{"data":[{"id":"1d47aba8-0fdb-47a9-af18-e1a535b5fb8e","source":"cc-execution","status":"authorized","payload":{"paths":["src/__tests__/contracts/frontend-build-memory-envelope.contract.test.ts","workers/cc-execution/test/release-orchestration-invariants.test.js"],"reason":"Owner explicitly requested the runner relabel/routing repair; Gate exposed two stale hard-safety assertions that still require the old 4 GB frontend envelope and must be updated on the same PR.","baseSha":"58435c69e33adefbd4bad2bd36637097375dc006","issuedAt":1790342850492,"expiresAt":1790343030492,"missionId":"bdb936b2-e84f-409b-98ae-f50b6415629c","authorizationId":"c8fecffe-7cd8-43a3-b466-bbc90100dca8","retryableWithinExactScope":true},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T13:27:30.761806+00:00","proof_gate":"control_plane_maintenance_scope_authorized","source_sha":"58435c69e33adefbd4bad2bd36637097375dc006","external_id":null,"receipt_type":"control_plane_maintenance_authorization","idempotency_key":"control-plane-maintenance-authorize:c8fecffe-7cd8-43a3-b466-bbc90100dca8","mission_step_id":"e4fadef3-ecb8-4c51-b55f-4529e4c1635c","command_center_event_id":"bdb936b2-e84f-409b-98ae-f50b6415629c"},{"id":"eef32dbd-a5e8-4850-802a-59319f5a92b8","source":"cc-execution","status":"deployment_dispatched","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-1e8472cc207c","reason":null,"status":"deployment_dispatched","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3357,"terminal":false,"missionId":"1e8472cc-207c-4b2a-b816-a66f15a3f985","operation":"automatic_mission_resume","proofGate":"canonical_release_dispatched","sourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a","timingsMs":{"prReadinessMs":556,"approvedPlanMs":0,"shipAndProveMs":3436,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":null,"receiptRef":{"mode":"full","missionId":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},"performance":null,"deploymentId":"forgejo-main-ba136e4efdfc","releaseState":null,"workflowRunId":null,"releaseTargets":{"frontend":false,"onrunner":true,"migrations":false,"ccExecution":true,"supabaseEdge":false,"edgeFunctionSlugs":[]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":2133,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"766cfaa7-ac42-46c8-bbef-69d13268a29d","created_at":"2026-09-21T15:44:31.934824+00:00","proof_gate":"canonical_release_dispatched","source_sha":null,"external_id":"3357","receipt_type":"automatic_mission_resume","idempotency_key":"mission:1e8472cc-207c-4b2a-b816-a66f15a3f985:automatic-mission-resume:3357:canonical_release_dispatched","mission_step_id":"cbf8b9ce-9e65-4388-8cb6-4d7185c2ac87","command_center_event_id":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},{"id":"eecad1ed-96e4-4eca-999f-670db2e39ab0","source":"forgejo-runtime","status":"failed","payload":{"failed":["render-onrunner/runtime-proof"],"states":{"forgejo-main/source":"success","forgejo-release/workflow":"pending","cc-execution/runtime-proof":"pending","render-onrunner/runtime-proof":"failure"},"mainSha":"ba136e4efdfc79715aee043f79d6148f9877063a","missing":[],"pending":["forgejo-release/workflow","cc-execution/runtime-proof"],"required":["forgejo-main/source","forgejo-release/workflow","cc-execution/runtime-proof","render-onrunner/runtime-proof"],"sourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a","releaseState":"failed","sourceInMain":true,"compareStatus":"identical","releaseTargets":{"frontend":false,"onrunner":true,"migrations":false,"ccExecution":true,"supabaseEdge":false,"edgeFunctionSlugs":[]},"releaseTargetStates":{},"requestContractHash":"0e32a956a445bd0553cc59dc1ba4ca16bae0d87a0b573ce506d4474d200e3fee","forgejoWorkflowProof":{"error":"workflow_run_id_missing","runId":null},"onrunnerRuntimeProof":{"reason":"render_onrunner_source_mismatch","hostedUrl":"https://knocklaunchcrm.onrender.com","brokerReady":true,"exactSource":false,"healthStatus":200,"runtimeReady":true,"liveSourceSha":"7949858f063d3e50ce48b60231d56b2b593d1acf","runnerVersion":"onrunner-7949858f063d","expectedSourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a"},"releaseSourceVerified":true,"ccExecutionRuntimeProof":{"liveSha":"4b99654f3bd9d476c478be48ff275e54401ae9c5","deploymentId":"forgejo-main-4b99654f3bd9d476c478be48ff275e54401ae9c5","compareStatus":null,"identitySource":"local_build_metadata","runtimeVersion":"1.58.208-visual-job-reconcile","containsSourceSha":false},"releaseTargetRecoveryProof":null,"exactReleaseVerifiedAfterMainAdvanced":false},"tenant_id":"766cfaa7-ac42-46c8-bbef-69d13268a29d","created_at":"2026-09-21T15:44:33.540652+00:00","proof_gate":"canonical_release_terminal_failed","source_sha":"ba136e4efdfc79715aee043f79d6148f9877063a","external_id":"forgejo-main-ba136e4efdfc","receipt_type":"canonical_release_status","idempotency_key":"mission:1e8472cc-207c-4b2a-b816-a66f15a3f985:forgejo-release-status:ba136e4efdfc79715aee043f79d6148f9877063a:failed:forgejo-main/source=success|forgejo-release/workflow=pending|cc-execution/runtime-proof=pending|render-onrunner/runtime-proof=failure","mission_step_id":"cbf8b9ce-9e65-4388-8cb6-4d7185c2ac87","command_center_event_id":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},{"id":"3acb4be9-175a-4776-bc9b-e99e03a6fc13","source":"cc-execution","status":"source_resolution_required","payload":{"ok":true,"jobId":null,"phase":"objective_received","branch":"ai/objective-first-repair-8c49fdbe3f50","reason":null,"status":"source_resolution_required","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":"1.58.209-visual-certification-hardening","prNumber":null,"terminal":false,"missionId":"8c49fdbe-3f50-4b08-901d-1c56affc3114","operation":"execute_mission","proofGate":"repair_mission_source_resolution_required","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":108,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"missionSetupMs":579,"providerAuthMs":0,"ledgerPrepareMs":579,"ledgerReconcileMs":0,"lineageReconcileMs":0,"resolvePreflightMs":579,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"totalSynchronousLedgerMs":579,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0},"nextAction":"Resolve bounded authoritative Forgejo source targets, then call /mission/execute again with this same missionId and exact files or anchored_edits. Do not switch workflows.","receiptRef":{"mode":"full","missionId":"8c49fdbe-3f50-4b08-901d-1c56affc3114"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":5207,"likelyAffectedFiles":[],"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T15:53:21.013191+00:00","proof_gate":"repair_mission_source_resolution_required","source_sha":null,"external_id":null,"receipt_type":"execute_mission","idempotency_key":"mission:8c49fdbe-3f50-4b08-901d-1c56affc3114:execute_mission:repair_mission_source_resolution_required:current-generation","mission_step_id":"a69fdb7e-f395-465c-9949-b481ec3d9f68","command_center_event_id":"8c49fdbe-3f50-4b08-901d-1c56affc3114"},{"id":"f1e662c1-033f-489c-8c81-7fb0840af2cb","source":"cc-execution","status":"waiting","payload":{"body":{"ship":true,"files":[{"path":"src/shells/TenantModesShell.tsx","content":"import { type CSSProperties, type ReactNode, useEffect, useMemo, useRef, useState } from 'react';\nimport { Link, Navigate, useLocation } from 'react-router-dom';\nimport { ArrowUpRight, BadgeDollarSign, BarChart3, BriefcaseBusiness, Building2, CalendarDays, CircleAlert, ClipboardCheck, FileText, Home, Layers3, ListTodo, Mail, Radar, Users } from 'lucide-react';\nimport MiscAwareAccountMenu from '@/components/MiscAwareAccountMenu';\nimport TenantLogo from '@/components/branding/TenantLogo';\nimport TennexWorkspaceShell from '@/shells/tennex/TennexWorkspaceShell';\nimport { CanonicalWorkspaceSidebarTrigger, useWorkspaceSidebarRegistration } from '@/components/layout/TenantLayoutControl';\nimport { ApplicationFrame, ApplicationSurface } from '@/components/layout/ApplicationFrame';\nimport TenantModeNavigation, { type TenantModeNavigationItem } from '@/components/tenant-modes/TenantModeNavigation';\nimport { useMultiTenant } from '@/contexts/MultiTenantContext';\nimport { supabase } from '@/integrations/supabase/client';\nimport { OwnerEmbeddedPresentationContext, OwnerShellNestingContext } from '@/layouts/OwnerLayout';\nimport { resolveTenantBackgroundUrl } from '@/lib/tenantBackground';\nimport { resolveTenantMediaBranding } from '@/lib/tenants/tenantMediaBranding';\nimport { getTenantDashboardPathForTenant } from '@/lib/tenantUtils';\nimport { getTenantApplicationByReference } from '@/config/applicationCapabilityRegistry';\nimport { tenantMediaAssetUrl } from '@/lib/tenantMedia';\nimport { resolveTenantWorkspaceTargetPath } from '@/routes/tenantApplicationRouteResolver';\nimport { getTenantModeApplicationsForRole, getTenantModeCardsForRole, modeToken, modesCardOverlayBackground, type TenantModeApplicationConfig, type TenantModeCardConfig } from '@/shells/modesTenantShell';\nimport { LazyFenderBenderModeTitleArt, type FenderBenderModeTitleKey } from '@/shells/modesTitleArt';\nconst DEFAULT_ACCENTS = ['#67d7ff', '#68e0a8', '#f1bf72', '#b9a0ff'] as const;\nconst MODES_DESKTOP_MEDIA_QUERY = '(min-width: 1024px)';\nfunction useModesDesktopViewport() { const [isDesktop, setIsDesktop] = useState(() => typeof window === 'undefined' ? true : window.matchMedia(MODES_DESKTOP_MEDIA_QUERY).matches); useEffect(() => { const media = window.matchMedia(MODES_DESKTOP_MEDIA_QUERY); const sync = () => setIsDesktop(media.matches); sync(); media.addEventListener('change', sync); return () => media.removeEventListener('change', sync); }, []); return isDesktop; }\nfunction iconForMode(mode: TenantModeCardConfig) { const token = `${mode.key} ${mode.title} ${mode.subtitle || ''}`.toLowerCase(); if (/decision|exception|approval|risk|attention/.test(token)) return CircleAlert; if (/opportunit|lead|pipeline|growth|referral/.test(token)) return Radar; if (/business|portfolio|brokerage|company/.test(token)) return Building2; if (/operation|job|production|dispatch|service|work/.test(token)) return BriefcaseBusiness; if (/money|revenue|sales|invoice|finance|paid|commission/.test(token)) return BadgeDollarSign; if (/schedule|calendar|appointment|showing/.test(token)) return CalendarDays; if (/team|agent|crew|staff|customer|contact|client/.test(token)) return Users; if (/message|mail|inbox|communication/.test(token)) return Mail; if (/document|file|form|photo/.test(token)) return FileText; if (/task|follow|queue|next/.test(token)) return ListTodo; if (/report|performance|analytics|pulse/.test(token)) return BarChart3; if (/check|event/.test(token)) return ClipboardCheck; return Home; }\nfunction bigPapisTitleMode(tenant: any, card: TenantModeCardConfig): FenderBenderModeTitleKey | null { const tenantSlug = modeToken(tenant?.company_slug || tenant?.name); if (tenantSlug !== 'big-papis' && tenantSlug !== 'big-papis-coquito-iceys') return null; const key = modeToken(card.key || card.title); if (key === 'plan') return 'plan'; if (key === 'popup' || key === 'pop-up') return 'popup'; if (key === 'event' || key === 'booked-event') return 'event'; if (key === 'office' || key === 'back-office' || key === 'backoffice') return 'office'; return null; }\nfunction isBigPapisTenant(tenant: any): boolean { const candidates = [tenant?.company_slug, tenant?.company_dba_name, tenant?.company_legal_name, tenant?.name].map(modeToken); return candidates.some((value) => value === 'big-papis' || value === 'big-papis-coquito-iceys'); }\ntype CurriPortfolioBusiness = { key: string; name: string; route: string; role: string; summary: string };\nfunction curriControlCenterBusinesses(tenant: any): CurriPortfolioBusiness[] { const settings = tenant?.settings && typeof tenant.settings === 'object' && !Array.isArray(tenant.settings) ? tenant.settings as Record : {}; if (modeToken(settings.workspace_variant) !== 'curri-control-center') return []; const profile = settings.control_center_profile && typeof settings.control_center_profile === 'object' && !Array.isArray(settings.control_center_profile) ? settings.control_center_profile as Record : {}; const children = Array.isArray(profile.child_tenants) ? profile.child_tenants : []; return children.map((raw: any): CurriPortfolioBusiness | null => { const name = String(raw?.name || '').trim(); const route = String(raw?.route || '').trim(); const role = modeToken(raw?.role); if (!name || !route.startsWith('/') || route.startsWith('//') || /(^|\\/)\\.\\.?($|\\/)/.test(route.split(/[?#]/, 1)[0])) return null; const summary = role.includes('realtor') ? 'Run the brokerage: leads, clients, transactions, documents, and closing.' : role.includes('property') || role.includes('maintenance') ? 'Run property operations: dispatch, route, jobs, customers, and money.' : 'Open this operating business workspace.'; return { key: modeToken(raw?.slug || name), name, route, role, summary }; }).filter((entry: CurriPortfolioBusiness | null): entry is CurriPortfolioBusiness => Boolean(entry)); }\nfunction normalizePath(path: string): string { return String(path || '/').split('?')[0].split('#')[0].replace(/\\/+$/g, '') || '/'; }\nexport function isTenantModesLandingLocation(pathname: string, search: string, homePath: string): boolean { if (normalizePath(pathname) !== normalizePath(homePath)) return false; const params = new URLSearchParams(search); return !modeToken(params.get('mode')); }\nfunction safeTenantHome(tenant: any): string { try { return getTenantDashboardPathForTenant(tenant); } catch { const slug = modeToken(tenant?.company_slug || tenant?.name) || 'workspace'; return `/${slug}`; } }\nfunction tenantRootFromHome(homePath: string): string { const first = normalizePath(homePath).split('/').filter(Boolean)[0] || ''; return first ? `/${first}` : ''; }\nexport function tenantScopedModeRoute(route: string | undefined, homePath: string): string { const raw = String(route || '').trim(); if (!raw) return homePath; const tenantRoot = tenantRootFromHome(homePath); if (!tenantRoot || raw.startsWith('//') || /^[a-z][a-z0-9+.-]*:/i.test(raw) || /(^|\\/)\\.\\.?($|\\/)/.test(raw.split(/[?#]/, 1)[0])) return homePath; try { const source = raw.startsWith('?') || raw.startsWith('#') ? `${normalizePath(homePath)}${raw}` : raw.startsWith('/') ? raw : `/${raw.replace(/^\\/+/, '')}`; const parsed = new URL(source, 'https://knocklaunch.local'); const path = normalizePath(parsed.pathname); if (path === tenantRoot || path.startsWith(`${tenantRoot}/`)) return `${parsed.pathname}${parsed.search}${parsed.hash}`; const targetPath = resolveTenantWorkspaceTargetPath(path); if (!targetPath) return homePath; parsed.pathname = `${tenantRoot}/${targetPath.replace(/^\\/+/, '')}`; return `${parsed.pathname}${parsed.search}${parsed.hash}`; } catch { return homePath; } }\nfunction withMode(route: string | undefined, homePath: string, modeKey: string): string { const source = tenantScopedModeRoute(route, homePath); try { const parsed = new URL(source, 'https://knocklaunch.local'); parsed.searchParams.set('mode', modeKey); return `${parsed.pathname}${parsed.search}${parsed.hash}`; } catch { const separator = source.includes('?') ? '&' : '?'; return `${source}${separator}mode=${encodeURIComponent(modeKey)}`; } }\nexport function browserDisplayableMediaUrl(...values: Array): string | null { for (const value of values) { const raw = String(value || '').trim(); if (raw) return raw; } return null; }\nfunction modeImage(mode: TenantModeCardConfig): string | null { return browserDisplayableMediaUrl(mode.image_asset_id ? tenantMediaAssetUrl(mode.image_asset_id) : null, mode.image_url, mode.fallback_image_url, mode.default_image_url); }\nfunction isPartyRentalTenant(tenant: any): boolean { const settings = tenant?.settings && typeof tenant.settings === 'object' && !Array.isArray(tenant.settings) ? tenant.settings as Record : {}; const candidates = [settings.workspace_variant, settings.business_type, settings.declared_business_type, tenant?.tenant_type].map(modeToken); return candidates.some((value) => value === 'party-rentals' || value === 'event-rentals'); }\nfunction isPandaEventRentalTenant(tenant: any): boolean { const values = [tenant?.company_slug, tenant?.company_dba_name, tenant?.company_legal_name, tenant?.name].map(modeToken); return values.some((value) => value.includes('panda')); }\nfunction hrefIdentity(value: string): string { try { const parsed = new URL(value, 'https://knocklaunch.local'); const entries = [...parsed.searchParams.entries()].sort(([leftKey, leftValue], [rightKey, rightValue]) => leftKey.localeCompare(rightKey) || leftValue.localeCompare(rightValue)); const search = new URLSearchParams(entries).toString(); return `${normalizePath(parsed.pathname)}${search ? `?${search}` : ''}`; } catch { return value; } }\nexport function withModeApplication(route: string | undefined, homePath: string, modeKey: string, applicationKey: string): string { const source = withMode(route, homePath, modeKey); try { const parsed = new URL(source, 'https://knocklaunch.local'); const key = modeToken(applicationKey); if (key) parsed.searchParams.set('modeApp', key); return `${parsed.pathname}${parsed.search}${parsed.hash}`; } catch { return source; } }\nfunction workspaceTargetForHref(href: string, homePath: string): string | null { try { const parsed = new URL(href, 'https://knocklaunch.local'); const scoped = tenantScopedModeRoute(`${parsed.pathname}${parsed.search}${parsed.hash}`, homePath); return resolveTenantWorkspaceTargetPath(new URL(scoped, 'https://knocklaunch.local').pathname); } catch { return null; } }\nfunction applicationOwnsHref(application: TenantModeApplicationConfig, href: string, homePath: string): boolean { const current = workspaceTargetForHref(href, homePath); const target = workspaceTargetForHref(String(application.route || ''), homePath); return Boolean(current && target && (current === target || current.startsWith(`${target}/`))); }\nexport function canonicalModeWorkspaceHref(href: string, homePath: string, modeKey: string, applicationKey = ''): string { const source = tenantScopedModeRoute(href, homePath); try { const parsed = new URL(source, 'https://knocklaunch.local'); parsed.searchParams.set('mode', modeKey); const appKey = modeToken(applicationKey); if (appKey) parsed.searchParams.set('modeApp', appKey); else parsed.searchParams.delete('modeApp'); return `${parsed.pathname}${parsed.search}${parsed.hash}`; } catch { return source; } }\nexport function resolveModeApplicationForHref(applications: readonly TenantModeApplicationConfig[], href: string, homePath: string, _modeKey: string): TenantModeApplicationConfig | null { let requestedKey = ''; try { requestedKey = modeToken(new URL(href, 'https://knocklaunch.local').searchParams.get('modeApp')); } catch {} if (requestedKey) { const requested = applications.find((application) => application.key === requestedKey); if (requested && applicationOwnsHref(requested, href, homePath)) return requested; } return applications.find((application) => applicationOwnsHref(application, href, homePath)) || null; }\nfunction iconForApplication(application: TenantModeApplicationConfig) { return iconForMode({ key: application.key, title: application.title, subtitle: application.description }); }\nfunction isEntertainmentTenant(tenant:any){const s=tenant?.settings&&typeof tenant.settings==='object'?tenant.settings:{};const c=s.tenant_classification&&typeof s.tenant_classification==='object'?s.tenant_classification:{};return [c.primary_archetype,s.declared_business_type,s.business_type,tenant?.tenant_type].map(modeToken).some((v)=>['entertainment','entertainment-dj','dj','mobile-dj','wedding-dj','disc-jockey'].includes(v))}\ntype DjPulse={\n ok?:boolean;\n config?:{public_capture_enabled?:boolean;program_state?:string;repeat_visit_threshold?:number;lapsed_days?:number;reward_label?:string|null};\n metrics?:Record;\n analytics?:{repeat_rate?:number;referral_conversion_rate?:number;creative_stages?:Record;professional_stages?:Record;join_sources?:Array<{source:string;count:number}>};\n money?:{creative_booked?:number;professional_booked?:number;total_booked?:number;creative_outstanding?:number;professional_outstanding?:number;total_outstanding?:number;proposal_pipeline?:number;invoice_outstanding?:number};\n next_creative?:any;next_professional?:any;\n next_actions?:Array<{id:string;mode:string;priority:string;label:string;detail:string}>;\n launch_runway?:Array<{id:string;label:string;complete:boolean;mode:string}>;\n fan_segments?:Record;\n milestones?:Record;\n relationships?:{total?:number;promoters?:number;venues?:number};\n};\nconst DJ_MONEY=new Intl.NumberFormat('en-US',{style:'currency',currency:'USD',maximumFractionDigits:0});\nfunction djCurrency(value:unknown){return DJ_MONEY.format(Number(value||0))}\nfunction djEventLabel(event:any){return event?String(event.event_name||event.venue_name||'Upcoming booking'):'Nothing booked yet'}\nfunction djEventMeta(event:any){if(!event)return 'Create the next opportunity from this lane.';return [event.event_date,event.start_time,event.venue_name].filter(Boolean).join(' · ')||'Details need confirmation'}\nfunction stageEntries(value:Record|undefined){return Object.entries(value||{}).sort((a,b)=>b[1]-a[1])}\nfunction DjCockpitLanding({tenant,homePath,businessName}:{tenant:any;homePath:string;businessName:string}){\n const[pulse,setPulse]=useState(null);\n const[error,setError]=useState('');\n const slug=String(tenant?.company_slug||'').trim();\n useEffect(()=>{if(!slug)return;let live=true;setError('');void supabase.functions.invoke('entertainment-fanbase',{body:{tenant_slug:slug,action:'owner_status'}}).then(({data,error})=>{if(!live)return;if(error||!data?.ok){setPulse(null);setError(error?.message||data?.error||'DJ dashboard is catching up');return}setPulse(data)}).catch((e)=>{if(live){setPulse(null);setError(e instanceof Error?e.message:'DJ dashboard is catching up')}});return()=>{live=false}},[slug]);\n const m=pulse?.metrics||{};\n const money=pulse?.money||{};\n const nextCreative=pulse?.next_creative;\n const nextProfessional=pulse?.next_professional;\n const creativeDate=String(nextCreative?.event_date||'9999-12-31');\n const professionalDate=String(nextProfessional?.event_date||'9999-12-31');\n const nextGigMode=nextCreative&&(!nextProfessional||creativeDate<=professionalDate)?'creative':nextProfessional?'professional':'creative';\n const nextGig=nextGigMode==='professional'?nextProfessional:nextCreative;\n const creativeUpcoming=Number(m.creative_upcoming||0);\n const professionalUpcoming=Number(m.professional_upcoming||0);\n const getMoreMode=creativeUpcoming<1?'creative':professionalUpcoming<1?'professional':'creative';\n const getMoreTitle=getMoreMode==='professional'?'Find a professional event':'Find a creative gig';\n const getMoreDetail=getMoreMode==='professional'?'Weddings, corporate, schools, private events.':'Clubs, bars, festivals, promoters, venues.';\n const fans=Number(m.fans||0);\n const outstanding=Number(money.total_outstanding||0);\n const booked=Number(money.total_booked||0);\n return
\n
\n
\n
\n
\n
DJ Home
\n

{businessName}

\n

Your next gig, more gigs, fans, and money. That's it.

\n
\n \n
\n
\n\n {error?
{error}. Your DJ tools still work.
:null}\n\n
\n \n
Next Gig
\n

{nextGig?djEventLabel(nextGig):'Nothing booked yet'}

\n

{nextGig?djEventMeta(nextGig):'Add the next date you are working.'}

\n
{nextGig?'Open gig':'Add a gig'}
\n \n\n \n
Get More Gigs
\n

{getMoreTitle}

\n

{getMoreDetail}

\n
Go get one
\n \n\n \n
Fans
\n
{fans}
\n

{fans===1?'fan on your list':'fans on your list'}

\n
{fans?'Grow my fan list':'Start my fan list'}
\n \n\n \n
Money
\n
{djCurrency(outstanding)}
\n

{outstanding>0?'still needs to be collected':booked>0?djCurrency(booked)+' booked':'Nothing to collect yet'}

\n
Open money
\n \n
\n\n
\n Creative = clubs, bars, festivals, promoters•Professional = weddings, corporate, schools, private events\n
\n
\n
\n}\nexport default function TenantModesShell({ children }: { children: ReactNode }) { const { activeTenant } = useMultiTenant(); const slug=String(activeTenant?.company_slug||'').trim().toLowerCase(); const name=String((activeTenant as any)?.company_dba_name||(activeTenant as any)?.company_legal_name||(activeTenant as any)?.name||'').trim().toLowerCase(); const isTennex=slug==='tennex'||slug==='tennex-tax-solutions'||name==='tennex tax solutions'; if(isTennex)return {children}; return {children}; }\nfunction TenantModesShellBase({ children }: { children: ReactNode }) { const location = useLocation(); const isDesktopViewport = useModesDesktopViewport(); const { activeTenant, effectiveRole } = useMultiTenant(); const cards = useMemo(() => getTenantModeCardsForRole(activeTenant, effectiveRole), [activeTenant, effectiveRole]); const homePath = useMemo(() => safeTenantHome(activeTenant), [activeTenant]); const branding = useMemo(() => resolveTenantMediaBranding(activeTenant), [activeTenant]); const backgroundUrl = browserDisplayableMediaUrl(branding.backgroundUrl, resolveTenantBackgroundUrl(activeTenant)); const tenantSettings = activeTenant?.settings && typeof activeTenant.settings === 'object' && !Array.isArray(activeTenant.settings) ? activeTenant.settings as Record : {}; const publicPresenceSettings = tenantSettings.public_presence && typeof tenantSettings.public_presence === 'object' && !Array.isArray(tenantSettings.public_presence) ? tenantSettings.public_presence as Record : {}; const bookMeDirectlySettings = publicPresenceSettings.bookmedirectly && typeof publicPresenceSettings.bookmedirectly === 'object' && !Array.isArray(publicPresenceSettings.bookmedirectly) ? publicPresenceSettings.bookmedirectly as Record : {}; const publicWebsiteUrl = String(bookMeDirectlySettings.url || '').trim(); const mediaBrandingSettings = tenantSettings.media_branding && typeof tenantSettings.media_branding === 'object' && !Array.isArray(tenantSettings.media_branding) ? tenantSettings.media_branding as Record : {}; const heroBackgroundAssetId = String(mediaBrandingSettings.hero_background_asset_id || '').trim(); const partyHeroBackgroundUrl = browserDisplayableMediaUrl(String(mediaBrandingSettings.hero_background_url || '').trim(), heroBackgroundAssetId ? tenantMediaAssetUrl(heroBackgroundAssetId) : null); const isPartyRentals = isPartyRentalTenant(activeTenant); const isPandaEventRentals = isPartyRentals && isPandaEventRentalTenant(activeTenant); const businessName = String(activeTenant?.company_dba_name || activeTenant?.company_legal_name || activeTenant?.name || 'Workspace').trim(); const lastModeRef = useRef(''); const currentHref = `${location.pathname}${location.search}${location.hash || ''}`; const isBigPapis = isBigPapisTenant(activeTenant); const modeParams = new URLSearchParams(location.search); const requestedMode = modeToken(modeParams.get('mode') || (isBigPapis ? modeParams.get('bpMode') : '')); const requestedModeCard = cards.find((card) => card.key === requestedMode) || null; const recoveredMode = !requestedMode && lastModeRef.current ? cards.find((card) => { if (card.key !== lastModeRef.current) return false; const applications = getTenantModeApplicationsForRole(activeTenant, effectiveRole, card, cards); return Boolean(resolveModeApplicationForHref(applications, currentHref, homePath, card.key)); }) || null : null; const activeMode = requestedModeCard || recoveredMode; const portfolioBusinesses = useMemo(() => activeMode?.key === 'operations' ? curriControlCenterBusinesses(activeTenant) : [], [activeMode?.key, activeTenant]); const portfolioBusinessesMode = activeMode?.key === 'operations' && portfolioBusinesses.length > 0; const modeApplications = useMemo(() => activeMode ? getTenantModeApplicationsForRole(activeTenant, effectiveRole, activeMode, cards) : [], [activeMode, activeTenant, cards, effectiveRole]); const activeApplication = useMemo(() => activeMode ? resolveModeApplicationForHref(modeApplications, currentHref, homePath, activeMode.key) : null, [activeMode, currentHref, homePath, modeApplications]); if (activeMode) lastModeRef.current = activeMode.key; const homeRoutePath = normalizePath(homePath); const isLanding = isTenantModesLandingLocation(location.pathname, location.search, homePath); const pandaBackgroundPosition = isPandaEventRentals ? (branding.backgroundPosition || 'center top') : null; const modeOverviewHref = activeMode ? withMode(homePath, homePath, activeMode.key) : ''; const isModeOverview = Boolean(activeMode && hrefIdentity(`${location.pathname}${location.search}`) === hrefIdentity(modeOverviewHref)); const navItems = useMemo(() => activeMode ? (portfolioBusinessesMode ? portfolioBusinesses.map((business) => ({ label: business.name, path: business.route, icon: Building2, end: true })) : modeApplications.map((application) => ({ label: application.title, path: withModeApplication(application.route, homePath, activeMode.key, application.key), icon: iconForApplication(application), end: true }))) : cards.map((card) => ({ label: card.title, path: withMode(homePath, homePath, card.key), icon: iconForMode(card), end: true })), [activeMode, cards, homePath, modeApplications, portfolioBusinesses, portfolioBusinessesMode]); const sidebarItems = useMemo(() => navItems.map((item, index) => { const modeApplication = modeApplications.find((application) => application.title === item.label); const registeredApplication = modeApplication ? getTenantApplicationByReference(modeApplication.key) : undefined; return { id: `modes:${activeMode?.key || 'all'}:${registeredApplication?.id || index}`, label: item.label, href: item.path, applicationId: registeredApplication?.id }; }), [activeMode?.key, modeApplications, navItems]); const sidebarRegistration = useMemo(() => ({ scopeId: `modes:${activeTenant?.id || 'workspace'}:${activeMode?.key || 'all'}`, priority: 200, label: activeMode ? `${activeMode.title} mode` : 'Modes', contextItems: sidebarItems }), [activeMode, activeTenant?.id, sidebarItems]); useWorkspaceSidebarRegistration(sidebarRegistration); const activeIcon = activeMode ? iconForMode(activeMode) : Layers3; const activeAccent = activeMode?.color || DEFAULT_ACCENTS[0]; const canonicalActiveHref = activeMode ? canonicalModeWorkspaceHref(currentHref, homePath, activeMode.key, activeApplication?.key || '') : currentHref; if (requestedMode && !activeMode) return ; if (activeMode && hrefIdentity(currentHref) !== hrefIdentity(canonicalActiveHref)) return ; return
{activeMode ? : null}
{
span]:hidden\" />{activeMode ? `${activeMode.title} mode` : (isBigPapis ? 'Your Icey Command Center.' : 'MODES')}{businessName}
{isPartyRentals && publicWebsiteUrl ? Website : null}{!activeMode && !isDesktopViewport && !isPandaEventRentals ?
: null}{isDesktopViewport ?
: null}
}{isLanding ? (isPartyRentals ?
{partyHeroBackgroundUrl ? \"\" : null}
Events • Delivery • Setup • Rentals

{businessName}

Pick what you're working on
{cards.slice(0,4).map((card, index) => { const Icon = iconForMode(card); const image = modeImage(card); const accent = card.color || DEFAULT_ACCENTS[index % DEFAULT_ACCENTS.length]; return {image ? \"\" : null}

{card.title}

{card.headline || card.subtitle}

Open
; })}
: isEntertainmentTenant(activeTenant) ? :
{(isBigPapis ? cards.slice(0,4) : cards).map((card, index) => { const Icon = iconForMode(card); const image = modeImage(card); const accent = card.color || DEFAULT_ACCENTS[index % DEFAULT_ACCENTS.length]; const titleArtMode = bigPapisTitleMode(activeTenant, card); return {image ? \"\" : null}
{isBigPapis ?
{titleArtMode ? :

{card.title}

}
: <>
Mode {index + 1}
{titleArtMode ? :

{card.title}

}{card.subtitle ?

{card.subtitle}

: null}}
; })}
) : {isModeOverview && portfolioBusinessesMode ?
Businesses mode

Choose the business you want to run

Control Center stays focused on portfolio decisions. Open Realty World or One Call to do the actual operating work.

{portfolioBusinesses.map((business, index) =>
{index === 0 ? 'Brokerage' : 'Property operations'}

{business.name}

{business.summary}

Open business
)}
: isModeOverview && modeApplications.length ?
{activeMode?.title} mode

{activeMode?.headline || activeMode?.title}

{activeMode?.subtitle ?

{activeMode.subtitle}

: null}
{modeApplications.length} {modeApplications.length === 1 ? 'tool ready' : 'tools ready'}
{modeApplications.map((application) => { const Icon = iconForApplication(application); return
Ready

{application.title}

{application.description}

Open
; })}
: isModeOverview ?
{activeMode?.title} mode

Nothing here yet

There aren’t any tools in this section yet. Head back to your other modes and keep moving.

Back to Modes
: activeApplication ?
{activeMode?.title} mode

{activeApplication.title}

{activeApplication.description ?

{activeApplication.description}

: null}
{children}
 : activeMode ?
{activeMode.title} mode

That tool isn’t available here

Head back to this mode and choose one of the tools ready for you.

Back to {activeMode.title}
: children}}
{isPandaEventRentals && !isDesktopViewport ? : null}{activeMode && !isDesktopViewport && !isPandaEventRentals ? : null}
; }"}],"route":"/dj/dashboard","branch":"ai/objective-first-repair-30cd4575b504","writes":[],"patches":[],"version":1,"approved":true,"missionId":"30cd4575-b504-4bc9-8e97-0c2082101426","objective":"Replace the overcomplicated DJ dashboard with the simple four-part DJ Home: Next Gig, Get More Gigs, Fans, Money. Preserve underlying capabilities behind the existing Creative, Professional, Fanbase, and Office modes. Remove the default analytics wall, launch runway, growth queue, milestone farm, stage chips, fan configuration form, and financial card grid from the home screen. Ship, Gate, merge, deploy, and visually verify /dj/dashboard on desktop and mobile.","repository":"noel/KnockLaunchOS","visualProof":true,"verifyVisual":true,"ownerApproved":true,"releaseIntent":null,"sourceTargets":["src/shells/TenantModesShell.tsx"],"implementation":{"files":[],"writes":[]},"requestContract":null,"repairGeneration":null,"executionEnvelope":{"ship":true,"version":1,"approved":true,"missionId":"30cd4575-b504-4bc9-8e97-0c2082101426","ownerApproved":true,"releaseIntent":null,"sourceTargets":["src/shells/TenantModesShell.tsx"],"requestContract":null,"repairGeneration":null,"proofRequirements":null,"controlPlaneUnfreeze":false,"controlPlaneMaintenance":false,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":null},"proofRequirements":null,"controlPlaneUnfreeze":false,"durableMutationResume":true,"controlPlaneMaintenance":false,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":null},"recovery":false,"fingerprint":"a44eab6684b4f95d481afbe2666b177154b6c7d33abbaa3c995725bdf8f5c373","replayCount":0,"serializedBytes":62709},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-27T21:24:07.574773+00:00","proof_gate":"repository_mutation_intent_persisted","source_sha":null,"external_id":null,"receipt_type":"repository_mutation_intent","idempotency_key":"mission:30cd4575-b504-4bc9-8e97-0c2082101426:repository-mutation-intent:a44eab6684b4f95d481afbe2666b177154b6c7d33abbaa3c995725bdf8f5c373:0","mission_step_id":"3aaf57df-eca2-4e6f-938b-3dcaff587900","command_center_event_id":"30cd4575-b504-4bc9-8e97-0c2082101426"},{"id":"2cbdca61-421c-48fb-bb1e-2378f8c2245e","source":"cc-execution","status":"waiting","payload":{"body":{"ship":true,"files":[{"path":"src/shells/TenantModesShell.tsx","content":"import { type CSSProperties, type ReactNode, useEffect, useMemo, useRef, useState } from 'react';\nimport { Link, Navigate, useLocation } from 'react-router-dom';\nimport { ArrowUpRight, BadgeDollarSign, BarChart3, BriefcaseBusiness, Building2, CalendarDays, CircleAlert, ClipboardCheck, FileText, Home, Layers3, ListTodo, Mail, Radar, Users } from 'lucide-react';\nimport MiscAwareAccountMenu from '@/components/MiscAwareAccountMenu';\nimport TenantLogo from '@/components/branding/TenantLogo';\nimport TennexWorkspaceShell from '@/shells/tennex/TennexWorkspaceShell';\nimport { CanonicalWorkspaceSidebarTrigger, useWorkspaceSidebarRegistration } from '@/components/layout/TenantLayoutControl';\nimport { ApplicationFrame, ApplicationSurface } from '@/components/layout/ApplicationFrame';\nimport TenantModeNavigation, { type TenantModeNavigationItem } from '@/components/tenant-modes/TenantModeNavigation';\nimport { useMultiTenant } from '@/contexts/MultiTenantContext';\nimport { OwnerEmbeddedPresentationContext, OwnerShellNestingContext } from '@/layouts/OwnerLayout';\nimport { resolveTenantBackgroundUrl } from '@/lib/tenantBackground';\nimport { resolveTenantMediaBranding } from '@/lib/tenants/tenantMediaBranding';\nimport { getTenantDashboardPathForTenant } from '@/lib/tenantUtils';\nimport { getTenantApplicationByReference } from '@/config/applicationCapabilityRegistry';\nimport { tenantMediaAssetUrl } from '@/lib/tenantMedia';\nimport { resolveTenantWorkspaceTargetPath } from '@/routes/tenantApplicationRouteResolver';\nimport { getTenantModeApplicationsForRole, getTenantModeCardsForRole, modeToken, modesCardOverlayBackground, type TenantModeApplicationConfig, type TenantModeCardConfig } from '@/shells/modesTenantShell';\nimport { LazyFenderBenderModeTitleArt, type FenderBenderModeTitleKey } from '@/shells/modesTitleArt';\nconst DEFAULT_ACCENTS = ['#67d7ff', '#68e0a8', '#f1bf72', '#b9a0ff'] as const;\nconst MODES_DESKTOP_MEDIA_QUERY = '(min-width: 1024px)';\nfunction useModesDesktopViewport() { const [isDesktop, setIsDesktop] = useState(() => typeof window === 'undefined' ? true : window.matchMedia(MODES_DESKTOP_MEDIA_QUERY).matches); useEffect(() => { const media = window.matchMedia(MODES_DESKTOP_MEDIA_QUERY); const sync = () => setIsDesktop(media.matches); sync(); media.addEventListener('change', sync); return () => media.removeEventListener('change', sync); }, []); return isDesktop; }\nfunction iconForMode(mode: TenantModeCardConfig) { const token = `${mode.key} ${mode.title} ${mode.subtitle || ''}`.toLowerCase(); if (/decision|exception|approval|risk|attention/.test(token)) return CircleAlert; if (/opportunit|lead|pipeline|growth|referral/.test(token)) return Radar; if (/business|portfolio|brokerage|company/.test(token)) return Building2; if (/operation|job|production|dispatch|service|work/.test(token)) return BriefcaseBusiness; if (/money|revenue|sales|invoice|finance|paid|commission/.test(token)) return BadgeDollarSign; if (/schedule|calendar|appointment|showing/.test(token)) return CalendarDays; if (/team|agent|crew|staff|customer|contact|client/.test(token)) return Users; if (/message|mail|inbox|communication/.test(token)) return Mail; if (/document|file|form|photo/.test(token)) return FileText; if (/task|follow|queue|next/.test(token)) return ListTodo; if (/report|performance|analytics|pulse/.test(token)) return BarChart3; if (/check|event/.test(token)) return ClipboardCheck; return Home; }\nfunction bigPapisTitleMode(tenant: any, card: TenantModeCardConfig): FenderBenderModeTitleKey | null { const tenantSlug = modeToken(tenant?.company_slug || tenant?.name); if (tenantSlug !== 'big-papis' && tenantSlug !== 'big-papis-coquito-iceys') return null; const key = modeToken(card.key || card.title); if (key === 'plan') return 'plan'; if (key === 'popup' || key === 'pop-up') return 'popup'; if (key === 'event' || key === 'booked-event') return 'event'; if (key === 'office' || key === 'back-office' || key === 'backoffice') return 'office'; return null; }\nfunction isBigPapisTenant(tenant: any): boolean { const candidates = [tenant?.company_slug, tenant?.company_dba_name, tenant?.company_legal_name, tenant?.name].map(modeToken); return candidates.some((value) => value === 'big-papis' || value === 'big-papis-coquito-iceys'); }\ntype CurriPortfolioBusiness = { key: string; name: string; route: string; role: string; summary: string };\nfunction curriControlCenterBusinesses(tenant: any): CurriPortfolioBusiness[] { const settings = tenant?.settings && typeof tenant.settings === 'object' && !Array.isArray(tenant.settings) ? tenant.settings as Record : {}; if (modeToken(settings.workspace_variant) !== 'curri-control-center') return []; const profile = settings.control_center_profile && typeof settings.control_center_profile === 'object' && !Array.isArray(settings.control_center_profile) ? settings.control_center_profile as Record : {}; const children = Array.isArray(profile.child_tenants) ? profile.child_tenants : []; return children.map((raw: any): CurriPortfolioBusiness | null => { const name = String(raw?.name || '').trim(); const route = String(raw?.route || '').trim(); const role = modeToken(raw?.role); if (!name || !route.startsWith('/') || route.startsWith('//') || /(^|\\/)\\.\\.?($|\\/)/.test(route.split(/[?#]/, 1)[0])) return null; const summary = role.includes('realtor') ? 'Run the brokerage: leads, clients, transactions, documents, and closing.' : role.includes('property') || role.includes('maintenance') ? 'Run property operations: dispatch, route, jobs, customers, and money.' : 'Open this operating business workspace.'; return { key: modeToken(raw?.slug || name), name, route, role, summary }; }).filter((entry: CurriPortfolioBusiness | null): entry is CurriPortfolioBusiness => Boolean(entry)); }\nfunction normalizePath(path: string): string { return String(path || '/').split('?')[0].split('#')[0].replace(/\\/+$/g, '') || '/'; }\nexport function isTenantModesLandingLocation(pathname: string, search: string, homePath: string): boolean { if (normalizePath(pathname) !== normalizePath(homePath)) return false; const params = new URLSearchParams(search); return !modeToken(params.get('mode')); }\nfunction safeTenantHome(tenant: any): string { try { return getTenantDashboardPathForTenant(tenant); } catch { const slug = modeToken(tenant?.company_slug || tenant?.name) || 'workspace'; return `/${slug}`; } }\nfunction tenantRootFromHome(homePath: string): string { const first = normalizePath(homePath).split('/').filter(Boolean)[0] || ''; return first ? `/${first}` : ''; }\nexport function tenantScopedModeRoute(route: string | undefined, homePath: string): string { const raw = String(route || '').trim(); if (!raw) return homePath; const tenantRoot = tenantRootFromHome(homePath); if (!tenantRoot || raw.startsWith('//') || /^[a-z][a-z0-9+.-]*:/i.test(raw) || /(^|\\/)\\.\\.?($|\\/)/.test(raw.split(/[?#]/, 1)[0])) return homePath; try { const source = raw.startsWith('?') || raw.startsWith('#') ? `${normalizePath(homePath)}${raw}` : raw.startsWith('/') ? raw : `/${raw.replace(/^\\/+/, '')}`; const parsed = new URL(source, 'https://knocklaunch.local'); const path = normalizePath(parsed.pathname); if (path === tenantRoot || path.startsWith(`${tenantRoot}/`)) return `${parsed.pathname}${parsed.search}${parsed.hash}`; const targetPath = resolveTenantWorkspaceTargetPath(path); if (!targetPath) return homePath; parsed.pathname = `${tenantRoot}/${targetPath.replace(/^\\/+/, '')}`; return `${parsed.pathname}${parsed.search}${parsed.hash}`; } catch { return homePath; } }\nfunction withMode(route: string | undefined, homePath: string, modeKey: string): string { const source = tenantScopedModeRoute(route, homePath); try { const parsed = new URL(source, 'https://knocklaunch.local'); parsed.searchParams.set('mode', modeKey); return `${parsed.pathname}${parsed.search}${parsed.hash}`; } catch { const separator = source.includes('?') ? '&' : '?'; return `${source}${separator}mode=${encodeURIComponent(modeKey)}`; } }\nexport function browserDisplayableMediaUrl(...values: Array): string | null { for (const value of values) { const raw = String(value || '').trim(); if (raw) return raw; } return null; }\nfunction modeImage(mode: TenantModeCardConfig): string | null { return browserDisplayableMediaUrl(mode.image_asset_id ? tenantMediaAssetUrl(mode.image_asset_id) : null, mode.image_url, mode.fallback_image_url, mode.default_image_url); }\nfunction isPartyRentalTenant(tenant: any): boolean { const settings = tenant?.settings && typeof tenant.settings === 'object' && !Array.isArray(tenant.settings) ? tenant.settings as Record : {}; const candidates = [settings.workspace_variant, settings.business_type, settings.declared_business_type, tenant?.tenant_type].map(modeToken); return candidates.some((value) => value === 'party-rentals' || value === 'event-rentals'); }\nfunction isPandaEventRentalTenant(tenant: any): boolean { const values = [tenant?.company_slug, tenant?.company_dba_name, tenant?.company_legal_name, tenant?.name].map(modeToken); return values.some((value) => value.includes('panda')); }\nfunction hrefIdentity(value: string): string { try { const parsed = new URL(value, 'https://knocklaunch.local'); const entries = [...parsed.searchParams.entries()].sort(([leftKey, leftValue], [rightKey, rightValue]) => leftKey.localeCompare(rightKey) || leftValue.localeCompare(rightValue)); const search = new URLSearchParams(entries).toString(); return `${normalizePath(parsed.pathname)}${search ? `?${search}` : ''}`; } catch { return value; } }\nexport function withModeApplication(route: string | undefined, homePath: string, modeKey: string, applicationKey: string): string { const source = withMode(route, homePath, modeKey); try { const parsed = new URL(source, 'https://knocklaunch.local'); const key = modeToken(applicationKey); if (key) parsed.searchParams.set('modeApp', key); return `${parsed.pathname}${parsed.search}${parsed.hash}`; } catch { return source; } }\nfunction workspaceTargetForHref(href: string, homePath: string): string | null { try { const parsed = new URL(href, 'https://knocklaunch.local'); const scoped = tenantScopedModeRoute(`${parsed.pathname}${parsed.search}${parsed.hash}`, homePath); return resolveTenantWorkspaceTargetPath(new URL(scoped, 'https://knocklaunch.local').pathname); } catch { return null; } }\nfunction applicationOwnsHref(application: TenantModeApplicationConfig, href: string, homePath: string): boolean { const current = workspaceTargetForHref(href, homePath); const target = workspaceTargetForHref(String(application.route || ''), homePath); return Boolean(current && target && (current === target || current.startsWith(`${target}/`))); }\nexport function canonicalModeWorkspaceHref(href: string, homePath: string, modeKey: string, applicationKey = ''): string { const source = tenantScopedModeRoute(href, homePath); try { const parsed = new URL(source, 'https://knocklaunch.local'); parsed.searchParams.set('mode', modeKey); const appKey = modeToken(applicationKey); if (appKey) parsed.searchParams.set('modeApp', appKey); else parsed.searchParams.delete('modeApp'); return `${parsed.pathname}${parsed.search}${parsed.hash}`; } catch { return source; } }\nexport function resolveModeApplicationForHref(applications: readonly TenantModeApplicationConfig[], href: string, homePath: string, _modeKey: string): TenantModeApplicationConfig | null { let requestedKey = ''; try { requestedKey = modeToken(new URL(href, 'https://knocklaunch.local').searchParams.get('modeApp')); } catch {} if (requestedKey) { const requested = applications.find((application) => application.key === requestedKey); if (requested && applicationOwnsHref(requested, href, homePath)) return requested; } return applications.find((application) => applicationOwnsHref(application, href, homePath)) || null; }\nfunction iconForApplication(application: TenantModeApplicationConfig) { return iconForMode({ key: application.key, title: application.title, subtitle: application.description }); }\nexport default function TenantModesShell({ children }: { children: ReactNode }) { const { activeTenant } = useMultiTenant(); const slug=String(activeTenant?.company_slug||'').trim().toLowerCase(); const name=String((activeTenant as any)?.company_dba_name||(activeTenant as any)?.company_legal_name||(activeTenant as any)?.name||'').trim().toLowerCase(); const isTennex=slug==='tennex'||slug==='tennex-tax-solutions'||name==='tennex tax solutions'; if(isTennex)return {children}; return {children}; }\nfunction TenantModesShellBase({ children }: { children: ReactNode }) { const location = useLocation(); const isDesktopViewport = useModesDesktopViewport(); const { activeTenant, effectiveRole } = useMultiTenant(); const cards = useMemo(() => getTenantModeCardsForRole(activeTenant, effectiveRole), [activeTenant, effectiveRole]); const homePath = useMemo(() => safeTenantHome(activeTenant), [activeTenant]); const branding = useMemo(() => resolveTenantMediaBranding(activeTenant), [activeTenant]); const backgroundUrl = browserDisplayableMediaUrl(branding.backgroundUrl, resolveTenantBackgroundUrl(activeTenant)); const tenantSettings = activeTenant?.settings && typeof activeTenant.settings === 'object' && !Array.isArray(activeTenant.settings) ? activeTenant.settings as Record : {}; const publicPresenceSettings = tenantSettings.public_presence && typeof tenantSettings.public_presence === 'object' && !Array.isArray(tenantSettings.public_presence) ? tenantSettings.public_presence as Record : {}; const bookMeDirectlySettings = publicPresenceSettings.bookmedirectly && typeof publicPresenceSettings.bookmedirectly === 'object' && !Array.isArray(publicPresenceSettings.bookmedirectly) ? publicPresenceSettings.bookmedirectly as Record : {}; const publicWebsiteUrl = String(bookMeDirectlySettings.url || '').trim(); const mediaBrandingSettings = tenantSettings.media_branding && typeof tenantSettings.media_branding === 'object' && !Array.isArray(tenantSettings.media_branding) ? tenantSettings.media_branding as Record : {}; const heroBackgroundAssetId = String(mediaBrandingSettings.hero_background_asset_id || '').trim(); const partyHeroBackgroundUrl = browserDisplayableMediaUrl(String(mediaBrandingSettings.hero_background_url || '').trim(), heroBackgroundAssetId ? tenantMediaAssetUrl(heroBackgroundAssetId) : null); const isPartyRentals = isPartyRentalTenant(activeTenant); const isPandaEventRentals = isPartyRentals && isPandaEventRentalTenant(activeTenant); const businessName = String(activeTenant?.company_dba_name || activeTenant?.company_legal_name || activeTenant?.name || 'Workspace').trim(); const lastModeRef = useRef(''); const currentHref = `${location.pathname}${location.search}${location.hash || ''}`; const isBigPapis = isBigPapisTenant(activeTenant); const modeParams = new URLSearchParams(location.search); const requestedMode = modeToken(modeParams.get('mode') || (isBigPapis ? modeParams.get('bpMode') : '')); const requestedModeCard = cards.find((card) => card.key === requestedMode) || null; const recoveredMode = !requestedMode && lastModeRef.current ? cards.find((card) => { if (card.key !== lastModeRef.current) return false; const applications = getTenantModeApplicationsForRole(activeTenant, effectiveRole, card, cards); return Boolean(resolveModeApplicationForHref(applications, currentHref, homePath, card.key)); }) || null : null; const activeMode = requestedModeCard || recoveredMode; const portfolioBusinesses = useMemo(() => activeMode?.key === 'operations' ? curriControlCenterBusinesses(activeTenant) : [], [activeMode?.key, activeTenant]); const portfolioBusinessesMode = activeMode?.key === 'operations' && portfolioBusinesses.length > 0; const modeApplications = useMemo(() => activeMode ? getTenantModeApplicationsForRole(activeTenant, effectiveRole, activeMode, cards) : [], [activeMode, activeTenant, cards, effectiveRole]); const activeApplication = useMemo(() => activeMode ? resolveModeApplicationForHref(modeApplications, currentHref, homePath, activeMode.key) : null, [activeMode, currentHref, homePath, modeApplications]); if (activeMode) lastModeRef.current = activeMode.key; const homeRoutePath = normalizePath(homePath); const isLanding = isTenantModesLandingLocation(location.pathname, location.search, homePath); const pandaBackgroundPosition = isPandaEventRentals ? (branding.backgroundPosition || 'center top') : null; const modeOverviewHref = activeMode ? withMode(homePath, homePath, activeMode.key) : ''; const isModeOverview = Boolean(activeMode && hrefIdentity(`${location.pathname}${location.search}`) === hrefIdentity(modeOverviewHref)); const navItems = useMemo(() => activeMode ? (portfolioBusinessesMode ? portfolioBusinesses.map((business) => ({ label: business.name, path: business.route, icon: Building2, end: true })) : modeApplications.map((application) => ({ label: application.title, path: withModeApplication(application.route, homePath, activeMode.key, application.key), icon: iconForApplication(application), end: true }))) : cards.map((card) => ({ label: card.title, path: withMode(homePath, homePath, card.key), icon: iconForMode(card), end: true })), [activeMode, cards, homePath, modeApplications, portfolioBusinesses, portfolioBusinessesMode]); const sidebarItems = useMemo(() => navItems.map((item, index) => { const modeApplication = modeApplications.find((application) => application.title === item.label); const registeredApplication = modeApplication ? getTenantApplicationByReference(modeApplication.key) : undefined; return { id: `modes:${activeMode?.key || 'all'}:${registeredApplication?.id || index}`, label: item.label, href: item.path, applicationId: registeredApplication?.id }; }), [activeMode?.key, modeApplications, navItems]); const sidebarRegistration = useMemo(() => ({ scopeId: `modes:${activeTenant?.id || 'workspace'}:${activeMode?.key || 'all'}`, priority: 200, label: activeMode ? `${activeMode.title} mode` : 'Modes', contextItems: sidebarItems }), [activeMode, activeTenant?.id, sidebarItems]); useWorkspaceSidebarRegistration(sidebarRegistration); const activeIcon = activeMode ? iconForMode(activeMode) : Layers3; const activeAccent = activeMode?.color || DEFAULT_ACCENTS[0]; const canonicalActiveHref = activeMode ? canonicalModeWorkspaceHref(currentHref, homePath, activeMode.key, activeApplication?.key || '') : currentHref; if (requestedMode && !activeMode) return ; if (activeMode && hrefIdentity(currentHref) !== hrefIdentity(canonicalActiveHref)) return ; return
{activeMode ? : null}
{
span]:hidden\" />{activeMode ? `${activeMode.title} mode` : (isBigPapis ? 'Your Icey Command Center.' : 'MODES')}{businessName}
{isPartyRentals && publicWebsiteUrl ? Website : null}{!activeMode && !isDesktopViewport && !isPandaEventRentals ?
: null}{isDesktopViewport ?
: null}
}{isLanding ? (isPartyRentals ?
{partyHeroBackgroundUrl ? \"\" : null}
Events • Delivery • Setup • Rentals

{businessName}

Pick what you're working on
{cards.slice(0,4).map((card, index) => { const Icon = iconForMode(card); const image = modeImage(card); const accent = card.color || DEFAULT_ACCENTS[index % DEFAULT_ACCENTS.length]; return {image ? \"\" : null}

{card.title}

{card.headline || card.subtitle}

Open
; })}
:
{(isBigPapis ? cards.slice(0,4) : cards).map((card, index) => { const Icon = iconForMode(card); const image = modeImage(card); const accent = card.color || DEFAULT_ACCENTS[index % DEFAULT_ACCENTS.length]; const titleArtMode = bigPapisTitleMode(activeTenant, card); return {image ? \"\" : null}
{isBigPapis ?
{titleArtMode ? :

{card.title}

}
: <>
Mode {index + 1}
{titleArtMode ? :

{card.title}

}{card.subtitle ?

{card.subtitle}

: null}}
; })}
) : {isModeOverview && portfolioBusinessesMode ?
Businesses mode

Choose the business you want to run

Control Center stays focused on portfolio decisions. Open Realty World or One Call to do the actual operating work.

{portfolioBusinesses.map((business, index) =>
{index === 0 ? 'Brokerage' : 'Property operations'}

{business.name}

{business.summary}

Open business
)}
: isModeOverview && modeApplications.length ?
{activeMode?.title} mode

{activeMode?.headline || activeMode?.title}

{activeMode?.subtitle ?

{activeMode.subtitle}

: null}
{modeApplications.length} {modeApplications.length === 1 ? 'tool ready' : 'tools ready'}
{modeApplications.map((application) => { const Icon = iconForApplication(application); return
Ready

{application.title}

{application.description}

Open
; })}
: isModeOverview ?
{activeMode?.title} mode

Nothing here yet

There aren’t any tools in this section yet. Head back to your other modes and keep moving.

Back to Modes
: activeApplication ?
{activeMode?.title} mode

{activeApplication.title}

{activeApplication.description ?

{activeApplication.description}

: null}
{children}
 : activeMode ?
{activeMode.title} mode

That tool isn’t available here

Head back to this mode and choose one of the tools ready for you.

Back to {activeMode.title}
: children}}
{isPandaEventRentals && !isDesktopViewport ? : null}{activeMode && !isDesktopViewport && !isPandaEventRentals ? : null}
; }"},{"path":"src/shells/modesTenantShell.ts","content":"import {\n applyTenantExperienceFamily,\n tenantExperienceFamily,\n type TenantExperienceFamily,\n} from '@/lib/tenants/tenantExperienceFamily';\nimport { getTenantApplicationByReference, isTenantApplicationSupported } from '@/config/applicationCapabilityRegistry';\nimport { getSafeConfiguredTenantRoute, getTenantDashboardPathForTenant } from '@/lib/tenantUtils';\n\nexport { applyTenantExperienceFamily, tenantExperienceFamily, type TenantExperienceFamily } from '@/lib/tenants/tenantExperienceFamily';\nexport const MODES_TENANT_SHELL_KEY = 'MODES' as const;\nexport const MODES_EXPERIENCE_FAMILY = 'modes' as const;\n\nexport interface TenantModeCardConfig {\n key: string;\n title: string;\n subtitle?: string;\n headline?: string;\n color?: string;\n route?: string;\n roles?: readonly string[];\n primary_applications?: readonly string[];\n storage_slug?: string;\n image_asset_id?: string | null;\n image_url?: string | null;\n fallback_image_url?: string | null;\n default_image_key?: string | null;\n default_image_url?: string | null;\n image_source?: string | null;\n image_position_x?: number;\n image_position_y?: number;\n}\n\nexport interface TenantModeApplicationConfig {\n key: string;\n title: string;\n description: string;\n route: string;\n score: number;\n}\n\nexport const MODES_TENANT_SHELL_TEMPLATE = {\n key: MODES_TENANT_SHELL_KEY,\n label: 'Mode Cards',\n description: 'Daily role-aware operating modes presented as premium tenant cards.',\n modeDriven: true,\n mediaPrefix: 'media/modes//',\n profileSections: ['MODE_CARD_IMAGE_UPLOADS'] as const,\n} as const;\n\nconst MODE_COLORS = ['#67d7ff', '#68e0a8', '#f1bf72', '#b9a0ff'] as const;\nexport const MODE_DEFAULT_MEDIA_CONTRACT = 'MODE_DEFAULT_MEDIA_V2' as const;\nexport const MODES_TENANT_CAPABILITY_CONTRACT = 'MODES_TENANT_V1' as const;\nexport type ModeDefaultImageKey = 'operations' | 'planning' | 'growth' | 'financials' | 'back-office' | 'field' | 'rentals' | 'events' | 'activations' | 'vendors';\nexport const MODE_DEFAULT_IMAGE_KEYS: readonly ModeDefaultImageKey[] = ['operations', 'planning', 'growth', 'financials', 'back-office', 'field', 'rentals', 'events', 'activations', 'vendors'];\nconst MODE_DEFAULT_ALIASES: Record = {operations:'operations',operation:'operations',command:'operations',today:'operations',work:'operations','work-queue':'operations',jobs:'operations',job:'operations',team:'operations',overview:'operations',focus:'operations',planning:'planning',plan:'planning',schedule:'planning',calendar:'planning',prep:'planning',prepare:'planning',growth:'growth',opportunity:'growth',opportunities:'growth',pipeline:'growth',sales:'growth',customers:'growth',customer:'growth','follow-up':'growth',followup:'growth',financials:'financials',financial:'financials',finance:'financials',money:'financials',performance:'financials',reports:'financials',analytics:'financials','back-office':'back-office',backoffice:'back-office',office:'back-office',admin:'back-office',administration:'back-office',documents:'back-office',document:'back-office',field:'field',popup:'field','pop-up':'field','on-site':'field',onsite:'field',rentals:'rentals',rental:'rentals',events:'events',event:'events','booked-event':'events',activations:'activations',activation:'activations',vendors:'vendors',vendor:'vendors'};\n\nexport function modesCardOverlayBackground(color: string): string {\n const accent = String(color || '#ffffff').trim() || '#ffffff';\n return `radial-gradient(circle at 50% 10%, rgba(255,255,255,.08), transparent 38%), linear-gradient(180deg, rgba(2,7,13,0) 0%, rgba(2,7,13,.02) 32%, rgba(2,7,13,.10) 56%, rgba(2,7,13,.32) 79%, rgba(2,7,13,.58) 100%), linear-gradient(135deg, ${accent}22 0%, transparent 46%)`;\n}\n\nfunction record(value: unknown): Record {\n return value && typeof value === 'object' && !Array.isArray(value) ? value as Record : {};\n}\n\nfunction strings(value: unknown): string[] {\n return Array.isArray(value) ? value.map((entry) => String(entry || '').trim()).filter(Boolean) : [];\n}\n\nfunction firstString(...values: unknown[]): string | undefined {\n for (const value of values) {\n const normalized = String(value || '').trim();\n if (normalized) return normalized;\n }\n return undefined;\n}\n\nfunction imagePositionPercent(value: unknown): number | undefined {\n if (value === null || value === undefined || value === '') return undefined;\n const numeric = Number(value);\n if (!Number.isFinite(numeric)) return undefined;\n return Math.max(0, Math.min(100, numeric));\n}\n\nexport function modeToken(value: unknown): string {\n return String(value || '').trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80);\n}\n\ntype TenantTypeModePreset = Pick;\ntype TenantModeApplicationPresentation = Pick;\n\nconst EVENT_RENTAL_MODE_SHELL_PRESET: Record = {\n plan: { title: 'Bookings', headline: 'Turn inquiries into reserved dates', subtitle: 'Availability, quotes, agreements, deposits & calendar', primary_applications: ['booking', 'rental-inventory', 'calendar', 'proposals', 'payments'] },\n planning: { title: 'Bookings', headline: 'Turn inquiries into reserved dates', subtitle: 'Availability, quotes, agreements, deposits & calendar', primary_applications: ['booking', 'rental-inventory', 'calendar', 'proposals', 'payments'] },\n booking: { title: 'Prep & Loadout', headline: 'Get every rental ready to roll', subtitle: 'Rental prep, loadout, delivery prep & tasks', primary_applications: ['event-rental-operations', 'rental-inventory', 'tasks', 'documents', 'calendar'] },\n 'pop-up': { title: 'Prep & Loadout', headline: 'Get every rental ready to roll', subtitle: 'Rental prep, loadout, delivery prep & tasks', primary_applications: ['event-rental-operations', 'rental-inventory', 'tasks', 'documents', 'calendar'] },\n operations: { title: 'Delivery & Pickup', headline: 'Run the rental from delivery through return', subtitle: 'Delivery, setup, active rental, pickup & closeout', primary_applications: ['event-rental-operations', 'calendar', 'contacts', 'communications', 'forms'] },\n 'booked-event': { title: 'Delivery & Pickup', headline: 'Run the rental from delivery through return', subtitle: 'Delivery, setup, active rental, pickup & closeout', primary_applications: ['event-rental-operations', 'calendar', 'contacts', 'communications', 'forms'] },\n events: { title: 'Delivery & Pickup', headline: 'Run the rental from delivery through return', subtitle: 'Delivery, setup, active rental, pickup & closeout', primary_applications: ['event-rental-operations', 'calendar', 'contacts', 'communications', 'forms'] },\n 'back-office': { title: 'Back Office', headline: 'Keep the rental business tight behind the scenes', subtitle: 'Customers, invoices, payments, documents & reporting', primary_applications: ['contacts', 'invoices', 'payments', 'documents', 'analytics'] },\n financials: { title: 'Back Office', headline: 'Keep the rental business tight behind the scenes', subtitle: 'Customers, invoices, payments, documents & reporting', primary_applications: ['contacts', 'invoices', 'payments', 'documents', 'analytics'] },\n};\n\nconst EVENT_RENTAL_BOOKING_APPLICATIONS: Readonly> = {\n booking: { title: 'Booking Board', description: 'Review inquiries, reserve dates, and move each rental toward confirmation.' },\n 'rental-inventory': { title: 'Rental Inventory & Availability', description: 'Check real gear availability and conflicts before promising a date.' },\n calendar: { title: 'Event Calendar', description: 'See reserved dates, delivery windows, pickups, and event timing.' },\n proposals: { title: 'Quotes & Agreements', description: 'Build the quote, agreement, and rental terms for approval.' },\n payments: { title: 'Deposits & Balances', description: 'Track deposits, remaining balances, and payment status.' },\n};\n\nconst EVENT_RENTAL_PREP_APPLICATIONS: Readonly> = {\n 'event-rental-operations': { title: 'Loadout Board', description: 'Build the loadout and move each rental through prep.' },\n 'rental-inventory': { title: 'Rental Inventory', description: 'Confirm quantities, condition, and what is actually going on the truck.' },\n tasks: { title: 'Prep Checklist', description: 'Keep cleaning, staging, packing, and final checks together.' },\n documents: { title: 'Event Documents', description: 'Keep venue notes, agreements, photos, and rental paperwork with the event.' },\n calendar: { title: 'Delivery Schedule', description: 'See prep deadlines and upcoming delivery windows.' },\n};\n\nconst EVENT_RENTAL_DELIVERY_APPLICATIONS: Readonly> = {\n 'event-rental-operations': { title: 'Event Run Sheet', description: 'Run delivery, setup, active rental, teardown, pickup, and return inspection.' },\n calendar: { title: 'Delivery Schedule', description: 'See delivery, setup, pickup, and timing at a glance.' },\n contacts: { title: 'Customer & Venue', description: 'Keep the renter, venue, site contact, and delivery details together.' },\n communications: { title: 'Messages', description: 'Handle event-specific customer and crew communication.' },\n forms: { title: 'Setup & Return Forms', description: 'Capture setup proof, condition notes, signatures, and return checks.' },\n};\n\nconst EVENT_RENTAL_BACK_OFFICE_APPLICATIONS: Readonly> = {\n contacts: { title: 'Customers', description: 'Manage renters and repeat-customer history.' },\n invoices: { title: 'Invoices', description: 'Bill rentals and track what is due.' },\n payments: { title: 'Payments', description: 'See deposits, balances, refunds, and payment status.' },\n documents: { title: 'Documents', description: 'Keep business and rental documents organized.' },\n analytics: { title: 'Reports', description: 'Review booking, revenue, utilization, and operating trends.' },\n};\n\nconst EVENT_RENTAL_MODE_APPLICATION_PRESENTATION: Readonly>>> = {\n plan: EVENT_RENTAL_BOOKING_APPLICATIONS,\n planning: EVENT_RENTAL_BOOKING_APPLICATIONS,\n booking: EVENT_RENTAL_PREP_APPLICATIONS,\n 'pop-up': EVENT_RENTAL_PREP_APPLICATIONS,\n operations: EVENT_RENTAL_DELIVERY_APPLICATIONS,\n 'booked-event': EVENT_RENTAL_DELIVERY_APPLICATIONS,\n events: EVENT_RENTAL_DELIVERY_APPLICATIONS,\n 'back-office': EVENT_RENTAL_BACK_OFFICE_APPLICATIONS,\n financials: EVENT_RENTAL_BACK_OFFICE_APPLICATIONS,\n};\n\nfunction isEventRentalBusinessType(tenant: any): boolean {\n const settings = record(tenant?.settings);\n const manifest = record(settings.tenant_manifest);\n const blueprint = record(settings.business_operating_blueprint || manifest.businessOperatingBlueprint);\n const businessType = modeToken(\n blueprint.businessTypeKey\n || blueprint.business_type_key\n || settings.declared_business_type\n || settings.business_type\n || tenant?.tenant_type,\n );\n return ['event-rental', 'event-rentals', 'party-rental', 'party-rentals'].includes(businessType);\n}\n\nexport function applyEventRentalModeShellPreset(tenant: any, cards: readonly TenantModeCardConfig[]): TenantModeCardConfig[] {\n if (!isEventRentalBusinessType(tenant)) return [...cards];\n return cards.map((card) => {\n const preset = EVENT_RENTAL_MODE_SHELL_PRESET[card.key];\n return preset ? { ...card, ...preset, primary_applications: [...preset.primary_applications] } : card;\n });\n}\n\nfunction applyEventRentalApplicationPresentation(\n tenant: any,\n mode: TenantModeCardConfig,\n application: TenantModeApplicationConfig,\n): TenantModeApplicationConfig {\n if (!isEventRentalBusinessType(tenant)) return application;\n const presentation = EVENT_RENTAL_MODE_APPLICATION_PRESENTATION[modeToken(mode.key)]?.[modeToken(application.key)];\n return presentation ? { ...application, ...presentation } : application;\n}\n\nfunction assertEventRentalModePrimitive(): void {\n const expectedPrimary: Record = {\n plan: 'booking',\n planning: 'booking',\n booking: 'event-rental-operations',\n 'pop-up': 'event-rental-operations',\n operations: 'event-rental-operations',\n 'booked-event': 'event-rental-operations',\n events: 'event-rental-operations',\n 'back-office': 'contacts',\n financials: 'contacts',\n };\n const banned = /\\b(crm|dashboard|pipeline|leads?)\\b/i;\n for (const [modeKey, firstApplication] of Object.entries(expectedPrimary)) {\n const preset = EVENT_RENTAL_MODE_SHELL_PRESET[modeKey];\n if (!preset || preset.primary_applications?.length !== 5 || preset.primary_applications[0] !== firstApplication) {\n throw new Error(`Event-rental mode ${modeKey} requires a five-app curated set beginning with ${firstApplication}.`);\n }\n const presentation = EVENT_RENTAL_MODE_APPLICATION_PRESENTATION[modeKey];\n for (const applicationKey of preset.primary_applications) {\n const copy = presentation?.[applicationKey];\n if (!copy) throw new Error(`Event-rental mode ${modeKey} is missing contextual presentation for ${applicationKey}.`);\n if (banned.test(`${copy.title} ${copy.description}`)) {\n throw new Error(`Event-rental mode ${modeKey} contains generic CRM terminology in ${applicationKey}.`);\n }\n }\n }\n}\nassertEventRentalModePrimitive();\n\nconst ENTERTAINMENT_MODE_SHELL_PRESET: Record = {\n creative: { title: 'Creative', headline: 'Book the room. Build the crowd.', subtitle: 'Club sets, promoters, promotion, content & rebook momentum', primary_applications: ['booking', 'calendar', 'creative-studio', 'communications', 'opportunity-radar'] },\n professional: { title: 'Professional', headline: 'Deliver the event without dropping a cue', subtitle: 'Clients, proposals, planning, show readiness & payment', primary_applications: ['booking', 'proposals', 'calendar', 'documents', 'payments'] },\n fanbase: { title: 'Fans', headline: 'Turn every crowd into the next booking', subtitle: 'Fans, VIPs, capture, referrals, outreach & retention', primary_applications: ['contacts', 'communications', 'qr-suite', 'opportunity-radar', 'analytics'] },\n office: { title: 'Back Office', headline: 'Run the business behind the booth', subtitle: 'Invoices, payments, documents, reporting & next actions', primary_applications: ['invoices', 'payments', 'documents', 'analytics', 'tasks'] },\n};\n\nconst ENTERTAINMENT_CREATIVE_APPLICATIONS: Readonly> = {\n booking: { title: 'Bookings & Holds', description: 'Run pitches, holds, confirmed sets, promoters, venues, fees, guest lists, and rebook windows.' },\n calendar: { title: 'Set Calendar', description: 'See door times, set times, travel, conflicts, and upcoming Creative commitments.' },\n 'creative-studio': { title: 'Promo & Content', description: 'Build flyers, promo assets, set content, and the material that keeps the artist visible.' },\n communications: { title: 'Promoters & Venues', description: 'Keep promoter, talent-buyer, venue, and collaboration conversations tied to the booking.' },\n 'opportunity-radar': { title: 'Booking Radar', description: 'Work new rooms, promoter follow-up, venue rebooks, holds, and Creative opportunities.' },\n};\n\nconst ENTERTAINMENT_PROFESSIONAL_APPLICATIONS: Readonly> = {\n booking: { title: 'Client Events', description: 'Run weddings, corporate events, private parties, schools, galas, and formal event bookings.' },\n proposals: { title: 'Proposals & Agreements', description: 'Build the offer, terms, agreement, package, and approval path for each Professional event.' },\n calendar: { title: 'Event Calendar', description: 'See event timing, setup, breakdown, travel, and readiness deadlines.' },\n documents: { title: 'Show Sheets & Documents', description: 'Keep timelines, venue notes, music plans, cue sheets, files, and event proof together.' },\n payments: { title: 'Deposits & Balances', description: 'Track deposits, remaining balances, settlement, and payment status.' },\n};\n\nconst ENTERTAINMENT_FANBASE_APPLICATIONS: Readonly> = {\n contacts: { title: 'Fans & VIPs', description: 'Keep supporters, VIPs, ambassadors, referrals, attendance history, and relationship context together.' },\n communications: { title: 'Fan Outreach', description: 'Reach opted-in supporters with invitations, updates, reactivation, and follow-up.' },\n 'qr-suite': { title: 'Fan Capture', description: 'Create event-specific QR entry points for guest list, fan club, referral, and campaign attribution.' },\n 'opportunity-radar': { title: 'Growth Radar', description: 'Turn fan engagement, referrals, promoter relationships, and repeat attendance into the next booking.' },\n analytics: { title: 'Fanbase Pulse', description: 'Measure growth, repeat attendance, referrals, reactivation, and fan-to-booking conversion.' },\n};\n\nconst ENTERTAINMENT_OFFICE_APPLICATIONS: Readonly> = {\n invoices: { title: 'Invoices', description: 'Keep Professional billing and Creative settlements visible without mixing the operating lanes.' },\n payments: { title: 'Payments', description: 'Track deposits, balances, guarantees, and collected revenue.' },\n documents: { title: 'Business Documents', description: 'Keep business records, agreements, templates, and reusable operating documents organized.' },\n analytics: { title: 'Business Performance', description: 'See Creative revenue, Professional revenue, total business, booking conversion, and growth signals.' },\n tasks: { title: 'Next Moves', description: 'Keep promoter follow-up, proposal follow-up, rebooks, reviews, referrals, and content due in one queue.' },\n};\n\nconst ENTERTAINMENT_MODE_APPLICATION_PRESENTATION: Readonly>>> = {\n creative: ENTERTAINMENT_CREATIVE_APPLICATIONS,\n professional: ENTERTAINMENT_PROFESSIONAL_APPLICATIONS,\n fanbase: ENTERTAINMENT_FANBASE_APPLICATIONS,\n office: ENTERTAINMENT_OFFICE_APPLICATIONS,\n};\n\nfunction isEntertainmentBusinessType(tenant: any): boolean {\n const settings = record(tenant?.settings);\n const classification = record(settings.tenant_classification);\n const manifest = record(settings.tenant_manifest);\n const blueprint = record(settings.business_operating_blueprint || manifest.businessOperatingBlueprint);\n const primaryArchetype = modeToken(classification.primary_archetype);\n const businessType = modeToken(\n blueprint.businessTypeKey\n || blueprint.business_type_key\n || settings.declared_business_type\n || settings.business_type\n || tenant?.tenant_type,\n );\n return primaryArchetype === 'entertainment' || ['entertainment', 'entertainment-dj', 'dj', 'disc-jockey', 'mobile-dj', 'wedding-dj'].includes(businessType);\n}\n\nexport function applyEntertainmentModeShellPreset(tenant: any, cards: readonly TenantModeCardConfig[]): TenantModeCardConfig[] {\n if (!isEntertainmentBusinessType(tenant)) return [...cards];\n return cards.map((card) => {\n const preset = ENTERTAINMENT_MODE_SHELL_PRESET[modeToken(card.key)];\n return preset ? { ...card, ...preset, primary_applications: [...preset.primary_applications] } : card;\n });\n}\n\nfunction applyEntertainmentApplicationPresentation(\n tenant: any,\n mode: TenantModeCardConfig,\n application: TenantModeApplicationConfig,\n): TenantModeApplicationConfig {\n if (!isEntertainmentBusinessType(tenant)) return application;\n const presentation = ENTERTAINMENT_MODE_APPLICATION_PRESENTATION[modeToken(mode.key)]?.[modeToken(application.key)];\n return presentation ? { ...application, ...presentation } : application;\n}\n\nfunction assertEntertainmentModePrimitive(): void {\n const expected: Record = {\n creative: ['booking', 'calendar', 'creative-studio', 'communications', 'opportunity-radar'],\n professional: ['booking', 'proposals', 'calendar', 'documents', 'payments'],\n fanbase: ['contacts', 'communications', 'qr-suite', 'opportunity-radar', 'analytics'],\n office: ['invoices', 'payments', 'documents', 'analytics', 'tasks'],\n };\n const banned = /\\b(redfish|roof|roofing|icee|coquito|party rental|crm)\\b/i;\n for (const [modeKey, applicationIds] of Object.entries(expected)) {\n const preset = ENTERTAINMENT_MODE_SHELL_PRESET[modeKey];\n if (!preset || JSON.stringify(preset.primary_applications) !== JSON.stringify(applicationIds)) {\n throw new Error(`Entertainment mode ${modeKey} requires its canonical five-app set.`);\n }\n const presentation = ENTERTAINMENT_MODE_APPLICATION_PRESENTATION[modeKey];\n for (const applicationKey of applicationIds) {\n const copy = presentation?.[applicationKey];\n if (!copy) throw new Error(`Entertainment mode ${modeKey} is missing contextual presentation for ${applicationKey}.`);\n if (banned.test(`${copy.title} ${copy.description}`)) {\n throw new Error(`Entertainment mode ${modeKey} contains donor-shell business terminology in ${applicationKey}.`);\n }\n }\n }\n}\nassertEntertainmentModePrimitive();\n\nconst HANDYMAN_MODE_SHELL_PRESET: Record = {\n dispatch: { title: 'Dispatch', headline: 'Turn requests into scheduled work', subtitle: 'Service requests, schedule, next actions & customer communication', primary_applications: ['booking', 'calendar', 'tasks', 'communications', 'contacts'] },\n command: { title: 'Dispatch', headline: 'Turn requests into scheduled work', subtitle: 'Service requests, schedule, next actions & customer communication', primary_applications: ['booking', 'calendar', 'tasks', 'communications', 'contacts'] },\n 'active-jobs': { title: 'Active Jobs', headline: 'Keep every job moving toward completion', subtitle: 'Work orders, job proof, tasks, schedule & communication', primary_applications: ['jobs', 'documents', 'tasks', 'calendar', 'communications'] },\n growth: { title: 'Active Jobs', headline: 'Keep every job moving toward completion', subtitle: 'Work orders, job proof, tasks, schedule & communication', primary_applications: ['jobs', 'documents', 'tasks', 'calendar', 'communications'] },\n customers: { title: 'Customers', headline: 'Keep the customer and the work connected', subtitle: 'Customer records, estimates, requests, messages & documents', primary_applications: ['contacts', 'proposals', 'booking', 'communications', 'documents'] },\n operations: { title: 'Customers', headline: 'Keep the customer and the work connected', subtitle: 'Customer records, estimates, requests, messages & documents', primary_applications: ['contacts', 'proposals', 'booking', 'communications', 'documents'] },\n 'back-office': { title: 'Back Office', headline: 'Close the loop on the business', subtitle: 'Invoices, payments, estimates, reporting & documents', primary_applications: ['invoices', 'payments', 'proposals', 'analytics', 'documents'] },\n financials: { title: 'Back Office', headline: 'Close the loop on the business', subtitle: 'Invoices, payments, estimates, reporting & documents', primary_applications: ['invoices', 'payments', 'proposals', 'analytics', 'documents'] },\n};\n\nconst HANDYMAN_DISPATCH_APPLICATIONS: Readonly> = {\n booking: { title: 'Service Requests', description: 'Review new customer requests and turn approved work into scheduled jobs.' },\n calendar: { title: 'Schedule', description: 'See appointments, job windows, and what needs to happen next.' },\n tasks: { title: 'Dispatch Queue', description: 'Keep call-backs, confirmations, approvals, and next actions visible.' },\n communications: { title: 'Customer Messages', description: 'Keep service-request communication tied to the right customer.' },\n contacts: { title: 'Customer Details', description: 'Open the customer and property context before work is assigned.' },\n};\n\nconst HANDYMAN_ACTIVE_JOB_APPLICATIONS: Readonly> = {\n jobs: { title: 'Work Orders', description: 'Run active jobs from assigned scope through completion.' },\n documents: { title: 'Job Photos & Documents', description: 'Keep photos, files, forms, and proof attached to the job.' },\n tasks: { title: 'Job Tasks', description: 'Track the next actions needed to finish the work cleanly.' },\n calendar: { title: 'Job Schedule', description: 'See active job timing, return visits, and upcoming commitments.' },\n communications: { title: 'Job Communication', description: 'Keep job-specific customer communication in one place.' },\n};\n\nconst HANDYMAN_CUSTOMER_APPLICATIONS: Readonly> = {\n contacts: { title: 'Customers', description: 'Manage customer records, properties, history, and contact details.' },\n proposals: { title: 'Estimates & Proposals', description: 'Create and manage estimates and proposals for customer work.' },\n booking: { title: 'Service Requests', description: 'See the requests that started or expanded customer work.' },\n communications: { title: 'Customer Messages', description: 'Handle customer conversations and follow-up.' },\n documents: { title: 'Customer Documents', description: 'Keep customer-facing files and job documents organized.' },\n};\n\nconst HANDYMAN_BACK_OFFICE_APPLICATIONS: Readonly> = {\n invoices: { title: 'Invoices', description: 'Bill completed work and keep receivables clear.' },\n payments: { title: 'Payments', description: 'Track collections and payment status.' },\n proposals: { title: 'Estimates & Proposals', description: 'Review estimates and proposals before and after approval.' },\n analytics: { title: 'Business Reports', description: 'See operational and financial trends that need attention.' },\n documents: { title: 'Business Documents', description: 'Keep business files and generated documents organized.' },\n};\n\nconst HANDYMAN_MODE_APPLICATION_PRESENTATION: Readonly>>> = {\n dispatch: HANDYMAN_DISPATCH_APPLICATIONS,\n command: HANDYMAN_DISPATCH_APPLICATIONS,\n 'active-jobs': HANDYMAN_ACTIVE_JOB_APPLICATIONS,\n growth: HANDYMAN_ACTIVE_JOB_APPLICATIONS,\n customers: HANDYMAN_CUSTOMER_APPLICATIONS,\n operations: HANDYMAN_CUSTOMER_APPLICATIONS,\n 'back-office': HANDYMAN_BACK_OFFICE_APPLICATIONS,\n financials: HANDYMAN_BACK_OFFICE_APPLICATIONS,\n};\n\nfunction isHandymanBusinessType(tenant: any): boolean {\n const settings = record(tenant?.settings);\n const manifest = record(settings.tenant_manifest);\n const blueprint = record(settings.business_operating_blueprint || manifest.businessOperatingBlueprint);\n const businessType = modeToken(\n blueprint.businessTypeKey\n || blueprint.business_type_key\n || settings.declared_business_type\n || settings.business_type\n || tenant?.tenant_type,\n );\n return ['handyman', 'handyman-service', 'handyman-services'].includes(businessType);\n}\n\nexport function applyHandymanModeShellPreset(tenant: any, cards: readonly TenantModeCardConfig[]): TenantModeCardConfig[] {\n if (!isHandymanBusinessType(tenant)) return [...cards];\n return cards.map((card) => {\n const preset = HANDYMAN_MODE_SHELL_PRESET[card.key];\n return preset ? { ...card, ...preset, primary_applications: [...preset.primary_applications] } : card;\n });\n}\n\nfunction applyHandymanApplicationPresentation(\n tenant: any,\n mode: TenantModeCardConfig,\n application: TenantModeApplicationConfig,\n): TenantModeApplicationConfig {\n if (!isHandymanBusinessType(tenant)) return application;\n const presentation = HANDYMAN_MODE_APPLICATION_PRESENTATION[modeToken(mode.key)]?.[modeToken(application.key)];\n return presentation ? { ...application, ...presentation } : application;\n}\n\nfunction assertHandymanModePrimitive(): void {\n const expected: Record = {\n dispatch: ['booking', 'calendar', 'tasks', 'communications', 'contacts'],\n 'active-jobs': ['jobs', 'documents', 'tasks', 'calendar', 'communications'],\n customers: ['contacts', 'proposals', 'booking', 'communications', 'documents'],\n 'back-office': ['invoices', 'payments', 'proposals', 'analytics', 'documents'],\n };\n const banned = /\\b(redfish|roof|roofing|mvgives|crm)\\b/i;\n for (const [modeKey, applicationIds] of Object.entries(expected)) {\n const preset = HANDYMAN_MODE_SHELL_PRESET[modeKey];\n if (!preset || JSON.stringify(preset.primary_applications) !== JSON.stringify(applicationIds)) {\n throw new Error(`Handyman mode ${modeKey} requires its canonical five-app set.`);\n }\n const presentation = HANDYMAN_MODE_APPLICATION_PRESENTATION[modeKey];\n if (banned.test(`${preset.title} ${preset.headline} ${preset.subtitle}`)) {\n throw new Error(`Handyman mode ${modeKey} contains donor-shell business terminology.`);\n }\n for (const applicationKey of applicationIds) {\n const copy = presentation?.[applicationKey];\n if (!copy) throw new Error(`Handyman mode ${modeKey} is missing contextual presentation for ${applicationKey}.`);\n if (banned.test(`${copy.title} ${copy.description}`)) {\n throw new Error(`Handyman mode ${modeKey} contains donor-shell business terminology in ${applicationKey}.`);\n }\n }\n }\n}\nassertHandymanModePrimitive();\n\ntype CurriModeShellPresetKey = 'control-center' | 'realty-world' | 'one-call';\ntype CurriModePreset = Pick;\n\nconst CURRI_MODE_SHELL_PRESETS: Record> = {\n 'control-center': {\n command: { title: 'Command', headline: 'See what needs your attention', subtitle: 'Decisions and exceptions that need John now', primary_applications: ['tasks', 'analytics', 'calendar', 'communications'] },\n growth: { title: 'Opportunities', headline: 'Find the next portfolio opportunity', subtitle: 'Cross-business referrals and revenue', primary_applications: ['opportunity-radar', 'contacts', 'communications', 'analytics'] },\n operations: { title: 'Businesses', headline: 'Move between your operating businesses', subtitle: 'Realty World and One Call at a glance', primary_applications: ['tasks', 'calendar', 'documents', 'analytics'] },\n financials: { title: 'Financials', headline: 'Know where the money stands', subtitle: 'Portfolio money, reports, and timing', primary_applications: ['analytics', 'reports', 'documents', 'tasks'] },\n },\n 'realty-world': {\n command: { title: 'Lead Mode', headline: 'Capture and work the next opportunity', subtitle: 'New leads, prospecting, and follow-up', primary_applications: ['opportunity-radar', 'contacts', 'communications', 'tasks'] },\n growth: { title: 'Client Mode', headline: 'Move active buyers and sellers forward', subtitle: 'Active clients, appointments, and communication', primary_applications: ['contacts', 'calendar', 'communications', 'documents'] },\n operations: { title: 'Transaction Mode', headline: 'Keep every deal moving toward close', subtitle: 'Transactions, documents, milestones, and closing', primary_applications: ['realtor-transaction-operations', 'documents', 'calendar', 'tasks'] },\n financials: { title: 'Back Office', headline: 'Run the brokerage behind the scenes', subtitle: 'Reports, mail, documents, and admin', primary_applications: ['analytics', 'reports', 'mail', 'documents'] },\n },\n 'one-call': {\n command: { title: 'Dispatch', headline: 'Decide what moves next', subtitle: 'Requests, approvals, schedule changes, and communication', primary_applications: ['tasks', 'calendar', 'communications', 'mail'] },\n growth: { title: \"Today's Route\", headline: 'Run the day in the right order', subtitle: 'Stops, schedule, customers, and next actions', primary_applications: ['jobs', 'calendar', 'contacts', 'tasks'] },\n operations: { title: 'Job Mode', headline: 'Finish the work in front of you', subtitle: 'Scope, documents, customer context, and completion', primary_applications: ['jobs', 'documents', 'contacts', 'communications'] },\n financials: { title: 'Back Office', headline: 'Close the loop on the business', subtitle: 'Invoices, payments, reporting, and documents', primary_applications: ['invoices', 'payments', 'analytics', 'documents'] },\n },\n};\n\nfunction curriModeShellPresetKey(tenant: any): CurriModeShellPresetKey | null {\n const settings = record(tenant?.settings);\n const workspaceVariant = modeToken(settings.workspace_variant);\n const portfolioFamily = modeToken(settings.portfolio_family);\n const tenantType = modeToken(tenant?.tenant_type || settings.declared_business_type || settings.business_type);\n const tenantSlug = modeToken(tenant?.company_slug || tenant?.name);\n if (workspaceVariant === 'curri-control-center' || tenantType === 'portfolio-control-center' || tenantSlug === 'curri-control-center') return 'control-center';\n if (portfolioFamily !== 'curri') return null;\n if (workspaceVariant === 'realtor' || tenantType === 'realtor' || tenantSlug === 'curri-properties') return 'realty-world';\n if (workspaceVariant === 'one-call-management' || tenantType === 'property-maintenance' || tenantSlug === 'one-call') return 'one-call';\n return null;\n}\n\nexport function applyCurriModeShellPreset(tenant: any, cards: readonly TenantModeCardConfig[]): TenantModeCardConfig[] {\n const presetKey = curriModeShellPresetKey(tenant);\n if (!presetKey) return [...cards];\n const presets = CURRI_MODE_SHELL_PRESETS[presetKey];\n return cards.map((card) => {\n const preset = presets[card.key];\n return preset ? { ...card, ...preset, primary_applications: [...preset.primary_applications] } : card;\n });\n}\n\nexport function resolveModeDefaultImageKey(key: unknown, title?: unknown): ModeDefaultImageKey {\n for (const candidate of [modeToken(key), modeToken(title)]) if (candidate && MODE_DEFAULT_ALIASES[candidate]) return MODE_DEFAULT_ALIASES[candidate];\n return 'operations';\n}\n\nexport function modeDefaultImageUrl(key: ModeDefaultImageKey): string {\n const root = String(import.meta.env.VITE_SUPABASE_URL || '').trim().replace(/\\/+$/g, '');\n return root ? `${root}/functions/v1/tenant-media-library?mode=default-mode&key=${encodeURIComponent(key)}&v=1` : '';\n}\n\nfunction applyModeDefaultImage(tenant: any, card: TenantModeCardConfig): TenantModeCardConfig {\n const modes = record(record(tenant?.settings).modes);\n const configuredKey = modeToken(card.default_image_key);\n const defaultKey = MODE_DEFAULT_ALIASES[configuredKey] || resolveModeDefaultImageKey(card.key, card.title);\n const defaultUrl = String(card.default_image_url || '').trim() || modeDefaultImageUrl(defaultKey);\n const existingImage = String(card.image_url || '').trim();\n const existingFallback = String(card.fallback_image_url || '').trim();\n const custom = Boolean(card.image_asset_id || (existingImage && !existingImage.includes('mode=default-mode')) || existingFallback || card.image_source === 'custom');\n return {...card,default_image_key:defaultKey,default_image_url:defaultUrl||null,image_source:custom?'custom':'default',image_url:(existingImage||existingFallback)?card.image_url:(defaultUrl||null)};\n}\n\nfunction roleToken(value: unknown): string {\n return String(value || '').trim().toUpperCase().replace(/[\\s-]+/g, '_');\n}\n\nexport function isModesTenant(tenant: any): boolean {\n if (tenantExperienceFamily(tenant) !== 'modes') return false;\n const state = String(record(record(tenant?.settings).modes).activation_state || '').trim().toLowerCase();\n return !['prepare', 'prerequisite_required', 'quarantined'].includes(state);\n}\n\nfunction configuredModeCards(tenant: any): TenantModeCardConfig[] {\n const modes = record(record(tenant?.settings).modes);\n return (Array.isArray(modes.cards) ? modes.cards : []).map((raw): TenantModeCardConfig | null => {\n const card = record(raw);\n const key = modeToken(card.key || card.id || card.title);\n const title = String(card.title || card.label || '').trim();\n if (!key || !title) return null;\n return {\n key,\n title,\n subtitle: String(card.subtitle || '').trim() || undefined,\n headline: String(card.headline || '').trim() || undefined,\n color: String(card.color || '').trim() || undefined,\n route: String(card.route || card.path || '').trim() || undefined,\n roles: strings(card.roles),\n primary_applications: strings(card.primary_applications || card.primaryApplications),\n storage_slug: modeToken(card.storage_slug || key) || key,\n image_asset_id: String(card.image_asset_id || '').trim() || null,\n image_url: String(card.image_url || '').trim() || null,\n fallback_image_url: String(card.fallback_image_url || '').trim() || null,\n default_image_key: String(card.default_image_key || '').trim() || null,\n default_image_url: String(card.default_image_url || '').trim() || null,\n image_source: String(card.image_source || '').trim() || null,\n image_position_x: imagePositionPercent(card.image_position_x),\n image_position_y: imagePositionPercent(card.image_position_y),\n } satisfies TenantModeCardConfig;\n }).filter((card): card is TenantModeCardConfig => Boolean(card));\n}\n\nexport function getTenantModeCards(tenant: any): TenantModeCardConfig[] {\n if (!isModesTenant(tenant)) return [];\n const configured = configuredModeCards(tenant);\n const tenantTypePreset = applyHandymanModeShellPreset(tenant, applyEntertainmentModeShellPreset(tenant, applyEventRentalModeShellPreset(tenant, configured)));\n return applyCurriModeShellPreset(tenant, tenantTypePreset).map((card) => applyModeDefaultImage(tenant, card));\n}\n\nfunction tenantHomeRoute(tenant: any): string {\n const settings = record(tenant?.settings);\n const persisted = record(settings.tenant_operating_contract);\n const workspace = record(persisted.workspace);\n const routeTarget = {\n tenant_type: tenant?.tenant_type,\n company_slug: tenant?.company_slug,\n name: tenant?.name,\n company_dba_name: tenant?.company_dba_name,\n company_legal_name: tenant?.company_legal_name,\n settings,\n };\n const persistedWorkspaceRoute = getSafeConfiguredTenantRoute(\n { ...routeTarget, settings: { canonical_workspace_route: workspace.canonical_workspace_route } },\n 'canonical_workspace_route',\n );\n return persistedWorkspaceRoute\n || getSafeConfiguredTenantRoute(routeTarget, 'canonical_workspace_route')\n || getSafeConfiguredTenantRoute(routeTarget, 'canonical_owner_route')\n || getTenantDashboardPathForTenant(routeTarget);\n}\n\nfunction blueprintForTenant(tenant: any): Record {\n const settings = record(tenant?.settings);\n const manifest = record(settings.tenant_manifest);\n return record(settings.business_operating_blueprint || manifest.businessOperatingBlueprint);\n}\n\nfunction moduleScore(module: Record, effectiveRole?: string | null): number {\n const role = roleToken(effectiveRole);\n const text = [module.id, module.key, module.title, module.label, module.name, module.module, module.application, module.description, module.subtitle].map((value) => String(value || '').toLowerCase()).join(' ');\n let score = 0;\n const has = (pattern: RegExp) => pattern.test(text);\n const add = (pattern: RegExp, points: number) => { if (has(pattern)) score += points; };\n const emphasis = String(module.emphasis || module.priority || '').toLowerCase();\n if (emphasis === 'primary' || emphasis === 'critical') score += 35;\n else if (emphasis === 'high') score += 22;\n else if (emphasis === 'secondary') score += 8;\n if (['OWNER', 'TENANT_OWNER', 'ADMIN', 'GODMODE'].includes(role) || !role) {\n add(/decision|exception|approval|needs attention|risk/, 190);\n add(/today|brief|overview|command|priority/, 175);\n add(/opportunit|referral|pipeline|growth/, 155);\n add(/operation|job|production|dispatch|service|work/, 145);\n add(/money|revenue|sales|commission|finance|invoice|paid/, 135);\n add(/performance|report|analytics|pulse|portfolio|business/, 125);\n add(/team|agent|crew|staff/, 85);\n add(/schedule|calendar|appointment/, 75);\n } else if (['MANAGER', 'PM', 'OFFICE_ADMIN'].includes(role)) {\n add(/operation|job|production|dispatch|service|work/, 190);\n add(/schedule|calendar|appointment|task|queue|follow/, 175);\n add(/team|agent|crew|staff/, 155);\n add(/customer|contact|client|homeowner/, 130);\n add(/opportunit|lead|pipeline|growth/, 120);\n add(/performance|report|analytics/, 95);\n } else if (['REP', 'AGENT', 'VIEWER'].includes(role)) {\n add(/lead|opportunit|pipeline|prospect|deal/, 195);\n add(/customer|contact|client|homeowner/, 170);\n add(/schedule|calendar|appointment|showing/, 155);\n add(/task|follow|next|cadence/, 145);\n add(/message|mail|inbox|communication/, 110);\n add(/document|proposal|estimate|quote/, 90);\n } else {\n add(/job|operation|production|work order|task|dispatch/, 195);\n add(/schedule|calendar|appointment/, 165);\n add(/customer|contact|client|homeowner/, 130);\n add(/photo|document|form|checklist/, 115);\n add(/message|mail|communication/, 95);\n }\n add(/settings|configuration|setup|onboarding/, -260);\n add(/document|file|archive/, -45);\n return score;\n}\n\nfunction moduleRoute(tenant: any, module: Record, key: string): string {\n const direct = firstString(module.route, module.path, module.href, module.ownerRoute, module.owner_route);\n if (direct) return direct;\n const home = tenantHomeRoute(tenant);\n if (/^(today|home|dashboard|overview|brief|command)$/.test(key)) return home;\n const separator = home.includes('?') ? '&' : '?';\n return `${home}${separator}tab=${encodeURIComponent(key)}`;\n}\n\nfunction routeIdentity(value: unknown): string {\n const raw = String(value || '').trim();\n if (!raw) return '';\n try {\n const parsed = new URL(raw, 'https://knocklaunch.local');\n parsed.searchParams.delete('mode');\n const entries = [...parsed.searchParams.entries()].sort(([leftKey, leftValue], [rightKey, rightValue]) => leftKey.localeCompare(rightKey) || leftValue.localeCompare(rightValue));\n const search = new URLSearchParams(entries).toString();\n const path = parsed.pathname.replace(/\\/+$/g, '') || '/';\n return `${path}${search ? `?${search}` : ''}`;\n } catch {\n return raw;\n }\n}\n\nfunction modeSemanticScore(mode: TenantModeCardConfig, module: Record): number {\n const modeText = [mode.key, mode.title, mode.subtitle, mode.headline].map((value) => String(value || '').toLowerCase()).join(' ');\n const moduleText = [module.id, module.key, module.title, module.label, module.name, module.module, module.application, module.description, module.subtitle, module.category].map((value) => String(value || '').toLowerCase()).join(' ');\n const rules: Array<[RegExp, RegExp, number]> = [\n [/today|focus|priority|decision|attention|command|overview/, /today|dashboard|overview|task|job|calendar|schedule|analytics|report|communication/, 110],\n [/plan|schedule|calendar|prepare|prep|organize/, /calendar|schedule|booking|appointment|task|job|document|contact|communication/, 125],\n [/opportunit|growth|sales|sell|pipeline|lead|prospect|market|hustle/, /opportunit|lead|pipeline|contact|customer|proposal|estimate|mail|communication|call|canvass|qr|booking/, 145],\n [/operation|work|job|production|field|service|crew|execute|delivery/, /job|work|production|route|service|calendar|schedule|task|document|photo|contact|communication|estimate/, 140],\n [/money|revenue|finance|billing|paid|payment|profit|performance|score|report/, /invoice|payment|billing|analytics|report|proposal|estimate|job|revenue/, 135],\n [/customer|client|people|relationship|follow|support/, /contact|customer|client|mail|communication|call|task|calendar|proposal|booking/, 120],\n [/event|booking|serve|show|appointment/, /event|booking|calendar|schedule|inventory|proposal|contact|mail|communication|task/, 140],\n [/back office|admin|business|manage|owner/, /invoice|billing|analytics|report|document|contact|calendar|mail|communication|job|task/, 115],\n [/create|design|proposal|quote|estimate/, /proposal|proposal-editor|estimate|document|contact|customer/, 135],\n [/document|proof|paperwork|file|photo/, /document|form|proposal|estimate|photo|invoice/, 130],\n ];\n let score = 0;\n for (const [modePattern, modulePattern, points] of rules) {\n if (modePattern.test(modeText) && modulePattern.test(moduleText)) score += points;\n }\n const modeWords = [...new Set(modeText.split(/[^a-z0-9]+/g).filter((word) => word.length >= 4 && !['mode', 'with', 'from', 'your', 'what', 'needs'].includes(word)))];\n for (const word of modeWords) if (moduleText.includes(word)) score += 24;\n return score;\n}\n\nfunction modulePurpose(module: Record, key: string, title: string): string {\n const supplied = firstString(module.modeDescription, module.mode_description, module.description, module.summary, module.subtitle);\n if (supplied) return supplied;\n const text = `${key} ${title}`.toLowerCase();\n if (/opportunit|lead|pipeline|prospect/.test(text)) return 'Find, qualify, and move the next opportunity forward.';\n if (/calendar|schedule|booking|appointment/.test(text)) return 'Plan what is next and keep timing under control.';\n if (/contact|customer|client|homeowner/.test(text)) return 'Keep the right people and relationship details together.';\n if (/proposal|estimate|quote/.test(text)) return 'Build the next offer and move it toward approval.';\n if (/invoice|billing|payment/.test(text)) return 'Keep billing, collections, and money movement clear.';\n if (/job|production|work|route|service/.test(text)) return 'Move active work forward without losing the handoff.';\n if (/mail|message|communication|call/.test(text)) return 'Handle the conversations that belong to this work.';\n if (/document|form|photo|file/.test(text)) return 'Keep the files and proof for this work in one place.';\n if (/analytic|report|performance/.test(text)) return 'See what is changing and where attention is needed.';\n if (/task|follow/.test(text)) return 'Keep next actions visible and close the loop.';\n return `Open ${title} for the work that belongs in this mode.`;\n}\n\nfunction modeApplicationCandidate(tenant: any, module: Record, mode: TenantModeCardConfig, allModes: readonly TenantModeCardConfig[], effectiveRole: string | null | undefined, index: number): TenantModeApplicationConfig | null {\n const application = moduleApplicationCapability(module);\n if (application && !isTenantApplicationSupported(application, tenant?.tenant_type)) return null;\n const title = firstString(module.applicationTitle, module.application_title, module.title, module.label, module.name, application?.label);\n const key = modeToken(application?.id || module.applicationKey || module.application_key || module.id || module.key || title);\n const roles = strings(module.roles);\n const activeRole = roleToken(effectiveRole);\n const allowedRoles = roles.map(roleToken);\n if (!title || !key || (activeRole && allowedRoles.length && !allowedRoles.includes('*') && !allowedRoles.includes(activeRole))) return null;\n const route = moduleRoute(tenant, module, key);\n const directRoute = firstString(module.route, module.path, module.href, module.ownerRoute, module.owner_route);\n const sameIdentity = key === mode.key || modeToken(title) === mode.key;\n const distinctAction = Boolean(directRoute && routeIdentity(directRoute) !== routeIdentity(mode.route || tenantHomeRoute(tenant)));\n if (sameIdentity && !distinctAction) return null;\n const modeSet = allModes.length ? allModes : [mode];\n const relevance = modeSemanticScore(mode, module);\n const peerScores = modeSet.map((candidateMode) => modeSemanticScore(candidateMode, module));\n const maxRelevance = Math.max(0, ...peerScores);\n const modeIndex = Math.max(0, modeSet.findIndex((candidateMode) => candidateMode.key === mode.key));\n const moduleText = `${key} ${title} ${module.description || ''}`.toLowerCase();\n const sharedUtility = /calendar|schedule|mail|communication|contact|customer|document|task/.test(moduleText);\n const unknownAssignment = maxRelevance === 0;\n const belongsHere = unknownAssignment\n ? index % Math.max(1, modeSet.length) === modeIndex\n : relevance === maxRelevance || (sharedUtility && relevance > 0 && relevance >= maxRelevance - 35);\n if (!belongsHere) return null;\n return {\n key,\n title,\n description: modulePurpose(module, key, title),\n route,\n score: relevance * 10 + moduleScore(module, effectiveRole) - index / 100,\n };\n}\n\nfunction moduleApplicationCapability(module: Record) {\n const references = [\n module.applicationKey,\n module.application_key,\n module.applicationId,\n module.application_id,\n module.application,\n module.route,\n module.path,\n module.href,\n module.ownerRoute,\n module.owner_route,\n ];\n for (const reference of references) {\n const application = getTenantApplicationByReference(reference);\n if (application) return application;\n }\n return undefined;\n}\n\nfunction moduleApplicationTokens(module: Record): string[] {\n const application = moduleApplicationCapability(module);\n return [...new Set([\n module.applicationKey,\n module.application_key,\n module.applicationId,\n module.application_id,\n module.application,\n module.id,\n module.key,\n module.title,\n module.label,\n module.name,\n module.route,\n module.path,\n module.href,\n module.ownerRoute,\n module.owner_route,\n application?.id,\n application?.slug,\n application?.workspaceSurface,\n application?.standalonePath,\n ].map(modeToken).filter(Boolean))];\n}\n\nfunction explicitModeApplicationCandidate(\n tenant: any,\n module: Record | undefined,\n requestedApplicationKey: string,\n effectiveRole: string | null | undefined,\n score: number,\n): TenantModeApplicationConfig | null {\n const source = module || {};\n const application = getTenantApplicationByReference(requestedApplicationKey) || moduleApplicationCapability(source);\n if (application && !isTenantApplicationSupported(application, tenant?.tenant_type)) return null;\n const title = firstString(source.applicationTitle, source.application_title, source.title, source.label, source.name, application?.label, requestedApplicationKey);\n const key = modeToken(application?.id || requestedApplicationKey || source.applicationKey || source.application_key || source.applicationId || source.application_id || source.application || source.id || source.key || title);\n const roles = strings(source.roles);\n const activeRole = roleToken(effectiveRole);\n const allowedRoles = roles.map(roleToken);\n if (!title || !key || (activeRole && allowedRoles.length && !allowedRoles.includes('*') && !allowedRoles.includes(activeRole))) return null;\n const route = module ? moduleRoute(tenant, source, key) : firstString(application?.workspaceSurface, application?.standalonePath) || tenantHomeRoute(tenant);\n return { key, title, description: modulePurpose(source, key, title), route, score };\n}\n\nexport function getTenantModeApplicationsForRole(tenant: any, effectiveRole: string | null | undefined, mode: TenantModeCardConfig | null | undefined, allModes: readonly TenantModeCardConfig[] = []): TenantModeApplicationConfig[] {\n if (!isModesTenant(tenant) || !mode) return [];\n const blueprint = blueprintForTenant(tenant);\n const modules = Array.isArray(blueprint.modules) ? blueprint.modules : Array.isArray(blueprint.operatingModules) ? blueprint.operatingModules : Array.isArray(blueprint.operating_modules) ? blueprint.operating_modules : [];\n const explicitPrimaryApplications = (mode.primary_applications || []).map(modeToken).filter(Boolean);\n\n if (explicitPrimaryApplications.length) {\n const moduleRecords = modules.map((raw: unknown) => record(raw));\n const resolved = explicitPrimaryApplications\n .map((applicationKey, order) => {\n const module = moduleRecords.find((candidate) => moduleApplicationTokens(candidate).includes(applicationKey));\n return explicitModeApplicationCandidate(tenant, module, applicationKey, effectiveRole, 100000 - order);\n })\n .filter((entry): entry is TenantModeApplicationConfig => Boolean(entry));\n const seen = new Set();\n return resolved\n .map((entry) => applyEntertainmentApplicationPresentation(tenant, mode, applyHandymanApplicationPresentation(tenant, mode, applyEventRentalApplicationPresentation(tenant, mode, entry))))\n .filter((entry) => !seen.has(entry.key) && Boolean(seen.add(entry.key)))\n .slice(0, isEventRentalBusinessType(tenant) || isHandymanBusinessType(tenant) || isEntertainmentBusinessType(tenant) ? 5 : 6);\n }\n\n const ranked = modules\n .map((raw: unknown, index: number) => modeApplicationCandidate(tenant, record(raw), mode, allModes, effectiveRole, index))\n .filter((entry): entry is TenantModeApplicationConfig => Boolean(entry))\n .sort((left, right) => right.score - left.score);\n if (ranked.length >= 2) return ranked.slice(0, 6);\n const modeSet = allModes.length ? allModes : [mode];\n const modeIndex = Math.max(0, modeSet.findIndex((candidateMode) => candidateMode.key === mode.key));\n const fallback = modules\n .map((raw: unknown, index: number) => ({ module: record(raw), index }))\n .filter(({ index }) => index % Math.max(1, modeSet.length) === modeIndex)\n .map(({ module, index }) => {\n const application = moduleApplicationCapability(module);\n if (application && !isTenantApplicationSupported(application, tenant?.tenant_type)) return null;\n const title = firstString(module.applicationTitle, module.application_title, module.title, module.label, module.name, application?.label);\n const key = modeToken(application?.id || module.applicationKey || module.application_key || module.id || module.key || title);\n if (!title || !key || key === mode.key || modeToken(title) === mode.key) return null;\n return { key, title, description: modulePurpose(module, key, title), route: moduleRoute(tenant, module, key), score: moduleScore(module, effectiveRole) - index / 100 } satisfies TenantModeApplicationConfig;\n })\n .filter((entry): entry is TenantModeApplicationConfig => Boolean(entry))\n .sort((left, right) => right.score - left.score);\n const seen = new Set(ranked.map((entry) => entry.key));\n return [...ranked, ...fallback.filter((entry) => !seen.has(entry.key))].slice(0, 6);\n}\n\nfunction derivedModeCards(tenant: any, effectiveRole?: string | null): TenantModeCardConfig[] {\n const blueprint = blueprintForTenant(tenant);\n const modules = Array.isArray(blueprint.modules) ? blueprint.modules : Array.isArray(blueprint.operatingModules) ? blueprint.operatingModules : Array.isArray(blueprint.operating_modules) ? blueprint.operating_modules : [];\n return modules.map((raw: unknown, index: number): { card: TenantModeCardConfig; score: number; index: number } | null => {\n const module = record(raw);\n const title = firstString(module.modeTitle, module.mode_title, module.title, module.label, module.name);\n const key = modeToken(module.modeKey || module.mode_key || module.id || module.key || title);\n const roles = strings(module.roles);\n const activeRole = roleToken(effectiveRole);\n const allowedRoles = roles.map(roleToken);\n if (!title || !key || (activeRole && allowedRoles.length && !allowedRoles.includes('*') && !allowedRoles.includes(activeRole))) return null;\n return { card: { key, title, subtitle: firstString(module.subtitle, module.category, module.module), headline: firstString(module.headline, module.description, module.summary), color: firstString(module.color, module.accent) || MODE_COLORS[index % MODE_COLORS.length], route: moduleRoute(tenant, module, key), roles, storage_slug: key } satisfies TenantModeCardConfig, score: moduleScore(module, effectiveRole), index };\n }).filter((entry): entry is { card: TenantModeCardConfig; score: number; index: number } => Boolean(entry)).sort((left, right) => right.score - left.score || left.index - right.index).map((entry) => entry.card);\n}\n\nfunction fallbackModeCards(tenant: any, effectiveRole?: string | null): TenantModeCardConfig[] {\n const role = roleToken(effectiveRole);\n const home = tenantHomeRoute(tenant);\n const sets: Record> = {\n manager: [['work', 'Work Queue', 'What needs movement now'], ['schedule', 'Schedule', 'What is next'], ['team', 'Team', 'People and handoffs'], ['performance', 'Performance', 'What is changing']],\n rep: [['pipeline', 'Pipeline', 'Deals and opportunities'], ['customers', 'Customers', 'People to move forward'], ['schedule', 'Schedule', 'Today and next'], ['follow-up', 'Follow Up', 'What needs a response']],\n field: [['jobs', 'Jobs', 'Work in front of you'], ['schedule', 'Schedule', 'Where to be next'], ['customers', 'Customers', 'Who you are serving'], ['documents', 'Documents', 'Photos, forms, and proof']],\n owner: [['today', 'Today', 'What needs you now'], ['operations', 'Operations', 'What is moving'], ['opportunities', 'Opportunities', 'Where growth is'], ['performance', 'Performance', 'What the numbers say']],\n };\n const family = ['MANAGER', 'PM', 'OFFICE_ADMIN'].includes(role) ? 'manager' : ['REP', 'AGENT', 'VIEWER'].includes(role) ? 'rep' : role && !['OWNER', 'TENANT_OWNER', 'ADMIN', 'GODMODE'].includes(role) ? 'field' : 'owner';\n return sets[family].map(([key, title, subtitle], index) => ({ key, title, subtitle, color: MODE_COLORS[index], route: home, storage_slug: key }));\n}\n\nexport function getTenantModeCardsForRole(tenant: any, effectiveRole?: string | null): TenantModeCardConfig[] {\n if (!isModesTenant(tenant)) return [];\n // Tenant-configured MODES are the stable top-level operating choices for every\n // authorized tenant role. Role scope belongs inside each mode's applications;\n // it must never replace the tenant's four configured mode identities.\n const explicit = applyCurriModeShellPreset(tenant, applyHandymanModeShellPreset(tenant, applyEntertainmentModeShellPreset(tenant, applyEventRentalModeShellPreset(tenant, configuredModeCards(tenant)))));\n const candidates = explicit.length >= 4\n ? explicit\n : [...explicit, ...derivedModeCards(tenant, effectiveRole), ...fallbackModeCards(tenant, effectiveRole)];\n const seen = new Set();\n const selected: TenantModeCardConfig[] = [];\n for (const card of candidates) {\n const key = modeToken(card.key || card.title);\n if (!key || seen.has(key)) continue;\n seen.add(key);\n selected.push(applyModeDefaultImage(tenant, { ...card, key, color: card.color || MODE_COLORS[selected.length % MODE_COLORS.length], storage_slug: modeToken(card.storage_slug || key) || key }));\n if (selected.length === 4) break;\n }\n return selected;\n}\n\nexport function modeCardStoragePrefix(mode: Pick): string {\n return `media/modes/${modeToken(mode.storage_slug || mode.key) || modeToken(mode.key)}`;\n}\n\nexport function applyModesTenantShell(settings: unknown, cards: readonly TenantModeCardConfig[]) {\n const current = applyTenantExperienceFamily(settings, 'modes');\n const currentModes = record(current.modes);\n const normalizedCards = cards.map((card) => ({ ...card, key: modeToken(card.key), storage_slug: modeToken(card.storage_slug || card.key) || modeToken(card.key) }));\n const existingNamespaces = strings(currentModes.storage_namespaces);\n const storageNamespaces = [...new Set([...existingNamespaces, ...MODE_DEFAULT_IMAGE_KEYS.map((key) => `media/modes/${key}`), ...normalizedCards.map(modeCardStoragePrefix)])];\n return { ...current, shell_template: MODES_TENANT_SHELL_KEY, modes: { ...currentModes, version: 3, capability_contract: MODES_TENANT_CAPABILITY_CONTRACT, default_media_contract: MODE_DEFAULT_MEDIA_CONTRACT, activation_state: 'prepare', storage_namespaces: storageNamespaces, cards: normalizedCards } };\n}"}],"route":"/dj/dashboard","branch":"ai/objective-first-repair-a0a8c37b7978","writes":[],"patches":[],"version":1,"approved":true,"missionId":"a0a8c37b-7978-49e0-b330-448a56b7b2a8","objective":"Make DJ Mount Nine a true MODES tenant by removing the custom entertainment dashboard diversion, routing the DJ landing through the standard MODES four-card landing, and presenting the four modes as Creative, Professional, Fans, and Back Office. Preserve all existing entertainment mode applications, tenant branding, tenant isolation, desktop/mobile behavior, Gate, squash merge, deploy, and live visual proof.","repository":"noel/KnockLaunchOS","visualProof":true,"verifyVisual":true,"ownerApproved":true,"releaseIntent":null,"sourceTargets":["src/shells/TenantModesShell.tsx","src/shells/modesTenantShell.ts"],"implementation":{"files":[],"writes":[]},"requestContract":null,"repairGeneration":null,"executionEnvelope":{"ship":true,"version":1,"approved":true,"missionId":"a0a8c37b-7978-49e0-b330-448a56b7b2a8","ownerApproved":true,"releaseIntent":null,"sourceTargets":["src/shells/TenantModesShell.tsx","src/shells/modesTenantShell.ts"],"requestContract":null,"repairGeneration":null,"proofRequirements":null,"controlPlaneUnfreeze":false,"controlPlaneMaintenance":false,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":null},"proofRequirements":null,"controlPlaneUnfreeze":false,"durableMutationResume":true,"controlPlaneMaintenance":false,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":null},"recovery":false,"fingerprint":"c920c610d19538f090ce1d0e64323b2845b2c1a2fc2c2891da2785209fc9493c","replayCount":0,"serializedBytes":113474},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-27T21:33:42.572204+00:00","proof_gate":"repository_mutation_intent_persisted","source_sha":null,"external_id":null,"receipt_type":"repository_mutation_intent","idempotency_key":"mission:a0a8c37b-7978-49e0-b330-448a56b7b2a8:repository-mutation-intent:c920c610d19538f090ce1d0e64323b2845b2c1a2fc2c2891da2785209fc9493c:0","mission_step_id":"37e14384-9db3-4ad4-93c7-592951faa10b","command_center_event_id":"a0a8c37b-7978-49e0-b330-448a56b7b2a8"},{"id":"b0c8263e-4f5d-4025-bf21-57bf3fbf0ef9","source":"cc-execution","status":"waiting","payload":{"kind":"heartbeat","message":"Still active in implementation.","nextAction":{"lane":"cc-execution","action":"continue_implementation","reason":"durable_state:implementation","automationAllowed":false,"ownerActionRequired":false},"silenceBudgetMs":15000,"semanticCheckpointSignature":"{\"stateMachineVersion\":1,\"phase\":\"implementation\",\"ownerFacingState\":null,\"latest\":{\"kind\":\"receipt\",\"key\":\"execute_mission\",\"status\":\"source_resolution_required\",\"proofGate\":\"repair_mission_source_resolution_required\"},\"activeStep\":{\"key\":\"implementation\",\"status\":\"ready\",\"lane\":\"cc-execution\"},\"nextStep\":{\"key\":\"pull_request\",\"status\":\"pending\",\"lane\":\"cc-execution\"},\"nextSafeAction\":{\"action\":\"continue_implementation\",\"lane\":\"cc-execution\",\"reason\":\"durable_state:implementation\",\"automationAllowed\":false,\"ownerActionRequired\":false},\"acceptance\":{\"total\":2,\"verified\":0,\"pending\":2,\"percent\":0,\"satisfied\":false,\"verifiedIds\":[],\"pendingIds\":[\"proof-production\",\"proof-visual\"]},\"stall\":{\"stalled\":false,\"reason\":\"within_deadline\",\"step\":\"implementation\",\"deadlineAt\":\"2026-09-21T17:53:20.115052+00:00\",\"recoveryAction\":null},\"blocker\":null,\"terminal\":false,\"branch\":\"ai/objective-first-repair-8c49fdbe3f50\",\"prNumber\":null,\"sourceSha\":null,\"deploymentId\":null}"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T15:54:29.078422+00:00","proof_gate":"owner_progress_heartbeat","source_sha":null,"external_id":null,"receipt_type":"owner_progress_heartbeat","idempotency_key":"mission:8c49fdbe-3f50-4b08-901d-1c56affc3114:owner-progress-heartbeat:119333737","mission_step_id":"76695b2d-911b-481f-a4c8-68b65a224e0e","command_center_event_id":"8c49fdbe-3f50-4b08-901d-1c56affc3114"},{"id":"9df802b4-d5ed-42a0-a8b4-bdc013106ba0","source":"cc-execution","status":"source_resolution_required","payload":{"ok":true,"jobId":null,"phase":"objective_received","branch":"ai/objective-first-repair-34fc64bf1723","reason":null,"status":"source_resolution_required","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":"1.58.209-visual-certification-hardening","prNumber":null,"terminal":false,"missionId":"34fc64bf-1723-4a48-8162-578dad054047","operation":"execute_mission","proofGate":"repair_mission_source_resolution_required","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":125,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"missionSetupMs":610,"providerAuthMs":0,"ledgerPrepareMs":610,"ledgerReconcileMs":0,"lineageReconcileMs":0,"resolvePreflightMs":610,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"totalSynchronousLedgerMs":610,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0},"nextAction":"Resolve bounded authoritative Forgejo source targets, then call /mission/execute again with this same missionId and exact files or anchored_edits. Do not switch workflows.","receiptRef":{"mode":"full","missionId":"34fc64bf-1723-4a48-8162-578dad054047"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":3989,"likelyAffectedFiles":[],"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T15:54:52.063741+00:00","proof_gate":"repair_mission_source_resolution_required","source_sha":null,"external_id":null,"receipt_type":"execute_mission","idempotency_key":"mission:34fc64bf-1723-4a48-8162-578dad054047:execute_mission:repair_mission_source_resolution_required:current-generation","mission_step_id":"3cb3fb1f-3583-455a-a6a5-6fdebf2f156d","command_center_event_id":"34fc64bf-1723-4a48-8162-578dad054047"},{"id":"8beb15ed-84a4-4ce2-93bc-d100a08fc873","source":"cc-execution","status":"blocked","payload":{"ok":false,"jobId":null,"phase":"implementation","branch":"ai/objective-first-repair-34fc64bf1723","reason":"anchored_edit_invalid","status":"blocked","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":"1.58.209-visual-certification-hardening","prNumber":null,"terminal":false,"missionId":"34fc64bf-1723-4a48-8162-578dad054047","operation":"execute_mission","proofGate":"repair_mission_execution_blocked","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":1512,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":0,"approvedPlanMs":1512,"missionSetupMs":343,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":343,"ledgerReconcileMs":0,"lineageReconcileMs":0,"resolvePreflightMs":343,"repositoryMutationMs":0,"repositoryProviderMs":0,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":343,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":0},"nextAction":null,"receiptRef":{"mode":"full","missionId":"34fc64bf-1723-4a48-8162-578dad054047"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime","visual"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1423,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T15:56:03.681037+00:00","proof_gate":"repair_mission_execution_blocked","source_sha":null,"external_id":null,"receipt_type":"execute_mission","idempotency_key":"mission:34fc64bf-1723-4a48-8162-578dad054047:execute_mission:repair_mission_execution_blocked:current-generation","mission_step_id":"fa8ce86a-ea01-4d57-bf20-4544674992c1","command_center_event_id":"34fc64bf-1723-4a48-8162-578dad054047"},{"id":"142adf77-5e82-475c-9a1d-90703809f85e","source":"forgejo-runtime","status":"verified","payload":{"failed":[],"states":{"forgejo-main/source":"success"},"mainSha":"97f734cd2a627b88babbdc8d66db957f20240ac2","missing":[],"pending":[],"required":["forgejo-main/source"],"sourceSha":"97f734cd2a627b88babbdc8d66db957f20240ac2","releaseState":"verified","sourceInMain":true,"compareStatus":"protected_main_push_exact_source","releaseTargets":{"frontend":false,"onrunner":false,"migrations":false,"ccExecution":false,"supabaseEdge":false,"edgeFunctionSlugs":[]},"releaseTargetStates":{},"requestContractHash":"07f772d7cf20fb100037fdeeeac5ae29e87a1fa3600341f44cd5b7b5d8917045","forgejoWorkflowProof":null,"onrunnerRuntimeProof":null,"releaseSourceVerified":true,"ccExecutionRuntimeProof":null,"releaseTargetRecoveryProof":null,"exactReleaseVerifiedAfterMainAdvanced":false},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-27T23:49:42.415051+00:00","proof_gate":"canonical_release_terminal_verified","source_sha":"97f734cd2a627b88babbdc8d66db957f20240ac2","external_id":"forgejo-main-97f734cd2a62","receipt_type":"canonical_release_status","idempotency_key":"mission:087a734e-d691-40e3-9aab-50ae14ca4cc8:forgejo-release-status:97f734cd2a627b88babbdc8d66db957f20240ac2:verified:forgejo-main/source=success","mission_step_id":"32da43e0-eb0c-49b0-b7ab-a9b292c72c12","command_center_event_id":"087a734e-d691-40e3-9aab-50ae14ca4cc8"},{"id":"d991545d-9548-4741-b279-ed607fb55e4f","source":"cc-execution","status":"verified","payload":{"ownerWaitSloMs":{"merge_to_live_ms":117801,"owner_action_to_pr_ms":200285,"green_gate_to_merge_ms":null,"owner_action_to_useful_response_ms":200285},"ownerWaitLiveAt":"2026-09-21T23:23:07.801Z"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T23:23:08.099937+00:00","proof_gate":"owner_wait_live_milestone_recorded","source_sha":null,"external_id":null,"receipt_type":"owner_wait_live_milestone","idempotency_key":"mission:4f79bf69-b2e5-47cf-ad62-6a93bc8d22f0:owner-wait-live","mission_step_id":"dbefb11e-b640-4579-88bd-3d49c1909807","command_center_event_id":"4f79bf69-b2e5-47cf-ad62-6a93bc8d22f0"},{"id":"d41b18d4-4ebb-4c15-aec4-5239c10ca885","source":"cc-execution","status":"deployment_dispatched","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-94fb6463408f","reason":null,"status":"deployment_dispatched","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3387,"terminal":false,"missionId":"94fb6463-408f-4f34-99da-79a66e658f6f","operation":"automatic_mission_resume","proofGate":"canonical_release_dispatched","sourceSha":"5e71fe1e717bcd9fb1894a3225325823c2677694","timingsMs":{"prReadinessMs":476,"approvedPlanMs":0,"shipAndProveMs":3327,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":null,"receiptRef":{"mode":"full","missionId":"94fb6463-408f-4f34-99da-79a66e658f6f"},"performance":null,"deploymentId":"forgejo-main-5e71fe1e717b","releaseState":null,"workflowRunId":null,"releaseTargets":{"frontend":true,"onrunner":false,"migrations":false,"ccExecution":false,"supabaseEdge":false,"edgeFunctionSlugs":[]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1835,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-22T01:47:58.754086+00:00","proof_gate":"canonical_release_dispatched","source_sha":null,"external_id":"3387","receipt_type":"automatic_mission_resume","idempotency_key":"mission:94fb6463-408f-4f34-99da-79a66e658f6f:automatic-mission-resume:3387:canonical_release_dispatched","mission_step_id":"bf4775af-b025-444e-9afc-cfe597266cda","command_center_event_id":"94fb6463-408f-4f34-99da-79a66e658f6f"},{"id":"8bab7714-d568-4363-b6be-3e7f42991160","source":"cc-execution","status":"waiting_for_gate","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-34fc64bf1723","reason":"pull_request_checks_pending","status":"waiting_for_gate","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3358,"terminal":false,"missionId":"34fc64bf-1723-4a48-8162-578dad054047","operation":"automatic_mission_resume","proofGate":"repair_mission_waiting_for_gate","sourceSha":null,"timingsMs":{"prReadinessMs":475,"approvedPlanMs":0,"shipAndProveMs":0,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"Reconcile this same mission and pull request after the exact-head KnockLaunch Gate changes state.","receiptRef":{"mode":"full","missionId":"34fc64bf-1723-4a48-8162-578dad054047"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1285,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T15:57:14.039905+00:00","proof_gate":"repair_mission_waiting_for_gate","source_sha":null,"external_id":"3358","receipt_type":"automatic_mission_resume","idempotency_key":"mission:34fc64bf-1723-4a48-8162-578dad054047:automatic-mission-resume:3358:repair_mission_waiting_for_gate","mission_step_id":"7195e3df-959d-48fb-b231-9e4cb185e453","command_center_event_id":"34fc64bf-1723-4a48-8162-578dad054047"},{"id":"64362225-1d24-4ab5-be3a-c786fa081e73","source":"cc-execution","status":"waiting_for_gate","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-34fc64bf1723","reason":"provider_verified_auto_progress_owns_gate_merge_release_outside_owner_response","status":"waiting_for_gate","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":"1.58.209-visual-certification-hardening","prNumber":3358,"terminal":false,"missionId":"34fc64bf-1723-4a48-8162-578dad054047","operation":"execute_mission","proofGate":"repair_mission_pr_handed_off_to_supervisor","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":8773,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":0,"approvedPlanMs":2126,"missionSetupMs":739,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":386,"ledgerReconcileMs":0,"lineageReconcileMs":353,"resolvePreflightMs":739,"repositoryMutationMs":6647,"repositoryProviderMs":6647,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":6157,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":386,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":490},"nextAction":"Canonical KnockLaunch Gate notifier and durable mission supervisor own Gate, merge, release, and proof progression from this exact PR head outside the owner response path.","receiptRef":{"mode":"full","missionId":"34fc64bf-1723-4a48-8162-578dad054047"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime","visual"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":3229,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T15:57:08.993239+00:00","proof_gate":"repair_mission_pr_handed_off_to_supervisor","source_sha":null,"external_id":"3358","receipt_type":"execute_mission","idempotency_key":"mission:34fc64bf-1723-4a48-8162-578dad054047:execute_mission:repair_mission_pr_handed_off_to_supervisor:current-generation","mission_step_id":"fa8ce86a-ea01-4d57-bf20-4544674992c1","command_center_event_id":"34fc64bf-1723-4a48-8162-578dad054047"},{"id":"b9d7f5a9-b6da-415b-aabc-67505283a4fe","source":"cc-execution","status":"release_reconciliation_pending","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-5a4662afe846","reason":null,"status":"release_reconciliation_pending","metrics":{"receiptBytes":16276,"releaseCount":0,"toolCallCount":4,"repeatedCallCount":0,"executorlessWaitMs":12278,"firstUsefulResultAt":"2026-09-24T23:12:32.043Z","recoveryAttemptCount":0,"ownerInterruptionCount":0},"version":"1.58.265-runner-slot-occupancy-bounds","prNumber":3681,"terminal":false,"missionId":"5a4662af-e846-4ab4-a647-e6828c342c54","operation":"execute_mission","proofGate":"canonical_release_reconciliation_pending","sourceSha":"d5ee4067d525aad8088317e594b163b2d9f31186","timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":4813,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":485,"approvedPlanMs":0,"missionSetupMs":513,"providerAuthMs":0,"shipAndProveMs":3749,"ledgerPrepareMs":360,"ledgerReconcileMs":0,"lineageReconcileMs":153,"resolvePreflightMs":513,"repositoryMutationMs":0,"repositoryProviderMs":0,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":360,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"reconcile_release","receiptRef":{"mode":"full","missionId":"5a4662af-e846-4ab4-a647-e6828c342c54"},"performance":null,"deploymentId":"forgejo-main-d5ee4067d525","releaseState":null,"workflowRunId":null,"releaseTargets":{"frontend":false,"onrunner":false,"migrations":false,"ccExecution":true,"supabaseEdge":false,"edgeFunctionSlugs":[]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":2801,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-24T23:13:16.081956+00:00","proof_gate":"canonical_release_reconciliation_pending","source_sha":"d5ee4067d525aad8088317e594b163b2d9f31186","external_id":"forgejo-main-d5ee4067d525","receipt_type":"execute_mission","idempotency_key":"mission:5a4662af-e846-4ab4-a647-e6828c342c54:execute_mission:canonical_release_reconciliation_pending:current-generation","mission_step_id":"a6132191-50c8-4d31-9eae-04d47b62d834","command_center_event_id":"5a4662af-e846-4ab4-a647-e6828c342c54"},{"id":"74bf99a4-ab45-4b05-89d8-38fe5334214f","source":"durable-mission-ledger","status":"verified","payload":{"sourceSha":"97f734cd2a627b88babbdc8d66db957f20240ac2","requestContractProof":{"legacy":false,"present":true,"outcomes":[{"id":"outcome-1","satisfied":true,"statement":"Corrective generation 3: implement persistent searchable local conversation history in the KNOCKLAUNCH Operator. Preserve timestamps, voice-to-text, progress narration, witness behavior, and universal STOP. This request intentionally begins with exact current source synthesis before mutation.","proofConditionIds":["proof-production"]}],"satisfied":true,"constraints":[{"id":"capability-completeness","satisfied":true,"statement":"Every dependency the implementation declares or relies on must be wired and proven across applicable frontend, backend/runtime, schema/data/storage, authentication/authorization, provider configuration, prerequisite/loading/empty/error states, release ownership, and live production behavior; owner-authorized unavailable dependencies must become explicit prerequisite states rather than runtime failures.","proofConditionIds":["proof-production"]},{"id":"atomic-capability-lifecycle","satisfied":true,"statement":"Changed capabilities remain non-active until dependency readiness, N/N-1 compatibility, affected-target release, and claim-matched production canary proof are satisfied; missing optional dependencies become prerequisite_required, and runtime drift or health-contract violation quarantines only the affected capability instead of breaking unrelated working capability.","proofConditionIds":["proof-production"]}],"contractHash":"07f772d7cf20fb100037fdeeeac5ae29e87a1fa3600341f44cd5b7b5d8917045","releaseBound":true,"witnessBound":false,"visualRequested":false,"visualSatisfied":true,"conditionResults":[{"id":"proof-production","kind":"runtime","evidence":{"reason":null,"satisfied":true,"releaseState":"verified","missingTargets":[],"disallowedTargets":[],"migrationRequired":false,"releaseTargetStates":{},"unsuccessfulTargets":[],"activeReleaseTargets":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"migrationReleaseVerified":null,"releaseRequestContractHash":"07f772d7cf20fb100037fdeeeac5ae29e87a1fa3600341f44cd5b7b5d8917045"},"required":true,"satisfied":true}],"validationErrors":[],"pendingProofKinds":[],"activeReleaseTargets":[]},"authoritativeMissionRefresh":true,"evaluatedRequestContractRevision":1},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-27T23:49:43.646717+00:00","proof_gate":"request_contract_terminal_verified","source_sha":"97f734cd2a627b88babbdc8d66db957f20240ac2","external_id":null,"receipt_type":"request_contract_reconciliation","idempotency_key":"mission:087a734e-d691-40e3-9aab-50ae14ca4cc8:request-contract:07f772d7cf20fb100037fdeeeac5ae29e87a1fa3600341f44cd5b7b5d8917045:97f734cd2a627b88babbdc8d66db957f20240ac2:verified:","mission_step_id":"32da43e0-eb0c-49b0-b7ab-a9b292c72c12","command_center_event_id":"087a734e-d691-40e3-9aab-50ae14ca4cc8"},{"id":"0a66830a-b3f3-44f4-8c9d-7ee5d84d0278","source":"cc-execution","status":"waiting","payload":{"body":{"ship":true,"files":[{"path":"src/__tests__/contracts/cc-execution-visual-proof-inference.contract.test.ts","content":"import { describe, expect, it } from 'vitest';\nimport { normalizeVisualProofIntent } from '../../../workers/cc-execution/src/command-center-contracts.js';\n\ndescribe('cc-execution visual proof inference', () => {\n it('does not infer visual proof from generic operational visibility language', () => {\n expect(normalizeVisualProofIntent({\n objective: 'Expose exact Stop for the current job and bounded Stop All for owner-visible active jobs using existing cancellation primitives.',\n })).toMatchObject({\n visualProofRequested: false,\n visualProofScope: 'none',\n verificationTier: 'none',\n });\n });\n\n it('still infers visual proof for a concrete visual surface', () => {\n expect(normalizeVisualProofIntent({\n objective: 'Make the header visible on mobile and fix the responsive layout.',\n })).toMatchObject({\n visualProofRequested: true,\n });\n });\n});\n"}],"branch":"ai/objective-first-repair-1615dccb9b98","writes":[],"patches":[],"pr_body":"Require a concrete visual surface before inferred visual proof while preserving real visual UI requests.","version":1,"approved":true,"pr_title":"Fix remaining operational visual-proof false positive","missionId":"1615dccb-9b98-4dbf-89c9-2e2e8326eb83","objective":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","repository":"noel/KnockLaunchOS","ownerApproved":true,"releaseIntent":null,"sourceTargets":["workers/cc-execution/src/command-center-contracts.js","src/__tests__/contracts/cc-execution-visual-proof-inference.contract.test.ts"],"anchored_edits":[{"path":"workers/cc-execution/src/command-center-contracts.js","edits":[{"new_content":" const visualSurface = /\\b(?:background|hero|image|imagery|logo|layout|spacing|clipping|clip|bleed|bleeding|overlap|scale|scaling|shell|header|card|avatar|position|alignment|center|centering|crop|cropped|viewport|mobile|desktop)\\b/;","old_content":" const visualSurface = /\\b(?:background|hero|image|imagery|logo|layout|spacing|clipping|clip|bleed|bleeding|overlap|scale|scaling|visibility|visible|responsive|shell|header|card|avatar|render|display|position|alignment|center|centering|crop|cropped|viewport|mobile|desktop)\\b/;"}]}],"implementation":{"files":[],"writes":[]},"requestContract":{"valid":true,"intent":{"rawUtterance":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","wordingChanged":false,"canonicalIntent":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"owner_explicit","version":1,"outcomes":[{"id":"outcome-1","statement":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","provenance":{"reason":null,"source":"owner_explicit","inherited":false,"blockingAuthority":true},"proofConditionIds":["proof-production"]}],"objective":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","constraints":[],"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"proof-production","kind":"runtime","claim":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","route":null,"required":true,"targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false}],"validationErrors":[]},"repairGeneration":null,"executionEnvelope":{"ship":true,"version":1,"approved":true,"missionId":null,"ownerApproved":true,"releaseIntent":null,"sourceTargets":["workers/cc-execution/src/command-center-contracts.js","src/__tests__/contracts/cc-execution-visual-proof-inference.contract.test.ts"],"requestContract":{"valid":true,"intent":{"rawUtterance":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","wordingChanged":false,"canonicalIntent":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"owner_explicit","version":1,"outcomes":[{"id":"outcome-1","statement":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","provenance":{"reason":null,"source":"owner_explicit","inherited":false,"blockingAuthority":true},"proofConditionIds":["proof-production"]}],"objective":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","constraints":[],"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"proof-production","kind":"runtime","claim":"Repair the remaining Command Center visual-proof inference false positive: generic operational state language such as owner-visible active jobs must not trigger visual proof. Require a concrete visual surface for inferred visual proof while preserving genuine visual requests such as making a header visible, rendering an image, or fixing responsive layout. Add regression coverage and prove the corrected classifier live.","route":null,"required":true,"targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false}],"validationErrors":[]},"repairGeneration":null,"proofRequirements":null,"controlPlaneUnfreeze":true,"controlPlaneMaintenance":true,"controlPlaneMaintenancePaths":["workers/cc-execution/src/command-center-contracts.js","src/__tests__/contracts/cc-execution-visual-proof-inference.contract.test.ts"],"controlPlaneMaintenanceReason":"Owner explicitly authorized the Console autonomy roadmap and this bounded corrective classifier repair."},"proofRequirements":null,"controlPlaneUnfreeze":true,"durableMutationResume":true,"controlPlaneMaintenance":true,"controlPlaneMaintenancePaths":["workers/cc-execution/src/command-center-contracts.js","src/__tests__/contracts/cc-execution-visual-proof-inference.contract.test.ts"],"controlPlaneMaintenanceReason":"Owner explicitly authorized the Console autonomy roadmap and this bounded corrective classifier repair."},"recovery":false,"fingerprint":"9cd7d0904c16fe0858e563986e409db0a7a15ad1fff7e87ad2ebcad677eb947f","replayCount":0,"serializedBytes":9838},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-27T23:49:58.48638+00:00","proof_gate":"repository_mutation_intent_persisted","source_sha":null,"external_id":null,"receipt_type":"repository_mutation_intent","idempotency_key":"mission:1615dccb-9b98-4dbf-89c9-2e2e8326eb83:repository-mutation-intent:9cd7d0904c16fe0858e563986e409db0a7a15ad1fff7e87ad2ebcad677eb947f:0","mission_step_id":"3fd2f999-5eb2-4d49-89ab-ee3ae37b18d0","command_center_event_id":"1615dccb-9b98-4dbf-89c9-2e2e8326eb83"},{"id":"1f38f0d1-3d51-4204-86f1-a54288a287c5","source":"forgejo-runtime","status":"pending","payload":{"failed":[],"states":{"forgejo-main/source":"success","forgejo-release/workflow":"pending","cc-execution/runtime-proof":"pending"},"mainSha":"efe7e5e29164e97416ecf7c0de65bbb959d7b29b","missing":[],"pending":["forgejo-release/workflow","cc-execution/runtime-proof"],"required":["forgejo-main/source","forgejo-release/workflow","cc-execution/runtime-proof"],"sourceSha":"efe7e5e29164e97416ecf7c0de65bbb959d7b29b","releaseState":"pending","sourceInMain":true,"compareStatus":"protected_main_push_exact_source","releaseTargets":{"frontend":false,"onrunner":false,"migrations":false,"ccExecution":true,"supabaseEdge":false,"edgeFunctionSlugs":[]},"releaseTargetStates":{"ccExecution":"pending"},"requestContractHash":"f0496b0da3a4f7727a13cc701ae5d2dda5f053bc20e82eb9d0d40cf4d1877510","forgejoWorkflowProof":{"runId":12385,"source":"signed_push_receipt","status":"running","results":{},"conclusion":"running","targetStates":{"ccExecution":"pending"},"targetJobCount":7,"observedTargetStates":{"ccExecution":"pending"}},"onrunnerRuntimeProof":null,"releaseSourceVerified":true,"ccExecutionRuntimeProof":{"liveSha":"cf5f94fe1a61dff270c9baf698f98f1c261a8910","deploymentId":"forgejo-main-cf5f94fe1a61dff270c9baf698f98f1c261a8910","compareStatus":null,"identitySource":"local_build_metadata","runtimeVersion":"1.58.297-clause-visual-intent","containsSourceSha":false},"releaseTargetRecoveryProof":null,"exactReleaseVerifiedAfterMainAdvanced":false},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-27T23:50:32.290947+00:00","proof_gate":"canonical_release_pending","source_sha":"efe7e5e29164e97416ecf7c0de65bbb959d7b29b","external_id":"forgejo-main-efe7e5e29164","receipt_type":"canonical_release_status","idempotency_key":"mission:55d1450a-f7fe-4ed5-bc2f-e6f3cd1d15c4:forgejo-release-status:efe7e5e29164e97416ecf7c0de65bbb959d7b29b:pending:forgejo-main/source=success|forgejo-release/workflow=pending|cc-execution/runtime-proof=pending","mission_step_id":"6053c23c-53b5-49a2-a0a6-1af1e4430fa1","command_center_event_id":"55d1450a-f7fe-4ed5-bc2f-e6f3cd1d15c4"},{"id":"3652c09b-71ba-43ee-b809-16de515202bf","source":"forgejo-runtime","status":"verified","payload":{"failed":[],"states":{"forgejo-main/source":"success","forgejo-release/workflow":"success","cc-execution/runtime-proof":"success","render-onrunner/runtime-proof":"success"},"mainSha":"ba136e4efdfc79715aee043f79d6148f9877063a","missing":[],"pending":[],"required":["forgejo-main/source","forgejo-release/workflow","cc-execution/runtime-proof","render-onrunner/runtime-proof"],"sourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a","releaseState":"verified","sourceInMain":true,"compareStatus":"protected_main_push_exact_source","releaseTargets":{"frontend":false,"onrunner":true,"migrations":false,"ccExecution":true,"supabaseEdge":false,"edgeFunctionSlugs":[]},"releaseTargetStates":{"onrunner":"success","ccExecution":"success"},"requestContractHash":"0e32a956a445bd0553cc59dc1ba4ca16bae0d87a0b573ce506d4474d200e3fee","forgejoWorkflowProof":{"url":"https://git.knocklaunch.app/noel/KnockLaunchOS/actions/runs/10528","runId":10528,"status":"success","sourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a","conclusion":null,"failedJobs":[],"diagnostics":null,"exactSource":true,"targetStates":{"onrunner":"success","ccExecution":"success"},"targetJobCount":7,"observedTargetStates":{"onrunner":"success","ccExecution":"success"}},"onrunnerRuntimeProof":{"reason":null,"hostedUrl":"https://knocklaunchcrm.onrender.com","brokerReady":true,"exactSource":true,"healthStatus":200,"runtimeReady":true,"liveSourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a","runnerVersion":"onrunner-ba136e4efdfc","expectedSourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a"},"releaseSourceVerified":true,"ccExecutionRuntimeProof":{"liveSha":"ba136e4efdfc79715aee043f79d6148f9877063a","proofGate":"cc_execution_target_aware_runtime_identity_verified","deploymentId":"forgejo-main-ba136e4efdfc79715aee043f79d6148f9877063a","compareStatus":"target_job_success_runtime_verified","workflowRunId":10528,"identitySource":"canonical_release_target_job","runtimeVersion":"1.58.209-visual-certification-hardening","workflowFailed":false,"containsSourceSha":true},"releaseTargetRecoveryProof":null,"exactReleaseVerifiedAfterMainAdvanced":false},"tenant_id":"766cfaa7-ac42-46c8-bbef-69d13268a29d","created_at":"2026-09-21T16:09:18.64215+00:00","proof_gate":"canonical_release_terminal_verified","source_sha":"ba136e4efdfc79715aee043f79d6148f9877063a","external_id":"forgejo-main-ba136e4efdfc","receipt_type":"canonical_release_status","idempotency_key":"mission:1e8472cc-207c-4b2a-b816-a66f15a3f985:forgejo-release-status:ba136e4efdfc79715aee043f79d6148f9877063a:verified:forgejo-main/source=success|forgejo-release/workflow=success|cc-execution/runtime-proof=success|render-onrunner/runtime-proof=success","mission_step_id":"20b9396f-0704-4923-94fb-04ea9d6b16a5","command_center_event_id":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},{"id":"430bae6d-8e8e-4282-b9d9-43883c86733c","source":"cc-execution","status":"verified","payload":{"ownerWaitSloMs":{"merge_to_live_ms":1492938,"owner_action_to_pr_ms":368360,"green_gate_to_merge_ms":null,"owner_action_to_useful_response_ms":236363},"ownerWaitLiveAt":"2026-09-21T16:09:23.938Z"},"tenant_id":"766cfaa7-ac42-46c8-bbef-69d13268a29d","created_at":"2026-09-21T16:09:24.477692+00:00","proof_gate":"owner_wait_live_milestone_recorded","source_sha":null,"external_id":null,"receipt_type":"owner_wait_live_milestone","idempotency_key":"mission:1e8472cc-207c-4b2a-b816-a66f15a3f985:owner-wait-live","mission_step_id":"20b9396f-0704-4923-94fb-04ea9d6b16a5","command_center_event_id":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},{"id":"7140f086-0c39-46bf-aefa-746e6c5e4291","source":"cc-execution","status":"release_verified_contract_pending","payload":{"ok":true,"jobId":null,"phase":"release","branch":"ai/objective-first-repair-5a4662afe846","reason":null,"status":"release_verified_contract_pending","metrics":{"receiptBytes":18577,"releaseCount":0,"toolCallCount":6,"repeatedCallCount":0,"executorlessWaitMs":97071,"firstUsefulResultAt":"2026-09-24T23:12:32.043Z","recoveryAttemptCount":0,"ownerInterruptionCount":0},"version":"1.58.266-ledger-egress-degraded-source-scope","prNumber":3681,"terminal":false,"missionId":"5a4662af-e846-4ab4-a647-e6828c342c54","operation":"execute_mission","proofGate":"canonical_release_already_verified","sourceSha":"d5ee4067d525aad8088317e594b163b2d9f31186","timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":1437,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":171,"approvedPlanMs":0,"missionSetupMs":1258,"providerAuthMs":0,"shipAndProveMs":581,"ledgerPrepareMs":372,"ledgerReconcileMs":0,"lineageReconcileMs":886,"resolvePreflightMs":1258,"repositoryMutationMs":0,"repositoryProviderMs":0,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":372,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":0},"nextAction":null,"receiptRef":{"mode":"full","missionId":"5a4662af-e846-4ab4-a647-e6828c342c54"},"performance":null,"deploymentId":"forgejo-main-d5ee4067d525","releaseState":null,"workflowRunId":null,"releaseTargets":{"frontend":false,"onrunner":false,"migrations":false,"ccExecution":true,"supabaseEdge":false,"edgeFunctionSlugs":[]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":2739,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-24T23:14:11.349226+00:00","proof_gate":"canonical_release_already_verified","source_sha":"d5ee4067d525aad8088317e594b163b2d9f31186","external_id":"forgejo-main-d5ee4067d525","receipt_type":"execute_mission","idempotency_key":"mission:5a4662af-e846-4ab4-a647-e6828c342c54:execute_mission:canonical_release_already_verified:current-generation","mission_step_id":"3da6f395-6f13-40ab-ba5c-cfc1cfd46ebc","command_center_event_id":"5a4662af-e846-4ab4-a647-e6828c342c54"},{"id":"7fd442e8-907b-44d5-b586-5fd1ef83160c","source":"cc-execution","status":"recorded","payload":{"requestContract":{"valid":true,"intent":{"evidence":[],"confidence":null,"rawUtterance":"Control plane maintenance continuation: decouple the dedicated 8 GB frontend release memory envelope from the separate 4 GB control-plane runner budget in Gate hard-safety validation.","wordingChanged":false,"canonicalIntent":"Control plane maintenance continuation: decouple the dedicated 8 GB frontend release memory envelope from the separate 4 GB control-plane runner budget in Gate hard-safety validation.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"explicit","version":1,"outcomes":[{"id":"separate-runner-budgets","statement":"Control plane Gate validates the 4 GB control-plane budget and the dedicated 8 GB frontend budget independently, including exact frontend container/heap/headroom values.","provenance":{"reason":null,"source":"explicit_request_contract","inherited":false,"blockingAuthority":true},"proofConditionIds":["proof-production"]}],"objective":"Control plane maintenance continuation: decouple the dedicated 8 GB frontend release memory envelope from the separate 4 GB control-plane runner budget in Gate hard-safety validation.","constraints":[{"id":"existing-hardware-only","statement":"Use only existing hardware; no infrastructure purchase or resize.","provenance":{"reason":null,"source":"explicit_request_contract","inherited":false,"blockingAuthority":true},"proofConditionIds":["proof-production"]},{"id":"visual-witness-excluded","statement":"Do not modify Visual Witness.","provenance":{"reason":null,"source":"explicit_request_contract","inherited":false,"blockingAuthority":true},"proofConditionIds":["proof-production"]},{"id":"capability-completeness","statement":"Every dependency the implementation declares or relies on must be wired and proven across applicable frontend, backend/runtime, schema/data/storage, authentication/authorization, provider configuration, prerequisite/loading/empty/error states, release ownership, and live production behavior; owner-authorized unavailable dependencies must become explicit prerequisite states rather than runtime failures.","provenance":{"reason":null,"source":"hard_safety_invariant","inherited":false,"blockingAuthority":true},"proofConditionIds":["proof-production"]},{"id":"atomic-capability-lifecycle","statement":"Changed capabilities remain non-active until dependency readiness, N/N-1 compatibility, affected-target release, and claim-matched production canary proof are satisfied; missing optional dependencies become prerequisite_required, and runtime drift or health-contract violation quarantines only the affected capability instead of breaking unrelated working capability.","provenance":{"reason":null,"source":"hard_safety_invariant","inherited":false,"blockingAuthority":true},"proofConditionIds":["proof-production"]}],"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"proof-production","kind":"runtime","claim":"The same PR reruns canonical Gate with separate control-plane and frontend memory envelopes and reaches green before merge.","route":null,"roleRef":null,"userRef":null,"required":true,"expectedText":null,"targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"expectedWatchdogPolicyVersion":null,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false}],"validationErrors":[],"capabilityManifest":{"id":"Control-plane-maintenance-continuation:-decouple-the-dedicated-8-GB-frontend-release-memory-envelope","driftPolicy":"exact_manifest_source_release_dependency_or_runtime_identity_mismatch_is_nonterminal","proofLedger":"command_center_mission_ledger_request_contract_hash_bound","schemaVersion":1,"releaseTargets":[],"lifecycleStates":["prepare","deploy","verify","activate"],"activationPolicy":"dependencies_and_claim_matched_live_proof_before_exposure","dependencyDomains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"prerequisitePolicy":"expected_unavailable_dependencies_are_prerequisite_required_not_runtime_failures","compatibilityWindow":["N","N-1"],"failureIsolationPolicy":"quarantine_or_rollback_affected_capability_only_preserve_unrelated_working_capabilities","canaryProofConditionIds":["proof-production"]},"capabilityCompleteness":{"domains":["frontend","backend_runtime","schema_data_storage","authentication_authorization","provider_configuration","prerequisite_loading_empty_error_states","release_ownership","live_production_proof"],"required":true,"prerequisitePolicy":"expected_unavailable_dependencies_are_prerequisite_states_not_runtime_failures"}},"requestContractHash":"603c1f08db2874e600ea48999a6c1a870392fe83657bf83820f45dbe79ba5661","requestContractRevision":4,"previousRequestContractHash":"0195b29534602b426df67b41952e1f2ed6313c76920e5300b7b5c012c1e8d447"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T13:29:12.198963+00:00","proof_gate":"request_contract_revision_recorded","source_sha":null,"external_id":null,"receipt_type":"request_contract_revision","idempotency_key":"mission:bdb936b2-e84f-409b-98ae-f50b6415629c:request-contract:603c1f08db2874e600ea48999a6c1a870392fe83657bf83820f45dbe79ba5661","mission_step_id":"dd2537a7-d502-4b60-8d2a-ad943e48569d","command_center_event_id":"bdb936b2-e84f-409b-98ae-f50b6415629c"},{"id":"7073cb34-dc35-4c44-bab0-73af799d514c","source":"cc-execution","status":"authorized","payload":{"paths":[".forgejo/workflows/knocklaunch.yml","scripts/validate-control-plane-restore-point.mjs"],"reason":"Owner ordered the September 25 witness-lockdown state fully locked down. Current main is stable at the post-PAUL 58435c69 generation; make restore validation unconditional on every Gate after the previous attempt was safely rejected before mutation by the base-SHA fence.","baseSha":"58435c69e33adefbd4bad2bd36637097375dc006","issuedAt":1790342972999,"expiresAt":1790343152999,"missionId":"8b22a784-5397-4822-8c66-cdcfcda533d7","authorizationId":"7b0b063a-15b6-47d5-a8b4-94f7d686930e","retryableWithinExactScope":true},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T13:29:33.25827+00:00","proof_gate":"control_plane_maintenance_scope_authorized","source_sha":"58435c69e33adefbd4bad2bd36637097375dc006","external_id":null,"receipt_type":"control_plane_maintenance_authorization","idempotency_key":"control-plane-maintenance-authorize:7b0b063a-15b6-47d5-a8b4-94f7d686930e","mission_step_id":"d5aa85b1-97c0-4d06-ba34-1e4a01341bb3","command_center_event_id":"8b22a784-5397-4822-8c66-cdcfcda533d7"},{"id":"61d24506-c440-49a9-8ea6-9a5de458f4bf","source":"cc-execution","status":"waiting_for_gate","payload":{"ok":true,"jobId":null,"phase":"implementation","branch":"ai/objective-first-repair-8b22a7845397","reason":"provider_verified_auto_progress_owns_gate_merge_release_outside_owner_response","status":"waiting_for_gate","metrics":{"receiptBytes":16839,"releaseCount":0,"toolCallCount":1,"repeatedCallCount":0,"executorlessWaitMs":0,"firstUsefulResultAt":"2026-09-25T13:29:32.247Z","recoveryAttemptCount":0,"ownerInterruptionCount":0},"version":"1.58.280-witness-lockdown","prNumber":3731,"terminal":false,"missionId":"8b22a784-5397-4822-8c66-cdcfcda533d7","operation":"execute_mission","proofGate":"repair_mission_pr_handed_off_to_supervisor","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":4209,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":0,"approvedPlanMs":1353,"missionSetupMs":326,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":326,"ledgerReconcileMs":0,"lineageReconcileMs":0,"resolvePreflightMs":326,"repositoryMutationMs":2856,"repositoryProviderMs":2856,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":1771,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":326,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":1085},"nextAction":"Canonical KnockLaunch Gate notifier and durable mission supervisor own Gate, merge, release, and proof progression from this exact PR head outside the owner response path.","receiptRef":{"mode":"full","missionId":"8b22a784-5397-4822-8c66-cdcfcda533d7"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":3605,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T13:29:37.545683+00:00","proof_gate":"repair_mission_pr_handed_off_to_supervisor","source_sha":null,"external_id":"3731","receipt_type":"execute_mission","idempotency_key":"mission:8b22a784-5397-4822-8c66-cdcfcda533d7:execute_mission:repair_mission_pr_handed_off_to_supervisor:current-generation","mission_step_id":"fd815cd8-eecb-45f4-a1d2-d40f3caea40d","command_center_event_id":"8b22a784-5397-4822-8c66-cdcfcda533d7"},{"id":"86a81901-619f-4e93-bd24-d43b6484de07","source":"cc-execution","status":"verified","payload":{"ownerWaitSloMs":{"merge_to_live_ms":26385,"owner_action_to_pr_ms":549821,"green_gate_to_merge_ms":null,"owner_action_to_useful_response_ms":544824},"ownerWaitLiveAt":"2026-09-28T03:23:08.385Z"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-28T03:23:08.721407+00:00","proof_gate":"owner_wait_live_milestone_recorded","source_sha":null,"external_id":null,"receipt_type":"owner_wait_live_milestone","idempotency_key":"mission:73364bb7-6976-4a69-babf-4e8729bea3eb:owner-wait-live","mission_step_id":"72c101d4-8fbe-4bcc-bdd2-497e46ba642e","command_center_event_id":"73364bb7-6976-4a69-babf-4e8729bea3eb"},{"id":"8bac59ce-335d-446c-b455-8e1d14dc7785","source":"cc-execution","status":"pending","payload":{"ok":true,"jobId":"abf9454a-7e24-493b-a54f-db16af319ae9","phase":"universal_visual_witness_supervised","branch":"ai/objective-first-repair-1e8472cc207c","reason":null,"status":"pending","metrics":{"receiptBytes":0,"releaseCount":1,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3357,"terminal":false,"missionId":"1e8472cc-207c-4b2a-b816-a66f15a3f985","operation":"visual_proof_started","proofGate":"universal_visual_witness_pending","sourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a","timingsMs":{"queue":363,"total":488,"execution":125},"nextAction":"Execution is pending; poll inspect_route_status only when fresh progress is expected, or cancel with inspect_route_cancel.","receiptRef":{"mode":"full","missionId":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},"performance":null,"deploymentId":"forgejo-main-ba136e4efdfc","releaseState":"verified","visualWitness":{"role":"GodMode","jobId":"abf9454a-7e24-493b-a54f-db16af319ae9","tenant":"766cfaa7-ac42-46c8-bbef-69d13268a29d","runnerUrl":"cloudflare-container://visual-witness-virtual","runnerLane":"virtual","attemptsUsed":0,"supervisorId":"abf9454a-7e24-493b-a54f-db16af319ae9","failureReason":null,"observedRoute":null,"runnerVersion":null,"attemptLineage":[],"missionOutcome":null,"requestedRoute":"/big-papis/owner/dashboard","runnerSourceSha":null,"selectedViewports":["desktop","mobile"],"checkpointAccounting":null,"correctiveGeneration":0,"restartReplayHistory":[]},"workflowRunId":10528,"releaseTargets":{"frontend":false,"onrunner":true,"migrations":false,"ccExecution":true,"supabaseEdge":false,"edgeFunctionSlugs":[]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1819,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"766cfaa7-ac42-46c8-bbef-69d13268a29d","created_at":"2026-09-21T16:09:22.07045+00:00","proof_gate":"post_release_visual_proof_started","source_sha":"ba136e4efdfc79715aee043f79d6148f9877063a","external_id":"abf9454a-7e24-493b-a54f-db16af319ae9","receipt_type":"visual_proof_started","idempotency_key":"mission:1e8472cc-207c-4b2a-b816-a66f15a3f985:visual-start:abf9454a-7e24-493b-a54f-db16af319ae9","mission_step_id":"b91fc332-a882-4643-adaf-54fe0ae6894e","command_center_event_id":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},{"id":"b3483e52-d372-4939-9b5d-31d8ff4b65d3","source":"cc-execution","status":"pending","payload":{"ok":true,"jobId":"f72dd7a3-3e8f-4ac5-816e-f21d0ed3ba61","phase":"universal_visual_witness_supervised","branch":"ai/objective-first-repair-1e8472cc207c","reason":null,"status":"pending","metrics":{"receiptBytes":0,"releaseCount":1,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3357,"terminal":false,"missionId":"1e8472cc-207c-4b2a-b816-a66f15a3f985","operation":"visual_proof_started","proofGate":"universal_visual_witness_pending","sourceSha":"ba136e4efdfc79715aee043f79d6148f9877063a","timingsMs":{"queue":271,"total":377,"execution":106},"nextAction":"Execution is pending; poll inspect_route_status only when fresh progress is expected, or cancel with inspect_route_cancel.","receiptRef":{"mode":"full","missionId":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},"performance":null,"deploymentId":"forgejo-main-ba136e4efdfc","releaseState":"verified","visualWitness":{"role":"GodMode","jobId":"f72dd7a3-3e8f-4ac5-816e-f21d0ed3ba61","tenant":"766cfaa7-ac42-46c8-bbef-69d13268a29d","runnerUrl":"cloudflare-container://visual-witness-virtual","runnerLane":"virtual","attemptsUsed":0,"supervisorId":"f72dd7a3-3e8f-4ac5-816e-f21d0ed3ba61","failureReason":null,"observedRoute":null,"runnerVersion":null,"attemptLineage":[],"missionOutcome":null,"requestedRoute":"/big-papis/owner/dashboard","runnerSourceSha":null,"selectedViewports":["desktop","mobile"],"checkpointAccounting":null,"correctiveGeneration":0,"restartReplayHistory":[]},"workflowRunId":10528,"releaseTargets":{"frontend":false,"onrunner":true,"migrations":false,"ccExecution":true,"supabaseEdge":false,"edgeFunctionSlugs":[]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["visual"],"verificationState":"failed","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1819,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"766cfaa7-ac42-46c8-bbef-69d13268a29d","created_at":"2026-09-21T16:16:09.367872+00:00","proof_gate":"post_release_visual_proof_started","source_sha":"ba136e4efdfc79715aee043f79d6148f9877063a","external_id":"f72dd7a3-3e8f-4ac5-816e-f21d0ed3ba61","receipt_type":"visual_proof_started","idempotency_key":"mission:1e8472cc-207c-4b2a-b816-a66f15a3f985:visual-start:f72dd7a3-3e8f-4ac5-816e-f21d0ed3ba61","mission_step_id":"b91fc332-a882-4643-adaf-54fe0ae6894e","command_center_event_id":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},{"id":"da059c09-5a98-4e82-a68e-10594a0deee1","source":"cc-execution","status":"synthesis_required","payload":{"ok":true,"jobId":null,"phase":"objective_received","branch":"ai/objective-first-repair-ad033befa378","reason":null,"status":"synthesis_required","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":"1.58.209-visual-certification-hardening","prNumber":null,"terminal":false,"missionId":"ad033bef-a378-4fd8-b821-892b60801fb5","operation":"execute_mission","proofGate":"repair_mission_synthesis_ready","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":396,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"missionSetupMs":429,"providerAuthMs":0,"ledgerPrepareMs":429,"ledgerReconcileMs":0,"lineageReconcileMs":0,"resolvePreflightMs":429,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"totalSynchronousLedgerMs":429,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0},"nextAction":"Inspect the bounded repository paths, synthesize exact files or anchored_edits, and call /mission/execute again automatically with this same missionId without another owner prompt or workflow switch.","receiptRef":{"mode":"full","missionId":"ad033bef-a378-4fd8-b821-892b60801fb5"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":8209,"likelyAffectedFiles":["packages","src/__tests__/contracts/knocklaunch-os-tenant-routing.contract.test.ts","src/App.css","src/App.tsx","src/OAuthConsentBridge.tsx","src/PrivateAppShell.tsx","src/PublicAppShell.tsx","src/__tests__/contracts/active-tenant-hook-role-scope.contract.test.ts","src/__tests__/contracts/encore-pa-tenant-authority.contract.test.ts","src/__tests__/contracts/generatedTenantRouteFamily.contract.test.ts","src/__tests__/contracts/godmode-tenant-authority-runtime.contract.test.ts","src/__tests__/contracts/mobile-tenant-avatar-navigation.contract.test.ts"],"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T16:17:10.16967+00:00","proof_gate":"repair_mission_synthesis_ready","source_sha":null,"external_id":null,"receipt_type":"execute_mission","idempotency_key":"mission:ad033bef-a378-4fd8-b821-892b60801fb5:execute_mission:repair_mission_synthesis_ready:current-generation","mission_step_id":"a6f85929-f7b9-42c1-a2b8-bc60a040dd57","command_center_event_id":"ad033bef-a378-4fd8-b821-892b60801fb5"},{"id":"73f24614-e46f-405b-a0ba-9307bf5e5fb5","source":"cc-execution","status":"waiting","payload":{"body":{"ship":true,"files":[{"path":"supabase/migrations/20260924233000_modes_storage_reconcile_egress_guard.sql","content":"-- KNOCKLAUNCH Supabase cached-egress safety guard for automatic MODES storage reconciliation.\n-- The Sept 14-17 2026 incident proved that a trigger feedback loop can fan out into\n-- millions of tenant storage list operations. Keep automatic repair bounded even if\n-- a future semantic trigger regresses.\ncreate table if not exists private.modes_storage_reconcile_guard (\n scope_key text primary key,\n last_dispatched_at timestamptz,\n last_blocked_at timestamptz,\n last_reason text,\n blocked_notice_count bigint not null default 0,\n updated_at timestamptz not null default now()\n);\n\nrevoke all on table private.modes_storage_reconcile_guard from public, anon, authenticated;\ngrant select, insert, update on table private.modes_storage_reconcile_guard to service_role;\n\ncreate or replace function private.modes_storage_edge_request(p_tenant_id uuid default null)\nreturns bigint\nlanguage plpgsql\nsecurity definer\nset search_path = private, vault, net, public, pg_temp\nas $$\ndeclare\n v_token text;\n v_request_id bigint;\n v_scope_key text := case when p_tenant_id is null then 'all-tenants' else 'tenant:' || p_tenant_id::text end;\n v_cooldown_seconds integer := case when p_tenant_id is null then 1800 else 300 end;\n v_now timestamptz := clock_timestamp();\n v_last_dispatched_at timestamptz;\n v_last_blocked_at timestamptz;\n v_retry_after_seconds integer;\nbegin\n -- Collapse concurrent copies immediately instead of making them wait and fan out.\n if not pg_try_advisory_xact_lock(hashtextextended('modes-storage-egress-guard:' || v_scope_key, 0)) then\n return 0;\n end if;\n\n insert into private.modes_storage_reconcile_guard(scope_key, updated_at)\n values (v_scope_key, v_now)\n on conflict (scope_key) do nothing;\n\n select last_dispatched_at, last_blocked_at\n into v_last_dispatched_at, v_last_blocked_at\n from private.modes_storage_reconcile_guard\n where scope_key = v_scope_key\n for update;\n\n if v_last_dispatched_at is not null\n and v_now < v_last_dispatched_at + make_interval(secs => v_cooldown_seconds) then\n v_retry_after_seconds := greatest(\n 1,\n ceil(extract(epoch from ((v_last_dispatched_at + make_interval(secs => v_cooldown_seconds)) - v_now)))::integer\n );\n\n -- Emit at most one loud notice per cooldown window. Do not create a second log storm.\n if v_last_blocked_at is null\n or v_now >= v_last_blocked_at + make_interval(secs => v_cooldown_seconds) then\n update private.modes_storage_reconcile_guard\n set last_blocked_at = v_now,\n last_reason = 'automatic_modes_reconcile_debounced',\n blocked_notice_count = blocked_notice_count + 1,\n updated_at = v_now\n where scope_key = v_scope_key;\n\n raise warning 'SUPABASE_EGRESS_SAFETY_STOP scope=% reason=automatic_modes_reconcile_debounced retry_after_seconds=% cached_egress_ceiling_gb=250',\n v_scope_key, v_retry_after_seconds;\n end if;\n\n return 0;\n end if;\n\n update private.modes_storage_reconcile_guard\n set last_dispatched_at = v_now,\n last_reason = null,\n updated_at = v_now\n where scope_key = v_scope_key;\n\n select decrypted_secret into v_token\n from vault.decrypted_secrets\n where name = 'knocklaunch_modes_storage_reconcile_trigger'\n limit 1;\n\n if v_token is null then\n raise exception 'modes_storage_reconcile_secret_missing';\n end if;\n\n select net.http_post(\n url := 'https://ymntrajfubicyxwwdxxa.supabase.co/functions/v1/tenant-media-library',\n body := jsonb_strip_nulls(jsonb_build_object('action','reconcile_modes_internal','tenantId',p_tenant_id)),\n headers := jsonb_build_object(\n 'Content-Type','application/json',\n 'x-modes-storage-token',v_token,\n 'x-knocklaunch-egress-guard','automatic-admitted'\n ),\n timeout_milliseconds := 30000\n ) into v_request_id;\n\n return v_request_id;\nend;\n$$;\n\nrevoke all on function private.modes_storage_edge_request(uuid) from public, anon, authenticated;\n\ncomment on table private.modes_storage_reconcile_guard is\n 'KNOCKLAUNCH automatic MODES reconcile egress circuit breaker. 250 GB cached-egress ceiling policy; 5 minute tenant cooldown; 30 minute all-tenant cooldown.';\n"},{"path":"src/__tests__/contracts/supabase-egress-safety.contract.test.ts","content":"import { readFileSync } from 'node:fs';\nimport { describe, expect, it } from 'vitest';\n\nconst migration = readFileSync('supabase/migrations/20260924233000_modes_storage_reconcile_egress_guard.sql', 'utf8');\nconst mediaLibrary = readFileSync('supabase/functions/tenant-media-library/index.ts', 'utf8');\n\ndescribe('Supabase egress safety contract', () => {\n it('rate-limits automatic MODES reconciliation before pg_net fanout', () => {\n expect(migration).toContain('private.modes_storage_reconcile_guard');\n expect(migration).toContain('pg_try_advisory_xact_lock');\n expect(migration).toContain(\"p_tenant_id is null then 1800 else 300\");\n expect(migration).toContain('SUPABASE_EGRESS_SAFETY_STOP');\n expect(migration).toContain('cached_egress_ceiling_gb=250');\n expect(migration).toContain(\"x-knocklaunch-egress-guard\");\n });\n\n it('keeps automatic reconciliation on the lightweight bucket path', () => {\n expect(mediaLibrary).toContain('const forceBucketVerify=strict||includePreparedTenant');\n expect(mediaLibrary).toContain('ensureTenantBucket(String(tenant.id),tenant,forceBucketVerify)');\n });\n\n it('advertises the owner-visible safety policy from tenant-media-library health', () => {\n expect(mediaLibrary).toContain(\"supabaseEgressSafety:{cachedEgressCeilingGb:250\");\n expect(mediaLibrary).toContain(\"stopCode:'SUPABASE_EGRESS_SAFETY_STOP'\");\n });\n});\n"}],"branch":"ai/objective-first-repair-c3721053a5c6","writes":[],"patches":[],"version":1,"approved":true,"missionId":"c3721053-a5c6-455c-9c51-01d80fd81713","objective":"Prevent another Supabase cached-egress runaway from automatic MODES media reconciliation. Add a database-side per-scope circuit breaker before pg_net dispatch: automatic tenant reconciliation may dispatch at most once per tenant per 300 seconds, all-tenant reconciliation at most once per 1800 seconds, and concurrent duplicates collapse immediately with pg_try_advisory_xact_lock. A blocked automatic dispatch must return without network fanout and emit at most one unmistakable SUPABASE_EGRESS_SAFETY_STOP warning per cooldown window, including retry timing and the 250 GB cached-egress ceiling policy. Keep deliberate/manual media operations functional. Make tenant-media-library automatic reconciliation use lightweight bucket verification unless strict/bootstrap verification was explicitly requested, and advertise the safety policy from its health response. Add a focused contract test. Gate, squash merge, apply the migration, release tenant-media-library, and verify production plus current request-rate sanity.","repository":"noel/KnockLaunchOS","ownerApproved":true,"releaseIntent":null,"sourceTargets":["supabase/functions/tenant-media-library/index.ts","supabase/migrations/20260924233000_modes_storage_reconcile_egress_guard.sql","src/__tests__/contracts/supabase-egress-safety.contract.test.ts"],"anchored_edits":[{"path":"supabase/functions/tenant-media-library/index.ts","edits":[{"new_content":"tenantCount++;const forceBucketVerify=strict||includePreparedTenant;try{await ensureTenantBucket(String(tenant.id),tenant,forceBucketVerify)}catch","old_content":"tenantCount++;try{await ensureTenantBucket(String(tenant.id),tenant,true)}catch"},{"new_content":"tenantWorkspaceConversionActions:['set_experience_family'],supabaseEgressSafety:{cachedEgressCeilingGb:250,automaticModesReconcileCooldownSeconds:300,automaticAllTenantReconcileCooldownSeconds:1800,stopCode:'SUPABASE_EGRESS_SAFETY_STOP'},tenantTypeRegistryContract:","old_content":"tenantWorkspaceConversionActions:['set_experience_family'],tenantTypeRegistryContract:"}]}],"implementation":{"files":[],"writes":[]},"requestContract":{"outcomes":[{"id":"egress-circuit-breaker","statement":"Automatic MODES media reconciliation cannot fan out more frequently than the configured tenant/global cooldowns and duplicate concurrent dispatches are collapsed before pg_net network traffic.","proofConditionIds":["egress-live-proof"]},{"id":"clear-safety-stop","statement":"When the automatic reconcile guard blocks a dispatch, the system emits SUPABASE_EGRESS_SAFETY_STOP with retry context and the 250 GB cached-egress ceiling policy without creating a warning storm.","proofConditionIds":["egress-live-proof"]}],"constraints":[{"id":"manual-media-preserved","statement":"Deliberate tenant media upload, delivery, bootstrap, and strict verification workflows remain functional; only automatic trigger fanout is throttled.","proofConditionIds":["egress-live-proof"]}],"proofConditions":[{"id":"egress-live-proof","kind":"runtime","claim":"The migration is applied, tenant-media-library is released, its health contract advertises the safety policy, and recent production logs show no renewed tenant storage-list storm.","required":true,"requiredReleaseTargets":["supabaseEdge","migrations"]}]},"repairGeneration":null,"executionEnvelope":{"ship":true,"version":1,"approved":true,"missionId":null,"ownerApproved":true,"releaseIntent":null,"sourceTargets":["supabase/functions/tenant-media-library/index.ts","supabase/migrations/20260924233000_modes_storage_reconcile_egress_guard.sql","src/__tests__/contracts/supabase-egress-safety.contract.test.ts"],"requestContract":{"outcomes":[{"id":"egress-circuit-breaker","statement":"Automatic MODES media reconciliation cannot fan out more frequently than the configured tenant/global cooldowns and duplicate concurrent dispatches are collapsed before pg_net network traffic.","proofConditionIds":["egress-live-proof"]},{"id":"clear-safety-stop","statement":"When the automatic reconcile guard blocks a dispatch, the system emits SUPABASE_EGRESS_SAFETY_STOP with retry context and the 250 GB cached-egress ceiling policy without creating a warning storm.","proofConditionIds":["egress-live-proof"]}],"constraints":[{"id":"manual-media-preserved","statement":"Deliberate tenant media upload, delivery, bootstrap, and strict verification workflows remain functional; only automatic trigger fanout is throttled.","proofConditionIds":["egress-live-proof"]}],"proofConditions":[{"id":"egress-live-proof","kind":"runtime","claim":"The migration is applied, tenant-media-library is released, its health contract advertises the safety policy, and recent production logs show no renewed tenant storage-list storm.","required":true,"requiredReleaseTargets":["supabaseEdge","migrations"]}]},"repairGeneration":null,"proofRequirements":null,"controlPlaneUnfreeze":false,"controlPlaneMaintenance":false,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":null},"proofRequirements":null,"controlPlaneUnfreeze":false,"durableMutationResume":true,"controlPlaneMaintenance":false,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":null},"recovery":false,"fingerprint":"95cd0d362237446a94559c10c60d7f0d9688a60446f30f37476d2dd782b3b94e","replayCount":0,"serializedBytes":11257},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-24T23:15:53.663756+00:00","proof_gate":"repository_mutation_intent_persisted","source_sha":null,"external_id":null,"receipt_type":"repository_mutation_intent","idempotency_key":"mission:c3721053-a5c6-455c-9c51-01d80fd81713:repository-mutation-intent:95cd0d362237446a94559c10c60d7f0d9688a60446f30f37476d2dd782b3b94e:0","mission_step_id":"4b6f765e-9fa3-4afc-9c6c-3035ab923372","command_center_event_id":"c3721053-a5c6-455c-9c51-01d80fd81713"},{"id":"b6181337-c832-4b60-9de8-b7bfaa3b1b1c","source":"cc-execution","status":"authorized","payload":{"paths":[".forgejo/workflows/knocklaunch.yml"],"reason":"Gate exposed a stale hard-safety equality that incorrectly binds the dedicated 8 GB frontend heap to the independent 4 GB control-plane heap. Owner requested this runner routing repair.","baseSha":"58435c69e33adefbd4bad2bd36637097375dc006","issuedAt":1790342952707,"expiresAt":1790343132707,"missionId":"bdb936b2-e84f-409b-98ae-f50b6415629c","authorizationId":"e0dd8f68-a436-40de-8980-05d214be99c3","retryableWithinExactScope":true},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T13:29:12.970243+00:00","proof_gate":"control_plane_maintenance_scope_authorized","source_sha":"58435c69e33adefbd4bad2bd36637097375dc006","external_id":null,"receipt_type":"control_plane_maintenance_authorization","idempotency_key":"control-plane-maintenance-authorize:e0dd8f68-a436-40de-8980-05d214be99c3","mission_step_id":"e4fadef3-ecb8-4c51-b55f-4529e4c1635c","command_center_event_id":"bdb936b2-e84f-409b-98ae-f50b6415629c"},{"id":"2a616591-0aed-4691-9d87-137ee52ae197","source":"cc-execution","status":"authorized","payload":{"paths":["src/pages/admin/GodModeCommandConsole.tsx","workers/cc-execution/src/console-operator.js"],"reason":"Owner-authorized exact-scope repair for current-main Console capability-question misrouting.","baseSha":"0d4d671d8f9cd9b6cd97912393bbfe8a974c8820","issuedAt":1790558436693,"expiresAt":1790558616693,"missionId":"7cbb6947-42c0-483b-ad3b-9b100a6812bc","authorizationId":"e3473951-3f23-4910-83d0-05fe1430011c","retryableWithinExactScope":true},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-28T01:20:36.939136+00:00","proof_gate":"control_plane_maintenance_scope_authorized","source_sha":"0d4d671d8f9cd9b6cd97912393bbfe8a974c8820","external_id":null,"receipt_type":"control_plane_maintenance_authorization","idempotency_key":"control-plane-maintenance-authorize:e3473951-3f23-4910-83d0-05fe1430011c","mission_step_id":"f8638912-9e5c-4800-afde-3e0b09582e0c","command_center_event_id":"7cbb6947-42c0-483b-ad3b-9b100a6812bc"},{"id":"f292bc1e-4353-4e8c-9e87-060112c8bd22","source":"cc-execution","status":"waiting","payload":{"kind":"heartbeat","message":"Still active in implementation.","nextAction":{"lane":"cc-execution","action":"continue_implementation","reason":"durable_state:implementation","automationAllowed":false,"ownerActionRequired":false},"silenceBudgetMs":15000,"semanticCheckpointSignature":"{\"stateMachineVersion\":1,\"phase\":\"implementation\",\"ownerFacingState\":null,\"latest\":{\"kind\":\"receipt\",\"key\":\"execute_mission\",\"status\":\"synthesis_required\",\"proofGate\":\"repair_mission_synthesis_ready\"},\"activeStep\":{\"key\":\"implementation\",\"status\":\"ready\",\"lane\":\"cc-execution\"},\"nextStep\":{\"key\":\"pull_request\",\"status\":\"pending\",\"lane\":\"cc-execution\"},\"nextSafeAction\":{\"action\":\"continue_implementation\",\"lane\":\"cc-execution\",\"reason\":\"durable_state:implementation\",\"automationAllowed\":false,\"ownerActionRequired\":false},\"acceptance\":{\"total\":2,\"verified\":0,\"pending\":2,\"percent\":0,\"satisfied\":false,\"verifiedIds\":[],\"pendingIds\":[\"proof-production\",\"proof-visual\"]},\"stall\":{\"stalled\":false,\"reason\":\"within_deadline\",\"step\":\"implementation\",\"deadlineAt\":\"2026-09-21T18:17:09.190501+00:00\",\"recoveryAction\":null},\"blocker\":null,\"terminal\":false,\"branch\":\"ai/objective-first-repair-ad033befa378\",\"prNumber\":null,\"sourceSha\":null,\"deploymentId\":null}"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T16:17:26.349648+00:00","proof_gate":"owner_progress_heartbeat","source_sha":null,"external_id":null,"receipt_type":"owner_progress_heartbeat","idempotency_key":"mission:ad033bef-a378-4fd8-b821-892b60801fb5:owner-progress-heartbeat:119333829","mission_step_id":"222f02e8-1838-496c-8ad7-ae970983874e","command_center_event_id":"ad033bef-a378-4fd8-b821-892b60801fb5"},{"id":"1d7c4de1-d177-49e2-90f6-12d99c6f4fc0","source":"cc-execution","status":"blocked","payload":{"ok":false,"jobId":"f72dd7a3-3e8f-4ac5-816e-f21d0ed3ba61","phase":"visual_proof","branch":"ai/objective-first-repair-1e8472cc207c","reason":"anchored_edit_anchor_missing:src/PrivateAppShell.tsx","status":"blocked","metrics":{"receiptBytes":0,"releaseCount":1,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":"1.58.209-visual-certification-hardening","prNumber":null,"terminal":false,"missionId":"1e8472cc-207c-4b2a-b816-a66f15a3f985","operation":"execute_mission","proofGate":"repair_mission_execution_blocked","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":893,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":0,"approvedPlanMs":893,"missionSetupMs":563,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":563,"ledgerReconcileMs":0,"lineageReconcileMs":0,"resolvePreflightMs":563,"repositoryMutationMs":0,"repositoryProviderMs":0,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":563,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":0},"nextAction":null,"receiptRef":{"mode":"full","missionId":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},"performance":null,"deploymentId":null,"releaseState":"verified","visualWitness":{"role":null,"jobId":"f72dd7a3-3e8f-4ac5-816e-f21d0ed3ba61","tenant":null,"runnerUrl":null,"runnerLane":null,"attemptsUsed":null,"supervisorId":null,"failureReason":"anchored_edit_anchor_missing:src/PrivateAppShell.tsx","observedRoute":null,"runnerVersion":null,"attemptLineage":[],"missionOutcome":null,"requestedRoute":null,"runnerSourceSha":null,"selectedViewports":[],"checkpointAccounting":null,"correctiveGeneration":0,"restartReplayHistory":[]},"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["visual"],"verificationState":"failed","workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1483,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"766cfaa7-ac42-46c8-bbef-69d13268a29d","created_at":"2026-09-21T16:21:58.907094+00:00","proof_gate":"repair_mission_execution_blocked","source_sha":null,"external_id":"f72dd7a3-3e8f-4ac5-816e-f21d0ed3ba61","receipt_type":"execute_mission","idempotency_key":"mission:1e8472cc-207c-4b2a-b816-a66f15a3f985:execute_mission:repair_mission_execution_blocked:generation-1","mission_step_id":"79d62e91-6ba6-4ed8-8001-1561bb4c6fab","command_center_event_id":"1e8472cc-207c-4b2a-b816-a66f15a3f985"},{"id":"c79b72a6-d327-4082-bab2-72b3ed5c3913","source":"cc-execution","status":"waiting_for_gate","payload":{"ok":true,"jobId":null,"phase":"implementation","branch":"ai/objective-first-repair-c3721053a5c6","reason":"provider_verified_auto_progress_owns_gate_merge_release_outside_owner_response","status":"waiting_for_gate","metrics":{"receiptBytes":11404,"releaseCount":0,"toolCallCount":1,"repeatedCallCount":0,"executorlessWaitMs":0,"firstUsefulResultAt":"2026-09-24T23:15:53.601Z","recoveryAttemptCount":0,"ownerInterruptionCount":0},"version":"1.58.266-ledger-egress-degraded-source-scope","prNumber":3682,"terminal":false,"missionId":"c3721053-a5c6-455c-9c51-01d80fd81713","operation":"execute_mission","proofGate":"repair_mission_pr_handed_off_to_supervisor","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":4747,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":0,"approvedPlanMs":682,"missionSetupMs":284,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":284,"ledgerReconcileMs":0,"lineageReconcileMs":0,"resolvePreflightMs":284,"repositoryMutationMs":4065,"repositoryProviderMs":4065,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":2465,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":284,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":1600},"nextAction":"Canonical KnockLaunch Gate notifier and durable mission supervisor own Gate, merge, release, and proof progression from this exact PR head outside the owner response path.","receiptRef":{"mode":"full","missionId":"c3721053-a5c6-455c-9c51-01d80fd81713"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":3457,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-24T23:15:59.367863+00:00","proof_gate":"repair_mission_pr_handed_off_to_supervisor","source_sha":null,"external_id":"3682","receipt_type":"execute_mission","idempotency_key":"mission:c3721053-a5c6-455c-9c51-01d80fd81713:execute_mission:repair_mission_pr_handed_off_to_supervisor:current-generation","mission_step_id":"4b6f765e-9fa3-4afc-9c6c-3035ab923372","command_center_event_id":"c3721053-a5c6-455c-9c51-01d80fd81713"},{"id":"a3e2cd1e-1a5d-4cfb-92e4-d0366692ce23","source":"cc-execution","status":"release_reconciliation_pending","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-c3721053a5c6","reason":null,"status":"release_reconciliation_pending","metrics":{"receiptBytes":15024,"releaseCount":0,"toolCallCount":3,"repeatedCallCount":0,"executorlessWaitMs":8026,"firstUsefulResultAt":"2026-09-24T23:15:53.601Z","recoveryAttemptCount":0,"ownerInterruptionCount":0},"version":"1.58.266-ledger-egress-degraded-source-scope","prNumber":3682,"terminal":false,"missionId":"c3721053-a5c6-455c-9c51-01d80fd81713","operation":"execute_mission","proofGate":"canonical_release_reconciliation_pending","sourceSha":"bdaccfcba926c0bfadaefc4a367fba19350c5f63","timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":4233,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":574,"approvedPlanMs":0,"missionSetupMs":763,"providerAuthMs":0,"shipAndProveMs":3110,"ledgerPrepareMs":583,"ledgerReconcileMs":0,"lineageReconcileMs":180,"resolvePreflightMs":763,"repositoryMutationMs":0,"repositoryProviderMs":0,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":583,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"reconcile_release","receiptRef":{"mode":"full","missionId":"c3721053-a5c6-455c-9c51-01d80fd81713"},"performance":null,"deploymentId":"forgejo-main-bdaccfcba926","releaseState":null,"workflowRunId":null,"releaseTargets":{"frontend":false,"onrunner":false,"migrations":true,"ccExecution":false,"supabaseEdge":true,"edgeFunctionSlugs":["tenant-media-library"]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":2723,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-24T23:17:05.579024+00:00","proof_gate":"canonical_release_reconciliation_pending","source_sha":"bdaccfcba926c0bfadaefc4a367fba19350c5f63","external_id":"forgejo-main-bdaccfcba926","receipt_type":"execute_mission","idempotency_key":"mission:c3721053-a5c6-455c-9c51-01d80fd81713:execute_mission:canonical_release_reconciliation_pending:current-generation","mission_step_id":"10f3f76c-1fa1-4c4e-8ca2-16e1fdbf5887","command_center_event_id":"c3721053-a5c6-455c-9c51-01d80fd81713"},{"id":"a2aa74f5-b4c9-4910-b345-fbd08517d37e","source":"cc-execution","status":"waiting","payload":{"body":{"ship":true,"files":[{"path":"supabase/config.toml","content":"project_id = \"ymntrajfubicyxwwdxxa\"\n\n[functions]\n [functions.console-ops]\n # Session and current platform-admin authority are checked inside the function.\n verify_jwt = false\n [functions.qr-suite]\n verify_jwt = false\n [functions.owner-seo-audit]\n # Private Knock Launch OS owner tool. The function validates the bearer and requires the authenticated user to match the fixed personal tenant owner_id before scanning the fixed hostname allowlist.\n verify_jwt = false\n [functions.owner-search-console]\n # Private Knock Launch OS owner Search Console tool. OAuth/data authorization is enforced in-function against the fixed personal tenant owner and fixed web-property allowlist.\n verify_jwt = false\n [functions.activity-timeline]\n verify_jwt = false\n [functions.admin]\n verify_jwt = true\n [functions.admin-create-user]\n verify_jwt = true\n [functions.admin-impersonate]\n verify_jwt = true\n [functions.admin-leads]\n verify_jwt = true\n [functions.admin-operations]\n verify_jwt = true\n [functions.admin-reset-password]\n verify_jwt = false\n [functions.admin-status]\n verify_jwt = true\n [functions.admin-tenant-preview]\n verify_jwt = true\n [functions.admin-tenant-mode-image-upload]\n # Authenticated MODES media mutation. The function validates the Bearer JWT and tenant authority in-function before service-role writes.\n verify_jwt = false\n [functions.aerial-orders]\n verify_jwt = true\n [functions.agreement-sign]\n verify_jwt = false\n [functions.agreements]\n verify_jwt = true\n [functions.analytics-engine]\n verify_jwt = false\n [functions.ai-respond]\n verify_jwt = false\n [functions.auto-unlock-document-scan]\n # Public 321 Auto Unlock document scan. The function rate-limits and only returns confidence-gated intake fields; it performs no database or storage writes.\n verify_jwt = false\n [functions.auto-unlock-intake]\n # Public 321 Auto Unlock intake. Server-validates identity/authority selections, creates an awaiting-signature request, and prepares the existing KnockLaunch e-sign agreement.\n verify_jwt = false\n [functions.whatsmyprogress-waitlist]\n # Public WhatsMyProgress.com launch waitlist. The function enforces allowed origins, validation, rate limits, dedupe, and fixed tenant binding internally.\n verify_jwt = false\n [functions.roof-damage-analysis]\n # Authenticated tenant-user inspection analysis. The function validates the bearer and tenant membership internally before service-role reads or writes.\n verify_jwt = false\n [functions.cc-agent]\n verify_jwt = false\n [functions.cc-tools]\n verify_jwt = false\n [functions.cc-action-logs]\n verify_jwt = false\n [functions.cc-deploy-request]\n verify_jwt = false\n [functions.cc-deploy-controller]\n verify_jwt = false\n [functions.cc-notify-owner]\n verify_jwt = false\n [functions.command-center-autopilot]\n verify_jwt = false\n [functions.apopka-search]\n verify_jwt = false\n [functions.appointments-operations]\n verify_jwt = false\n [functions.audit-fix-leads]\n verify_jwt = true\n [functions.auth-email-hook]\n verify_jwt = false\n [functions.auth-login]\n verify_jwt = false\n [functions.auth-operations]\n verify_jwt = false\n [functions.background-enrich]\n verify_jwt = false\n [functions.batch-document-upload]\n # Authenticated tenant-scoped upload. Function additionally proves active membership/role\n # before using service-role storage/database writes.\n verify_jwt = true\n [functions.batch-photo-commit]\n verify_jwt = false\n [functions.brevard-bass-search]\n verify_jwt = false\n [functions.bulk-enrich-permits]\n verify_jwt = false\n [functions.bulk-geocode]\n verify_jwt = false\n [functions.calls]\n verify_jwt = true\n [functions.calls-manage]\n verify_jwt = false\n [functions.call-session-status]\n verify_jwt = false\n [functions.initiate-call]\n # Authenticated CRM click-to-call. The function also validates the bearer token internally.\n verify_jwt = true\n [functions.canvassing-doors]\n verify_jwt = true\n [functions.cape-canaveral-bsa-search]\n verify_jwt = false\n [functions.check-global-pool]\n verify_jwt = true\n [functions.claim-global-lead]\n verify_jwt = true\n [functions.claim-lead]\n verify_jwt = true\n [functions.clermont-energov-search]\n verify_jwt = false\n [functions.cocoa-beach-opengov-search]\n verify_jwt = false\n [functions.cocoa-citizenserve-search]\n verify_jwt = false\n [functions.communication-hub]\n verify_jwt = false\n [functions.communication-setup-request]\n # Authenticated workspace setup request. The function re-validates the bearer and tenant membership before service-role writes.\n verify_jwt = true\n [functions.compile-leads]\n verify_jwt = false\n [functions.config-manage]\n verify_jwt = true\n [functions.contacts]\n # Contacts validates Supabase user JWTs or exact single-use Capability Layer leases in-function.\n verify_jwt = false\n [functions.calendar-domain]\n # Native Calendar validates Supabase user JWTs or exact single-use Capability Layer leases in-function.\n verify_jwt = false\n [functions.crm-ai]\n verify_jwt = false\n [functions.customer-portal]\n verify_jwt = false\n [functions.shared-claims]\n # Cross-tenant claim collaboration requires an authenticated bearer JWT.\n verify_jwt = true\n [functions.daytona-beach-ims-search]\n verify_jwt = false\n [functions.deland-accela-search]\n verify_jwt = false\n [functions.deltona-citizenserve-search]\n verify_jwt = false\n [functions.dialogue-operations]\n verify_jwt = false\n [functions.dnc-operations]\n verify_jwt = false\n [functions.documents]\n verify_jwt = false\n [functions.document-request-public]\n verify_jwt = false\n [functions.lawn-care-service-request]\n # Public customer intake. The function performs its own validation and only\n # writes through the service-role client after resolving an active tenant.\n verify_jwt = false\n [functions.mobile-vendor-event-request]\n # Public event intake. The function validates required fields and resolves\n # an active mobile-vendor tenant before any service-role write.\n verify_jwt = false\n [functions.entertainment-fanbase]\n # Mixed auth: public fan join is validated in-function; owner/admin cockpit actions\n # authenticate the bearer and prove tenant authority before service-role access.\n verify_jwt = false\n [functions.mobile-vendor-growth]\n # Public club join/unsubscribe are validated in-function; owner loyalty and\n # campaign actions authenticate the bearer and prove tenant authority.\n verify_jwt = false\n [functions.mobile-vendor-loyalty-member]\n # Customer OTP/session actions self-authorize with hashed member sessions;\n # owner review actions authenticate bearer and tenant authority in-function.\n verify_jwt = false\n [functions.mobile-vendor-email-intelligence]\n # Provider-agnostic inbound email ingestion. The function authenticates a\n # provider webhook secret or a tenant bearer token before service-role access.\n verify_jwt = false\n [functions.opportunity-radar]\n # The function performs its own bearer/service authorization and exposes\n # an anonymous /health endpoint for canonical runtime proof.\n verify_jwt = false\n [functions.drive-import]\n verify_jwt = true\n [functions.drive-operations]\n verify_jwt = false\n [functions.drive-sync]\n verify_jwt = true\n [functions.duplicate-management]\n verify_jwt = false\n [functions.edgewater-bsa-search]\n verify_jwt = false\n [functions.emergency-reset]\n verify_jwt = false\n [functions.extract-for-contact]\n verify_jwt = false [functions.field-operations]\n verify_jwt = false\n [functions.fill-pdf-form]\n verify_jwt = true\n [functions.flagler-beach-bsa-search]\n verify_jwt = false\n [functions.followups-operations]\n verify_jwt = false\n [functions.fort-pierce-legacy-arcgis]\n verify_jwt = false\n [functions.gas-proxy]\n verify_jwt = true\n [functions.generate-roof-report]\n verify_jwt = true\n [functions.generate-pa-claim-review]\n # Authenticated PA report generation. The function validates the bearer token,\n # tenant membership, and feature entitlement internally before service-role access.\n verify_jwt = false\n [functions.geocode]\n verify_jwt = false\n [functions.global-unassigned-leads]\n verify_jwt = true\n [functions.health-check]\n verify_jwt = false\n [functions.import-noaa-storms]\n verify_jwt = false\n [functions.ims-search]\n verify_jwt = false\n [functions.indian-river-search]\n verify_jwt = false\n [functions.invoices]\n verify_jwt = true\n [functions.jobs]\n verify_jwt = true\n [functions.kissimmee-accela-search]\n verify_jwt = false\n [functions.lakeland-accela-search]\n verify_jwt = false\n [functions.lead-auto-repair]\n verify_jwt = true\n [functions.lead-bulk-cleanup]\n verify_jwt = true\n [functions.lead-duplicate-detection]\n verify_jwt = true\n [functions.lead-quality-scan]\n verify_jwt = true\n [functions.leads]\n verify_jwt = true\n [functions.leads-add]\n verify_jwt = false\n [functions.leads-claim]\n verify_jwt = false\n [functions.leads-list]\n verify_jwt = false\n [functions.leads-outcome]\n verify_jwt = false\n [functions.leesburg-etrakit-search]\n verify_jwt = false\n [functions.marion-county-energov-search]\n verify_jwt = false\n [functions.mark-document-request-uploaded]\n verify_jwt = false\n [functions.melbourne-energov-search]\n verify_jwt = false\n [functions.new-smyrna-beach-energov-search]\n verify_jwt = false\n [functions.ocala-energov-search]\n verify_jwt = false\n [functions.ormond-beach-energov-search]\n verify_jwt = false\n [functions.palm-coast-energov-search]\n verify_jwt = false\n [functions.parse-hail-intel]\n verify_jwt = false\n [functions.permits-import]\n verify_jwt = false\n [functions.photos]\n verify_jwt = true\n [functions.tenant-photo-studio]\n verify_jwt = false\n [functions.pipeline-automation]\n verify_jwt = false\n [functions.pipelines-manage]\n verify_jwt = true\n [functions.port-orange-smartgov-search]\n verify_jwt = false\n [functions.process-email-queue]\n verify_jwt = true\n [functions.process-lead-batch]\n verify_jwt = true\n [functions.property-discovery]\n verify_jwt = false\n [functions.property-enrichment]\n verify_jwt = false\n [functions.property-lookup]\n verify_jwt = true\n [functions.recent-storms-in-bounds]\n verify_jwt = false\n [functions.release-lead]\n verify_jwt = true\n [functions.repair-unassigned-pool]\n verify_jwt = true\n [functions.rockledge-bsa-search]\n verify_jwt = false\n [functions.roof-ai-detection]\n verify_jwt = false\n [functions.roof-edge-detection]\n verify_jwt = false\n [functions.roof-estimator]\n verify_jwt = false\n [functions.roof-operations]\n verify_jwt = false\n [functions.satellite-beach-bsa-search]\n verify_jwt = false\n [functions.scrape-spc-storms]\n verify_jwt = false\n [functions.security-operations]\n # Mixed public/private security endpoint: anonymous access is restricted in-function to\n # login lockout telemetry; all session, alert, permission, and admin actions authenticate\n # the bearer and enforce self/tenant/platform scope before service-role access.\n verify_jwt = false\n [functions.seminole-parcel-sync]\n verify_jwt = false\n [functions.seminole-search]\n verify_jwt = false\n [functions.send-email]\n verify_jwt = true\n [functions.self-serve-demo]\n # Public demo discovery/capture. Bounds website scanning, rejects private-network targets, and never provisions production tenants or executes outbound automation.\n verify_jwt = false\n [functions.submit-demo-request]\n # Public intake validates and rate-limits input in-function; all privileged writes use the service role server-side.\n verify_jwt = false\n [functions.zoho-mail]\n # OAuth callback is public; all tenant actions authenticate the bearer and tenant authority inside the function.\n verify_jwt = false\n [functions.capability-router]\n # Capability Router authenticates Supabase user JWTs and verified cc-execution bearers in-function so delegated execution can reach its lease gate.\n verify_jwt = false\n [functions.application-api]\n # Application API supports public catalog/customer-token reads plus tenant-user and delegated Command Center execution; authorization is enforced in-function.\n verify_jwt = false\n [functions.mail360]\n # Legacy function retained only for rollback history; active tenant email uses zoho-mail.\n verify_jwt = true\n [functions.pcg-commerce-webhook]\n # PCG commerce provider callbacks authenticate with a dedicated high-entropy channel secret in-function.\n verify_jwt = false\n [functions.mail360-webhook]\n # Mail360 provider callbacks authenticate with the dedicated high-entropy webhook secret in-function.\n verify_jwt = false\n [functions.send-invitation]\n verify_jwt = false\n [functions.accept-invitation]\n # Public inspection is token-scoped; acceptance validates the bearer JWT inside the function.\n verify_jwt = false\n [functions.send-sms]\n verify_jwt = true\n [functions.sequence-executor]\n verify_jwt = false\n [functions.signup-manage]\n verify_jwt = false\n [functions.sms-webhook]\n verify_jwt = false\n [functions.st-augustine-energov-search]\n verify_jwt = false\n [functions.st-cloud-etrakit-search]\n verify_jwt = false\n [functions.st-johns-county-energov-search]\n verify_jwt = false\n [functions.storm-data-proxy]\n verify_jwt = false\n [functions.storm-lookup]\n verify_jwt = false\n [functions.tenant-context]\n # Authenticated tenant-context lookup; live runtime already enforces gateway JWT.\n verify_jwt = true\n [functions.tenant-manage]\n verify_jwt = true\n [functions.tenant-search]\n verify_jwt = false\n [functions.territory-tools]\n verify_jwt = true\n [functions.titusville-bsa-search]\n verify_jwt = false\n [functions.unified-enrich]\n verify_jwt = false\n [functions.universal-extractor]\n verify_jwt = false\n [functions.user-roles-manage]\n verify_jwt = true\n [functions.user-whoami]\n verify_jwt = true\n [functions.verify-admin]\n verify_jwt = false\n [functions.view-config-manage]\n verify_jwt = true\n [functions.web-search-storms]\n verify_jwt = false\n [functions.west-melbourne-bsa-search] verify_jwt = false\n [functions.winter-haven-energov-search]\n verify_jwt = false\n [functions.workflows]\n verify_jwt = true\n [functions.workflows-manage]\n verify_jwt = true\n [functions.workspace-operations]\n verify_jwt = false\n [functions.send-transactional-email]\n verify_jwt = true\n [functions.preview-transactional-email]\n verify_jwt = false\n [functions.handle-email-unsubscribe]\n verify_jwt = false\n [functions.handle-email-suppression]\n verify_jwt = false\n [functions.academy-roleplay]\n verify_jwt = true\n [functions.academy-sync-from-workflow]\n verify_jwt = true\n [functions.create-checkout]\n verify_jwt = false\n [functions.get-stripe-price]\n verify_jwt = false\n [functions.payments-webhook]\n verify_jwt = false\n [functions.finance-reports]\n # Mixed auth: owner/admin actions validate the Supabase bearer in-function;\n # scheduled dispatch validates the existing cc-execution machine bearer.\n verify_jwt = false\n [functions.finance-square]\n # Square OAuth callback and payment webhook are public provider callbacks;\n # owner actions authenticate the bearer and tenant authority inside the function.\n verify_jwt = false\n [functions.tenant-provider-connections]\n # OAuth callbacks are public provider redirects; every tenant action validates\n # the bearer and tenant owner/platform-admin authority inside the function.\n verify_jwt = false\n\n [functions.integrations-health]\n verify_jwt = false\n [functions.provision-trial-user]\n # Legacy one-shot provisioning is restricted to signed-in platform admins.\n verify_jwt = true\n [functions.get-shared-storm-report]\n verify_jwt = false\n [functions.send-storm-report]\n verify_jwt = true\n [functions.twilio-amd-webhook]\n verify_jwt = false\n [functions.twilio-voice-webhook]\n verify_jwt = false\n [functions.twilio-recording-webhook]\n verify_jwt = false\n [functions.twilio-voicemail-webhook]\n verify_jwt = false\n [functions.twilio-sms-inbound-webhook]\n verify_jwt = false\n [functions.twilio-transcription-webhook]\n verify_jwt = false\n [functions.twilio-media-stream]\n verify_jwt = false\n [functions.compliance-daily-audit]\n verify_jwt = false\n [functions.twiml-bridge-confirm]\n verify_jwt = false\n [functions.twiml-transfer-target]\n verify_jwt = false\n [functions.twilio-transfer]\n verify_jwt = true\n [functions.twilio-transfer-complete]\n verify_jwt = true\n [functions.twiml-supervise]\n verify_jwt = false\n [functions.twilio-supervise]\n verify_jwt = true\n [functions.twiml-inbound-router]\n verify_jwt = false\n [functions.twiml-inbound-router-fallback]\n verify_jwt = false\n [functions.twiml-ivr-handle]\n verify_jwt = false\n [functions.twiml-ring-group]\n verify_jwt = false\n [functions.queue-callback-dispatch]\n verify_jwt = true\n [functions.twiml-voicemail-box]\n verify_jwt = false\n [functions.voicemail-recording-callback]\n verify_jwt = false\n [functions.analyze-voicemail]\n verify_jwt = false\n [functions.analyze-call-recording]\n verify_jwt = false\n [functions.twilio-browser-token]\n verify_jwt = true\n [functions.twiml-browser-dial]\n verify_jwt = false\n [functions.pa-lor-webhook]\n verify_jwt = false\n [functions.canvassing-visits]\n # The function validates the caller JWT itself, then enforces tenant membership\n # before any service-role write. Keep gateway verification disabled so the\n # runtime contract matches the canonical registry entry.\n verify_jwt = false\n [functions.experience-studio-publish-tenant] # Health/OpenAPI stay public for runtime proof; publish validates the platform-admin bearer token inside the function.\n verify_jwt = false\n [functions.experience-preview-session]\n # Issue requests validate the owner JWT explicitly; validation requests use the opaque short-lived token.\n verify_jwt = false\n [functions.pa-manage]\n # The function validates the caller JWT explicitly, then uses that token for tenant RLS.\n verify_jwt = false\n [functions.portal-auth]\n # Customer validation uses a hashed, expiring portal token; link administration validates the owner JWT explicitly.\n verify_jwt = false\n [functions.tenant-media-library]\n # Authenticated mutations validate caller JWTs inside the function; published and HMAC-signed asset GET/HEAD URLs must remain directly streamable for browser media previews.\n verify_jwt = false\n [functions.tenant-storage-migration-v1]\n # One-time machine cleanup. Gateway JWT is disabled; a database-generated, RLS-hidden nonce is required for every mutation and is rotated after completion.\n verify_jwt = false\n [functions.system-backup]\n # Machine-only backup orchestrator. Gateway JWT checks are disabled so pg_cron/pg_net can invoke it; the function validates a high-entropy Vault-backed trigger token before any privileged work.\n verify_jwt = false\n [functions.visual-witness-container-bootstrap]\n # Machine-only bootstrap broker. It validates the cc-execution bearer by callback against cc-execution, binds the request to the exact deployed source SHA, and returns only AES-GCM ciphertext.\n verify_jwt = false\n [functions.mail-continuity]\n # Custom auth: owner/admin actions validate caller JWTs inside the function; machine health ticks use a Vault-backed token; service-to-service launch reconciliation uses the service-role bearer.\n verify_jwt = false\n [functions.owner-storage-backup]\n # Machine-only read-only Storage exporter. Gateway JWT checks are disabled so authorized MSI clients can reach the function; protected actions are authenticated inside the function with timestamped RSA-SHA256 machine signatures.\n verify_jwt = false\n"},{"path":"supabase/functions/owner-storage-backup/index.ts","content":"import { createClient } from 'https://esm.sh/@supabase/supabase-js@2.80.0';\n\nexport const BACKUP_CONTRACT = 'KNOCKLAUNCH_OWNER_STORAGE_BACKUP_V1';\nexport const SIGNED_URL_TTL_SECONDS = 600;\nexport const MAX_SIGN_BATCH = 100;\nexport const MAX_TIMESTAMP_SKEW_SECONDS = 120;\nexport const MAX_LIST_DEPTH = 32;\nexport const MAX_LIST_OBJECTS = 100_000;\n\nconst SUPABASE_URL = Deno.env.get('SUPABASE_URL') ?? '';\nconst SERVICE_ROLE = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') ?? '';\n\nconst TRUSTED_PUBLIC_KEYS: Record = {\n 'DESKTOP-TO28G8T': `-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApWVZZVIW4Arohn8EBoox\nZndzrqgjvKTbRlpYLIha88lnxCqiEE1wRMsUj/UOFunYV3tLPBNVCXXQhPibstJG\nC9toaqQkd3js9XWCHKJbBHmhp5y6MKeOXiIO3o4HmZXXDvVtmARSev6FJtFLigw8\nv00kd6XuBgQ47854L93NtJoGO8sXVNVaDd58c/NbOrhD0zIcpNTD54uNAXNEUTh8\nxZfLl9z7DUAk08Wt41VcIafqLuldbhBDjjN0tM4OAwTMHJSXCamDHbhVFy2sy4s6\n8UJiVwpSSfoF5cetzTjpJ7UG0VLPfaNMAAUtBOa6lzriN4QUi8LCCel4Eim7JZtE\n3QIDAQAB\n-----END PUBLIC KEY-----`,\n 'MSI-LAPTOP': `-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7JZhCIxngm1SSiS9iydB\nfNiS0nrOwnZb4n7GnRv27iNbVOENOaEv1KeZYI55K6VVvd6Qq7fq8ZoARxwu04YD\n5SLScz8icxjhVhDWixwCsy59xD8JREnbAZOqY8wyaRHNht8OWXvhT5y2Z793nAdw\nwoazi5exyb7I3ZPbRQkeVxrtK8pCUV0/+68YEEcMbatH1fhnkbEvJtefj9QrGRnk\n4o+qp2ipGv7Rj+79lyEhd67gslMcvWgO1YX+TNoFNvFzmLJ4Sv7QlpXfTTbE3rUo\n1q6V/IHUDgfRY7D9gYhHGe19oXyEEzhOufZxX1GuUcd6Iy5IhTXiMBHWbe4IAEpQ\nJQIDAQAB\n-----END PUBLIC KEY-----`,\n};\n\nconst admin = createClient(SUPABASE_URL, SERVICE_ROLE, {\n auth: { persistSession: false, autoRefreshToken: false },\n});\n\nconst encoder = new TextEncoder();\nconst cors = {\n 'Access-Control-Allow-Origin': '*',\n 'Access-Control-Allow-Headers': 'content-type,x-kl-backup-machine,x-kl-backup-timestamp,x-kl-backup-nonce,x-kl-backup-signature',\n 'Access-Control-Allow-Methods': 'GET,POST,OPTIONS',\n};\n\nconst json = (body: unknown, status = 200) => new Response(JSON.stringify(body), {\n status,\n headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store' },\n});\n\nfunction base64ToBytes(value: string) {\n const raw = atob(value);\n return Uint8Array.from(raw, (char) => char.charCodeAt(0));\n}\n\nfunction pemToDer(pem: string) {\n return base64ToBytes(pem.replace(/-----BEGIN PUBLIC KEY-----|-----END PUBLIC KEY-----|\\s+/g, ''));\n}\n\nexport async function sha256HexBytes(bytes: Uint8Array) {\n const digest = await crypto.subtle.digest('SHA-256', bytes);\n return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nasync function importPublicKey(pem: string) {\n return crypto.subtle.importKey(\n 'spki',\n pemToDer(pem),\n { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n false,\n ['verify'],\n );\n}\n\nexport function canonicalSignedRequest(method: string, pathname: string, timestamp: string, nonce: string, bodyHash: string) {\n return [method.toUpperCase(), pathname, timestamp, nonce, bodyHash.toLowerCase()].join('\\n');\n}\n\nexport async function verifyBackupRequest(req: Request, rawBody: Uint8Array, nowEpochSeconds = Math.floor(Date.now() / 1000)) {\n const machine = String(req.headers.get('x-kl-backup-machine') || '').trim();\n const timestampRaw = String(req.headers.get('x-kl-backup-timestamp') || '').trim();\n const nonce = String(req.headers.get('x-kl-backup-nonce') || '').trim();\n const signatureRaw = String(req.headers.get('x-kl-backup-signature') || '').trim();\n const publicKeyPem = TRUSTED_PUBLIC_KEYS[machine];\n if (!publicKeyPem) return { ok: false as const, error: 'backup_machine_unknown' };\n if (!/^\\d{10,}$/.test(timestampRaw) || !/^[A-Za-z0-9._:-]{8,200}$/.test(nonce) || !signatureRaw) {\n return { ok: false as const, error: 'backup_signature_headers_invalid' };\n }\n const timestamp = Number(timestampRaw);\n if (!Number.isSafeInteger(timestamp) || Math.abs(nowEpochSeconds - timestamp) > MAX_TIMESTAMP_SKEW_SECONDS) {\n return { ok: false as const, error: 'backup_signature_stale' };\n }\n let signature: Uint8Array;\n try {\n signature = base64ToBytes(signatureRaw);\n } catch {\n return { ok: false as const, error: 'backup_signature_invalid' };\n }\n const bodyHash = await sha256HexBytes(rawBody);\n const canonical = canonicalSignedRequest(req.method, '/owner-storage-backup', timestampRaw, nonce, bodyHash);\n try {\n const key = await importPublicKey(publicKeyPem);\n const valid = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, signature, encoder.encode(canonical));\n return valid ? { ok: true as const, machine, bodyHash } : { ok: false as const, error: 'backup_signature_invalid' };\n } catch {\n return { ok: false as const, error: 'backup_signature_invalid' };\n }\n}\n\nfunction safeText(value: unknown, max = 4096) {\n return String(value ?? '').trim().slice(0, max);\n}\n\nfunction safeMetadata(value: unknown) {\n const metadata = value && typeof value === 'object' && !Array.isArray(value) ? value as Record : {};\n return {\n size: Number(metadata.size ?? 0) || 0,\n mimetype: safeText(metadata.mimetype ?? metadata.contentType, 240) || null,\n cacheControl: safeText(metadata.cacheControl, 240) || null,\n eTag: safeText(metadata.eTag ?? metadata.etag, 240) || null,\n lastModified: safeText(metadata.lastModified, 240) || null,\n };\n}\n\nexport async function listBucketObjects(storage: any, bucket: string) {\n const output: Array> = [];\n const visited = new Set();\n\n async function visit(prefix: string, depth: number) {\n if (depth > MAX_LIST_DEPTH) throw new Error('backup_storage_depth_exceeded');\n if (visited.has(prefix)) return;\n visited.add(prefix);\n let offset = 0;\n while (true) {\n const { data, error } = await storage.from(bucket).list(prefix, {\n limit: 1000,\n offset,\n sortBy: { column: 'name', order: 'asc' },\n });\n if (error) throw error;\n const rows = Array.isArray(data) ? data : [];\n for (const item of rows) {\n const name = safeText(item?.name);\n if (!name || name === '.emptyFolderPlaceholder') continue;\n const path = prefix ? `${prefix}/${name}` : name;\n const isFile = Boolean(item?.id) || Boolean(item?.metadata);\n if (isFile) {\n const metadata = safeMetadata(item?.metadata);\n const updatedAt = safeText(item?.updated_at, 80) || null;\n const createdAt = safeText(item?.created_at, 80) || null;\n const id = safeText(item?.id, 180) || null;\n const sourceFingerprint = [id || '', updatedAt || '', metadata.size, metadata.eTag || '', metadata.lastModified || ''].join('|');\n output.push({ bucket, path, id, createdAt, updatedAt, metadata, sourceFingerprint });\n if (output.length > MAX_LIST_OBJECTS) throw new Error('backup_storage_object_limit_exceeded');\n } else {\n await visit(path, depth + 1);\n }\n }\n if (rows.length < 1000) break;\n offset += rows.length;\n }\n }\n\n await visit('', 0);\n return output;\n}\n\nexport async function dispatchBackupAction(client: any, body: any) {\n const action = safeText(body?.action, 80);\n if (action === 'list_buckets') {\n const { data, error } = await client.storage.listBuckets();\n if (error) throw error;\n const buckets = (data || []).map((bucket: any) => ({\n id: safeText(bucket?.id, 240),\n name: safeText(bucket?.name, 240),\n public: Boolean(bucket?.public),\n createdAt: safeText(bucket?.created_at, 80) || null,\n updatedAt: safeText(bucket?.updated_at, 80) || null,\n fileSizeLimit: bucket?.file_size_limit ?? null,\n }));\n return { ok: true, contract: BACKUP_CONTRACT, buckets };\n }\n if (action === 'list_objects') {\n const bucket = safeText(body?.bucket, 240);\n if (!bucket) return { ok: false, error: 'bucket_required', status: 400 };\n const objects = await listBucketObjects(client.storage, bucket);\n return { ok: true, contract: BACKUP_CONTRACT, bucket, count: objects.length, objects };\n }\n if (action === 'sign_batch') {\n const bucket = safeText(body?.bucket, 240);\n const paths = Array.isArray(body?.paths) ? body.paths.map((value: unknown) => safeText(value)).filter(Boolean) : [];\n if (!bucket) return { ok: false, error: 'bucket_required', status: 400 };\n if (!paths.length || paths.length > MAX_SIGN_BATCH) return { ok: false, error: 'paths_batch_invalid', max: MAX_SIGN_BATCH, status: 400 };\n const { data, error } = await client.storage.from(bucket).createSignedUrls(paths, SIGNED_URL_TTL_SECONDS);\n if (error) throw error;\n const signed = (data || []).map((row: any, index: number) => ({\n path: safeText(row?.path || paths[index]),\n signedUrl: safeText(row?.signedUrl, 8192) || null,\n error: safeText(row?.error, 1000) || null,\n }));\n return { ok: true, contract: BACKUP_CONTRACT, bucket, expiresIn: SIGNED_URL_TTL_SECONDS, signed }; }\n return { ok: false, error: 'unknown_action', status: 400 };\n}\n\nexport async function handleBackupRequest(req: Request, client = admin) {\n if (req.method === 'OPTIONS') return new Response('ok', { headers: cors });\n const url = new URL(req.url);\n if (req.method === 'GET' && url.searchParams.get('mode') === 'health') {\n return json({\n ok: true,\n service: 'owner-storage-backup',\n contract: BACKUP_CONTRACT,\n readOnly: true,\n maxSignBatch: MAX_SIGN_BATCH,\n signedUrlTtlSeconds: SIGNED_URL_TTL_SECONDS,\n authentication: 'machine-rsa-sha256',\n });\n }\n if (req.method !== 'POST') return json({ ok: false, error: 'method_not_allowed' }, 405);\n const rawBody = new Uint8Array(await req.arrayBuffer());\n const verified = await verifyBackupRequest(req, rawBody);\n if (!verified.ok) return json({ ok: false, error: verified.error }, 401);\n let body: any;\n try {\n body = JSON.parse(new TextDecoder().decode(rawBody));\n } catch {\n return json({ ok: false, error: 'invalid_json' }, 400);\n }\n const result = await dispatchBackupAction(client, body);\n const status = Number((result as any)?.status || 200);\n if ('status' in result) delete (result as any).status;\n return json(result, status);\n}\n\nif (import.meta.main) {\n Deno.serve(async (req) => {\n try {\n return await handleBackupRequest(req);\n } catch (error) {\n console.error('[owner-storage-backup]', error instanceof Error ? error.message : String(error));\n return json({ ok: false, error: 'backup_internal_error' }, 500);\n }\n });\n}\n"},{"path":"supabase/functions/owner-storage-backup/index.test.ts","content":"import { assertEquals, assertRejects } from 'https://deno.land/std@0.224.0/assert/mod.ts';\nimport { canonicalSignedRequest, dispatchBackupAction, listBucketObjects, MAX_SIGN_BATCH } from './index.ts';\n\nDeno.test('canonical request binds method path timestamp nonce and body hash', () => {\n assertEquals(canonicalSignedRequest('post', '/owner-storage-backup', '10', 'abc12345', 'AABB'), 'POST\\n/owner-storage-backup\\n10\\nabc12345\\naabb');\n});\n\nDeno.test('listBucketObjects paginates and recurses without mutation calls', async () => {\n const calls: any[] = [];\n const storage = {\n from(bucket: string) {\n return {\n async list(prefix: string, options: any) {\n calls.push({ bucket, prefix, offset: options.offset });\n if (prefix === '' && options.offset === 0) return { data: [{ name: 'folder', id: null, metadata: null }, { name: 'root.txt', id: '1', updated_at: '2026-01-01', metadata: { size: 2 } }], error: null };\n if (prefix === 'folder' && options.offset === 0) return { data: [{ name: 'a.txt', id: '2', updated_at: '2026-01-02', metadata: { size: 3 } }], error: null };\n return { data: [], error: null };\n },\n };\n },\n };\n const rows = await listBucketObjects(storage, 'private');\n assertEquals(rows.map((row: any) => row.path).sort(), ['folder/a.txt', 'root.txt']);\n assertEquals(calls.some((call) => call.prefix === 'folder'), true);\n});\n\nDeno.test('sign_batch enforces max batch and performs only createSignedUrls', async () => {\n let signedCalls = 0;\n const client = {\n storage: {\n from() {\n return {\n async createSignedUrls(paths: string[], ttl: number) {\n signedCalls += 1;\n return { data: paths.map((path) => ({ path, signedUrl: `https://example.test/${path}` })), error: null, ttl };\n },\n };\n },\n },\n };\n const tooMany = await dispatchBackupAction(client, { action: 'sign_batch', bucket: 'x', paths: Array(MAX_SIGN_BATCH + 1).fill('a') });\n assertEquals((tooMany as any).error, 'paths_batch_invalid');\n assertEquals(signedCalls, 0);\n const ok = await dispatchBackupAction(client, { action: 'sign_batch', bucket: 'x', paths: ['a'] });\n assertEquals(ok.ok, true);\n assertEquals(signedCalls, 1);\n});\n\nDeno.test('list errors fail closed', async () => {\n const storage = { from: () => ({ list: async () => ({ data: null, error: new Error('nope') }) }) };\n await assertRejects(() => listBucketObjects(storage, 'x'), Error, 'nope');\n});\n"},{"path":"scripts/backup/backup-supabase-storage.ps1","content":"param(\n [string]$ProjectRef='ymntrajfubicyxwwdxxa',\n [string]$MachineName=$env:COMPUTERNAME,\n [string]$PrivateKeyPath,\n [string]$LocalRoot='C:\\KNOCKLAUNCH_Backups',\n [string]$DriveVault='G:\\My Drive\\KNOCKLAUNCH BACKUPS',\n [string]$OpenSsl='C:\\Program Files\\Git\\usr\\bin\\openssl.exe'\n)\n$ErrorActionPreference='Stop'\n[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12\nif(!$MachineName){throw 'MachineName is required'}\nif(!$PrivateKeyPath){$PrivateKeyPath=Join-Path $LocalRoot 'Keys\\supabase-storage-backup-private.pem'}\nforeach($p in @($PrivateKeyPath,$OpenSsl,$DriveVault)){if(!(Test-Path $p)){throw \"Required path missing: $p\"}}\n$endpoint=\"https://$ProjectRef.supabase.co/functions/v1/owner-storage-backup\"\n$root=Join-Path $LocalRoot 'SupabaseStorage'\n$objRoot=Join-Path $root 'objects'\n$catRoot=Join-Path $root 'catalogs'\n$driveRoot=Join-Path $DriveVault 'Supabase Storage - Daily'\n$driveObj=Join-Path $driveRoot 'objects'\n$driveCat=Join-Path $driveRoot 'catalogs'\nNew-Item -ItemType Directory -Force -Path $objRoot,$catRoot,$driveObj,$driveCat|Out-Null\nfunction ShaBytes([byte[]]$b){$s=New-Object Security.Cryptography.SHA256Managed;try{return ([BitConverter]::ToString($s.ComputeHash($b))).Replace('-','').ToLowerInvariant()}finally{$s.Dispose()}}\nfunction ShaFile([string]$p){(Get-FileHash $p -Algorithm SHA256).Hash.ToLowerInvariant()}\nfunction Cas([string]$base,[string]$hash){$d=Join-Path $base $hash.Substring(0,2);New-Item -ItemType Directory -Force -Path $d|Out-Null;Join-Path $d $hash}\nfunction Api([hashtable]$payload){\n $body=$payload|ConvertTo-Json -Depth 8 -Compress\n $bytes=[Text.Encoding]::UTF8.GetBytes($body)\n $ts=[DateTimeOffset]::UtcNow.ToUnixTimeSeconds().ToString()\n $nonce=[Guid]::NewGuid().ToString('N')\n $canonical='POST'+[char]10+'/owner-storage-backup'+[char]10+$ts+[char]10+$nonce+[char]10+(ShaBytes $bytes)\n $base=Join-Path $env:TEMP ('kl-sign-'+[Guid]::NewGuid().ToString('N'))\n $txt=$base+'.txt';$sig=$base+'.sig'\n try{\n [IO.File]::WriteAllText($txt,$canonical,(New-Object Text.UTF8Encoding($false)))\n & $OpenSsl dgst -sha256 -sign $PrivateKeyPath -out $sig $txt 2>$null\n if($LASTEXITCODE -ne 0){throw 'Request signing failed'}\n $headers=@{\n 'x-kl-backup-machine'=$MachineName\n 'x-kl-backup-timestamp'=$ts\n 'x-kl-backup-nonce'=$nonce\n 'x-kl-backup-signature'=[Convert]::ToBase64String([IO.File]::ReadAllBytes($sig))\n }\n $r=Invoke-WebRequest -UseBasicParsing -Uri $endpoint -Method Post -Headers $headers -ContentType 'application/json' -Body $bytes -TimeoutSec 180\n $r.Content|ConvertFrom-Json\n }finally{Remove-Item $txt,$sig -Force -ErrorAction SilentlyContinue}\n}\n$prior=@{}\n$prev=Get-ChildItem $catRoot -Filter 'storage-catalog-*.json' -File -ErrorAction SilentlyContinue|Sort-Object LastWriteTime -Descending|Select-Object -First 1\nif($prev){try{(Get-Content $prev.FullName -Raw|ConvertFrom-Json).entries|ForEach-Object{$prior[($_.bucket+[char]10+$_.path)]=$_}}catch{}}\n$b=Api @{action='list_buckets'};if(!$b.ok){throw 'Bucket listing failed'}\n$entries=New-Object Collections.ArrayList;$remote=[int64]0;$downloaded=[int64]0;$downloadCount=0;$reused=0\nforeach($bucket in @($b.buckets)){\n $name=[string]$bucket.name;if(!$name){continue}\n $l=Api @{action='list_objects';bucket=$name};if(!$l.ok){throw \"Object listing failed: $name\"}\n $objects=@($l.objects)\n for($i=0;$i -lt $objects.Count;$i+=100){\n $last=[Math]::Min($i+99,$objects.Count-1);$batch=@($objects[$i..$last]);$need=New-Object Collections.ArrayList\n foreach($o in $batch){\n $size=[int64]$o.metadata.size;$remote+=$size;$key=$name+[char]10+[string]$o.path;$old=$prior[$key]\n if($old -and [string]$old.sourceFingerprint -eq [string]$o.sourceFingerprint -and $old.sha256){\n $lp=Cas $objRoot ([string]$old.sha256);$dp=Cas $driveObj ([string]$old.sha256)\n if(Test-Path $lp){\n if(!(Test-Path $dp)){Copy-Item $lp $dp -Force}\n if((ShaFile $dp) -ne [string]$old.sha256){throw 'Drive hash mismatch on reused object'}\n [void]$entries.Add([ordered]@{bucket=$name;path=[string]$o.path;sourceFingerprint=[string]$o.sourceFingerprint;size=$size;mime=[string]$o.metadata.mimetype;sha256=[string]$old.sha256;objectRelativePath=('objects/'+([string]$old.sha256).Substring(0,2)+'/'+[string]$old.sha256);updatedAt=[string]$o.updatedAt});$reused++;continue\n }\n }\n [void]$need.Add($o)\n }\n if(!$need.Count){continue}\n $signed=Api @{action='sign_batch';bucket=$name;paths=@($need|ForEach-Object{[string]$_.path})};if(!$signed.ok){throw \"Signing failed: $name\"}\n $map=@{};@($signed.signed)|ForEach-Object{$map[[string]$_.path]=$_}\n foreach($o in @($need)){\n $p=[string]$o.path;$s=$map[$p];if(!$s.signedUrl){throw \"No signed URL: $name/$p\"}\n $tmp=Join-Path $env:TEMP ('kl-storage-'+[Guid]::NewGuid().ToString('N'))\n try{\n Invoke-WebRequest -UseBasicParsing -Uri ([string]$s.signedUrl) -OutFile $tmp -TimeoutSec 300\n $hash=ShaFile $tmp;$lp=Cas $objRoot $hash;$dp=Cas $driveObj $hash\n if(!(Test-Path $lp)){Move-Item $tmp $lp -Force}else{Remove-Item $tmp -Force}\n if(!(Test-Path $dp)){Copy-Item $lp $dp -Force}\n if((ShaFile $dp) -ne $hash){throw \"Drive hash mismatch: $name/$p\"}\n $size=[int64](Get-Item $lp).Length;$downloaded+=$size;$downloadCount++\n [void]$entries.Add([ordered]@{bucket=$name;path=$p;sourceFingerprint=[string]$o.sourceFingerprint;size=$size;mime=[string]$o.metadata.mimetype;sha256=$hash;objectRelativePath=('objects/'+$hash.Substring(0,2)+'/'+$hash);updatedAt=[string]$o.updatedAt})\n }finally{Remove-Item $tmp -Force -ErrorAction SilentlyContinue}\n }\n }\n}\n$stamp=(Get-Date).ToUniversalTime().ToString('yyyyMMdd-HHmmssZ')\n$catalog=[ordered]@{schema='knocklaunch.storage-backup.v1';contract='KNOCKLAUNCH_OWNER_STORAGE_BACKUP_V1';capturedAt=(Get-Date).ToUniversalTime().ToString('o');projectRef=$ProjectRef;machine=$MachineName;bucketCount=@($b.buckets).Count;objectCount=$entries.Count;totalSourceBytes=$remote;downloadedObjects=$downloadCount;downloadedBytes=$downloaded;reusedObjects=$reused;contentAddressed=$true;entries=@($entries|Sort-Object bucket,path)}\n$cat=Join-Path $catRoot (\"storage-catalog-$stamp.json\");[IO.File]::WriteAllText($cat,($catalog|ConvertTo-Json -Depth 12),(New-Object Text.UTF8Encoding($false)))\n$ch=ShaFile $cat;$driveCatFile=Join-Path $driveCat (Split-Path $cat -Leaf);Copy-Item $cat $driveCatFile -Force;if((ShaFile $driveCatFile)-ne $ch){throw 'Drive catalog hash mismatch'}\n$receipt=[ordered]@{ok=$true;capturedAt=$catalog.capturedAt;projectRef=$ProjectRef;machine=$MachineName;bucketCount=$catalog.bucketCount;objectCount=$catalog.objectCount;totalSourceBytes=$remote;downloadedObjects=$downloadCount;downloadedBytes=$downloaded;reusedObjects=$reused;catalog=$cat;catalogSha256=$ch;googleDriveCatalog=$driveCatFile;googleDriveVerified=$true}\n[IO.File]::WriteAllText((Join-Path $root (\"storage-backup-receipt-$stamp.json\")),($receipt|ConvertTo-Json -Depth 6),(New-Object Text.UTF8Encoding($false)))\n$receipt|ConvertTo-Json -Compress"},{"path":"scripts/backup/README.md","content":"# KNOCKLAUNCH Disaster Recovery V1\n\nThis directory owns the portable backup and restore-verification tooling for KNOCKLAUNCH.\n\n## Recovery layers\n- Forgejo: full Git bundles are copied to Google Drive.\n- PAUL: durable knowledge/config archives are checksumed and copied to Drive; search indexes remain rebuildable.\n- Supabase database: the Pro project has automatic daily database backups. Those backups do not contain Storage object payloads.\n- Supabase Storage: owner-storage-backup is a read-only Edge Function. Authorized MSI machines sign requests with local RSA private keys; the function stores only public keys and returns short-lived signed download URLs.\n- MSI replicas: desktop is the primary Storage puller. Laptop copies the Drive-backed corpus rather than duplicating Supabase egress.\n\n## Security\nNo bucket is made public. No service-role key is written to Windows, Drive, the repository, catalogs, receipts, or logs. Protected requests use RSA PKCS#1 v1.5 SHA-256 over:\nMETHOD + LF + pathname + LF + timestamp + LF + nonce + LF + sha256(raw request body)\nTimestamp skew is bounded. Supabase internally rewrites the public function URL before the Edge Function sees it, so clients sign the canonical internal pathname `/owner-storage-backup`.\n\n## Storage backup\nRun backup-supabase-storage.ps1 with the machine-local private key. First run downloads all objects. Later runs compare immutable source fingerprints and download only changed/missing objects. Payloads are stored content-addressed by SHA-256 locally and in Google Drive. Catalogs contain path mapping and hashes, never credentials or signed URLs.\n\n## Restore drill\nverify-restore.ps1 never mutates production. It verifies and temp-clones the latest Git bundle, verifies the PAUL archive, hashes every Storage object locally and in Drive, verifies Drive copies, and writes a restore-drill receipt.\n\n## Retention\nbackup-retention.ps1 keeps hourly journals 72 hours, ordinary daily artifacts 30 days, one weekly Storage catalog for 12 weeks, one monthly catalog for 12 months, and never automatically deletes golden/major-release/restore-point artifacts. Content-addressed objects are removed only after all retained catalogs are evaluated and the object is unreferenced past a grace period.\n\n## Disaster manifest\nwrite-disaster-manifest.ps1 produces KNOCKLAUNCH-RESTORE-MANIFEST.json linking repository, PAUL, Storage and database coverage with no secrets.\n\n## Recovery order\n1. Choose a restore manifest with a passing restore-drill receipt.\n2. Restore repository source from the verified Git bundle if Forgejo is unavailable.\n3. Restore/rebuild PAUL from its verified archive/journal.\n4. Restore the database through the owner-approved Supabase recovery path if needed.\n5. Restore Storage objects from the content-addressed corpus using the catalog path map.\n6. Recreate provider/infrastructure configuration from canonical manifests.\n7. Verify tenant isolation, runtime identities and claim-matched production behavior."}],"branch":"ai/objective-first-repair-70c455ff70bd","writes":[],"patches":[],"version":1,"approved":true,"missionId":"70c455ff-70bd-43aa-bb5b-d8ac0f34af9b","objective":"Complete the existing Disaster Recovery RSA-auth correction using the live proof: register owner-storage-backup with verify_jwt=false and canonicalize signed requests to Supabase's actual internal pathname /owner-storage-backup. Update only the Edge Function, its test, the Windows Storage backup client, README, and supabase/config.toml. Preserve read-only behavior, bucket privacy, machine RSA keys, and no-new-spend constraint.","repository":"noel/KnockLaunchOS","ownerApproved":true,"releaseIntent":null,"sourceTargets":["supabase/config.toml","supabase/functions/owner-storage-backup/index.ts","supabase/functions/owner-storage-backup/index.test.ts","scripts/backup/backup-supabase-storage.ps1","scripts/backup/README.md"],"implementation":{"files":[],"writes":[]},"requestContract":null,"repairGeneration":null,"executionEnvelope":{"ship":true,"version":1,"approved":true,"missionId":"70c455ff-70bd-43aa-bb5b-d8ac0f34af9b","ownerApproved":true,"releaseIntent":null,"sourceTargets":["supabase/config.toml","supabase/functions/owner-storage-backup/index.ts","supabase/functions/owner-storage-backup/index.test.ts","scripts/backup/backup-supabase-storage.ps1","scripts/backup/README.md"],"requestContract":null,"repairGeneration":null,"proofRequirements":null,"controlPlaneUnfreeze":false,"controlPlaneMaintenance":false,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":null},"proofRequirements":null,"controlPlaneUnfreeze":false,"durableMutationResume":true,"controlPlaneMaintenance":false,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":null},"recovery":false,"fingerprint":"dcf9bcd79644c830c35e1f15978c0d545bebe565cde5e2f6f6b33188d230a1eb","replayCount":0,"serializedBytes":46268},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-28T03:29:49.691354+00:00","proof_gate":"repository_mutation_intent_persisted","source_sha":null,"external_id":null,"receipt_type":"repository_mutation_intent","idempotency_key":"mission:70c455ff-70bd-43aa-bb5b-d8ac0f34af9b:repository-mutation-intent:dcf9bcd79644c830c35e1f15978c0d545bebe565cde5e2f6f6b33188d230a1eb:0","mission_step_id":"4ee48e18-5f99-44f8-9f5a-4353a0b0e18a","command_center_event_id":"70c455ff-70bd-43aa-bb5b-d8ac0f34af9b"},{"id":"997aaed0-70ed-4182-860a-904a540a5c61","source":"cc-execution","status":"retryable","payload":{"ok":false,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-ad033befa378","reason":"pull_request_checks_failed","status":"retryable","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3360,"terminal":false,"missionId":"ad033bef-a378-4fd8-b821-892b60801fb5","operation":"automatic_mission_resume","proofGate":"repair_mission_pr_ready_retryable","sourceSha":null,"timingsMs":{"prReadinessMs":746,"approvedPlanMs":0,"shipAndProveMs":0,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"Reconcile this same mission and pull request automatically; do not create a replacement branch or PR.","receiptRef":{"mode":"full","missionId":"ad033bef-a378-4fd8-b821-892b60801fb5"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime","visual"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1359,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T16:25:18.575236+00:00","proof_gate":"repair_mission_pr_ready_retryable","source_sha":null,"external_id":"3360","receipt_type":"automatic_mission_resume","idempotency_key":"mission:ad033bef-a378-4fd8-b821-892b60801fb5:automatic-mission-resume:3360:repair_mission_pr_ready_retryable","mission_step_id":"5339708f-8d91-4fe8-bccd-9bc6b9ec899c","command_center_event_id":"ad033bef-a378-4fd8-b821-892b60801fb5"},{"id":"b5b9ee79-2935-4fbd-b78a-3fbb2173dd98","source":"cc-execution","status":"waiting_for_gate","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-ad033befa378","reason":"provider_verified_auto_progress_owns_gate_merge_release_outside_owner_response","status":"waiting_for_gate","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":"1.58.209-visual-certification-hardening","prNumber":3360,"terminal":false,"missionId":"ad033bef-a378-4fd8-b821-892b60801fb5","operation":"execute_mission","proofGate":"repair_mission_pr_handed_off_to_supervisor","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":4260,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":0,"approvedPlanMs":1847,"missionSetupMs":2084,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":1909,"ledgerReconcileMs":0,"lineageReconcileMs":175,"resolvePreflightMs":2084,"repositoryMutationMs":2413,"repositoryProviderMs":2413,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":2286,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":1909,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":127},"nextAction":"Canonical KnockLaunch Gate notifier and durable mission supervisor own Gate, merge, release, and proof progression from this exact PR head outside the owner response path.","receiptRef":{"mode":"full","missionId":"ad033bef-a378-4fd8-b821-892b60801fb5"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime","visual"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":3082,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T16:24:00.025251+00:00","proof_gate":"repair_mission_pr_handed_off_to_supervisor","source_sha":null,"external_id":"3360","receipt_type":"execute_mission","idempotency_key":"mission:ad033bef-a378-4fd8-b821-892b60801fb5:execute_mission:repair_mission_pr_handed_off_to_supervisor:current-generation","mission_step_id":"222f02e8-1838-496c-8ad7-ae970983874e","command_center_event_id":"ad033bef-a378-4fd8-b821-892b60801fb5"},{"id":"a2dfda26-c0d3-42b3-be69-57d6ea304732","source":"cc-execution","status":"waiting_for_gate","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-ad033befa378","reason":"pull_request_checks_pending","status":"waiting_for_gate","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3360,"terminal":false,"missionId":"ad033bef-a378-4fd8-b821-892b60801fb5","operation":"automatic_mission_resume","proofGate":"repair_mission_waiting_for_gate","sourceSha":null,"timingsMs":{"prReadinessMs":1308,"approvedPlanMs":0,"shipAndProveMs":0,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"Reconcile this same mission and pull request after the exact-head KnockLaunch Gate changes state.","receiptRef":{"mode":"full","missionId":"ad033bef-a378-4fd8-b821-892b60801fb5"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1286,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T16:24:17.218422+00:00","proof_gate":"repair_mission_waiting_for_gate","source_sha":null,"external_id":"3360","receipt_type":"automatic_mission_resume","idempotency_key":"mission:ad033bef-a378-4fd8-b821-892b60801fb5:automatic-mission-resume:3360:repair_mission_waiting_for_gate","mission_step_id":"5339708f-8d91-4fe8-bccd-9bc6b9ec899c","command_center_event_id":"ad033bef-a378-4fd8-b821-892b60801fb5"},{"id":"ee51e548-2428-4f84-b269-c725acc9bf27","source":"cc-execution","status":"deployment_dispatched","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-ad033befa378","reason":null,"status":"deployment_dispatched","metrics":{"receiptBytes":0,"releaseCount":0,"toolCallCount":0,"repeatedCallCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3360,"terminal":false,"missionId":"ad033bef-a378-4fd8-b821-892b60801fb5","operation":"automatic_mission_resume","proofGate":"canonical_release_dispatched","sourceSha":"b8ddbb3648294f30df9d7a54d2d444838e61d001","timingsMs":{"prReadinessMs":498,"approvedPlanMs":0,"shipAndProveMs":3881,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":null,"receiptRef":{"mode":"full","missionId":"ad033bef-a378-4fd8-b821-892b60801fb5"},"performance":null,"deploymentId":"forgejo-main-b8ddbb364829","releaseState":null,"workflowRunId":null,"releaseTargets":{"frontend":true,"onrunner":false,"migrations":false,"ccExecution":false,"supabaseEdge":true,"edgeFunctionSlugs":["agreement-sign","proposal-engine"]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":2244,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T16:31:00.012074+00:00","proof_gate":"canonical_release_dispatched","source_sha":null,"external_id":"3360","receipt_type":"automatic_mission_resume","idempotency_key":"mission:ad033bef-a378-4fd8-b821-892b60801fb5:automatic-mission-resume:3360:canonical_release_dispatched","mission_step_id":"24f507f8-cddd-4ce2-94c2-c88fb3a294e3","command_center_event_id":"ad033bef-a378-4fd8-b821-892b60801fb5"},{"id":"257d8f0c-b991-4a51-afe3-3bf9b10e9c93","source":"durable-mission-ledger","status":"pending","payload":{"sourceSha":"ae87994156a6e9cbe549e7b0f782ecd60b9c52c5","requestContractProof":{"legacy":false,"present":true,"outcomes":[{"id":"outcome-godmode-premium-refactor","satisfied":false,"statement":"God Mode / Console at /admin/console uses one cohesive premium obsidian/graphite, cobalt/cyan, restrained violet design system; existing behavior remains intact; witness canvas remains dominant; desktop and mobile are polished.","proofConditionIds":["proof-source","proof-live","proof-visual"]}],"satisfied":false,"constraints":[{"id":"frontend-only","satisfied":false,"statement":"Change frontend source only. Do not change runtime, backend, database, auth, APIs, routes, release architecture, or control-plane behavior.","proofConditionIds":["proof-source","proof-live"]},{"id":"behavior-preservation","satisfied":false,"statement":"Preserve existing IDs, data attributes, selectors, route/witness/operator behavior, interaction contracts, and functionality.","proofConditionIds":["proof-source","proof-live"]},{"id":"visual-system","satisfied":true,"statement":"Use obsidian/graphite and deep navy surfaces, restrained cobalt/cyan accents and violet depth, emerald only for healthy/live states, amber for attention, destructive red only for destructive/error semantics.","proofConditionIds":["proof-visual"]},{"id":"witness-dominance","satisfied":true,"statement":"The witness canvas remains the dominant visual element with minimal chrome, crisp control clusters, strong hierarchy, and a cinematic black canvas.","proofConditionIds":["proof-visual"]},{"id":"responsive","satisfied":true,"statement":"Desktop and mobile must share the same design language while remaining intentionally laid out for each viewport.","proofConditionIds":["proof-visual"]},{"id":"motion","satisfied":false,"statement":"Use subtle premium interaction motion only where useful and respect prefers-reduced-motion.","proofConditionIds":["proof-source","proof-visual"]},{"id":"visual-content-truth","satisfied":true,"statement":"Do not present invented names, metrics, prices, dates, services, testimonials, credentials, customer records, or other unknown business facts as real. Omit unknowns or mark them clearly as placeholder/example content.","proofConditionIds":["proof-visual"]},{"id":"visual-viewport-authority","satisfied":true,"statement":"The requested desktop and mobile viewports are authoritative; do not create mixed-device composites or substitute another viewport.","proofConditionIds":["proof-visual"]},{"id":"capability-completeness","satisfied":false,"statement":"Every dependency the implementation declares or relies on must be wired and proven across applicable frontend, backend/runtime, schema/data/storage, authentication/authorization, provider configuration, prerequisite/loading/empty/error states, release ownership, and live production behavior; owner-authorized unavailable dependencies must become explicit prerequisite states rather than runtime failures.","proofConditionIds":["proof-source","proof-live"]},{"id":"atomic-capability-lifecycle","satisfied":false,"statement":"Changed capabilities remain non-active until dependency readiness, N/N-1 compatibility, affected-target release, and claim-matched production canary proof are satisfied; missing optional dependencies become prerequisite_required, and runtime drift or health-contract violation quarantines only the affected capability instead of breaking unrelated working capability.","proofConditionIds":["proof-source","proof-live"]}],"contractHash":"8ceea8747cdb611e261f86ea470f98a39682fd401990dee49fdccb2ea6c76522","releaseBound":true,"witnessBound":true,"visualRequested":true,"visualSatisfied":true,"conditionResults":[{"id":"proof-source","kind":"repository","evidence":{"reason":null,"gateRunId":null,"satisfied":true,"gateTestProof":null,"gateTestPassed":false,"missingTargets":[],"gateTestExecuted":false,"disallowedTargets":[],"migrationRequired":false,"namedGateTestPath":null,"releaseTargetStates":{"frontend":"success"},"repositoryProofGate":null,"repositoryProofPath":null,"requestContractHash":"8ceea8747cdb611e261f86ea470f98a39682fd401990dee49fdccb2ea6c76522","unsuccessfulTargets":[],"activeReleaseTargets":["frontend"],"allowedReleaseTargets":["frontend"],"repositoryProofStatus":"required","expectedRepositoryPath":null,"namedGateTestSatisfied":true,"requiredReleaseTargets":["frontend"],"migrationReleaseVerified":null,"repositoryConditionBound":false,"repositoryProofSourceSha":null},"required":true,"satisfied":false},{"id":"proof-live","kind":"runtime","evidence":{"reason":null,"satisfied":true,"releaseState":"verified","missingTargets":[],"disallowedTargets":[],"migrationRequired":false,"releaseTargetStates":{"frontend":"success"},"unsuccessfulTargets":[],"activeReleaseTargets":["frontend"],"allowedReleaseTargets":["frontend"],"requiredReleaseTargets":["frontend"],"migrationReleaseVerified":null,"releaseRequestContractHash":"8ceea8747cdb611e261f86ea470f98a39682fd401990dee49fdccb2ea6c76522"},"required":true,"satisfied":true},{"id":"proof-visual","kind":"visual","evidence":{"modeBound":true,"claimBound":true,"routeBound":true,"witnessMode":"observe","witnessRoute":"/admin/console","currentSourceSha":"ae87994156a6e9cbe549e7b0f782ecd60b9c52c5","witnessSourceSha":"ae87994156a6e9cbe549e7b0f782ecd60b9c52c5","verificationState":"verified","witnessRequestContractHash":"8ceea8747cdb611e261f86ea470f98a39682fd401990dee49fdccb2ea6c76522"},"required":true,"satisfied":true}],"validationErrors":[],"pendingProofKinds":["repository"],"activeReleaseTargets":["frontend"]},"authoritativeMissionRefresh":true,"evaluatedRequestContractRevision":1},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-28T03:28:19.825975+00:00","proof_gate":"request_contract_pending","source_sha":"ae87994156a6e9cbe549e7b0f782ecd60b9c52c5","external_id":null,"receipt_type":"request_contract_reconciliation","idempotency_key":"mission:0555bcc2-c5e6-429f-9a0c-0d2a81a7e44c:request-contract:8ceea8747cdb611e261f86ea470f98a39682fd401990dee49fdccb2ea6c76522:ae87994156a6e9cbe549e7b0f782ecd60b9c52c5:pending:repository","mission_step_id":"959d60f6-fe68-4f88-82ac-0bc0ab283dd5","command_center_event_id":"0555bcc2-c5e6-429f-9a0c-0d2a81a7e44c"},{"id":"0514d359-08f9-4c12-9bf8-a0e76da35784","source":"cc-execution","status":"waiting_for_gate","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-c3721053a5c6","reason":"pull_request_checks_pending","status":"waiting_for_gate","metrics":{"receiptBytes":13486,"releaseCount":0,"toolCallCount":2,"repeatedCallCount":0,"executorlessWaitMs":5714,"firstUsefulResultAt":"2026-09-24T23:15:53.601Z","recoveryAttemptCount":0,"ownerInterruptionCount":0},"version":null,"prNumber":3682,"terminal":false,"missionId":"c3721053-a5c6-455c-9c51-01d80fd81713","operation":"automatic_mission_resume","proofGate":"repair_mission_waiting_for_gate","sourceSha":null,"timingsMs":{"prReadinessMs":631,"approvedPlanMs":0,"shipAndProveMs":0,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"Reconcile this same mission and pull request after the exact-head KnockLaunch Gate changes state.","receiptRef":{"mode":"full","missionId":"c3721053-a5c6-455c-9c51-01d80fd81713"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1285,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-24T23:16:01.672639+00:00","proof_gate":"repair_mission_waiting_for_gate","source_sha":null,"external_id":"3682","receipt_type":"automatic_mission_resume","idempotency_key":"mission:c3721053-a5c6-455c-9c51-01d80fd81713:automatic-mission-resume:3682:repair_mission_waiting_for_gate","mission_step_id":"fb73a77a-c46f-40ee-a7cc-41d3d5054d84","command_center_event_id":"c3721053-a5c6-455c-9c51-01d80fd81713"},{"id":"c641e291-2872-4293-b95e-a72c5b7fd40a","source":"cc-execution","status":"waiting_for_gate","payload":{"ok":true,"jobId":null,"phase":"implementation","branch":"ai/objective-first-repair-bdb936b2e84f","reason":"provider_verified_auto_progress_owns_gate_merge_release_outside_owner_response","status":"waiting_for_gate","metrics":{"receiptBytes":9127,"releaseCount":0,"toolCallCount":6,"repeatedCallCount":1,"executorlessWaitMs":357855,"firstUsefulResultAt":"2026-09-25T13:21:36.653Z","recoveryAttemptCount":0,"ownerInterruptionCount":0},"version":"1.58.280-witness-lockdown","prNumber":3730,"terminal":false,"missionId":"bdb936b2-e84f-409b-98ae-f50b6415629c","operation":"execute_mission","proofGate":"repair_mission_pr_handed_off_to_supervisor","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":3665,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":0,"approvedPlanMs":1673,"missionSetupMs":874,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":756,"ledgerReconcileMs":0,"lineageReconcileMs":118,"resolvePreflightMs":874,"repositoryMutationMs":1992,"repositoryProviderMs":1992,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":1861,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":756,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":131},"nextAction":"Canonical KnockLaunch Gate notifier and durable mission supervisor own Gate, merge, release, and proof progression from this exact PR head outside the owner response path.","receiptRef":{"mode":"full","missionId":"bdb936b2-e84f-409b-98ae-f50b6415629c"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":3362,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T13:24:53.524612+00:00","proof_gate":"repair_mission_pr_handed_off_to_supervisor","source_sha":null,"external_id":"3730","receipt_type":"execute_mission","idempotency_key":"mission:bdb936b2-e84f-409b-98ae-f50b6415629c:execute_mission:repair_mission_pr_handed_off_to_supervisor:current-generation","mission_step_id":"dd2537a7-d502-4b60-8d2a-ad943e48569d","command_center_event_id":"bdb936b2-e84f-409b-98ae-f50b6415629c"},{"id":"7c3eec5b-73a0-44e5-ae2a-7103ca69a03d","source":"forgejo-runtime","status":"pending","payload":{"failed":[],"states":{"forgejo-main/source":"success","forgejo-release/workflow":"pending","frontend-cloudflare/live":"pending","supabase-edge-production/live":"pending"},"mainSha":"b8ddbb3648294f30df9d7a54d2d444838e61d001","missing":[],"pending":["forgejo-release/workflow","supabase-edge-production/live","frontend-cloudflare/live"],"required":["forgejo-main/source","forgejo-release/workflow","supabase-edge-production/live","frontend-cloudflare/live"],"sourceSha":"b8ddbb3648294f30df9d7a54d2d444838e61d001","releaseState":"pending","sourceInMain":true,"compareStatus":"protected_main_push_exact_source","releaseTargets":{"frontend":true,"onrunner":false,"migrations":false,"ccExecution":false,"supabaseEdge":true,"edgeFunctionSlugs":["agreement-sign","proposal-engine"]},"releaseTargetStates":{"frontend":"pending","supabaseEdge":"pending"},"requestContractHash":"818b9638f63650221d44e872b6fbcb07e53b61ec1f57bac073ca649dfef4814e","forgejoWorkflowProof":{"runId":10536,"source":"signed_push_receipt","status":"running","results":{},"conclusion":"running","targetStates":{"frontend":"pending","supabaseEdge":"pending"},"targetJobCount":7,"observedTargetStates":{"frontend":"pending","supabaseEdge":"pending"}},"onrunnerRuntimeProof":null,"releaseSourceVerified":true,"ccExecutionRuntimeProof":null,"releaseTargetRecoveryProof":null,"exactReleaseVerifiedAfterMainAdvanced":false},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T16:31:01.510783+00:00","proof_gate":"canonical_release_pending","source_sha":"b8ddbb3648294f30df9d7a54d2d444838e61d001","external_id":"forgejo-main-b8ddbb364829","receipt_type":"canonical_release_status","idempotency_key":"mission:ad033bef-a378-4fd8-b821-892b60801fb5:forgejo-release-status:b8ddbb3648294f30df9d7a54d2d444838e61d001:pending:forgejo-main/source=success|forgejo-release/workflow=pending|supabase-edge-production/live=pending|frontend-cloudflare/live=pending","mission_step_id":"24f507f8-cddd-4ce2-94c2-c88fb3a294e3","command_center_event_id":"ad033bef-a378-4fd8-b821-892b60801fb5"},{"id":"59000ca3-2002-4206-b2ab-74a5f409cbaa","source":"cc-execution","status":"release_reconciliation_pending","payload":{"ok":true,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-49933fef78df","reason":null,"status":"release_reconciliation_pending","metrics":{"receiptBytes":9113,"releaseCount":0,"toolCallCount":5,"repeatedCallCount":1,"executorlessWaitMs":31861,"firstUsefulResultAt":"2026-09-25T22:38:49.500Z","recoveryAttemptCount":2,"ownerInterruptionCount":0},"version":null,"prNumber":3774,"terminal":false,"missionId":"49933fef-78df-4dad-a419-83ca123e24da","operation":"automatic_mission_resume","proofGate":"canonical_release_reconciliation_pending","sourceSha":"662bdac511298255e54080c124bf1989312923d1","timingsMs":{"prReadinessMs":461,"approvedPlanMs":0,"shipAndProveMs":2418,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"reconcile_release","receiptRef":{"mode":"full","missionId":"49933fef-78df-4dad-a419-83ca123e24da"},"performance":null,"deploymentId":"forgejo-main-662bdac51129","releaseState":null,"workflowRunId":null,"releaseTargets":{"frontend":false,"onrunner":false,"migrations":false,"ccExecution":false,"supabaseEdge":false,"edgeFunctionSlugs":[]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1850,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T22:39:36.633021+00:00","proof_gate":"canonical_release_reconciliation_pending","source_sha":null,"external_id":"3774","receipt_type":"automatic_mission_resume","idempotency_key":"mission:49933fef-78df-4dad-a419-83ca123e24da:automatic-mission-resume:3774:canonical_release_reconciliation_pending","mission_step_id":"8e6111b5-8f6c-4a6d-bc07-6295ab4db901","command_center_event_id":"49933fef-78df-4dad-a419-83ca123e24da"},{"id":"1601a6e5-1e76-466f-98f0-a0f9a358fdbf","source":"cc-execution","status":"retryable","payload":{"ok":false,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-503502db5893","reason":"retryable_provider_transport:forgejo_provider_read_timeout","status":"retryable","metrics":{"receiptBytes":13848,"releaseCount":0,"toolCallCount":7,"repeatedCallCount":2,"executorlessWaitMs":436822,"firstUsefulResultAt":"2026-09-25T18:04:41.307Z","recoveryAttemptCount":4,"ownerInterruptionCount":0},"version":null,"prNumber":3753,"terminal":false,"missionId":"503502db-5893-4e94-acfc-60206671793d","operation":"automatic_mission_resume","proofGate":"repair_mission_pr_ready_retryable","sourceSha":null,"timingsMs":{"prReadinessMs":8263,"approvedPlanMs":0,"shipAndProveMs":0,"repositoryMutationMs":0,"repositoryProviderMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"Reconcile this same mission and pull request automatically; do not create a replacement branch or PR.","receiptRef":{"mode":"full","missionId":"503502db-5893-4e94-acfc-60206671793d"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime","visual"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1995,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T18:07:25.006109+00:00","proof_gate":"repair_mission_pr_ready_retryable","source_sha":null,"external_id":"3753","receipt_type":"automatic_mission_resume","idempotency_key":"mission:503502db-5893-4e94-acfc-60206671793d:automatic-mission-resume:3753:repair_mission_pr_ready_retryable","mission_step_id":"fabc562b-68e4-40b2-badf-2e94a1ce886c","command_center_event_id":"503502db-5893-4e94-acfc-60206671793d"},{"id":"437f237d-0be8-4f43-bbd4-6079d49548f4","source":"forgejo-runtime","status":"pending","payload":{"failed":[],"states":{"forgejo-main/source":"success","forgejo-release/workflow":"pending","frontend-cloudflare/live":"pending","supabase-edge-production/live":"success"},"mainSha":"b8ddbb3648294f30df9d7a54d2d444838e61d001","missing":[],"pending":["forgejo-release/workflow","frontend-cloudflare/live"],"required":["forgejo-main/source","forgejo-release/workflow","supabase-edge-production/live","frontend-cloudflare/live"],"sourceSha":"b8ddbb3648294f30df9d7a54d2d444838e61d001","releaseState":"pending","sourceInMain":true,"compareStatus":"protected_main_push_exact_source","releaseTargets":{"frontend":true,"onrunner":false,"migrations":false,"ccExecution":false,"supabaseEdge":true,"edgeFunctionSlugs":["agreement-sign","proposal-engine"]},"releaseTargetStates":{"frontend":"pending","supabaseEdge":"success"},"requestContractHash":"818b9638f63650221d44e872b6fbcb07e53b61ec1f57bac073ca649dfef4814e","forgejoWorkflowProof":{"runId":10536,"source":"signed_push_receipt","status":"running","results":{},"conclusion":"running","targetStates":{"frontend":"pending","supabaseEdge":"success"},"targetJobCount":7,"observedTargetStates":{"frontend":"pending","supabaseEdge":"success"}},"onrunnerRuntimeProof":null,"releaseSourceVerified":true,"ccExecutionRuntimeProof":null,"releaseTargetRecoveryProof":null,"exactReleaseVerifiedAfterMainAdvanced":false},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-21T16:32:29.196176+00:00","proof_gate":"canonical_release_pending","source_sha":"b8ddbb3648294f30df9d7a54d2d444838e61d001","external_id":"forgejo-main-b8ddbb364829","receipt_type":"canonical_release_status","idempotency_key":"mission:ad033bef-a378-4fd8-b821-892b60801fb5:forgejo-release-status:b8ddbb3648294f30df9d7a54d2d444838e61d001:pending:forgejo-main/source=success|forgejo-release/workflow=pending|supabase-edge-production/live=success|frontend-cloudflare/live=pending","mission_step_id":"24f507f8-cddd-4ce2-94c2-c88fb3a294e3","command_center_event_id":"ad033bef-a378-4fd8-b821-892b60801fb5"},{"id":"19a2121d-6f39-43a7-8a80-15a92c85135e","source":"forgejo","status":"waiting","payload":{"branch":"ai/objective-first-repair-c3721053a5c6","prNumber":3682,"nextAction":"Follow the existing canonical release to terminal proof.","mergeCommitSha":"bdaccfcba926c0bfadaefc4a367fba19350c5f63","branchDeletedAfterMerge":true,"correctiveGenerationCreated":false},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-24T23:17:59.558377+00:00","proof_gate":"forgejo_merged_pr_is_authoritative_source_lineage","source_sha":"bdaccfcba926c0bfadaefc4a367fba19350c5f63","external_id":"3682","receipt_type":"source_lineage_merged_pr_authoritative","idempotency_key":"mission:c3721053-a5c6-455c-9c51-01d80fd81713:merged-pr:3682:bdaccfcba926c0bfadaefc4a367fba19350c5f63","mission_step_id":"10f3f76c-1fa1-4c4e-8ca2-16e1fdbf5887","command_center_event_id":"c3721053-a5c6-455c-9c51-01d80fd81713"},{"id":"d2ac1bc6-b593-4412-a2a5-26b7c1adc856","source":"cc-execution","status":"waiting","payload":{"body":{"ship":true,"files":[{"path":"scripts/validate-control-plane-restore-point.mjs","content":"import assert from 'node:assert/strict';\nimport { readFileSync } from 'node:fs';\n\nconst TARGET = 'bf2a8e9c4206c491a249c02db298682850f49581';\nconst RESTORE_NAME = 'KNOCKLAUNCH Golden Restore Point — 2026-09-25 Witness Lockdown Stable';\nconst restore = JSON.parse(readFileSync('config/control-plane-restore-point.json', 'utf8'));\nconst contract = readFileSync('src/__tests__/contracts/control-plane-restore-point.contract.test.ts', 'utf8');\nconst workflow = readFileSync('.forgejo/workflows/knocklaunch.yml', 'utf8');\n\nassert.equal(restore.schemaVersion, 2);\nassert.equal(restore.kind, 'canonical_control_plane_system_architecture_restore_point');\nassert.equal(restore.name, RESTORE_NAME);\nassert.equal(restore.supersedes?.name, 'KNOCKLAUNCH Golden Restore Point — 2026-09-11 Exact-Green Stable');\nassert.equal(restore.restoreTarget?.architectureSourceSha, TARGET);\nassert.equal(restore.restoreTarget?.protectedMainSha, TARGET);\nassert.equal(restore.restoreTarget?.commandCenter?.service, 'cc-execution');\nassert.equal(restore.restoreTarget?.commandCenter?.version, '1.58.280-witness-lockdown');\nassert.equal(restore.restoreTarget?.commandCenter?.sourceSha, TARGET);\nassert.equal(restore.restoreTarget?.commandCenter?.deploymentId, 'forgejo-main-bf2a8e9c4206c491a249c02db298682850f49581');\nassert.equal(restore.restoreTarget?.commandCenter?.buildId, 'forgejo-bf2a8e9c4206-11782-1');\nassert.equal(restore.restoreTarget?.commandCenter?.status, 'live');\n\nassert.match(String(restore.architectureInvariants?.visualWitnessTerminalMonotonicity || ''), /durable_success_receipt/);\nassert.match(String(restore.architectureInvariants?.visualWitnessCheckpointSourceBinding || ''), /exact_witness_source_commit/);\nassert.match(String(restore.architectureInvariants?.visualWitnessExplicitViewportPreservation || ''), /explicit_viewports_are_authoritative/);\nassert.match(String(restore.architectureInvariants?.visualWitnessRestartReplayBound || ''), /one_process_restart_replay_per_attempt_slot/);\nassert.match(String(restore.architectureInvariants?.visualWitnessGateExecution || ''), /full_package_check_required/);\nassert.equal(restore.architectureInvariants?.visualWitnessGateBaseline, '163_tests_163_pass_0_fail');\nassert.match(String(restore.architectureInvariants?.runtimeReleaseProofReconciliation || ''), /every_affected_runtime_target_is_proven/);\nassert.match(String(restore.architectureInvariants?.nonRuntimeReleaseFailClosed || ''), /frontend_supabase_edge_and_migrations/);\n\nassert.equal(restore.knownGoodEvidence?.mainShaAtSnapshot, TARGET);\nassert.equal(restore.knownGoodEvidence?.commandCenterRuntimeSha, TARGET);\nassert.equal(restore.knownGoodEvidence?.witnessPrimaryRuntimeSha, TARGET);\nassert.equal(restore.knownGoodEvidence?.witnessVirtualRuntimeSha, TARGET);\nassert.equal(restore.knownGoodEvidence?.witnessHostedRunnerTests, 163);\nassert.equal(restore.knownGoodEvidence?.witnessHostedRunnerPassed, 163);\nassert.equal(restore.knownGoodEvidence?.witnessHostedRunnerFailed, 0);\nassert.equal(restore.knownGoodEvidence?.renderOnrunnerRuntimeIdentityVerified, true);\nassert.equal(restore.knownGoodEvidence?.witnessTerminalMonotonicityVerified, true);\nassert.equal(restore.knownGoodEvidence?.witnessRestartTerminalizationVerified, true);\nassert.equal(restore.knownGoodEvidence?.witnessCheckpointSourceBindingVerified, true);\nassert.equal(restore.knownGoodEvidence?.witnessExplicitViewportPreservationVerified, true);\nassert.equal(restore.knownGoodEvidence?.mixedRuntimeTargetReconciliationVerified, true);\nassert.equal(restore.knownGoodEvidence?.frontendEdgeMigrationFailClosedPreserved, true);\n\nassert.equal(restore.restorePolicy?.verifyRuntimeTargetReconciliationAfterRestore, true);\nassert.equal(restore.restorePolicy?.verifyVisualWitnessTerminalMonotonicityAfterRestore, true);\nassert.equal(restore.restorePolicy?.verifyVisualWitnessRestartTerminalizationAfterRestore, true);\nassert.equal(restore.restorePolicy?.verifyVisualWitnessSourceBoundCheckpointAfterRestore, true);\nassert.equal(restore.restorePolicy?.verifyVisualWitnessExplicitViewportPreservationAfterRestore, true);\nassert.equal(restore.restorePolicy?.verifyHostedRunnerGateAfterRestore, true);\nassert.equal(restore.restorePolicy?.verifyPrimaryOnRunnerIdentityAfterRestore, true);\nassert.equal(restore.restorePolicy?.doNotUseGitHubAsFallback, true);\nassert.equal(restore.restorePolicy?.preserveProtectedMain, true);\nassert.equal(restore.restorePolicy?.databaseRecordsExcludedFromRollbackMutation, true);\nassert.equal(restore.restorePolicy?.migrationHistoryPreserved, true);\n\nassert.match(contract, new RegExp(`WITNESS_LOCKDOWN_SHA = ['\"]${TARGET}['\"]`));\nassert.match(contract, /visualWitnessTerminalMonotonicity/);\nassert.match(contract, /visualWitnessCheckpointSourceBinding/);\nassert.match(contract, /visualWitnessExplicitViewportPreservation/);\nassert.match(contract, /runtimeReleaseProofReconciliation/);\nassert.ok(workflow.includes('node scripts/validate-control-plane-restore-point.mjs'));\n\nconsole.log(JSON.stringify({\n ok: true,\n proofGate: 'canonical_control_plane_restore_point_verified',\n restoreName: RESTORE_NAME,\n restoreTarget: TARGET,\n hostedRunnerTests: 163,\n invariants: {\n terminalMonotonicity: true,\n sourceBoundCheckpoints: true,\n explicitViewportPreservation: true,\n boundedRestartReplay: true,\n fullHostedRunnerGate: true,\n runtimeTargetReconciliation: true,\n nonRuntimeFailClosed: true\n }\n}));\n"}],"branch":"ai/objective-first-repair-8b22a7845397","writes":[],"patches":[],"version":1,"approved":true,"missionId":"8b22a784-5397-4822-8c66-cdcfcda533d7","objective":"Corrective generation after the 58435c69 main stabilization: make the already-merged September 25 witness-lockdown golden restore point an unconditional KnockLaunch Gate hard-safety invariant on every PR. Add a dependency-free validator, hydrate its restore config and restore contract on every Gate, and execute it before adaptive QA exits. This generation supersedes the earlier pre-mutation base-SHA-rejected attempt and must not alter runtime behavior.","repository":"noel/KnockLaunchOS","visualProof":false,"verifyVisual":false,"ownerApproved":true,"releaseIntent":null,"sourceTargets":[],"anchored_edits":[{"path":".forgejo/workflows/knocklaunch.yml","anchor":" '/config/control-plane-capabilities.json' \\\n '/config/platform-standards.json' \\","replacement":" '/config/control-plane-capabilities.json' \\\n '/config/control-plane-restore-point.json' \\\n '/config/platform-standards.json' \\"},{"path":".forgejo/workflows/knocklaunch.yml","anchor":" '/scripts/validate-production-critical-files.mjs' \\\n '/scripts/validate-stale-gate-evidence-reuse.mjs' \\","replacement":" '/scripts/validate-production-critical-files.mjs' \\\n '/scripts/validate-control-plane-restore-point.mjs' \\\n '/scripts/validate-stale-gate-evidence-reuse.mjs' \\"},{"path":".forgejo/workflows/knocklaunch.yml","anchor":" '/src/integrations/supabase/client.ts' \\\n '/index.html' \\","replacement":" '/src/integrations/supabase/client.ts' \\\n '/src/__tests__/contracts/control-plane-restore-point.contract.test.ts' \\\n '/index.html' \\"},{"path":".forgejo/workflows/knocklaunch.yml","anchor":" config/control-plane-capabilities.json\n workers/cc-execution/src/index-release-fast-lane.js","replacement":" config/control-plane-capabilities.json\n config/control-plane-restore-point.json\n scripts/validate-control-plane-restore-point.mjs\n src/__tests__/contracts/control-plane-restore-point.contract.test.ts\n workers/cc-execution/src/index-release-fast-lane.js"},{"path":".forgejo/workflows/knocklaunch.yml","anchor":" node scripts/reconcile-supabase-edge-registry.test.mjs\n\n # Runtime parseability is a hard safety invariant, not optional domain QA.","replacement":" node scripts/reconcile-supabase-edge-registry.test.mjs\n node scripts/validate-control-plane-restore-point.mjs\n echo \"Hard safety: canonical control-plane restore point contract passed.\"\n\n # Runtime parseability is a hard safety invariant, not optional domain QA."}],"implementation":{"files":[],"writes":[]},"requestContract":{"valid":true,"intent":{"evidence":[],"confidence":null,"rawUtterance":"Corrective generation after the 58435c69 main stabilization: make the already-merged September 25 witness-lockdown golden restore point an unconditional KnockLaunch Gate hard-safety invariant on every PR. Add a dependency-free validator, hydrate its restore config and restore contract on every Gate, and execute it before adaptive QA exits. This generation supersedes the earlier pre-mutation base-SHA-rejected attempt and must not alter runtime behavior.","wordingChanged":false,"canonicalIntent":"Corrective generation after the 58435c69 main stabilization: make the already-merged September 25 witness-lockdown golden restore point an unconditional KnockLaunch Gate hard-safety invariant on every PR. Add a dependency-free validator, hydrate its restore config and restore contract on every Gate, and execute it before adaptive QA exits. This generation supersedes the earlier pre-mutation base-SHA-rejected attempt and must not alter runtime behavior.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"explicit","version":1,"outcomes":[{"id":"restore-hard-safety","statement":"Every KnockLaunch Gate verifies the exact September 25 golden restore target and witness-lockdown invariants.","provenance":{"reason":null,"source":"owner_authorized_control_plane_maintenance","inherited":false,"blockingAuthority":true},"proofConditionIds":["validator","gate-wiring"]}],"objective":"Corrective generation after the 58435c69 main stabilization: make the already-merged September 25 witness-lockdown golden restore point an unconditional KnockLaunch Gate hard-safety invariant on every PR. Add a dependency-free validator, hydrate its restore config and restore contract on every Gate, and execute it before adaptive QA exits. This generation supersedes the earlier pre-mutation base-SHA-rejected attempt and must not alter runtime behavior.","constraints":[{"id":"no-runtime-change","statement":"Only add unconditional Gate validation; do not alter Visual Witness or release runtime behavior.","provenance":{"reason":null,"source":"owner_authorized_control_plane_maintenance","inherited":false,"blockingAuthority":true},"proofConditionIds":["validator","gate-wiring"]}],"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"validator","kind":"repository","path":"scripts/validate-control-plane-restore-point.mjs","claim":"Dependency-free restore validator pins the exact witness-lockdown golden restore contract.","roleRef":null,"userRef":null,"required":true,"expectedText":"canonical_control_plane_restore_point_verified","targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"expectedWatchdogPolicyVersion":null,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false},{"id":"gate-wiring","kind":"repository","path":".forgejo/workflows/knocklaunch.yml","claim":"Gate always hydrates and executes the restore validator.","roleRef":null,"userRef":null,"required":true,"expectedText":"Hard safety: canonical control-plane restore point contract passed.","targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"expectedWatchdogPolicyVersion":null,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false}],"validationErrors":[]},"repairGeneration":null,"executionEnvelope":{"ship":true,"version":1,"approved":true,"missionId":null,"ownerApproved":true,"releaseIntent":null,"sourceTargets":[],"requestContract":{"valid":true,"intent":{"evidence":[],"confidence":null,"rawUtterance":"Corrective generation after the 58435c69 main stabilization: make the already-merged September 25 witness-lockdown golden restore point an unconditional KnockLaunch Gate hard-safety invariant on every PR. Add a dependency-free validator, hydrate its restore config and restore contract on every Gate, and execute it before adaptive QA exits. This generation supersedes the earlier pre-mutation base-SHA-rejected attempt and must not alter runtime behavior.","wordingChanged":false,"canonicalIntent":"Corrective generation after the 58435c69 main stabilization: make the already-merged September 25 witness-lockdown golden restore point an unconditional KnockLaunch Gate hard-safety invariant on every PR. Add a dependency-free validator, hydrate its restore config and restore contract on every Gate, and execute it before adaptive QA exits. This generation supersedes the earlier pre-mutation base-SHA-rejected attempt and must not alter runtime behavior.","resolutionStatus":"exact","uniqueResolution":true,"clarificationRequired":false},"source":"explicit","version":1,"outcomes":[{"id":"restore-hard-safety","statement":"Every KnockLaunch Gate verifies the exact September 25 golden restore target and witness-lockdown invariants.","provenance":{"reason":null,"source":"owner_authorized_control_plane_maintenance","inherited":false,"blockingAuthority":true},"proofConditionIds":["validator","gate-wiring"]}],"objective":"Corrective generation after the 58435c69 main stabilization: make the already-merged September 25 witness-lockdown golden restore point an unconditional KnockLaunch Gate hard-safety invariant on every PR. Add a dependency-free validator, hydrate its restore config and restore contract on every Gate, and execute it before adaptive QA exits. This generation supersedes the earlier pre-mutation base-SHA-rejected attempt and must not alter runtime behavior.","constraints":[{"id":"no-runtime-change","statement":"Only add unconditional Gate validation; do not alter Visual Witness or release runtime behavior.","provenance":{"reason":null,"source":"owner_authorized_control_plane_maintenance","inherited":false,"blockingAuthority":true},"proofConditionIds":["validator","gate-wiring"]}],"terminalPolicy":"all_required_proof_conditions_satisfied_after_live_release","proofConditions":[{"id":"validator","kind":"repository","path":"scripts/validate-control-plane-restore-point.mjs","claim":"Dependency-free restore validator pins the exact witness-lockdown golden restore contract.","roleRef":null,"userRef":null,"required":true,"expectedText":"canonical_control_plane_restore_point_verified","targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"expectedWatchdogPolicyVersion":null,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false},{"id":"gate-wiring","kind":"repository","path":".forgejo/workflows/knocklaunch.yml","claim":"Gate always hydrates and executes the restore validator.","roleRef":null,"userRef":null,"required":true,"expectedText":"Hard safety: canonical control-plane restore point contract passed.","targetedActions":[],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"requireCapacityAdmissible":false,"expectedWatchdogPolicyVersion":null,"minConsecutiveHealthyHeartbeats":1,"requirePositiveMemoryAttribution":false,"requireMemoryAdmissionPressureFalse":false}],"validationErrors":[]},"repairGeneration":null,"proofRequirements":null,"controlPlaneUnfreeze":true,"controlPlaneMaintenance":true,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":"Owner ordered the September 25 witness-lockdown state fully locked down. Current main is stable at the post-PAUL 58435c69 generation; make restore validation unconditional on every Gate after the previous attempt was safely rejected before mutation by the base-SHA fence."},"proofRequirements":null,"controlPlaneUnfreeze":true,"durableMutationResume":true,"controlPlaneMaintenance":true,"controlPlaneMaintenancePaths":[],"controlPlaneMaintenanceReason":"Owner ordered the September 25 witness-lockdown state fully locked down. Current main is stable at the post-PAUL 58435c69 generation; make restore validation unconditional on every Gate after the previous attempt was safely rejected before mutation by the base-SHA fence."},"recovery":false,"fingerprint":"b26fa1445f6e65b8e13c3944cb2c8bd2361df10df17d39b1d5d8c6b4d13a0607","replayCount":0,"serializedBytes":16692},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T13:29:32.288526+00:00","proof_gate":"repository_mutation_intent_persisted","source_sha":null,"external_id":null,"receipt_type":"repository_mutation_intent","idempotency_key":"mission:8b22a784-5397-4822-8c66-cdcfcda533d7:repository-mutation-intent:b26fa1445f6e65b8e13c3944cb2c8bd2361df10df17d39b1d5d8c6b4d13a0607:0","mission_step_id":"fd815cd8-eecb-45f4-a1d2-d40f3caea40d","command_center_event_id":"8b22a784-5397-4822-8c66-cdcfcda533d7"},{"id":"c253c8ca-278f-44f2-a3c9-3f2331684984","source":"cc-execution","status":"retryable","payload":{"ok":false,"jobId":null,"phase":"pull_request","branch":"ai/objective-first-repair-503502db5893","reason":"retryable_provider_transport:forgejo_provider_read_timeout","status":"retryable","metrics":{"receiptBytes":10325,"releaseCount":0,"toolCallCount":5,"repeatedCallCount":1,"executorlessWaitMs":169919,"firstUsefulResultAt":"2026-09-25T18:04:41.307Z","recoveryAttemptCount":2,"ownerInterruptionCount":0},"version":"1.58.282-lineage-main-guard","prNumber":3753,"terminal":false,"missionId":"503502db-5893-4e94-acfc-60206671793d","operation":"execute_mission","proofGate":"repair_mission_pr_ready_retryable","sourceSha":null,"timingsMs":{"gateMs":0,"proofMs":0,"handlerMs":5547,"releaseMs":0,"mutationMs":0,"repositoryMs":0,"prReadinessMs":5436,"approvedPlanMs":0,"missionSetupMs":401,"providerAuthMs":0,"shipAndProveMs":0,"ledgerPrepareMs":288,"ledgerReconcileMs":0,"lineageReconcileMs":113,"resolvePreflightMs":401,"repositoryMutationMs":0,"repositoryProviderMs":0,"authoritativeLedgerMs":0,"ledgerAsyncDispatchMs":0,"repositoryAtomicCommitMs":0,"repositoryBranchCreateMs":0,"totalSynchronousLedgerMs":288,"asyncBookkeepingDispatchMs":0,"ledgerAuthoritativeCommitMs":0,"repositoryPullRequestCreateMs":0},"nextAction":"Reconcile this same mission and pull request automatically; do not create a replacement branch or PR.","receiptRef":{"mode":"full","missionId":"503502db-5893-4e94-acfc-60206671793d"},"performance":null,"deploymentId":null,"releaseState":null,"workflowRunId":null,"releaseTargets":null,"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":["runtime","visual"],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1523,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T18:07:43.00222+00:00","proof_gate":"repair_mission_pr_ready_retryable","source_sha":null,"external_id":"3753","receipt_type":"execute_mission","idempotency_key":"mission:503502db-5893-4e94-acfc-60206671793d:execute_mission:repair_mission_pr_ready_retryable:current-generation","mission_step_id":"940a0c41-98c6-4700-9d80-55142b173f2a","command_center_event_id":"503502db-5893-4e94-acfc-60206671793d"},{"id":"36b6f141-101a-4ecd-bbe2-0b490327f571","source":"cc-execution","status":"pending","payload":{"ok":true,"jobId":"09342259-45d8-4886-a54c-bfb74a44ed78","phase":"universal_visual_witness_supervised","branch":"ai/objective-first-repair-851cc024870f","reason":null,"status":"pending","metrics":{"receiptBytes":37293,"releaseCount":0,"toolCallCount":14,"repeatedCallCount":6,"executorlessWaitMs":452538,"firstUsefulResultAt":"2026-09-25T18:00:14.182Z","recoveryAttemptCount":6,"ownerInterruptionCount":0},"version":null,"prNumber":3752,"terminal":false,"missionId":"851cc024-870f-469a-bd07-66ea76712db4","operation":"visual_proof_started","proofGate":"universal_visual_witness_pending","sourceSha":"86308f02212acd8841732d099200f74f26fabd1e","timingsMs":{"queue":383,"total":403,"execution":20},"nextAction":"Execution is pending; poll inspect_route_status only when fresh progress is expected, or cancel with inspect_route_cancel.","receiptRef":{"mode":"full","missionId":"851cc024-870f-469a-bd07-66ea76712db4"},"performance":null,"deploymentId":"forgejo-main-86308f02212a","releaseState":"verified","visualWitness":{"role":"GodMode","jobId":"09342259-45d8-4886-a54c-bfb74a44ed78","tenant":null,"runnerUrl":"https://paul-witness.knocklaunch.app","runnerLane":"paul","attemptsUsed":0,"supervisorId":"09342259-45d8-4886-a54c-bfb74a44ed78","failureReason":null,"observedRoute":null,"runnerVersion":null,"attemptLineage":[],"missionOutcome":null,"requestedRoute":"/big-papis/owner/calendar?bpMode=plan","runnerSourceSha":null,"selectedViewports":["mobile"],"checkpointAccounting":null,"correctiveGeneration":0,"restartReplayHistory":[]},"workflowRunId":11853,"releaseTargets":{"frontend":true,"onrunner":false,"migrations":false,"ccExecution":false,"supabaseEdge":false,"edgeFunctionSlugs":[]},"detailsAvailable":true,"ownerFacingState":"IN_PROGRESS","pendingProofKinds":[],"verificationState":null,"workflowInvariant":{"oneBranch":true,"oneMission":true,"oneRelease":true,"invariantScope":"repair_generation","onePullRequest":true,"terminalProofRequired":true,"correctiveGenerationsAllowed":true},"sourceReceiptBytes":1773,"ownerActionRequired":false,"ownerFacingTerminal":false,"continuationRequired":true,"requestContractState":"pending"},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T18:07:48.355857+00:00","proof_gate":"post_release_visual_proof_started","source_sha":"86308f02212acd8841732d099200f74f26fabd1e","external_id":"09342259-45d8-4886-a54c-bfb74a44ed78","receipt_type":"visual_proof_started","idempotency_key":"mission:851cc024-870f-469a-bd07-66ea76712db4:visual-start:09342259-45d8-4886-a54c-bfb74a44ed78","mission_step_id":"def4cd90-032f-47b1-aa39-e75f27cc58e2","command_center_event_id":"851cc024-870f-469a-bd07-66ea76712db4"},{"id":"9e280164-7b01-497d-80f4-0efc46e6dc61","source":"durable-mission-ledger","status":"pending","payload":{"sourceSha":"86308f02212acd8841732d099200f74f26fabd1e","requestContractProof":{"legacy":false,"present":true,"outcomes":[{"id":"big-papis-contextual-nav-fix","satisfied":false,"statement":"Fix the Big Papi mobile contextual-nav defect proven by live interaction: on in-mode routes, build shortcut labels from the actual mode navigation items before broader mode cards so Calendar is absent while on Calendar and reappears as Calendar after leaving it; keep the crown slot permanent and avatar last. Also enlarge the shared Modes/Context hitboxes and Big Papi Calendar previous/next-day hitboxes enough to remain mobile-safe after tenant scaling, without changing desktop or public behavior.","proofConditionIds":["proof-production","proof-calendar-interaction"]}],"satisfied":false,"constraints":[{"id":"tenant-scope","satisfied":false,"statement":"Only Big Papi's private owner mobile workspace is changed; desktop and public-facing behavior remain unchanged.","proofConditionIds":["proof-production","proof-calendar-interaction"]},{"id":"preserve-shell","satisfied":false,"statement":"The crown-centered mobile shell and account-last rule remain unchanged.","proofConditionIds":["proof-production","proof-calendar-interaction"]},{"id":"visual-content-truth","satisfied":false,"statement":"Do not present invented names, metrics, prices, dates, services, testimonials, credentials, customer records, or other unknown business facts as real. Omit unknowns or mark them clearly as placeholder/example content.","proofConditionIds":["proof-calendar-interaction"]},{"id":"tenant-visual-isolation","satisfied":false,"statement":"Visual work is isolated to Big Papi's. Do not import another tenant's logo, colors, imagery, copy, shell, customer data, business facts, or visual identity.","proofConditionIds":["proof-calendar-interaction"]},{"id":"visual-viewport-authority","satisfied":false,"statement":"The requested mobile viewport/form factor is authoritative. Do not create a mixed-device composite or add another viewport.","proofConditionIds":["proof-calendar-interaction"]},{"id":"reference-visual-fidelity","satisfied":false,"statement":"Preserve the approved crown-centered Big Papi mobile shell composition and existing mode visual language.","proofConditionIds":["proof-calendar-interaction"]},{"id":"responsive-visual-continuity","satisfied":false,"statement":"Mobile adaptation preserves Big Papi hierarchy, branding, functionality, and design language; it does not invent a second design.","proofConditionIds":["proof-calendar-interaction"]},{"id":"reference-visual-authority","satisfied":false,"statement":"The currently approved live crown-centered Big Papi mobile shell is the immutable acceptance reference for this bounded repair.","proofConditionIds":["proof-calendar-interaction"]},{"id":"capability-completeness","satisfied":true,"statement":"Every dependency the implementation declares or relies on must be wired and proven across applicable frontend, backend/runtime, schema/data/storage, authentication/authorization, provider configuration, prerequisite/loading/empty/error states, release ownership, and live production behavior; owner-authorized unavailable dependencies must become explicit prerequisite states rather than runtime failures.","proofConditionIds":["proof-production"]},{"id":"atomic-capability-lifecycle","satisfied":true,"statement":"Changed capabilities remain non-active until dependency readiness, N/N-1 compatibility, affected-target release, and claim-matched production canary proof are satisfied; missing optional dependencies become prerequisite_required, and runtime drift or health-contract violation quarantines only the affected capability instead of breaking unrelated working capability.","proofConditionIds":["proof-production"]}],"contractHash":"fc1b91ae563c366c924009e6ceb4cb97ce1521fdf4e378da6142a9241482eed5","releaseBound":true,"witnessBound":false,"visualRequested":true,"visualSatisfied":false,"conditionResults":[{"id":"proof-production","kind":"runtime","evidence":{"reason":null,"satisfied":true,"releaseState":"verified","missingTargets":[],"disallowedTargets":[],"migrationRequired":false,"releaseTargetStates":{"frontend":"success"},"unsuccessfulTargets":[],"activeReleaseTargets":["frontend"],"allowedReleaseTargets":[],"requiredReleaseTargets":[],"migrationReleaseVerified":null,"releaseRequestContractHash":"fc1b91ae563c366c924009e6ceb4cb97ce1521fdf4e378da6142a9241482eed5"},"required":true,"satisfied":true},{"id":"proof-calendar-interaction","kind":"visual","evidence":{"modeBound":true,"claimBound":true,"routeBound":true,"witnessMode":"observe","witnessRoute":"https://app.knocklaunch.app/big-papis/owner/calendar?bpMode=plan","currentSourceSha":"86308f02212acd8841732d099200f74f26fabd1e","witnessSourceSha":"86308f02212acd8841732d099200f74f26fabd1e","verificationState":null,"witnessRequestContractHash":"fc1b91ae563c366c924009e6ceb4cb97ce1521fdf4e378da6142a9241482eed5"},"required":true,"satisfied":false}],"validationErrors":[],"pendingProofKinds":["visual"],"activeReleaseTargets":["frontend"]},"authoritativeMissionRefresh":true,"evaluatedRequestContractRevision":1},"tenant_id":"a3ffa31f-0c88-4fdd-b872-051db013ca3e","created_at":"2026-09-25T18:07:46.765572+00:00","proof_gate":"request_contract_pending","source_sha":"86308f02212acd8841732d099200f74f26fabd1e","external_id":null,"receipt_type":"request_contract_reconciliation","idempotency_key":"mission:851cc024-870f-469a-bd07-66ea76712db4:request-contract:fc1b91ae563c366c924009e6ceb4cb97ce1521fdf4e378da6142a9241482eed5:86308f02212acd8841732d099200f74f26fabd1e:pending:visual","mission_step_id":"08cd02eb-9ba8-450d-bdb2-cd4c0f83d54b","command_center_event_id":"851cc024-870f-469a-bd07-66ea76712db4"},{"id":"48f9b3d9-d887-4867-bcfc-bbc3d57a1bd2","source":"cc-execution","status":"waiting","payload":{"body":{"ship":true,"files":[{"path":"src/pages/admin/GodModeCommandConsole.tsx","content":"import { useEffect, useRef, useState } from 'react';\nimport { useMultiTenant } from '@/contexts/MultiTenantContext';\nimport { supabase } from '@/integrations/supabase/client';\nimport { getTenantDashboardPathForTenant } from '@/lib/tenantUtils';\n\ntype ConsoleIntentClass = 'conversation' | 'stable_context_read' | 'live_state_read' | 'route_inspection' | 'direct_operation' | 'repository_repair';\ntype ConsoleDecision = { intentClass: ConsoleIntentClass; selectedCommand?: string; selectedCapability?: string; lifecycleState?: string; evidenceSource?: string; missionId?: string; witnessJobId?: string; statusTransitions?: string[] };\ntype ConsoleProgressEntry = { at: string; content: string; stateKey?: string };\ntype ConsoleMessage = { id: string; role: 'user' | 'assistant'; content: string; createdAt?: string; error?: boolean; progress?: boolean; decision?: ConsoleDecision };\ntype ConsoleOperatorContext = { route?: string; tenantRef?: string; roleRef?: string; viewports?: string[]; [key: string]: unknown };\ntype ResolvedConsoleTarget = { route: string; tenantRef: string; tenant: any | null; confidence: number; ambiguous: boolean };\ntype ResolverTrace = { status: 'idle' | 'resolving' | 'resolved' | 'ambiguous' | 'error'; query?: string; tenantName?: string; tenantRef?: string; confidence?: number; matchKind?: string; route?: string; message?: string };\ntype ActiveConsoleJob = { kind: 'witness' | 'mission' | 'forgejo'; id: string; label?: string; missionId?: string; workflowRunId?: string };\n\ntype HistoryTab = 'live' | 'chats' | 'runs';\ntype WitnessInteractionMode = 'observe' | 'interact' | 'act';\n\nfunction nowIso() { return new Date().toISOString(); }\n\nfunction formatConsoleTimestamp(value: unknown) {\n const date = new Date(String(value || ''));\n if (Number.isNaN(date.getTime())) return '';\n return date.toLocaleString([], { year: 'numeric', month: 'numeric', day: 'numeric', hour: 'numeric', minute: '2-digit', second: '2-digit' });\n}\n\nfunction isRouteFamilyRequest(value: string) {\n const text = String(value || '').toLowerCase();\n return /\\b(?:entire|whole|full|all)\\s+(?:tenant\\s+)?(?:route\\s+family|routes?)\\b/i.test(text)\n || /\\broute\\s+family\\b/i.test(text)\n || /\\ball\\s+(?:of\\s+)?(?:the\\s+)?routes\\b/i.test(text);\n}\n\nfunction extractRouteFamilyTenantHint(value: string) {\n const raw = String(value || '').trim();\n if (!isRouteFamilyRequest(raw)) return '';\n const cleaned = raw\n .replace(/https?:\\/\\/[^\\s]+/gi, ' ')\n .replace(/(?:^|\\s)\\/(?!\\/)[a-z0-9][^\\s,;]*/gi, ' ')\n .replace(/^(?:please\\s+)?(?:(?:can|could|would)\\s+you\\s+)?(?:go\\s+to\\s+|open\\s+|show\\s+(?:me\\s+)?|inspect\\s+|analyz\\w*\\s+|analys\\w*\\s+|review\\s+|look\\s+at\\s+|take\\s+a\\s+look\\s+at\\s+|check\\s+(?:out\\s+)?|watch\\s+|verify\\s+)+/i, '')\n .trim();\n\n const afterFamily = cleaned.match(/\\b(?:route\\s+family|all\\s+routes?|entire\\s+routes?|whole\\s+routes?)\\b\\s+(?:for|of|under|in)\\s+(.+?)(?=\\s+(?:for|to)\\s+(?:breakage|breaks?|errors?|issues?|problems?|failures?)\\b|[.!?]|$)/i);\n if (afterFamily?.[1]) return afterFamily[1].replace(/^(?:the\\s+)?(?:tenant|company|business)\\s+/i, '').trim();\n\n const beforeFamily = cleaned.match(/^(.+?)(?:[’']s)?\\s+(?:(?:entire|whole|full|all)\\s+)?(?:route\\s+family|routes?)\\b/i);\n if (beforeFamily?.[1]) {\n return beforeFamily[1]\n .replace(/^(?:the\\s+)?(?:entire|whole|full|all)\\s+/i, '')\n .replace(/^(?:the\\s+)?(?:tenant|company|business)\\s+/i, '')\n .trim();\n }\n return '';\n}\n\nfunction extractTenantReferenceHint(value: string) {\n const familyHint = extractRouteFamilyTenantHint(value);\n if (familyHint) return familyHint;\n let text = String(value || '').trim();\n if (!text) return '';\n text = text.replace(/https?:\\/\\/[^\\s]+/gi, ' ').replace(/(?:^|\\s)\\/(?!\\/)[a-z0-9][^\\s,;]*/gi, ' ').trim();\n text = text.replace(/^(?:please\\s+)?(?:(?:can|could|would)\\s+you\\s+)?(?:go\\s+to\\s+|open\\s+|show\\s+(?:me\\s+)?|inspect\\s+|analyz\\w*\\s+|analys\\w*\\s+|review\\s+|look\\s+at\\s+|take\\s+a\\s+look\\s+at\\s+|check\\s+(?:out\\s+)?|watch\\s+|verify\\s+)+/i, '').trim();\n const surface = text.search(/\\b(?:dashboard|workspace|page|screen|layout|route|website|site|app|application|mode|inventory|calendar|schedule|proposal|events?|booking|back\\s+office|form|viewer)\\b/i);\n if (surface > 0) text = text.slice(0, surface);\n text = text.replace(/^(?:the\\s+)?(?:tenant|company|business)\\s+/i, '').replace(/\\s+(?:tenant|company|business)$/i, '').trim();\n return text.replace(/[,:;.!?]+$/g, '').trim();\n}\n\nfunction tenantReferenceCandidates(value: string) {\n const hint = extractTenantReferenceHint(value);\n const variants: string[] = [];\n const add = (candidate: string) => { const clean = candidate.replace(/\\s+/g, ' ').trim(); if (clean && !variants.some((item) => item.toLowerCase() === clean.toLowerCase())) variants.push(clean); };\n if (hint) {\n add(hint);\n add(hint.replace(/[’']s\\b/gi, ''));\n add(hint.replace(/\\b([a-z0-9-]{5,})s\\b$/i, '$1'));\n add(hint.replace(/[’']s\\b/gi, '').replace(/\\b([a-z0-9-]{5,})s\\b$/i, '$1'));\n }\n add(String(value || ''));\n return variants.slice(0, 5);\n}\n\nfunction isTerminalOperatorData(data: any) {\n const receipt = data?.receipt || data || {};\n if (typeof receipt?.terminal === 'boolean') return receipt.terminal;\n const state = String(receipt?.ownerFacingState || receipt?.status || receipt?.phase || data?.status || '').trim().toLowerCase();\n return ['verified','live','completed','complete','completed_with_findings','failed','cancelled','canceled','timed_out','error'].includes(state);\n}\n\nfunction formatRouteCoverageSummary(run: any) {\n const coverage = run?.routeCoverage;\n const status = String(run?.status || run?.phase || 'unknown');\n if (!coverage) return 'Witness status: ' + status + '. Route coverage was not returned by this runner; full-family completion is unverified.';\n const inspected = Array.isArray(coverage.inspected) ? coverage.inspected : [];\n const failed = Array.isArray(coverage.failed) ? coverage.failed : [];\n const skipped = Array.isArray(coverage.skipped) ? coverage.skipped : [];\n const pending = Array.isArray(coverage.pending) ? coverage.pending : [];\n const list = (items: any[]) => items.map(item => String(item.route) + ' [' + String(item.viewport || 'unknown viewport') + ']').join(', ') || 'none';\n return [\n 'Witness status: ' + status + '.',\n 'Coverage: ' + inspected.length + ' route/viewport checks; ' + failed.length + ' with findings; ' + skipped.length + ' skipped; ' + pending.length + ' pending.',\n 'Inspected: ' + list(inspected) + '.',\n 'Findings: ' + list(failed) + '.',\n 'Skipped: ' + list(skipped) + '.',\n pending.length ? 'Pending: ' + list(pending) + '.' : '',\n coverage.fullFamilyVerified === true ? 'Registered route-family coverage verified.' : 'Full registered route-family coverage is not verified. ' + String(coverage.limitation || 'The runner reported discovered links only.'),\n ].filter(Boolean).join('\\n');\n}\n\nfunction operatorProgressText(data: any) {\n const receipt = data?.receipt || {};\n const phase = String(receipt?.ownerFacingState || receipt?.latestProgress?.message || receipt?.jobProgress?.phase || receipt?.phase || receipt?.status || data?.message || '').trim();\n return phase ? phase.replaceAll('_', ' ') : 'Job is still running.';\n}\n\nfunction parseStoredConsoleTurn(raw: unknown): any {\n if (raw && typeof raw === 'object') return raw;\n const text = String(raw || '');\n try { return JSON.parse(text); } catch { return { assistant_message: text }; }\n}\n\nfunction consoleSessionTitle(row: any) {\n const payload = parseStoredConsoleTurn(row?.first_message);\n return String(payload?.user_message || row?.event_title || 'Console session').trim().slice(0, 110);\n}\n\nfunction consoleSessionRoute(row: any) {\n const payload = parseStoredConsoleTurn(row?.last_message);\n return String(payload?.route || payload?.witness?.currentRoute || payload?.witness?.route || '').trim();\n}\n\nfunction runRoute(row: any) {\n const context = row?.mission_context && typeof row.mission_context === 'object' ? row.mission_context : {};\n const receipt = row?.latest_receipt && typeof row.latest_receipt === 'object' ? row.latest_receipt : {};\n const payload = receipt?.payload && typeof receipt.payload === 'object' ? receipt.payload : {};\n return String(context.route || context.proofRoute || context.requestedRoute || payload.route || payload.requestedRoute || '').trim();\n}\n\nfunction isWitnessRequest(value: string, interactionMode: WitnessInteractionMode = 'observe') {\n const text = String(value || '').toLowerCase();\n const direct = /\\b(witness|visually|visual proof|screenshot|screen capture|capture|render|mobile view|desktop view|compare live|compare candidate)\\b/i.test(text);\n const verb = /\\b(analyz\\w*|analys\\w*|inspect|review|look at|take a look|tell me what you see|what do you see|show me|check out|watch|verify)\\b/i.test(text);\n const surface = /\\b(dashboard|page|screen|layout|route|workspace|website|site|app|application|mode|inventory|calendar|proposal|event|back office|form|viewer)\\b/i.test(text);\n const interaction = interactionMode !== 'observe' && /\\b(click|tap|open|press|type|fill|enter|select|check|submit|save|confirm|interact|try)\\b/i.test(text);\n return direct || interaction || isRouteFamilyRequest(text) || (verb && surface);\n}\n\nfunction isExecutionRequest(value: string) {\n const text = String(value || '').trim().toLowerCase();\n return /^(?:please\\s+)?(?:fix|repair|change|implement|build|add|remove|update|deploy|ship|merge|release|make|handle)\\b/i.test(text)\n || /^(?:accept|approve|reject|discard|revise)\\s+(?:the\\s+)?candidate\\b/i.test(text)\n || /^(?:do it|make it happen|handle it|cancel|stop|status|poll|progress|where are we|continue|keep going)[?.!\\s]*$/i.test(text);\n}\n\nfunction isCapabilityStrategyQuestion(value: string) {\n const text = String(value || '').trim().toLowerCase();\n if (!text) return false;\n if (/\\bwhat\\s+(?:can|can't|cant|cannot)\\s+you\\s+do\\b|\\bwhat\\s+are\\s+your\\s+(?:capabilities|limits|limitations)\\b/.test(text)) return true;\n if (/\\b(?:can|could|would)\\s+(?:i|we)\\s+(?:use|rely\\s+on|depend\\s+on)\\s+you\\b|\\bare\\s+you\\s+(?:able|capable)\\b/.test(text)) return true;\n if (/\\bcan\\s+you\\s+replace\\s+(?:chatgpt|openai)\\b|\\bcan\\s+you\\s+replace\\s+it\\s+on\\s+(?:a\\s+)?(?:daily|day-to-day)\\s+basis\\b/.test(text)) return true;\n if (/\\bcan\\s+(?:i|we)\\s+(?:get\\s+rid\\s+of|cancel|stop\\s+paying\\s+for)\\s+(?:my\\s+)?(?:chatgpt|openai)(?:\\s+subscription)?\\b/.test(text)) return true;\n return false;\n}\n\nfunction isLastRunFollowup(value: string) {\n const text = String(value || '').trim().toLowerCase();\n return /\\b(?:what happened (?:on|with|during) )?(?:the )?(?:last|latest|previous|most recent) (?:witness )?run\\b/.test(text)\n || /\\b(?:status|result|results|evidence|errors?|issues?) (?:from|of|on) (?:the )?(?:last|latest|previous|most recent) (?:witness )?run\\b/.test(text);\n}\n\nfunction classifyConsoleIntent(value: string, wantsWitness: boolean): ConsoleIntentClass {\n const text = String(value || '').trim().toLowerCase();\n if (!wantsWitness && isCapabilityStrategyQuestion(text)) return 'conversation';\n if (wantsWitness) return 'route_inspection';\n const directOperation = /\\b(cancel|rerun|retry|reconcile|retire|restart|bootstrap|repair)\\b/i.test(text)\n && /\\b(queue|run|runner|workspace|tenant|storage|gate|pull request|pr)\\b/i.test(text);\n if (directOperation) return 'direct_operation';\n const repositoryMutation = /\\b(fix|change|update|implement|build|create|remove|replace|refactor|deploy|ship|make)\\b/i.test(text)\n && /\\b(code|source|repo|repository|frontend|backend|component|route|console|platform|tenant|workflow|logic|bug|ui|page)\\b/i.test(text);\n if (repositoryMutation) return 'repository_repair';\n if (/\\b(current|live|latest|today|status|health|running|queued|failed|deployment|release|runner|gate|pull request|pr|main|runtime)\\b/i.test(text)) return 'live_state_read';\n if (/\\b(what is|what are|how does|how do|explain|meaning|means|architecture|logic|policy|rule|preference|terminology|why do|why does)\\b/i.test(text)) return 'stable_context_read';\n return 'conversation';\n}\n\nfunction buildConsoleDecision(intentClass: ConsoleIntentClass, data: any, witnessRun: any, witnessReceipt: any): ConsoleDecision {\n const declared = data?.decision && typeof data.decision === 'object' ? data.decision : {};\n const receipt = data?.receipt || witnessRun || witnessReceipt || null;\n const selectedCommand = String(declared.selectedCommand || data?.selectedCommand || receipt?.command || receipt?.operation || (intentClass === 'route_inspection' && (witnessRun || witnessReceipt) ? 'inspect_route' : '')).trim();\n const selectedCapability = String(declared.selectedCapability || data?.selectedCapability || receipt?.capability || (intentClass === 'route_inspection' ? 'visual_witness' : '')).trim();\n const lifecycleState = String(declared.lifecycleState || data?.lifecycleState || receipt?.ownerFacingState || receipt?.phase || receipt?.status || 'requested').trim();\n const evidenceSource = String(declared.evidenceSource || data?.evidenceSource || receipt?.proofGate || receipt?.proof_gate || receipt?.source || '').trim();\n const missionId = String(declared.missionId || data?.missionId || receipt?.missionId || '').trim();\n const witnessJobId = String(declared.witnessJobId || witnessRun?.id || witnessRun?.supervisorId || witnessReceipt?.run?.id || witnessReceipt?.run?.supervisorId || '').trim();\n const transitions = declared.statusTransitions || data?.statusTransitions || receipt?.statusTransitions || [];\n return {\n intentClass,\n ...(selectedCommand ? { selectedCommand } : {}),\n ...(selectedCapability ? { selectedCapability } : {}),\n lifecycleState,\n ...(evidenceSource ? { evidenceSource } : {}),\n ...(missionId ? { missionId } : {}),\n ...(witnessJobId ? { witnessJobId } : {}),\n ...(Array.isArray(transitions) && transitions.length ? { statusTransitions: transitions.map(String).slice(-12) } : {}),\n };\n}\n\nfunction extractInternalRoute(value: string) {\n const urlMatch = String(value || '').match(/https?:\\/\\/[^\\s]+/i);\n if (urlMatch) {\n try {\n const url = new URL(urlMatch[0]);\n if (url.hostname.endsWith('knocklaunch.app')) return `${url.pathname}${url.search}`;\n } catch {}\n }\n const routeMatch = String(value || '').match(/(?:^|\\s)(\\/(?!\\/)[a-z0-9][^\\s,;]*)/i);\n return routeMatch?.[1]?.replace(/[.!?]+$/g, '') || '';\n}\n\nfunction bigPapisSurfaceRoute(text: string, dashboardRoute: string) {\n if (!dashboardRoute.startsWith('/big-papis/owner/')) return '';\n const value = String(text || '').toLowerCase();\n const base = '/big-papis/owner';\n if (/\\binventory\\b/.test(value)) return base + '/inventory';\n if (/\\bcalendar\\b|\\bschedule\\b/.test(value)) return base + '/calendar';\n if (/\\bproposal/.test(value)) return base + '/proposals';\n if (/\\bevent day\\b/.test(value)) return base + '/event-day';\n if (/\\bevents?\\b|\\bbooking\\b/.test(value)) return base + '/events';\n if (/\\bcustomer/.test(value)) return base + '/customers';\n if (/\\binvoice|payment|money\\b/.test(value)) return base + '/invoices';\n if (/\\bdocuments?\\b|\\bfiles?\\b/.test(value)) return base + '/documents';\n if (/\\bmessages?\\b|\\binbox\\b/.test(value)) return base + '/inbox';\n if (/\\bmail\\b|\\bemail\\b/.test(value)) return base + '/mail';\n if (/\\breports?\\b/.test(value)) return base + '/reports';\n if (/\\bsettings?\\b/.test(value)) return base + '/settings';\n return '';\n}\n\nfunction cleanConsoleError(value: unknown) {\n const raw = value instanceof Error ? value.message : String(value || 'KNOCKLAUNCH control plane is unavailable.');\n if (/repo session is not open|open a repo session in operator/i.test(raw)) return 'Repository access did not initialize through the current control plane.';\n if (/universal_runner_not_ready|laptop_sentinel|visual_witness_infrastructure|runner.*not.*ready|transport_exhausted|no console-compatible witness lane/i.test(raw)) {\n return 'The fresh visual check could not run right now, so I do not have new page evidence to report.';\n }\n return raw.replace(/^blocked by the sidekick execution lane:\\s*/i, '').slice(0, 500);\n}\n\n/** One shared Console UI. Provider credentials and owner tokens never cross the iframe boundary. */\nexport default function GodModeCommandConsole() {\n const frame = useRef(null);\n const { activeTenant } = useMultiTenant();\n\n const [messages, setMessages] = useState([]);\n const [sending, setSending] = useState(false);\n const [consoleError, setConsoleError] = useState(null);\n const [witnessMode, setWitnessMode] = useState(false);\n const [witnessInteractionMode, setWitnessInteractionMode] = useState('observe');\n const [mobilePane, setMobilePane] = useState<'witness' | 'chat'>('witness');\n const [operatorContext, setOperatorContext] = useState({ viewports: ['desktop'] });\n const [lastReceipt, setLastReceipt] = useState(null);\n const [draft, setDraft] = useState('');\n const [voiceListening, setVoiceListening] = useState(false);\n const [voiceError, setVoiceError] = useState(null);\n const recognitionRef = useRef(null);\n const voiceBaseDraftRef = useRef('');\n const cancelRequestedRef = useRef(false);\n const [activeJob, setActiveJob] = useState(null);\n const [cancellingJobId, setCancellingJobId] = useState('');\n const [resolverTrace, setResolverTrace] = useState({ status: 'idle' });\n const [historyOpen, setHistoryOpen] = useState(false);\n const [historyTab, setHistoryTab] = useState('live');\n const [historyQuery, setHistoryQuery] = useState('');\n const [historyLoading, setHistoryLoading] = useState(false);\n const [historyError, setHistoryError] = useState(null);\n const [sessionRows, setSessionRows] = useState([]);\n const [runRows, setRunRows] = useState([]);\n const [liveRows, setLiveRows] = useState([]);\n const [currentSessionId, setCurrentSessionId] = useState('');\n const sendInFlightRef = useRef(false);\n const sendRef = useRef<(prompt: string) => void>(() => undefined);\n const transcriptRef = useRef(null);\n const composerRef = useRef(null);\n\n const postWitnessSync = (context = operatorContext, receipt = lastReceipt) => {\n const target = frame.current?.contentWindow;\n if (!target) return;\n target.postMessage({ type: 'kl-witness-sync', context, receipt }, window.location.origin);\n };\n\n async function consoleAccessToken(refresh = false) {\n const sessionResult = refresh ? await supabase.auth.refreshSession() : await supabase.auth.getSession();\n const accessToken = sessionResult.data.session?.access_token;\n if (!accessToken) throw new Error('Sign in required');\n return accessToken;\n }\n\n async function consoleFetch(path: string, init: RequestInit = {}) {\n let lastResponse: Response | null = null;\n for (let attempt = 0; attempt < 2; attempt += 1) {\n const accessToken = await consoleAccessToken(attempt === 1);\n const headers = new Headers(init.headers || {});\n headers.set('Authorization', 'Bearer ' + accessToken);\n if (init.body && !headers.has('Content-Type')) headers.set('Content-Type', 'application/json');\n const response = await fetch(path, { ...init, headers, signal: init.signal || AbortSignal.timeout(30000) });\n lastResponse = response;\n if (response.status === 401 && attempt === 0) continue;\n const data = await response.json().catch(() => ({ error: 'Console backend returned invalid JSON' }));\n if (!response.ok || data?.ok === false || data?.error) throw new Error(data?.error || `Console backend returned ${response.status}`);\n return data;\n }\n throw new Error(`Console backend returned ${lastResponse?.status || 401}`);\n }\n\n async function persistConsoleTurn(args: {\n userMessage: string;\n assistantMessage: string;\n contextTenantId?: string | null;\n route?: string;\n tenantRef?: string;\n context?: Record;\n witness?: Record;\n }) {\n const rpc = await (supabase as any).rpc('append_console_session_turn', {\n _session_id: currentSessionId || null,\n _context_tenant_id: args.contextTenantId || null,\n _user_message: args.userMessage,\n _assistant_message: args.assistantMessage,\n _route: args.route || null,\n _tenant_ref: args.tenantRef || null,\n _context: args.context || {},\n _witness: args.witness || {},\n });\n if (rpc?.error) throw rpc.error;\n const id = String(rpc?.data || '').trim();\n if (id) {\n setCurrentSessionId(id);\n window.sessionStorage.setItem('kl-console-session-v1', id);\n }\n return id;\n }\n\n async function refreshConsoleHistory(tab = historyTab, query = historyQuery) {\n setHistoryLoading(true);\n setHistoryError(null);\n try {\n if (tab === 'live') {\n const activity = await consoleFetch('/__knocklaunch/console/witness/activity', { method: 'GET' });\n const rows = [activity?.active, ...(Array.isArray(activity?.runs) ? activity.runs : [])].filter(Boolean);\n const deduped = rows.filter((run: any, index: number, all: any[]) => {\n const key = String(run?.id || run?.supervisorId || run?.jobId || run?.currentRoute || '');\n return all.findIndex((candidate: any) => String(candidate?.id || candidate?.supervisorId || candidate?.jobId || candidate?.currentRoute || '') === key) === index;\n });\n setLiveRows(deduped);\n } else if (tab === 'chats') {\n const rpc = await (supabase as any).rpc('list_console_sessions', { _query: query || null, _limit: 150 });\n if (rpc?.error) throw rpc.error;\n setSessionRows(Array.isArray(rpc?.data) ? rpc.data : []);\n } else {\n const rpc = await (supabase as any).rpc('search_console_runs', { _query: query || null, _limit: 150 });\n if (rpc?.error) throw rpc.error;\n setRunRows(Array.isArray(rpc?.data) ? rpc.data : []);\n }\n } catch (error) {\n setHistoryError(cleanConsoleError(error));\n } finally {\n setHistoryLoading(false);\n }\n }\n\n async function openConsoleSession(sessionId: string, closeDrawer = true) {\n if (sendInFlightRef.current || cancellingJobId) return;\n const rpc = await (supabase as any).rpc('get_console_session', { _session_id: sessionId });\n if (rpc?.error) {\n setHistoryError(cleanConsoleError(rpc.error));\n return;\n }\n const row = Array.isArray(rpc?.data) ? rpc.data[0] : rpc?.data;\n if (!row) {\n setHistoryError('Session not found.');\n return;\n }\n const turns = Array.isArray(row.turns) ? row.turns : [];\n const recovered: ConsoleMessage[] = [];\n for (const turn of turns) {\n const payload = parseStoredConsoleTurn(turn?.raw_message);\n const metadata = { ...(payload?.context || {}), ...(payload?.metadata || {}) };\n const fallbackAt = String(payload?.created_at || turn?.created_at || row?.created_at || '');\n if (String(payload?.user_message || '').trim()) recovered.push({ id: String(turn?.id || crypto.randomUUID()) + ':user', role: 'user', content: String(payload.user_message), createdAt: String(metadata?.userTimestamp || fallbackAt || '') });\n const progressLog = Array.isArray(metadata?.progressLog) ? metadata.progressLog : [];\n for (const [index, entry] of progressLog.entries()) {\n if (!String(entry?.content || '').trim()) continue;\n recovered.push({ id: String(turn?.id || crypto.randomUUID()) + ':progress:' + index, role: 'assistant', content: String(entry.content), createdAt: String(entry?.at || fallbackAt || ''), progress: true });\n }\n if (String(payload?.assistant_message || '').trim()) {\n const storedDecision = payload?.context?.decision || metadata?.decision || payload?.decision;\n recovered.push({ id: String(turn?.id || crypto.randomUUID()) + ':assistant', role: 'assistant', content: String(payload.assistant_message), createdAt: String(metadata?.assistantTimestamp || fallbackAt || ''), error: Boolean(metadata?.error), ...(storedDecision?.intentClass ? { decision: storedDecision as ConsoleDecision } : {}) });\n }\n }\n const lastPayload = turns.length ? parseStoredConsoleTurn(turns[turns.length - 1]?.raw_message) : {};\n setMessages(recovered);\n setCurrentSessionId(sessionId);\n window.sessionStorage.setItem('kl-console-session-v1', sessionId);\n setOperatorContext((previous) => ({\n ...previous,\n ...(lastPayload?.route ? { route: String(lastPayload.route) } : {}),\n ...(lastPayload?.tenant_ref ? { tenantRef: String(lastPayload.tenant_ref) } : {}),\n }));\n setResolverTrace({ status: 'idle' });\n setConsoleError(null);\n setWitnessMode(false);\n if (closeDrawer) setHistoryOpen(false);\n window.setTimeout(() => composerRef.current?.focus(), 0);\n }\n\n function openWitnessHistoryRun(run: any) {\n const route = String(run?.currentRoute || run?.route || '').trim();\n const nextContext = {\n ...operatorContext,\n ...(route ? { route } : {}),\n mode: 'witness',\n witnessRequested: true,\n witnessHistoryRunId: String(run?.id || run?.supervisorId || run?.jobId || ''),\n witnessHistoryLane: String(run?.runnerLane || run?.runtimeLane || ''),\n };\n setOperatorContext(nextContext);\n setLastReceipt(run);\n setWitnessMode(true);\n setMobilePane('witness');\n setHistoryOpen(false);\n window.setTimeout(() => postWitnessSync(nextContext, run), 100);\n }\n\n useEffect(() => {\n if (!historyOpen) return;\n const timer = window.setTimeout(() => { void refreshConsoleHistory(historyTab, historyQuery); }, 180);\n return () => window.clearTimeout(timer);\n }, [historyOpen, historyTab, historyQuery]);\n\n useEffect(() => {\n window.sessionStorage.removeItem('kl-console-session-v1');\n }, []);\n\n async function resolveConsoleTarget(text: string, wantsWitness: boolean): Promise {\n const explicitRoute = extractInternalRoute(text);\n if (explicitRoute) {\n const tenantRef = String(operatorContext.tenantRef || '');\n setResolverTrace({ status: 'resolved', query: text, tenantRef, confidence: 1, matchKind: 'explicit_route', route: explicitRoute });\n return { route: explicitRoute, tenantRef, tenant: null, confidence: 1, ambiguous: false };\n }\n\n if (!wantsWitness) {\n setResolverTrace({ status: 'idle' });\n return {\n route: String(operatorContext.route || ''),\n tenantRef: String(operatorContext.tenantRef || ''),\n tenant: null,\n confidence: 1,\n ambiguous: false,\n };\n }\n\n const routeFamilyRequest = isRouteFamilyRequest(text);\n const tenantHint = extractTenantReferenceHint(text);\n const candidates = routeFamilyRequest && !tenantHint && operatorContext.tenantRef\n ? [String(operatorContext.tenantRef)]\n : tenantReferenceCandidates(text);\n setResolverTrace({ status: 'resolving', query: tenantHint || text });\n const strongestByTenant = new Map();\n for (const query of candidates) {\n const rpc = await (supabase as any).rpc('resolve_console_tenant_context', { _tenant_ref: query });\n if (rpc?.error) {\n setResolverTrace({ status: 'error', query, message: cleanConsoleError(rpc.error) });\n throw rpc.error;\n }\n for (const match of (Array.isArray(rpc?.data) ? rpc.data : [])) {\n const key = String(match?.tenant_id || '');\n if (!key) continue;\n const current = strongestByTenant.get(key);\n if (!current || Number(match?.confidence || 0) > Number(current?.confidence || 0)) strongestByTenant.set(key, { ...match, resolved_query: query });\n }\n }\n const matches = [...strongestByTenant.values()].sort((a, b) => Number(b?.confidence || 0) - Number(a?.confidence || 0));\n const pinnedTenantRef = routeFamilyRequest && !tenantHint\n ? String(operatorContext.tenantRef || '').trim().toLowerCase()\n : '';\n const contextPinnedMatch = pinnedTenantRef\n ? matches.find((match) => [match?.tenant_id, match?.company_slug]\n .some((value) => String(value || '').trim().toLowerCase() === pinnedTenantRef))\n : null;\n const best = contextPinnedMatch || matches[0];\n const second = matches.find((match) => String(match?.tenant_id || '') !== String(best?.tenant_id || ''));\n const confidence = Number(best?.confidence || 0);\n const gap = confidence - Number(second?.confidence || 0);\n const strongKind = /exact|prefix|acronym|learned_alias/i.test(String(best?.match_kind || ''));\n const minimum = strongKind ? 0.68 : tenantHint ? 0.70 : 0.72;\n const exactFamilyTarget = routeFamilyRequest\n && Boolean(tenantHint)\n && /exact|learned_alias/i.test(String(best?.match_kind || ''))\n && confidence >= 0.80;\n const familyScopeAnchored = routeFamilyRequest && (Boolean(contextPinnedMatch) || exactFamilyTarget);\n const clear = Boolean(best?.tenant_id)\n && confidence >= minimum\n && (familyScopeAnchored || !second || gap >= 0.08);\n if (!clear) {\n const mayReuseContext = !tenantHint;\n const route = mayReuseContext ? String(operatorContext.route || '') : '';\n const tenantRef = mayReuseContext ? String(operatorContext.tenantRef || '') : '';\n setResolverTrace({\n status: 'ambiguous',\n query: tenantHint || text,\n tenantName: String(best?.tenant_name || ''),\n tenantRef: String(best?.company_slug || tenantRef),\n confidence,\n matchKind: String(best?.match_kind || ''),\n route,\n });\n return {\n route,\n tenantRef,\n tenant: null,\n confidence,\n ambiguous: matches.length > 1,\n };\n }\n\n const tenantResult = await (supabase as any)\n .from('tenants')\n .select('id,company_slug,tenant_type,name,company_dba_name,company_legal_name,settings')\n .eq('id', String(best.tenant_id))\n .maybeSingle();\n if (tenantResult?.error) throw tenantResult.error;\n const tenant = tenantResult?.data || {\n id: best.tenant_id,\n company_slug: best.company_slug,\n name: best.tenant_name,\n };\n const tenantRef = String(tenant.company_slug || best.company_slug || tenant.id || '');\n let route = '';\n if (wantsWitness) {\n try {\n const dashboardRoute = getTenantDashboardPathForTenant(tenant);\n route = routeFamilyRequest\n ? dashboardRoute\n : /\\b(dashboard|home|workspace|overview)\\b/i.test(text)\n ? dashboardRoute\n : bigPapisSurfaceRoute(text, dashboardRoute) || dashboardRoute;\n } catch {}\n }\n setResolverTrace({\n status: 'resolved',\n query: String(best?.resolved_query || tenantHint || text),\n tenantName: String(tenant.name || best?.tenant_name || ''),\n tenantRef,\n confidence,\n matchKind: String(best?.match_kind || ''),\n route,\n });\n return { route, tenantRef, tenant, confidence, ambiguous: false };\n }\n\n async function callConsoleOperator(message: string, context: ConsoleOperatorContext, agentTurn?: Record) {\n return consoleFetch('/__knocklaunch/console/operator', {\n method: 'POST',\n body: JSON.stringify({ message: message.slice(0, 2000), context, ...(agentTurn ? { agentTurn } : {}) }),\n });\n }\n\n async function callConsoleAnswer(message: string, context: ConsoleOperatorContext) {\n const { data, error } = await supabase.functions.invoke('operator-respond', {\n body: {\n action: 'console_answer',\n message: message.slice(0, 3000),\n sidekickContext: context,\n },\n });\n if (error) throw new Error(error.message || 'Sidekick answer generation failed.');\n if (!data?.ok) throw new Error(data?.error || 'Sidekick answer generation failed.');\n return data;\n }\n\n async function navigateWitness(route: string, tenantRef: string, viewport: string, objective: string, interactionMode: WitnessInteractionMode, routeFamily = false) {\n return consoleFetch('/__knocklaunch/console/witness/navigate', {\n method: 'POST',\n body: JSON.stringify({\n route: route.slice(0, 500),\n viewport: viewport === 'mobile' ? 'mobile' : 'desktop',\n tenantRef: tenantRef.slice(0, 200),\n objective: objective.slice(0, 1200),\n interactionMode,\n authorizedMutations: interactionMode === 'act',\n routeFamily,\n }),\n });\n }\n\n async function waitForWitnessObservation(runId: string, route: string, onProgress?: (content: string, stateKey: string) => void) {\n let lastMatch: any = null;\n let lastProgressKey = '';\n let lastProgressAt = Date.now();\n let consecutiveErrors = 0;\n for (let attempt = 0; attempt < 400; attempt += 1) {\n if (cancelRequestedRef.current) return lastMatch;\n try {\n const activity = await consoleFetch('/__knocklaunch/console/witness/activity', { method: 'GET' });\n const runs = [activity?.active, ...(Array.isArray(activity?.runs) ? activity.runs : [])].filter(Boolean);\n const match = runs.find((run: any) => runId && String(run?.id || run?.supervisorId || run?.jobId || '') === runId)\n || runs.find((run: any) => !runId && String(run?.currentRoute || '') === route);\n if (match) {\n lastMatch = match;\n const progressState = String(match?.jobProgress?.phase || match?.phase || match?.status || 'running').trim();\n const progressKey = [progressState, String(match?.currentRoute || ''), String(match?.currentViewport || ''), Boolean(match?.terminal)].join('|');\n if (progressState && (progressKey !== lastProgressKey || Date.now() - lastProgressAt >= 15000)) {\n lastProgressAt = Date.now();\n lastProgressKey = progressKey;\n onProgress?.(`Witness: ${progressState.replaceAll('_', ' ')} · ${String(match?.currentRoute || route)}${match?.currentViewport ? ` · ${String(match.currentViewport)}` : ''}. Still following this run until it ends.`, progressKey + ':' + Math.floor(Date.now() / 15000));\n }\n if (isTerminalOperatorData(match)) return match;\n }\n consecutiveErrors = 0;\n if (!match && Date.now() - lastProgressAt >= 15000) {\n lastProgressAt = Date.now();\n onProgress?.('Waiting for the dispatched Witness run to report. Completion is not confirmed.', 'witness:waiting:' + attempt);\n }\n } catch (error) {\n consecutiveErrors += 1;\n onProgress?.('Witness status unavailable: ' + cleanConsoleError(error) + ' The job may still be running.', 'witness:status-error:' + consecutiveErrors);\n if (consecutiveErrors >= 3) return lastMatch;\n }\n await new Promise((resolve) => window.setTimeout(resolve, 2500));\n if (cancelRequestedRef.current) return lastMatch;\n }\n return lastMatch;\n }\n\n function formatWitnessObservation(run: any) {\n const observation = run?.observation || {};\n return {\n runId: String(run?.id || ''),\n route: String(observation?.route || run?.currentRoute || ''),\n finalUrl: String(observation?.finalUrl || ''),\n title: String(observation?.title || ''),\n headings: Array.isArray(observation?.headings) ? observation.headings.filter(Boolean).slice(0, 16) : [],\n visibleText: String(observation?.bodyText || '').replace(/\\s+/g, ' ').trim().slice(0, 7000),\n controlsDiscovered: Number(observation?.controlsDiscovered || 0),\n issues: Array.isArray(observation?.issues) ? observation.issues.slice(0, 12) : [],\n consoleErrors: Array.isArray(observation?.consoleErrors) ? observation.consoleErrors.slice(0, 8) : [],\n failedRequests: Array.isArray(observation?.failedRequests) ? observation.failedRequests.slice(0, 8) : [],\n routeCoverage: run?.routeCoverage || null,\n terminal: Boolean(run?.terminal),\n status: String(run?.status || ''),\n phase: String(run?.phase || ''),\n runnerLane: String(run?.runnerLane || run?.runtimeLane || ''),\n };\n }\n\n async function followOperatorProgress(initialData: any, initialContext: ConsoleOperatorContext, agentTurn: Record, onProgress: (content: string, stateKey: string) => void) {\n let data = initialData;\n let context = (data?.context && typeof data.context === 'object') ? { ...initialContext, ...data.context } : initialContext;\n let lastSignature = '';\n let lastProgressAt = 0;\n for (let attempt = 0; attempt < 400; attempt += 1) {\n if (cancelRequestedRef.current) break;\n const receipt = data?.receipt || {};\n const activeId = String(context?.missionId || context?.jobId || receipt?.missionId || receipt?.jobId || data?.missionId || data?.jobId || '').trim();\n if (!activeId || isTerminalOperatorData(data)) break;\n const signature = [operatorProgressText(data), String(receipt?.phase || ''), String(receipt?.status || ''), String(receipt?.ownerFacingState || '')].join('|');\n if (signature !== lastSignature || Date.now() - lastProgressAt >= 15000) {\n lastSignature = signature;\n lastProgressAt = Date.now();\n onProgress(operatorProgressText(data), signature + ':' + Math.floor(Date.now() / 15000));\n }\n await new Promise((resolve) => window.setTimeout(resolve, 2500));\n if (cancelRequestedRef.current) break;\n data = await callConsoleOperator('status', { ...context, statusOnly: true }, { ...agentTurn, statusOnly: true });\n context = (data?.context && typeof data.context === 'object') ? { ...context, ...data.context } : context;\n }\n return { data, context };\n }\n\n async function cancelMissionLedger(missionId: string) {\n const data = await callConsoleOperator(\n `Cancel durable mission ${missionId}`,\n { ...operatorContext, missionId, cancelTarget: { kind: 'mission', missionId } },\n { intentClass: 'direct_operation', selectedCommand: 'mission_cancel', exactMissionId: missionId, cancelReason: 'owner_cancelled_from_console', ownerCancellation: true },\n );\n if (data?.ok === false || data?.error) throw new Error(data?.error || data?.reason || 'Mission cancellation failed.');\n const state = String(data?.receipt?.status || data?.mission?.status || data?.status || '').toLowerCase();\n const terminalCancelled = data?.terminal === true && ['cancelled', 'canceled'].includes(state);\n if (!terminalCancelled && !['cancelled', 'canceled'].includes(state)) throw new Error('Mission ledger did not confirm terminal cancellation.');\n return data;\n }\n\n async function cancelForgejoRun(runId: string) {\n const numeric = Number(runId);\n if (!Number.isInteger(numeric) || numeric < 1) throw new Error('A valid Forgejo run ID is required.');\n const data = await callConsoleOperator(`Cancel Forgejo Actions run ${numeric}`, { ...operatorContext, forgejoRunId: numeric, cancelTarget: { kind: 'forgejo', runId: numeric } }, { intentClass: 'direct_operation', selectedCommand: 'forgejo_action_run_cancel', exactRunId: numeric, ownerCancellation: true });\n if (data?.ok === false || data?.error) throw new Error(data?.error || 'Forgejo cancellation failed.');\n return data;\n }\n\n async function cancelWitnessJob(jobId: string) {\n const result = await consoleFetch('/__knocklaunch/console/witness/cancel', { method: 'POST', body: JSON.stringify({ runId: jobId }) });\n if (result?.run?.stopConfirmed === true) return { ...result, status: 'cancelled' };\n for (let attempt = 0; attempt < 30; attempt += 1) {\n await new Promise(resolve => window.setTimeout(resolve, 1000));\n const activity = await consoleFetch('/__knocklaunch/console/witness/activity');\n const run = [activity?.active, ...(activity?.runs || [])].find(item => String(item?.id || '') === jobId);\n if (run?.stopConfirmed === true) return { ok: true, status: 'cancelled', run };\n if (run?.terminal && run?.status !== 'cancelled') throw new Error('The job ended as ' + String(run.status) + '; it was not cancelled.');\n }\n throw new Error('Stop was requested but the runner has not confirmed termination. Use Current jobs to inspect or retry.');\n }\n\n async function cancelConsoleJob(job: ActiveConsoleJob) {\n if (!job?.id || cancellingJobId) return;\n cancelRequestedRef.current = true;\n setCancellingJobId(job.id);\n const requestedAt = nowIso();\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: `Stop requested · ${job.label || job.kind} · ${job.id}.`, createdAt: requestedAt, progress: true }]);\n try {\n let childReceipt: any = null;\n if (job.kind === 'witness') childReceipt = await cancelWitnessJob(job.id);\n if (job.kind === 'forgejo') childReceipt = await cancelForgejoRun(job.id);\n if (job.kind === 'mission' && job.workflowRunId) childReceipt = await cancelForgejoRun(job.workflowRunId);\n const missionReceipt = job.kind === 'mission' ? await cancelMissionLedger(job.missionId || job.id) : null;\n const cancellationReceipt = missionReceipt || childReceipt;\n const receiptState = String(cancellationReceipt?.receipt?.status || cancellationReceipt?.mission?.status || cancellationReceipt?.status || '').toLowerCase();\n if (!['cancelled', 'canceled'].includes(receiptState)) throw new Error('Cancellation was requested, but a cancelled terminal receipt has not been confirmed. The job remains available to inspect or stop.');\n // A mission without a separately identified child execution is fully stopped by its canonical terminal cancellation receipt.\n const confirmedAt = nowIso();\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: `Cancelled · ${job.label || job.kind} · ${job.id}.`, createdAt: confirmedAt, progress: true }]);\n setActiveJob((current) => current?.id === job.id ? null : current);\n try {\n await persistConsoleTurn({\n userMessage: `Stop ${job.kind} ${job.id}`,\n assistantMessage: `Cancelled ${job.kind} ${job.id}`,\n contextTenantId: String(activeTenant?.id || '') || null,\n route: String(operatorContext.route || ''),\n tenantRef: String(operatorContext.tenantRef || ''),\n context: { consoleSurface: 'sidekick-v4-native-operator', cancellation: { requestedAt, confirmedAt, kind: job.kind, id: job.id, missionId: job.missionId || null, workflowRunId: job.workflowRunId || null, childReceipt: childReceipt || null, missionReceipt: missionReceipt || null } },\n witness: {},\n });\n } catch {}\n if (historyOpen) void refreshConsoleHistory(historyTab, historyQuery);\n } catch (error) {\n const message = `Stop failed · ${cleanConsoleError(error)}`;\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: message, createdAt: nowIso(), error: true }]);\n cancelRequestedRef.current = false;\n } finally {\n setCancellingJobId('');\n }\n }\n\n function requestConsoleStop() {\n cancelRequestedRef.current = true;\n if (activeJob) { void cancelConsoleJob(activeJob); return; }\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: 'Stop requested. Waiting for any in-flight dispatch receipt so its job can be cancelled; stopping is not yet confirmed.', createdAt: nowIso(), progress: true }]);\n }\n\n function fallbackWitnessSummary(observation: any) {\n const headings = Array.isArray(observation?.headings) ? observation.headings.filter(Boolean) : [];\n const title = String(observation?.title || 'the requested page').trim();\n const visible = String(observation?.visibleText || '').replace(/\\s+/g, ' ').trim();\n const issueCount = Array.isArray(observation?.issues) ? observation.issues.length : 0;\n const parts = [`I observed ${title} on ${observation?.route || 'the requested route'}.`];\n if (headings.length) parts.push(`Visible sections: ${headings.join(', ')}.`);\n if (visible) parts.push(`Visible content included: ${visible.slice(0, 650)}${visible.length > 650 ? '…' : ''}`);\n parts.push(issueCount ? `The Witness detected ${issueCount} issue${issueCount === 1 ? '' : 's'} during the observation.` : 'The Witness did not report a page-level issue during this observation.');\n return parts.join(' ');\n }\n\n async function sendConsolePrompt(prompt: string) {\n const text = String(prompt || '').trim();\n if (/^(?:please\\s+)?(?:stop|cancel)(?:\\s+(?:it|this|the current job))?[.!?]*$/i.test(text) && (sendInFlightRef.current || activeJob)) {\n requestConsoleStop();\n return;\n }\n if (!text || sendInFlightRef.current || cancellingJobId) return;\n sendInFlightRef.current = true;\n const explicitRoute = extractInternalRoute(text);\n const executionRequest = isExecutionRequest(text);\n const wantsWitness = !executionRequest && (Boolean(explicitRoute) || isWitnessRequest(text, witnessInteractionMode));\n const intentClass = classifyConsoleIntent(text, wantsWitness);\n const userTimestamp = nowIso();\n const progressLog: ConsoleProgressEntry[] = [];\n const progressKeys = new Set();\n const pushProgress = (content: string, stateKey: string) => {\n const clean = String(content || '').trim();\n if (!clean || cancelRequestedRef.current || progressKeys.has(stateKey)) return;\n progressKeys.add(stateKey);\n const entry = { at: nowIso(), content: clean, stateKey };\n progressLog.push(entry);\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: clean, createdAt: entry.at, progress: true }]);\n };\n const progressEnabled = wantsWitness || intentClass === 'direct_operation' || intentClass === 'repository_repair';\n cancelRequestedRef.current = false;\n setActiveJob(null);\n setConsoleError(null);\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'user', content: text, createdAt: userTimestamp }]);\n if (progressEnabled) pushProgress(wantsWitness ? 'Starting witness job · resolving the requested tenant and route.' : 'Starting job · routing the request through the live KNOCKLAUNCH operator.', 'job:start');\n setSending(true);\n\n try {\n if (isLastRunFollowup(text)) {\n const activity = await consoleFetch('/__knocklaunch/console/witness/activity', { method: 'GET' });\n const activityRuns = [activity?.active, ...(Array.isArray(activity?.runs) ? activity.runs : [])].filter(Boolean);\n const rememberedRun = lastReceipt?.run || lastReceipt;\n const run = activityRuns[0] || (rememberedRun && typeof rememberedRun === 'object' ? rememberedRun : null);\n if (!run) {\n setResolverTrace({ status: 'idle' });\n const assistantMessage = 'There is no witness run in this session yet.';\n const assistantTimestamp = nowIso();\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: assistantMessage, createdAt: assistantTimestamp }]);\n await persistConsoleTurn({\n userMessage: text,\n assistantMessage,\n contextTenantId: String(activeTenant?.id || '') || null,\n route: String(operatorContext.route || ''),\n tenantRef: String(operatorContext.tenantRef || ''),\n context: { consoleSurface: 'sidekick-v3-session-history', followup: 'last_witness_run', userTimestamp, assistantTimestamp, progressLog },\n witness: {},\n });\n return;\n }\n\n const observation = formatWitnessObservation(run);\n const route = String(observation.route || operatorContext.route || '');\n const viewport = String(run?.currentViewport || (operatorContext.viewports || ['desktop'])[0] || 'desktop');\n const status = String(run?.status || run?.phase || (run?.terminal ? 'complete' : 'running')).replaceAll('_', ' ');\n const issueDetails = [\n ...(Array.isArray(observation.issues) ? observation.issues : []),\n ...(Array.isArray(observation.consoleErrors) ? observation.consoleErrors : []),\n ...(Array.isArray(observation.failedRequests) ? observation.failedRequests : []),\n ].map((item) => typeof item === 'string' ? item : JSON.stringify(item)).filter(Boolean).slice(0, 3);\n const evidenceSummary = observation.visibleText || observation.headings.length\n ? fallbackWitnessSummary(observation)\n : 'No accepted page observation text was captured for that run.';\n const assistantMessage = [\n `Last witness run: ${route || 'route unavailable'} · ${viewport} · ${status}.`,\n evidenceSummary,\n issueDetails.length ? `Issues: ${issueDetails.join(' | ')}` : '',\n ].filter(Boolean).join(' ');\n setResolverTrace({\n status: 'resolved',\n query: text,\n tenantRef: String(operatorContext.tenantRef || ''),\n confidence: 1,\n matchKind: 'last_witness_run',\n route,\n });\n setLastReceipt(run);\n const assistantTimestamp = nowIso();\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: assistantMessage, createdAt: assistantTimestamp }]);\n await persistConsoleTurn({\n userMessage: text,\n assistantMessage,\n contextTenantId: String(activeTenant?.id || '') || null,\n route,\n tenantRef: String(operatorContext.tenantRef || ''),\n context: { consoleSurface: 'sidekick-v3-session-history', followup: 'last_witness_run', userTimestamp, assistantTimestamp, progressLog },\n witness: {\n runId: String(run?.id || run?.supervisorId || run?.jobId || ''),\n status: String(run?.status || ''),\n phase: String(run?.phase || ''),\n currentRoute: route,\n runnerLane: String(run?.runnerLane || run?.runtimeLane || ''),\n },\n });\n return;\n }\n\n const routeFamilyRequest = isRouteFamilyRequest(text);\n const inferred = await resolveConsoleTarget(text, wantsWitness || executionRequest);\n const inferredRoute = inferred.route;\n const inferredTenantRef = inferred.tenantRef;\n if (wantsWitness && inferredRoute) pushProgress(`Resolved ${String(inferred?.tenant?.name || inferredTenantRef || 'target')} → ${inferredRoute}.`, `target:${inferredTenantRef}:${inferredRoute}`);\n if (wantsWitness && !inferredRoute) pushProgress('The named tenant or route is still genuinely ambiguous; I am not reusing the previous workspace.', 'target:ambiguous');\n const agentTurn = {\n version: 'knocklaunch-native-operator-v1',\n originalPrompt: text,\n intentClass,\n preserveOwnerPrompt: true,\n capabilitySource: 'live_command_registry',\n capabilityPolicy: 'registered_commands_only',\n stableContextCommand: 'owner_operating_context',\n liveReadPolicy: 'current_prime_truth',\n witnessCommand: 'inspect_route',\n witnessStatusCommand: 'inspect_route_status',\n repositoryMutationCommand: 'execute_objective',\n missionStatusCommand: 'mission_status',\n missionReceiptCommand: 'mission_receipt',\n directOperationPolicy: 'bounded_registered_operator_only',\n failClosed: true,\n lifecycleProofRequired: true,\n witnessInteractionMode,\n witnessAuthorizedMutations: witnessInteractionMode === 'act',\n target: { route: inferredRoute || null, tenantRef: inferredTenantRef || null, roleRef: String(operatorContext.roleRef || '') || null },\n };\n const baseContext: ConsoleOperatorContext = {\n ...operatorContext,\n ...(inferredRoute ? { route: inferredRoute } : {}),\n ...(inferredTenantRef ? { tenantRef: inferredTenantRef } : {}),\n ...((inferred?.tenant?.id || operatorContext.tenantId) ? { tenantId: String(inferred?.tenant?.id || operatorContext.tenantId) } : {}),\n mode: executionRequest ? 'execute' : wantsWitness ? 'witness' : 'chat',\n executionRequested: executionRequest,\n witnessRequested: wantsWitness,\n witnessInteractionMode,\n witnessAuthorizedMutations: witnessInteractionMode === 'act',\n consoleSurface: 'sidekick-v4-native-operator',\n agentTurn,\n legacyRepoSessionAllowed: false,\n recentConversation: messages.slice(-6).map((item) => ({ role: item.role, content: item.content.slice(0, 900) })),\n inferenceContract: 'owner-conversational-context-v3-live-registry',\n clarificationPolicy: 'ask_only_when_materially_ambiguous',\n intentConfidence: inferred.confidence,\n };\n\n if (cancelRequestedRef.current) return;\n setOperatorContext(baseContext);\n\n let witnessReceipt: any = null;\n let witnessRun: any = null;\n let witnessObservation: any = null;\n let pinnedContext = baseContext;\n if (wantsWitness && inferredRoute) {\n setWitnessMode(true);\n setMobilePane('witness');\n window.setTimeout(() => postWitnessSync(baseContext, null), 80);\n pushProgress(`Dispatching the ${String((baseContext.viewports || ['desktop'])[0])} witness to ${inferredRoute}.`, `witness:dispatch:${inferredRoute}:${String((baseContext.viewports || ['desktop'])[0])}`);\n witnessReceipt = await navigateWitness(inferredRoute,inferredTenantRef,String((baseContext.viewports || ['desktop'])[0]),text,witnessInteractionMode,routeFamilyRequest);\n const dispatchedRunId = String(witnessReceipt?.run?.id || witnessReceipt?.run?.supervisorId || '');\n if (dispatchedRunId) {\n const job: ActiveConsoleJob = { kind: 'witness', id: dispatchedRunId, label: inferredRoute };\n setActiveJob(job);\n if (cancelRequestedRef.current) { await cancelConsoleJob(job); return; }\n }\n pinnedContext = {...baseContext,witnessRunId:dispatchedRunId,witnessRunnerLane:String(witnessReceipt?.runnerLane || witnessReceipt?.run?.runnerLane || ''),witnessPinnedRoute:inferredRoute};\n setOperatorContext(pinnedContext);\n if (witnessReceipt) setLastReceipt(witnessReceipt);\n window.setTimeout(() => postWitnessSync(pinnedContext, witnessReceipt), 80);\n witnessRun = await waitForWitnessObservation(dispatchedRunId, inferredRoute, pushProgress);\n witnessObservation = witnessRun ? formatWitnessObservation(witnessRun) : null;\n if (witnessObservation?.visibleText || witnessObservation?.headings?.length) pushProgress('Observation captured · summarizing the actual page evidence now.', 'witness:observation-ready');\n if (witnessRun) setLastReceipt(witnessRun);\n window.setTimeout(() => postWitnessSync(pinnedContext, witnessRun || witnessReceipt), 80);\n } else if (wantsWitness) {\n setWitnessMode(true);\n setMobilePane('witness');\n }\n\n if (cancelRequestedRef.current) return;\n const witnessObservationReady = Boolean(witnessObservation?.visibleText || witnessObservation?.headings?.length);\n const operatorIntent = executionRequest\n || intentClass === 'stable_context_read'\n || intentClass === 'live_state_read'\n || intentClass === 'direct_operation'\n || intentClass === 'repository_repair';\n let data: any;\n let trackedContext = pinnedContext;\n if (operatorIntent) {\n if (progressEnabled) pushProgress(`Routing as ${intentClass.replaceAll('_', ' ')} through the live capability registry.`, `operator:route:${intentClass}`);\n data = await callConsoleOperator(text, { ...pinnedContext, agentTurn }, agentTurn);\n if (progressEnabled) {\n const initialReceipt = data?.receipt || {};\n const missionId = String(data?.context?.missionId || pinnedContext?.missionId || data?.missionId || initialReceipt?.missionId || '').trim();\n const workflowRunId = String(data?.context?.workflowRunId || pinnedContext?.workflowRunId || data?.workflowRunId || initialReceipt?.workflowRunId || '').trim();\n const jobId = String(data?.context?.jobId || pinnedContext?.jobId || data?.jobId || initialReceipt?.jobId || '').trim();\n if (missionId) setActiveJob({ kind: 'mission', id: missionId, missionId, workflowRunId: workflowRunId || undefined, label: intentClass.replaceAll('_', ' ') });\n else if (workflowRunId) setActiveJob({ kind: 'forgejo', id: workflowRunId, label: 'Forgejo Actions run' });\n else if (jobId) setActiveJob({ kind: 'witness', id: jobId, label: 'active job' });\n if (cancelRequestedRef.current) {\n if (missionId) await cancelConsoleJob({ kind: 'mission', id: missionId, missionId, workflowRunId: workflowRunId || undefined });\n else if (workflowRunId) await cancelConsoleJob({ kind: 'forgejo', id: workflowRunId });\n else if (jobId) await cancelConsoleJob({ kind: 'witness', id: jobId });\n return;\n }\n const tracked = await followOperatorProgress(data, pinnedContext, agentTurn, pushProgress);\n data = tracked.data;\n trackedContext = tracked.context;\n pushProgress(isTerminalOperatorData(data) ? 'The job reached a terminal state · preparing the grounded result.' : 'Completion is not confirmed. Any tracked job remains available to inspect or stop.', isTerminalOperatorData(data) ? 'operator:terminal' : 'operator:return');\n }\n } else if (wantsWitness && inferredRoute) {\n if (!isTerminalOperatorData(witnessRun || {})) {\n data = { ok: true, context: pinnedContext, receipt: witnessRun || witnessReceipt, message: 'Witness completion is not confirmed. The job may still be running; its Stop control remains available. Any captured page evidence is partial.' };\n } else if (routeFamilyRequest) {\n data = { ok: true, context: pinnedContext, receipt: witnessRun, message: formatRouteCoverageSummary(witnessRun) };\n } else if (!witnessObservationReady) {\n data = {\n ok: true,\n context: pinnedContext,\n receipt: witnessReceipt,\n message: `The fresh visual check reached ${inferredRoute}, but it did not return readable page evidence. I will not guess about what is on the page.`,\n };\n } else {\n const answerContext = {\n ...pinnedContext,\n agentTurn,\n witnessAlreadyDispatched: true,\n witnessObservationReady: true,\n witnessEvidenceAuthority: 'canonical_cc_execution_observation',\n trustedWitnessEvidence: witnessObservation,\n };\n try {\n data = await callConsoleAnswer(text, answerContext);\n } catch {\n data = { ok: true, context: pinnedContext, receipt: witnessReceipt, message: fallbackWitnessSummary(witnessObservation) };\n }\n }\n } else if (wantsWitness) {\n data = {\n ok: true,\n context: pinnedContext,\n message: 'I could not resolve a single page to inspect, so I did not substitute a different route.',\n };\n } else {\n data = await callConsoleAnswer(text, {\n ...pinnedContext,\n agentTurn,\n witnessAlreadyDispatched: false,\n witnessObservationReady: false,\n trustedWitnessEvidence: null,\n });\n }\n\n const nextContext = (data?.context && typeof data.context === 'object')\n ? { ...trackedContext, ...data.context, ...(inferredRoute ? { route: inferredRoute } : {}), ...(inferredTenantRef ? { tenantRef: inferredTenantRef } : {}) }\n : trackedContext;\n setOperatorContext(nextContext);\n const receipt = data?.receipt ?? witnessReceipt ?? null;\n if (receipt) setLastReceipt(receipt);\n\n let assistantMessage = String(data?.message || '').trim();\n const dumbClarification = /which\\s+(?:big papi\\s+)?page|which page|say\\s+(?:inventory|calendar|proposals)|pick\\s+(?:a\\s+)?page|what page/i.test(assistantMessage);\n const wrongSurfaceProgress = inferredRoute !== '/admin/console' && (/^Inspecting\\s+\\/admin\\/console\\b/i.test(assistantMessage) || /^Inspecting\\b/i.test(assistantMessage) || /live frame will appear|inspection completes|standing by/i.test(assistantMessage));\n if (wantsWitness && inferredRoute && (dumbClarification || wrongSurfaceProgress || !assistantMessage)) {\n assistantMessage = witnessObservation ? fallbackWitnessSummary(witnessObservation) : `Witness reached ${inferredRoute}, but the observation payload was not available yet. I will not invent what it saw.`;\n }\n if (!assistantMessage) assistantMessage = witnessObservation ? fallbackWitnessSummary(witnessObservation) : 'The control plane returned no message.';\n if (cancelRequestedRef.current) return;\n const witnessTerminal = isTerminalOperatorData(witnessRun || {});\n if (wantsWitness && inferredRoute) {\n const state = witnessTerminal ? String(witnessRun?.status || witnessRun?.phase || 'terminal').replaceAll('_', ' ') : 'completion unconfirmed';\n pushProgress(`Witness: ${state}.`, 'witness:result:' + state);\n if (!witnessTerminal || /failed|error|cancelled|canceled|timed_out/.test(String(witnessRun?.status || witnessRun?.phase || '').toLowerCase())) {\n assistantMessage = `Witness ${state}. ${assistantMessage}`;\n }\n }\n const decision = buildConsoleDecision(intentClass, data, witnessRun, witnessReceipt);\n const assistantTimestamp = nowIso();\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: assistantMessage, createdAt: assistantTimestamp, decision }]);\n\n try {\n await persistConsoleTurn({\n userMessage: text,\n assistantMessage,\n contextTenantId: String(inferred?.tenant?.id || activeTenant?.id || '') || null,\n route: String(nextContext.route || ''),\n tenantRef: String(nextContext.tenantRef || ''),\n context: {\n consoleSurface: 'sidekick-v4-native-operator',\n originalPrompt: text,\n witnessRequested: wantsWitness,\n intentConfidence: inferred.confidence,\n resolverMatch: resolverTrace.matchKind || null,\n intentClass,\n selectedCommand: decision.selectedCommand || null,\n selectedCapability: decision.selectedCapability || null,\n lifecycleState: decision.lifecycleState || 'requested',\n missionId: decision.missionId || null,\n witnessJobId: decision.witnessJobId || null,\n statusTransitions: decision.statusTransitions || [],\n userTimestamp,\n assistantTimestamp,\n progressLog,\n decision,\n },\n witness: {\n runId: String(witnessRun?.id || witnessReceipt?.run?.id || ''),\n status: String(witnessRun?.status || witnessReceipt?.run?.status || ''),\n phase: String(witnessRun?.phase || witnessReceipt?.run?.phase || ''),\n currentRoute: String(witnessRun?.currentRoute || nextContext.route || ''),\n runnerLane: String(witnessRun?.runnerLane || witnessReceipt?.runnerLane || ''),\n },\n });\n } catch (historySaveError) {\n setHistoryError('Session history save failed: ' + cleanConsoleError(historySaveError));\n }\n\n if (wantsWitness ? witnessTerminal : isTerminalOperatorData(data)) setActiveJob(null);\n if (wantsWitness) {\n setWitnessMode(true);\n window.setTimeout(() => postWitnessSync(nextContext, receipt), 180);\n window.setTimeout(() => postWitnessSync(nextContext, receipt), 800);\n }\n } catch (error) {\n const message = cleanConsoleError(error);\n setResolverTrace((current) => ({ ...current, status: 'error', message }));\n setConsoleError(message);\n const assistantTimestamp = nowIso();\n setMessages((prev) => [...prev, { id: crypto.randomUUID(), role: 'assistant', content: message, createdAt: assistantTimestamp, error: true }]);\n try {\n await persistConsoleTurn({\n userMessage: text,\n assistantMessage: message,\n contextTenantId: String(activeTenant?.id || '') || null,\n route: String(operatorContext.route || ''),\n tenantRef: String(operatorContext.tenantRef || ''),\n context: { consoleSurface: 'sidekick-v4-native-operator', error: true, userTimestamp, assistantTimestamp, progressLog },\n witness: {},\n });\n } catch (historySaveError) {\n setHistoryError('Session history save failed: ' + cleanConsoleError(historySaveError));\n }\n } finally {\n sendInFlightRef.current = false;\n setSending(false);\n }\n }\n\n useEffect(() => {\n sendRef.current = (prompt: string) => { void sendConsolePrompt(prompt); };\n });\n\n useEffect(() => {\n const handleConsoleSend = (event: Event) => {\n const prompt = String((event as CustomEvent<{ prompt?: string }>).detail?.prompt || '').trim();\n if (prompt) sendRef.current(prompt);\n };\n const handleConsoleFocus = () => window.setTimeout(() => composerRef.current?.focus(), 0);\n window.addEventListener('knocklaunch:console-assistant:send', handleConsoleSend as EventListener);\n window.addEventListener('knocklaunch:console-assistant:focus', handleConsoleFocus);\n return () => {\n window.removeEventListener('knocklaunch:console-assistant:send', handleConsoleSend as EventListener);\n window.removeEventListener('knocklaunch:console-assistant:focus', handleConsoleFocus);\n };\n }, []);\n\n useEffect(() => {\n const node = transcriptRef.current;\n if (node) node.scrollTop = node.scrollHeight;\n }, [messages, sending, witnessMode]);\n\n useEffect(() => {\n const pending = new Set();\n const handle = async (event: MessageEvent) => {\n if (event.origin !== window.location.origin || event.source !== frame.current?.contentWindow) return;\n const { type, id, action, payload } = event.data || {};\n const allowed = ['cloudflare','supabase','forgejo','runner-proof','operator','witness','witness-activity','witness-route'];\n if (type !== 'kl-console-request' || typeof id !== 'string' || id.length > 80 || !allowed.includes(action) || pending.has(action)) return;\n pending.add(action);\n try {\n let data: any;\n if (action === 'witness-activity') {\n data = await consoleFetch('/__knocklaunch/console/witness/activity', { method: 'GET' });\n } else if (action === 'witness-route') {\n const tenantRef = String(payload?.tenantRef || operatorContext.tenantRef || activeTenant?.company_slug || activeTenant?.id || '').slice(0, 200);\n data = await consoleFetch('/__knocklaunch/console/witness/navigate', {\n method: 'POST',\n body: JSON.stringify({\n route: String(payload?.route || '').slice(0, 500),\n viewport: payload?.viewport === 'mobile' ? 'mobile' : 'desktop',\n tenantRef,\n }),\n });\n } else if (action === 'operator') {\n data = await callConsoleOperator(String(payload?.message || ''), payload?.context || {});\n } else if (action === 'witness') {\n data = await consoleFetch('/__knocklaunch/console/witness', { method: 'GET' });\n } else if (action === 'forgejo' || action === 'runner-proof') {\n data = await consoleFetch('/__knocklaunch/console/forgejo', {\n method: 'POST',\n body: JSON.stringify({ action }),\n });\n } else {\n const result = await supabase.functions.invoke('console-ops', { body: { action } });\n if (result.error || result.data?.error) throw new Error(result.error?.message || result.data.error);\n data = result.data;\n }\n frame.current?.contentWindow?.postMessage({ type:'kl-console-result', id, data }, window.location.origin);\n } catch (error) {\n frame.current?.contentWindow?.postMessage({ type:'kl-console-result', id, error:error instanceof Error ? error.message : 'Provider unavailable' }, window.location.origin);\n } finally {\n pending.delete(action);\n }\n };\n window.addEventListener('message', handle);\n return () => window.removeEventListener('message', handle);\n }, [operatorContext.tenantRef, activeTenant?.company_slug, activeTenant?.id]);\n\n\n\n const toggleVoiceToText = () => {\n if (voiceListening) {\n recognitionRef.current?.stop?.();\n return;\n }\n const Recognition = (window as any).SpeechRecognition || (window as any).webkitSpeechRecognition;\n if (!Recognition) {\n setVoiceError('Voice-to-text is not supported by this browser.');\n return;\n }\n setVoiceError(null);\n const recognition = new Recognition();\n voiceBaseDraftRef.current = draft.trimEnd();\n recognition.continuous = true;\n recognition.interimResults = true;\n recognition.lang = navigator.language || 'en-US';\n recognition.onresult = (event: any) => {\n let finalText = '';\n let interimText = '';\n for (let index = 0; index < event.results.length; index += 1) {\n const result = event.results[index];\n const transcript = String(result?.[0]?.transcript || '').trim();\n if (!transcript) continue;\n if (result.isFinal) finalText += (finalText ? ' ' : '') + transcript;\n else interimText += (interimText ? ' ' : '') + transcript;\n }\n const spoken = [finalText, interimText].filter(Boolean).join(' ').trim();\n const base = voiceBaseDraftRef.current;\n setDraft([base, spoken].filter(Boolean).join(base && spoken ? ' ' : ''));\n };\n recognition.onerror = (event: any) => {\n const code = String(event?.error || 'unavailable');\n if (code !== 'no-speech' && code !== 'aborted') setVoiceError(code === 'not-allowed' || code === 'service-not-allowed' ? 'Microphone access was denied. Allow microphone access for app.knocklaunch.app and try again.' : `Voice-to-text error: ${code.replaceAll('-', ' ')}.`);\n };\n recognition.onend = () => {\n recognitionRef.current = null;\n setVoiceListening(false);\n };\n recognitionRef.current = recognition;\n try {\n recognition.start();\n setVoiceListening(true);\n } catch (error) {\n recognitionRef.current = null;\n setVoiceListening(false);\n setVoiceError(cleanConsoleError(error));\n }\n };\n\n useEffect(() => () => {\n try { recognitionRef.current?.abort?.(); } catch {}\n recognitionRef.current = null;\n }, []);\n\n const submitDraft = () => {\n const prompt = draft.trim();\n if (!prompt) return;\n if (sending && !/^(?:please\\s+)?(?:stop|cancel)(?:\\s+(?:it|this|the current job))?[.!?]*$/i.test(prompt)) return;\n setDraft('');\n void sendConsolePrompt(prompt);\n };\n\n const clearConversation = () => {\n if (sendInFlightRef.current || cancellingJobId) return;\n const previousSessionId = currentSessionId;\n if (previousSessionId) {\n void (supabase as any).rpc('close_console_session', { _session_id: previousSessionId });\n }\n setCurrentSessionId('');\n window.sessionStorage.removeItem('kl-console-session-v1');\n setMessages([]);\n setOperatorContext({ viewports: ['desktop'] });\n setWitnessInteractionMode('observe');\n setWitnessMode(false);\n setConsoleError(null);\n setLastReceipt(null);\n setResolverTrace({ status: 'idle' });\n window.setTimeout(() => composerRef.current?.focus(), 0);\n };\n\n const toolChips = (\n
\n {['Repo', 'Forgejo', 'Cloudflare', 'Supabase', 'Witness'].map((label) => {label})}\n \n {([\n ['observe', 'Observe', 'View only'],\n ['interact', 'Interact', 'Safe reversible interaction'],\n ['act', 'Act', 'Explicit targeted action'],\n ] as const).map(([mode, label, title]) => {\n const active = witnessInteractionMode === mode;\n const activeClass = mode === 'act' ? 'border-amber-300/45 bg-amber-300/12 text-amber-100 shadow-[0_0_18px_rgba(252,211,77,.06)]' : 'border-cyan-300/40 bg-cyan-300/10 text-cyan-100 shadow-[0_0_18px_rgba(34,211,238,.08)]';\n return ;\n })}\n
\n );\n\n const resolverLabel = resolverTrace.status === 'idle' ? 'IDLE' : resolverTrace.status === 'resolving' ? 'RESOLVING' : resolverTrace.status === 'resolved' ? 'RESOLVED' : resolverTrace.status === 'ambiguous' ? 'AMBIGUOUS' : 'ERROR';\n const resolverStrip = (\n
\n Backend Resolver\n {resolverLabel}\n {resolverTrace.tenantName ? {resolverTrace.tenantName} : null}\n {typeof resolverTrace.confidence === 'number' ? {Math.round(resolverTrace.confidence * 100)}% : null}\n {resolverTrace.matchKind ? {resolverTrace.matchKind} : null}\n {resolverTrace.route ? → {resolverTrace.route} : null}\n {resolverTrace.message ? {resolverTrace.message} : null}\n
\n );\n\n const composer = (\n
{ event.preventDefault(); submitDraft(); }} className=\"shrink-0 border-t border-blue-300/10 bg-[#050914]/95 p-3 backdrop-blur-xl\">\n
\n setDraft(event.target.value)}\n onKeyDown={(event) => { if (event.key === 'Enter' && !event.shiftKey) { event.preventDefault(); submitDraft(); } }}\n rows={2}\n placeholder={witnessMode ? 'Tell Sidekick what to inspect, change, or verify…' : 'Ask KNOCKLAUNCH anything about the platform…'}\n className=\"max-h-36 min-h-[64px] w-full min-w-0 resize-none bg-transparent px-2 py-2 text-[14px] leading-6 text-slate-100 outline-none placeholder:text-slate-500 [overflow-wrap:anywhere]\"\n />\n
\n Enter sends · Shift+Enter adds a line · Mic dictates without sending\n
\n {sending || activeJob ? : null}\n \n \n
\n
\n {voiceError ?
{voiceError}
: null}\n
\n
\n );\n\n const transcript = (\n
\n
\n {!messages.length ? (\n
\n
SIDEKICK · GOD MODE
\n

KNOCKLAUNCH Console

\n

Chat with the platform normally. The interactive witness stays closed until you ask to see, inspect, capture, compare, or visually verify something.

\n
\n ) : null}\n {messages.map((message) => (\n
\n
{message.role === 'user' ? 'You' : message.progress ? 'KNOCKLAUNCH · PROGRESS' : 'KNOCKLAUNCH'}{message.createdAt ? : null}
\n

{message.content}

\n {message.role === 'assistant' && message.decision ?
Why this action?
intent: {message.decision.intentClass}command: {message.decision.selectedCommand || 'no command required'}state: {message.decision.lifecycleState || 'requested'}{message.decision.evidenceSource ? evidence: {message.decision.evidenceSource} : null}{message.decision.missionId ? mission: {message.decision.missionId} : null}{message.decision.witnessJobId ? witness: {message.decision.witnessJobId} : null}
: null}\n
\n ))}\n {sending ?
KNOCKLAUNCH is working…
: null}\n {consoleError && !messages.some((item) => item.error && item.content === consoleError) ?
{consoleError}
: null}\n
\n
\n );\n\n\n const visibleLiveRows = historyQuery.trim()\n ? liveRows.filter((run) => JSON.stringify(run).toLowerCase().includes(historyQuery.trim().toLowerCase()))\n : liveRows;\n\n const historyPanel = historyOpen ? (\n <>\n \n
\n
\n setHistoryQuery(event.target.value)}\n placeholder=\"Search chats, tenants, routes, run IDs, errors, proof…\"\n className=\"w-full bg-transparent text-xs text-white outline-none placeholder:text-white/28\"\n />\n
\n
\n {(['live','chats','runs'] as HistoryTab[]).map((tab) => (\n \n ))}\n
\n
\n\n
\n {historyLoading ?
Loading Console history…
: null}\n {historyError ?
{historyError}
: null}\n\n {!historyLoading && historyTab === 'live' ? (\n
\n {currentSessionId ? (\n \n ) : null}\n {visibleLiveRows.map((run: any) => {\n const witnessId = String(run?.id || run?.supervisorId || run?.jobId || '');\n return
\n
\n \n {!run?.terminal && witnessId ? : null}\n
\n
;\n })}\n {!currentSessionId && !visibleLiveRows.length ?
No active Console or Witness sessions right now.
: null}\n
\n ) : null}\n\n {!historyLoading && historyTab === 'chats' ? (\n
\n {sessionRows.map((row: any) => {\n const route = consoleSessionRoute(row);\n const isCurrent = String(row.session_id) === currentSessionId;\n return (\n \n );\n })}\n {!sessionRows.length ?
No matching Console chats.
: null}\n
\n ) : null}\n\n {!historyLoading && historyTab === 'runs' ? (\n
\n {runRows.map((row: any) => {\n const route = runRoute(row);\n const receipt = row?.latest_receipt || {};\n const terminal = ['verified','completed_with_findings','failed','cancelled','timed_out','blocked','superseded'].includes(String(row.mission_status || ''));\n const context = row?.mission_context && typeof row.mission_context === 'object' ? row.mission_context : {};\n const workflowRunId = String(context?.workflowRunId || context?.workflow_run_id || receipt?.payload?.workflowRunId || receipt?.payload?.workflow_run_id || '').trim();\n const missionId = String(row.run_id || '');\n return (\n
\n
\n {!terminal && missionId ? : null}\n
\n
\n );\n })}\n {!runRows.length ?
No matching Command Center runs.
: null}\n
\n ) : null}\n
\n \n \n ) : null;\n\n return
\n {!witnessMode ? (\n
\n
\n
Sidekick
\n
{toolChips}
\n \n \n
Witness closed
\n
\n {resolverStrip}\n {transcript}\n {composer}\n
\n ) : (\n
\n
\n
\n \n \n
\n
\n \n \n
\n
\n
\n
\n