build(deps): bump node from 20-bookworm-slim to 25-bookworm-slim in /packages/orchestration/skills/dev-tools/quality-gate/sandbox

.github/workflows/pages.yml

@@ -0,0 +1,49 @@
+name: GitHub Pages demo
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: "20.19.0"
+      - name: Build static demo
+        run: npm --prefix packages/orchestration run build:pages-demo
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b
+      - name: Upload GitHub Pages artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b
+        with:
+          path: dist/pages-demo
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-24.04
+    needs: build
+    permissions:
+      pages: write
+      id-token: write
+    steps:
+      - name: Deploy GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e

.stylelintrc.json

@@ -0,0 +1,22 @@
+{
+  "rules": {
+    "at-rule-property-required-list": null,
+    "declaration-no-important": null,
+    "declaration-property-value-disallowed-list": null,
+    "function-disallowed-list": null,
+    "function-url-scheme-allowed-list": null,
+    "function-url-scheme-disallowed-list": null,
+    "media-feature-name-allowed-list": null,
+    "media-feature-name-value-allowed-list": null,
+    "property-disallowed-list": null,
+    "selector-attribute-name-disallowed-list": null,
+    "selector-disallowed-list": null,
+    "selector-max-compound-selectors": null,
+    "selector-max-id": null,
+    "selector-max-specificity": null,
+    "selector-max-universal": null,
+    "selector-not-notation": "complex",
+    "time-min-milliseconds": null,
+    "unit-allowed-list": null
+  }
+}

DESIGN.md

@@ -0,0 +1,15 @@
+# Visual system register
+
+The operator console uses the existing RAE evidence-dossier system: square geometry, restrained blue and teal evidence accents, neutral paper-like surfaces, compact system typography, tabular identifiers, thin rules, and explicit text labels beside status color.
+
+The workflow editor extends that system as a visual systems map:
+
+- a registry rail for workflow identity, revisions, and activation state
+- a spatial SVG projection for topology and execution relationships
+- a synchronized structured node and edge list for complete non-canvas operation
+- a property inspector using native form controls
+- a validation ledger, revision diff, budget display, and activation history
+
+Canvas dragging is optional and never the only authoring path. Standard controls retain native keyboard behavior. Focus indicators remain visible, status is communicated with words and symbols as well as color, and motion is removed when the user requests reduced motion. Responsive layouts preserve the registry, editor, and validation order at narrow widths.
+
+This register describes the implemented design intent. It makes no formal accessibility-conformance claim.

PRODUCT.md

@@ -0,0 +1,18 @@
+# Product register
+
+RAE is a source-distributed toolkit for bounded repository change, repair, and evaluation. Its supported autonomous provider is Codex. It operates on a committed Git repository in an isolated worktree by default and does not commit, push, publish, deploy, or promote workflow revisions.
+
+The graph-native runtime treats a versioned workflow as executable policy. Requirements, design criticism, planning, alignment, mutation, verification, and repair are arbitrary typed nodes rather than a fixed phase list. Each run owns an immutable workflow snapshot, node guidance, payload contracts, attempt envelopes, trace order, and evidence references. Existing v1 run requests remain linear when resumed.
+
+The operator is a loopback-only, bearer-authenticated local console. It is used to inspect runs, resolve checkpoints, stop or resume owned work, and author future workflow revisions. Active runs cannot be edited. Workflow activation is an attributed human decision that affects future runs only.
+
+The improvement campaign is evaluator-owned. It compares bounded workflow policy and topology candidates against frozen development and held-out matrices, records append-only lineage, and emits a recommendation. It never activates a candidate.
+
+Primary users are maintainers who need inspectable repository automation, explicit ownership, conservative mutation, reproducible evidence, and human control over publication and policy changes.
+
+Product boundaries:
+
+- Runtime code, judges, fixtures, safety invariants, provider selection, model selection, tools, commands, and promotion rules are not candidate-editable.
+- Context graph memory is separately opt-in with `--graph-memory` and cannot authorize mutation.
+- The supported execution sandbox is the repository's documented macOS evaluator backend. Unsupported hosts fail closed where that boundary applies.
+- Local evidence is not publication or release evidence.

README.md

@@ -21,15 +21,19 @@ The repository is an alpha candidate. It does not publish a package, container,
 hosted service, or stable API. See [Release Status](RELEASE_STATUS.md) for the
 current release evidence.
 
+Explore the [static Evidence Dossier demo](https://sebastianspicker.github.io/rae/).
+It uses sanitized fixture data, runs no command, and stores no state.
+
 ## Capabilities and limitations
 
 RAE currently provides:
 
-- a ten-stage orchestration runtime with typed artifacts and pass/fail gates
+- a graph-native orchestration runtime with typed nodes, joins, bounded repair loops, and immutable evidence envelopes
 - isolated Git worktrees for autonomous repository changes
 - a loopback-only operator console for run status, checkpoints, resume, and stop
 - Ralph audit, linting, and story-scoped fixing modes
 - benchmark validation, execution, comparison, calibration, and release gates
+- opt-in local repository, workflow, evidence, and temporal-memory graph projections
 - a transactional Git co-author trailer cleaner
 - sanitized environment-profile templates and installers
 
@@ -97,6 +101,8 @@ The umbrella command forwards arguments to the runtime that owns them:
 Use `--policy <path>` to select a validated orchestration policy. Use
 `--checkpoint-policy before-mutation` or
 `before-mutation-and-ship` to require operator approval at those boundaries.
+Use `--graph-memory read` or `read-write` only when local graph retrieval is
+required. Graph memory is `off` by default.
 Ralph accepts command flags and `RALPH_*` environment variables documented in
 its package README.
 
@@ -127,6 +133,22 @@ Run a task in an isolated worktree:
   --task "Add a tested health endpoint and document its behavior"
 ```
 
+New runs use the committed graph-native workflow by default. Select a validated
+workflow with `--workflow`, stop at a node with `--through`, or temporarily
+start the v1 engine with `--legacy-linear`. Existing v1 requests always resume
+through the linear engine.
+
+Inspect future workflow revisions with `graph workflow list|validate|show|diff`
+and activate a reviewed revision with `graph workflow activate`. Activation
+requires an attributed rationale and exact digest confirmation, and affects
+future runs only.
+
+Workflow schema 2.1 supports bounded data-driven fan-out, item streams,
+deterministic transforms, threshold joins, until-dry discovery, and logical
+execution tiers. Use `--execution-profile <file>` to supply the operator-owned
+Codex model mapping. Use `graph workflow propose` for a read-only, draft-only
+Codex topology proposal; it never activates or executes the candidate.
+
 Use `--through plan` to stop before repository mutation. The default worktree
 is stored under the target repository's Git metadata at
 `.git/rae-worktrees/<run-id>`. The final output identifies the worktree and
@@ -167,6 +189,18 @@ Run one benchmark split:
   --output-dir evals/results/local-dev
 ```
 
+Evaluate a sealed workflow-improvement campaign without activation:
+
+```bash
+./scripts/rae.sh eval improve \
+  --campaign evals/campaigns/autonomous-policy-improvement.v2.json \
+  --baseline-evaluation evals/results/local/baseline-development.json \
+  --candidate-policy evals/results/local/candidate-policy.json \
+  --candidate-evaluation evals/results/local/candidate-development.json \
+  --sealed-evaluation evals/results/local/candidate-held-out.json \
+  --output-dir evals/results/local/improvement-campaign
+```
+
 Local outputs under `evals/results/local*`, `.pipeline/`, and package runtime
 directories are intentionally ignored.
 

TESTING.md

@@ -29,7 +29,7 @@ The root gate runs:
 
 ## Test inventory
 
-The current tree contains 128 executable test source files and 11 referenced
+The current tree contains 129 executable test source files and 11 referenced
 runner, helper, fixture, or configuration files.
 
 | Classification | Paths | Count | Runner or owner |
@@ -42,7 +42,7 @@ runner, helper, fixture, or configuration files.
 | Active | `packages/loops/ralph/tests/ralph_*_test.sh` | 63 | `packages/loops/ralph/scripts/run_tests.sh` |
 | Active support | Ralph test runner and `tests/lib/test_helpers.sh` | 2 | Ralph shell suite |
 | Active | `packages/orchestration/operator/tests/*.test.mjs` | 5 | Node test runner |
-| Active | `packages/orchestration/scripts/pipeline/tests/*.test.mjs` | 25 | Vitest |
+| Active | `packages/orchestration/scripts/pipeline/tests/*.test.mjs` | 26 | Vitest |
 | Active support | Pipeline Vitest config, test helper, and two fixture modules | 4 | Pipeline Vitest suite |
 | Active | `packages/orchestration/skills/dev-tools/*/tests/unit/*.test.ts` | 17 | Package-local Vitest commands |
 | Active support | `trace-test-helpers.ts` | 1 | Trace collector tests |
@@ -80,8 +80,12 @@ Orchestration:
 npm --prefix packages/orchestration run test:operator
 npm --prefix packages/orchestration run test:runner
 npm --prefix packages/orchestration run verify
+npm --prefix packages/orchestration run benchmark:workflow-topology
 ```
 
+The topology benchmark is a deterministic scheduler fixture for event order,
+critical path, and barrier idle time. It does not measure model quality.
+
 Ralph:
 
 ```bash