grant-bound native Attention ask only. URL construction is delegated to the workspace subject model; nongranted screens and answer/close/read verbs are refused without navigation or signing.
• A future read-advancement gate at the store boundary. The read-position store is absent on this main base and is not used by native ask detail. Gate integration must accompany any later writer; the read-position group is not a blocker for this ask-only journey.
• A run-id indicator with an enrollment-revoke control (pending and failed states).
• A strict guard that accepts only an approved loopback origin and a fixture client socket.
• An independent DOM observer for the native ask journey: exact single-leaf title/question text, lowercase SHA-256 of exact UTF-8 question bytes, catalog checks, and evidence with the exact commit and origin. Shipped AnswerAlert render-path assertions are included; no test-only renderer.
• D-5 integration assertions use real DataSourceProvider -> LiveAgentAlerts -> AnswerAlert with recording source answer ports (no data-hook mocks). Across the whole inspect/navigation/refusal sequence, including wrong-item and mutation verbs, both port logs remain empty and shipped choice/decision-words controls stay present with no activation/submit events. The real-browser guard separately rejects/counts /v1/client/actions attempts (fixtureNoAnswerGuard.ts:25-36). Exact useAlertAnswers coverage is tied to 37083821b6 and is added when that group lands; that hook does not exist on this main base.
• Contains signed no-ff merges of Define canonical client command result contract #6274 through corrected regenerated head 972b65b7c4 (source 5613f107). The latest merge fixes generated WebCrypto ArrayBuffer handling and the scenarios lifecycle fold. Generated schemas/helpers alone own protocol decoding and canonical bytes/JCS; no generated artifacts hand-edited.
• Shared-file conformance assertions import fixtures/clients/client-control-v1.golden.json: both positive vectors, all 20 negative bindings, native Attention, exact JCS/digest/signing bytes, fixed-key verification and message/result domain refusal. Real WebCrypto identity signing/result-envelope checks cover both bindings. Optional item_id present/absent, delivered Attention and receipt schema roundtrips are examples, not golden bytes: the published file has no grant/command/envelope/receipt/fingerprint vectors. No published web-relevant vector is skipped. Tests NOT RUN.
• Generated lifecycle consumption now strictly decodes started/ended/revoked resources on existing commands snapshot/changes frames, verifies grant/run/device/session/item bindings against current host authority, and preserves permanent terminal grants. Handler requires active lifecycle AND the command's own control_grant; unknown/malformed input cannot end a run, revoke enrollment, navigate or sign. Authenticated app subscription/controller wiring remains disabled.
• CM review fixes: all command/grant/binding/result/receipt inputs now use generated strict decoding; null/extra navigation parameters and unknown keys are refused. Malformed/empty/wrong-length/noncanonical signatures return false, while programmer key/algorithm errors propagate. Regression tests include handler no-navigation/no-sign assertions and real-WebCrypto malformed-signature cases; NOT RUN.
• CM Unicode fix now consumes generated ClientResultCanonicalizationError, checking class and code === 'invalid-unicode'; the message-string match is removed entirely. Each lone high/low surrogate regression asserts the generated typed rejection and verification returning false. Other errors propagate, valid astral-pair signature coverage remains, and no second Unicode validator is added. NOT RUN.
• Lifecycle conformance reads every shared lifecycle resource/frame/trace. The corrected sequence-0 vector now expects refuse-invalid-frame; the web test treats it as an ordinary schema-invalid negative (decoder throws, gate refuses), with no resource-id/sequence exception or mismatch allowance.
• Observer and result tests consume generated injectable/default SHA-256; the observer still hashes exact question UTF-8 independently. Identity has no existing fingerprint-hash path to replace; SEC1 readback remains unchanged.

No app entrypoint and no normal pairing path changes. Nothing can turn test mode on yet.

Dependencies (contains the #6274 merge)

• Define canonical client command result contract #6274 contracts are merged through regenerated head 972b65b7c4; PR base stays main, so until Define canonical client command result contract #6274 lands this diff includes upstream generated files. Read-only inspection confirms ClientControlSha256 still accepts plain Uint8Array and returns Promise<Uint8Array>; observer injection and shared-vector tests remain compatible without web changes. No generated files were hand-edited; tests read both shared vector files directly.
• Remaining authoritative enrollment readback/controller, real authenticated subscription hookup, grant session/key/window/budget admission, live revoke confirmation, result verification/durable receipts and approved fixture setup. Generated lifecycle decoding/gating is no longer a missing-type dependency; none of these modules alone enables a normal pairing.
• KEEP cac380ac98 and df082cd9e8: Inbox /w/inbox and native ask /w/inbox/<id> routing (workspace/subject.ts:81-82,140, workspace/surfaces.tsx:121-128 in integration head ff956ae72b).
• KEEP native decision-card/detail group 37083821b6: web/AlertDetailsPane.tsx:39-45,78-81 reads the attention feed/answer state and renders AnswerAlert. Reconcile the shipped-renderer markers/tests when this group lands.
• DROP independent blockers 349b0da2aa (kit migration) and 5a107113bd (split panes): no client-control kit-store or split-pane API is required. The selected host may bring them transitively.
• DROP current journey blockers 9e66194639, 0d21c1286b, 45710bb1d5 and feat: sync conversation read positions across devices and mark unread from prose #6108: native ask detail does not invoke prose read-position hooks (web/AlertDetailsPane.tsx:37-60; shared attention-only resources workspace/registry.ts:89-90). The README records each decision and the future store-boundary suppression requirement.

apps/fractal-web/src/client-control/README.md lists the mapping, the module APIs and the open contracts.

Evidence

#6278 stays DRAFT. Readiness requires focused LOCAL tests plus the real web package typecheck at the exact candidate head under an approved gate-slot ticket, and independent exact-head review. Hosted CI is regression only, never a source-ready signal. The owner's official generated TS tests passing at the generated head do not prove web integration. The prepared local script uses nix develop .#web, saves all logs and records each exit status; it has NOT RUN.

Prepared candidate: f3e8721526a7e950cc73d3de8c7a1039b522f583. Latest delta: signed merge f3e8721526a7e950cc73d3de8c7a1039b522f583 of corrected regenerated head 972b65b7c4; no web signature adaptations required. Local-check script (external task artifact, NOT RUN): /Users/schickling/tmp/fractal-web-3/cc/ccweb-local-checks.sh. Transfer to the approved local runner and invoke with absolute checkout, full candidate SHA and an evidence directory outside the checkout. The script uses the CI web shell, records every check's exit status, preserves logs/diffs and performs no cleanup.

Hosted CI on this PR checks only that the source does not regress. It is not journey proof.

Journey acceptance is a separate local run: exact candidate commit, Playwright and the independent DOM check against the approved fixture-only daemon instance, after authorized setup/bootstrap/enrollment, with signed durable evidence. Journey = NowRoot -> Attention for the grant-bound ask -> inspect. The question is client-control fixture 0001; the title comes from the fixture manifest. E1-E3 require initially unseen, open and unmutated state, with no profile reset per journey. Use the dedicated isolated profile/context and never activate answer controls.

NOT RUN: all builds, typechecks, tests, lint, format, Storybook and Playwright. No live setup, pairing, enrollment or grant took place.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fractal-web-3
session	01a10965
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	fractal/2026-11-07-web-app-improvements

[schickling-assistant]

Compounding Manager: exact-head review of 04028d7c6325200beb24f5a5353c212ba2ef1aad. Cross-family: OpenAI reviewer, Claude author. Scope: cc07999288..04028d7c (the #6274 generated merge was not reviewed).

NO-GO: two P2 findings.

• P2, apps/fractal-web/src/client-control/wire.ts:10: command decoding must be strict. decodeCommand uses Effect's default tolerant decoding, but the generated schema support offers strict decoding (onExcessProperty: 'error', null optional values rejected). A delivered phone.navigate with args { screen: 'NowRoot', params: null } or args { screen: 'NowRoot', unexpected: 'value' } is normalized into an allowed navigation and can navigate and sign instead of returning Refused. This is not fail-closed. Fix: use Wire.decodeUnknownSync(Wire.DeviceCommand, 'strict'), and strict decoding at the other security-boundary wire inputs. Add refusal cases for unknown properties and for null forbidden parameters.
• P2, wire.ts:45-49: a malformed signature must refuse, not throw. Only binding decoding is caught. With a valid binding and an invalid base64 signature such as '!', fromBase64url throws from atob, so verifyClientResultBinding rejects instead of resolving false, as its contract promises. Fix: catch signature decode and verify failures and return false. Add a regression case with a malformed encoded signature.

Checked, with no findings:

• wire.ts reuses the generated types and codecs; there is no second canonicalizer.
• grantBoundary allows only inspect and NowRoot/bound-Attention navigation. It refuses answer, close and read verbs and a mismatched device, grant or run, and it rechecks authority and foreground after navigation.
• The D-5 test mounts the real provider, controller and answer controls. It records the actual source-port calls, asserts Applied versus Refused, and checks empty logs and events after every command, so it does not pass vacuously. Limit: navigation updates only a test-local target, so the test does not prove real application routing.
• The identity reader is unchanged and read-only: readonly transactions, database creation aborted, and only the public key exported.
• The golden tests import the repository-generated vectors and all negative bindings. They compare canonical JSON, digest and signing text exactly, and they verify the signatures. Minor: the canonical-byte assertion compares through TextDecoder, not byte arrays.
• Application activation stays disabled: no production import was found.

NOT RUN: tests, typechecks, builds, browser journeys, and runtime or crypto checks. This review is source inspection only.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/compounding-manager
session	01a1d992
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

Compounding Manager: delta review 04028d7c..ad814f6b162a4341dac64a576c33b11d7ad3e382. Cross-family: OpenAI reviewer, Claude author.

NO-GO: one residual P2. Both earlier P2s are fixed.

• Fixed: P2-1. Strict decoding now applies at all five security-boundary decoders.
• Fixed: P2-2. A malformed signature string returns false. The base64url length, alphabet and padding-bit checks are canonical. Propagating InvalidAccessError and TypeError is right: the CryptoKey comes from the caller, the algorithm is fixed, and the arrays are built internally.
• P2, residual from the original verifier: apps/fractal-web/src/client-control/wire.ts:60-61. Take a valid golden binding and set visible_state.route to '\uD800'. It still passes the strict schema, because route is Schema.String. With any canonical 64-byte signature, clientResultCanonicalBytes then calls the generated quote helper. That helper throws Error('Invalid Unicode in client result') before the new try block, so attacker-controlled input still makes the verifier reject instead of returning false. Fix: validate well-formed Unicode in binding strings, or translate only the canonicalizer's malformed-Unicode refusal into false. Do not swallow unrelated errors. Add a regression case: an unpaired surrogate with a validly shaped signature.

Checked, with no other findings: the positive and negative regression assertions do not pass vacuously, the golden vectors are now compared as byte arrays, application activation stays disabled, and D-5 is unchanged. NOT RUN: tests, typechecks and builds. This review is source inspection only.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/compounding-manager
session	01a1d992
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

Compounding Manager: GO at d86b71759570a9aa56f2ee98e177ff290c18ec45, from the source review. Cross-family: OpenAI reviewer, Claude author. It replaces the NO-GOs at 04028d7 and ad814f6.

• The residual P2 is fixed. The catch encloses only the generated canonicalizer call. It matches only the plain Error with the exact message 'Invalid Unicode in client result', and it rethrows all other failures. No second validator or canonicalizer was added.
• The tests do not pass vacuously. High and low lone surrogates are tested in all 12 schema-valid string locations. Each case first requires strict decoding to succeed, and then requires false with a canonical golden signature and the real key. The valid astral pair still verifies.
• The earlier fixes for strict decoding and signature encoding are still in place.
  NOT RUN: tests, typechecks, builds and browser checks. This GO is not evidence of execution or of application activation. Johannes b1895dd7 still requires the focused local tests before the readiness flip. Conditions: those tests, green hosted CI at this head, and U04.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/compounding-manager
session	01a1d992
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

Delta review at ed2030149da0477007b76c1ae41b8994d91770d8: GO (source). Compounding Manager (agent/compoundingtech/compounding-manager). The reviewer is OpenAI-family; the author is Claude-family. The earlier GO was at d86b717.

• 995a206 (merge of the Define canonical client command result contract #6274 generated head 7cafdf1):
  • git show --remerge-diff shows no resolution diff.
  • The contents under clients, crates, docs/st3/client-v0 and fixtures are identical to the canonical parent. Nothing was hand-edited.
• ed20301:
  • Each frame is decoded strictly and validated in full before any effect.
  • Authority and the bindings inside each frame are validated, and run starts must increase.
  • A terminal tombstone is permanent.
  • Revocation is verified across the whole enrollment.
  • A command runs only where the embedded command's policy and the current authority's policy both allow it.
  • Lifecycle and foreground are checked again after navigation.
  • Hashing uses the generated functions, and the golden assertions match byte for byte.
  • The lifecycle, D-5 and hash tests are not vacuous.
• Sequence-0 fixture vector: this is a real contradiction between the upstream fixture and the schema, and the PR exposes it openly. Refusing the frame is correct against the positive-sequence contract, and the refusal leaves the existing state untouched. FPL has the report.

No findings. Conditions:

• Define canonical client command result contract #6274 lands first.
• Green hosted CI at this exact head.
• The dev5 focused tests that Johannes required run before the ready flip.

This GO covers the source only. Production activation stays disabled.

NOT RUN: tests, typecheck, build, regeneration, browser journeys, authenticated subscription, enrollment, expiry and budget integration, live revocation.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/compounding-manager
session	01a1d992
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

Delta review at c6c9f69d193d502845fff7285840243058725a49: NO-GO. Compounding Manager (agent/compoundingtech/compounding-manager). The reviewer is OpenAI-family. The earlier GO was at ed20301.

P1: clients/typescript/fractal-client/index.ts:5 re-exports a class that the committed generated module does not export.

• The merge of Define canonical client command result contract #6274 f92a263 makes index.ts re-export ClientResultCanonicalizationError from ClientControl.generated.ts.
• The committed ClientControl.generated.ts has no such export and still throws a plain Error. Only the generator template (ClientControl.ts.in) was updated.
• index.ts is the @fractal/client entry point in the package exports map. Production web modules import that entry point, including data/liveSource.ts and conversation/alerts/alert-action-port.ts.
• So the PR adds an unresolved named export for existing consumers. This is a real defect, not a pending optional improvement.

Fix:

1. In Define canonical client command result contract #6274, regenerate and commit the canonical outputs, so that the generated module exports the class.
2. Merge those outputs here before the re-export.
3. In the same change, switch the refusal catch in wire.ts to the generated typed error, so that malformed Unicode still resolves to false.

Checked:

• git show --remerge-diff 84965b5645 is clean, and the merge content equals the Define canonical client command result contract #6274 parent under clients, crates, docs and fixtures.
• The corrected sequence-0 vector is now an ordinary strict refusal.
• The narrow plain-Error catch still returns false for malformed Unicode and rethrows unrelated errors. It has no fallback to acceptance.
• The rest of the web delta has no other defect.

NOT RUN: tests, typecheck, build, regeneration, runtime or browser checks. The review is source inspection only.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/compounding-manager
session	01a1d992
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

Delta review at a4132d6af5fb929dd1eb5d942a17af6e86b8c158: GO (source). Compounding Manager (agent/compoundingtech/compounding-manager). The reviewer is OpenAI-family. The P1 from issuecomment-6779587468 is fixed, and the review found no new problems.

• bc9041f (merge of Define canonical client command result contract #6274 6fb398c): the remerge diff is empty. The content under clients, crates, docs and fixtures equals the canonical Define canonical client command result contract #6274 parent.
• Typed error: index.ts now re-exports ClientResultCanonicalizationError, and the committed generated class exists, so consumers of @fractal/client resolve it. In TypeScript, the template and the output agree on the class, on the code invalid-unicode and on both surrogate throw sites.
• Swift and Rust: the regenerated sequence validation matches the templates and the positive JSON-safe range. The typed class exists only in TypeScript.
• a4132d6: wire.ts catches only that class and code around canonicalization, with no message matching, and rethrows every other error. All 12 binding-location regressions assert strict decoding, rejection with the typed class and code, and a result of false. The valid astral-pair and byte-exact golden assertions are still in place.

Conditions:

• Define canonical client command result contract #6274 lands first, with FPL's formal GO at 6fb398c.
• Green hosted CI at this exact head.
• The dev5 focused-test receipt that Johannes required.
• Janitor's U04.

NOT RUN: tests, typecheck, build, generator parity, Swift and Rust execution, runtime checks.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/compounding-manager
session	01a1d992
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

GO (source) extended to f3e8721526a7e950cc73d3de8c7a1039b522f583. Compounding Manager (agent/compoundingtech/compounding-manager). The delta from a4132d6 is only the signed merge of #6274's corrected head 972b65b7. The remerge diff is empty. The tree under clients, crates, docs and fixtures is identical to the #6274 parent. #6278 has no source changes. Conditions: unchanged from issuecomment-6780234044.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/compounding-manager
session	01a1d992
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown