Redesign V2 operational readiness workspace

[mekado11]

Scope

Redesign the actual six-section HubCyS V2 workspace around evidence-backed readiness, not a separate dashboard mockup.

• Calm light navigation rail, shared typography, spacing, status, tables, controls, responsive layouts and dark mode.
• Latest reviewable exercise result and clickable capability comparisons using the authorized evidence endpoint.
• Threat-profile index prioritizing recorded exercises, expandable to the full catalog.
• Exercise register with workspace and evidence actions.
• Evidence-linked corrective-action register with owner, due date, verification state and finding trace.
• Clear separation of exercise scores from unmeasured organization readiness and of completed work from verified outcomes.

Dependencies / review order

Stacked on #23 (feat/v2-exercise-workflow), not directly on main. Review this diff for UI changes; merge #23 first and retarget/revalidate this PR against main before merging. Independent security PR #24 remains separate.

No production flags, Firebase rules, data, pricing, authorization or scoring algorithms are changed. Leave this PR open and unmerged for review.

Verification

• V2 typecheck and scoped lint passed.
• 68 domain + 34 security/client tests passed.
• 20 emulator tests passed, including actual create → release → six participants → evaluator observations → explainable score.
• 20 desktop/mobile UI checks passed, including new drill-down/filter paths and existing access-denied, tamper, tenant-switch and stale-request protections.
• Production and synthetic review builds passed.
• Visual review: all six sections at desktop/mobile, expanded evidence, dark mode and constrained effective zoom viewport. Existing legacy bundle size warning remains.

Preview boundary

The review preview uses the actual components with clearly labeled synthetic data. It cannot write to production. Create is explicitly read-only; live workspace operations require the connected application and are separately tested against local emulators. Threat recommendations and report generation are still unconnected; no fabricated readiness trends are shown.

See docs/v2/ui-redesign.md for scope, QA coverage and release limitations.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hubcys	Ready	Preview	Sep 23, 2026 5:41pm UTC

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f28e32b1ce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Include closed actions in the Verified filter

When a successfully verified action advances to closed, selecting the Verified tab hides it because this predicate only accepts the literal verified state; the tab's count applies the same strict comparison. The lifecycle permits closed only after verified and requires retained successful verification (server/v2/lifecycle.ts), so closed actions are verified outcomes and should remain visible in this filter.

Useful? React with 👍 / 👎.