**Design guidance distilled into component system and skills.** agent-webui distills license-reviewed accessibility, responsive, interaction and visual guidance from outside sources into the `src/components/ui/` primitives, the `src/index.css` tokens, and the public universal design and accessibility skills, ranking keyboard and screen-reader failures highest in its review rubric. The assimilation never installs a duplicate skill name, copies unlicensed skill text, adds a remote critique service, or introduces telemetry beyond what already exists. | Source diff and dependency audit confirm no duplicate skill names, unlicensed text, or new telemetry were introduced.

**Design tokens documented with contrast targets.** The component system documents semantic color, typography, spacing, focus, density and state tokens sourced from `src/index.css`, including light and dark contrast targets for each. | Token audit and snapshot tests confirm documented tokens match `src/index.css` and meet the stated contrast targets.

**Controls have accessible names and visible focus.** Every interactive control exposes an accessible name and a visible focus indicator, repeated filter rows label each individual clause distinctly, and dialogs trap keyboard focus while open and restore it to the triggering element on close. | Keyboard end-to-end tests cover the chat, Atlas and an operational form flow.

**Responsive layout covers 320px mobile through desktop.** Layout patterns render correctly from 320px mobile width through desktop without horizontal overflow and without hiding any required action behind an unreachable control. | Viewport matrix tests with screenshot diffing across the mobile-to-desktop range.

**Gesture actions have alternatives and respect reduced motion.** Every gesture-driven action also has a click or keyboard alternative, and when `prefers-reduced-motion` is set, nonessential animation is disabled while status feedback remains visible. | Touch-alternative and reduced-motion end-to-end tests.

**Status states are distinguishable by text, not only color.** Loading, empty, stale, denied, error, success and pending states each render with distinct text in addition to color, and a long-running operation can be interrupted where doing so is safe. | Rendered tests against fixtures for each named state.

**No duplicate primitives or unsolicited telemetry introduced.** No new component duplicates an existing UI primitive, no unsolicited telemetry is added, and any idea drawn from a third-party source is paraphrased in original wording only after its license has been reviewed and cleared. | Source diff and dependency audit confirm no duplicate primitives, no new telemetry, and license clearance for paraphrased content.

**Fonts load from the same origin.** The interface ships its Inter font files inside the build and declares them with `@font-face` and a system fallback stack. The stylesheet imports no remote font or stylesheet. | A browser probe under the served policy records no `font-src` or `style-src-elem` violation for a remote URL.

**Runtime style elements satisfy the strict policy.** The server issues a fresh nonce for each HTML document and adds it to `style-src` and `style-src-elem`. Each library that inserts a `<style>` element at runtime carries that nonce or ships its rules as a bundled stylesheet. The policy never gains `'unsafe-inline'` for style elements. | Server tests prove a fresh nonce per document. A browser probe under the served policy records no inline `style-src-elem` violation.

**Evaluation dashboard shows calibration and coverage.** A dashboard presents decision evaluation calibration and coverage metrics — cohort, sample count, source class, evaluation window, target versus observed coverage, risk, and receipt version — as independently labeled fields, and shows no numeric coverage, calibration or deployment claim when the evaluation is synthetic-only, missing or underpowered. | Independent-label fixture tests plus negative fixtures for the synthetic-only, missing, and underpowered cases.

**Decision explorer cites premises, derivations and certificate.** A typed decision explorer renders the chosen and excluded options for a decision, citing the premise and derivation identifiers, the certificate, and any violations that applied. | Contract fixture and rendered route tests.

**Why-not explanations run on demand within a bounded budget.** A why-not explanation is computed on demand within a bounded solve budget, and a timeout or refusal is shown to the reader without altering the original decision record. | Timeout and refusal integration fixture tests.

**Dashboard labels each evaluation field independently.** The evaluation dashboard labels cohort, sample count, source class, evaluation window, target and observed coverage, risk, and receipt version as separate, independently sourced fields rather than a single combined claim. | Independent-label fixture and rendered dashboard tests.

**No coverage claim shown for inadequate evaluation data.** The dashboard shows no numeric coverage, calibration or deployment claim when the underlying evaluation is synthetic-only, missing, or underpowered. | Negative fixture tests for each of the synthetic-only, missing, and underpowered cases.

**Tenant or purpose change invalidates cached decision queries.** Changing tenant or purpose invalidates any cached decision or evaluation query, and a stale response can never overwrite a result from a newer selection. | Two-tenant browser test exercising cache invalidation and stale-response ordering.

**Explanation views work without color, hover or pointer.** Every part of the decision explanation structure is usable without relying on color alone, hover-only reveal, or pointer-only controls. | Keyboard and accessibility tests covering the full explanation structure.

**Decision explorer surfaces premises, derivations and violations.** The decision explorer presents a selected decision's premise classes, derivations, certificate, why-not explanation and violations through the WebUI, backed by typed calls to the Graph OS read API. | Component tests cover the explorer's rendering logic, plus a browser integration test against an authenticated Keycloak-backed Graph OS session.

**Mobile-first Markets app with five-destination navigation (rollup).** Split into `FIN-UI-R001.1` (detail-tab support) and `FIN-UI-R001.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Detail-tab support model.** A typed detail-tab support model determines which of the six detail tabs (Chart, Rates, News, Notes, Dividends, Analysis) an instrument's series capabilities allow. | Verified by `detail-support.test.ts` asserting each capability combination yields the correct supported/unsupported tab set.

**Live Markets app wiring (remaining).** The remaining scope: wiring the five-destination navigation, instrument groups, sparkline rows, the detail view's six tabs gated by `FIN-UI-R001.1`, range selector, and performance-versus-benchmark card into the live Markets app, with PWA install, theming, and accessibility. | Verified by a responsive browser test across phone and desktop viewports confirming the navigation, group and detail views, and accessibility behavior.

**Shared ChartRenderer for line, candle, and overlay data (rollup).** Split into `FIN-UI-R002.1` (ChartRenderer contract) and `FIN-UI-R002.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Shared ChartRenderer input contract.** A typed shared ChartRenderer input contract validates line versus complete OHLC candle series, defines decimation that provably never alters finalized trail/flip/state output, and a versioned, simulation-flagged overlay marker type. | Verified by `chart-contract.test.ts` asserting decimated and full-resolution views of the same fixture produce identical finalized trend and overlay output.

**Live ChartRenderer wiring (remaining).** The remaining scope: wiring the shared ChartRenderer contract into the live ChartRenderer/ChartPage components — rendering line/area and candle series with a volume pane, drawing overlays for trend lines/flips, DCA buys, cost basis, and margin/liquidation levels, and touch crosshair/pinch-zoom interaction. | Verified by a chart-rendering test comparing full-resolution and decimated views of the same fixture and asserting identical finalized trend and overlay output.

**Responsive five-destination navigation.** The application presents five top-level destinations as a bottom navigation bar on narrow viewports and as a side rail on desktop, keeping the selected route and keyboard focus coherent across layouts. | Verified by a responsive browser test at phone and desktop widths confirming the correct navigation chrome and consistent selection and focus.

**Instrument groups with distinct data states.** User-defined instrument groups and their Basic/Holdings mode preserve the selected group and mode, and the UI visibly distinguishes loading, genuinely empty, stale, partial, permission-denied, and unavailable results rather than collapsing them into one state. | Verified by a component test driving each data state from a fixture and asserting a distinct, correctly labeled rendering for each.

**Search resolves by stable identity, not ticker text.** Instrument search and selection key off stable instrument and listing IDs together with venue and quote currency, so a ticker symbol alone never identifies or disambiguates an instrument. | Verified by a test using two identically ticked instruments on different venues and asserting search and detail views keep them distinct by ID.

**Instrument rows show price, provenance, after-hours value.** Instrument rows and detail views display the current price with session and source provenance, the previous close, price change, a sparkline, a licensed logo or text fallback, and a separately labeled after-hours value when one is supplied. | Verified by a fixture-driven test covering regular, pre-market, post-market, delayed, and missing quotes, asserting each field renders correctly and a missing price is never shown as zero.

**Detail tabs and range controls expose only supported data (rollup).** Split into `FUI-05.1` (supportedChartMode) and `FUI-05.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Pure supportedChartMode gating function.** A pure `supportedChartMode` function gates interval/data-type/volume combinations for the detail view, returning an explanatory reason when a combination is unsupported. | Verified by `chart-contract.test.ts` and `detail-support.test.ts` driving valid and unsupported timeframe/data-type combinations and asserting the correct supported state and reason.

**Live detail-tab/range-control wiring (remaining).** The remaining scope: wiring `supportedChartMode` into the live detail view's tabs, range controls, and line/candle/volume toggle so unsupported options are hidden or explained in the running UI rather than only in fixtures. | Verified by a test driving valid and unsupported timeframe and data-type combinations and asserting unsupported options are hidden or explained rather than silently rendered.

**Shared ChartRenderer preserves gaps and revisions.** One typed ChartRenderer, shared with the Atlas renderer, draws scalar line/area series and complete OHLC candles, preserves data gaps and bar revisions by ID rather than smoothing over them, and performs no authoritative indicator computation of its own. | Verified by a unit and browser test asserting candle mode only accepts valid OHLC bars, gaps persist, a revised bar replaces the prior one by ID, and no indicator values originate client-side.

**Chart overlays show strategy version and simulation state (rollup).** Split into `FUI-07.1` (overlay marker type) and `FUI-07.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Overlay marker version/simulation-flag type.** Chart overlay markers carry a strategy version and simulation flag; `overlayLabel` tags simulated results distinctly from finalized ones. | Verified by the batch-2 contract tests asserting overlay markers carry the correct version and simulation label for a finalized trend flip, DCA buy, cost basis, and simulated margin level.

**Live chart overlay wiring (remaining).** The remaining scope: wiring the versioned, simulation-flagged overlay marker type into the live chart overlay rendering for trend lines/flips, DCA buys, cost basis, and margin/liquidation levels. | Verified by a test comparing full-resolution and decimated chart views on a fixture with a finalized trend flip, DCA buy, cost basis, and simulated margin level, asserting markers align to the correct bars and versions.

**Performance cards render owner-calculated values verbatim (rollup).** Split into `FUI-08.1` (verbatim-value contract) and `FUI-08.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Performance/benchmark card verbatim-value contract.** Performance and benchmark cards reproduce the owning service's decimal string verbatim, with explicit unavailable and stale states, and no client-side recomputation. | Verified by the batch-2 contract-fixture tests with multi-currency cash flows, dividends, splits, fees, and a stale valuation, asserting no client-side recomputation.

**Live performance/benchmark card wiring (remaining).** The remaining scope: wiring the verbatim-value contract into the live performance and benchmark card components, including return method, currency, source, as-of time, and session display. | Verified by a contract-fixture test with multi-currency cash flows, dividends, splits, fees, and a stale valuation, asserting the UI reproduces the owner's decimal-string output with no client-side recomputation.

**Strategy views cite evidence and never submit orders (rollup).** Split into `FUI-09.1` (evidence/abstain contract) and `FUI-09.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Strategy view evidence/abstain contract type.** Strategy recommendation view types cite versioned evidence or an explicit abstain reason, and contain no order-submission field by construction. | Verified by the batch-2 fixture tests covering a calibrated proposal, thin history, warmup, drift, and a missing scorecard.

**Live strategy/recommendation view wiring (remaining).** The remaining scope: wiring the evidence/abstain contract type into the live strategy and recommendation views, confirming no order-submission path exists in the rendered UI. | Verified by a fixture test covering a calibrated proposal, thin history, warmup, drift, and a missing scorecard, asserting the shown evidence and abstention reason and confirming no order request originates from the panel.

**DCA and alert views distinguish delivery states (rollup).** Split into `FUI-10.1` (delivery-receipt dedupe) and `FUI-10.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**DCA/alert delivery-receipt dedupe contract.** DCA and alert delivery receipts dedupe a duplicated event ID or channel retry; a paper fill is never reported as a live fill. | Verified by the batch-2 fixture tests exercising due, missed, failed, replayed, paper-filled, and delivered states including a duplicated event ID and channel retry.

**Live DCA/alert delivery-state wiring (remaining).** The remaining scope: wiring the delivery-receipt dedupe contract into the live DCA and alert views so each state renders as a visibly distinct outcome. | Verified by a fixture test exercising each state, including a duplicated event ID and a channel retry, asserting the states and receipts remain distinct and a paper fill is never shown as a live fill.

**CSV import preview with idempotent receipt (rollup).** Split into `FUI-11.1` (CSV import contract) and `FUI-11.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**CSV import preview contract mirroring the SDK.** CSV import preview types mirror `agent_connector_sdk.finance.csv_import`, modeling column-mapping errors and idempotent re-import keyed by file digest. | Verified by the batch-3 CSV fixture tests with mapped and unmapped columns, a malformed row, and a duplicate digest.

**Live CSV import preview wiring (remaining).** The remaining scope: wiring the CSV import preview contract into the live import flow, including post-import holdings display from the owning service's response. | Verified by a CSV fixture test with mapped and unmapped columns, a malformed row, and a duplicate digest, asserting preview counts, idempotent receipts, and owner-sourced holdings.

**Offline PWA shell marks cached data stale (rollup).** Split into `FUI-12.1` (offline cache contract) and `FUI-12.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Offline cache staleness contract.** An offline cache view type marks data stale and disables current-state actions while offline or expired. | Verified by the batch-3 offline-cache fixture tests.

**Live offline PWA shell wiring (remaining).** The remaining scope: wiring the offline cache staleness contract into the live installed PWA shell so previously cached financial facts display while offline, marked stale, with current-data actions disabled. | Verified by an offline test loading a previously valid finance view without network access and asserting cached values are labeled stale and current-data actions are unavailable.

**Charts and controls meet accessibility requirements (rollup).** Split into `FUI-13.1` (accessibility contract) and `FUI-13.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Chart accessibility text-summary contract.** A chart accessibility contract defines a screen-reader text summary and non-color direction words for chart state. | Verified by the batch-3 accessibility contract tests.

**Live chart/control accessibility wiring (remaining).** The remaining scope: wiring the accessibility text-summary contract into the live charts and controls — keyboard operation, 200% zoom, reduced-motion, and non-color state indicators. | Verified by an accessibility review combining keyboard-only operation, screen-reader inspection, 200% zoom, reduced-motion, and high-contrast checks against each chart and control.

**GraphOS Markets app with scanner, search, and layered chart.** A GraphOS-hosted Markets application provides a market overview, a scanner with filters, symbol search, and a layered chart view, reusing the shared Atlas OHLC ChartRenderer and the epistemic-graph engine's large-dataset decimation, and exposes its market actions as WebMCP tools. | Verified by an integration test driving the scanner, search, and chart views against fixture market data and confirming the WebMCP tool calls return the expected results.

**Generated GraphOS API client with typed decisions and confirmation flows.** Agent-webui generates a versioned TypeScript client and a single invoke adapter from the Graph OS API schema, and migrates decisions, Markets/apps pages and WebMCP tools to call it; the console confirmation page sends only the exact server-issued plan reference required to complete a previewed effect. | Contract tests against the generated client plus positive and negative effect tests on the confirmation flow verify this.

**Typed ontology, graph, Atlas and object-set operations replace host routes.** Agent-webui's api_extensions.py ontology, graph, Atlas and object-set route blocks, and their corresponding src callers, are replaced by generated Graph OS operations that preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixture tests and browser tests covering each migrated route family confirm parity with the prior behavior.

**Remaining domain routes migrate to generated operations with a route census (rollup).** Split into `WEBUI-API-R003.1` (route-census typed model) and `WEBUI-API-R003.2` (route-census data file and lint rule), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Route-census typed model.** A typed `RouteCensusEntry` model with a strict disposition enum records each route's owning operation, refusing a `generated-operation` row that omits its owning operation. | Verified by `route-census.test.ts` asserting the refusal and disposition-enum behavior.

**Route-census data file and lint rule (remaining).** The remaining scope: a checked-in route census data file populated for every `api_extensions.py` domain route family, plus an architecture lint rule run in CI that rejects any new unclassified domain route. | Route-census and contract tests plus the lint rule running in continuous integration confirm no unclassified domain route remains.

**Each request carries its own correlation id.** The host mints a fresh correlation id for each HTTP request and WebSocket connection without an inbound `x-correlation-id`. An ambient id bound on the serving thread never leaks into a request. | An observability test binds an ambient id, serves two requests, and confirms two distinct ids that differ from the ambient one.

**Generated TypeScript client from a pinned Graph OS schema.** Agent-webui generates its TypeScript types and client from a pinned Graph OS v1 API schema and digest, exposing one invoke adapter and a stable error envelope for all callers. | A regeneration-diff check plus contract tests confirm the generated client matches the pinned schema and envelope.

**Typed operations preserve preview-confirm-step-up for effects.** Decisions, Markets/apps pages, WebMCP tools and the console confirmation flow in agent-webui call typed Graph OS operations through the generated client, preserving the preview, confirmation and step-up sequence required before any side-effecting action executes. | Positive and negative effect tests exercise the preview, confirm and step-up sequence end to end.

**Ontology, graph, Atlas and object-set operations preserve tenant semantics (rollup).** Split by code root into `APIUI-03.1` (ontology), `APIUI-03.2` (graph), `APIUI-03.3` (Atlas) and `APIUI-03.4` (object-set), producer first. This row is LANDED only when all four children are LANDED. | Each child's own verification row; see below.

**Ontology reads and writes use typed Graph OS operations with preserved tenant semantics.** Agent-webui's ontology callers (schema graph, catalogue, import/export, registry types and interfaces) in `agent/agent_webui/api_extensions.py` and their `src` counterparts call typed Graph OS operations that preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixtures and a browser test confirm ontology-read parity after migration.

**Graph reads and writes use typed Graph OS operations with preserved tenant semantics.** Agent-webui's graph callers in `agent/agent_webui/api_extensions.py` and their `src` counterparts call typed Graph OS operations that preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixtures and a browser test confirm graph-read/write parity after migration.

**Atlas reads and writes use typed Graph OS operations with preserved tenant semantics.** Agent-webui's Atlas callers in `agent/agent_webui/api_extensions.py` and their `src` counterparts call typed Graph OS operations that preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixtures and a browser test confirm Atlas parity after migration.

**Object-set reads and writes use typed Graph OS operations with preserved tenant semantics.** Agent-webui's object-set callers (`ObjectExplorerView`, `ObjectView`) in `agent/agent_webui/api_extensions.py` and their `src` counterparts call typed Graph OS operations that preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixtures and a browser test confirm object-set parity after migration.

**Prompts, SDD, knowledge base, sessions and goals migrate to typed calls.** Agent-webui's prompts, SDD, knowledge base, sessions, goals, MCP servers/tools and model-management features call typed Graph OS operations in place of host-owned routes. | A route census and contract tests confirm each family is covered by a generated operation.

**Host drops direct internal imports once replacement operations are proven.** Agent-webui removes direct internal imports and domain route handlers from its host once the replacement Graph OS operations are proven, keeping only an explicitly inventoried set of browser-local endpoints. | A static dependency check and route-census gate confirm no forbidden import or unlisted domain route remains.

**Shared auth and streaming are preserved without exposing a service bearer.** Agent-webui preserves shared authentication, credential delegation, streaming and cancel behavior, and error handling across the migration, and never exposes a Graph OS service bearer token to browser JavaScript. | Host integration tests and adversarial browser tests confirm the bearer is never exposed and behavior is preserved.

**Failure logs carry a sanitized typed error code.** `_log_failure` in api_extensions.py logs the operation label, exception type and an `error_code`. The code comes from the `engine_error_code` or `code` attribute. A value that is not an upper-case token of 64 characters or fewer is logged as `none`. Message text never reaches the log. | tests/test_log_failure_error_code.py confirms `ACCESS_DENIED` is logged, malformed codes log `none`, and message text is absent.

**Browser identity consistently reads GraphOS across titles and assets.** Agent-webui's page titles, metadata and web manifest present the GraphOS product identity. Generated assets, theme tokens, UI copy and the published Pages site present the same identity. | Asset regeneration, a rendered snapshot test and the Pages build confirm consistent branding.

**Package, import and environment naming stay on the component identity.** Package and import names remain `agent-webui` and `agent_webui`. Npm metadata, release images, WebMCP identifiers, skills, browser storage, consent keys and environment variable names stay unchanged. Only user-visible strings carry the Graph OS brand. Operator decision 2026-10-09: only front-end-facing items are renamed to Graph OS; agent-webui stays the component name. | Build and wheel tests confirm the component identifiers are unchanged while user-visible strings read Graph OS.

**AppSurface contract declares each app's route, capability and client.** Agent-webui exposes Apps as a single section in nav-registry.ts, where each app declares its route, required capability, typed service client, WebMCP page and optional Atlas renderer through one AppSurface contract. | Contract tests and a route-census test confirm every registered app conforms to the AppSurface shape.

**Contributed app descriptors cannot escalate privilege beyond the contract.** Native apps and validated package-contributed apps resolve to the same AppSurface shape. Untrusted or malformed descriptors cannot register executable code or arbitrary URLs. They cannot grant capabilities beyond the contract. | Tests that submit invalid descriptors and denied capabilities confirm they are rejected.

**Markets consumes the AppSurface contract without shell-side duplication.** Markets is the first app to consume AppSurface. The browser shell must not duplicate its scanner, chart or gateway wiring. | A first-consumer integration test confirms Markets runs through the shared contract alone.

**No browser-state migration is required by the rebrand.** Because storage and consent keys keep their component names, existing browser state and granted permissions stay valid. Any future key change must expire or migrate them with explicit renewed consent. Operator decision 2026-10-09: only front-end-facing items are renamed to Graph OS. Agent-webui stays the component name. | Browser test confirms existing consent and storage survive the user-visible rebrand.

**App navigation supports accessibility and layout states across devices.** Navigation between apps in agent-webui works with keyboard, touch and reduced-motion input across mobile and desktop layouts. Each app surface presents explicit loading, unavailable and denied states. | An end-to-end accessibility test suite confirms these interaction modes and states.

**Apps information-architecture section and AppSurface contract.** Agent-webui introduces an Apps section in its navigation information architecture and a reusable AppSurface contract that binds each app's route, capability, typed client, WebMCP page and optional Atlas renderer to the existing shell. | Contract and route-census tests confirm the shared shell binds every declared app surface correctly.

**Graph OS brand layer covers user-visible strings.** Page titles, metadata and the web manifest name and short name must present the Graph OS brand. The Open Graph card, UI copy and user-facing documentation headings must present the Graph OS brand. Operator decision 2026-10-09: only front-end-facing items are renamed to Graph OS; agent-webui stays the component name. | A rendered snapshot test and asset checks confirm user-visible strings read Graph OS.

**Repository, package and runtime identifiers are not renamed.** The repository, distribution, Python import path and npm package keep the agent-webui identity. The WebMCP identifiers, skills, browser storage keys, consent version, environment variables and release image keep it too. Operator decision 2026-10-09: only front-end-facing items are renamed to Graph OS; agent-webui stays the component name. | Build and packaging tests confirm the identifiers are unchanged.

**Run harness surface is read-only and honest.** The agent-webui client must show a run's current plan, context use against budget, applied harness configuration, cost and termination reason. The client reads only graph-os operations. | Children WEBUI-APPS-R004.1 to WEBUI-APPS-R004.6.

**Run read goes through the graph-os read operations.** The client run view must read `runs.get` and `runs.metrics` (the `GRAPHOS-OPS` rows for run metrics). The client must not call the engine and must not compute these values. | `tests/x::test_run_read_uses_graphos_operations`

**Applied harness configuration is shown.** The run view must show the run's `harness_config`: `context_policy`, `plan_scaffold` and `action_space`. A missing field must read "not available". | `tests/x::test_harness_config_shown`

**Context use is shown against the budget.** The run view must show `peakContextTokens` against `contextBudgetTokens` and the cost `costUsd`. An absent field must read "not available", never zero. | `tests/x::test_context_and_cost_shown`

**Current plan is shown read-only.** The run view must render the current plan from the run's plan state. The view must offer no edit control. | `tests/x::test_plan_read_only`

**Each termination reason has a distinct state.** The run view must map each `terminationReason` (`final_answer`, `context_overflow`, `stuck`, `step_budget`, `error`) to its own label. `context_overflow` and `stuck` must not appear as a generic failure. | `tests/x::test_termination_reasons_distinct`

**Absent operation shows an honest state.** When `runs.get` or `runs.metrics` is absent or refused, the run view must show "not available" and no fabricated value. | `tests/x::test_absent_operation_not_available`

**Navigation and dashboards follow the signed-in user's role.** Agent-webui must show each signed-in user only the navigation and dashboard content that the user's role allows, and must keep each user's own dashboard layout. Rollup: LANDED when every `WEBUI-APPS-R005.<n>` child is LANDED. | A two-principal browser test shows different navigation and separate layouts, and the children pass.

**Nav entry declares a minimum role.** Each entry in src/lib/nav-registry.ts must declare a minimum role from admin, maintainer, user or reader. | src/lib/__tests__/nav-registry.test.ts: entries without a role fail; a reader sees no admin entry.

**Layout saved per user.** DashboardView must save and load the dashboard layout per principal through a typed Graph OS preference operation. It must report not available when the operation is absent. | src/components/views/__tests__/DashboardView.test.tsx: two principals keep separate layouts; absent operation shows not available.

**Connector tiles from the catalog.** The dashboard must offer one tile per connector in the Graph OS connector catalog. It reads connection state from Graph OS and holds no credential in the browser. | src/components/views/__tests__/DashboardConnectorTiles.test.tsx: tile per catalog entry; storage holds no credential.

**One chat session list.** The floating chat button and the navigation chat view must read the same session list. The first task locates both components. | src/components/__tests__/chat-session-sync.test.tsx: a session created in one appears in the other.

**Every route renders.** A render census test must mount every registered route and fail when any route shows the error boundary. | src/lib/__tests__/route-render-census.test.tsx: all routes render; an injected throwing view fails the test.

**Each view states its purpose.** Each registered view must show a one-sentence purpose from its nav registry entry. The census must fail on a missing one. | src/lib/__tests__/nav-registry.test.ts: every entry has a purpose of at most 20 words.

**One panel relates goals, sessions and fleets.** Agent-webui must offer one panel that relates goals, sessions and fleets, drawn only from identifiers that Graph OS returns. Rollup: LANDED when every `WEBUI-APPS-R006.<n>` child is LANDED. | A browser test filters the panel by goal and the children pass.

**Link type.** The panel must define a typed goal-session-fleet link built from returned identifiers in src/types. | src/lib/__tests__/goal-link.test.ts: a link with an unknown identifier is rejected.

**Panel reads typed operations.** The panel must read goals, sessions and fleets through the generated Graph OS client calls of `APIUI-04`. | src/components/views/__tests__/GoalPanel.test.tsx: three calls, no direct fetch.

**Absent operation is honest.** The panel must show not available for any absent or refused operation, and must invent no link. | src/components/views/__tests__/GoalPanel.test.tsx: refused fleets call shows not available.

**Graph view edits go through the engine and refusals show.** The graph view must render nodes and edges as a pan and zoom force layout with semantic filters. It must send add, edit and delete requests to graph-os and show the engine verdict, never a local edit. Persona modes must change only presentation. | Children WEBUI-APPS-R030.1 to WEBUI-APPS-R030.7.

**Model.** `src/lib/graph-edit.ts` (new) must define `GraphEditRequest` (`add`, `update`, `delete`; node id; labels; properties), `GraphEditVerdict` (`applied`, `refused`, `unavailable`) and `ViewPersona` (`operator`, `analyst`, `reader`). No store type exists for these today. | `src/__tests__/graph-edit-types.test.ts::test_edit_types_closed`

**Behavior.** `src/lib/graph-edit.ts` must expose `sendGraphEdit` as a named export. Through `gatewayPost`, use the installed GraphOS registry contracts `eg.graph.AddNode`, `eg.graph.ApplyMutation` and `eg.graph.RemoveNode`, with generated request schemas, at `POST /api/v1/ops/{op_id}`. GraphOS binding, invocation and HTTP owners are `GRAPHOS-OPS-R008`, `GRAPHOS-OPS-R009` and `GRAPHOS-OPS-R013`; the served version-checked mutation owner is `EG-DURABLE-KERNEL-R084.3`. Return the engine verdict; missing or incompatible installed contracts are unavailable. `EG-TYPED-PACKS-R088` covers embedded read parity and does not establish this served write proof. | `src/__tests__/graph-edit-send.test.ts::test_send_returns_engine_verdict`

**Wiring.** `GraphView.tsx:792`, `:796` and `:801` define `handleUpdateNode`, `handleDeleteNode` and `handleAddNode`, which only change React state and call no server. The caller is `GraphCanvas.tsx:605-609` through `onUpdateNode`, `onDeleteNode` and `onAddNode`. No production caller reaches an engine write today. This row replaces the three bodies with `sendGraphEdit` and changes local state only after an `applied` verdict. | `src/__tests__/graph-edit-wiring.test.tsx::test_handlers_call_send_graph_edit`

**Refusal.** When the engine refuses an edit for lack of permission, `GraphView.tsx` must keep the node unchanged and show the refusal reason. When the operation is absent, it must show `not available`. The identity owner is `GRAPHOS-IDENTITY`; the client must not decide authorization. | `src/__tests__/graph-edit-refusal.test.tsx::test_unauthorized_edit_refused_and_unchanged`

**Behavior.** The view must offer semantic filters by node type and by label text through `typeFilter` (`GraphView.tsx:272`). It must offer a persona mode that selects a default filter and detail level. `GraphCanvas.tsx:379` already runs the force layout, with pan and zoom. A persona must not widen what the engine returns. | `src/__tests__/graph-persona-filter.test.tsx::test_persona_changes_presentation_only`

**Evidence.** Each edit must record the request, the verdict and the engine reason in the view's visible edit log. A refused or unavailable edit must appear there with its reason. | `src/__tests__/graph-edit-log.test.tsx::test_log_records_each_verdict`

**Served end-to-end proof.** Start the real WebUI host, authenticated GraphOS operation host and a disposable durable fixture engine. From the rendered graph overlay, save and delete through `sendGraphEdit`, `gatewayPost` and the actual registered operations from R030.2. Do not mock the client, gateway, host handler or engine transport. With an unauthorized principal, assert the visible refusal. Independently read the durable graph. No node, property or edge may change. With an authorized principal, assert the accepted value and durable readback after reload. Component tests alone cannot satisfy this row. | `e2e/graph-edit-served.spec.ts::overlay_edit_reaches_durable_engine` (planned)

**Memory state shows as Markdown files that sync with the graph.** List the hosted observations, reflections, profile and active-context documents and render EG synchronization evidence. An authorized retained conflict preserves both versions without overwriting the accepted head. A refusal reveals no head metadata. | Children WEBUI-APPS-R031.1 to WEBUI-APPS-R031.7.

**Model.** Planned `src/lib/memory-files.ts` consumes generated snapshot and tagged outcome schemas from `EG-DURABLE-KERNEL-R085.1` through `GRAPHOS-OPS-R024.4.1`. `MemoryFileKind` is observations, reflections, profile or active_context. `MemoryFile` maps the authorized document identity, logical path, revision, digest and sync state without a second permissive wire schema. `MemorySyncState` includes in_sync, graph_ahead, file_ahead, conflict and unavailable. Refused is a separate head-free variant. No file-sync client exists on current main. | `src/__tests__/memory-files-types.test.ts::test_memory_file_types_closed` (planned)

**Behavior.** Planned named exports `listMemoryFiles`, `readMemoryFile` and `saveMemoryFile` reuse `src/lib/graphos-api/invoke.ts` and generated schemas under `WEBUI-API-R001`. Bind proposed `memory.files.list`, `memory.files.read` and `memory.files.save` exactly to `GRAPHOS-OPS-R024.4.1–.3` and `.6`, backed by `EG-DURABLE-KERNEL-R085.1–.4`. Preserve exact revision/digest, bytes, explicit absent-head creation and submit/resolve tags. Fetch content only through authorized read; restart refused/expired pagination explicitly. Saves bind idempotency identity to the exact request. Browser callers cannot submit observe_file or acknowledge_materialization. Generic memory.read/write and Memory-node CRUD are not versioned synchronization. | `src/__tests__/memory-files-ops.test.ts::test_generated_operations_preserve_preconditions` plus `e2e/memory-files-served.spec.ts::authorized_snapshots_and_cursor_refusal` (planned)

**Wiring.** `MemoryView.tsx:439` currently lists Memory nodes at `:461` and writes legacy `/api/enhanced/graph/memory` routes. Navigation mounts the view from `nav-registry.ts:664`. Add the Files tab beside browse (`MemoryView.tsx:610`) using the named exports and canonical invoke adapter, whose endpoint is `POST /api/v1/ops/{op_id}`. Prove the real same-origin host reaches registered GraphOS operations under `GRAPHOS-OPS-R024.4.2/.6`. Reuse the operation transport. Do not assume gatewayPost, which prefixes the graph facade, serves this endpoint. Cancel or discard obsolete responses after document, tenant, graph or principal changes; clear protected content on access loss. Missing registration/schema/host transport renders not available. | `src/__tests__/memory-files-wiring.test.tsx::test_files_tab_uses_canonical_invoke` plus `e2e/memory-files-served.spec.ts::navigation_reaches_registered_memory_operations` (planned)

**Refusal.** Render both immutable contents and digests only for an authorized conflict_retained outcome and authorized subsequent reads under `EG-DURABLE-KERNEL-R085.3/.5/.7` and `GRAPHOS-OPS-R024.4.3/.5`. Retention must survive restart without changing the accepted head; resolve requires current-head and retained-conflict references. Refused exposes only registered error code and request-local correlation. It withholds existence, revision, digest, conflict reference and stored receipt from errors, activity entries and stale UI state. Denied existing, absent and creation responses have equal disclosure. Retention failure must not claim conflict preservation. Recheck authorization on replay and conflict reads; clear protected versions on revocation. | `src/__tests__/memory-files-conflict.test.tsx::test_authorized_conflict_and_head_free_refusal` plus `e2e/memory-files-served.spec.ts::denied_reads_creates_and_replays_are_redacted` (planned)

**Behavior.** The Files tab must show each file's `MemorySyncState` with a distinct label per state. A file with a missing state must read `not available`, never `in_sync`. | `src/__tests__/memory-files-state.test.tsx::test_each_sync_state_has_label`

**Evidence.** Authorized save results show the returned digest, verdict and time; authorized conflict views show both retained digests. Refused entries show only registered error code and request-local correlation. Never reconstruct missing metadata from an earlier authorized result. Client save success or local timestamps do not establish synchronization. | `src/__tests__/memory-files-evidence.test.tsx::test_save_evidence_respects_outcome_authority` (planned)

**Served end-to-end proof.** Navigate the rendered Files tab through the actual WebUI host, GraphOS registered operations and authenticated durable fixture engine. Prove authorized snapshot reads, cursor rejection, competing saves, retained conflicts across restart and exact-head resolution. Independently read accepted content and retained artifacts. Exercise denied existing/absent/create and replay after revocation with head-free UI/errors. Under `EG-DURABLE-KERNEL-R085.6/.8` and `GRAPHOS-OPS-R024.4.4–.6`, delay a host acknowledgment. Observe a newer edit while the accepted head stays unchanged. Then deliver the old acknowledgment; it must not establish in_sync. Only an authenticated host acknowledgment matching current head, digest, observation generation and attempt establishes served in_sync. Pending edits/conflicts prevent it; missing evidence is unavailable. Browser acknowledgment attempts refuse. No mocked client, host handler, authorization, engine transport or persistence can satisfy this row. | `e2e/memory-files-served.spec.ts::file_conflict_preserves_both_versions` and `::stale_materialization_ack_never_shows_in_sync` (planned)

**Evolution evidence.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R004.7.1` through `WEBUI-APPS-R004.7.6` must pass their planned acceptance.

**Model.** Use generated proposal identity, prompt revision, agent identity, progress state and source RunTrace references. Keep measured run metrics separate from decision calibration and coverage. | Planned `e2e/evolution-evidence-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Show each optimization proposal beside its exact source runs and recorded progress. Preserve pending review and propose-only state. Never promote a prompt from this view. | Planned `e2e/evolution-evidence-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/views/ObservabilityView.tsx beside the existing run DAG. Resolve proposal and trace references through typed GraphOS reads. The existing runs.get and runs.metrics operations alone do not return the missing join. | Planned `e2e/evolution-evidence-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Missing proposal provenance, hidden traces or incompatible producer revisions show unavailable. Never infer progress from trace count or substitute WEBUI-DECIDE-R001 coverage. | Planned `e2e/evolution-evidence-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind the shown proposal revision, run IDs, trace digests, metric window and producer schema revision. Label incomplete source sets. | Planned `e2e/evolution-evidence-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** A real served proposal must lead from the dashboard to its authorized stored traces and measured outcomes. Denied traces must reveal no metrics or proposal progress. | Planned `e2e/evolution-evidence-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Unified harness sessions.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R006.4.1` through `WEBUI-APPS-R006.4.6` must pass their planned acceptance.

**Model.** Consume the versioned host supported-harness manifest and discovery status for every manifest entry. Session identity includes source harness, source session ID, tenant and authoritative indexed revision. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** On first use, show discovery and synchronization for every declared supported harness. Browse and search the unified authorized index with cross-session cost summaries. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/views/SessionsView.tsx and the R006 panel through the generated client. SDK discovers and syncs sources; EG owns indexes; GraphOS serves bounded search and discovery progress. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unsupported harnesses, denied sources and partial synchronization remain individually visible. Never claim complete discovery from one source or replace missing costs with zero. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Keep source coverage, sync cursor, index revision, query window, cost units and partial-result flags with every result page. Do not create a browser metric or session index. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** From a fresh browser, exercise every supported harness in the versioned owner manifest and search sessions without duplicate identities. Include at least two harnesses when the manifest contains two or more. Two examples alone do not prove manifest-wide coverage. Deny one source and prove visible partial coverage and no hidden-session disclosure. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Indexed usage analysis.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R004.8.1` through `WEBUI-APPS-R004.8.6` must pass their planned acceptance.

**Model.** Consume generated model, project and agent identities, input/output token counts and total usage cost. Preserve owner-defined cached/reasoning categories, accounting units and missing-value semantics. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Filter indexed history by model, project, agent and time window. Show producer aggregates and pagination. Label cost per solved task separately from total usage and context peak/budget. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/views/ObservabilityView.tsx using the canonical operation adapter. EG returns indexed accounting and groups; GraphOS serves the generated projection. Reuse existing model/task-class metrics. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unknown project/agent attribution, incomplete token accounting and zero-solved abstention remain explicit. Missing, nonpositive or nonfinite owner latency limits make bounded analysis unavailable. Never total overlapping token categories or manufacture project costs in JavaScript. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Retain aggregate definition, currency, accounting version, observation interval, source coverage and index watermark. Bind measured latency to an owner-published positive finite limit, units, measurement boundary, dataset size and contract revision. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Serve indexed model/project/agent queries over the owner-declared dataset and check independent stored accounting totals. Compare measured latency with the revision-bound positive finite owner limit. Test incomplete attribution, denied scope and absent, invalid or exceeded limits. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Live graph convergence.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R030.8.1` through `WEBUI-APPS-R030.8.6` must pass their planned acceptance.

**Model.** Consume authorized snapshot identity and ordered change events with graph incarnation, revision, cursor and event identity. A tombstone remains distinct from an inaccessible entity. | Planned `e2e/live-graph-convergence-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Apply committed changes to other connected clients without page refresh. Preserve selected nodes, camera and stable layout anchors during concurrent edits. | Planned `e2e/live-graph-convergence-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Attach the host subscription to src/components/views/GraphView.tsx and GraphCanvas. Use the existing host event transport with its generated contract; snapshot reads remain typed GraphOS operations. | Planned `e2e/live-graph-convergence-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Deduplicate events and reject revision regressions. A gap or expired cursor requires an authorized fresh snapshot. Missing, nonpositive or nonfinite latency/layout bounds make bounded live mode unavailable. Revocation clears protected graph state and stops the subscription. | Planned `e2e/live-graph-convergence-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Retain snapshot and event revisions and measure commit-to-visible latency. Bind latency and layout measurements to owner-published positive finite limits, metric definitions, units, workload and contract revision. Layout metrics must cover readability and frame timing; retain selection continuity evidence. | Planned `e2e/live-graph-convergence-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Two real browsers edit concurrently and converge before refresh within the owner latency limit. Compare layout measurements against owner limits under the declared workload. Test missing, invalid and exceeded bounds. Exercise duplicated, delayed and reordered events, reconnect and revocation; compare both views with independent durable readback. | Planned `e2e/live-graph-convergence-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Retrieval quality comparison.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.1.1` through `WEBUI-APPS-R001.1.6` must pass their planned acceptance.

**Model.** Consume EG evaluation identity, corpus revision, relevance-label revision, algorithm version, k, hits-at-k and context-span offsets. Keep result ranking separate from relevance labels. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Compare algorithms side by side for the same evaluation input. Show hits-at-k, safe n-gram highlights and context search with source references. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/table-explorer/TryItPanel.tsx through typed GraphOS evaluation reads. Its current SQL search legs and local rrfFuse do not establish authoritative evaluation metrics. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Missing labels, incompatible corpus revisions, invalid offsets and denied context show unavailable. Never compute quality from rank alone or treat local fusion as an EG retrieval decision. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Show numerator, denominator, k, corpus/label revisions, algorithm settings and query identity. Escape source text before highlighting and bound returned context spans. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** A real served fixed corpus and labels must produce independently checked hits-at-k for two algorithms. Test unlabeled data, cross-revision comparison and hostile highlight text without fake metrics. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Bounded large-data charts.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.2.1` through `WEBUI-APPS-R001.2.6` must pass their planned acceptance.

**Model.** Consume EG viewport bounds, pixel dimensions, bin revision, source cardinality, count/extrema and selection references. Scatter bins and line continuity have distinct generated result variants. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Pan, zoom and select scatter and line data with at least one billion source points. Render screen-bounded results, preserving gaps and producer-defined selection semantics. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend the existing shared Atlas chart renderer used by finance. Send viewport queries through typed GraphOS reads; EG performs binning and selection against its indexed source. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Reject stale viewport replies and invalid selection tokens. Refuse rendering when owner bin/byte limits or viewport dimensions are absent, nonpositive, nonfinite or schema-invalid. Never download the complete source, interpolate across declared gaps or report exact point selection from a bin summary. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Enforce owner-published positive finite bin-count and response-byte limits before rendering. Their versioned formulas must bind viewport dimensions and chart variant, independently of total source cardinality. Count limits use integers. Record formula revision, viewport dimensions, source cardinality, bins and bytes. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Serve a real indexed source of at least one billion points. Pan, zoom and select both chart variants. Measure bins and bytes against the owner viewport formulas and limits. Test absent, zero, negative, nonfinite and exceeded limits, stale responses and denied selections. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Column vector controls.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.3.1` through `WEBUI-APPS-R001.3.6` must pass their planned acceptance.

**Model.** Consume stable table/column IDs, schema revision, ColumnVectorBinding, embedder identity/dimension and versioned index statistics. Advice and binding state remain distinct. | Planned `e2e/column-vector-controls-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Offer explicit per-column bind/unbind controls and show index readiness, indexed-row count and owner-reported size/freshness. Read the authoritative binding after each accepted mutation. | Planned `e2e/column-vector-controls-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/views/TableExplorerView.tsx and src/components/table-explorer/SchemaTree.tsx. Use generated GraphOS list, stats and mutation bindings to existing EG column operations. | Planned `e2e/column-vector-controls-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Deny unauthorized mutations before effects. Stale schema, unsupported type or unavailable embedder leaves the binding unchanged. Advice must never activate a toggle automatically. | Planned `e2e/column-vector-controls-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind mutation verdict and readback to column ID, schema revision, embedder and index generation. Missing statistics remain unavailable, never fabricated zeros. | Planned `e2e/column-vector-controls-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Use an authenticated browser to bind a text column and read actual index statistics through GraphOS and EG. Deny a writer and submit a stale schema; prove unchanged bindings and no embedding effects. | Planned `e2e/column-vector-controls-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Remote editor compatibility.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.4.1` through `WEBUI-APPS-R001.4.6` must pass their planned acceptance.

**Model.** Consume a versioned host compatibility manifest naming editor protocol, extension IDs/versions, supported capabilities and keybinding profiles. Keep remote workspace identity scoped to the session. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Expose supported extension installation/use and keyboard shortcuts within the existing embedded workbench. Resolve shortcut focus between shell and editor without silently swallowing commands. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Reuse src/components/views/WorkspaceIDEView.tsx at /ide and its editor-context bridge. GraphOS owns workbench hosting and extension admission; the browser must not install a second editor. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unsupported extensions, incompatible versions and denied workspace access show explicit refusals. Untrusted workspaces cannot gain host privileges or access another workspace through the bridge. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Record workbench and manifest versions, extension verdicts, keybinding profile and workspace revision. Keep service credentials out of frame messages and browser state. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Open an authenticated remote workspace and exercise one declared extension and shortcut in a real browser. Test incompatible extensions, reserved shortcut focus and cross-workspace access denial. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Meeting transcripts and summaries.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.5.1` through `WEBUI-APPS-R001.5.6` must pass their planned acceptance.

**Model.** Consume meeting ID, segment ID, sequence, correction revision, timestamps and finalization state. Summary requests bind final transcript revision, admitted provider identity and local/hosted execution class. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Show live partial/final segments and ordered corrections. After meeting finalization, let the user select an available local or hosted summary provider and request a summary. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Add the meeting consumer through existing AppSurface and host transport. SDK owns live transcription/provider transport; EG owns context and summary admission; GraphOS serves their generated contracts. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Keep src/hooks/useVoiceDictation.ts single-shot behavior honest. Denied capture, missing streams, sequence gaps or absent providers remain distinct. Never silently move a local-provider request to a hosted service. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind summary content and citations to final transcript revision, provider/model revision and admitted execution receipt. Corrections invalidate stale summaries visibly. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** In a real browser, receive segments and corrections, finalize, then select local and hosted providers separately. Check actual provider routing and summary provenance. Denied egress and stale transcript requests produce no summary effects. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Bookmark knowledge views.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.6.1` through `WEBUI-APPS-R001.6.6` must pass their planned acceptance.

**Model.** Consume bookmark/source IDs, ingestion provenance, semantic-index revision, authorized relationships and bounded export schema. Reuse the existing SDK bookmark envelopes and extraction vocabulary. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Search and filter bookmarks by meaning; render their authorized relationships as an interactive mindmap. Offer CSV and JSON export for the selected authorized query snapshot. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Use existing AppSurface, GraphView/GraphCanvas and generated GraphOS reads/export delivery. EG owns semantic indexing and relationship decisions. Do not duplicate SDK offline ingestion in the browser. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Denied nodes, stale cursors and unavailable semantic indexes reveal no hidden counts or relationships. Never fetch embedded URLs or run imported instructions. Exports must not widen the selected scope. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind search, mindmap and exports to one query/snapshot revision, source provenance, format version and content digest. Preserve unknown metadata and escape CSV formula-like cells safely. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Import bookmarks through SDK R005.7–.12, then use real browser semantic filtering, mindmap and CSV/JSON export. Independently compare stored records and downloaded bytes; deny one bookmark and prove exclusion everywhere. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Sandboxed design artifacts.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.7.1` through `WEBUI-APPS-R001.7.6` must pass their planned acceptance.

**Model.** Consume host-discovered executable identities and capabilities, EG-admitted skill sequence and immutable generated artifact references. Bind artifacts to execution, skill and source revisions. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Let the user select available coding-agent capabilities for a design flow and inspect skill-transformation progress. Render the resulting artifact only through the existing sandboxed frame. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Reuse src/components/mcp/McpAppFrame.tsx and McpAppHost.tsx. GraphOS discovers PATH executables and hosts effects; EG selects composition; AU runs admitted skills. The browser never probes PATH or chooses policy. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unavailable executables or refused transformations produce no success preview. Validate artifact digest, origin and message schema. Block parent DOM, credential access, popups and unauthorized network/navigation. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Show execution and transformation references with the rendered digest. Preserve producer refusal and cancellation; frame rendering alone is not proof of a completed transformation. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Serve an admitted design flow through actual host discovery and execution to the sandbox frame. Compare the artifact digest with durable provenance; test substituted artifacts and hostile scripts without parent or network escape. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Interactive code explanations.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.8.1` through `WEBUI-APPS-R001.8.6` must pass their planned acceptance.

**Model.** Consume query/repository revision, ordered walkthrough steps, source spans, self-contained artifact manifest/digest and execution-note sequence references. Keep explanation notes distinct from private model reasoning. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Show a linear source-linked walkthrough and interactive explanation artifact for the same query output. Show ordered graph-persisted execution notes with provenance links. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Reuse existing code navigation and the R001.7 frame boundary. GraphOS serves generated explanation output and note subscriptions; EG owns source and provenance identity; AU emits admitted execution notes. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Missing source revisions, invalid manifests, stale notes and denied source spans show unavailable. Reject unmanifested external artifact dependencies; never synthesize a successful explanation from a generic span tree. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind walkthrough, artifact bytes and note stream to one query and repository revision. Label disconnected streams and retain sequence/correction identities without exposing hidden source content. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** From a real served code query, inspect source-linked steps and load the artifact with external network blocked. Independently read graph notes and compare artifact bytes; reject wrong-revision outputs and unauthorized source links. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Identity mode wizard shows the active auth mode with no hidden bypass.** Agent-webui's identity mode wizard displays whether OIDC, local authentication or loopback bootstrap is configured along with a diagnostic check result, and no mode can silently bypass authentication. | Mode-specific rendered and server tests confirm each mode displays correctly and no bypass is possible.

**Local account flows use server sessions with no stored credentials.** Agent-webui's local registration, login, logout, forgot-password, reset-password and change-password flows use server-managed sessions with anti-CSRF protection, and no credential or bearer token is stored in browser persistence. | End-to-end session-fixation and CSRF probe tests confirm no credential leaks into browser storage.

**MFA enrollment and recovery cover TOTP and WebAuthn.** Agent-webui supports MFA enrollment, challenge and recovery for both TOTP and WebAuthn, including recovery codes that can each be used only once. | Positive, replay and lost-device tests confirm enrollment, challenge and one-time recovery behavior.

**Identity admin tabs cover users, roles, groups and mapping dry run.** Agent-webui's administration interface provides tabs for users, roles, groups, authentication modes and a mapping-rule dry run, each calling a typed identity Graph OS operation. | Authorized and denied generated-client tests confirm each admin tab enforces the correct access.

**Elevation requests display scope, expiry and a bound receipt.** Agent-webui's elevation request, approval and revocation views display the requested scope, reason, expiry and resulting receipt, and the confirmation and step-up for an elevation action are bound to the same caller and action that requested it. | Parity tests across chat and UI surfaces plus adversarial tests confirm the binding holds.

**Identity or tenant change invalidates cached protected data.** Changing the identity mode, tenant or session in agent-webui invalidates any cached protected data and closes active privileged interactions rather than leaving them reachable under the prior context. | A two-principal browser test confirms cached data and privileged interactions are closed on change.

**Identity forms and confirmations are accessible on desktop and mobile.** Agent-webui's identity forms, error messages, admin tab panels and modal confirmations are usable by keyboard and screen reader, with equivalent behavior on mobile. | An accessibility end-to-end test suite confirms keyboard, screen-reader and mobile parity.

**Release-qualification identity test client supports a live sign-in probe.** Agent-webui's release qualification maintains a dedicated OIDC test client and test-realm user so that a real browser sign-in probe against the identity provider can run end to end. | A browser sign-in probe against the provisioned test client and user confirms the authentication path works.

**Admin UI surfaces identity operations for users, roles and navigation.** Agent-webui's UserManagementView.tsx, AdminView.tsx and nav-registry.ts implement the browser side of the identity administration operations against the Graph OS identity API. | Authorized and denied generated-client tests against the live identity API confirm the admin UI enforces correct access.