FE-847: DX introspection tier 2

.agents/skills/ln-review/SKILL.md

@@ -61,6 +61,8 @@ Concrete cues to look for:
 - Ordering or position encoded by a numeric index/splice rather than by structure. Repair: make the order declarative.
 - A type alias or name that implies a wider contract than it points at. Repair: point it at the real union, or rename.
 - A method-shaped read/cache surface added without the matching update path (RPC method, query key, publisher topic, client invalidator, and README ledger entry drifting apart). Repair: thread the method-shaped topic through the whole publish/invalidate path, and lock it with a narrow invalidation/publisher test.
+- An **optional capability hook on a dependency/context interface** (`readonly x?: (` consumed via `?.` with a `??` fallback) where test harnesses supply the capability but the production composition root silently omits it → live behavior diverges from everything the suite proves, invisibly (graduated 2026-06-11 from four independent findings: unwired live gap reads froze legality at a conservative floor; mention/drain inputs never threaded; a provider guard bypassed its retry helper; runtime switches recomputed tool posture from an empty register). Repair: make load-bearing capabilities **required** members so the compiler polices the composition root; reserve optionality for documented ergonomics, and say which is which on the interface; pin each live posture with a real-boot oracle. Quiet defaults that "handle" the absence one layer down are the same fault relocated. See SPEC §Acknowledged Blind Spots "Live-vs-harness wiring divergence".
+- A **tagged-union arm that is representable and boundary-accepted but has no semantics anywhere downstream** (validation checks kind membership only; derivation hits a default/zero branch) → a "dark variant" persists as permanently-inert data, silently (graduated 2026-06-11: `field`/`coverage` gap predicates were creatable but derived coverage 0 forever and could not be hand-answered). Repair: one exhaustive `never`-checked owner of per-arm semantics that both validation and derivation ride — every accepted arm gets an implementation or loud rejection at the boundary, and adding an arm without deciding its semantics fails to compile.
 
 Collect findings as numbered items (category: `contract`). Frame each as: the assumed contract in one sentence, the failure mode when it breaks, and which of the three repairs applies. Most are concrete fixes (`ln-scope`/`ln-build`); clusters across a seam route to `ln-refactor`.
 

docs/archive/PLAN_HISTORY.md

@@ -149,3 +149,20 @@ Archived from `memory/PLAN.md` so the live plan only carries active, next, horiz
 - **Traceability:** R4, R8, R11, R12, R16, R17 / D5-L, D10-L, D12-L, D13-L, D19-L, D24-L, D33-L / I19-L, I21-L
 - **Design docs:** [prd.md §M3, §Frontend Architecture](file:///Users/lunelson/Code/hashintel/brunch-next/docs/architecture/prd.md)
 - **Current execution pointer:** complete. M3 tied off with shared JSON-RPC protocol helpers/dispatch semantics, `ws`-backed `/rpc` transport, persistent browser RPC client with protocol-failure hardening, canonical built asset serving with traversal-safe asset resolution, stable React runtime, explicit read-only session projection by durable session id through a canonical Brunch session-envelope reader with strict self-description validation, explicit transcript custom-entry classifiers, and read-only browser transcript rendering of assistant/user rows plus transcript-native prompt display rows from typed `{ sessionId, specId }` targets. Automated verification and direct HTTP/WebSocket projection postconditions pass. Accepted outer-loop deferral: qualitative browser-open smoke remains environment-blocked because `agent-browser` cannot create its socket directory under the current macOS sandbox (`Operation not permitted`); this does not block M3 tie-off because static HTML serving, absence of HTTP product reads, explicit `{ sessionId, specId }` WebSocket RPC reads, transcript-display text including custom prompt rows, and exchange projection were rechecked directly against the host.
+
+## 2026-06-11 Sync archive
+
+Archived from `memory/PLAN.md` after the FE-847 turn-boundary closure, review-fix remediation, and typing-collapse passes became the live completion window. Full definitions retired; pointers preserved below.
+
+- `dx-tier-2-harness` (FE-847) — Done 2026-06-10 with 2026-06-11 closure on FE-847. The real `runBrunchTui` boot chassis, faux-turn payload/transcript oracle, fixture resume path, skipped I45-L–I47-L scaffold, and topology stubs are in place; the final follow-on tightened Tier-1 proof so Brunch-configured faux sessions now own the definitive provider-facing prompt/tool payload assertion.
+- `project-graph-review-cycle` (FE-809) — Done 2026-06-06. Structured-exchange schema/emission lock and approval wiring are complete, and `.fixtures/runs/project-graph-review-cycle/2026-06-06-project-graph-review-cycle/` proves the real `project-graph` agent path: selected-spec graph read, dry-run-gated `present_review_set`, public-RPC approval through `session.submitExchangeResponse`, one explicit-basis `acceptReviewSet` graph commit, and graph invalidations with `{specId, lsn}`. The probe also fixed a real policy gap: commitment-grade `generate-proposal` now activates `present_review_set` / `request_review` for the Brunch runtime tool posture.
+- `elicitation-backlog` (FE-823) — Done 2026-06-08 on FE-823. Materialized `elicitation_backlog` as a flat table plus generated migration, seeded grounding questions at `createSpec`, routed create/close mutations through `CommandExecutor` on the shared spec-local LSN/change-log seam, and added graph-owned per-spec read-back. The remaining prompt-resource body pass stays in `memory/CROSS_CUT_PLAN.md` as temporary coverage completion work; the live per-turn driver remains a follow-on, not frontier completion debt.
+- `elicitation-gaps-remodel` (FE-531) — Done 2026-06-10. Replaced FE-823 `elicitation_backlog` with the D65-L `elicitation_gaps` obligation register, regenerated the table/migration metadata, seeded the grounding typology catalog, routed create/disposition mutations through `CommandExecutor`, and proved live `presence` coverage/answered derivation at read-back with sibling-spec isolation. `field`/`coverage` predicate derivation and `manual` LLM satisficiency remain named follow-ons for capability-readiness / later predicate slices. **Superseded in part by `gaps-node-kind-reference` (D75-L):** the grounding typology catalog and gap-`name` enum are retired in favor of `refersTo: NodeKind` + a free-form question; the flat-table substrate, predicate union, disposition, and live derivation this frontier established stand. **2026-06-11 predicate-hardening follow-on landed:** `field`/`coverage` gap predicates now reject loudly until derivation exists, open presence gaps dedupe by `(specId, nodeKind)`, and gap hydration fails on `predicate_kind` / predicate JSON divergence instead of silently reading an inconsistent row.
+- `gaps-node-kind-reference` — Done 2026-06-10. Replaced gap `name` with `refersTo: NodeKind` + `question` across schema, DB, `CommandExecutor`, reads, and capability-readiness; added migration `0004_gaps_node_kind_reference`; reseeded grounding by node kind (`context`, `thesis`, `goal`, `constraint`, plus `term`/`assumption`); proved live presence coverage still flips, required-kind absence fails loud, and two `thesis` gaps discriminate independently by question+satisfier. Topology READMEs reconciled.
+- `minimal-authority-shell` (FE-810) — Done 2026-06-08. Added `src/.pi/extensions/runtime/authority-matrix.test.ts` as the minimal authority guard: it locks the `CommandResult` discriminant vocabulary (including structured `needs_human` representability), proves `elicit-read-only` derives allowed/blocked tool authority from the shared projected runtime policy, and verifies the POC side-effecting tools (`bash`, `edit`, `write`) are not reachable in `elicit`. No standalone authority service was introduced, `src/.pi/agents/state.ts` stayed untouched, and A18-L strict built-in suppression remains named residue rather than closed.
+- `graph-observed-shapes` — Done 2026-06-08. `src/graph/README.md` now owns the closed observed-shape ledger: `read_graph` requires the six agent shapes, RPC and web require only `overview` + `neighborhood`, `list_by_kind` / `list_by_band` remain web-eligible deferred, and register reads remain deferred until a per-turn driver/consumer needs them. `src/graph/observed-shapes-coverage.test.ts` guards the tool/RPC/web required subsets; no transport shape shipped in this frontier.
+- `runtime-affordances-and-legality` — Done 2026-06-08. `src/projections/session/affordances.ts` now owns the shared `(resolvedState, readinessGrade)` derivation for legal goal/strategy/lens options plus default-on-switch values, reusing the same grade/AUTO legality source consumed by `.pi/agents/state.ts`; `src/session/README.md` owns the closed coverage ledger and `src/session/runtime-affordances-coverage.test.ts` guards required agent/RPC rows while leaving `active-review-set` and `turn-mode` as explicit product-state-gated deferrals.
+- `role-safe-graph-mutations` — Done 2026-06-09. `CommandExecutor` now exposes one public authored mutation seam (`mutateGraph` / `dryRunMutateGraph`) over the extracted planner/writer modules; direct tool writes, review-set acceptance, capture, seed loading, and dev curation all converge on that grammar. The dev-only RPC boundary is now `dev.graph.mutateGraph`, using role-named create-edge ops plus projected node-code / selected-spec edge-id resolution before it enters `CommandExecutor`. Follow-up closure on the same date: the product probes now prompt for and parse `mutate_graph`, current docs describe `mutate_graph` as the active tool, the checked-in 2026-06-05 fixture-curation run is labeled historical pre-migration `commit_graph` evidence, and schema coverage guards the authored edge surfaces against endpoint-role drift.
+- `dx-feedback-loops` (FE-825) — Done 2026-06-09. The chain landed the latest-pi bump and `PI_SOURCE`-gated runtime alias, the `src/dev/` faux front door and shared faux harness, and the dev-gated read-only introspection extension plus paired run-artifact launcher. Verification: `npm run verify` (608 tests, tsc build, web build). The follow-on frontier `dx-introspection-live` is now also done: the real TUI wiring, `--cwd` launch surface, unified `BRUNCH_DEV` gate, dev query tools, and workspace-local `.brunch/debug/` cache all landed on 2026-06-11.
+- `dx-introspection-live` (FE-825) — Done 2026-06-11. Slices 1-2, the dev-query active-tool follow-on, and the workspace debug-cache chain are done: `BRUNCH_DEV` real TUI launches can mirror the latest final system prompt and append explicit Brunch-owned text tool-result content into launch-cwd `.brunch/debug/` while repo-root `.fixtures/scratch/` remains the durable paired-run artifact path. `tool-renders` flattening remains explicitly deferred until a concrete renderer-debugging need appears.
+- `web-design-system-port` — (no pointer found)