[liminalshruti]

Builds the reviewed Align UX (Claude Design "Align App v6" / "Align Tool Concepts v2") into the custom-scenario screens testers use. Adds leadership's launch decision and in-app team switching, hard-locks Afshar's Halden test scenario, and carries every fix from Sean's #6 and #7 reviews. Northstar's API is unchanged; its UI text is re-baselined for v6 (Sean signs off). Draft; nothing merges before the pitch, and it lands as one unit.

Sessions contributed in turns under founder ruling "B" (5 open PRs, no new ones). Every push was a fast-forward, after iMac S3's review and iMac S1's test-all.

1. Decision record and Halden (iMac S1): 0d86ee6, b7aa7e4, f079f76

• Conditions come from the owning team's conditions field only. The owner's reason shows separately ("Why asked for changes") and is never shown as a condition.
• Multi-line conditions are numbered; the duplicate "Who decided" section is gone.
• Halden hard lock (founder, LIM-2438): adds scripts/fixtures/halden-country-selection.json and removes Halverson (clinical-screening-window.json).

2. Leadership's launch decision (Mini S0): 5ef9ca9 … 580b24c

• New route POST /api/proposals/[id]/launch: custom only, leadership only (403), RATIFIED with an acceptance (409). The body is approved or not_yet plus an optional note of at most 500 characters, which never goes into the audit log.
• New field Acceptance.launch_decision (data change), plus the OrgView launch UI.
• The record, the MCP accepted-plan output and the agent directive say "launch pending" until leadership approves.

3. Wording, Switch team, deletion day (iMac S3): 580b24c..1eb66cf, 820aa15

• One agreement wording from labels.agreedStatus. Conditions are marked once ("Not confirmed yet").
• In-app Switch team (founder ruling): signs out and opens the chosen team's sign-in. Each team still needs its passcode.
• Deletion-day cutoff enforced; F1/F3 fixes from the hosted Halden rehearsal.

4. Sean's #7 review (iMac S1): 8635202, 37ad24b

• Item 1: a "fictional" label on Halden (now superseded by section 6). Test F17: a reason-only counter stores the rationale and no conditions.
• Item 2: the nav-subtitle wrap applies to custom only; Northstar keeps its original truncate class.

5. Sean's #6 review fixes, rebased onto this head

• Fixes 2+4 (Mini S1): 3888e5e. Origin check on mapping decisions, sign-out and the launch route; launch rate limit; every agent-facing line and title goes through quoted()/oneLine(), including the decision-record summary.
• Fix 1 (Mini S0): c652cf0. useAlign reloads only on workspace_mismatch; other 409s show their reason.
• Fixes 3+5 (Mini S2): 4b7a255. Closed mode: after ALIGN_DELETE_BY every request gets 410 and the purge still works. align-watch exits 1 on 401/403 with one line; agent-session.sh prints expires_at.
• Lows (Mini S3): bc67edf. Includes Restart bumping the epoch before the state write, and HOSTING.md limits.

6. Founder label and test-server notice (Mini S2): 260a252

• company_note (INPUT SCHEMA CHANGE): one founder-ruled label, "Example company (fictional), based on an anonymized real workflow.", on all three fixtures. It is shown in the custom header and on sign-in. Halden is back to its locked text apart from this label.
• /new notice uses the ruled text (deletion by November 13, 2026), rendered once.

7. Align App v6 screens (iMac S1 integration of 5 parallel builds; iMac S3 review): 3ef5cb0 + merge d506668 … a54570f

• New rail: Your turn, Goals, Scenario Studio (Northstar only), Decisions, Work, plus "+ New conflict" (custom only). The proposal is a review thread; the decision record has tabs; Goals has a tree with a team lens; Work shows what's still on the old plan.
• "Try to approve (only can)" refusal demo, with a client-side session check and the workspace header. The STALE approval wording and record note.
• Client components, styles and test scripts only.

Tests at head a54570f23298fa903b35a7f2b8b2f65d3d21e13b

scripts/test-all.sh: all 15 steps pass (iMac S1 and iMac S3, each independently).

• frozen, lint, typecheck, syntax: pass
• Northstar API snapshot identical to 850971e; test-flow identical
• test-scenario 73/73 on example, Halden and partner-program
• test-ui-loop 30/30
• test-mcp, test-capture, test-mapper: pass
• test-tenancy 166/166
• ui-northstar re-baselined to 125 files (needs Sean's sign-off)

Review state

• Sean APPROVED bc67edf (01:30Z, Oct 23) and RE-APPROVED 3cd7f8a (02:10Z). The head has since moved to a54570f (section 7): his ui-northstar sign-off and a re-approval are requested.
• Before go C: Sean's Fly smoke test. Still open: the sign-out token note (LIM-2437) and the Mac mini's local QA proxy cert (hosted-tls/cert.pem, reported by Mini S3), which expires Fri Oct 23, 5:04 PM PT. That cert is not a Fly app or the pitch host. Founder tester sequence (LIM-2437 ac143caa): QA on the hosted build Sat Oct 24 to Mon Oct 26, go/no-go Mon after the 3 PM daily, Wave 1 testers Tue Oct 27.
• Sean's new Lows (not blocking): /new and /setup can't send company_note, so a hand-rebuilt Halden loses the label; agents see the company without the label; "You can request earlier deletion" has no contact path (founder copy call).
• Autopilot Act 2 (headless mapping wait) and Act 4 (tmux) were not run on v6.

These results are regression-clean; Sean's review is the security gate.

Base: #6 (agent/LIM-2424-pr5-adversarial-fixes).

https://claude.ai/code/session_01WgVzmgWS6wETjetB3xmJ1q

[allsmog]

Review, PR #7 @ 1eb66cf (includes the launch route)

Status: changes requested, small. The launch route is sound on the points that matter. Two items from my look at f079f76 are still open, and there are a few Lows on the new code. Gate: scripts/test-all.sh 3247 on this head, all steps PASS (test-scenario 65/65 on all three fixtures, test-ui-loop 23/23, test-tenancy 136/136, Northstar snapshot and UI 72/72 identical to 850971e).

Launch route (app/api/proposals/[id]/launch/route.ts, lib/flow.ts:259-275): checked

• Leadership only (forbid for other actors), custom scenarios only (404 otherwise), and only on a RATIFIED proposal that has an acceptance (409 otherwise).
• Workspace-scoped through requireWsSession + who.mutate, so the M7 x-align-workspace check applies. test-tenancy A6 proves B's leadership gets 404 on A's proposal with both trees unchanged.
• JSON only, 4 KB cap, decision is an enum, note is text of at most 500 characters, and the audit records the decision and proposal id, never the note.
• launchApproved reads the latest acceptance, so a decision on an older proposal never shows as approval for a newer agreement, and a new agreement starts as launch pending. Correct.
• The hosted allowlist adds only launch to the existing proposal-action pattern (proxy.ts:23), and test-tenancy's route list is updated to match.
• The agent directive, the MCP summary and run_command all say launch is pending until leadership approves, and that conditions are not confirmed. Good: agents can't read "agreed" as "go".
• The new copy is scoped to custom (!L.northstar and custom guards), and customStateLabel returns undefined for Northstar.

Still open from f079f76

1. Fictional label (required). scripts/fixtures/halden-country-selection.json still never says the company and scenario are fictional, and the company name shows on screen once it's loaded. One "Fictional company and scenario" line covers it.
2. Northstar nav (required). Removing truncate (components/Home.tsx, nav subtitles) still applies to Northstar's shared nav. Scope it to custom, or drop "Northstar untouched" from the description.

Lows on the new code

• The launch route skips the same-origin check. Every other cookie-authenticated write goes through bodyFor (JSON plus Origin matching Host, port included, the M4 rule). This route uses requireJson + cappedJson directly. Requiring JSON already forces a CORS preflight, so the cross-site risk is small, but it's the only write route that departs from the rule. Add requireSameOrigin(req), and add a cross-port case for it to test-tenancy.
• No rate limit on launch decisions. Each call adds an audit row. The archive is now bounded, so this is cosmetic; takeWorkspaceAction(who.ws, "launch") matches Restart and connect.
• MCP outputSchema doesn't declare agreement.launch (lib/mcp/register.ts, AcceptedPlanOut). Structured readers learn the launch state only from the text in run_command. If keeping the Northstar MCP baseline byte-identical is the reason, say so in a comment.
• Leadership's team name goes into the agent directive unquoted (lib/directives.ts, status line). Same class as the open quoted() newline gap on #6 (fix 4). When that lands, run team names through it too.
• Deletion cutoff uses a fixed +32 h, which is midnight PST. Right for 2026-11-06, which falls after DST ends; during daylight time it would be 1 AM. Fine as is; worth a comment.
• The PR body's Tests section still cites head f079f76. Update it for this head.
• From before: numbered conditions split on every newline, and no test covers a counter with a reason but no conditions.

Merge recommendation

Not before #3 to #6 land (#6 has changes requested). On this PR, items 1 and 2 plus the same-origin line on the launch route, then it's ready from my side.

[allsmog]

Re-approval, PR #7 @ 3cd7f8a (delta from bc67edf)

Status: approved. Three commits since my approval: 41fa4d6 (fixtures drop confirm; callers add it), 260a252 (company_note, /new notice wording), 3cd7f8a (my VT/FF/NEL Low). Gate: scripts/test-all.sh 3247 on this head, all steps PASS: test-scenario 73/73 on all three fixtures, test-ui-loop 25/25, test-tenancy 166/166, test-mcp, test-capture and test-mapper pass, Northstar snapshot and UI 72/72 identical to 850971e.

Checked

• Item 1, fictional label: still resolved, in a better form. company_note ("Example company (fictional), based on an anonymized real workflow.") is on all three fixtures and on data/scenarios/example-custom.json. It shows under the company name in the custom header (components/Home.tsx) and on both sign-in screens, so anyone who sees "Halden Therapeutics" sees the label too. Halden's plan text is back to the locked wording.
• Schema change. company_note: text(200).optional() inside the strict ScenarioInput (lib/scenario.ts), stored last in scenario_config and only when sent. Rendered as React text, so no markup path.
• Public exposure. login-info and the anonymous /api/state (viewFor, lib/flow.ts) add company_note only for custom workspaces that set one. That's the same tier as the company name, which is already public on the sign-in screen. Northstar's anonymous view is unchanged; test-b1 passes.
• Agents never read it. No company_note in lib/mcp, lib/directives.ts or lib/policy.ts, so no new prompt-injection surface.
• confirm removed from fixtures. Every caller I found adds it back: app/setup/page.tsx:51, test-b1, test-scenario, test-tenancy. No doc or script posts a fixture file directly.
• VT/FF/NEL. oneLine is now /[\r\n\v\f\u0085

]+/g (lib/directives.ts:66).

Lows (non-blocking)

• The /new and /setup forms don't send company_note (toBody in components/ScenarioForm.tsx has no field for it), so only API-loaded fixtures carry the label. That's fine for the locked fixtures. If testers ever rebuild Halden by hand, the label is lost.
• Agents see company ("Halden Therapeutics") in align_get_accepted_plan without the label. That's harmless to an agent, but if agent transcripts get shown or shared, the fictional note won't be in them.
• The /new notice says "You can request earlier deletion" but doesn't say how. Add a contact (an email address) so the promise has a path.

Merge recommendation

Unchanged: ready from my side. It lands as one unit with #3 to #6 after the pitch; main stays at e9ef581f for Friday. For go C, what's left is my Fly smoke test.

[liminalshruti]

Sean: the head moved past your 3cd7f8a approval. It now carries the Align App v6 screens: a54570f23298fa903b35a7f2b8b2f65d3d21e13b (fast-forward; iMac S3 reviewed it, including a 192-view browser walk at 1440 and 1024). Two asks: sign off the ui-northstar re-baseline, and re-approve the head.

What v6 changes vs 3cd7f8a: client components, styles (app/globals.css) and test scripts only. No app/api, lib/, proxy.ts or data file changes. Nothing from agent/align-v2 (#8): 8405c8f and 07e5cf6 are not in it, and git grep ALIGN_V2 finds 0.

Re-baseline (last commit, a54570f): ui-northstar goes from 72 to 125 files.

• 94 nav views per stage and role: your-turn, goals, scenario-studio, decisions, work, plus leadership's company-goal. The old next-decision, proposals and evidence nav views are gone.
• 31 deep screens that are now pinned: the proposal review (11), the decision record (3) and run details (17).
• The refusal demo "Try to approve (only Security can)", the STALE checkbox label and the "approved without a passing test" record note are all in the snapshot text.
• The Northstar API snapshot, test-flow stdout and the MCP checks are byte-identical (not re-baselined).

Behaviour changes to look at:

1. "Try to approve" re-reads /api/session and refuses on the client unless the viewer is still the waiting non-owner. The request carries the workspace, so a stale tab after Switch team can't approve. Covered by test-ui-loop U5b/U5c.
2. STALE approval: the checkbox says the sandbox test no longer matches the plan; the record shows the note. (Still inferred from the ratify_untested audit row, which is trimmed at 1000 rows. Storing it on the acceptance is a server change, yours if you want it.)
3. "+ New conflict" is hidden in Northstar, so it can't replace the shared demo. In custom, Scenario Studio is hidden and Work doesn't poll /api/mappings.
4. 33ffab9: test-tenancy L409 changes navigation clicks only (the "Proposals" nav is gone); no assertion changed.

Gates at a54570f: test-all 15/15 (iMac S1 and iMac S3, each independently): scenario 73 x3, ui-loop 30/30, tenancy 166/166, ui-northstar 125.

Not run: the autopilot's Act 2 (mapping wait times out headless on a bare dev server, not confirmed against base) and Act 4 (tmux).

[allsmog]

Landing plan for the stack (#3 to #7)

My approval is on #7 @ 3cd7f8a, and that head carries every fix from my #3, #5, #6 and #7 reviews. Proposal for landing it:

1. Friday: the pitch runs from main @ e9ef581f. Nothing merges before it. main has no branch protection, so this holds only because we hold it.
2. After the pitch: retarget LIM-2424: custom record, launch decision, Switch team, Halden fixture (stacked on #6) #7 to main and squash-merge it as one commit. That's one diff, one gate run and one revert point. Then close LIM-2424: L0 multi-workspace (Mode L) + hosted-mode draft #3, LIM-2424: agents work with a custom scenario's agreement (CPSec loop) #4, LIM-2424: PR #3 review fixes (local + hosted) and agent connection for local workspaces #5 and LIM-2424: fix every finding from the adversarial review of #5 (stacked on #5) #6 as superseded by LIM-2424: custom record, launch decision, Switch team, Halden fixture (stacked on #6) #7, each with a link. Merging bottom-up would mean landing intermediate heads that still carry review findings (LIM-2424: L0 multi-workspace (Mode L) + hosted-mode draft #3 and LIM-2424: fix every finding from the adversarial review of #5 (stacked on #5) #6 are still changes-requested on their own heads).
3. Your approval on LIM-2424: custom record, launch decision, Switch team, Halden fixture (stacked on #6) #7 before the squash. The squashed diff includes my code from LIM-2424: agents work with a custom scenario's agreement (CPSec loop) #4 and LIM-2424: PR #3 review fixes (local + hosted) and agent connection for local workspaces #5, which I can't approve myself. One approval from you on LIM-2424: custom record, launch decision, Switch team, Halden fixture (stacked on #6) #7, once it targets main, covers that.
4. Goal-bound agent sessions for Claude Code and Codex (behind ALIGN_GOAL_SESSIONS=1) #8 (Align v2) stays out of this landing. After LIM-2424: custom record, launch decision, Switch team, Halden fixture (stacked on #6) #7 is on main, I'll rebase Goal-bound agent sessions for Claude Code and Codex (behind ALIGN_GOAL_SESSIONS=1) #8 onto main and it gets its own review.
5. Hosted test: before the first tester, I do a live smoke test on Fly from LIM-2424: custom record, launch decision, Switch team, Halden fixture (stacked on #6) #7's head (or main after the squash). It covers sign-in, the closed-mode 410, and a dry run of the purge, including the fly machine run fallback.

Two questions:

• Test date: is the first hosted tester Mon Oct 26 or Tue Oct 27? This PR's body says Tue Oct 27; my notes say Mon Oct 26.
• TLS certificate: the body says "the hosted TLS certificate expires Fri Oct 23, 5:04 PM PT". Which host is that? No Fly app exists yet per HOSTING.md. If the pitch touches it, it expires Friday afternoon.

[liminalshruti]

Correction to the tester date I gave earlier (iMac S1): the first testers are Tue Oct 27, not Mon Oct 26. The founder's tester sequence (LIM-2437 ac143caa, Thu ~4:20 PM) is: QA on the hosted build Sat Oct 24 to Mon Oct 26, go/no-go Mon after the 3 PM daily, Wave 1 (two testers) Tue Oct 27, Wave 2 Mon Nov 2 to Tue Nov 3, feedback by Wed Nov 11. I had cited an earlier tester email that this ruling superseded. So hosting has to be live by Sat Oct 24, for QA. The PR body is corrected.

[liminalshruti]

Final head for your review: a54570f23298fa903b35a7f2b8b2f65d3d21e13b (iMac S1). I won't push to #7 again unless you ask.

• LIM-2424: custom record, launch decision, Switch team, Halden fixture (stacked on #6) #7 now targets main (95c43be, the LIM-2424: land Sean-approved PR #7 at 3cd7f8a (stack #3 to #7) #9 merge, whose tree is identical to 3cd7f8a). It carries only the 27 v6 commits, and GitHub shows MERGEABLE / CLEAN. Merging it gives exactly the tested tree below.
• test-all at a54570f: 15/15 (iMac S1 and iMac S3, each independently). Northstar API snapshot and test-flow identical; test-scenario 73/73 x3; ui-loop 30/30; tenancy 166/166; mcp, capture and mapper pass; ui-northstar re-baselined to 125 files.
• What v6 changes: client components, styles and test scripts only. No app/api, lib, proxy.ts or data changes. Nothing from Goal-bound agent sessions for Claude Code and Codex (behind ALIGN_GOAL_SESSIONS=1) #8, and 0 ALIGN_V2 references.
• Needs from you: sign-off on the ui-northstar re-baseline (last commit a54570f) and approval of this SHA. The founder then merges with a merge commit pinned to it.
• Details are in my earlier comment on this PR. Not run: autopilot Acts 2 and 4.
• Separate: the three QA-exit gaps (error page/noscript, hosted 'is Align running' copy, cross-tab role switch) come as their own small PR off main (Mini S0, iMac S3 reviews), not in LIM-2424: custom record, launch decision, Switch team, Halden fixture (stacked on #6) #7.

[liminalshruti]

Review: PR #7 @ a54570f23298fa903b35a7f2b8b2f65d3d21e13b (the 27 v6 commits now on main)

Automated code review, high effort, read-only. Checked = I read the code at this head and confirmed it. Unchecked = reviewer finding not yet confirmed. Context: main is 95c43be (Sean-approved 3cd7f8a). This PR's remaining delta is the v6 work and needs Sean's sign-off.

Fix before tester QA (Sat)

1. Checked. A "not_yet" launch decision hides leadership's re-decide prompt. components/YourTurnView.tsx:139 gates on !acc.launch_decision, and lib/flow.ts:265 accepts not_yet. After "not yet", the launch is still pending, but leadership's Your turn says "Nothing waiting on you" and the badge drops to 0. Line ~182 hides the teams' "Leadership decides the launch" card the same way. Fix: gate on launchState(acc) !== "approved".
2. Unchecked. The time-to-agreement timer no longer starts on its own. Landing changed from decision to turn (components/Home.tsx:312). DecisionView fired mark("ceo_change_viewed"); YourTurnView doesn't. touch() drops actions while started_at is unset, so the record's measured tile can read "Not started" with 0 touchpoints.
3. Unchecked. "+ New conflict" opens the old decided proposal (components/Home.tsx:428). After any ratified proposal, ProposalsView shows the latest non-rejected proposal and no composer. The "Propose a change" card on Your turn does the same.

Lower

4. components/DecisionsView.tsx:64: every row opens go("decision"), which renders acceptances.at(-1), so older acceptances can't be opened.
5. components/v6/record.tsx:193: actionWords has a launch key the server never writes. launch_approved, launch_not_yet, ratify_untested and reject show as raw verbs.
6. components/TeamLens.tsx:171: still hardcodes "New requirement, added today". The changedToday(g) ? … : … ternary is copied about 8 times; one helper would stop this recurring.
7. components/GoalsView.tsx:21: depStage returns "accepted" whenever any acceptance exists, ignoring the dependency's status, so it can disagree with Your turn.
8. Duplication in components/v6/*: Pill is in kit.tsx (text-amber-700) and record.tsx (var(--al-warn)); Collapsible, Chip and Lbl are in kit and thread; there are four initials helpers; WorkScreen is unused; two different components are both named OldPlanWork; and conditions are split on \n in three places (only conditionLines() handles \r\n).

[allsmog]

Review, PR #7 @ a54570f (the 27 v6 commits on top of 3cd7f8a, now on main via #9)

Status: approved, with follow-ups. This approval includes my sign-off on the Northstar UI re-baseline (a54570f). Gate: scripts/test-all.sh 3247 on this head, all steps PASS: test-scenario 73/73 on all three fixtures, test-ui-loop 30/30, test-tenancy 166/166, test-mcp, test-capture and test-mapper pass, Northstar API snapshot and test-flow identical to 850971e, ui-northstar 125 files matching the new baseline.

I checked main @ 95c43be too: its tree is byte-identical to 3cd7f8a, so #9 landed exactly the approved commit.

Scope checked

• Client only: components/, components/v6/, app/globals.css, and the test scripts. No changes under lib/ or app/api, so the server, auth and tenancy surface is the one I already approved.
• No new dangerouslySetInnerHTML, innerHTML, eval, fetch calls or external URLs. scripts/test-all.sh and scripts/test-ui-northstar.sh are unchanged.
• No weakened tests that I found. test-ui-loop gained U5b/U5c, and test-tenancy L409 follows the new way of opening a proposal.
• Still present: the Elsewhere notice, Switch team, company_note, 409 reasons and the stale-tab guard (stronger now, TryApprove), the conditions-unconfirmed labels, and the launch decision.

What changes for Northstar (what I'm signing off on)

• Navigation: Next decision / Goals / Proposals / Evidence becomes Your turn / Goals / Scenario Studio / Decisions / Work for every role, and Leadership keeps Company goal. Every role lands on Your turn.
• Screens: Goals becomes a tree with a lens. Proposals become a message thread, with the step tracker and per-check table folded under Evidence. The record gets Summary / Receipts / How to read this. "+ New conflict" is hidden.
• Agent pane: the live agent pane and the 2/9 vs 9/9 at-a-glance cards no longer show before agreement. The agent's hold is visible only in Work.

Follow-ups (fix before the hosted QA on Sat Oct 24)

1. Medium: the time-to-agreement clock no longer starts on its own. The server starts it only on ceo_change_viewed (lib/flow.ts:30). On 3cd7f8a, landing on Next decision fired it (DecisionView.tsx:96). On v6 it fires only on three clicks: the header pill (Home.tsx:571), Your turn's "See goals" (YourTurnView.tsx:254), or the CEO node in Goals (GoalsView.tsx:166). A Product user who goes straight to "Propose a change" never starts it, and the record then shows "Not started" (v6/record.tsx:139). Fix: mark ceo_change_viewed when Your turn shows the CEO change, as DecisionView did on mount. Add a test-ui-loop check that the record shows a measured time after the shortest path.
2. Medium: the baseline label is now false. test/snapshots/ui-northstar-850971e holds the a54570f text, and the gate prints "identical to 850971e (125 files)". Rename the folder to the v6 commit, update scripts/test-ui-northstar.sh, and keep 850971e only for the API snapshot and test-flow, which really are unchanged.
3. Medium: docs/DEMO_SCRIPT.md describes the old screens (lines 41, 57, 68, 103-104: Next decision, Proposals, Evidence). That's right for the pitch on main tomorrow. Update it in this PR so it matches the UI once it lands.
4. Low: the "Receipts" tab (v6/record.tsx:43) labels results that EvidenceView.tsx:200 says "aren't signed". Call it "Activity" or "Evidence".
5. Low: jargon in Northstar copy.
   • "Clashes with KR2" (GoalsView.tsx:64; it used to say "Clashes with the CEO's new requirement") and "KR2 changed today".
   • "P0/P1/P2" priorities in the brief (BriefDrawer.tsx), which collide with "P0" incidents in Security's counter text.
   • Raw plan ids on the Studio result cards (ScenarioStudio.tsx:44-45).
   • Developer copy: "Needs a decision field on work items. Not built yet." (v6/OldPlanWork.tsx:120), and scripts/run-plan.sh in Studio.
6. Low: leftovers.
   • Goals "Open record" for Northstar goes to the Evidence screen (GoalsView.tsx:92).
   • The record still says "read What to do next" and "opened Evidence" (v6/record.tsx:184-186).
   • The proposal thread shows raw state chips ("ratified", "acknowledged").
   • WorkScreen (v6/OldPlanWork.tsx:145) is unused, and the pre-agreement branches of DecisionView and TodayView can no longer be reached.

Merge recommendation

Ready to merge from my side after the pitch, ideally with follow-ups 1 to 3 in. It isn't needed for Friday, since the pitch runs from main @ 95c43be. #8 rebases onto main once this lands.

[liminalshruti]

@allsmog: thanks for the approval at a54570f. The founder ruled to merge #7 as you approved it and land the follow-ups separately, so #7's head stays a54570f. Nothing was pushed to this branch.

Follow-ups are in #10 (62a4c30e3db3ba8d1d67d2cc5f889ad2ded20f2d, stacked on this branch). Please review:

• Your LIM-2424: Build A minimum slice #1 (clock): done as you suggested. Your turn marks ceo_change_viewed when it shows the change, and test-ui-loop U11 covers the shortest path.
• Your LIM-2425: Build B part 1, privacy gates (B1-1..B1-6) + consent doc #2 (baseline label): ui-northstar-v6, re-captured; the only differences are the clock now running.
• New to you, from the review in comment 6356535154: (a) a "not_yet" launch decision hid leadership's re-decide card and the teams' "Leadership decides" card (U12); (b) "+ New conflict" reopened the ratified thread instead of the composer (U13). All four new checks fail without the fixes and pass with them. Gate 15/15.
• Your LIM-2424: L0 multi-workspace (Mode L) + hosted-mode draft #3 (DEMO_SCRIPT.md): written on branch docs/demo-script-v6 but parked, because the file is in test-all.sh's FROZEN list. Removing it from that list is your call or the founder's, not something the agent changes. That branch also fixes the spoken "2 of 9" (the latest baseline run on record shows 1 / 9).
• LIM-2424: agents work with a custom scenario's agreement (CPSec loop) #4 to LIM-2424: fix every finding from the adversarial review of #5 (stacked on #5) #6 (Low): next.

Correction: "the pitch runs from main @ 95c43be" isn't quite right. Friday's pitch uses a recorded video made at e9ef581f, and that pre-merge tree is tagged pitch-baseline-e9ef581. Please don't run a live Northstar demo from post-merge main expecting the old screens.

[allsmog]

Follow-up to my approval @ a54570f: integration pass

The second review lens finished after I approved, and I also drove the app once with scripts/autopilot.mjs (headless, --fast --no-agent) on this head. No blocking defects, and the approval stands. There's one confirmed regression to fix before QA, one more Medium, and two Lows.

Follow-up 1 (timer) is confirmed by running it. The autopilot drove Act 3 to RATIFIED with one acceptance, and afterwards data/state.json has timer.started_at: null and no touchpoints. After a full demo on v6, the record shows "Not started" for time to agreement. Please treat this one as required before the hosted QA on Sat Oct 24.

(The autopilot's Act 2, re-matching sessions to the new goals, timed out here. It times out the same way on 3cd7f8a, so it isn't from this PR.)

7. Medium: a declined proposal has no screen. The Proposals nav item is gone (Home.tsx:27-34). Decisions lists only open proposals and acceptances (DecisionsView.tsx:34 filters out REJECTED), and Your turn skips REJECTED too (YourTurnView.tsx:15). The review screen still tells the owner that the asking team "sees that you declined" (ProposalsView.tsx:794). In practice, after a Decline the asking team gets a fresh "Propose a change" card with no mention of the decline. The server keeps the REJECTED state and its audit row; the UI just doesn't show them. Fix: list declined proposals in Decisions, or show the decline on Your turn, so the copy at :794 is true.
8. Low: TryApprove calls api() directly (ProposalsView.tsx, the accept call), not act(). A 401 session-ended or a 409 workspace_mismatch therefore shows as inline text, without sign-out or the Elsewhere notice. The 403 path is correct and tested (U5b/U5c). Route it through act(), or handle those two codes.
9. Low: Decisions opens the latest record for every accepted row (DecisionsView.tsx:64 → DecisionView renders the latest acceptance). This only matters once a workspace has more than one acceptance. I found no UI path that creates a second one today.

Coverage note: custom scenarios now show Goals, Work and Decisions for the first time, and the gate doesn't snapshot those screens. The reviewer ran a one-off sweep that checked every custom screen, for every role, at each stage from fresh through launch, with no Northstar wording, undefined or empty screens. Worth adding a custom UI snapshot to the gate.