Phase 8: Savile Row Clearance Console

[MachineLearning-Nerd]

The Savile Row Clearance Console: a custom-branded TrueForge UI (@truefoundry/trueforge-ui@0.2.4) that renders the release officer's work as the clearance workflow it is. It adds no backend — the console drives the same TrueForge server and sessions as the bundled UI, which remains the documented fallback.

What it adds (console/)

• Scaffold — Vite + React 19, TrueForgeUI with server={{type:'trueforge'}} proxied same-origin (/api → the harness), dark Savile Row theme expressed as oklch semantic tokens.
• Custom layout + evidence rail — three columns: sessions, the conversation, and a rail showing mission (purpose/audience/columns/suppressed cells), contract verdict with both hashes, and ledger/receipt state, with a stage badge (NO MISSION → PREPARED → CLEARED → RELEASED / DENIED). Every value is parsed exclusively from the vault's tool responses in the current thread — nothing is computed or invented client-side.
• ToolApprovalBar override — the release_result approval renders the full human-approved tuple (purpose, audience, columns, suppressed cells, queryId, contract and output hashes) read from the pending tool call itself, then delegates the actual decision to the stock bar so approve/deny semantics stay exactly the runtime's.
• AskUserPrompt / AgentStepsCard / SubAgentCard overrides — the question pause is framed as the mission checkpoint, the steps trail is restyled, and a subagent card renders as a policy-violation banner because this deployment disables subagents (root-only enforcement).
• Fallback — documented in console/README.md: if the console is down, the bundled UI on the TrueForge base URL runs identical sessions against the same server.

Notes

• zustand is pinned to v5 at the app level to resolve the @assistant-ui (needs v5) vs @openuidev (needs v4) hoisting conflict that broke the production build; v4 stays nested under the openui packages.
• Verified so far: TypeScript strict and Biome clean, vite build passes, and the dev server serves with the /api proxy reaching a live TrueForge (agent list confirmed through the proxy). The visual walkthrough of the full demo flow in the console (audience question → clearance card → approval hero → receipt + chart + evidence rail) is the remaining Phase 8 exit check and will be recorded before merge.

AI-assisted (Claude Code); reviewed and understood by the author.

[MachineLearning-Nerd]

/review

[qodo-code-review]

PR Summary by Qodo

Add Savile Row clearance workflow console

✨ Enhancement 📝 Documentation ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Adds a branded three-column console for release-officer clearance workflows.
• Surfaces vault-authored evidence and release tuples without adding backend state.
• Preserves stock approval semantics and documents the bundled TrueForge UI fallback.

Diagram

graph TD
  Officer["Release Officer"] --> Console["Clearance Console"] --> Server["TrueForge Server"] --> Vault["Vault Tools"] --> Thread["Thread Messages"] --> Parser["Evidence Parser"] --> Rail["Evidence Rail"]
  Parser --> Approval["Approval View"] --> Server

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Dedicated evidence endpoint

• ➕ Provides a typed, stable payload independent of UI message shapes
• ➕ Avoids rescanning the complete thread on each message update
• ➖ Adds a backend and another source of clearance state
• ➖ Weakens the requirement that displayed evidence comes directly from persisted tool responses

2. Modify the bundled TrueForge UI

• ➕ Avoids maintaining a separate application scaffold
• ➕ Could reuse deployment and dependency management
• ➖ Couples domain-specific workflow presentation to upstream UI code
• ➖ Makes fallback behavior and future TrueForge upgrades harder to preserve

Recommendation: Keep the standalone SDK-based console and derive evidence from persisted tool responses because it preserves the existing backend, sessions, and approval semantics while isolating domain branding. A dedicated evidence endpoint should only be reconsidered if tool-response schemas become unstable enough to outweigh the additional trust boundary and duplicated state.

Files changed (14) +6983 / -0

Enhancement (7) +624 / -0

App.tsxConfigure the TrueForge clearance application +31/-0

Configure the TrueForge clearance application

• Instantiates TrueForgeUI against the existing server and supplies the custom layout, theme, approval prompt, agent-step, and subagent overrides. Supports an optional runtime base URL while defaulting to same-origin access.

console/src/App.tsx

EvidenceRail.tsxRender clearance evidence and workflow stage +75/-0

Render clearance evidence and workflow stage

• Derives evidence from the stable current-thread message snapshot and displays mission, contract, hashes, ledger, receipt, version, denial, and chart state. Maps available evidence to release workflow stage badges without inventing missing values.

console/src/EvidenceRail.tsx

Layout.tsxAdd the three-column clearance layout +27/-0

Add the three-column clearance layout

• Composes the branded session list, TrueForge conversation thread, and evidence rail into the release-officer workspace while leaving runtime wiring to the SDK.

console/src/Layout.tsx

console.cssStyle the Savile Row workflow surfaces +227/-0

Style the Savile Row workflow surfaces

• Adds the dark three-column shell, evidence stages, release tuple presentation, mission checkpoint framing, and subagent violation banner. Uses OKLCH colors consistently with the semantic theme.

console/src/console.css

evidence.tsExtract clearance evidence from thread tool calls +141/-0

Extract clearance evidence from thread tool calls

• Parses decoded or MCP-wrapped vault tool results into mission, contract, release, receipt, version, denial, and chart evidence. Also locates pending release_result arguments for human approval and formats long hashes for display.

console/src/evidence.ts

main.tsxBootstrap the React console +14/-0

Bootstrap the React console

• Loads TrueForge and console styles, validates the root element, and mounts the application under React StrictMode.

console/src/main.tsx

overrides.tsxCustomize audited workflow interaction cards +109/-0

Customize audited workflow interaction cards

• Shows the complete pending release tuple before delegating approve or deny actions to the stock approval bar. Reframes mission questions and agent steps, and flags any subagent stream as a root-only policy violation.

console/src/overrides.tsx

Documentation (1) +34 / -0

README.mdDocument console operation and fallback +34/-0

Document console operation and fallback

• Explains the evidence rail, release approval presentation, checkpoint framing, local prerequisites, and startup command. Documents that the bundled TrueForge UI remains an equivalent fallback against the same sessions.

console/README.md

Other (6) +6325 / -0

index.htmlAdd the console HTML entry point +12/-0

Add the console HTML entry point

• Defines the root mount element, responsive viewport metadata, and clearance-console page title for the Vite application.

console/index.html

package-lock.jsonLock the standalone console dependency graph +6213/-0

Lock the standalone console dependency graph

• Records the resolved React, TrueForge UI, Vite, TypeScript, and transitive package versions. Keeps Zustand 5 at the application root while retaining the UI package's nested Zustand 4 dependency.

console/package-lock.json

package.jsonDefine console dependencies and build scripts +24/-0

Define console dependencies and build scripts

• Creates the private ESM package with Vite development, typechecked production build, and preview scripts. Pins TrueForge UI 0.2.4 and adds root-level Zustand 5 to satisfy assistant-ui dependency resolution.

console/package.json

theme.tsDefine the dark Savile Row theme +43/-0

Define the dark Savile Row theme

• Configures TrueForge branding and perceptually balanced OKLCH semantic tokens for surfaces, text, messages, controls, statuses, focus, and radii.

console/src/theme.ts

tsconfig.jsonEnable strict console TypeScript checks +16/-0

Enable strict console TypeScript checks

• Configures modern browser and bundler compilation with strict typing, unchecked-index protection, isolated modules, and no emitted output.

console/tsconfig.json

vite.config.tsConfigure Vite and the TrueForge API proxy +17/-0

Configure Vite and the TrueForge API proxy

• Enables the React plugin, serves development on port 5178, and proxies same-origin /api requests to the configured or default TrueForge server to avoid CORS divergence.

console/vite.config.ts

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Prior release survives new mission ✓ Resolved 🐞 Bug ≡ Correctness ⭐ New

Description

When a later prepare_analysis succeeds, extractEvidence replaces the mission/query fields but
leaves the previous receipt, verdict, hashes, denial, and chart state intact; the rail can therefore
label the new, unreleased query RELEASED and display evidence belonging to the earlier query. A
later denied preparation is likewise masked by an old receipt because receipt state remains and has
stage precedence.

Code

console/src/evidence.ts[R102-105]

+      if (call.toolName === "prepare_analysis") {
+        if (typeof body.queryId === "string") {
+          const candidate = record(body.candidate);
+          evidence.queryId = body.queryId;

Relevance

●●● Strong

Recent accepted precedent fixes stale released evidence across lifecycle transitions; this finding
similarly requires fail-closed per-query state isolation.

PR-#4
PR-#6

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The server creates a fresh queryId for every successful preparation, and only release_result
creates a receipt. The extractor's preparation block updates only mission/query fields, while
stage() prioritizes any retained receipt over denial, verdict, or prepared state, proving that
multiple attempts in one thread are merged into an invalid status.

src/server/handlers.ts[182-194]
src/server/handlers.ts[234-253]
src/server/handlers.ts[140-154]
console/src/evidence.ts[83-138]
console/src/EvidenceRail.tsx[17-24]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Evidence from an earlier query remains attached when a new preparation attempt starts, causing the rail to combine unrelated workflows and report stale release state.

## Issue Context
Each successful preparation creates a new query ID, while receipts and validation evidence are query-specific. A preparation denial also represents the latest workflow attempt and must not remain masked by a prior receipt.

## Fix Focus Areas
- console/src/evidence.ts[76-111]
- console/src/EvidenceRail.tsx[17-24]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Mission denial shown as idle ✓ Resolved 🐞 Bug ≡ Correctness

Description

extractEvidence only processes prepare_analysis responses containing a string queryId, so the
Vault's mission_not_authorized response is ignored. The evidence rail consequently displays `NO
MISSION` and omits the denial code/findings even though the Vault explicitly denied and audited the
request.

Code

console/src/evidence.ts[81]

+      if (call.toolName === "prepare_analysis" && typeof body.queryId === "string") {

Relevance

●●● Strong

Clear correctness bug; recent history accepts fixes preserving explicit denial findings and
Vault-authored evidence.

PR-#3
PR-#4
PR-#7

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The backend returns error: "mission_not_authorized" with finding codes and no query ID for
unauthorized missions. The added extractor gates all preparation handling on body.queryId, while
the added stage logic falls back to NO MISSION when no denial code, verdict, or query ID was
extracted.

src/server/handlers.ts[182-194]
console/src/evidence.ts[78-90]
console/src/EvidenceRail.tsx[17-23]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Capture denied `prepare_analysis` responses so an explicit Vault denial is not rendered as `NO MISSION`.

## Issue Context
Unauthorized preparation responses contain `error`, `findingCodes`, and an OpenUI denial card but no `queryId`. Update extraction and stage derivation to preserve this denial evidence while keeping successful preparation behavior unchanged.

## Fix Focus Areas
- console/src/evidence.ts[81-90]
- console/src/EvidenceRail.tsx[17-23]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

Review mode: ⚖️ Balanced

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit 33d0eda

Results up to commit 528ceb0 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Mission denial shown as idle ✓ Resolved 🐞 Bug ≡ Correctness

Description

extractEvidence only processes prepare_analysis responses containing a string queryId, so the
Vault's mission_not_authorized response is ignored. The evidence rail consequently displays `NO
MISSION` and omits the denial code/findings even though the Vault explicitly denied and audited the
request.

Code

console/src/evidence.ts[81]

+      if (call.toolName === "prepare_analysis" && typeof body.queryId === "string") {

Relevance

●●● Strong

Clear correctness bug; recent history accepts fixes preserving explicit denial findings and
Vault-authored evidence.

PR-#3
PR-#4
PR-#7

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The backend returns error: "mission_not_authorized" with finding codes and no query ID for
unauthorized missions. The added extractor gates all preparation handling on body.queryId, while
the added stage logic falls back to NO MISSION when no denial code, verdict, or query ID was
extracted.

src/server/handlers.ts[182-194]
console/src/evidence.ts[78-90]
console/src/EvidenceRail.tsx[17-23]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Capture denied `prepare_analysis` responses so an explicit Vault denial is not rendered as `NO MISSION`.

## Issue Context
Unauthorized preparation responses contain `error`, `findingCodes`, and an OpenUI denial card but no `queryId`. Update extraction and stage derivation to preserve this denial evidence while keeping successful preparation behavior unchanged.

## Fix Focus Areas
- console/src/evidence.ts[81-90]
- console/src/EvidenceRail.tsx[17-23]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[Copilot]

🟡 Changes recommended

There are a few concrete UI logic/data-extraction issues (stage labeling for denied vs needs_review, loss of denial detail, and potential “undefined” hash rendering) that should be corrected before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new console/ Vite + React app that provides a custom-branded “Clearance Console” UI for the Need-to-Know release workflow, reusing the existing TrueForge server/sessions (no new backend) and presenting “evidence” derived from vault tool responses.

Changes:

• Introduces a standalone Vite/React console app with TrueForgeUI layout and component overrides.
• Adds an evidence rail and “release approval hero” UI derived from tool-call parts in the current thread.
• Documents local run steps and fallback to the bundled TrueForge UI.

File summaries

File	Description
console/vite.config.ts	Vite dev-server configuration, including /api proxy to TrueForge base URL.
console/tsconfig.json	Strict TypeScript configuration for the console project.
console/src/theme.ts	Savile Row dark theme tokens for TrueForge UI theming.
console/src/overrides.tsx	UI slot overrides (approval bar, ask-user prompt framing, steps styling, subagent warning).
console/src/main.tsx	React root bootstrapping and global style imports.
console/src/Layout.tsx	Three-column layout (sessions, thread, evidence rail).
console/src/EvidenceRail.tsx	Evidence rail rendering and stage badge logic derived from extracted evidence.
console/src/evidence.ts	Parses vault tool responses/tool-call args to derive evidence and pending approval tuple.
console/src/console.css	Console-specific CSS for shell layout, rail, and override framing.
console/src/App.tsx	TrueForgeUI wiring: server config, theme, layout, and overrides.
console/README.md	Console run instructions and fallback guidance.
console/package.json	Console dependencies and build scripts (Vite build + tsc --noEmit).
console/index.html	Console HTML entrypoint mounting #root.

Review details

• Files reviewed: 13/14 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[MachineLearning-Nerd]

/review

[qodo-code-review]

Code review by qodo was updated up to the latest commit 5df2d68

[Copilot]

🔵 Needs a closer look

It is a substantial new frontend whose end-to-end runtime behavior is unverified by the author's own note (the demo walkthrough is a pending exit check) and whose logic-heavy evidence parsing has no automated tests, so final human review is warranted.

Review details

• Files reviewed: 13/14 changed files
• Comments generated: 0 new
• Review effort level: Balanced