feat: provisioned website studio and the Website Manager job - #691
Draft
nocodeafrica wants to merge 183 commits into
Draft
feat: provisioned website studio and the Website Manager job#691nocodeafrica wants to merge 183 commits into
nocodeafrica wants to merge 183 commits into
Conversation
Snapshot of the uncommitted Website Manager implementation produced by the DeepSeek V4.1 Flash workers (core types, relay broker/authority, DB rows, Electron preview host, desktop feature components, persona pack, specs). Untested: no CI, build, or rendered acceptance has run. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
… feature-shaped native handle
Native preview host follow-ups from source review: inline-script entity
decoding never throws (surrogates and out-of-range clamp to U+FFFD, an
undecodable handler stays unauthorized and reports truncation once);
every served HTML page is authorized from its own verified bytes and
non-HTML responses get the base CSP; website-* bridge requests throw
"<code>: <message>" while every other request keeps its historical
thrown value; the shared client handle takes the feature
{element, clip, intersection, visible} shape, exposes a scoped state
subscription, and the artifact loader returns
{objectUrl, verifiedSha256, revoke}. Docs updated with the corrected
zoom rule (renderer sends none) and the honest list of unproven gates.
Source-level only: no Electron proof, CI, or rendered acceptance ran.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
… fetch, SDK and CLI surface
Relay: reserved website decisions now run after the full generic Block
validation and reach the broker with the validated envelope; the early
pre-validation branch is gone. Owner request-changes through the Block
path reopens the canonical task with bounce semantics like the
coordinator path. Artifact fetches run under one wall-clock deadline
that covers DNS, every redirect hop, headers, and body, and every hop is
checked against the core public-URL policy. Unused evidence helpers
removed (they also broke the build).
Core: optional bounded handover accessRequest {text, authoredBy}; the
broker requires the author to be an assigned build persona owned by the
job owner.
SDK: website action builder, head/receipt parsers, QA binding tag.
CLI: `buzz website` get/list/create/begin-work/revision/qa/evidence/
ready/request-changes/handover.
Authored for GitHub CI; nothing here has compiled or run locally.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…istration Adds the relay-authored `website-job` Block composite (owner-only `website.approve` / `website.request-changes`, bounded brief instance schema) and validates review-card instance data against it in the broker. Adds crates/buzz-test-client/tests/e2e_website.rs (owner and coordinator create, exact retry, conflicting replay, stale generation, unauthorized and cross-community refusals) and runs it in the relay suites step. Authored for GitHub CI; not compiled or run locally. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…e E2E Adds features/websiteIntegration: a channel-scoped store of relay-signed kind 30203 website heads (signer must be the relay self key, strict tags, generation guard) with receipt waiters; owner decision transport as reserved Block actions pinned to the coordinator's review card; beginWork as kind 40027; native preview, artifact, and download adapters over the shared client; and the channel-root / thread attachments that render the approved job projection under the owner's message and the review controls under the coordinator's card. One insertion point in MessageRow, one reset in resetCommunityState, new kind constants. Adds desktop/tests/e2e/website-manager.spec.ts (smoke project): mocked Brief, Working, Review, Revision, Handover captures at two widths plus interaction and recovery assertions. Mocked proof only; nothing here has been built, typechecked, or run. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…onical facts Clip rect comes from the attachment's nearest scrolling ancestor intersected with the viewport, so each pane hides or clips its native preview correctly without app-shell wiring. Stage progress is derived only from the relay-signed record: task reports and job outcomes complete a stage, checkpoints and work events mark it in progress, a current revision completes design/build until a change request reopens it, current-revision QA completes review, a pinned active approval completes owner review. Source tests and E2E assertions added. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…igest Adds `buzz website bundle`: walks a built static site deterministically, validates paths/MIME/limits against the core preview contract, refuses symlinks and case-fold collisions, uploads files, captures, manifest and a deterministic source archive through the existing Blossom client, reads every upload back and refuses success unless bytes and size match, and emits the JSON that `buzz website revision --file` consumes. Adds the website-job manifest to the core publication digest table. Authored for GitHub CI; not compiled or run locally. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…able pack skills Pack corrections (Jules owns the handover bundle and access request, Avery delegates and presents, grounded facts with aesthetic freedom, requestChanges instead of an invented rejection, record-first recovery) plus a native installer under managed_agents/website_team: deterministic (owner, community, team, role) identities, durable bounded journal, reconcile-not-duplicate on retry, hash-preserving skill files installed where the harness loads them, tier/manager placement, keys never returned. Agents view gains a Website Manager team entry and install dialog with real status. Authored for GitHub CI; not compiled or run locally. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
# Conflicts: # desktop/playwright.config.ts # desktop/src/features/messages/ui/MessageRow.tsx
… WebCrypto and Blob TypeScript 5.7 distinguishes Uint8Array<ArrayBufferLike> from the ArrayBuffer-backed view that crypto.subtle.digest and Blob accept; the decode helper now copies once into an ArrayBuffer-backed Uint8Array. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…, native inventory website_jobs.rs wraps its const-column queries in sqlx::AssertSqlSafe like the rest of buzz-db; unused website imports and the duplicated WEBSITE_JOB_BLOCK_HANDLE export are removed so clippy -D warnings passes. The Tauri lib.rs registration is folded back under the 1000-line ratchet and desktop/native-inventory.json is updated for the three website_team commands and seven new Rust files following the generator's counting rules. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Drops unused React namespace imports, adds diagnostics to the verified artifact error state, matches the onStart contract, builds handover assets mutably before assignment, and fetches the review card through the existing event-by-id path instead of an unsupported ids filter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…s an artifact Lets a branch authored without local tooling receive the repo's exact formatter output (rustfmt, tauri rustfmt, biome for desktop and web) from a GitHub runner. It never pushes; the patch is applied and committed by a person or orchestrator with their own sign-off. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
workflow_dispatch resolves only default-branch workflows, so agent branches trigger the patch job on push instead. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Formatter patch produced by the Format diff workflow (run 34524732130) and applied unchanged. No semantic changes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…ler text from UTF-8 bytes assert.rejects skips its validator when the thunk throws synchronously, so the loader code tests never compared codes; the helper now wraps the operation in a resolved promise and checks the real error class and code. Inline handler scanning decodes the document as UTF-8 before hashing so non-ASCII handler text produces the served-bytes hash; the CRLF/UTF-8 test derives its expected tokens with node:crypto. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
… modules Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
lib.rs sat one registration list over the 1000-line ratchet after the website team commands were added. The reveal plugin body moves to its own module unchanged; the inventory is updated for the new file. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…ustive deps) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…plete proofs The real-Electron proof measured innerWidth equal to the fitted DIP width (900 and 323) because the host only called setZoomFactor when its stored factor changed, and Electron discards a factor set before the first load and on navigation. The factor is now seeded through webPreferences.zoomFactor and re-applied unconditionally on did-finish-load and did-navigate. The proof computes real tolerances from the fitted bounds, and the workflow now fails when proof.json is incomplete or any check is not ok, while still reporting an unavailable clip capture as unproven. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Produced by the Format diff workflow (run 34529197753) running pnpm generate:native-inventory; replaces the hand-derived values. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…used website_team imports Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…ebsite presentation After the shared Blocks redesign (#682) landed: the website-job manifest is a reviewed core digest, the handle joins the core composite list, and BlockMessage lazily delegates a trusted website-job instance to WebsiteJobComposite, which renders the approved job body from the verified head in the thread and keeps the generic primitive tree as the fallback when the head is missing or the instance is untrusted. The plain thread attachment yields to the composite through a small registry so controls never render twice. Mocked E2E asserts the trusted path renders and computes the manifest digest at test time. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Format diff workflow run 34537194848; no semantic changes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017sBYDRjdjvQbg6fFosheTB Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Collaborator
Author
|
Direct recovery: head 8bf4d8b integrates develop at 29f8fa8 without rewriting history. It restores the explicit verified-Power Continue step in the affected onboarding tests, preserves the current choice-first assertions, adds signed manifest-bound builder evidence before both handovers, and corrects the duplicate receipt revision expectation. GitHub CI 34740771408 and native/package checks are queued. No local CI ran. Original uncommitted browser-evidence work is preserved separately and excluded. Draft status and full live Website proof boundary remain unchanged. |
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…ation Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
…alidation Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
Signed-off-by: Basheer Phiri <phiribash@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Colony provides a Website Manager team and presents its work in the existing channel and side thread: brief, working, review, revision, and handover. Avery coordinates research by Ren, design and build by Jules, and independent review by Vera under the Chief of Staff. Owner decisions identify the exact immutable revision and manifest hash.
The change includes the relay job protocol, agent CLI, editable team instructions, employee provisioning, substantial inline review controls, source and handover artifacts, and an isolated Electron preview host. Website publication and domain changes require separate owner decisions.
Current candidate
6aa4c1aef834c117ac10afa45861c36b05ab7399includes the latest develop integration, Website setup entry point and editable channel draft, explicit installed/joined/ready reporting, owner/relay-fenced membership writes, authenticated same-community artifact consumption, and a dedicated private Blossom lifecycle gate. The replay fixture now requires the relay'sduplicate:discriminator and verifies the original action, head and unchanged generation.GitHub generated the formatting and native inventory. No local CI, tests, builds or formatters have been run during takeover. Implementation is delegated to GPT-5.6 Luna workers at max reasoning.
Verified evidence on the preceding candidate
These results belong to
22fa9860d924922e2a490282e934c35389f5f531; they do not establish the new candidate's complete proof.Remaining gates
This PR remains a draft until implementation and exact-head proof gates pass. It has not been merged or released.