Skip to content

feat: provisioned website studio and the Website Manager job - #691

Draft
nocodeafrica wants to merge 183 commits into
developfrom
codex/website-manager
Draft

feat: provisioned website studio and the Website Manager job#691
nocodeafrica wants to merge 183 commits into
developfrom
codex/website-manager

Conversation

@nocodeafrica

@nocodeafrica nocodeafrica commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator

Colony provides a Website Manager team and presents its work in the existing channel and side thread: brief, working, review, revision, and handover. Avery coordinates research by Ren, design and build by Jules, and independent review by Vera under the Chief of Staff. Owner decisions identify the exact immutable revision and manifest hash.

The change includes the relay job protocol, agent CLI, editable team instructions, employee provisioning, substantial inline review controls, source and handover artifacts, and an isolated Electron preview host. Website publication and domain changes require separate owner decisions.

Current candidate

6aa4c1aef834c117ac10afa45861c36b05ab7399 includes the latest develop integration, Website setup entry point and editable channel draft, explicit installed/joined/ready reporting, owner/relay-fenced membership writes, authenticated same-community artifact consumption, and a dedicated private Blossom lifecycle gate. The replay fixture now requires the relay's duplicate: discriminator and verifies the original action, head and unchanged generation.

GitHub generated the formatting and native inventory. No local CI, tests, builds or formatters have been run during takeover. Implementation is delegated to GPT-5.6 Luna workers at max reasoning.

Verified evidence on the preceding candidate

These results belong to 22fa9860d924922e2a490282e934c35389f5f531; they do not establish the new candidate's complete proof.

  • Real Electron preview proof: all 16 required checks and composited clipping passed; actual desktop/mobile viewports were 1440×900 and 390×844.
  • Desktop Smoke E2E (6): 10 Website Manager cases passed on the first attempt, with 10 distinct screenshots across five states. This uses mocked data and saved-image fallback.
  • Electron package and migration proof passed. The package remains unpublished and uses ad-hoc signing.
  • Native first-job proof passed: real packaged ACP, shell, signed CLI, relay and gateway; one task/instruction; worker output and Scout review; missing-team recovery; 10 model responses reconciled to 10 debit entries totaling 28,000 nanoUSD, with no remaining holds and complete service cleanup. Model responses and funding were controlled fixtures. This is not a real-model Website job or payment-settlement proof.
  • The preceding full CI run failed on formatting, a copy lint, and replay-response parsing. Those causes have source corrections in the new candidate and need fresh CI confirmation.

Remaining gates

  • Current full GitHub CI, including the new tenant-scoped private Blossom lifecycle, plus refreshed native preview, packaging, and native first-job checks.
  • Complete assigned-worker browser access for real public-site research and durable desktop/mobile captures. Authority must come from existing verified task/job/persona records and the current isolated runtime.
  • Prove native authenticated artifact rendering and a packaged app completing real managed Website work through revision, independent QA, exact owner approval, and handover.

This PR remains a draft until implementation and exact-head proof gates pass. It has not been merged or released.

ncoodeAfrica and others added 30 commits September 10, 2026 21:07
Snapshot of the uncommitted Website Manager implementation produced by
the DeepSeek V4.1 Flash workers (core types, relay broker/authority,
DB rows, Electron preview host, desktop feature components, persona
pack, specs). Untested: no CI, build, or rendered acceptance has run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
… feature-shaped native handle

Native preview host follow-ups from source review: inline-script entity
decoding never throws (surrogates and out-of-range clamp to U+FFFD, an
undecodable handler stays unauthorized and reports truncation once);
every served HTML page is authorized from its own verified bytes and
non-HTML responses get the base CSP; website-* bridge requests throw
"<code>: <message>" while every other request keeps its historical
thrown value; the shared client handle takes the feature
{element, clip, intersection, visible} shape, exposes a scoped state
subscription, and the artifact loader returns
{objectUrl, verifiedSha256, revoke}. Docs updated with the corrected
zoom rule (renderer sends none) and the honest list of unproven gates.

Source-level only: no Electron proof, CI, or rendered acceptance ran.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
… fetch, SDK and CLI surface

Relay: reserved website decisions now run after the full generic Block
validation and reach the broker with the validated envelope; the early
pre-validation branch is gone. Owner request-changes through the Block
path reopens the canonical task with bounce semantics like the
coordinator path. Artifact fetches run under one wall-clock deadline
that covers DNS, every redirect hop, headers, and body, and every hop is
checked against the core public-URL policy. Unused evidence helpers
removed (they also broke the build).

Core: optional bounded handover accessRequest {text, authoredBy}; the
broker requires the author to be an assigned build persona owned by the
job owner.

SDK: website action builder, head/receipt parsers, QA binding tag.
CLI: `buzz website` get/list/create/begin-work/revision/qa/evidence/
ready/request-changes/handover.

Authored for GitHub CI; nothing here has compiled or run locally.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…istration

Adds the relay-authored `website-job` Block composite (owner-only
`website.approve` / `website.request-changes`, bounded brief instance
schema) and validates review-card instance data against it in the
broker. Adds crates/buzz-test-client/tests/e2e_website.rs (owner and
coordinator create, exact retry, conflicting replay, stale generation,
unauthorized and cross-community refusals) and runs it in the relay
suites step.

Authored for GitHub CI; not compiled or run locally.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…e E2E

Adds features/websiteIntegration: a channel-scoped store of relay-signed
kind 30203 website heads (signer must be the relay self key, strict
tags, generation guard) with receipt waiters; owner decision transport
as reserved Block actions pinned to the coordinator's review card;
beginWork as kind 40027; native preview, artifact, and download
adapters over the shared client; and the channel-root / thread
attachments that render the approved job projection under the owner's
message and the review controls under the coordinator's card. One
insertion point in MessageRow, one reset in resetCommunityState, new
kind constants.

Adds desktop/tests/e2e/website-manager.spec.ts (smoke project): mocked
Brief, Working, Review, Revision, Handover captures at two widths plus
interaction and recovery assertions. Mocked proof only; nothing here has
been built, typechecked, or run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…onical facts

Clip rect comes from the attachment's nearest scrolling ancestor
intersected with the viewport, so each pane hides or clips its native
preview correctly without app-shell wiring. Stage progress is derived
only from the relay-signed record: task reports and job outcomes
complete a stage, checkpoints and work events mark it in progress, a
current revision completes design/build until a change request reopens
it, current-revision QA completes review, a pinned active approval
completes owner review. Source tests and E2E assertions added.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…igest

Adds `buzz website bundle`: walks a built static site deterministically,
validates paths/MIME/limits against the core preview contract, refuses
symlinks and case-fold collisions, uploads files, captures, manifest and
a deterministic source archive through the existing Blossom client,
reads every upload back and refuses success unless bytes and size match,
and emits the JSON that `buzz website revision --file` consumes. Adds
the website-job manifest to the core publication digest table.

Authored for GitHub CI; not compiled or run locally.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…able pack skills

Pack corrections (Jules owns the handover bundle and access request,
Avery delegates and presents, grounded facts with aesthetic freedom,
requestChanges instead of an invented rejection, record-first recovery)
plus a native installer under managed_agents/website_team: deterministic
(owner, community, team, role) identities, durable bounded journal,
reconcile-not-duplicate on retry, hash-preserving skill files installed
where the harness loads them, tier/manager placement, keys never
returned. Agents view gains a Website Manager team entry and install
dialog with real status.

Authored for GitHub CI; not compiled or run locally.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
# Conflicts:
#	desktop/playwright.config.ts
#	desktop/src/features/messages/ui/MessageRow.tsx
… WebCrypto and Blob

TypeScript 5.7 distinguishes Uint8Array<ArrayBufferLike> from the
ArrayBuffer-backed view that crypto.subtle.digest and Blob accept; the
decode helper now copies once into an ArrayBuffer-backed Uint8Array.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…, native inventory

website_jobs.rs wraps its const-column queries in sqlx::AssertSqlSafe
like the rest of buzz-db; unused website imports and the duplicated
WEBSITE_JOB_BLOCK_HANDLE export are removed so clippy -D warnings
passes. The Tauri lib.rs registration is folded back under the
1000-line ratchet and desktop/native-inventory.json is updated for the
three website_team commands and seven new Rust files following the
generator's counting rules.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Drops unused React namespace imports, adds diagnostics to the verified
artifact error state, matches the onStart contract, builds handover
assets mutably before assignment, and fetches the review card through
the existing event-by-id path instead of an unsupported ids filter.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…s an artifact

Lets a branch authored without local tooling receive the repo's exact
formatter output (rustfmt, tauri rustfmt, biome for desktop and web)
from a GitHub runner. It never pushes; the patch is applied and
committed by a person or orchestrator with their own sign-off.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
workflow_dispatch resolves only default-branch workflows, so agent
branches trigger the patch job on push instead.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Formatter patch produced by the Format diff workflow (run 34524732130)
and applied unchanged. No semantic changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…ler text from UTF-8 bytes

assert.rejects skips its validator when the thunk throws synchronously,
so the loader code tests never compared codes; the helper now wraps the
operation in a resolved promise and checks the real error class and
code. Inline handler scanning decodes the document as UTF-8 before
hashing so non-ASCII handler text produces the served-bytes hash; the
CRLF/UTF-8 test derives its expected tokens with node:crypto.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
… modules

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
lib.rs sat one registration list over the 1000-line ratchet after the
website team commands were added. The reveal plugin body moves to its
own module unchanged; the inventory is updated for the new file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…ustive deps)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…plete proofs

The real-Electron proof measured innerWidth equal to the fitted DIP
width (900 and 323) because the host only called setZoomFactor when its
stored factor changed, and Electron discards a factor set before the
first load and on navigation. The factor is now seeded through
webPreferences.zoomFactor and re-applied unconditionally on
did-finish-load and did-navigate. The proof computes real tolerances
from the fitted bounds, and the workflow now fails when proof.json is
incomplete or any check is not ok, while still reporting an
unavailable clip capture as unproven.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Produced by the Format diff workflow (run 34529197753) running
pnpm generate:native-inventory; replaces the hand-derived values.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…used website_team imports

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…ebsite presentation

After the shared Blocks redesign (#682) landed: the website-job manifest
is a reviewed core digest, the handle joins the core composite list, and
BlockMessage lazily delegates a trusted website-job instance to
WebsiteJobComposite, which renders the approved job body from the
verified head in the thread and keeps the generic primitive tree as the
fallback when the head is missing or the instance is untrusted. The
plain thread attachment yields to the composite through a small
registry so controls never render twice. Mocked E2E asserts the trusted
path renders and computes the manifest digest at test time.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Format diff workflow run 34537194848; no semantic changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
@nocodeafrica

Copy link
Copy Markdown
Collaborator Author

Direct recovery: head 8bf4d8b integrates develop at 29f8fa8 without rewriting history. It restores the explicit verified-Power Continue step in the affected onboarding tests, preserves the current choice-first assertions, adds signed manifest-bound builder evidence before both handovers, and corrects the duplicate receipt revision expectation. GitHub CI 34740771408 and native/package checks are queued. No local CI ran. Original uncommitted browser-evidence work is preserved separately and excluded. Draft status and full live Website proof boundary remain unchanged.

Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…ation

Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…alidation

Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants