Feat v0.7.4 docs surface work (#58)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

.gitea/workflows/ci.yaml

@@ -7,9 +7,10 @@
 #
 # Pipeline:
 #   0.  Detect changes (path-based gating for all downstream jobs)
-#   1a. Frontend tests   — skipped if only BE/docs changed
+#   1a. Frontend tests   — skipped if only BE/docs/packages changed
 #   1b. Go unit tests    — all non-DB packages + SQLite integration (race-enabled)
 #   1c. Go test (PG)     — PG store + handlers against Postgres (race-enabled)
+#   1d. Test runners     — disabled until v0.7.5 (Playwright headless fix)
 #   2.  Build + Deploy   — skipped if docs-only change
 #
 # Test coverage mapping (no package tested by zero jobs):
@@ -23,7 +24,9 @@
 # Path gating rules:
 #   src/, src/editor/          → frontend tests
 #   server/, scripts/db-*      → backend tests (PG + SQLite)
+#   packages/                  → test-runners (surface/extension tests)
 #   Dockerfile*, k8s/, .gitea/ → all tests (infra change)
+#   ci/                        → infra (CI scripts)
 #   docs/, *.md                → skip all tests + deploy
 #   VERSION, scripts/*         → frontend + backend tests
 #   Tags (v*)                  → always full pipeline
@@ -100,6 +103,7 @@ jobs:
     outputs:
       frontend: ${{ steps.filter.outputs.frontend }}
       backend:  ${{ steps.filter.outputs.backend }}
+      packages: ${{ steps.filter.outputs.packages }}
       infra:    ${{ steps.filter.outputs.infra }}
       docs_only: ${{ steps.filter.outputs.docs_only }}
     steps:
@@ -137,7 +141,7 @@ jobs:
           echo "${CHANGED}" | sed 's/^/  /'
 
           # Classify
-          FE=false; BE=false; INFRA=false; DOCS=false; OTHER=false
+          FE=false; BE=false; PKG=false; INFRA=false; DOCS=false; OTHER=false
           while IFS= read -r file; do
             [[ -z "$file" ]] && continue
             case "$file" in
@@ -145,19 +149,23 @@ jobs:
                 FE=true ;;
               server/*|scripts/db-*)
                 BE=true ;;
+              packages/*)
+                PKG=true ;;
               .gitea/*|k8s/*|Dockerfile*|docker-compose*|docker-entrypoint*|nginx.conf)
                 INFRA=true ;;
               docs/*|*.md|CHANGELOG.md|LICENSE)
                 DOCS=true ;;
               VERSION|scripts/*)
                 FE=true; BE=true ;;
+              ci/*)
+                INFRA=true ;;
               *)
                 OTHER=true ;;
             esac
           done <<< "${CHANGED}"
 
           # Docs-only: only docs changed, nothing else
-          if [[ "$DOCS" == "true" && "$FE" == "false" && "$BE" == "false" && "$INFRA" == "false" && "$OTHER" == "false" ]]; then
+          if [[ "$DOCS" == "true" && "$FE" == "false" && "$BE" == "false" && "$PKG" == "false" && "$INFRA" == "false" && "$OTHER" == "false" ]]; then
             DOCS_ONLY=true
           else
             DOCS_ONLY=false
@@ -165,6 +173,7 @@ jobs:
 
           echo "frontend=${FE}"        >> "$GITHUB_OUTPUT"
           echo "backend=${BE}"         >> "$GITHUB_OUTPUT"
+          echo "packages=${PKG}"       >> "$GITHUB_OUTPUT"
           echo "infra=${INFRA}"        >> "$GITHUB_OUTPUT"
           echo "docs_only=${DOCS_ONLY}" >> "$GITHUB_OUTPUT"
 
@@ -172,6 +181,7 @@ jobs:
           echo "━━━ Change Detection ━━━"
           echo "  frontend:  ${FE}"
           echo "  backend:   ${BE}"
+          echo "  packages:  ${PKG}"
           echo "  infra:     ${INFRA}"
           echo "  docs_only: ${DOCS_ONLY}"
 
@@ -366,6 +376,41 @@ jobs:
           psql -c "DROP DATABASE IF EXISTS armature_ci;" postgres
           echo "✓ Dropped CI test database"
 
+  # ── Stage 1d: Surface Test Runners ──────────
+  # Boots the server in Docker, runs all installed test-runner packages
+  # via Playwright, and asserts zero failures.
+  #
+  # DISABLED: Playwright driver can't find the Run All button in headless
+  # mode — likely a shell/SPA rendering issue.  Run manually from the
+  # test-runners surface after deploy until this is resolved.
+  # See: docker-compose.ci.yml, ci/surface-test-driver.js
+  #
+  # Runs when: backend, frontend, or packages changed (runners test all tiers).
+  # Skipped when: only docs changed.
+  test-runners:
+    runs-on: ubuntu-latest
+    needs: [detect-changes]
+    if: false  # disabled — see comment above. Condition for v0.7.5:
+    # needs.detect-changes.outputs.backend == 'true' || needs.detect-changes.outputs.frontend == 'true' || needs.detect-changes.outputs.packages == 'true' || needs.detect-changes.outputs.infra == 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run surface tests (compose)
+        env:
+          BUNDLED_PACKAGES: '*'
+          ARMATURE_ADMIN_USERNAME: admin
+          ARMATURE_ADMIN_PASSWORD: admin
+          ARMATURE_ADMIN_EMAIL: admin@test.local
+        run: |
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+            --abort-on-container-exit \
+            --exit-code-from test-runner
+
+      - name: Teardown
+        if: always()
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v
+
   # ── Stage 2: Build, Database, Deploy ─────────
   #
   # Depends on all test jobs. Skipped jobs (due to path gating)
@@ -374,7 +419,7 @@ jobs:
   # Skipped entirely for docs-only changes (nothing to build).
   build-and-deploy:
     runs-on: ubuntu-latest
-    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite]
+    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite, test-runners]
     # Run unless: a needed job failed, the workflow was cancelled, or it's docs-only.
     # Skipped test jobs (path-gated) are fine — they don't block.
     if: |
@@ -413,6 +458,7 @@ jobs:
             echo "MEMORY_LIMIT=512Mi"                        >> "$GITHUB_OUTPUT"
             echo "CPU_REQUEST=50m"                           >> "$GITHUB_OUTPUT"
             echo "CPU_LIMIT=250m"                            >> "$GITHUB_OUTPUT"
+            echo "BUNDLED_PACKAGES=*"                        >> "$GITHUB_OUTPUT"
             echo "env_label=dev (PR #${{ gitea.event.pull_request.number }})" >> "$GITHUB_OUTPUT"
           elif [[ "${{ gitea.ref }}" == refs/tags/v* ]]; then
             VERSION="${{ gitea.ref_name }}"
@@ -429,6 +475,7 @@ jobs:
             echo "MEMORY_LIMIT=512Mi"                        >> "$GITHUB_OUTPUT"
             echo "CPU_REQUEST=100m"                          >> "$GITHUB_OUTPUT"
             echo "CPU_LIMIT=500m"                            >> "$GITHUB_OUTPUT"
+            echo "BUNDLED_PACKAGES=notes,chat,chat-core,mermaid-renderer,schedules" >> "$GITHUB_OUTPUT"
             echo "is_release=true"                           >> "$GITHUB_OUTPUT"
             echo "env_label=production (${VERSION})"         >> "$GITHUB_OUTPUT"
           else
@@ -444,6 +491,7 @@ jobs:
             echo "MEMORY_LIMIT=512Mi"                        >> "$GITHUB_OUTPUT"
             echo "CPU_REQUEST=50m"                           >> "$GITHUB_OUTPUT"
             echo "CPU_LIMIT=250m"                            >> "$GITHUB_OUTPUT"
+            echo "BUNDLED_PACKAGES=notes,chat,chat-core"      >> "$GITHUB_OUTPUT"
             echo "env_label=test (main)"                     >> "$GITHUB_OUTPUT"
           fi
 
@@ -670,6 +718,7 @@ jobs:
           STORAGE_CLASS: ${{ vars.STORAGE_CLASS }}
           STORAGE_SIZE: ${{ vars.STORAGE_SIZE || '10Gi' }}
           STORAGE_BACKEND: ${{ vars.STORAGE_BACKEND || 'pvc' }}
+          BUNDLED_PACKAGES: ${{ steps.setup.outputs.BUNDLED_PACKAGES }}
         run: |
           # Render PVC first (must exist before backend references it)
           if [[ -n "${STORAGE_CLASS}" ]]; then

CHANGELOG.md

@@ -2,6 +2,230 @@
 
 All notable changes to Armature are documented here.
 
+## v0.7.4 — Documentation + Deferred Surface Work
+
+**Docs Category Grouping**
+- Backend `Category` field on `docEntry` struct in `server/handlers/docs.go`
+- Frontend sidebar groups docs by category with `.docs-category-heading` CSS
+- Four categories: Getting Started, Platform, Extension Development, Operations
+- 14 docs in ordered list (was 7 ordered + 3 auto-discovered)
+
+**New Documentation (4 guides)**
+- `PERMISSIONS-AND-GROUPS.md` — RBAC model, 7 permission slugs, system/custom groups, settings cascade, extension permissions
+- `WORKFLOWS.md` — Entry modes, stage modes/types/audiences, signoff gates, SLA enforcement, branch rules, Starlark hooks
+- `STARLARK-REFERENCE.md` — Sandbox constraints, 10 modules with function signatures and permission gates, example hook script
+- `FRONTEND-JS-GUIDE.md` — Preact+htm runtime, 16 SDK modules with API reference, shell topbar patterns, CSS contract
+
+**Extension Guide Updates**
+- `config_section` manifest field documented: schema, backend discovery (`configSectionsForSurface()`), frontend `__CONFIG_SECTIONS__` contract, example component
+- Starlark Sandbox API section replaced with pointer to new Starlark Reference
+
+**Docs Content Refresh**
+- GETTING-STARTED: `sb_data` → `armature_data` volume name
+- ARCHITECTURE: `sb.register()`/`sb.ns()` → `sw` SDK references, shell topbar mention
+- DEPLOYMENT: `sb_storage` → `armature_storage`, added `TLS_MODE` env var
+- TUTORIAL-FIRST-EXTENSION: `--bg-2` → `--bg-secondary` CSS variable
+- EXTENSION-CSS: self-hosted font notes on `--font` and `--mono`
+- `docs.go`: added `AUDIT-` and `USABILITY-` prefix filters for auto-discovery
+
+**Team Admin Workflows Split**
+- `workflows.js` (722 lines) split into 3 ES modules:
+  - `workflows.js` (~160 lines) — `WorkflowsSection` + `WorkflowsTab` + imports
+  - `workflow-editor.js` (~240 lines) — `WorkflowEditor` + `StageForm`
+  - `workflow-monitor.js` (~210 lines) — `AssignmentsTab` + `MonitorTab` + `SignoffPanel`
+- External import contract unchanged (default export stays in `workflows.js`)
+
+**Bug Fixes**
+- Docs outline `scrollToHeading` now scrolls `.docs-content` container instead of `scrollIntoView`, preventing topbar from being pushed off-screen
+- `--bg-2` (undefined CSS variable) replaced with `--bg-secondary` in `sw-shell.css` and `sw-primitives.css`
+
+## v0.7.3 — Extension Shell Migration
+
+**Shell Topbar Migration**
+- Migrated Chat, Notes, and Schedules from legacy `sw.shell.Topbar` component to the v0.7.0 shell topbar contract (`sw.shell.topbar.setTitle/setSlot`)
+- Eliminated double topbar (shell-injected + surface-owned) on all three extension surfaces
+- Chat: reactive slot updates for thread title + People button when conversation changes
+- Notes: slot content for + New Note, Import .md, and Graph toggle buttons
+- Schedules: reactive slot with schedule count and + New Schedule button; removed legacy fallback branch
+
+**Runner Test Updates**
+- Added `shell-topbar` test suite to chat-runner, notes-runner, and schedules-runner
+- Tests fetch surface JS and assert: no legacy `sw.shell.Topbar` reference, uses `sw.shell.topbar.setTitle/setSlot` API
+- 6 new tests across 3 runners
+
+**Package Versions**
+- Chat surface v0.3.0, Notes surface v0.9.0, Schedules surface v0.2.0
+- Chat runner v0.2.0, Notes runner v0.2.0, Schedules runner v0.2.0
+
+**Roadmap**
+- Headless E2E automation moved to v0.7.5 (independent from shell migration)
+
+## v0.7.2 — Package Runners + CI Gate
+
+**Package Runners (5)**
+- Notes runner: `requires: ["notes"]`. 3 suites (crud, folders, tags-search), 12 tests
+- Chat runner: `requires: ["chat", "chat-core"]`. 2 suites (conversations, messaging), 9 tests
+- Schedules runner: `requires: ["schedules"]`. 1 suite (crud), 5 tests
+- Workflow runner: `requires: ["content-approval"]`. 1 suite (lifecycle), 5 tests
+- Renderer runner: `requires: ["mermaid-renderer"]`. 1 suite (contract), 4 tests
+
+**Runner Result API**
+- `POST /api/v1/admin/test-runners/results` — store structured run results
+- `GET /api/v1/admin/test-runners/results` — retrieve latest results per runner
+- In-memory store with 4 Go handler tests
+
+**CI Integration**
+- `test-runners` stage in Gitea CI pipeline
+- Playwright driver launches headless browser, navigates to `/s/test-runners`, triggers run-all
+- `wait-for-healthy.sh` polls `/healthz/ready` before test execution
+- DinD networking fix: resolve container IP via `docker inspect` (port mapping not exposed to runner localhost)
+
+## v0.7.1 — Surface Runner Framework
+
+**`sw.testing` SDK Module**
+- New kernel SDK module at `src/js/sw/sdk/testing.js`
+- `sw.testing.suite(name, fn)` — register test suites with lifecycle hooks
+- `sw.testing.run(name?)` — execute one or all suites, returns structured JSON
+- Suite context: `s.test()`, `s.beforeAll/afterAll()`, `s.beforeEach/afterEach()`, `s.track()`, `s.skip()`
+- Test context: `t.assert.ok/eq/neq/gt/match/throws/status/shape/arrayOf`, `t.warn()`, `t.skip()`
+- Auto-cleanup: `track(type, id)` registers resources for LIFO deletion in afterAll
+- Three result statuses: passed / failed / warned — warnings are never silent
+
+**`test-runner` Manifest Type**
+- New `"type": "test-runner"` in `ValidateManifest` — surface-like packages discovered by type
+- Test-runner packages excluded from sidebar nav (not type "surface" or "full")
+- Runner manifests support `"requires": [...]` — missing packages → clean skip
+
+**ICD Runner Migration**
+- Migrated from hand-rolled `T.test()`/`T.assert()` framework to `sw.testing.suite()`
+- Stripped extension-dependent tests (channels, notes, personas, etc.) — those belong in v0.7.2 package runners
+- Kernel-only suites: smoke, crud (admin, profile, notifications, teams, workflows, extensions, surfaces, packages), authz, security, providers, packaging, sdk
+- Type changed to `"test-runner"`, standalone route removed, UI rendering delegated to registry
+
+**SDK Runner Migration**
+- Migrated from `T.dualTest()`/`T.domains` framework to `sw.testing.suite()`
+- Dual-path validation preserved: SDK call + raw ICD fetch + verdict dispatch
+- Stripped extension domains — kernel-only suites: misc, workflows, admin, packages, connections, dependencies, composition
+- SHAPE_BUG verdict maps to `t.warn()`, SDK_BUG/ICD_BUG to `t.assert.ok(false)`
+
+**Runner Registry Surface**
+- New `test-runners` surface at `/s/test-runners` (admin-only)
+- Discovers installed test-runner packages via admin packages API
+- Dynamically loads each runner's JS to register suites
+- Run All button, per-runner Run button, real-time results dashboard
+- Suite/test results with pass/fail/warn/skip color coding, timing, error details
+- Export Failures / Export Full Results buttons for JSON download
+- `requires` checking with prominent skip display for missing dependencies
+- Dark mode styling using kernel CSS variables
+
+**Database Migration**
+- SQLite migration 013: adds `test-runner` to packages.type CHECK constraint
+- Postgres migration 014: same constraint update
+
+## v0.7.0 — Shell Contract + Surface Audit + Rebrand
+
+**Shell Infrastructure**
+- Kernel-injected two-slot topbar for all surfaces (home, left slot, center slot, bell, user menu)
+- `sw.shell.topbar` SDK API: `setLeft()`, `setSlot()`, `setTitle()`, `hide()`, `show()`
+- `.sw-topbar__tabs` / `.sw-topbar__tab` CSS classes for consistent tab styling
+- Shell topbar auto-mounts on extension surfaces via `#shell-topbar` div
+
+**Backend WS Events**
+- `package.changed` event broadcast on install/uninstall/enable/disable/update
+- `auth.changed` event targeted to affected user on team/group membership changes
+- `notification.all_read` event split from `notification.read` for cleaner badge sync
+- `Hub.Broadcast()` method for untargeted all-client events
+
+**User Menu + Bell Reactivity**
+- User menu re-fetches surface list on `package.changed` and `auth.changed` events
+- Notification bell syncs on `notification.read` and `notification.all_read` across tabs
+
+**Surface Migrations**
+- Settings: Pattern B (flat tabs in topbar, no sidebar, full-width content)
+- Admin: Pattern C (category tabs in topbar, surface-owned sidebar below)
+- Team Admin: Pattern B (flat tabs, no sidebar, Groups tab removed)
+- Docs: Pattern A (shell topbar auto-renders, removed explicit Topbar import)
+- All 4 surfaces now have notification bell and user menu via shell topbar
+
+**Error Handling + Empty States**
+- `.sw-inline-error` CSS primitive for inline error + retry pattern
+- `.sw-empty-state` CSS primitive for guided empty states
+- Admin Workflows, Packages, Groups: inline error on list fetch failure
+- Admin Workflows, Groups: descriptive empty state guidance
+
+**Announcement Global Dismiss**
+- Announcement dismiss state persisted to localStorage keyed by content hash
+- Dismissed once on any surface, dismissed everywhere
+
+**Rebrand Assets**
+- `favicon-light.svg` renamed to `wordmark.svg` (was a 520x80 wordmark, not an icon)
+- New `favicon-light.svg`: actual square light-mode icon
+- New `wordmark-dark.svg`, `wordmark-light.svg` for dark/light backgrounds
+- New `favicon-light-32.png`, `favicon-light-256.png` raster icons
+- Full icon library deployed to `src/icons/` (both b/e variants, animated SVGs)
+- `manifest.json` description updated to "Self-hosted extension platform"
+- Light-mode icon entries added to PWA manifest
+
+**Bug Fixes**
+- Docs: "On this page" outline links now scroll to headings (IDs were missing from rendered HTML)
+- ICD security tier: tightened path traversal assertion (400/422, not 409), added `finally` cleanup
+- Workflow demo: replaced silent catch with inline error + retry
+- Team Admin: signoff panel shows display names instead of raw UUIDs
+- Deleted `packages/hello-dashboard/` (dead package)
+- Deleted `team-admin/groups.js` (37-line dead-end, no CRUD)
+
+## v0.6.18 — CI Bundle Wiring
+
+Wire `BUNDLED_PACKAGES` env var into the Gitea CI pipeline so each
+environment gets the correct package set at boot.
+
+### Changed
+
+- **CI: dev deploys** — `BUNDLED_PACKAGES=*` (install all, matches docker-compose default).
+- **CI: test deploys** — `BUNDLED_PACKAGES=notes,chat,chat-core` (core surfaces only).
+- **CI: prod deploys** — `BUNDLED_PACKAGES=notes,chat,chat-core,mermaid-renderer,schedules`.
+- **docker-compose.yml** — default `BUNDLED_PACKAGES` changed from empty to `*` (install all for local dev).
+
+### Fixed
+
+- **TestBundledInstall_DefaultAllowlist** — updated test assertions to match v0.6.17's empty default set (was still expecting `notes` in curated defaults).
+
+## v0.6.17 — Bug Fixes & Welcome Logic
+
+Fixes broken UI interactions (folder creation, team member add), dropdown
+overflow, welcome surface auto-disable, and bare-install default behavior.
+
+### Fixed
+
+- **Notes "Add folder" button** — `prompt()` replaced with `sw.prompt()`
+  so the dialog renders correctly in the extension iframe sandbox.
+- **Admin "Add team members"** — user list API returns `{data:[…]}`; handler
+  now unwraps the envelope (`Array.isArray(u) ? u : u.data`) so the user
+  picker populates.
+- **Package filter dropdown overflow** — removed `right:0` constraint on
+  `.sw-dropdown__list`, added `min-width:max-content` and `overflow-x:hidden`
+  so option labels ("Extension", "Workflow") render fully without a scrollbar.
+- **Admin actions cell wrapping** — switched `.admin-actions-cell` from
+  `white-space:nowrap` to flexbox with `flex-wrap:wrap; gap:4px` so buttons
+  don't overflow on narrow viewports.
+
+### Changed
+
+- **Welcome surface auto-disable** — welcome page now redirects to `/` when
+  any non-core extension surface is installed. Removed from the topbar
+  navigation surface list so it never appears alongside real surfaces.
+- **Zero default bundled packages** — `defaultBundledPackages` map is now
+  empty. Fresh installs start bare; use `BUNDLED_PACKAGES` env var to control
+  what gets auto-installed per environment (`*` for all, comma-separated list
+  for selective).
+- **Bundled filter logic** — `nil` (from `*`) means install all; empty map
+  (default) means install nothing. Previous code treated both as "install all".
+- **User menu conditional items** — Docs, Settings, and Team Admin menu
+  entries only appear when those surfaces are actually enabled, not assumed.
+- **SDK imperative host mount** — `ToastContainer` and `DialogStack` are now
+  auto-mounted by the SDK boot sequence for extension surfaces that lack an
+  AppShell, preventing missing toast/dialog hosts.
+
 ## v0.6.16 — Usability Survey Gate
 
 Machine-auditable UI quality gate. Four new audit scripts, a structured survey

ROADMAP-UI.md

@@ -1,151 +0,0 @@
-# Armature — v0.6.x UI Hardening Roadmap
-
-> **Goal**: Fix all viewport scaling, banner integration, and styling inconsistencies
-> so Claude Code can run a meaningful automated usability survey against a
-> stable, uniform UI.
-
----
-
-## Problem Inventory
-
-### P1 — Viewport & Scaling (blocks everything)
-
-| # | Issue | Where | Impact |
-|---|-------|-------|--------|
-| 1 | **Dual layout systems** — `base.html` template has its own banner→surface→footer column; `app-shell.js` Preact shell has a separate `sw-shell` → `sw-shell__body` → `sw-shell__surface` column. They never coordinate. | `server/pages/templates/base.html` ↔ `src/js/sw/shell/app-shell.js` | Every surface inherits an ambiguous viewport ancestor. |
-| 2 | **Transform-based scaling is broken** — `transform: scale()` on `#surfaceInner` doesn't reflow layout. Breaks `getBoundingClientRect` (menu.js already carries a scale-correction hack at line 20), scroll containment, pointer events, and the inverse-width/height hack (`100/s%`) doesn't account for banners consuming viewport space. | `base.html:56-67`, `appearance.js:41-53`, `menu.js:20-33` | Menus, tooltips, dropdowns all mis-positioned at any non-100% scale. Click targets wrong. |
-| 3 | **Banner height desync** — `base.html` hardcodes `--banner-h: 28px` and renders banners in-flow. `app-shell.js` ShellBanner measures `offsetHeight` into `--banner-top-height` / `--banner-bottom-height` and uses `position: fixed` + body padding. Two independent banner systems. | `base.html:31,72-75,103-107` ↔ `app-shell.js:25-42`, `sw-shell.css:22-37,63-69` | With banners enabled, content overflows by the banner height or gets double-inset depending on which code path is active. |
-| 4 | **`100vh` on mobile** — `.sw-shell`, `.chat-app`, `.chat-loading`, `.login-shell` use `100vh` which doesn't subtract mobile browser chrome (address bar, toolbar). | `sw-shell.css:9`, `chat/css/main.css:15,25`, `sw-login.css:7` | Content overflows on iOS Safari, Android Chrome. |
-| 5 | **Chat uses `100vh` not `100%`** — `.chat-app { height: 100vh }` ignores parent container (which already excludes banners/footer). Notes correctly uses `height: 100%`. Every extension surface that copies chat's pattern will inherit the bug. | `packages/chat/css/main.css:15` | Chat surface overflows behind banners. |
-
-### P2 — CSS Architecture
-
-| # | Issue | Where | Impact |
-|---|-------|-------|--------|
-| 6 | **Class name collisions** — `.settings-section` defined in both `modals.css:41-43` and `surfaces.css:75-83` with different padding, margin, and border-bottom rules. `.sw-dropdown` in `primitives.css:443` (styled `<select>`) vs `sw-primitives.css:262` (custom dropdown component). `.sw-tabs` in `primitives.css:459` vs `sw-primitives.css:234`. | Kernel CSS | Styles randomly win depending on load order. Bug reports differ by surface. |
-| 7 | **Old/new primitive duplication** — Two button systems (`.btn-primary`/`.btn-small` in `primitives.css` vs `.sw-btn--primary`/`.sw-btn--sm` in `sw-primitives.css`). Two toast systems (`.toast` vs `.sw-toast`). Two dropdown, two tabs implementations. | `primitives.css` ↔ `sw-primitives.css` | No single source of truth for any component. Extension authors can't know which to use. |
-| 8 | **Extension CSS bleeds globally** — Extension `main.css` loaded via `<link>` at document level, no scoping. Any class name can override kernel or sibling extension styles. | `base.html:26-28`, `extension-surface.css` | Package CSS fights with kernel. Two packages with `.sidebar` both lose. |
-| 9 | **No intermediate breakpoint** — Only `768px` mobile breakpoint. No tablet (768–1024px). Secondary workspace pane hardcoded `480px`. Admin nav hardcoded `200px`. | `layout.css:263`, `surfaces.css:305` | Cramped layout on iPad/small laptops. |
-
-### P3 — Visual Consistency
-
-| # | Issue | Where | Impact |
-|---|-------|-------|--------|
-| 10 | **Mixed unit systems** — `px`, `rem`, `em` used interchangeably with no rationale. Some font-sizes in `px` (primitives), others in `rem` (sw-primitives), others in `em` (user-picker). | All CSS files | Zoom/scale behaves differently per element. |
-| 11 | **Google Fonts CDN dependency** — `@import url(...)` in `variables.css:5` blocks rendering if CDN is slow; breaks entirely on air-gapped deployments. | `variables.css:5` | FOUT or blank page on slow networks. No offline support. |
-| 12 | **No spacing scale** — Padding/margins are ad-hoc values (10px, 12px, 14px, 16px, 20px, 24px, 28px…). No design-token spacing scale. | All CSS | Inconsistent visual rhythm across surfaces. |
-| 13 | **Hardcoded fallback colors in component CSS** — `sw-shell.css`, `sw-primitives.css` have inline fallbacks like `var(--accent, #b38a4e)` — a gold color from a previous theme that doesn't match the current blue `#6c9fff`. | `sw-shell.css`, `sw-primitives.css` | Wrong colors flash briefly if variables load late. |
-
----
-
-## Roadmap
-
-### v0.6.9 — Session Lifetime Config ✅
-
-Shipped. Admin-configurable TTLs, "keep me logged in" checkbox, idle timeout,
-config-driven `generateTokens()`, 7 new tests. See CHANGELOG.md for details.
-
-### v0.6.10 — Viewport Foundation ✅
-
-Shipped. Single layout model: `body → shell → surface`. CSS `zoom` replaces
-`transform: scale()`. `100dvh` fallbacks everywhere. Extension surfaces use
-`100%` instead of `100vh`. Dead shell layout code deprecated. See CHANGELOG.md.
-
-### v0.6.11 — CSS Deduplication ✅
-
-Shipped. Old primitive system retired. One class per concept. See CHANGELOG.md.
-
-| Step | Description |
-|------|-------------|
-| Audit collision inventory | Script that finds all duplicate class selectors across kernel CSS files. Produce a machine-readable collision report (JSON). |
-| Migrate `.settings-section` | Remove `modals.css:41-43` definition. The `surfaces.css` definition is authoritative. Modals that used the old styles get explicit overrides scoped to `.modal .settings-section`. |
-| Retire `primitives.css` old components | `.btn-primary`, `.btn-small`, `.btn-danger`, `.btn-full` → migrate all usages to `.sw-btn--*`. `.toast-container` / `.toast` → migrate to `.sw-toast-container` / `.sw-toast`. Old `.popup-menu` → migrate to `.sw-menu`. Old `.sw-dropdown` (styled select in primitives.css) → rename to `.sw-native-select` or delete if unused. Old `.sw-tabs` / `.sw-tab-btn` in primitives.css → delete (sw-primitives.css version is authoritative). |
-| Mark deprecated classes | Any remaining old classes get a `/* DEPRECATED v0.6.11 — use .sw-btn--* */` comment and a 1-version grace period for package authors. |
-| Package CSS audit | Scan all `packages/*/css/main.css` for references to deprecated kernel classes. Fix in-tree packages. |
-
-### v0.6.12 — Extension CSS Isolation ✅
-
-Shipped. Prefix enforcement via linter. All 12 in-tree packages migrated.
-See CHANGELOG.md.
-
-| Step | Description |
-|------|-------------|
-| Scoping strategy | Prefix enforcement (option B). `@scope` support still patchy; prefix works everywhere, trivially lintable. |
-| Linter | `scripts/lint-package-css.sh` — validates first class selector in every rule starts with `.ext-{slug}`. Exempts `:root`, `@keyframes`, `@font-face`, `@media`, `.sw-*` kernel classes, `.cm-*` CodeMirror classes. |
-| Kernel CSS contract | `docs/EXTENSION-CSS.md` — stable public classes (`.sw-btn--*`, `.sw-input`, `.sw-field`, `.sw-dialog`, `.sw-toast`, `.sw-menu`, `.sw-tabs`, etc.) and all CSS variables. Everything else internal. |
-| Migrate in-tree packages | `data-ext="{{.Surface}}"` on extension mount. All 12 packages prefixed to `.ext-{slug}-*`. CSS + JS updated in lockstep. |
-
-### v0.6.13 — Responsive & Spacing ✅
-
-Shipped. Spacing token scale (`--sp-1` through `--sp-12`, 4px grid) in
-`variables.css`. Tablet breakpoint (`max-width: 1024px`) in layout, surfaces,
-login. All kernel CSS and 12 in-tree packages migrated to spacing tokens.
-`EXTENSION-CSS.md` updated with spacing table and breakpoint guide.
-Font-size scale deferred to v0.6.14. See CHANGELOG.md.
-
-### v0.6.14 — Visual Polish ✅
-
-Shipped. Stale fallback colors purged (~65 instances), fonts self-hosted
-(DM Sans + JetBrains Mono woff2), border-radius standardized to three tokens
-(`--radius-sm`, `--radius`, `--radius-lg`). Also fixed v0.6.13 spacing
-regressions (half-step tokens), theme settings default, surface overflow,
-and user menu zoom drift. See CHANGELOG.md.
-
-### v0.6.15 — User Display Audit ✅
-
-Shipped. `GET /api/v1/users/resolve?ids=...` batch endpoint, `sw.users`
-SDK module with `resolve()`, `resolveMany()`, `displayName()` + 60s cache.
-Chat participants resolved from users table instead of snapshot. All admin
-surfaces show `display_name || username || 'Unknown'`. Chat-core snapshot
-column deprecated. 5 new handler tests. See CHANGELOG.md.
-
-### v0.6.16 — Usability Survey Gate ✅
-
-Shipped. Four audit scripts, structured survey prompt, contrast/touch-target
-fixes, Docker docs corrected. All 48 contrast pairings pass, all close buttons
-have 44px mobile targets, focus-visible on all key primitives. See CHANGELOG.md.
-
----
-
-## Sequencing Rationale
-
-```
-v0.6.9  Session Lifetime Config ✅ SHIPPED
-  ↓
-v0.6.10 Viewport Foundation     ✅ SHIPPED
-  ↓
-v0.6.11 CSS Deduplication       ✅ SHIPPED
-  ↓
-v0.6.12 Extension CSS Isolation ✅ SHIPPED
-  ↓
-v0.6.13 Responsive & Spacing    ✅ SHIPPED
-  ↓
-v0.6.14 Visual Polish           ✅ SHIPPED
-  ↓
-v0.6.15 User Display Audit     ✅ SHIPPED
-  ↓
-v0.6.16 Usability Survey Gate  ✅ SHIPPED
-```
-
-Each version is independently shippable and testable. No version depends on
-anything after it.
-
----
-
-## What "Usability Survey by Code" Means
-
-The v0.6.16 deliverables give Claude Code (or any automated tool) three things:
-
-1. **A structured inventory** (`ui-inventory.json`) of every component, on every
-   surface, with its CSS file and line number.
-
-2. **Automated checks** (contrast, touch targets, token usage) that produce
-   machine-readable pass/fail reports.
-
-3. **A survey prompt** (`USABILITY-SURVEY.md`) with explicit criteria and file
-   paths, so Claude Code can `cat` the relevant files, run the scripts, and
-   produce a scored report without human guidance.
-
-The survey is not a substitute for real user testing — it's a structural
-quality gate that catches the class of bugs (overflow, contrast, misalignment,
-inconsistent styling) that have historically slipped through.

ROADMAP.md

@@ -1,6 +1,6 @@
 # Armature — Roadmap
 
-## Current: v0.6.14 — Visual Polish
+## Current: v0.7.4 — Documentation + Deferred Surface Work
 
 Self-hosted extensible platform. Auth, identity, packages, Starlark sandbox,
 storage, realtime, and ops are kernel primitives. Everything else is an extension.
@@ -19,152 +19,187 @@ upgrade test harness, cluster registry + HA.
 
 ---
 
-## v0.6.0 — MVP
+## v0.6.x — Completed (MVP + Hardening)
 
-Extension, communication, and operations tracks converge. First
+All v0.6.x work is shipped and documented in `CHANGELOG.md`. Summary:
-externally usable release.
 
-Design docs: `docs/DESIGN-cluster-registry.md` — PG-backed cluster registry and self-assembling mesh.
+| Version | Title | Key Deliverables |
-
+|---------|-------|-----------------|
-### v0.6.0 — Cluster Registry + HA
+| v0.6.0 | Cluster Registry + HA | PG-backed node registry, heartbeat sweep, LISTEN/NOTIFY routing, self-eviction |
-
+| v0.6.1 | Backup/Restore + Docs | `.swb` archive format, server-side backups, docs surface + 5 guides |
-PG is the consensus layer. Zero new infrastructure. `UNLOGGED` table + `LISTEN/NOTIFY` replaces etcd/Consul/Redis for homelab-to-small-team scale.
+| v0.6.2 | Docs Polish + OpenAPI | Dark mode fix, topbar nav, `api_schema` manifest field, dynamic spec builder |
-
+| v0.6.3 | Dead Code Sweep | Registry install fix, dead Go/JS/HTML deletion, narrowed default bundle |
-| Step | Status | Description |
+| v0.6.4 | Admin Health/Metrics | Cluster dashboard merged into Admin tab, block renderer `requires` removed |
-|------|--------|-------------|
+| v0.6.5 | Renderer Pipeline | `sw.renderers.register()` kernel primitive, unified markdown, docs rewrite |
-| `node_registry` table | ✅ | `UNLOGGED TABLE` — node_id, endpoint, seq, registered_at, heartbeat, stats JSONB. Postgres migration 013. |
+| v0.6.6 | Final Hardening | Dependency auto-activation, `ValidateManifest()`, OIDC nonce, ICD/SDK update |
-| Node registration | ✅ | Self-registration on startup: `INSERT ... ON CONFLICT DO UPDATE`. `node_id` = `hostname-PID` or `CLUSTER_NODE_ID` env override. |
+| v0.6.7 | Native mTLS | `TLS_MODE` config, `MTLSNativeProvider`, node-to-node mTLS, `armature-ca.sh` |
-| Heartbeat tick | ✅ | Every 10s: update own heartbeat + collect runtime stats (goroutines, heap, GC, uptime, ws_clients). |
+| v0.6.8 | Cookie Fix + UI Roadmap | Cookie SameSite fix, UI hardening roadmap published |
-| Stale sweep | ✅ | Every heartbeat tick: `DELETE WHERE heartbeat < now() - 30s`. All nodes run it — idempotent, no ring topology. |
+| v0.6.9 | Session Lifetime Config | Admin-configurable TTLs, idle timeout, "keep me logged in" |
-| Self-eviction | ✅ | If heartbeat UPDATE returns 0 rows: node was swept by peer → log error + `os.Exit(1)`. K8s restarts → re-register. |
+| v0.6.10 | Viewport Foundation | Single layout model, CSS zoom, 100dvh, dead shell deprecated |
-| LISTEN/NOTIFY routing | ✅ | Durable events (messages, state changes) fan-out via `pg_notify`. All replicas receive, push to local WS subscribers, drop if irrelevant. Phase 1: ephemeral events (typing, presence) also via NOTIFY (8KB limit, ~60 bytes each). |
+| v0.6.11 | CSS Deduplication | Old primitive system retired, one class per concept |
-| Cluster API | ✅ | `GET /api/v1/admin/cluster` — returns `{data: [...]}` envelope with all registered nodes. |
+| v0.6.12 | Extension CSS Isolation | Prefix enforcement via linter, all 12 in-tree packages migrated |
-| Admin cluster dashboard | ✅ | `cluster-dashboard` surface package renders one card per node: node_id, endpoint, uptime, ws_clients, heap, GC pause. JSONB stats — future keys render automatically, no schema migration. Auto-refresh every 10s. |
+| v0.6.13 | Responsive & Spacing | Spacing token scale (4px grid), tablet breakpoint |
-| Health endpoint | ✅ | `GET /health` includes `node_id` and `cluster: {size, peers, heartbeat_age_ms}`. |
+| v0.6.14 | Visual Polish | Stale fallback colors purged, fonts self-hosted, radius tokens |
-| Config | ✅ | `CLUSTER_NODE_ID`, `CLUSTER_HEARTBEAT_INTERVAL` (default 10s), `CLUSTER_STALE_THRESHOLD` (default 30s), `CLUSTER_ENDPOINT` (Phase 2 mesh, auto-detect). |
+| v0.6.15 | User Display Audit | Batch user resolve API, `sw.users` SDK module |
-| Single-node regression | ✅ | One-node behavior identical to pre-cluster: one registry row, NOTIFY delivers back to same instance. No special-casing. SQLite returns nil store — all cluster code guarded. |
+| v0.6.16 | Usability Survey Gate | Four audit scripts, contrast/touch-target fixes |
-| Multi-node integration test | ✅ | Docker Compose: 3 instances, shared PG. `ci/e2e-cluster-test.sh`: registration, stale sweep on stop, re-registration on restart. 3 unit tests + 2 handler tests. |
+| v0.6.17 | Bug Fixes & Welcome | Notes folder fix, team member add fix, welcome auto-disable, zero default bundle |
-
+| v0.6.18 | CI Bundle Wiring | `BUNDLED_PACKAGES` env var wired into Gitea CI pipeline |
-### v0.6.1 — Backup/Restore + Documentation
-
-| Step | Status | Description |
-|------|--------|-------------|
-| Backup handler | ✅ | `POST /api/v1/admin/backup` streams `.swb` ZIP (JSONL core + ext_data tables + package assets). `POST /api/v1/admin/restore` wipes DB and restores from archive. Dialect-neutral (SQLite + Postgres). |
-| Server-side backups | ✅ | `GET /api/v1/admin/backups` list, `GET /download`, `DELETE`. Store backups in `{STORAGE_PATH}/backups/`. |
-| Admin backup section | ✅ | New "Backup" section under `/admin/backup`. Create (download or server-side), list, download, delete, restore with destructive confirmation. |
-| Documentation API | ✅ | `GET /api/v1/docs` lists, `GET /api/v1/docs/:name` returns raw markdown. Authenticated (not admin-only). |
-| Docs surface | ✅ | Builtin surface at `/docs/:section`. Sidebar navigation, client-side markdown renderer. 5 new docs: Getting Started, Extension Guide, API Reference, Deployment, Package Format. |
-| Tests | ✅ | 6 handler tests (basic backup, ext_data backup, round-trip restore, schema mismatch, dump/restore table, list empty). E2E script `ci/e2e-backup-test.sh`. |
-
-### v0.6.2 — Docs Polish + Dynamic OpenAPI
-
-| Step | Status | Description |
-|------|--------|-------------|
-| Dark mode fix | ✅ | Added `--bg-code` to CSS variables (dark + light). Replaced all hardcoded light-mode fallbacks in docs CSS with theme-aware variables. Table styling, code blocks, nav items all readable in dark mode. |
-| Loading & error handling | ✅ | Replaced borrowed `settings-placeholder` with docs-specific pulse animation. Added error state with retry button for failed doc list fetch. |
-| Topbar navigation | ✅ | Imported `Topbar` + `UserMenu` into docs surface. Users can now navigate to other surfaces via the avatar menu. |
-| Docs icon + menu entry | ✅ | Added `📖 Docs` entry to UserMenu standard items. Docs accessible from any surface's user menu. |
-| `api_schema` manifest field | ✅ | Optional `api_schema` array in `manifest.json`. Parsed lazily by spec builder. Malformed entries logged and skipped — never blocks extension loading. |
-| OpenAPI spec builder | ✅ | `BuildOpenAPISpec()` merges static kernel spec with extension routes. Tier 1: auto-generated stubs for all `api_routes`. Tier 2: `api_schema` replaces stubs with rich path items (params, body, response). |
-| Dynamic spec endpoint | ✅ | `GET /api/docs/openapi.json` serves merged spec. Swagger UI updated to use JSON endpoint. Static YAML preserved for backward compat. |
-| Tests | ✅ | 7 new handler tests: zero extensions, stubs, rich schema, multi-extension, malformed schema, disabled exclusion, required fields. |
 
 ---
 
-## v0.6.x — Hardening
+## v0.7.x — Test Infrastructure + Quality Gate
 
-Closes every audit finding before the public release. No new features — only correctness, dead code elimination, and architectural cleanup. Sequence is fixed: each version is a gate for the next.
+The v0.6.x series built the kernel. v0.7.x makes it provably correct.
 
-### v0.6.3 — Dead Code Sweep + Registry Fix
+A full surface audit (docs/AUDIT-surfaces.md) found 7 cross-surface issues
+and 18 surface-specific issues across Settings, Admin, Team Admin, and Docs.
+Only Docs is properly built. The fix is three phases: (1) establish a shell
+contract and bring all four primary surfaces to parity, (2) build a runner
+framework for end-to-end browser tests, (3) automate those runners headlessly
+in CI.
 
-Pure cleanup. No behavior changes except fixing the broken registry install flow.
+Design docs:
+- `docs/DESIGN-shell-contract.md` — two-slot topbar, three navigation patterns, surface migrations
+- `docs/DESIGN-surface-runners.md` — runner framework, requires declarations, headless E2E
+- `docs/AUDIT-surfaces.md` — full audit findings
+
+### v0.7.0 — Shell Contract + Surface Audit + Rebrand Cleanup
+
+Design doc: `docs/DESIGN-shell-contract.md`
+
+**Shell Infrastructure**
 
 | Step | Status | Description |
 |------|--------|-------------|
-| Fix registry install | ✅ | SDK sends `{ url }`, handler expects `{ download_url }`. Fix `api-domains.js` to send `{ download_url: url }`. Every Install click currently returns 400. |
+| Shell topbar (two-slot model) | done | Kernel injects topbar into `surface-extension` template. Two named slots: **left** (defaults to manifest title) and **center** (`flex: 1`, for tabs/pickers/search). Home link, notification bell, and user menu always present. |
-| Registry settings UI | ✅ | Add "Package Registry" section to admin settings with URL input field. Only way to configure registry today is a raw `PUT /api/v1/admin/settings/package_registry` — no user will find it. |
+| Topbar customization API | done | `sw.shell.topbar.setLeft(vnode)` overrides left slot. `sw.shell.topbar.setSlot(vnode)` sets center slot. `sw.shell.topbar.setTitle(str)` shorthand for text-only left. `sw.shell.topbar.hide()` / `.show()` for full-bleed surfaces. |
-| Registry tooling + docs | ✅ | `scripts/generate-registry.sh` scans a directory of `.pkg` files and emits registry JSON. `docs/PACKAGE-REGISTRY.md` documents the format. |
+| Kernel tab CSS | done | `.sw-topbar__tabs` and `.sw-topbar__tab` classes for consistent tab styling in the center slot. Surfaces use these for free or style their own slot content. |
-| Delete dead kernel Go | ✅ | `store/interfaces.go:178–183` — orphaned ChannelListFilter comments. `pages/pages.go:922–930` — `roleFilterType()` + template registration (chat vestige, maps nonexistent roles). `main.go:67` — orphaned provider-type comment. |
+| Notification read broadcast | done | Backend emits `notification.read` and `notification.all_read` WS events. Bell listens for `.created`, `.read`, `.all_read`. Cross-surface sync without refetch. |
-| Delete dead vendor JS | ✅ | `vendor/marked.min.js` and `vendor/purify.min.js` — 62KB, zero production imports. Only referenced in test helpers. |
+| User menu reactivity | done | Emit `package.changed` (install/uninstall/enable/disable) and `auth.changed` (role/membership) WS events. UserMenu listens and re-fetches surface list. Most impactful single fix. |
-| Delete `dev.html` | ✅ | 676 lines, not imported by anything. Dead. |
+| Shell announcement global dismiss | done | Dismissed state persisted to localStorage keyed by content hash. Dismiss once, dismissed everywhere. |
-| Remove `dashboard` from default bundle | ✅ | Requires `legacy-sdk` (doesn't exist), auto-installs as dormant on fresh installs. Confusing. Remove from `defaultBundledPackages`. |
-| Remove `hello-dashboard` | ✅ | Proof-of-concept from early development. Move to `examples/` or delete. |
-| Strip stale version comments | ✅ | 60+ files had legacy version annotations (`// v0.29.x:`, `// v0.33.x:`). Single sed pass. |
-| Narrow default bundle | ✅ | Default: `notes`, `chat`, `chat-core`, `mermaid-renderer`, `schedules`. Everything else available via registry or `BUNDLED_PACKAGES=*`. |
 
-### v0.6.4 — Admin Health/Metrics Tab + Cluster Merge
+**Surface Migrations**
-
-Structural move: cluster dashboard becomes an Admin tab. Better home for health/metrics — shared context with other admin panels, no separate nav entry.
 
 | Step | Status | Description |
 |------|--------|-------------|
-| "Health / Metrics" admin tab | ✅ | New tab in Admin surface. DB-agnostic metrics for all deployments. Cluster cards conditional on PG + multi-node detection. |
+| Settings → Pattern B (flat tabs) | done | Delete custom topbar + sidebar nav. 6 sections become flat tabs in topbar center slot. Content full-width. Fix Teams section: add team admin link, role display, leave action. Remove sessionStorage return URL logic. |
-| Runtime metrics | ✅ | Per-node: goroutines, heap alloc/sys, stack in use, GC cycles, last GC pause, GC CPU %, uptime, WebSocket clients, extensions loaded, open FDs. |
+| Admin → Pattern C (category tabs + sidebar) | done | Delete custom `admin-topbar`. `setLeft()` for favicon + "Administration". `setSlot()` for category tabs (People / Workflows / System / Monitoring). Admin sidebar (sub-navigation) unchanged — surface-owned, below the topbar. Bell + user menu come free from shell. Delete bespoke CatIcon renderer if using standard SVGs. |
-| DB pool metrics | ✅ | All deployments: DB latency (`SELECT 1` round-trip), pool active/idle/max, wait count, wait duration. PG-only: table bloat (`n_dead_tup`), active backends (`pg_stat_activity`). |
+| Team Admin → Pattern B (flat tabs) | done | Delete custom topbar + sidebar nav. 5 sections (Members / Connections / Workflows / Settings / Activity — Groups removed) become flat tabs. Content full-width. `setTitle()` for team-specific name. Remove sessionStorage return URL. Fix signoff user display (`user_id` → `sw.users.displayName()`). |
-| Cluster metrics | ✅ | PG multi-node only: cluster size, peer list with endpoint + uptime, heartbeat age per node, event bus publish/deliver rates. |
+| Team Admin: remove Groups tab | done | 37-line dead-end. Read-only "No groups" with no create/docs/link. Remove until team-scoped group management is properly designed. |
-| Extension runtime metrics | ✅ | Starlark exec/min, errors/min, avg duration, HTTP outbound requests/min, trigger fires/min, schedule overruns. |
+| Docs → Pattern A (default) | done | Delete explicit Topbar import. Shell topbar auto-renders with manifest title. Docs sidebar (document list) is in content area, unaffected. |
-| Fatten heartbeat payload | ✅ | Heartbeat JSONB carries full metric set. `GET /api/v1/admin/metrics` for single-node SQLite fallback (same shape). |
-| Retire `cluster-dashboard` | ✅ | Remove package once Admin Health tab ships. Update `defaultBundledPackages`. |
-| Fix block renderer `requires` | ✅ | `mermaid-renderer`, `katex-renderer`, `csv-table`, `diff-viewer` all have `"requires": ["chat"]`. These are content renderers, not chat features. Remove constraint — they should activate without chat. |
-| Health endpoint consolidation | ✅ | `/health` and `/api/v1/health` return near-identical JSON. Merge or clearly differentiate with docs. |
 
-### v0.6.5 — Renderer Pipeline + Docs Rewrite
+**Error Handling + UX Pass**
-
-Most complex sub-version. Lifts block rendering to a kernel SDK primitive so all surfaces share it, then rewrites the docs for an external audience.
 
 | Step | Status | Description |
 |------|--------|-------------|
-| SDK renderer primitive | ✅ | `sw.renderers.register(pattern, handler)` — kernel-level registration. Extensions call once; all surfaces consume. Decouples renderer discovery from chat surface. |
+| Inline error states | done | Replace `catch { toast }` with inline error + retry on all list endpoints. New `.sw-inline-error` CSS primitive. Systematic pass across Settings, Admin, Team Admin. |
-| Notes hooks SDK renderer pipeline | ✅ | Notes delegates to `sw.markdown.renderSync()` + `sw.renderers.runPostRenderers()`. Hand-rolled renderer deleted. |
+| Empty state guidance | done | Every "No X" message gets one-line explanation + primary action (create button or doc link). Admin Groups, Workflows, Teams; Team Admin Workflows; Settings Notifications. |
-| Docs hooks SDK renderer pipeline | ✅ | Docs delegates to `sw.markdown.renderSync()` + `sw.renderers.runPostRenderers()`. Hand-rolled renderer deleted (~160 lines). |
-| Unify markdown renderer | ✅ | `sw.markdown` module lazy-loads `marked` v16 (vendored). Notes, Docs, Chat all consume it. Two hand-rolled parsers deleted. |
-| Sanitize HTML output | ✅ | DOMPurify wired as default post-render step in `sw.markdown`. SVG-safe config allows mermaid output. Notes sanitizes; Docs opts out (system-authored). |
-| Mermaid/KaTeX/CSV/Diff work everywhere | ✅ | Browser extension loader injects renderer scripts into all pages. Extensions register via `sw:ready` event. All four render in Notes, Docs, and Chat. |
-| Docs rewrite for external audience | ✅ | All fork references removed from docs, CHANGELOG, ROADMAP. DESIGN-WORKFLOW-REDESIGN-0.2.6.md replaced with DESIGN-WORKFLOWS.md. |
-| Add Mermaid architecture diagrams | ✅ | Six diagrams in ARCHITECTURE.md: system overview, request flow, extension lifecycle, realtime events, settings cascade, cluster topology. |
-| Surface alias decision | ✅ | Migrated SDK + ICD runner to `/admin/packages/`; aliases removed from main.go. |
-| `CONTRIBUTING.md` + tutorial | ✅ | CONTRIBUTING.md at repo root + docs/TUTORIAL-FIRST-EXTENSION.md walkthrough. |
 
-### v0.6.7 — Native mTLS
+**Bug Fixes**
-
-End-to-end mutual TLS without a reverse proxy. Targets systemd+podman deployments where every connection (client→server, node→node) is mTLS. Design: `docs/DESIGN-native-mtls.md`.
 
 | Step | Status | Description |
 |------|--------|-------------|
-| `TLS_MODE` config | ✅ | Three values: `none` (default, plain HTTP) · `server` (TLS, no client cert) · `mtls` (mutual TLS, client cert required). Independent of `AUTH_MODE`. |
+| evil-chat cleanup | done | ICD security tier: `finally` cleanup block + tighten `409` assertion. |
-| TLS server mode | ✅ | Go binary calls `ListenAndServeTLS` directly. `TLS_CERT`, `TLS_KEY`, `TLS_CA` path config. TLS 1.3 minimum, no fallback. `server/config/tls.go` loader + validation. |
+| Workflow demo error surfacing | done | Replace silent `catch` with inline error + retry. |
-| `MTLSNativeProvider` | ✅ | Reads `r.TLS.PeerCertificates[0]` — no header trust. `Subject.CommonName` → username. `sha256(Raw)` → `external_id`. Auto-provisions `auth_source=mtls`. Renamed existing `mtls.go` → `mtls_proxy.go`. Shared helpers in `mtls_helpers.go`. |
+| Hello dashboard removal | done | Delete `packages/hello-dashboard/`. |
-| Node-to-node mTLS | ✅ | `BuildPeerTLSConfig()` constructs outbound TLS config with node cert + CA pool. Forward-looking — cluster registry is DB-backed (PG LISTEN/NOTIFY), no HTTP peer calls yet. |
-| `armature-ca.sh` | ✅ | Shell wrapper around openssl. Three commands: `init` (CA keypair) · `issue-node --name <n> --san <addrs>` (365d) · `issue-user --cn <name>` (90d). All output PEM. |
-| Unit tests | ✅ | Ephemeral CA via `crypto/x509`. Fabricated `PeerCertificates`. Valid cert → user provisioned · no TLS → `ErrNoCert` · empty certs → `ErrNoCert` · no CN → `ErrInvalidCreds`. |
-| Integration tests | ✅ | Real TLS listener on localhost. No cert / wrong CA / expired → TLS handshake rejected. Valid cert → 200. Peer certificate CN + email visibility verified. |
 
-### v0.6.6 — Final Hardening
+**Rebrand**
-
-Final pass before public release. Security, correctness, and developer experience.
 
 | Step | Status | Description |
 |------|--------|-------------|
-| Extension dependency auto-activation | ✅ | Installing a package with unmet `depends`/`requires` auto-installs dependencies from the bundled set. If not bundled: clear error listing what's missing. |
+| Light-mode icon SVG | done | New `favicon-light.svg` — square icon, transparent bg, dark node fills. Rename current `favicon-light.svg` (wordmark) to `wordmark.svg`. |
-| `ValidateManifest()` gate | ✅ | Single `ValidateManifest()` function in `package_validate.go`. Called at install time (both upload and bundled). 12 unit tests. |
+| Dark-mode wordmark SVG | done | New `wordmark-dark.svg` — light text for dark backgrounds. |
-| Package signing hook | ✅ | Optional `signature` field in manifest (reserved). `PACKAGE_VERIFY_SIGNATURES` env var (default false, log-only). No cryptographic code yet — schema slot reserved. |
+| Light-mode raster assets | done | `favicon-light-32.png`, `favicon-light-256.png`. |
-| OIDC state nonce validation | ✅ | `oidcClaims.Nonce` field added. `ValidateIDTokenNonce()` compares ID token nonce against stored state. Callback rejects mismatched nonces. |
+| PWA manifest description | done | "Self-hosted extension platform — build, compose, and run extensions." |
-| Schema migration stub decision | ✅ | Stub replaced with log-only function documenting additive-only policy. Downgrade rejection preserved. |
+| REBRAND-SPEC.md | | Land into `docs/`. Find/replace patterns, validation checklist, asset inventory. |
-| ICD/SDK runner update pass | ✅ | ICD smoke tier: added metrics, cluster, backups, docs, OpenAPI JSON endpoints. SDK admin domain: added metrics, cluster, backups tests. |
+| base.html favicon swap | done | Verify theme swap works with new square light icon. |
-| Stale TODO resolution | ✅ | `main.go` session middleware: replaced with `OptionalAuth()` (auth if token present, anonymous pass-through). `auth.go:221` OIDC nonce: resolved. `starlark_helpers.go:96` migration stub: resolved. |
 
-Then ship.
+**Tests**
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Shell topbar renders for extensions | done | Home, left slot, center slot, bell, user menu present. |
+| Topbar API (setLeft, setSlot, hide) | done | Custom content renders. Hide removes topbar. |
+| All 4 surfaces use shell topbar | done | No double topbars. Each pattern (A/B/C) renders correctly. |
+| User menu reactive to package install | | Install → menu updates without reload. |
+| Notification bell cross-surface sync | | Dismiss on Notes → clears on Chat. |
+| Inline error on API failure | | Error + retry shown, not empty list. |
+
+### v0.7.1 — Surface Runner Framework
+
+Design doc: `docs/DESIGN-surface-runners.md`
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Runner framework (`sw.testing`) | done | SDK module: suite/test/assert, lifecycle hooks, structured JSON results. |
+| `requires` declarations | done | Runner manifests declare dependencies. Missing packages → clean skip. |
+| Cleanup enforcement | done | `s.track(type, id)` auto-deletes in `afterAll`. No leaked state. |
+| Warning tier | done | pass / fail / warning. No silent catch swallowing. |
+| ICD runner migration | done | Refactor to `sw.testing`. Test logic preserved. |
+| SDK runner migration | done | Refactor to `sw.testing`. Domain suites preserved. |
+| Runner registry surface | done | `/s/test-runners` — list runners, run-all, results dashboard. |
+
+### v0.7.2 — Package Runners + CI Gate
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Notes runner | done | `requires: ["notes"]`. 3 suites (crud, folders, tags-search), 12 tests. |
+| Chat runner | done | `requires: ["chat", "chat-core"]`. 2 suites (conversations, messaging), 9 tests. |
+| Schedules runner | done | `requires: ["schedules"]`. 1 suite (crud), 5 tests. |
+| Workflow runner | done | `requires: ["content-approval"]`. 1 suite (lifecycle), 5 tests. |
+| Renderer runner | done | `requires: ["mermaid-renderer"]`. 1 suite (contract), 4 tests. |
+| Runner result API | done | `POST/GET /api/v1/admin/test-runners/results`. In-memory store, 4 Go tests. |
+| CI integration | done | `test-runners` stage in Gitea CI. Playwright driver, `wait-for-healthy.sh`. |
+| CI DinD networking fix | done | Resolve container IP via `docker inspect` — DinD port mapping doesn't expose to runner localhost. |
+
+### v0.7.3 — Extension Shell Migration
+
+Chat, Notes, and Schedules still use the old `sw.shell.Topbar` component,
+producing a double topbar (shell-injected + surface-owned). Migrate all
+three to the v0.7.0 shell contract (`sw.shell.topbar.setTitle/setSlot`),
+same pattern as the kernel surface migrations.
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Chat → shell topbar | done | Delete `<Topbar>`, use `setTitle('Chat')` + `setSlot()` for thread title/people button. |
+| Notes → shell topbar | done | Delete `<Topbar>`, use `setTitle('Notes')` + `setSlot()` for action buttons. |
+| Schedules → shell topbar | done | Delete `<Topbar>`, use `setTitle('Schedules')` + `setSlot()` for count/new button. |
+| Update package runner tests | done | Shell-topbar test suite in each runner — assert no legacy Topbar, uses shell API. |
+
+### v0.7.4 — Documentation + Deferred Surface Work
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Docs category grouping | done | Backend `Category` field on doc entries. Frontend groups sidebar by category with headings. Four categories: Getting Started, Platform, Extension Development, Operations. |
+| Permissions & Groups guide | done | RBAC model, 7 permission slugs, system/custom groups, settings cascade, extension permissions. |
+| Workflows user guide | done | Entry modes, stages, team roles, signoff gates, SLA, public forms, branch rules, Starlark hooks. |
+| Starlark Reference | done | Sandbox constraints, 10 modules with function signatures, permission gates, example hook script. |
+| Frontend JS Guide | done | Preact+htm runtime, 16 SDK modules with API reference, shell topbar patterns, CSS contract. |
+| Extension config_section docs | done | Manifest schema, backend discovery, frontend contract, example component. Added to Extension Guide. |
+| Docs content refresh | done | All 10 user-facing docs reviewed for v0.7.x accuracy: rebrand volume names, stale CSS vars, TLS_MODE env, self-hosted font notes, Architecture frontend section. |
+| Team Admin Workflows split | done | 722-line `workflows.js` split into 3 modules: `workflows.js` (router+CRUD), `workflow-editor.js` (editor+stages), `workflow-monitor.js` (assignments+monitor+signoff). |
+| Stale CSS variable fix | done | `--bg-2` references in `sw-shell.css` and `sw-primitives.css` replaced with `--bg-secondary`. |
+
+### v0.7.5 — Headless E2E + CI Gate
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Playwright test harness | | `ci/e2e-surface-test.sh` — docker-compose, chromium, run-all, assert. |
+| Screenshot-on-failure | | Full-page screenshot + console log. CI artifacts. |
+| Navigation smoke test | | Playwright visits every surface. Asserts topbar, no JS errors, home link works. |
+| Visual regression baseline | | Optional screenshot diff. Not a gate — report for review. |
+| CI pipeline integration | | Enable `test-runners` stage, add `e2e-smoke` stage. Failure blocks merge. |
 
 ---
 
-## Post-MVP
+## Post-v0.7.x
 
-- LLM participation (`llm-bridge` extension: subscribes to `chat.message.created`, calls `provider.complete()`, streams response via `realtime.publish`, posts via `chat.send()`. Bot participants with persona config. Multi-model conversations.)
+- **LLM participation** (`llm-bridge` extension)
-- Rich media extensions: image generation, code sandbox, STT/TTS
+- **Rich media extensions:** image generation, code sandbox, STT/TTS
-- Desktop app (Tauri or Electron)
+- **Desktop app** (Tauri or Electron)
-- Sidecar tier: container-based extensions
+- **Sidecar tier:** container-based extensions
-- Federation: cross-instance package sharing
+- **Federation:** cross-instance package sharing
-- Plugin marketplace with signing and review
+- **Plugin marketplace** with signing and review
 
 ---
 
@@ -172,22 +207,24 @@ Then ship.
 
 | Decision | Rationale |
 |----------|-----------|
-| Tasks → extension | Scheduler was the most entangled kernel component (~3,400 lines). Rebuilding as extension validates the trigger system and removes the worst compilation debt. Three trigger primitives (time, webhook, event) replace the monolithic scheduler. |
+| Tasks → extension | Three trigger primitives replace the monolithic scheduler. |
-| Sessions removed | Kernel-managed sessions replaced by workflow instances with dedicated storage (ext_data tables or kernel table). |
+| Sessions removed | Workflow instances with dedicated storage replace kernel sessions. |
-| `custom` stage mode | Stage mode `custom` delegates to a surface package, proving extension composability. Chat-in-workflow is handled by the chat extension, not the kernel. |
+| `custom` stage mode | Delegates to a surface package, proving extension composability. |
-| Providers removed from kernel | Provider configs, model catalog, routing policies — all moved to extension track. Kernel provides credential storage (connections) and the Starlark `provider.complete` module as the interface. |
+| Providers removed from kernel | Connections + Starlark `provider.complete` as the interface. |
-| Kernel permissions simplified | 6 platform permissions. Extensions define their own capability requirements in manifests. |
+| Kernel permissions simplified | 6 platform permissions. Extensions define their own. |
-| Preact+htm retained | 3KB runtime, no build step, works for extension authors without bundler config. KISS. |
+| Preact+htm retained | 3KB runtime, no build step, KISS. |
-| Single Docker image | Drop the frontend/backend split. Go binary + assets + migrations in one image. Simpler deployment, fewer moving parts. |
+| Single Docker image | Go binary + assets + migrations. |
-| Admin → RBAC group | The `role` column is pre-RBAC. v0.2.0 replaces it with a seeded "Admins" group + `surface.admin.access` grant. All users auto-join "Everyone" group. Admin middleware becomes a grant check, not a role check. |
+| Admin → RBAC group | Grant check replaces role check. |
-| Settings cascade | RBAC controls scope auth (who can set at what level). `user_overridable` flag controls whether lower scopes can override higher. Two orthogonal axes, composes cleanly with extension manifests. |
+| Settings cascade | Scope auth + `user_overridable`. Two orthogonal axes. |
-| No new migrations pre-MVP | Edit existing migration SQL files in place. No migration chains until schema is in production. |
+| No new migrations pre-MVP | Proper versioned migrations post-MVP. |
-| Notes over Editor | First surface is Obsidian-style notes (rich text, folders, backlinks) instead of a code editor. Notes is a stronger E2E proof — it exercises ext_data, storage, and the SDK more fully than a pure-browser CM6 editor. |
+| Chat as extension, not kernel | Zero kernel awareness. Proves extensibility thesis. |
-| No built-in auto-install | Extensions ship in the repo but are not auto-installed. Distribution model TBD — explicit install only. Keeps the kernel clean and avoids opinionated defaults. |
+| PG as consensus layer | UNLOGGED node_registry + LISTEN/NOTIFY. No etcd/Consul/Redis. |
-| Chat as extension, not kernel | Human-to-human chat built entirely as library + surface packages. Zero kernel awareness of conversations, messages, or participants. Kernel gains one generic `realtime` module. Proves near-infinite extensibility. LLM participation layers on top via a separate bridge extension — the chat system doesn't know or care whether a participant is human or AI. |
+| Two trigger tiers | Extension-declared (full sandbox) vs user ad-hoc (restricted). |
-| PG as consensus layer | Horizontal scaling uses PG as the sole coordinator (UNLOGGED node_registry + LISTEN/NOTIFY). No etcd, Consul, Redis, or Raft. Rationale: system is already tightly coupled to PG; adding a second consensus layer doubles operational complexity for zero benefit at homelab-to-small-team scale. UNLOGGED table is visible to all connections, survives session disconnect, and cleans up automatically on PG crash — correct behavior since all nodes are dead anyway. Sweep-all for health (every node deletes stale rows) is simpler than ring topology and has no edge cases. |
+| Builtin package rationale | Must enhance kernel surfaces or demonstrate platform capabilities. |
-| Two trigger tiers | Event + webhook triggers are extension-declared (manifest contract, full sandbox). Scheduled tasks are user-created ad-hoc (restricted sandbox — no raw HTTP, no DB table creation, connections-only outbound). Separation keeps extension contracts static and user automation safe. |
+| Two-slot topbar model | Left slot (title/branding) + center slot (`flex: 1`, tabs/pickers). Two named slots cover every navigation pattern: simple title (Pattern A), flat tabs full-width (Pattern B), category tabs + surface-owned sidebar (Pattern C). Surfaces without sub-items get full content width; surfaces with hierarchical navigation add their own sidebar below the topbar. Shell provides the stage; surface decides the theater. |
-| Scheduled task identity | Tasks run as their creator (RBAC-scoped). Admin-created tasks can opt into system context. Creator deactivation pauses the schedule. Ensures audit trail and permission boundaries. |
+| All four primary surfaces migrate to shell topbar | Admin was "keep custom topbar" initially. The two-slot model makes it unnecessary — category tabs fit in the center slot, sidebar is surface-owned below. One topbar implementation replaces four. Bell + user menu + reactivity come free on every surface. |
-| Builtin package rationale | A builtin must enhance kernel surfaces or be required to demonstrate the platform's own capabilities. **notes** — primary content surface, exercises ext_data/storage/SDK/settings/realtime fully. **chat + chat-core** — primary communication surface, proves the extensibility thesis (100% extension, zero kernel awareness). **mermaid-renderer** — docs surface uses Mermaid diagrams to explain the architecture; without it the platform's own documentation doesn't render (self-bootstrapping). **schedules** — UI for the kernel's scheduled task system; without it users can't manage cron jobs (kernel primitive UI). All others are domain features, examples, dormant, or LLM-only tools — available via registry or `BUNDLED_PACKAGES=*`. |
+| Settings / Team Admin → flat tabs (Pattern B) | Both had thin sidebars (~140px) that consumed width without justification. 5–6 sections fit cleanly in topbar tabs. Full-width content is a better use of space for these surfaces. |
-| Cluster dashboard retired | `cluster-dashboard` shipped as a standalone surface package (v0.6.0) as an expedient. Health/metrics belong inside the Admin surface as a tab — shared context, no separate nav entry, no install required. Merged in v0.6.4. |
+| Team Admin Groups removed | 37-line read-only dead-end. Admin Groups has full CRUD. Restore when properly designed. |
-| Block renderers decoupled from chat | `mermaid-renderer`, `katex-renderer`, `csv-table`, `diff-viewer` shipped with `"requires": ["chat"]` because renderer discovery lived inside the chat surface. These are content renderers, not chat features. v0.6.4 removes the constraint; v0.6.5 lifts renderer registration to the kernel SDK so all surfaces share it without reimplementing discovery. |
+| Docs is the reference surface | Only surface with shell Topbar, bell, user menu, inline errors. Others converge. |
+| Surface runners over expanding ICD | Different test tier, different failure class. |
+| Headless E2E via Playwright | Runners produce structured JSON; Playwright navigates and reads output. |

VERSION

@@ -1 +1 @@
-0.6.15
+0.7.4

ci/Dockerfile.test-runner

@@ -0,0 +1,11 @@
+# ci/Dockerfile.test-runner — Pre-built Playwright test runner
+#
+# Build & push (one-time, repeat when Playwright version bumps):
+#   docker build -t registry.gobha.me:5000/ci-test-runner:latest -f ci/Dockerfile.test-runner .
+#   docker push registry.gobha.me:5000/ci-test-runner:latest
+#
+# The CI compose override uses this image directly, avoiding npm install
+# on every run. Only the ci/ scripts are COPY'd at compose build time.
+FROM mcr.microsoft.com/playwright:v1.52.0-noble
+WORKDIR /work
+RUN npm init -y && npm install playwright@1.52.0

ci/run-surface-tests.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# ═══════════════════════════════════════════════
+# Surface Test Runner — CI Entrypoint
+# ═══════════════════════════════════════════════
+#
+# Authenticates as admin, navigates to the test-runners surface
+# via Playwright, runs all test suites, and asserts zero failures.
+#
+# Prerequisites:
+#   - Server running at $SERVER_URL (default: http://localhost:3000)
+#   - npx playwright install chromium
+#   - ADMIN_USER / ADMIN_PASS env vars (default: admin/admin)
+#
+# Exit codes: 0 = all tests passed, 1 = failures detected
+set -euo pipefail
+
+SERVER_URL="${SERVER_URL:-http://localhost:3000}"
+ADMIN_USER="${ADMIN_USER:-admin}"
+ADMIN_PASS="${ADMIN_PASS:-admin}"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+echo -e "${YELLOW}═══ Surface Test Runner ═══${NC}"
+echo "  Server: ${SERVER_URL}"
+
+# ── Authenticate ─────────────────────────────
+echo -e "${YELLOW}Authenticating...${NC}"
+TOKEN=$(curl -sf -X POST "${SERVER_URL}/api/v1/auth/login" \
+  -H "Content-Type: application/json" \
+  -d "{\"login\":\"${ADMIN_USER}\",\"password\":\"${ADMIN_PASS}\"}" \
+  | node -e "process.stdin.resume(); let d=''; process.stdin.on('data',c=>d+=c); process.stdin.on('end',()=>{try{console.log(JSON.parse(d).token)}catch(e){process.exit(1)}})")
+
+if [ -z "$TOKEN" ]; then
+  echo -e "${RED}Failed to authenticate${NC}"
+  exit 1
+fi
+echo -e "${GREEN}Authenticated${NC}"
+
+# ── Run via Playwright ───────────────────────
+echo -e "${YELLOW}Running surface tests via Playwright...${NC}"
+node "$(dirname "$0")/surface-test-driver.js" \
+  --server="${SERVER_URL}" \
+  --token="${TOKEN}"
+
+EXIT_CODE=$?
+
+if [ $EXIT_CODE -eq 0 ]; then
+  echo -e "${GREEN}═══ All surface tests passed ═══${NC}"
+else
+  echo -e "${RED}═══ Surface tests FAILED ═══${NC}"
+fi
+
+exit $EXIT_CODE

ci/surface-test-driver.js

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+/**
+ * Surface Test Driver — Playwright-based CI runner
+ *
+ * Navigates to /s/test-runners as admin, clicks "Run All",
+ * waits for completion, then fetches results from the API.
+ *
+ * Usage:
+ *   node ci/surface-test-driver.js --server=http://localhost:3000 --token=TOKEN
+ *
+ * Exit codes: 0 = all passed, 1 = failures
+ */
+'use strict';
+
+const { chromium } = require('playwright');
+
+// Parse args
+const args = {};
+process.argv.slice(2).forEach(a => {
+  const [k, v] = a.replace(/^--/, '').split('=');
+  args[k] = v;
+});
+
+const SERVER = args.server || 'http://localhost:3000';
+const TOKEN = args.token || '';
+
+if (!TOKEN) {
+  console.error('ERROR: --token is required');
+  process.exit(1);
+}
+
+(async () => {
+  const browser = await chromium.launch({ headless: true });
+  const context = await browser.newContext();
+
+  // Set auth cookie — name must match server's SetCookie ("arm_token")
+  await context.addCookies([{
+    name: 'arm_token',
+    value: TOKEN,
+    domain: new URL(SERVER).hostname,
+    path: '/',
+  }]);
+
+  const page = await context.newPage();
+
+  // Collect console errors
+  const consoleErrors = [];
+  page.on('console', msg => {
+    if (msg.type() === 'error') consoleErrors.push(msg.text());
+  });
+
+  try {
+    // Navigate to test runners surface
+    console.log('Navigating to test-runners surface...');
+    await page.goto(SERVER + '/s/test-runners', { waitUntil: 'networkidle', timeout: 30000 });
+
+    // Wait for the "Run All" button — suites load asynchronously so the
+    // button only appears once runners have registered their suites.
+    console.log('Waiting for Run All button...');
+    const runAllBtn = await page.waitForSelector('button:has-text("Run All")', { timeout: 60000 })
+      .catch(() => null);
+    if (!runAllBtn) {
+      // Dump page content for debugging
+      const text = await page.textContent('body').catch(() => '(empty)');
+      console.error('ERROR: "Run All" button not found. Page text:', text.substring(0, 500));
+      await browser.close();
+      process.exit(1);
+    }
+    console.log('Clicking Run All...');
+    await runAllBtn.click();
+
+    // Wait for results — poll until running state clears
+    console.log('Waiting for test completion...');
+    // The running indicator disappears when tests finish
+    // Max wait: 5 minutes
+    const maxWait = 300000;
+    const start = Date.now();
+    let done = false;
+
+    while (!done && (Date.now() - start) < maxWait) {
+      await page.waitForTimeout(2000);
+
+      // Check if results are available via API
+      try {
+        const resp = await page.evaluate(async (serverUrl) => {
+          const r = await fetch(serverUrl + '/api/v1/admin/test-runners/results', {
+            credentials: 'include'
+          });
+          if (r.status === 200) return await r.json();
+          return null;
+        }, SERVER);
+
+        if (resp && resp.summary) {
+          done = true;
+          console.log('\n═══ Results ═══');
+          console.log(`  Total:   ${resp.summary.total}`);
+          console.log(`  Passed:  ${resp.summary.passed}`);
+          console.log(`  Failed:  ${resp.summary.failed}`);
+          console.log(`  Warned:  ${resp.summary.warned}`);
+          console.log(`  Skipped: ${resp.summary.skipped}`);
+          console.log(`  Duration: ${resp.duration_ms}ms`);
+
+          if (resp.summary.failed > 0) {
+            console.log('\n═══ Failures ═══');
+            for (const suite of (resp.suites || [])) {
+              for (const test of (suite.tests || [])) {
+                if (test.status === 'failed') {
+                  console.log(`  ✗ ${suite.name} > ${test.name}: ${test.detail || 'failed'}`);
+                }
+              }
+            }
+            await browser.close();
+            process.exit(1);
+          }
+
+          await browser.close();
+          process.exit(0);
+        }
+      } catch (e) {
+        // Results not ready yet
+      }
+    }
+
+    if (!done) {
+      console.error('ERROR: Tests did not complete within timeout');
+      await browser.close();
+      process.exit(1);
+    }
+
+  } catch (e) {
+    console.error('Driver error:', e.message);
+    if (consoleErrors.length > 0) {
+      console.error('\nBrowser console errors:');
+      consoleErrors.forEach(e => console.error('  ' + e));
+    }
+    await browser.close();
+    process.exit(1);
+  }
+})();

ci/wait-for-healthy.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# ═══════════════════════════════════════════════
+# Wait for Armature server to be healthy
+# ═══════════════════════════════════════════════
+# Usage: ./ci/wait-for-healthy.sh [URL] [MAX_RETRIES]
+set -euo pipefail
+
+HOST="${1:-http://localhost:3000}"
+MAX_RETRIES="${2:-60}"
+
+echo "Waiting for ${HOST} to be healthy..."
+for i in $(seq 1 "$MAX_RETRIES"); do
+  if curl -sf --connect-timeout 2 "${HOST}/api/v1/health" -o /dev/null 2>/dev/null; then
+    echo "Server healthy after ${i}s"
+    exit 0
+  fi
+  sleep 1
+done
+
+echo "Server not healthy after ${MAX_RETRIES}s"
+exit 1

docker-compose.ci.yml

@@ -0,0 +1,44 @@
+# docker-compose.ci.yml — CI test override
+#
+# Extends base docker-compose.yml. Adds a healthcheck to armature and a
+# Playwright test-runner service.  All containers share the default compose
+# bridge network, so the test-runner reaches armature via Docker DNS
+# (http://armature:80).
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+#     --abort-on-container-exit --exit-code-from test-runner
+#
+# The workflow exits with the test-runner's exit code (0 = pass, 1 = fail).
+#
+# NOTE: Do NOT use network_mode: host — the workflow container and compose
+# containers are in separate network namespaces inside DinD. Use the default
+# bridge network and let services talk via Docker DNS instead.
+
+services:
+  armature:
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:80/api/v1/health"]
+      interval: 2s
+      timeout: 3s
+      retries: 30
+      start_period: 5s
+
+  test-runner:
+    build:
+      context: .
+      dockerfile_inline: |
+        FROM mcr.microsoft.com/playwright:v1.52.0-noble
+        WORKDIR /work
+        RUN npm init -y && npm install playwright@1.52.0
+        COPY ci/ /work/ci/
+        RUN chmod +x /work/ci/*.sh
+    depends_on:
+      armature:
+        condition: service_healthy
+    working_dir: /work
+    environment:
+      SERVER_URL: http://armature:80
+      ADMIN_USER: admin
+      ADMIN_PASS: admin
+    command: ["bash", "-c", "./ci/run-surface-tests.sh"]

docker-compose.yml

@@ -33,7 +33,7 @@ services:
       EXT_ALLOW_PRIVATE_IPS: ${EXT_ALLOW_PRIVATE_IPS:-true}
       LOG_FORMAT: ${LOG_FORMAT:-text}
       LOG_LEVEL: ${LOG_LEVEL:-info}
-      BUNDLED_PACKAGES: ${BUNDLED_PACKAGES:-}
+      BUNDLED_PACKAGES: ${BUNDLED_PACKAGES:-*}
       # Dev seed users — ignored if ENVIRONMENT=production
       SEED_USERS: ${SEED_USERS:-alice:password123:user,bob:password456:user,charlie:password789:user}
     volumes:

docs/ARCHITECTURE.md

@@ -271,12 +271,13 @@ graph TD
 ## Frontend
 
 Preact (3KB) + htm (tagged template literals). No build step, no bundler
-(except CM6 via esbuild). IIFE/global-namespace pattern with
+(except CM6 via esbuild). ES modules loaded via `<script type="module">`.
-`sb.register()`/`sb.ns()`.
+The SDK is exposed at `window.sw` — see the [Frontend JS Guide](FRONTEND-JS-GUIDE).
 
-The shell loads surfaces into a viewport. Extensions use `window.html`
+The shell provides a two-slot topbar (left title + center slot) that every
-and `window.preact` directly. Hooks via `window.hooks`. Vendor libs
+surface inherits. Extensions use `window.html` and `window.preact` directly.
-(marked.js, DOMPurify, KaTeX, CodeMirror 6) baked into the image.
+Hooks via `window.hooks`. Vendor libs (marked.js, DOMPurify, KaTeX,
+CodeMirror 6) baked into the image.
 
 ## Deployment
 

docs/AUDIT-surfaces.md

@@ -0,0 +1,209 @@
+# Surface Audit — Settings, Admin, Team Admin, Docs
+
+## Audit Methodology
+
+For each surface: read the index.js (tab/section structure), read every
+section module, check the HTML template, trace the topbar/navigation
+pattern, identify bugs, missing features, dead ends, and legacy baggage.
+
+---
+
+## 1. Settings Surface
+
+**Files:** `src/js/sw/surfaces/settings/` (7 files, ~868 lines)
+**Template:** `surfaces/settings.html` — mounts into `#settings-mount`
+**Topbar:** Custom — back arrow + user icon + "Settings" title. No bell. No user menu.
+
+### Sections
+
+| Section | Lines | Status | Notes |
+|---------|-------|--------|-------|
+| General | 62 | ✅ OK | Default surface picker. Clean. |
+| Appearance | 78 | ✅ OK | Theme toggle (light/dark/system) + UI scale slider. |
+| Profile | 180 | ✅ OK | Display name, email, avatar upload, password change. |
+| Teams | 47 | ⚠️ Thin | Read-only list of your teams. No actions. No link to team admin. |
+| Connections | 222 | ✅ OK | Personal BYOK connection CRUD. Functional. |
+| Notifications | 96 | ✅ OK | Toggle notification types on/off. |
+
+### Issues Found
+
+| # | Severity | Issue |
+|---|----------|-------|
+| S1 | **P1** | **No notification bell.** Custom topbar renders back arrow + icon + "Settings" — no bell, no user menu dropdown. User can't see notifications or navigate to other surfaces without using the back button. |
+| S2 | **P2** | **Teams section is a dead-end.** Lists your teams with no actions — can't leave team, can't navigate to team admin, can't see team details. Just names. Should either link to team admin or show useful info. |
+| S3 | **P2** | **Back button uses sessionStorage return URL.** `sb_settings_return` stash means: open settings in a new tab → back goes to `/` (correct). But open settings from a deep link → back goes to referrer, which might be unexpected. Shell topbar with consistent home link would fix this. |
+| S4 | **P3** | **Extension config sections.** `__CONFIG_SECTIONS__` injection works but has no documentation. Extension authors don't know they can add settings sections. Needs a docs entry. |
+
+### Shell Topbar Migration
+
+Settings renders its own `settings-topbar`. With shell topbar injection:
+- **Option A (simple):** `sw.shell.topbar.hide()` and keep custom topbar. Works immediately.
+- **Option B (ideal):** Remove custom topbar. Shell topbar provides back + title + bell + user menu. Settings nav stays in the sidebar.
+- **Recommendation:** Option B. Settings topbar adds nothing the shell topbar doesn't. The back arrow just navigates to `/`.
+
+---
+
+## 2. Admin Surface
+
+**Files:** `src/js/sw/surfaces/admin/` (13 files, ~2,522 lines)
+**Template:** `surfaces/admin.html` — mounts into `#admin-mount`
+**Topbar:** Custom — favicon + "Administration" + category tabs (People/Workflows/System/Monitoring) + UserMenu component. No notification bell.
+
+### Sections
+
+| Section | Category | Lines | Status | Notes |
+|---------|----------|-------|--------|-------|
+| Users | People | 152 | ✅ OK | User list, create, edit status/role. Functional. |
+| Teams | People | 178 | ✅ OK | Team list, create, member management. |
+| Groups | People | 207 | ✅ OK | Full CRUD — create, delete, permission toggles, member add/remove. Functional but **undocumented** (see issues). |
+| Workflows | Workflows | 163 | ⚠️ | CRUD + stage editor. `sw.api.workflows.list()` — needs same error-surfacing treatment as workflow-demo. |
+| Settings | System | 242 | ✅ OK | Comprehensive: default surface, registration, banner, message bar, footer, session TTLs, vault, package registry, email test. Actually solid. |
+| Storage | System | 76 | ✅ OK | Status cards, orphan cleanup. Clean. |
+| Packages | System | 391 | ⚠️ | Core feature. Large. Package list, install, uninstall, registry browse. **User menu doesn't update after install/uninstall** (main bug Jeff reported). |
+| Connections | System | 210 | ✅ OK | Global connection CRUD. |
+| Broadcast | System | 44 | ✅ OK | Send broadcast. Minimal. |
+| Backup | System | 162 | ✅ OK | Create/restore/download/delete. Works. |
+| Health | Monitoring | 209 | ✅ OK | Runtime, DB pool, cluster, extension metrics. |
+| Audit | Monitoring | 88 | ✅ OK | Audit log viewer with pagination. |
+
+### Issues Found
+
+| # | Severity | Issue |
+|---|----------|-------|
+| A1 | **P1** | **User menu not reactive to package changes.** `UserMenu` fetches surface list once on mount (`useEffect([authenticated])`). Installing/uninstalling a package doesn't trigger re-fetch. User must refresh the page to see new surfaces in the menu. Same for role changes (adding as team-admin). |
+| A2 | **P1** | **No notification bell.** Admin topbar has category tabs + UserMenu but no NotificationBell component. |
+| A3 | **P2** | **Groups: no documentation or inline help.** Admin Groups has full CRUD but zero explanation of what groups are, what permissions mean, or how the RBAC model works. "No groups" → user creates one → sees a list of permission slugs like `surface.admin.access` with no description. Every permission should have a human-readable description. |
+| A4 | **P2** | **Workflows: silent error potential.** `sw.api.workflows.list()` — if this fails, `catch (e) { sw.toast(e.message, 'error'); }` fires a toast but leaves the list empty. Better than workflow-demo's silent swallow, but the toast disappears and the user is left with an empty list + no context. Should show inline error state. |
+| A5 | **P2** | **Packages: no post-install feedback.** After installing a package, the package list refreshes (good) but the user menu doesn't update (bad — A1). User installs Notes, doesn't see it in the menu, thinks it's broken. |
+| A6 | **P3** | **Admin topbar favicon is hardcoded.** Line 142: `<img src="${BASE}/favicon.svg">`. Should respect light/dark theme favicon swap. |
+| A7 | **P3** | **Category icon rendering is fragile.** Custom compact SVG format (`C12 12 3\|M19.4 15...`) in `CatIcon`. Works but is unmaintainable — any icon change requires understanding the custom format. Should use standard SVG paths or lucide/feather icons. |
+
+### Shell Topbar Migration
+
+Admin has the most complex custom topbar — category tabs are genuinely useful navigation. Options:
+- **Option A (recommended):** `sw.shell.topbar.hide()`. Admin keeps its custom topbar but adds NotificationBell component to its existing right-side area next to UserMenu.
+- **Option B:** Shell topbar with `sw.shell.topbar.setSlot()` for category tabs. Works but requires rethinking the layout since shell topbar has fixed structure (home | title | slot | bell | user).
+- **Recommendation:** Option A for v0.7.0. Admin's custom topbar is bespoke enough to warrant keeping. Just wire in the bell.
+
+---
+
+## 3. Team Admin Surface
+
+**Files:** `src/js/sw/surfaces/team-admin/` (7 files, ~1,119 lines)
+**Template:** `surfaces/team-admin.html` — mounts into `#team-admin-mount`
+**Topbar:** Custom — back arrow + "Team Admin: {team name}" title. No bell. No user menu.
+
+### Sections
+
+| Section | Lines | Status | Notes |
+|---------|-------|--------|-------|
+| Members | ~90 | ✅ OK | Member list, add, remove. Functional. |
+| Groups | 37 | ❌ Dead-end | Read-only "No groups" display. No create, no docs, no link to admin. |
+| Connections | ~120 | ✅ OK | Team-scoped connections. Same pattern as user/admin connections. |
+| Workflows | 723 | ⚠️ Massive | Three tabs: Workflows (CRUD + inline stage editor), Assignments (claim/release/complete), Monitor (active instances + signoff). This is 65% of the surface's code. |
+| Settings | 72 | ✅ OK | Team name + description. Clean. |
+| Activity | ~80 | ✅ OK | Audit log. Works. |
+
+### Issues Found
+
+| # | Severity | Issue |
+|---|----------|-------|
+| T1 | **P1** | **Groups is a dead-end.** 37 lines. Read-only list of team groups. No "Create Group" button. No explanation of what groups are. No link to Admin > Groups where creation actually happens. A team admin user who isn't a platform admin literally cannot create team groups. The Admin groups page supports `scope: team` but that creates a global group with team scope — it's unclear if team-admin should even see groups at all. |
+| T2 | **P1** | **Workflows "Adopt Global" — same silent-error class.** `sw.api.teams.availableWorkflows(teamId)` — if this fails, the catch fires a toast but the adopt panel shows "No global workflows available" — indistinguishable from "there genuinely aren't any" vs "the API errored." |
+| T3 | **P1** | **Workflows is disproportionately complex.** 723 lines — inline stage editor with mode/type selectors, SLA fields, stage reordering, team role assignment per stage. This is a full workflow designer embedded in a tab. It works but it's a maintenance burden and the UX is dense. Question: should this complexity live here or be a separate workflow-designer surface? |
+| T4 | **P1** | **No notification bell.** Same as Settings — custom topbar with no bell. |
+| T5 | **P2** | **No user menu.** Unlike Admin (which renders UserMenu), Team Admin has no user menu in its topbar. User can't navigate to other surfaces except via the back button. |
+| T6 | **P2** | **Signoff panel shows raw user_id.** Line 714: `<span>${s.user_id}</span>` — shows UUID instead of display name. Should use `sw.users.displayName(s.user_id)`. |
+| T7 | **P3** | **Back button uses sessionStorage.** Same pattern as Settings (`sb_team_admin_return`). Shell topbar would fix. |
+
+### Shell Topbar Migration
+
+Team Admin has a simple topbar (back + title). Direct replacement:
+- Shell topbar provides: home link + "Team Admin: {name}" title + bell + user menu.
+- Team name from `sw.api.teams.get(teamId)` → `sw.shell.topbar.setTitle('Team Admin: ' + team.name)`.
+- Delete the custom topbar entirely.
+
+---
+
+## 4. Docs Surface
+
+**Files:** `src/js/sw/surfaces/docs/` (1 file, 313 lines)
+**Template:** `surfaces/docs.html` — mounts into `#docs-mount`
+**Topbar:** Imports and renders `shell/topbar.js` (the SDK Topbar component). **Only surface that uses the shell Topbar.**
+
+### Features
+
+| Feature | Status | Notes |
+|---------|--------|-------|
+| Document list sidebar | ✅ OK | Fetches from `/api/v1/docs`, renders nav links. |
+| Markdown rendering | ✅ OK | Uses `sw.markdown.renderSync()` + post-renderers (mermaid, katex). |
+| Document outline | ✅ OK | Parses H1-H4 from markdown, renders table of contents. |
+| Search | ✅ OK | Filters documents in sidebar. |
+| URL updates | ✅ OK | `history.replaceState` on doc change. |
+| Topbar | ✅ OK | Uses shell `Topbar` component — has title, bell, user menu. |
+
+### Issues Found
+
+| # | Severity | Issue |
+|---|----------|-------|
+| D1 | **P2** | **Stale content.** The docs themselves may be outdated — GETTING-STARTED, EXTENSION-GUIDE, API-REFERENCE, DEPLOYMENT, PACKAGE-FORMAT were written in v0.6.1. 18 versions later, some content is likely stale. Needs a content review pass. |
+| D2 | **P3** | **No docs for RBAC/Groups.** Admin Groups exists with full CRUD but there's no documentation explaining the permission model, what each permission slug means, how groups interact with teams, or how the settings cascade works. This directly causes the "groups WTF" reaction. |
+| D3 | **P3** | **No docs for Workflows.** The workflow engine is complex (multi-stage, team roles, signoff gates, SLA, public entry) but has no user-facing documentation. `DESIGN-WORKFLOWS.md` exists but is a design doc, not a user guide. |
+| D4 | **P3** | **Shell topbar migration.** Docs already imports `shell/topbar.js` — when shell topbar injection lands, Docs will get a double topbar. Needs migration: delete the import, let shell topbar handle it. Docs currently passes no custom slot content, so it's a pure delete. |
+
+---
+
+## Cross-Surface Issues
+
+These affect multiple or all surfaces:
+
+| # | Severity | Issue | Surfaces |
+|---|----------|-------|----------|
+| X1 | **P0** | **User menu not reactive.** Package install/uninstall, role changes, team membership changes — none trigger a menu refresh. User must reload the page. | All (via UserMenu component) |
+| X2 | **P1** | **No notification bell on 3/4 surfaces.** Only Docs has a bell (via Topbar import). Settings, Admin, and Team Admin all lack it. | Settings, Admin, Team Admin |
+| X3 | **P1** | **No user menu on 2/4 surfaces.** Settings and Team Admin have no user menu at all. Admin and Docs have one. | Settings, Team Admin |
+| X4 | **P2** | **Every surface has its own topbar.** Four different topbar implementations. None use the (not-yet-existing) shell topbar injection. Shell topbar (v0.7.0) eliminates this duplication. | All |
+| X5 | **P2** | **Silent error swallowing.** Multiple sections use `catch (e) { toast }` which fires a toast and leaves an empty/stale UI. Toast disappears after seconds; user is left confused. Every list endpoint needs an inline error state with retry. | Admin Workflows, Team Admin Workflows, Packages |
+| X6 | **P2** | **Empty states provide no guidance.** "No groups", "No workflows", "No notifications" — no explanation of what the feature is, why it's empty, or what action to take. Every empty state should have a one-line explanation and a primary action (create, link to docs, etc.). | Admin Groups, Team Admin Groups, Workflows |
+| X7 | **P3** | **Raw IDs in UI.** Team Admin signoff panel shows `user_id` UUIDs. Any surface showing IDs should resolve via `sw.users.displayName()`. | Team Admin Workflows |
+
+---
+
+## Recommendations
+
+### Immediate (fold into v0.7.0)
+
+1. **User menu reactivity** — emit `package.changed` and `auth.changed` events over WS + local custom events. UserMenu listens and re-fetches surface list. This is the single most impactful fix.
+
+2. **Shell topbar migration for Settings + Team Admin** — both have simple topbars that the shell topbar directly replaces. Docs deletes its Topbar import. Admin keeps its custom topbar but adds NotificationBell.
+
+3. **Remove Team Admin Groups tab** — it's 37 lines of dead-end. Team-scoped group management should either (a) be added properly with create/edit/delete or (b) removed until it's properly designed. Showing "No groups" with no path forward is worse than not showing the tab.
+
+4. **Error states** — replace `catch { toast }` with inline error + retry UI on every list endpoint. Systematic pass across all four surfaces.
+
+5. **Empty state copy** — every "No X" message gets a one-line explanation + primary action button or doc link.
+
+### Deferred (v0.7.1+ / runner coverage)
+
+6. **Admin Groups documentation** — write a "Permissions & Groups" doc for the docs surface. Explain the RBAC model, list all permission slugs with descriptions, explain group scoping.
+
+7. **Workflow user guide** — write a "Workflows" doc. Entry modes, stage types, team roles, signoff gates, SLA.
+
+8. **Team Admin Workflows simplification** — the 723-line inline stage editor is the most complex piece of UI in the entire application. Consider extracting to a dedicated workflow-designer surface or at minimum breaking into separate files.
+
+9. **Docs content refresh** — review all 5 docs for accuracy at v0.6.18+.
+
+10. **Settings Teams section** — either add useful actions (link to team admin, show team role, leave team) or remove the tab.
+
+---
+
+## Asset Inventory
+
+| Surface | Lines (total) | Sections | Custom Topbar | Bell | UserMenu | Error Handling |
+|---------|--------------|----------|---------------|------|----------|---------------|
+| Settings | 868 | 6 | Yes (back+icon) | ❌ | ❌ | Toast only |
+| Admin | 2,522 | 12 | Yes (tabs+menu) | ❌ | ✅ | Toast only |
+| Team Admin | 1,119 | 6 | Yes (back+title) | ❌ | ❌ | Toast only |
+| Docs | 313 | 1 | Shell Topbar ✅ | ✅ | ✅ | Inline error ✅ |
+
+Docs is the gold standard. The other three need to converge toward its pattern.

docs/DEPLOYMENT.md

@@ -41,13 +41,13 @@ services:
       STORAGE_BACKEND: pvc
       STORAGE_PATH: /data/storage
     volumes:
-      - sb_storage:/data/storage
+      - armature_storage:/data/storage
     depends_on:
       - postgres
 
 volumes:
   pg_data:
-  sb_storage:
+  armature_storage:
 ```
 
 ## Kubernetes
@@ -70,6 +70,7 @@ See the `k8s/` directory for example manifests. Key considerations:
 | `JWT_SECRET` | `dev-secret-change-me` | Token signing key -- **must change** |
 | `ENCRYPTION_KEY` | | AES-256 key for credential vault |
 | `AUTH_MODE` | `builtin` | `builtin`, `mtls`, `oidc` |
+| `TLS_MODE` | (empty) | `native` for node-to-node mTLS. Requires `MTLS_CERT_PATH` and `MTLS_KEY_PATH`. |
 | `STORAGE_BACKEND` | auto | `pvc` or `s3` |
 | `STORAGE_PATH` | `/data/storage` | PVC mount point |
 | `BASE_PATH` | | URL prefix (e.g., `/armature`) |

docs/DESIGN-shell-contract.md

@@ -0,0 +1,448 @@
+# DESIGN: Shell Contract — v0.7.0
+
+## Status: Proposed
+
+## Problem
+
+Extension surfaces render into `#extension-mount` with no shell chrome.
+A full audit (docs/AUDIT-surfaces.md) found: 3/4 primary surfaces lack a
+notification bell, 2/4 lack a user menu, 4 different topbar implementations,
+user menu never updates on package/role changes, toast-and-forget error
+handling, and empty states that explain nothing.
+
+## Solution
+
+### 1. Shell Topbar — Two-Slot Model
+
+The kernel injects a topbar for all extension surfaces. Two named slots
+(left + center) let surfaces customize without replacing the entire bar.
+
+**Layout:**
+
+```
+┌──────────────────────────────────────────────────────────────┐
+│  ←  │ [left]        │  [center: flex-1]         │ 🔔 │ 👤  │
+└──────────────────────────────────────────────────────────────┘
+```
+
+- **← (home):** Always visible. Navigates to `__BASE__/`. Simple `<a>`.
+- **Left slot:** Defaults to manifest title. Surfaces override with `setLeft()`.
+- **Center slot:** Empty by default. Surfaces inject tabs, search, pickers.
+  `flex: 1` — expands to fill available space.
+- **Bell + User Menu:** Always visible. Kernel-managed.
+
+**Template change** (`surfaces/extension.html`):
+
+```html
+{{define "surface-extension"}}
+<div id="extension-surface" class="extension-surface"
+     data-surface-id="{{.Surface}}">
+    <div id="shell-topbar" class="sw-topbar sw-topbar--shell"></div>
+    <div id="extension-mount" class="extension-mount" data-ext="{{.Surface}}"></div>
+</div>
+{{end}}
+```
+
+**SDK API:**
+
+```js
+sw.shell.topbar.setLeft(vnode)      // Override left slot (default: title)
+sw.shell.topbar.setSlot(vnode)      // Set center slot content
+sw.shell.topbar.setTitle(str)       // Shorthand: setLeft with plain text
+sw.shell.topbar.hide()              // Remove topbar entirely
+sw.shell.topbar.show()              // Restore after hiding
+```
+
+### 2. Three Navigation Patterns
+
+The shell topbar provides the top bar. What happens below it is the
+surface's business. Three patterns emerge naturally:
+
+#### Pattern A — Default (simple extensions, Docs)
+
+```
+┌──────────────────────────────────────────┐
+│  ←  │  Surface Title        │  🔔 │ 👤  │
+├──────────────────────────────────────────┤
+│                                          │
+│           Content (full width)           │
+│                                          │
+└──────────────────────────────────────────┘
+```
+
+Title only, no tabs, no sidebar. Content gets everything.
+Zero code required — kernel defaults handle it.
+
+**Used by:** Docs, Notes, Chat, simple extensions.
+
+#### Pattern B — Flat Tabs (no sidebar, full width)
+
+```
+┌──────────────────────────────────────────────────────────┐
+│  ←  │ Title │ Tab1 │ Tab2 │ Tab3 │ Tab4 │    │  🔔 │ 👤 │
+├──────────────────────────────────────────────────────────┤
+│                                                          │
+│              Content (full width, no sidebar)            │
+│                                                          │
+└──────────────────────────────────────────────────────────┘
+```
+
+Tabs in the topbar center slot. No sidebar — content fills the full
+viewport width. For surfaces with 3–7 sections that don't have sub-items.
+More real estate for content than a sidebar layout.
+
+**Surface code:**
+
+```js
+sw.shell.topbar.setSlot(html`
+    <div class="sw-topbar__tabs">
+        ${sections.map(s => html`
+            <a class="sw-topbar__tab ${active === s.key ? 'active' : ''}"
+               href=${s.href} onClick=${navigate}>${s.label}</a>
+        `)}
+    </div>
+`);
+```
+
+**Used by:** Team Admin (Members / Connections / Workflows / Settings / Activity),
+Settings, Schedules.
+
+#### Pattern C — Category Tabs + Sidebar (two-level)
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  ←  │ Title │ People │ Workflows │ System │ Mon │ 🔔 │ 👤  │
+├──────────┬──────────────────────────────────────────────────┤
+│ Users    │                                                  │
+│ Teams    │         Content                                  │
+│ Groups   │                                                  │
+│          │                                                  │
+└──────────┴──────────────────────────────────────────────────┘
+```
+
+Major categories in the topbar (via center slot). Surface renders its own
+sidebar inside the content area for sub-navigation within the active
+category. The shell topbar doesn't know about the sidebar — it's a
+surface-level div below `#extension-mount`.
+
+**Surface code:**
+
+```js
+// Topbar: major categories
+sw.shell.topbar.setLeft(html`
+    <img src="${BASE}/favicon.svg" width="18" height="18" style="vertical-align:-3px" />
+    <span style="margin-left:6px">Administration</span>
+`);
+sw.shell.topbar.setSlot(html`
+    <div class="sw-topbar__tabs">
+        ${categories.map(c => html`
+            <a class="sw-topbar__tab ${activeCat === c.key ? 'active' : ''}"
+               href=${c.href} onClick=${navigate}>
+                <${CatIcon} paths=${c.icon} /> ${c.label}
+            </a>
+        `)}
+    </div>
+`);
+
+// Content area: sidebar is surface-owned
+return html`
+    <div class="admin-body">
+        <div class="admin-nav">
+            ${sidebarSections.map(s => html`...`)}
+        </div>
+        <div class="admin-content">
+            <${SectionComponent} />
+        </div>
+    </div>
+`;
+```
+
+**Used by:** Admin.
+
+### 3. Kernel-Provided Tab CSS
+
+The kernel provides `.sw-topbar__tabs` and `.sw-topbar__tab` CSS so
+surfaces get consistent tab styling. Not required — surfaces can style
+their own slot content however they want.
+
+```css
+.sw-topbar__tabs {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-1);
+    height: 100%;
+}
+
+.sw-topbar__tab {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-2);
+    padding: var(--sp-2) var(--sp-3);
+    font-size: 13px;
+    font-weight: 500;
+    color: var(--text-2);
+    text-decoration: none;
+    border-radius: var(--radius-sm);
+    transition: color var(--transition), background var(--transition);
+    white-space: nowrap;
+}
+
+.sw-topbar__tab:hover {
+    color: var(--text);
+    background: var(--bg-hover);
+}
+
+.sw-topbar__tab.active {
+    color: var(--text);
+    background: var(--bg-2);
+}
+```
+
+### 4. Primary Surface Migrations
+
+#### Settings → Pattern B (flat tabs)
+
+Currently: custom topbar (back + icon + "Settings"), sidebar nav.
+After: shell topbar with flat tabs, no sidebar. Content full width.
+
+Settings has 6 sections (General / Appearance / Profile / Teams /
+Connections / Notifications) — perfect for flat tabs. The sidebar was
+thin (~140px) and ate width from the content area for no good reason.
+
+**Migration:**
+- Delete `settings-topbar` div and CSS.
+- Delete sidebar nav. Move section links into `sw.shell.topbar.setSlot()`.
+- Remove `sb_settings_return` sessionStorage — shell home link handles it.
+- Content area becomes full-width.
+- Fix Teams section: add "Open Team Admin →" link, show role, add leave action.
+
+Extension config sections (`__CONFIG_SECTIONS__`) render as additional
+tabs after the divider. Same as today, just in the topbar instead of sidebar.
+
+#### Admin → Pattern C (category tabs + sidebar)
+
+Currently: custom topbar (favicon + "Administration" + category tabs + UserMenu).
+After: shell topbar with category tabs in center slot, surface-owned sidebar.
+
+**Migration:**
+- Delete custom `admin-topbar` div and CSS.
+- `sw.shell.topbar.setLeft()` with favicon + "Administration".
+- `sw.shell.topbar.setSlot()` with category tabs (People / Workflows / System / Monitoring).
+- Bell and user menu come from the shell — delete the explicit `<${UserMenu}>`.
+- Admin sidebar and content area unchanged — they're below the topbar.
+- Delete custom `CatIcon` renderer if category tab icons use standard SVG.
+- Fix hardcoded `favicon.svg` — left slot can use theme-aware image.
+
+**Result:** Admin looks identical to today but its topbar is kernel-managed.
+Bell added for free. User menu reactive for free.
+
+#### Team Admin → Pattern B (flat tabs)
+
+Currently: custom topbar (back + "Team Admin: {name}"), sidebar nav.
+After: shell topbar with flat tabs, no sidebar.
+
+With Groups removed, Team Admin has 5 sections: Members / Connections /
+Workflows / Settings / Activity. Perfect for flat tabs.
+
+**Migration:**
+- Delete `team-admin-topbar` div and CSS.
+- `sw.shell.topbar.setTitle('Team Admin: ' + team.name)` after team fetch.
+- Section tabs into `sw.shell.topbar.setSlot()`.
+- Delete sidebar nav. Content full-width.
+- Remove `sb_team_admin_return` sessionStorage.
+- Remove Groups tab entirely (37-line dead-end).
+- Fix signoff display: `user_id` → `sw.users.displayName()`.
+
+#### Docs → Pattern A (default)
+
+Currently: imports `shell/topbar.js` and renders it explicitly.
+After: shell topbar auto-renders. No surface code needed.
+
+**Migration:**
+- Delete `import { Topbar }` and `<${Topbar}>` render.
+- Shell topbar provides title + bell + user menu automatically.
+- Docs sidebar (document list) is in the content area, unaffected.
+
+### 5. User Menu Reactivity
+
+**The single most impactful fix.**
+
+**Backend — new WS events:**
+
+```go
+// After package install/uninstall/enable/disable:
+h.hub.BroadcastToUser(userID, "package.changed", map[string]string{
+    "action": "installed", "id": packageID,
+})
+
+// After team role/membership change:
+h.hub.BroadcastToUser(userID, "auth.changed", map[string]string{
+    "reason": "team_role",
+})
+```
+
+**Frontend** (`user-menu.js`):
+
+```js
+useEffect(() => {
+    if (!sw?.api?.surfaces?.list) return;
+
+    function fetchSurfaces() {
+        sw.api.surfaces.list().then(data => {
+            const raw = Array.isArray(data) ? data : data?.data || [];
+            setAllSurfaces(raw);
+        }).catch(() => {});
+    }
+
+    fetchSurfaces();
+
+    const off1 = sw.on?.('package.changed', fetchSurfaces);
+    const off2 = sw.on?.('auth.changed', fetchSurfaces);
+
+    return () => {
+        if (typeof off1 === 'function') off1();
+        if (typeof off2 === 'function') off2();
+    };
+}, [authenticated]);
+```
+
+**Event inventory:**
+
+| Event | Trigger | Payload |
+|-------|---------|---------|
+| `package.changed` | Install, uninstall, enable, disable | `{ action, id }` |
+| `auth.changed` | Team role change, group membership change | `{ reason }` |
+| `notification.read` | Mark notification read | `{ id }` |
+| `notification.all_read` | Mark all read | `{}` |
+
+### 6. Notification Read Broadcast
+
+**Backend** — after `MarkRead()` / `MarkAllRead()`:
+
+```go
+h.hub.BroadcastToUser(userID, "notification.read", map[string]string{"id": id})
+h.hub.BroadcastToUser(userID, "notification.all_read", nil)
+```
+
+**Frontend** — `NotificationBell` listens for `.created`, `.read`, `.all_read`:
+
+```js
+const onRead = (e) => {
+    setNotifications(prev => prev.map(n =>
+        n.id === e.id ? { ...n, read_at: new Date().toISOString() } : n
+    ));
+};
+const onAllRead = () => {
+    setNotifications(prev => prev.map(n => ({
+        ...n, read_at: n.read_at || new Date().toISOString()
+    })));
+};
+```
+
+### 7. Shell Announcement Global Dismiss
+
+On dismiss, write: `localStorage.setItem('armature_dismissed_' + hash(text), '1')`.
+On mount, check. New announcements (changed text) show again.
+
+Implementation: inline `<script>` in `base.html` — checks localStorage on
+DOMContentLoaded. Dismiss button writes the key. Works on every surface
+including login.
+
+### 8. Error Handling Pass
+
+**Pattern** — inline error + retry replaces toast-and-forget:
+
+```js
+const [error, setError] = useState(null);
+
+async function load() {
+    setError(null);
+    try {
+        const data = await sw.api.whatever.list();
+        setItems(data || []);
+    } catch (e) { setError(e.message); }
+}
+
+// In render:
+${error && html`
+    <div class="sw-inline-error">
+        <span>${error}</span>
+        <button class="sw-btn sw-btn--secondary sw-btn--sm"
+                onClick=${load}>Retry</button>
+    </div>
+`}
+```
+
+**New CSS class** (`sw-primitives.css`):
+
+```css
+.sw-inline-error {
+    display: flex; align-items: center; gap: var(--sp-3);
+    padding: var(--sp-3) var(--sp-4);
+    background: var(--bg-2); border: 1px solid var(--danger);
+    border-radius: var(--radius); font-size: 13px; color: var(--danger);
+}
+```
+
+**Sections requiring this pass:**
+
+| Surface | Section | Current | After |
+|---------|---------|---------|-------|
+| Admin | Workflows | Toast + empty | Inline error + retry |
+| Admin | Packages | Toast + empty | Inline error + retry |
+| Admin | Groups | Toast + empty | Inline error + retry |
+| Team Admin | Workflows (adopt) | Toast + "No global workflows" | Inline error + retry |
+| Team Admin | Members | Toast + empty | Inline error + retry |
+| Settings | General | Console warn | Inline error + retry |
+| Settings | Teams | Toast + empty | Inline error + retry |
+| Workflow Demo (pkg) | Main | Silent swallow | Inline error + retry |
+
+### 9. Empty State Guidance
+
+Every "No X" empty state gets: one-line explanation, primary action or doc link.
+
+| Surface | Section | Current | After |
+|---------|---------|---------|-------|
+| Admin | Groups | "No groups" | "Groups control access to surfaces and features via permissions." + Create button |
+| Admin | Workflows | "No workflows" | "Workflows define multi-stage approval processes with team roles and SLA tracking." + Create button |
+| Admin | Teams | "No teams" | "Teams group users for shared connections, workflows, and access control." + Create button |
+| Team Admin | Workflows | "No workflows — create one or adopt" | Add: "Adopt copies a global workflow for this team to customize." |
+| Settings | Notifications | "No notification preferences" | "Preferences appear when notification types are configured by an administrator." |
+
+## Rebrand Asset Inventory
+
+### Current → Target
+
+| File | Current | Target |
+|------|---------|--------|
+| `favicon.svg` | Dark icon ✅ | Unchanged |
+| `favicon-light.svg` | **MISNAMED** (520×80 wordmark) | Square icon, light mode **(NEW)** |
+| `favicon-32.png` | Dark raster ✅ | Unchanged |
+| `favicon-256.png` | Dark raster ✅ | Unchanged |
+| `favicon-light-32.png` | Missing | Light raster **(NEW)** |
+| `favicon-light-256.png` | Missing | Light raster **(NEW)** |
+| `favicon.ico` | Dark ✅ | Unchanged |
+| `wordmark.svg` | Missing | **RENAMED** from current `favicon-light.svg` |
+| `wordmark-dark.svg` | Missing | Light text #E5E5E5 on transparent **(NEW)** |
+| `manifest.json` | "Self-hosted AI chat..." | "Self-hosted extension platform..." |
+
+## Bug Fixes (bundled)
+
+- **evil-chat:** `finally` cleanup + tighten `409` assertion.
+- **Workflow demo:** Silent `catch` → inline error + retry.
+- **Hello dashboard:** Delete `packages/hello-dashboard/`.
+
+## Changeset Plan
+
+| CS | Scope | Description |
+|----|-------|-------------|
+| CS-1 | Backend (Go) | WS events: `notification.read`, `notification.all_read`, `package.changed`, `auth.changed`. Tests. |
+| CS-2 | Frontend (JS + HTML) | Shell topbar component, SDK API (`setLeft`/`setSlot`/`setTitle`/`hide`), extension.html template, SDK boot auto-mount. |
+| CS-3 | Frontend (JS) | User menu reactivity: listen for `package.changed` + `auth.changed`. Notification bell: listen for `.read` + `.all_read`. |
+| CS-4 | Frontend (JS + HTML) | Surface migrations: Settings → Pattern B, Admin → Pattern C, Team Admin → Pattern B, Docs → Pattern A. Delete custom topbars. |
+| CS-5 | Frontend (JS + CSS) | Error handling pass + empty state guidance. `sw-inline-error` CSS. All sections from inventory. |
+| CS-6 | Frontend (JS) | Announcement global dismiss (localStorage). |
+| CS-7 | Static + docs | Rebrand assets, manifest.json, REBRAND-SPEC.md. |
+| CS-8 | Frontend (JS) | Bug fixes: evil-chat cleanup, workflow demo error, hello-dashboard deletion. |
+
+Each changeset independently CI-green.

docs/DESIGN-surface-runners.md

@@ -0,0 +1,407 @@
+# DESIGN: Surface Runners — v0.7.1–v0.7.3
+
+## Status: v0.7.1 Shipped (framework + migrations), v0.7.2–v0.7.3 Proposed
+
+## Problem
+
+Armature has two test tiers today:
+
+1. **Go unit tests** — test store methods, handlers, middleware, sandbox.
+   Run in CI on every push. Coverage is good for kernel internals.
+
+2. **ICD/SDK test runners** — browser-based test suites that validate API
+   endpoint contracts and SDK domain methods. Run manually by navigating
+   to `/s/icd-test-runner` or `/s/sdk-test-runner`.
+
+Neither tier catches the class of bugs discovered during manual testing:
+
+- **Cross-surface state:** Notification bell state not syncing, announcement
+  dismiss not persisting across surface navigations.
+- **Package integration:** Workflow demo shows "not installed" because its
+  API call fails silently. The API works (unit tests pass); the surface's
+  integration with the API is broken.
+- **Test side-effects:** ICD security tests install `evil.surface` with no
+  cleanup — it leaks into the menu.
+- **Surface lifecycle:** Surfaces fail to load, mount into wrong containers,
+  miss SDK boot, or render without shell chrome.
+
+These are integration bugs — they live at the boundary between kernel and
+package, between surface and surface, between API and UI. They require a
+new test tier.
+
+## Solution Overview
+
+Three deliverables across three versions:
+
+| Version | Deliverable | What it catches |
+|---------|-------------|-----------------|
+| v0.7.1 | Runner framework (`sw.testing`) | Framework bugs, standardizes existing runners |
+| v0.7.2 | Package runners + CI gate | Package integration bugs, regressions |
+| v0.7.3 | Headless E2E (Playwright) | DOM rendering bugs, navigation flows, visual regressions |
+
+## v0.7.1 — Runner Framework
+
+### `sw.testing` SDK Module
+
+New kernel SDK module at `src/js/sw/sdk/testing.js`. Provides structured
+test authoring, lifecycle hooks, cleanup tracking, and machine-readable
+results.
+
+```js
+// Extension runner registers suites during load
+sw.testing.suite('notes-crud', async (s) => {
+    let folderId, noteId;
+
+    s.beforeAll(async () => {
+        // Setup: create a test folder
+        const r = await sw.api.post('/api/v1/ext/notes/folders', {
+            name: 'test-' + Date.now()
+        });
+        folderId = r.id;
+        s.track('folder', folderId); // auto-cleanup
+    });
+
+    s.test('create note', async (t) => {
+        const r = await sw.api.post('/api/v1/ext/notes/notes', {
+            title: 'Test Note', folder_id: folderId, content: '# Hello'
+        });
+        t.assert.ok(r.id, 'note has ID');
+        t.assert.eq(r.title, 'Test Note');
+        noteId = r.id;
+        t.track('note', noteId); // auto-cleanup
+    });
+
+    s.test('renderers fire', async (t) => {
+        // Test that mermaid block in note content triggers renderer
+        await sw.api.patch('/api/v1/ext/notes/notes/' + noteId, {
+            content: '```mermaid\ngraph LR; A-->B\n```'
+        });
+        // Renderer integration tested via DOM assertion
+        // (only meaningful in headless E2E — marked as browser-only)
+        t.browserOnly(() => {
+            const el = document.querySelector('.mermaid svg');
+            t.assert.ok(el, 'mermaid rendered to SVG');
+        });
+    });
+
+    s.afterAll(async () => {
+        // s.track() resources auto-cleaned here
+        // Manual cleanup for anything not tracked
+    });
+});
+```
+
+### Core API
+
+```js
+sw.testing.suite(name, fn)        // Register a test suite
+sw.testing.run(name?)             // Run one suite or all
+sw.testing.results()              // Get structured results (JSON)
+sw.testing.on('complete', fn)     // Event when run finishes
+
+// Inside suite:
+s.test(name, fn)                  // Register a test
+s.beforeAll(fn)                   // Runs once before all tests
+s.afterAll(fn)                    // Runs once after all tests (always, even on failure)
+s.beforeEach(fn)                  // Runs before each test
+s.afterEach(fn)                   // Runs after each test
+s.track(type, id)                 // Register resource for auto-cleanup
+s.skip(reason)                    // Skip entire suite
+
+// Inside test:
+t.assert.ok(val, msg)             // Truthy
+t.assert.eq(a, b, msg)           // Deep equality
+t.assert.neq(a, b, msg)          // Not equal
+t.assert.gt(a, b, msg)           // Greater than
+t.assert.match(str, re, msg)     // Regex match
+t.assert.throws(fn, msg)         // Expects throw
+t.assert.status(resp, code, msg) // HTTP status check
+t.track(type, id)                // Register resource for auto-cleanup
+t.warn(msg)                      // Emit warning (non-fatal)
+t.browserOnly(fn)                // Only runs in headless E2E, skipped in API-only mode
+t.skip(reason)                   // Skip this test
+```
+
+### `requires` Declarations
+
+Runner packages declare dependencies in their manifest:
+
+```json
+{
+    "id": "chat-runner",
+    "type": "test-runner",
+    "title": "Chat Runner",
+    "requires": ["chat", "chat-core"],
+    "version": "0.1.0"
+}
+```
+
+On load, the framework calls `GET /api/v1/surfaces` (or equivalent) to
+check which packages are installed. If any `requires` entry is missing:
+
+- Suite is marked `skipped` with reason: `"Missing required package: chat-core"`
+- No tests execute — clean skip, not a failure
+- The runner registry surface shows the skip reason prominently
+
+This directly solves the "workflow demo shows not-installed" pattern:
+the runner *knows* what should be installed and reports clearly when it isn't.
+
+### Auto-Cleanup
+
+The `track(type, id)` method registers resources for deletion in `afterAll`.
+Supported resource types and their cleanup endpoints:
+
+| Type | Cleanup Action |
+|------|---------------|
+| `channel` | `DELETE /api/v1/channels/:id` |
+| `note` | `DELETE /api/v1/ext/notes/notes/:id` |
+| `folder` | `DELETE /api/v1/ext/notes/folders/:id` |
+| `workflow` | `DELETE /api/v1/workflows/:id` |
+| `schedule` | `DELETE /api/v1/schedules/:id` |
+| `package` | `DELETE /api/v1/admin/packages/:id` |
+| `user` | `DELETE /api/v1/admin/users/:id` |
+| `team` | `DELETE /api/v1/admin/teams/:id` |
+
+Cleanup runs in reverse order (LIFO) in `afterAll`, regardless of
+test pass/fail. Cleanup failures are reported as warnings, not failures.
+The framework never swallows cleanup errors silently.
+
+### Result Structure
+
+```json
+{
+    "runner": "notes-runner",
+    "timestamp": "2026-04-01T12:00:00Z",
+    "duration_ms": 1234,
+    "summary": { "total": 5, "passed": 4, "failed": 0, "warned": 1, "skipped": 0 },
+    "suites": [
+        {
+            "name": "notes-crud",
+            "status": "passed",
+            "duration_ms": 890,
+            "tests": [
+                {
+                    "name": "create note",
+                    "status": "passed",
+                    "duration_ms": 120,
+                    "warnings": [],
+                    "cleanup": { "tracked": 1, "cleaned": 1, "failed": 0 }
+                }
+            ]
+        }
+    ],
+    "requires": { "met": ["notes"], "missing": [] }
+}
+```
+
+### Warning Tier
+
+Three result statuses:
+
+- **`passed`** — assertions all passed, cleanup succeeded
+- **`failed`** — at least one assertion failed
+- **`warned`** — assertions passed but something non-fatal happened:
+  - API returned unexpected shape (extra/missing fields) but test doesn't depend on the exact field
+  - Cleanup failed for a tracked resource
+  - Timing exceeded a soft threshold
+  - `t.warn(msg)` called explicitly
+
+Warnings are **never silent.** They appear in the UI and structured results.
+The difference from the current `catch (e) { /* ignore */ }` pattern is
+that warnings are *visible* — a human or CI system can decide whether
+to investigate.
+
+### ICD/SDK Runner Migration
+
+The existing runners use a hand-rolled framework (`T.test()`, `T.assert()`,
+`T.authFetch()`). Migration preserves all test logic:
+
+| Current | New |
+|---------|-----|
+| `T.test(tier, group, name, fn)` | `s.test(name, fn)` inside `sw.testing.suite(tier + '/' + group, fn)` |
+| `T.assert(cond, msg)` | `t.assert.ok(cond, msg)` |
+| `T.authFetch(token, method, path, body)` | Kept as utility — not an assertion primitive |
+| `T.apiPost(...)` | Kept as utility |
+| Result rendering (`ui.js`) | Delegated to runner registry surface |
+| No cleanup hooks | `s.track()` + `s.afterAll()` |
+
+The ICD and SDK runners become packages with `"type": "test-runner"` in
+their manifests. Their existing surfaces (`/s/icd-test-runner`,
+`/s/sdk-test-runner`) are replaced by the unified runner registry at
+`/s/test-runners`.
+
+## v0.7.2 — Package Runners
+
+### Runner Inventory
+
+| Runner | `requires` | Key Assertions |
+|--------|-----------|---------------|
+| `notes-runner` | `["notes"]` | CRUD, folders, tags, backlinks, search, markdown rendering, SDK integration |
+| `chat-runner` | `["chat", "chat-core"]` | Channel CRUD, messaging, participant display, renderer blocks in messages |
+| `schedules-runner` | `["schedules"]` | Schedule CRUD, cron expression, toggle, Starlark exec |
+| `workflow-runner` | `["content-approval"]` | Install detection, stage progression, form submission, signoff |
+| `renderer-runner` | `["mermaid-renderer"]` | `sw.renderers.register` contract, post-render hooks, block rendering |
+
+### Runner Result API
+
+New kernel endpoints (no package required — kernel-provided):
+
+```
+POST /api/v1/test-runners/run          → Run all installed runners
+POST /api/v1/test-runners/run/:id      → Run specific runner
+GET  /api/v1/test-runners/results      → Last run results (JSON)
+GET  /api/v1/test-runners/results/:id  → Last run results for specific runner
+```
+
+These endpoints enable CI to trigger and consume runner results via
+`curl` without browser automation. The v0.7.3 Playwright harness is
+additive — not required for CI gating.
+
+**Auth:** Admin-only. Runners create/delete resources — they must run
+with elevated permissions.
+
+### CI Integration
+
+New stage in `.gitea/workflows/ci.yaml`:
+
+```yaml
+test-runners:
+    needs: [unit-tests]
+    steps:
+        - name: Boot server
+          run: |
+              docker compose up -d
+              ./ci/wait-for-healthy.sh
+        - name: Run surface runners
+          run: |
+              RESULT=$(curl -s -X POST http://localhost:8080/api/v1/test-runners/run \
+                  -H "Authorization: Bearer $ADMIN_TOKEN")
+              FAILED=$(echo "$RESULT" | jq '.summary.failed')
+              if [ "$FAILED" != "0" ]; then
+                  echo "$RESULT" | jq '.suites[] | select(.status == "failed")'
+                  exit 1
+              fi
+```
+
+Runs in both PG and SQLite pipelines. Server boots with `BUNDLED_PACKAGES=*`
+so all packages and their runners are installed.
+
+## v0.7.3 — Headless E2E
+
+### Playwright Harness
+
+`ci/e2e-surface-test.sh`:
+
+1. `docker compose up -d` (server + DB)
+2. `npx playwright install chromium` (CI caches this)
+3. Run `ci/e2e-surfaces.spec.ts`
+4. Collect screenshots on failure
+5. `docker compose down`
+
+### Surface Navigation Smoke Test
+
+```ts
+test('all surfaces reachable', async ({ page }) => {
+    // Login
+    await page.goto('/');
+    await page.fill('#username', 'admin');
+    await page.fill('#password', 'admin');
+    await page.click('button[type="submit"]');
+
+    // Navigate through every installed surface
+    const surfaces = ['notes', 'chat', 'admin', 'settings', 'docs'];
+    for (const s of surfaces) {
+        await page.goto(`/s/${s}`);
+        // Assert: page loaded, no uncaught JS errors
+        await expect(page.locator('.sw-topbar')).toBeVisible();
+        // Assert: home link works
+        await page.click('.sw-topbar__home');
+        await expect(page).toHaveURL('/');
+    }
+});
+```
+
+This is the automated version of "hello dashboard has no way out" — if
+any surface fails to render a topbar or its home link doesn't work, CI
+catches it.
+
+### Screenshot on Failure
+
+```ts
+test.afterEach(async ({ page }, testInfo) => {
+    if (testInfo.status !== 'passed') {
+        await page.screenshot({
+            path: `ci/artifacts/failure-${testInfo.title}.png`,
+            fullPage: true
+        });
+        const logs = await page.evaluate(() =>
+            (window.__consoleErrors || []).join('\n')
+        );
+        fs.writeFileSync(
+            `ci/artifacts/console-${testInfo.title}.log`, logs
+        );
+    }
+});
+```
+
+Artifacts saved to CI workspace. On failure, the developer gets a
+screenshot + console log dump without needing to reproduce locally.
+
+### Visual Regression (Optional)
+
+Not a CI gate in v0.7.3 — produces a diff report for human review:
+
+```ts
+test('visual baseline - notes', async ({ page }) => {
+    await page.goto('/s/notes');
+    await expect(page.locator('.sw-topbar')).toBeVisible();
+    await expect(page).toHaveScreenshot('notes.png', {
+        maxDiffPixelRatio: 0.01
+    });
+});
+```
+
+Playwright stores baseline screenshots in `ci/visual-baselines/`.
+`toHaveScreenshot` compares against baseline and produces a diff image
+on mismatch. Foundation for future visual regression gating.
+
+## Sequencing
+
+```
+v0.7.0  Shell Contract        ← prerequisite: surfaces need topbar before
+  │                              runners can assert on it
+  ↓
+v0.7.1  Runner Framework      ← standardize test authoring
+  │
+  ↓
+v0.7.2  Package Runners + CI  ← write the actual tests, wire into CI
+  │
+  ↓
+v0.7.3  Headless E2E          ← automate browser-based runner execution
+```
+
+Each version is independently shippable. v0.7.2's API-based CI gate
+works without v0.7.3's Playwright. v0.7.3 adds coverage for DOM-level
+bugs that API-only runners can't catch.
+
+## Open Questions
+
+1. **Runner package type.** Should `"type": "test-runner"` be a new
+   manifest type, or should runners be `"type": "surface"` with a
+   `"tags": ["test-runner"]` convention? New type is cleaner but requires
+   a `ValidateManifest()` update.
+
+2. **Runner discovery.** The registry surface needs to find all installed
+   runners. Options: (a) scan installed packages for `type: "test-runner"`,
+   (b) runners register themselves via `sw.testing.register()` during SDK
+   boot. Option (a) is declarative and doesn't require runner JS to load
+   before discovery.
+
+3. **Parallel vs sequential.** Should runners execute in parallel?
+   Probably not initially — shared DB state means test isolation is hard.
+   Sequential is safer. Parallel can be a future optimization.
+
+4. **SQLite limitations.** Some runners (cluster, multi-node) are
+   PG-only. The `requires` mechanism should support
+   `"requires_db": "postgres"` for these cases, or runners should
+   self-skip when `sw.config.db_driver === 'sqlite'`.

docs/EXTENSION-CSS.md

@@ -147,8 +147,8 @@ Example:
 
 | Variable | Purpose |
 |----------|---------|
-| `--font` | Primary font family |
+| `--font` | Primary font family (self-hosted, no external requests) |
-| `--mono` | Monospace font family |
+| `--mono` | Monospace font family (self-hosted) |
 | `--radius-sm` | Small border-radius (4px) — badges, inline controls |
 | `--radius` | Default border-radius (8px) — buttons, inputs, cards |
 | `--radius-lg` | Large border-radius (12px) — modals, dialogs, large cards |

docs/EXTENSION-GUIDE.md

@@ -79,6 +79,7 @@ Every package has a `manifest.json` at its root. Example for a surface:
 | `settings` | no | User-configurable settings schema |
 | `exports` | libraries | Functions exported for other packages |
 | `hooks` | no | Event bus subscriptions |
+| `config_section` | no | Settings/Admin panel injection (see below) |
 | `schema_version` | no | Integer for additive schema migrations |
 
 ## db_tables Schema
@@ -138,24 +139,73 @@ Only `path` and `method` are required. All other fields are optional. Malformed
 
 ## Starlark Sandbox API
 
-Starlark scripts run server-side with a CPU budget and memory ceiling. Available modules (granted per-permission by admin):
+Starlark scripts run server-side with a 1M operation budget and no
+filesystem access. See the [Starlark Reference](STARLARK-REFERENCE) for
+the complete module catalog, function signatures, and permission gates.
 
-| Module | Permission | API |
+## config_section — Settings Panel Injection
-|--------|-----------|-----|
-| `db` | `db.write` | `db.query(table, filters)`, `db.insert(table, row)`, `db.update(table, id, row)`, `db.delete(table, id)` |
-| `http` | `http` | `http.get(url)`, `http.post(url, body)` -- SSRF-safe, no private IPs by default |
-| `notifications` | `notifications` | `notifications.send(user_id, title, body)` |
-| `secrets` | `secrets` | `secrets.get(connection_type)` -- reads from the credential vault |
-| `api` | (implicit) | Registers HTTP routes at `/s/:slug/api/*path` |
-| `realtime` | `realtime.publish` | `realtime.publish(channel, event, data)` -- push to WebSocket clients |
 
-The sandbox cannot spawn goroutines, access the filesystem, or import arbitrary packages.
+Packages can inject configuration panels into the Settings, Admin, or
+Team Admin surfaces. Declare `config_section` in `manifest.json`:
+
+```json
+{
+  "config_section": {
+    "label": "My Config",
+    "icon": "M12 2L2 7l10 5 10-5-10-5z",
+    "component": "js/config.js",
+    "surfaces": ["settings", "admin"],
+    "category": "system"
+  }
+}
+```
+
+| Field | Required | Description |
+|-------|----------|-------------|
+| `label` | yes | Navigation label shown in the sidebar or tab list |
+| `icon` | no | SVG path data for the nav icon |
+| `component` | no | JS asset path (default: `js/config.js`). Must `export default` a Preact component. |
+| `surfaces` | yes | Target surfaces: `"settings"`, `"admin"`, `"team-admin"` |
+| `category` | no | Admin surface category tab (default: `"system"`). Ignored for settings/team-admin. |
+
+**How it works:**
+
+1. At page load, the backend scans all enabled packages for `config_section`
+   entries targeting the current surface.
+2. Matching sections are injected into the page as `__CONFIG_SECTIONS__`.
+3. The frontend dynamically imports the component module and renders it
+   as an additional tab/section.
+4. The component receives `{ packageId, teamId }` as props.
+
+**Example component** (`js/config.js`):
+
+```javascript
+const { html } = window;
+const { useState, useEffect } = hooks;
+
+export default function MyConfig({ packageId }) {
+    const [val, setVal] = useState('');
+
+    useEffect(() => {
+        sw.api.ext(packageId).get('/settings').then(r => setVal(r.value));
+    }, []);
+
+    return html`<div>
+        <label>API Key</label>
+        <input value=${val} onInput=${e => setVal(e.target.value)} />
+        <button onClick=${() => sw.api.ext(packageId).put('/settings', { value: val })}>Save</button>
+    </div>`;
+}
+```
 
 ## Permissions Model
 
-Extensions declare required permissions in `manifest.json`. The admin must grant each permission before the extension can use the corresponding module. Permission status is visible in Admin > Packages > Permissions.
+Extensions declare required permissions in `manifest.json`. The admin
+must grant each permission before the extension can use the corresponding
+sandbox module. Permission status is visible in **Admin > Packages > Permissions**.
 
-Kernel permissions for users/groups: `extension.use`, `extension.install`, `workflow.create`, `workflow.submit`, `admin.view`, `token.unlimited`.
+See [Permissions & Groups](PERMISSIONS-AND-GROUPS) for the full RBAC
+model, user permission slugs, and settings cascade.
 
 ## File Structure
 

docs/FRONTEND-JS-GUIDE.md

@@ -0,0 +1,256 @@
+# Frontend JS Guide
+
+Armature extensions run in the browser using **Preact + htm** — a 3 KB
+runtime with no build step. The kernel provides a rich SDK at `window.sw`
+that extensions use for API calls, auth, events, theming, and UI.
+
+## Getting started
+
+Extension surfaces are ES modules loaded via `<script type="module">`.
+The SDK is available on `window.sw` after the `sw:ready` DOM event:
+
+```javascript
+document.addEventListener('sw:ready', () => {
+    const { html } = window;
+    const mount = document.getElementById('my-mount');
+    preact.render(html`<${App} />`, mount);
+});
+```
+
+Or use the global `hooks` object for Preact hooks:
+
+```javascript
+const { useState, useEffect } = hooks;
+```
+
+## SDK modules
+
+All modules live on the `window.sw` object. They are frozen after boot
+and available to every extension.
+
+### sw.api — REST client
+
+Generic escape hatches for any endpoint:
+
+```javascript
+sw.api.get('/api/v1/docs')
+sw.api.post('/api/v1/teams', { name: 'Eng' })
+sw.api.put(path, body)
+sw.api.patch(path, body)
+sw.api.del(path)
+sw.api.upload(path, file)
+sw.api.stream(path, body, signal)
+```
+
+All methods auto-inject auth tokens and return unwrapped `data` from
+`{ data: ... }` response envelopes.
+
+**Domain namespaces** provide typed CRUD methods:
+
+| Namespace | Key methods |
+|-----------|-------------|
+| `sw.api.auth` | `login`, `register`, `refresh`, `logout` |
+| `sw.api.teams` | `list`, `get`, `create`, `members`, `workflows`, `assignments` |
+| `sw.api.workflows` | `list`, `get`, `stages`, `instances`, `advance`, `cancel` |
+| `sw.api.channels` | `list`, `get`, `create`, `update`, `del` |
+| `sw.api.notifications` | `list`, `unreadCount`, `markRead`, `markAllRead` |
+| `sw.api.admin` | Sub-objects for `users`, `teams`, `groups`, `packages`, `backup`, etc. |
+| `sw.api.users` | `search`, `resolve` |
+| `sw.api.connections` | `list`, `get`, `create`, `resolve` |
+| `sw.api.ext(pkgId)` | Scoped client for extension API routes: `get`, `post`, `put`, `del` |
+
+### sw.auth — Authentication state
+
+```javascript
+sw.auth.isAuthenticated  // boolean
+sw.auth.user             // { id, username, display_name, email, role, avatar }
+sw.auth.permissions      // Set<string>
+sw.auth.teams            // Array<{ id, name, role }>
+sw.auth.groups           // Array<{ id, name, permissions }>
+```
+
+Lifecycle: `sw.auth.login(login, pw)`, `sw.auth.logout()`, `sw.auth.refresh()`.
+
+### sw.can — RBAC gates
+
+```javascript
+sw.can('workflow.create')     // true if user has permission
+sw.isAdmin                    // true if surface.admin.access granted
+sw.isTeamAdmin(teamId)        // true if admin role in team
+```
+
+Use these to conditionally render UI elements.
+
+### sw.on / sw.off / sw.emit — Event bus
+
+```javascript
+const unsub = sw.on('theme.changed', (payload) => { ... });
+sw.once('auth.login', (user) => { ... });
+sw.off('theme.changed');       // remove all listeners
+sw.off('theme.changed', fn);   // remove specific listener
+sw.emit('my.event', { data });
+```
+
+The event bus bridges to the WebSocket — server-emitted events
+(e.g. `notification.created`, `workflow.sla_breach`) arrive here.
+
+### sw.theme — Theme control
+
+```javascript
+sw.theme.current   // 'dark' or 'light' (resolved)
+sw.theme.mode      // 'dark', 'light', or 'system'
+sw.theme.set('dark')
+sw.theme.on('change', (theme) => { ... })
+sw.theme.tokens    // live CSS variables as camelCase JS object
+```
+
+### sw.storage — Namespaced localStorage
+
+```javascript
+const store = sw.storage.local('my-extension');
+store.set('key', { complex: 'value' });
+store.get('key')     // parsed object
+store.remove('key')
+store.keys()         // ['key', ...]
+store.clear()
+```
+
+### sw.realtime — WebSocket pub/sub
+
+```javascript
+const unsub = sw.realtime.subscribe('my-channel', 'item.updated', (data) => { ... });
+// Or subscribe to all events on a channel:
+const unsub = sw.realtime.subscribe('my-channel', (event, data) => { ... });
+```
+
+### sw.slots — UI slot registry
+
+Register components into named shell slots (e.g. toolbar areas):
+
+```javascript
+const unreg = sw.slots.register('topbar-actions', {
+    id: 'my-button',
+    component: MyButton,
+    priority: 10,
+});
+```
+
+### sw.actions — Named action registry
+
+```javascript
+sw.actions.register('copy-link', {
+    handler: async (url) => navigator.clipboard.writeText(url),
+    label: 'Copy Link',
+    icon: 'M12 2...',
+});
+await sw.actions.run('copy-link', someUrl);
+```
+
+### sw.pipe — Filter pipeline
+
+Three-stage pipeline for message processing:
+
+```javascript
+sw.pipe.pre(10, async (ctx) => { /* pre-process */ return ctx; });
+sw.pipe.stream(10, async (ctx) => { /* streaming */ return ctx; });
+sw.pipe.render(10, async (ctx) => { /* post-render */ return ctx; });
+```
+
+### sw.renderers — Block and post renderers
+
+Register custom renderers for fenced code blocks or post-processing:
+
+```javascript
+sw.renderers.register('mermaid', {
+    type: 'block',
+    pattern: /^mermaid$/,
+    render: (code, container) => { /* render diagram */ },
+});
+
+sw.renderers.register('linkify', {
+    type: 'post',
+    render: (container) => { /* post-process rendered HTML */ },
+});
+```
+
+### sw.markdown — Unified rendering
+
+```javascript
+const html = sw.markdown.renderSync(markdownString, { sanitize: false });
+await sw.markdown.render(markdownString); // async variant
+sw.markdown.ready // boolean — true after preload
+```
+
+Uses marked + DOMPurify + registered `sw.renderers`.
+
+### sw.users — Identity resolution
+
+```javascript
+const user = await sw.users.resolve(userId);
+const map = await sw.users.resolveMany([id1, id2]);
+sw.users.displayName(userObj)  // display_name || username || 'Unknown'
+```
+
+Results are cached for 60 seconds. Batch fetches use the server's
+bulk resolve endpoint.
+
+### sw.testing — Test framework
+
+For writing package runner tests:
+
+```javascript
+sw.testing.suite('CRUD', async (s) => {
+    s.before(async () => { /* setup */ });
+    s.after(async () => { /* cleanup */ });
+
+    s.test('creates item', async (t) => {
+        const resp = await sw.api.post('/api/v1/items', { name: 'test' });
+        t.assert.status(resp, 200);
+        t.assert.ok(resp.id);
+        s.track('item', resp.id); // auto-cleanup in afterAll
+    });
+});
+await sw.testing.run();
+```
+
+### sw.shell — Topbar API
+
+The kernel injects a two-slot topbar into every extension surface.
+Extensions customize it via:
+
+```javascript
+sw.shell.topbar.setTitle('My Surface');          // text in left slot
+sw.shell.topbar.setSlot(html`<${TabBar} />`);   // center slot content
+sw.shell.topbar.hide();                          // full-bleed mode
+sw.shell.topbar.show();                          // restore topbar
+```
+
+### sw.toast / sw.confirm / sw.prompt — UI primitives
+
+```javascript
+sw.toast('Saved!', 'success');               // success | error | info
+sw.toast('Something broke', 'error', 5000);  // custom duration
+
+const ok = await sw.confirm('Delete this item?');
+const name = await sw.prompt('Enter name', 'default value');
+```
+
+## Shell topbar patterns
+
+Every surface uses one of three patterns:
+
+| Pattern | Description | Example |
+|---------|-------------|---------|
+| **A — Default** | Shell title only. No center slot content. | Docs |
+| **B — Flat tabs** | `setTitle()` + tabs in center slot via `setSlot()`. Full-width content. | Settings, Team Admin |
+| **C — Category tabs + sidebar** | `setTitle()` + category tabs in center slot. Surface-owned sidebar below. | Admin |
+
+The shell provides the home link, notification bell, and user menu
+on every surface for free.
+
+## Extension CSS contract
+
+Extensions must prefix all CSS classes with `.ext-{slug}-` to avoid
+conflicts with kernel styles. See the [Extension CSS](EXTENSION-CSS)
+doc for the full isolation rules, available primitives from
+`sw-primitives.css`, and spacing tokens.

docs/GETTING-STARTED.md

@@ -12,7 +12,7 @@ docker compose up --build
 
 Open [http://localhost:3000](http://localhost:3000). Default credentials: `admin` / `admin`.
 
-Data persists in the `sb_data` named volume. To reset everything:
+Data persists in the `armature_data` named volume. To reset everything:
 
 ```bash
 docker compose down -v

docs/PERMISSIONS-AND-GROUPS.md

@@ -0,0 +1,121 @@
+# Permissions & Groups
+
+Armature uses group-based RBAC. Permissions are granted to groups, and users
+inherit the union of permissions from all groups they belong to. There are no
+per-user permission grants — all access flows through group membership.
+
+## Groups
+
+### System groups
+
+| Group | ID | Purpose |
+|-------|----|---------|
+| Everyone | `00000000-...0001` | Implicit membership for every authenticated user. Default permissions: `extension.use`, `workflow.submit`. |
+| Admins | `00000000-...0002` | Full platform access. Members receive all seven permission slugs. Replaces the legacy `role = admin` check. |
+
+Every new user is automatically added to **Everyone** on registration.
+Admin status is granted by adding a user to the **Admins** group in
+**Admin > People > Groups**.
+
+### Custom groups
+
+Administrators can create additional groups under **Admin > People > Groups**.
+Each custom group has:
+
+- **Name** — display label
+- **Description** — purpose (shown in admin UI)
+- **Scope** — always `global` (team-scoped groups reserved for future use)
+- **Permissions** — zero or more permission slugs from the table below
+
+## Permission slugs
+
+Seven platform permissions control access to kernel features:
+
+| Slug | Description |
+|------|-------------|
+| `surface.admin.access` | Full admin panel access (tabs, settings, package management) |
+| `admin.view` | Read-only admin panel access (monitoring, health, audit log) |
+| `extension.use` | Use installed extension surfaces and libraries |
+| `extension.install` | Install, update, enable, and disable packages |
+| `workflow.create` | Create and edit workflow definitions |
+| `workflow.submit` | Submit instances to public-link workflows |
+| `token.unlimited` | Bypass per-user token budgets (API rate limiting) |
+
+Permissions follow a `domain.action` naming convention.
+
+## Permission resolution
+
+When a request arrives, the kernel resolves the effective permission set:
+
+1. Fetch all groups the user belongs to (including Everyone).
+2. Union all permission arrays across those groups.
+3. Cache the result for the duration of the request.
+
+A user has a permission if **any** of their groups grants it.
+
+Frontend code checks permissions via `sw.can('slug')` — see the
+[Frontend JS Guide](FRONTEND-JS-GUIDE) for details.
+
+## Extension permissions
+
+Separate from user permissions, each **package** can request sandbox
+capabilities. These are granted per-package in **Admin > Packages**:
+
+| Permission | Grants |
+|------------|--------|
+| `db.read` | Query `ext_data` tables (read-only) |
+| `db.write` | Insert, update, and delete rows in `ext_data` tables |
+| `api.http` | Make outbound HTTP requests from Starlark |
+| `notifications.send` | Send in-app notifications to users |
+| `secrets.read` | Read admin-configured extension secrets |
+| `realtime.publish` | Publish WebSocket events to subscribed clients |
+| `connections.read` | Read external connection configs (decrypted) |
+| `workflow.access` | Read workflow definitions and instances |
+
+See the [Starlark Reference](STARLARK-REFERENCE) for how these
+map to sandbox modules.
+
+## Settings cascade
+
+Package settings use a three-tier resolution model:
+
+```
+user override → team override → global default
+```
+
+At each tier:
+
+- **Global** — set by admins in **Admin > Packages > Settings**
+- **Team** — set by team admins in **Team Admin > Settings**
+- **User** — set by users in **Settings > Extensions**
+
+### The `user_overridable` flag
+
+Each setting key in a package manifest can declare `user_overridable`:
+
+```json
+{
+  "settings": [
+    { "key": "theme", "user_overridable": true },
+    { "key": "api_endpoint", "user_overridable": false }
+  ]
+}
+```
+
+- `true` (default) — team and user scopes can override the global value.
+- `false` — only the global (admin) value is used. Team and user values
+  are silently ignored during resolution.
+
+This gives administrators a lock mechanism: set `user_overridable: false`
+on security-sensitive keys to prevent lower scopes from changing them,
+while allowing cosmetic preferences to flow freely.
+
+### Resolution algorithm
+
+1. Start with the global value for each key.
+2. For each key where `user_overridable` is true (or undeclared):
+   - If a team-scoped value exists, it overrides global.
+   - If a user-scoped value exists, it overrides team.
+3. For keys where `user_overridable` is false:
+   - Team and user values are discarded.
+4. Unknown keys (not in schema) default to overridable.

docs/STARLARK-REFERENCE.md

@@ -0,0 +1,232 @@
+# Starlark Reference
+
+Armature extensions can include Starlark scripts for server-side logic.
+Starlark is a Python-like language designed for configuration and
+embedding — see the [official spec](https://github.com/google/starlark-go).
+
+## Sandbox constraints
+
+- **No `while` loops** — use `for` with bounded ranges.
+- **No `load()`** — use `lib.require()` for library dependencies.
+- **Max steps:** 1,000,000 bytecode operations per execution.
+- **No filesystem or OS access** — all I/O goes through gated modules.
+- **Deterministic** — same input produces same output (no `random`, no `time`).
+
+## Always-available modules
+
+These modules are injected into every script with no permission required.
+
+### json
+
+Standard Starlark JSON module.
+
+```python
+data = json.decode('{"key": "value"}')
+text = json.encode({"key": "value"})
+```
+
+### settings
+
+Read resolved package settings (global → team → user cascade).
+
+```python
+val = settings.get("theme", "light")
+# Returns the resolved value, or the default if unset.
+```
+
+The cascade respects the `user_overridable` flag from the package manifest.
+See [Permissions & Groups](PERMISSIONS-AND-GROUPS) for details.
+
+### lib
+
+Load exported functions from library packages.
+
+```python
+helpers = lib.require("my-utils")
+result = helpers.format_date("2026-01-15")
+```
+
+Requirements:
+- The library must be declared in your package manifest's `dependencies`.
+- The library must be type `library`, status `active`, tier `starlark`.
+- Circular dependencies are detected and rejected.
+- Results are cached per execution (calling `require` twice returns the
+  same object).
+
+## Permission-gated modules
+
+These modules are only available if the package has the corresponding
+permission granted in **Admin > Packages**.
+
+### secrets
+
+**Permission:** `secrets.read`
+
+Read admin-configured secrets for this package.
+
+```python
+api_key = secrets.get("OPENAI_KEY")  # str or None
+all_keys = secrets.list()             # list of key names
+```
+
+Secrets are set in **Admin > Packages > Secrets** and scoped per package.
+
+### notifications
+
+**Permission:** `notifications.send`
+
+Send in-app notifications to users.
+
+```python
+notifications.send(
+    user_id,        # str — target user UUID
+    title,          # str — notification title
+    body="",        # str — optional body text
+    type="extension.notify"  # str — notification type
+)
+```
+
+### db
+
+**Permission:** `db.read` (queries) or `db.write` (mutations)
+
+Read and write extension data tables. All tables are automatically
+namespaced as `ext_{package_id}_{table_name}`.
+
+#### Read operations
+
+```python
+# Query with filters, ordering, and pagination
+rows = db.query(
+    "tasks",                    # table name (without prefix)
+    filters={"status": "open"}, # equality WHERE clauses
+    order="-created_at",        # column name (prefix - for DESC)
+    limit=50,                   # max 1000
+    before={"created_at": ts},  # range: column < value
+    after={"created_at": ts},   # range: column > value
+    search_like={"title": "%bug%"}  # LIKE/ILIKE search
+)
+
+# Read from system views (read-only)
+users = db.view("users", filters={"display_name": "Alice"}, limit=10)
+channels = db.view("channels", limit=100)
+
+# List all tables owned by this package
+tables = db.list_tables()
+```
+
+Available views: `users`, `channels`.
+
+#### Write operations
+
+```python
+row = db.insert("tasks", {"title": "Fix bug", "status": "open"})
+# Returns the inserted row dict (with generated id, created_at)
+
+db.update("tasks", row_id, {"status": "closed"})
+# Returns True on success
+
+db.delete("tasks", row_id)
+# Returns True on success
+```
+
+### http
+
+**Permission:** `api.http`
+
+Make outbound HTTP requests.
+
+```python
+resp = http.get("https://api.example.com/data", headers={"Authorization": "Bearer ..."})
+resp = http.post(url, body='{"key": "val"}', headers={"Content-Type": "application/json"})
+resp = http.put(url, body="...", headers={})
+resp = http.delete(url, headers={})
+resp = http.request("PATCH", url, body="...", headers={})
+```
+
+Response dict:
+
+```python
+{
+    "status": 200,
+    "headers": {"content-type": "application/json"},
+    "body": "..."   # capped at 1 MB
+}
+```
+
+**Security:**
+- Private/loopback IPs are blocked (SSRF protection).
+- Packages can declare `network_access.allow` (allowlist) or
+  `network_access.block` (blocklist) in their manifest.
+- Max 10 redirects. 10-second timeout. 1 MB response body limit.
+
+### realtime
+
+**Permission:** `realtime.publish`
+
+Publish WebSocket events to subscribed clients.
+
+```python
+realtime.publish(
+    "my-channel",     # channel name
+    "item.updated",   # event label
+    {"id": "abc"}     # payload dict (max 7 KB)
+)
+```
+
+The payload is automatically tagged with `_pkg: package_id`.
+
+### connections
+
+**Permission:** `connections.read`
+
+Read external connection configurations (secrets are decrypted).
+
+```python
+conn = connections.get("postgres", "main-db")
+# Returns dict with id, type, name, scope, plus flattened config fields
+# Returns None if not found
+
+all_pg = connections.list("postgres")
+# Returns list of connection dicts
+```
+
+Connections are resolved via scope chain: personal → team → global.
+
+### workflow
+
+**Permission:** `workflow.access`
+
+Read workflow definitions and instances (read-only from Starlark;
+mutations go through the HTTP API).
+
+```python
+defn = workflow.get_definition(workflow_id)
+# Returns dict: id, name, slug, entry_mode, is_active, version, stages[]
+
+inst = workflow.get_instance(instance_id)
+# Returns dict: id, workflow_id, current_stage, status, stage_data, ...
+
+instances = workflow.list_instances(workflow_id, status="active")
+# Returns list of instance dicts
+```
+
+## Example: automated stage hook
+
+A simple hook that reads a setting, queries data, and advances:
+
+```python
+def on_run(ctx):
+    threshold = settings.get("approval_threshold", 1000)
+    amount = ctx["stage_data"].get("amount", 0)
+
+    if amount > threshold:
+        notifications.send(
+            ctx["started_by"],
+            "High-value submission",
+            body="Amount %d exceeds threshold." % amount,
+        )
+        return {"advance": True, "data": {"needs_review": True}}
+
+    return {"advance": True, "data": {"needs_review": False}}
+```

docs/TUTORIAL-FIRST-EXTENSION.md

@@ -54,7 +54,7 @@ and register with the SDK through `sw.renderers`:
             },
             render(lang, code, container) {
                 container.innerHTML =
-                    '<div style="padding:12px;background:var(--bg-2);' +
+                    '<div style="padding:12px;background:var(--bg-secondary);' +
                     'border:1px solid var(--border);border-radius:8px">' +
                     '<strong>Demo:</strong> ' + code +
                     '</div>';
@@ -74,7 +74,7 @@ The IIFE wrapper keeps variables out of global scope. `sw.renderers.register`
 takes a name and an options object: `type: 'block'` targets fenced code blocks,
 `match` checks the language tag, and `render` receives the language, raw code,
 and a container element. The `sw:ready` event fires once the SDK initializes;
-if already loaded, register immediately. Use CSS variables like `var(--bg-2)`
+if already loaded, register immediately. Use CSS variables like `var(--bg-secondary)`
 and `var(--border)` to follow the active theme.
 
 ## Step 4: Package It

docs/WORKFLOWS.md

@@ -0,0 +1,193 @@
+# Workflows
+
+Workflows are multi-stage processes with team assignment, validation gates,
+SLA enforcement, and optional Starlark automation. They are managed in
+**Team Admin > Workflows**.
+
+## Core concepts
+
+| Concept | Description |
+|---------|-------------|
+| **Definition** | A named template: stages, entry mode, staleness timeout. Created per-team or adopted from global definitions. |
+| **Stage** | One step in the workflow. Has a mode, audience, optional team assignment, and optional SLA. |
+| **Instance** | A running copy of a definition. Pins a published version snapshot and tracks accumulated stage data. |
+| **Assignment** | A queue entry linking an instance stage to a team member. Claim → work → complete. |
+| **Signoff** | An approval or rejection recorded against an instance stage (multi-party validation). |
+
+## Entry modes
+
+| Mode | Description |
+|------|-------------|
+| `team_only` | Only authenticated team members can start instances. |
+| `public_link` | Anyone with the public URL can start an instance. The first stage must have `audience: public`. An `entry_token` is issued for the anonymous submitter to resume later. |
+
+Public entry URL format:
+```
+{origin}/api/v1/public/workflows/{workflow_id}/start
+```
+
+## Stage modes
+
+Each stage has a **mode** that determines how it progresses:
+
+| Mode | Description |
+|------|-------------|
+| `form` | User submits structured data. Stage data is accumulated into the instance. |
+| `review` | Multi-party sign-off gate. Requires configured approvals before advancing. |
+| `delegated` | Assigned to a team member queue. The assignee claims, works, and completes. |
+| `automated` | Starlark hook executes without user interaction. Can chain up to 10 consecutive automated stages. |
+
+## Stage types
+
+| Type | Description |
+|------|-------------|
+| `simple` | Linear — always advances to the next ordinal. |
+| `dynamic` | Conditional — evaluates branch rules against stage data to pick the next stage. |
+| `automated` | Combined with mode `automated` for fully scripted stages. |
+
+## Audiences
+
+| Audience | Description |
+|----------|-------------|
+| `team` | Only authenticated team members can interact. |
+| `public` | Anonymous users can interact (used with `public_link` entry). |
+| `system` | System-generated stages, no direct user interaction. |
+
+## Team assignment
+
+When a stage has `assignment_team_id` set, the engine creates an
+**assignment** record:
+
+1. Assignment enters the queue with status `unassigned`.
+2. A team member **claims** the assignment (status → `claimed`).
+3. The assignee works the stage and **completes** it (status → `completed`).
+4. The engine auto-advances to the next stage.
+
+A **required role** can restrict who may claim:
+- Set `stage_config.required_role` to a team role name (e.g. `"reviewer"`).
+- Only members with that role can claim the assignment.
+
+Team roles are configured in **Team Admin > Settings > Roles**.
+
+## Signoff gates (multi-party validation)
+
+Review-mode stages can require multiple approvals before advancing.
+Configure via `stage_config.validation`:
+
+```json
+{
+  "validation": {
+    "required_approvals": 2,
+    "required_role": "approver",
+    "reject_action": "cancel"
+  }
+}
+```
+
+| Field | Description |
+|-------|-------------|
+| `required_approvals` | Minimum approve decisions needed to advance. |
+| `required_role` | Only members with this team role can sign off. Empty = any member. |
+| `reject_action` | What happens on rejection: `"cancel"` (default) cancels the instance, or a stage name to reroute. |
+
+Each signoff records: user, decision (`approve` or `reject`), optional comment, timestamp.
+
+## SLA enforcement
+
+Two timeout mechanisms run in a background scanner (every 5 minutes):
+
+### Per-stage SLA
+
+Set `sla_seconds` on a stage. When an instance has been in that stage
+longer than the threshold:
+
+- `sla_breached` flag is set in instance metadata.
+- A `workflow.sla_breach` WebSocket event is emitted.
+- The instance is **not** auto-cancelled — breaches are informational.
+
+### Per-workflow staleness
+
+Set `staleness_timeout_hours` on the workflow definition. When an instance
+has not been updated for longer than the threshold:
+
+- Instance status is set to `stale`.
+- All open assignments are cancelled.
+- A `workflow.stale` WebSocket event is emitted.
+
+## Branch rules
+
+Dynamic stages evaluate conditions against accumulated `stage_data`
+to determine the next stage. Rules are a JSON array on the stage:
+
+```json
+[
+  { "field": "priority", "op": "eq", "value": "high", "target_stage": "escalation" },
+  { "field": "amount",   "op": "gt", "value": 10000,  "target_stage": "manager-review" }
+]
+```
+
+First matching rule wins. If no rules match, the next ordinal stage is used.
+
+### Operators
+
+| Op | Description |
+|----|-------------|
+| `eq` | Equal (string-normalized) |
+| `neq` | Not equal |
+| `gt`, `lt`, `gte`, `lte` | Numeric comparisons |
+| `exists` | Field is present in stage data |
+| `not_exists` | Field is absent |
+| `in` | Value is in a list |
+| `contains` | String contains substring |
+
+`target_stage` can be a stage name (case-insensitive) or a numeric ordinal.
+
+## Publishing
+
+Workflows have a draft/publish lifecycle:
+
+1. Edit stages and configuration in the workflow editor (draft state).
+2. **Publish** creates a versioned snapshot of all stages.
+3. New instances pin the latest published version.
+4. Editing stages after publishing does not affect running instances.
+
+Version numbers auto-increment. The snapshot preserves the complete
+stage definition array at publish time.
+
+## Starlark hooks
+
+Automated stages execute a Starlark script via the `starlark_hook` field:
+
+```
+package_id:entry_point
+```
+
+For example: `my-automation:on_review` calls the `on_review` function
+in the `my-automation` package. If no entry point is specified,
+`on_run` is used.
+
+The hook receives a context dict:
+
+```python
+{
+  "instance_id": "...",
+  "current_stage": "...",
+  "workflow_id": "...",
+  "started_by": "...",
+  "stage_data": { ... }
+}
+```
+
+The hook returns a dict controlling what happens next:
+
+| Key | Effect |
+|-----|--------|
+| `advance: True` | Auto-advance to the next stage |
+| `data: { ... }` | Merge into stage data for the next stage |
+| `error: "msg"` | Set instance status to `error` and halt |
+
+Up to 10 consecutive automated stages can chain before the engine
+stops with an error (cycle guard).
+
+See the [Starlark Reference](STARLARK-REFERENCE) for available
+sandbox modules.

icons/favicon-animated.svg

@@ -0,0 +1,20 @@
+<svg viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg">
+  <style>
+    @keyframes p { 0%,100%{r:2.5;opacity:1} 50%{r:3;opacity:0.8} }
+    .c { animation: p 2.4s ease-in-out infinite; }
+  </style>
+  <rect width="32" height="32" rx="6" fill="#14142a"/>
+  <line x1="16" y1="8" x2="26" y2="16" stroke="#c8c8d0" stroke-width="1" opacity="0.3"/>
+  <line x1="26" y1="16" x2="16" y2="24" stroke="#c8c8d0" stroke-width="1" opacity="0.3"/>
+  <line x1="16" y1="24" x2="6" y2="16" stroke="#c8c8d0" stroke-width="1" opacity="0.3"/>
+  <line x1="6" y1="16" x2="16" y2="8" stroke="#c8c8d0" stroke-width="1" opacity="0.3"/>
+  <line x1="6" y1="16" x2="16" y2="16" stroke="#c8c8d0" stroke-width="0.8" opacity="0.4"/>
+  <line x1="26" y1="16" x2="16" y2="16" stroke="#c8c8d0" stroke-width="0.8" opacity="0.4"/>
+  <line x1="16" y1="8" x2="16" y2="16" stroke="#c8c8d0" stroke-width="0.8" opacity="0.4"/>
+  <line x1="16" y1="16" x2="16" y2="24" stroke="#c8c8d0" stroke-width="0.8" opacity="0.4"/>
+  <circle cx="16" cy="8" r="2" fill="#3B82F6"/>
+  <circle cx="6" cy="16" r="2" fill="#3B82F6"/>
+  <circle cx="26" cy="16" r="2" fill="#EF4444"/>
+  <circle cx="16" cy="24" r="2" fill="#3B82F6"/>
+  <circle cx="16" cy="16" r="2.5" fill="#3B82F6" class="c"/>
+</svg>

icons/favicon.svg

@@ -0,0 +1,16 @@
+<svg viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg">
+  <rect width="32" height="32" rx="6" fill="#14142a"/>
+  <line x1="16" y1="7" x2="26" y2="16" stroke="#c8c8d0" stroke-width="1" opacity="0.3"/>
+  <line x1="26" y1="16" x2="16" y2="25" stroke="#c8c8d0" stroke-width="1" opacity="0.3"/>
+  <line x1="16" y1="25" x2="6" y2="16" stroke="#c8c8d0" stroke-width="1" opacity="0.3"/>
+  <line x1="6" y1="16" x2="16" y2="7" stroke="#c8c8d0" stroke-width="1" opacity="0.3"/>
+  <line x1="6" y1="16" x2="16" y2="16" stroke="#c8c8d0" stroke-width="0.8" opacity="0.4"/>
+  <line x1="26" y1="16" x2="16" y2="16" stroke="#c8c8d0" stroke-width="0.8" opacity="0.4"/>
+  <line x1="16" y1="7" x2="16" y2="16" stroke="#c8c8d0" stroke-width="0.8" opacity="0.4"/>
+  <line x1="16" y1="16" x2="16" y2="25" stroke="#c8c8d0" stroke-width="0.8" opacity="0.4"/>
+  <circle cx="16" cy="7" r="2" fill="#3B82F6"/>
+  <circle cx="6" cy="16" r="2" fill="#3B82F6"/>
+  <circle cx="26" cy="16" r="2" fill="#EF4444"/>
+  <circle cx="16" cy="25" r="2" fill="#3B82F6"/>
+  <circle cx="16" cy="16" r="2.5" fill="#3B82F6"/>
+</svg>

icons/icon-b-dark-animated.svg

@@ -0,0 +1,48 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <style>
+    @keyframes center-pulse {
+      0%, 100% { r: 10; opacity: 1; }
+      50% { r: 12; opacity: 0.85; }
+    }
+    @keyframes glow-pulse {
+      0%, 100% { r: 16; opacity: 0.12; }
+      50% { r: 22; opacity: 0.06; }
+    }
+    @keyframes node-breathe {
+      0%, 100% { opacity: 1; }
+      50% { opacity: 0.8; }
+    }
+    .center-node { animation: center-pulse 2.4s ease-in-out infinite; }
+    .center-glow { animation: glow-pulse 2.4s ease-in-out infinite; }
+    .node-tl { animation: node-breathe 2.4s ease-in-out infinite 0.3s; }
+    .node-tr { animation: node-breathe 2.4s ease-in-out infinite 0.6s; }
+    .node-bl { animation: node-breathe 2.4s ease-in-out infinite 0.9s; }
+    .node-br { animation: node-breathe 2.4s ease-in-out infinite 1.2s; }
+  </style>
+
+  <rect width="200" height="200" rx="32" fill="#14142a"/>
+
+  <!-- Diamond outline -->
+  <line x1="100" y1="51" x2="145" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"/>
+  <line x1="145" y1="100" x2="100" y2="149" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"/>
+  <line x1="100" y1="149" x2="55" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"/>
+  <line x1="55" y1="100" x2="100" y2="51" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"/>
+
+  <!-- Cross lines -->
+  <line x1="55" y1="100" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <line x1="145" y1="100" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <line x1="100" y1="51" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <line x1="100" y1="100" x2="100" y2="149" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+
+  <!-- Center glow -->
+  <circle cx="100" cy="100" r="16" fill="#3B82F6" opacity="0.12" class="center-glow"/>
+
+  <!-- Nodes -->
+  <circle cx="100" cy="51" r="8" fill="#3B82F6" class="node-tl"/>
+  <circle cx="55" cy="100" r="8" fill="#3B82F6" class="node-tr"/>
+  <circle cx="145" cy="100" r="8" fill="#EF4444" class="node-bl"/>
+  <circle cx="100" cy="149" r="8" fill="#3B82F6" class="node-br"/>
+
+  <!-- Center -->
+  <circle cx="100" cy="100" r="10" fill="#3B82F6" class="center-node"/>
+</svg>

icons/icon-b-dark.svg

@@ -0,0 +1,21 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <rect width="200" height="200" rx="32" fill="#14142a"/>
+  <!-- Diamond outline -->
+  <line x1="100" y1="55" x2="142" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"/>
+  <line x1="142" y1="100" x2="100" y2="145" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"/>
+  <line x1="100" y1="145" x2="58" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"/>
+  <line x1="58" y1="100" x2="100" y2="55" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"/>
+  <!-- Cross lines -->
+  <line x1="58" y1="100" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <line x1="142" y1="100" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <line x1="100" y1="55" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <line x1="100" y1="100" x2="100" y2="145" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <!-- Center glow -->
+  <circle cx="100" cy="100" r="16" fill="#3B82F6" opacity="0.12"/>
+  <!-- Nodes -->
+  <circle cx="100" cy="55" r="8" fill="#3B82F6"/>
+  <circle cx="58" cy="100" r="8" fill="#3B82F6"/>
+  <circle cx="142" cy="100" r="8" fill="#EF4444"/>
+  <circle cx="100" cy="145" r="8" fill="#3B82F6"/>
+  <circle cx="100" cy="100" r="10" fill="#3B82F6"/>
+</svg>

icons/icon-b-light-animated.svg

@@ -0,0 +1,43 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <style>
+    @keyframes center-pulse {
+      0%, 100% { r: 10; opacity: 1; }
+      50% { r: 12; opacity: 0.85; }
+    }
+    @keyframes glow-pulse {
+      0%, 100% { r: 16; opacity: 0.1; }
+      50% { r: 22; opacity: 0.05; }
+    }
+    @keyframes node-breathe {
+      0%, 100% { opacity: 1; }
+      50% { opacity: 0.8; }
+    }
+    .center-node { animation: center-pulse 2.4s ease-in-out infinite; }
+    .center-glow { animation: glow-pulse 2.4s ease-in-out infinite; }
+    .node-tl { animation: node-breathe 2.4s ease-in-out infinite 0.3s; }
+    .node-tr { animation: node-breathe 2.4s ease-in-out infinite 0.6s; }
+    .node-bl { animation: node-breathe 2.4s ease-in-out infinite 0.9s; }
+    .node-br { animation: node-breathe 2.4s ease-in-out infinite 1.2s; }
+  </style>
+
+  <rect width="200" height="200" rx="32" fill="#e8e8ee"/>
+
+  <line x1="100" y1="51" x2="145" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"/>
+  <line x1="145" y1="100" x2="100" y2="149" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"/>
+  <line x1="100" y1="149" x2="55" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"/>
+  <line x1="55" y1="100" x2="100" y2="51" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"/>
+
+  <line x1="55" y1="100" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="145" y1="100" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="100" y1="51" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="100" y1="100" x2="100" y2="149" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+
+  <circle cx="100" cy="100" r="16" fill="#3B82F6" opacity="0.1" class="center-glow"/>
+
+  <circle cx="100" cy="51" r="8" fill="#3B82F6" class="node-tl"/>
+  <circle cx="55" cy="100" r="8" fill="#3B82F6" class="node-tr"/>
+  <circle cx="145" cy="100" r="8" fill="#EF4444" class="node-bl"/>
+  <circle cx="100" cy="149" r="8" fill="#3B82F6" class="node-br"/>
+
+  <circle cx="100" cy="100" r="10" fill="#3B82F6" class="center-node"/>
+</svg>

icons/icon-b-light.svg

@@ -0,0 +1,17 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <rect width="200" height="200" rx="32" fill="#e8e8ee"/>
+  <line x1="100" y1="55" x2="142" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"/>
+  <line x1="142" y1="100" x2="100" y2="145" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"/>
+  <line x1="100" y1="145" x2="58" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"/>
+  <line x1="58" y1="100" x2="100" y2="55" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"/>
+  <line x1="58" y1="100" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="142" y1="100" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="100" y1="55" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="100" y1="100" x2="100" y2="145" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <circle cx="100" cy="100" r="16" fill="#3B82F6" opacity="0.1"/>
+  <circle cx="100" cy="55" r="8" fill="#3B82F6"/>
+  <circle cx="58" cy="100" r="8" fill="#3B82F6"/>
+  <circle cx="142" cy="100" r="8" fill="#EF4444"/>
+  <circle cx="100" cy="145" r="8" fill="#3B82F6"/>
+  <circle cx="100" cy="100" r="10" fill="#3B82F6"/>
+</svg>

icons/icon-e-dark-animated.svg

@@ -0,0 +1,67 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <style>
+    @keyframes draw-edge {
+      from { stroke-dashoffset: 120; }
+      to { stroke-dashoffset: 0; }
+    }
+    @keyframes pop-node {
+      0% { r: 0; opacity: 0; }
+      70% { r: 8; }
+      100% { r: 6; opacity: 1; }
+    }
+    @keyframes pop-center {
+      0% { r: 0; opacity: 0; }
+      70% { r: 10; }
+      100% { r: 8; opacity: 0.7; }
+    }
+    @keyframes center-idle {
+      0%, 100% { r: 8; opacity: 0.7; }
+      50% { r: 9.5; opacity: 0.6; }
+    }
+
+    .edge { stroke-dasharray: 120; stroke-dashoffset: 120; }
+    .e-back-1 { animation: draw-edge 0.5s ease-out 0.0s forwards; }
+    .e-back-2 { animation: draw-edge 0.5s ease-out 0.1s forwards; }
+    .e-back-3 { animation: draw-edge 0.5s ease-out 0.2s forwards; }
+    .e-mid-1  { animation: draw-edge 0.5s ease-out 0.35s forwards; }
+    .e-mid-2  { animation: draw-edge 0.5s ease-out 0.45s forwards; }
+    .e-mid-3  { animation: draw-edge 0.5s ease-out 0.55s forwards; }
+    .e-frt-1  { animation: draw-edge 0.5s ease-out 0.7s forwards; }
+    .e-frt-2  { animation: draw-edge 0.5s ease-out 0.8s forwards; }
+    .e-frt-3  { animation: draw-edge 0.5s ease-out 0.9s forwards; }
+
+    .v-topback    { animation: pop-node 0.3s ease-out 0.05s forwards; r: 0; opacity: 0; }
+    .v-backleft   { animation: pop-node 0.3s ease-out 0.15s forwards; r: 0; opacity: 0; }
+    .v-backright  { animation: pop-node 0.3s ease-out 0.25s forwards; r: 0; opacity: 0; }
+    .v-center     { animation: pop-center 0.3s ease-out 0.5s forwards, center-idle 2.4s ease-in-out 1s infinite; r: 0; opacity: 0; }
+    .v-frontleft  { animation: pop-node 0.3s ease-out 0.75s forwards; r: 0; opacity: 0; }
+    .v-frontright { animation: pop-node 0.3s ease-out 0.85s forwards; r: 0; opacity: 0; }
+    .v-bottom     { animation: pop-node 0.3s ease-out 0.95s forwards; r: 0; opacity: 0; }
+  </style>
+
+  <rect width="200" height="200" rx="32" fill="#14142a"/>
+
+  <!-- Back edges -->
+  <line x1="100" y1="42" x2="46" y2="72" stroke="#c8c8d0" stroke-width="1.5" stroke-linecap="round" opacity="0.2" class="edge e-back-1"/>
+  <line x1="100" y1="42" x2="154" y2="72" stroke="#c8c8d0" stroke-width="1.5" stroke-linecap="round" opacity="0.2" class="edge e-back-2"/>
+  <line x1="154" y1="72" x2="154" y2="128" stroke="#c8c8d0" stroke-width="1.5" stroke-linecap="round" opacity="0.2" class="edge e-back-3"/>
+
+  <!-- Mid edges -->
+  <line x1="46" y1="72" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4" class="edge e-mid-1"/>
+  <line x1="154" y1="72" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4" class="edge e-mid-2"/>
+  <line x1="100" y1="100" x2="100" y2="158" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4" class="edge e-mid-3"/>
+
+  <!-- Front edges -->
+  <line x1="46" y1="72" x2="46" y2="128" stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round" opacity="0.9" class="edge e-frt-1"/>
+  <line x1="46" y1="128" x2="100" y2="158" stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round" opacity="0.9" class="edge e-frt-2"/>
+  <line x1="154" y1="128" x2="100" y2="158" stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round" opacity="0.9" class="edge e-frt-3"/>
+
+  <!-- Vertices -->
+  <circle cx="100" cy="42" fill="#3B82F6" opacity="0.55" class="v-topback"/>
+  <circle cx="46" cy="72" fill="#3B82F6" opacity="0.55" class="v-backleft"/>
+  <circle cx="154" cy="72" fill="#EF4444" opacity="0.55" class="v-backright"/>
+  <circle cx="100" cy="100" fill="#3B82F6" class="v-center"/>
+  <circle cx="46" cy="128" fill="#EF4444" class="v-frontleft"/>
+  <circle cx="154" cy="128" fill="#3B82F6" class="v-frontright"/>
+  <circle cx="100" cy="158" fill="#3B82F6" class="v-bottom"/>
+</svg>

icons/icon-e-dark.svg

@@ -0,0 +1,23 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <rect width="200" height="200" rx="32" fill="#14142a"/>
+  <!-- Back edges -->
+  <line x1="100" y1="48" x2="150" y2="74" stroke="#c8c8d0" stroke-width="1.5" stroke-linecap="round" opacity="0.2"/>
+  <line x1="100" y1="48" x2="50" y2="74" stroke="#c8c8d0" stroke-width="1.5" stroke-linecap="round" opacity="0.2"/>
+  <line x1="150" y1="74" x2="150" y2="126" stroke="#c8c8d0" stroke-width="1.5" stroke-linecap="round" opacity="0.2"/>
+  <!-- Mid edges -->
+  <line x1="50" y1="74" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <line x1="150" y1="74" x2="100" y2="100" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <line x1="100" y1="100" x2="100" y2="152" stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"/>
+  <!-- Front edges -->
+  <line x1="50" y1="74" x2="50" y2="126" stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round" opacity="0.9"/>
+  <line x1="50" y1="126" x2="100" y2="152" stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round" opacity="0.9"/>
+  <line x1="150" y1="126" x2="100" y2="152" stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round" opacity="0.9"/>
+  <!-- Vertices -->
+  <circle cx="100" cy="48" r="6" fill="#3B82F6" opacity="0.55"/>
+  <circle cx="50" cy="74" r="6" fill="#3B82F6" opacity="0.55"/>
+  <circle cx="150" cy="74" r="6" fill="#EF4444" opacity="0.55"/>
+  <circle cx="100" cy="100" r="8" fill="#3B82F6" opacity="0.7"/>
+  <circle cx="50" cy="126" r="6" fill="#EF4444"/>
+  <circle cx="150" cy="126" r="6" fill="#3B82F6"/>
+  <circle cx="100" cy="152" r="6" fill="#3B82F6"/>
+</svg>

icons/icon-e-light-animated.svg

@@ -0,0 +1,63 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <style>
+    @keyframes draw-edge {
+      from { stroke-dashoffset: 120; }
+      to { stroke-dashoffset: 0; }
+    }
+    @keyframes pop-node {
+      0% { r: 0; opacity: 0; }
+      70% { r: 8; }
+      100% { r: 6; opacity: 1; }
+    }
+    @keyframes pop-center {
+      0% { r: 0; opacity: 0; }
+      70% { r: 10; }
+      100% { r: 8; opacity: 0.7; }
+    }
+    @keyframes center-idle {
+      0%, 100% { r: 8; opacity: 0.7; }
+      50% { r: 9.5; opacity: 0.6; }
+    }
+
+    .edge { stroke-dasharray: 120; stroke-dashoffset: 120; }
+    .e-back-1 { animation: draw-edge 0.5s ease-out 0.0s forwards; }
+    .e-back-2 { animation: draw-edge 0.5s ease-out 0.1s forwards; }
+    .e-back-3 { animation: draw-edge 0.5s ease-out 0.2s forwards; }
+    .e-mid-1  { animation: draw-edge 0.5s ease-out 0.35s forwards; }
+    .e-mid-2  { animation: draw-edge 0.5s ease-out 0.45s forwards; }
+    .e-mid-3  { animation: draw-edge 0.5s ease-out 0.55s forwards; }
+    .e-frt-1  { animation: draw-edge 0.5s ease-out 0.7s forwards; }
+    .e-frt-2  { animation: draw-edge 0.5s ease-out 0.8s forwards; }
+    .e-frt-3  { animation: draw-edge 0.5s ease-out 0.9s forwards; }
+
+    .v-topback    { animation: pop-node 0.3s ease-out 0.05s forwards; r: 0; opacity: 0; }
+    .v-backleft   { animation: pop-node 0.3s ease-out 0.15s forwards; r: 0; opacity: 0; }
+    .v-backright  { animation: pop-node 0.3s ease-out 0.25s forwards; r: 0; opacity: 0; }
+    .v-center     { animation: pop-center 0.3s ease-out 0.5s forwards, center-idle 2.4s ease-in-out 1s infinite; r: 0; opacity: 0; }
+    .v-frontleft  { animation: pop-node 0.3s ease-out 0.75s forwards; r: 0; opacity: 0; }
+    .v-frontright { animation: pop-node 0.3s ease-out 0.85s forwards; r: 0; opacity: 0; }
+    .v-bottom     { animation: pop-node 0.3s ease-out 0.95s forwards; r: 0; opacity: 0; }
+  </style>
+
+  <rect width="200" height="200" rx="32" fill="#e8e8ee"/>
+
+  <line x1="100" y1="42" x2="46" y2="72" stroke="#333" stroke-width="1.5" stroke-linecap="round" opacity="0.15" class="edge e-back-1"/>
+  <line x1="100" y1="42" x2="154" y2="72" stroke="#333" stroke-width="1.5" stroke-linecap="round" opacity="0.15" class="edge e-back-2"/>
+  <line x1="154" y1="72" x2="154" y2="128" stroke="#333" stroke-width="1.5" stroke-linecap="round" opacity="0.15" class="edge e-back-3"/>
+
+  <line x1="46" y1="72" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3" class="edge e-mid-1"/>
+  <line x1="154" y1="72" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3" class="edge e-mid-2"/>
+  <line x1="100" y1="100" x2="100" y2="158" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3" class="edge e-mid-3"/>
+
+  <line x1="46" y1="72" x2="46" y2="128" stroke="#333" stroke-width="2.5" stroke-linecap="round" opacity="0.7" class="edge e-frt-1"/>
+  <line x1="46" y1="128" x2="100" y2="158" stroke="#333" stroke-width="2.5" stroke-linecap="round" opacity="0.7" class="edge e-frt-2"/>
+  <line x1="154" y1="128" x2="100" y2="158" stroke="#333" stroke-width="2.5" stroke-linecap="round" opacity="0.7" class="edge e-frt-3"/>
+
+  <circle cx="100" cy="42" fill="#3B82F6" opacity="0.55" class="v-topback"/>
+  <circle cx="46" cy="72" fill="#3B82F6" opacity="0.55" class="v-backleft"/>
+  <circle cx="154" cy="72" fill="#EF4444" opacity="0.55" class="v-backright"/>
+  <circle cx="100" cy="100" fill="#3B82F6" class="v-center"/>
+  <circle cx="46" cy="128" fill="#EF4444" class="v-frontleft"/>
+  <circle cx="154" cy="128" fill="#3B82F6" class="v-frontright"/>
+  <circle cx="100" cy="158" fill="#3B82F6" class="v-bottom"/>
+</svg>

icons/icon-e-light.svg

@@ -0,0 +1,19 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <rect width="200" height="200" rx="32" fill="#e8e8ee"/>
+  <line x1="100" y1="48" x2="150" y2="74" stroke="#333" stroke-width="1.5" stroke-linecap="round" opacity="0.15"/>
+  <line x1="100" y1="48" x2="50" y2="74" stroke="#333" stroke-width="1.5" stroke-linecap="round" opacity="0.15"/>
+  <line x1="150" y1="74" x2="150" y2="126" stroke="#333" stroke-width="1.5" stroke-linecap="round" opacity="0.15"/>
+  <line x1="50" y1="74" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="150" y1="74" x2="100" y2="100" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="100" y1="100" x2="100" y2="152" stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"/>
+  <line x1="50" y1="74" x2="50" y2="126" stroke="#333" stroke-width="2.5" stroke-linecap="round" opacity="0.7"/>
+  <line x1="50" y1="126" x2="100" y2="152" stroke="#333" stroke-width="2.5" stroke-linecap="round" opacity="0.7"/>
+  <line x1="150" y1="126" x2="100" y2="152" stroke="#333" stroke-width="2.5" stroke-linecap="round" opacity="0.7"/>
+  <circle cx="100" cy="48" r="6" fill="#3B82F6" opacity="0.55"/>
+  <circle cx="50" cy="74" r="6" fill="#3B82F6" opacity="0.55"/>
+  <circle cx="150" cy="74" r="6" fill="#EF4444" opacity="0.55"/>
+  <circle cx="100" cy="100" r="8" fill="#3B82F6" opacity="0.7"/>
+  <circle cx="50" cy="126" r="6" fill="#EF4444"/>
+  <circle cx="150" cy="126" r="6" fill="#3B82F6"/>
+  <circle cx="100" cy="152" r="6" fill="#3B82F6"/>
+</svg>

icons/icon-morph-dark-animated.svg

@@ -0,0 +1,174 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <style>
+    @keyframes center-pulse {
+      0%, 100% { r: 8; }
+      50% { r: 9.5; }
+    }
+    .center-node { animation: center-pulse 2.4s ease-in-out infinite; }
+  </style>
+
+  <rect width="200" height="200" rx="32" fill="#14142a"/>
+
+  <!--
+    B-state (flat diamond) positions:
+      top:    100,51   left: 55,100   right: 145,100   bottom: 100,149   center: 100,100
+    
+    E-state (wireframe cube) positions:
+      topBack:    100,42    backLeft:  46,72    backRight: 154,72
+      center:     100,100   frontLeft: 46,128   frontRight: 154,128   bottom: 100,158
+    
+    Mapping B→E:
+      top    → topBack     (100,51  → 100,42)
+      left   → backLeft    (55,100  → 46,72)   AND spawns frontLeft  (55,100  → 46,128)
+      right  → backRight   (145,100 → 154,72)  AND spawns frontRight (145,100 → 154,128)
+      bottom → bottom      (100,149 → 100,158)
+      center → center      (100,100 → 100,100) stays
+    
+    Timing: 1.5s hold B, 1s morph to E, 2s hold E, 1s morph back, repeat
+  -->
+
+  <!-- ═══ EDGES ═══ -->
+  <!-- Diamond outline (B) that morphs to cube edges (E) -->
+
+  <!-- top→right becomes topBack→backRight -->
+  <line stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"
+        x1="100" y1="51" x2="145" y2="100">
+    <animate attributeName="x1" values="100;100;100;100;100" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="51;51;42;42;51"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="145;145;154;154;145"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="100;100;72;72;100"     keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- right→bottom becomes backRight→frontRight -->
+  <line stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"
+        x1="145" y1="100" x2="100" y2="149">
+    <animate attributeName="x1" values="145;145;154;154;145"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"    keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="100;100;154;154;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="149;149;128;128;149"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- bottom→left becomes frontRight→bottom (front bottom-right) -->
+  <line stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round" opacity="0.25"
+        x1="100" y1="149" x2="55" y2="100">
+    <animate attributeName="x1" values="100;100;154;154;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="149;149;128;128;149"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="55;55;100;100;55"     keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="100;100;158;158;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0.25;0.25;0.9;0.9;0.25" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- left→top becomes backLeft→topBack -->
+  <line stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.25"
+        x1="55" y1="100" x2="100" y2="51">
+    <animate attributeName="x1" values="55;55;46;46;55"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"    keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="100;100;100;100;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="51;51;42;42;51"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- Cross: left→center becomes backLeft→center -->
+  <line stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"
+        x1="55" y1="100" x2="100" y2="100">
+    <animate attributeName="x1" values="55;55;46;46;55"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- Cross: right→center becomes backRight→center -->
+  <line stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"
+        x1="145" y1="100" x2="100" y2="100">
+    <animate attributeName="x1" values="145;145;154;154;145" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- Cross: center→bottom stays vertical but bottom moves -->
+  <line stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"
+        x1="100" y1="100" x2="100" y2="149">
+    <animate attributeName="y2" values="149;149;158;158;149" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- Cross: top→center vertical -->
+  <line stroke="#c8c8d0" stroke-width="2" stroke-linecap="round" opacity="0.4"
+        x1="100" y1="51" x2="100" y2="100">
+    <animate attributeName="y1" values="51;51;42;42;51" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- NEW edges that appear in E-state (start invisible) -->
+  <!-- frontLeft→bottom -->
+  <line stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round"
+        x1="55" y1="100" x2="100" y2="149" opacity="0">
+    <animate attributeName="x1" values="55;55;46;46;55"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;128;128;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="149;149;158;158;149"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0;0;0.9;0.9;0"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- backLeft→frontLeft (left vertical) -->
+  <line stroke="#c8c8d0" stroke-width="2.5" stroke-linecap="round"
+        x1="55" y1="100" x2="55" y2="100" opacity="0">
+    <animate attributeName="x1" values="55;55;46;46;55"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"    keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="55;55;46;46;55"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="100;100;128;128;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0;0;0.9;0.9;0"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- ═══ NODES ═══ -->
+
+  <!-- Top → TopBack -->
+  <circle cx="100" cy="51" r="8" fill="#3B82F6">
+    <animate attributeName="cy" values="51;51;42;42;51"              keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="1;1;0.55;0.55;1"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="8;8;6;6;8"                   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- Left → BackLeft -->
+  <circle cx="55" cy="100" r="8" fill="#3B82F6">
+    <animate attributeName="cx" values="55;55;46;46;55"              keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="cy" values="100;100;72;72;100"           keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="1;1;0.55;0.55;1"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="8;8;6;6;8"                   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- Right → BackRight -->
+  <circle cx="145" cy="100" r="8" fill="#EF4444">
+    <animate attributeName="cx" values="145;145;154;154;145"         keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="cy" values="100;100;72;72;100"           keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="1;1;0.55;0.55;1"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="8;8;6;6;8"                   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- Bottom → Bottom (slight shift) -->
+  <circle cx="100" cy="149" r="8" fill="#3B82F6">
+    <animate attributeName="cy" values="149;149;158;158;149"         keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="8;8;6;6;8"                   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- FrontLeft: spawns from Left position, invisible in B -->
+  <circle cx="55" cy="100" r="0" fill="#EF4444" opacity="0">
+    <animate attributeName="cx" values="55;55;46;46;55"              keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="cy" values="100;100;128;128;100"         keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="0;0;6;6;0"                   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0;0;1;1;0"             keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- FrontRight: spawns from Right position, invisible in B -->
+  <circle cx="145" cy="100" r="0" fill="#3B82F6" opacity="0">
+    <animate attributeName="cx" values="145;145;154;154;145"         keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="cy" values="100;100;128;128;100"         keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="0;0;6;6;0"                   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0;0;1;1;0"             keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- Center (always visible, pulse) -->
+  <circle cx="100" cy="100" r="10" fill="#3B82F6" class="center-node">
+    <animate attributeName="r" values="10;10;8;8;10"                 keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="1;1;0.7;0.7;1"         keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- Center glow -->
+  <circle cx="100" cy="100" r="16" fill="#3B82F6" opacity="0.12">
+    <animate attributeName="r" values="16;16;12;12;16"               keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0.12;0.12;0.06;0.06;0.12" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+</svg>

icons/icon-morph-light-animated.svg

@@ -0,0 +1,127 @@
+<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <style>
+    @keyframes center-pulse {
+      0%, 100% { r: 8; }
+      50% { r: 9.5; }
+    }
+    .center-node { animation: center-pulse 2.4s ease-in-out infinite; }
+  </style>
+
+  <rect width="200" height="200" rx="32" fill="#e8e8ee"/>
+
+  <!-- Diamond/cube edges -->
+  <line stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"
+        x1="100" y1="51" x2="145" y2="100">
+    <animate attributeName="y1" values="51;51;42;42;51"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="145;145;154;154;145"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="100;100;72;72;100"    keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <line stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"
+        x1="145" y1="100" x2="100" y2="149">
+    <animate attributeName="x1" values="145;145;154;154;145"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"    keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="100;100;154;154;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="149;149;128;128;149"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <line stroke="#333" stroke-width="2.5" stroke-linecap="round" opacity="0.18"
+        x1="100" y1="149" x2="55" y2="100">
+    <animate attributeName="x1" values="100;100;154;154;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="149;149;128;128;149"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="55;55;100;100;55"     keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="100;100;158;158;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0.18;0.18;0.7;0.7;0.18" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <line stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.18"
+        x1="55" y1="100" x2="100" y2="51">
+    <animate attributeName="x1" values="55;55;46;46;55"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"    keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="51;51;42;42;51"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- Cross lines -->
+  <line stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"
+        x1="55" y1="100" x2="100" y2="100">
+    <animate attributeName="x1" values="55;55;46;46;55"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+  <line stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"
+        x1="145" y1="100" x2="100" y2="100">
+    <animate attributeName="x1" values="145;145;154;154;145" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+  <line stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"
+        x1="100" y1="100" x2="100" y2="149">
+    <animate attributeName="y2" values="149;149;158;158;149" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+  <line stroke="#333" stroke-width="2" stroke-linecap="round" opacity="0.3"
+        x1="100" y1="51" x2="100" y2="100">
+    <animate attributeName="y1" values="51;51;42;42;51"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- E-only edges (spawn) -->
+  <line stroke="#333" stroke-width="2.5" stroke-linecap="round"
+        x1="55" y1="100" x2="100" y2="149" opacity="0">
+    <animate attributeName="x1" values="55;55;46;46;55"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;128;128;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="149;149;158;158;149"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0;0;0.7;0.7;0"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+  <line stroke="#333" stroke-width="2.5" stroke-linecap="round"
+        x1="55" y1="100" x2="55" y2="100" opacity="0">
+    <animate attributeName="x1" values="55;55;46;46;55"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y1" values="100;100;72;72;100"    keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="x2" values="55;55;46;46;55"      keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="y2" values="100;100;128;128;100"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0;0;0.7;0.7;0"  keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </line>
+
+  <!-- Nodes -->
+  <circle cx="100" cy="51" r="8" fill="#3B82F6">
+    <animate attributeName="cy" values="51;51;42;42;51"        keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="1;1;0.55;0.55;1" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="8;8;6;6;8"             keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+  <circle cx="55" cy="100" r="8" fill="#3B82F6">
+    <animate attributeName="cx" values="55;55;46;46;55"        keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="cy" values="100;100;72;72;100"     keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="1;1;0.55;0.55;1" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="8;8;6;6;8"             keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+  <circle cx="145" cy="100" r="8" fill="#EF4444">
+    <animate attributeName="cx" values="145;145;154;154;145"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="cy" values="100;100;72;72;100"     keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="1;1;0.55;0.55;1" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="8;8;6;6;8"             keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+  <circle cx="100" cy="149" r="8" fill="#3B82F6">
+    <animate attributeName="cy" values="149;149;158;158;149"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="8;8;6;6;8"             keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- Spawn nodes -->
+  <circle cx="55" cy="100" r="0" fill="#EF4444" opacity="0">
+    <animate attributeName="cx" values="55;55;46;46;55"        keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="cy" values="100;100;128;128;100"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="0;0;6;6;0"             keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0;0;1;1;0"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+  <circle cx="145" cy="100" r="0" fill="#3B82F6" opacity="0">
+    <animate attributeName="cx" values="145;145;154;154;145"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="cy" values="100;100;128;128;100"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="r" values="0;0;6;6;0"             keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0;0;1;1;0"       keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+
+  <!-- Center -->
+  <circle cx="100" cy="100" r="10" fill="#3B82F6" class="center-node">
+    <animate attributeName="r" values="10;10;8;8;10"           keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="1;1;0.7;0.7;1"   keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+  <circle cx="100" cy="100" r="16" fill="#3B82F6" opacity="0.1">
+    <animate attributeName="r" values="16;16;12;12;16"         keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+    <animate attributeName="opacity" values="0.1;0.1;0.05;0.05;0.1" keyTimes="0;0.27;0.45;0.73;1" dur="5.5s" repeatCount="indefinite"/>
+  </circle>
+</svg>

icons/wordmark-dark.svg

@@ -0,0 +1,12 @@
+<svg viewBox="0 0 520 80" xmlns="http://www.w3.org/2000/svg">
+  <!-- A-frame lettermark -->
+  <line x1="28" y1="8" x2="6" y2="68" stroke="#3B82F6" stroke-width="3.5" stroke-linecap="round"/>
+  <line x1="28" y1="8" x2="50" y2="68" stroke="#3B82F6" stroke-width="3.5" stroke-linecap="round"/>
+  <line x1="14" y1="46" x2="42" y2="46" stroke="#3B82F6" stroke-width="2.5" stroke-linecap="round"/>
+  <circle cx="28" cy="8" r="4" fill="#3B82F6"/>
+  <circle cx="14" cy="46" r="2.5" fill="#EF4444"/>
+  <circle cx="28" cy="46" r="2.5" fill="#3B82F6"/>
+  <circle cx="42" cy="46" r="2.5" fill="#EF4444"/>
+  <!-- "rmature" text -->
+  <text x="58" y="62" fill="#dddddd" font-family="-apple-system, system-ui, 'Segoe UI', sans-serif" font-size="52" font-weight="300" letter-spacing="1">rmature</text>
+</svg>

icons/wordmark-light.svg

@@ -0,0 +1,10 @@
+<svg viewBox="0 0 520 80" xmlns="http://www.w3.org/2000/svg">
+  <line x1="28" y1="8" x2="6" y2="68" stroke="#3B82F6" stroke-width="3.5" stroke-linecap="round"/>
+  <line x1="28" y1="8" x2="50" y2="68" stroke="#3B82F6" stroke-width="3.5" stroke-linecap="round"/>
+  <line x1="14" y1="46" x2="42" y2="46" stroke="#3B82F6" stroke-width="2.5" stroke-linecap="round"/>
+  <circle cx="28" cy="8" r="4" fill="#3B82F6"/>
+  <circle cx="14" cy="46" r="2.5" fill="#EF4444"/>
+  <circle cx="28" cy="46" r="2.5" fill="#3B82F6"/>
+  <circle cx="42" cy="46" r="2.5" fill="#EF4444"/>
+  <text x="58" y="62" fill="#222222" font-family="-apple-system, system-ui, 'Segoe UI', sans-serif" font-size="52" font-weight="300" letter-spacing="1">rmature</text>
+</svg>

packages/chat-runner/js/conversations.js

@@ -0,0 +1,59 @@
+/**
+ * Chat Runner — chat/conversations suite
+ *
+ * Tests conversation CRUD via the chat-core ext API.
+ */
+(function () {
+  'use strict';
+
+  var api = window.CR.api;
+
+  sw.testing.suite('chat/conversations', async function (s) {
+    var convId;
+
+    s.test('create conversation', async function (t) {
+      var r = await api.post('/conversations', {
+        title: 'Runner Test Convo ' + Date.now(),
+        type: 'direct'
+      });
+      t.assert.ok(r.id, 'conversation has id');
+      t.assert.ok(r.title, 'conversation has title');
+      convId = r.id;
+      s.track('conversation', convId);
+    });
+
+    s.test('get conversation', async function (t) {
+      t.assert.ok(convId, 'convId from previous test');
+      var r = await api.get('/conversations/' + convId);
+      t.assert.eq(r.id, convId, 'id matches');
+    });
+
+    s.test('update conversation', async function (t) {
+      t.assert.ok(convId, 'convId from previous test');
+      var r = await api.put('/conversations/' + convId, {
+        title: 'Updated Convo Title'
+      });
+      t.assert.eq(r.title, 'Updated Convo Title', 'title updated');
+    });
+
+    s.test('list conversations', async function (t) {
+      var r = await api.get('/conversations');
+      var list = Array.isArray(r) ? r : (r.data || []);
+      t.assert.ok(Array.isArray(list), 'response is array');
+      var found = list.some(function (c) { return c.id === convId; });
+      t.assert.ok(found, 'created conversation in list');
+    });
+
+    s.test('delete conversation', async function (t) {
+      t.assert.ok(convId, 'convId from previous test');
+      await api.del('/conversations/' + convId);
+      try {
+        await api.get('/conversations/' + convId);
+        t.assert.ok(false, 'expected error after delete');
+      } catch (e) {
+        t.assert.ok(true, 'conversation not found after delete');
+      }
+      convId = null;
+    });
+  });
+})();

packages/chat-runner/js/main.js

@@ -0,0 +1,64 @@
+/**
+ * Chat Runner — Entry Point
+ *
+ * Boot SDK, load test modules in dependency order.
+ * Each module is an IIFE that registers suites via sw.testing.suite().
+ */
+(async function () {
+  'use strict';
+
+  try {
+    var base = window.__BASE__ || '';
+    var ver = window.__VERSION__ || '0';
+    if (!window.preact) {
+      var { h, render } = await import(base + '/js/sw/vendor/preact.module.js');
+      var hooksModule = await import(base + '/js/sw/vendor/hooks.module.js');
+      var htmModule = await import(base + '/js/sw/vendor/htm.module.js');
+      window.preact = { h, render };
+      window.hooks = hooksModule;
+      window.html = htmModule.default.bind(h);
+    }
+    var sdk = await import(base + '/js/sw/sdk/index.js?v=' + ver);
+    await sdk.boot();
+  } catch (e) {
+    console.warn('[ChatRunner] SDK boot failed:', e.message);
+  }
+
+  window.CR = {
+    base: window.__BASE__ || '',
+    api: sw.api.ext('chat-core')
+  };
+
+  var surfaceId = 'chat-runner';
+  var assetBase = '/surfaces/' + surfaceId + '/js/';
+  if (window.CR.base) assetBase = window.CR.base + assetBase;
+
+  var modules = [
+    'conversations.js',
+    'messaging.js',
+    'shell-topbar.js'
+  ];
+
+  var loaded = 0;
+  function loadNext() {
+    if (loaded >= modules.length) { onReady(); return; }
+    var script = document.createElement('script');
+    script.src = assetBase + modules[loaded] + '?v=' + (window.__VERSION__ || '0') + '.' + Date.now();
+    script.onload = function () { loaded++; loadNext(); };
+    script.onerror = function () {
+      console.error('[ChatRunner] Failed to load: ' + modules[loaded]);
+      loaded++; loadNext();
+    };
+    document.body.appendChild(script);
+  }
+
+  function onReady() {
+    console.log('[ChatRunner] All modules loaded — ' + sw.testing.suites().length + ' suites registered');
+    var manifest = window.__MANIFEST__ || {};
+    if (manifest.id === surfaceId) {
+      window.location.href = (window.__BASE__ || '') + '/s/test-runners';
+    }
+  }
+
+  loadNext();
+})();

packages/chat-runner/js/messaging.js

@@ -0,0 +1,60 @@
+/**
+ * Chat Runner — chat/messaging suite
+ *
+ * Tests message CRUD and search within conversations.
+ */
+(function () {
+  'use strict';
+
+  var api = window.CR.api;
+
+  sw.testing.suite('chat/messaging', async function (s) {
+    var convId, msgId;
+
+    s.beforeAll(async function () {
+      var r = await api.post('/conversations', {
+        title: 'Messaging Test ' + Date.now(),
+        type: 'direct'
+      });
+      convId = r.id;
+      s.track('conversation', convId);
+    });
+
+    s.test('send message', async function (t) {
+      var r = await api.post('/messages/' + convId, {
+        content: 'Hello from chat-runner test!',
+        content_type: 'text'
+      });
+      t.assert.ok(r.id, 'message has id');
+      t.assert.ok(r.content, 'message has content');
+      msgId = r.id;
+    });
+
+    s.test('list messages', async function (t) {
+      var r = await api.get('/messages/' + convId);
+      var list = Array.isArray(r) ? r : (r.data || r.messages || []);
+      t.assert.ok(Array.isArray(list), 'messages is array');
+      t.assert.ok(list.length > 0, 'at least one message');
+      var found = list.some(function (m) { return m.id === msgId; });
+      t.assert.ok(found, 'sent message appears in list');
+    });
+
+    s.test('search conversations', async function (t) {
+      var r = await api.get('/search?q=chat-runner');
+      var list = Array.isArray(r) ? r : (r.data || r.conversations || r.results || []);
+      t.assert.ok(Array.isArray(list), 'search returns array');
+      if (list.length === 0) {
+        t.warn('Search returned empty — may need time for indexing');
+      }
+    });
+
+    s.test('mark read', async function (t) {
+      try {
+        await api.post('/read/' + convId, {});
+        t.assert.ok(true, 'mark read succeeded');
+      } catch (e) {
+        t.warn('mark read failed: ' + e.message);
+      }
+    });
+  });
+})();

packages/chat-runner/js/shell-topbar.js

@@ -0,0 +1,31 @@
+/**
+ * Chat Runner — chat/shell-topbar suite
+ *
+ * Validates the Chat surface uses the v0.7.0 shell topbar contract
+ * and does not render the legacy sw.shell.Topbar component.
+ */
+(function () {
+  'use strict';
+
+  sw.testing.suite('chat/shell-topbar', async function (s) {
+
+    s.test('surface JS does not reference legacy Topbar', async function (t) {
+      var base = window.__BASE__ || '';
+      var resp = await fetch(base + '/surfaces/chat/js/main.js');
+      t.assert.eq(resp.status, 200, 'fetched chat main.js');
+      var src = await resp.text();
+      var hasLegacy = src.indexOf('sw.shell.Topbar') !== -1;
+      t.assert.ok(!hasLegacy, 'no sw.shell.Topbar reference (uses shell topbar API)');
+    });
+
+    s.test('surface JS uses shell topbar API', async function (t) {
+      var base = window.__BASE__ || '';
+      var resp = await fetch(base + '/surfaces/chat/js/main.js');
+      var src = await resp.text();
+      var usesAPI = src.indexOf('sw.shell.topbar.setTitle') !== -1
+                 || src.indexOf('sw.shell.topbar.setSlot') !== -1;
+      t.assert.ok(usesAPI, 'uses sw.shell.topbar.setTitle or setSlot');
+    });
+
+  });
+})();

packages/chat-runner/manifest.json

@@ -0,0 +1,9 @@
+{
+  "id": "chat-runner",
+  "icon": "💬",
+  "type": "test-runner",
+  "title": "Chat Runner",
+  "auth": "admin",
+  "version": "0.2.0",
+  "description": "Integration tests for Chat package — conversations, messaging, search."
+}

packages/chat/js/main.js

@@ -1,12 +1,12 @@
 /**
- * Chat — Surface Entry Point (v0.2.0)
+ * Chat — Surface Entry Point (v0.3.0)
  *
  * Messaging surface built on chat-core library:
  *   sw.api.ext('chat-core')  — conversation/message CRUD
  *   sw.api.ext('chat')       — typing indicators
  *   sw.realtime              — live events
  *   sw.ui.*                  — primitive components
- *   sw.shell.Topbar          — navigation bar
+ *   sw.shell.topbar           — shell topbar API
  */
 (async function () {
   'use strict';
@@ -42,7 +42,6 @@
   var api     = sw.api.ext('chat-core');
   var chatApi = sw.api.ext('chat');
   var { Button, Spinner, Avatar, Dialog, Tabs } = sw.ui;
-  var Topbar = sw.shell.Topbar;
 
   // Import UserPicker directly (not in sw.ui index)
   var { UserPicker } = await import(base + '/js/sw/primitives/user-picker.js?v=' + ver);
@@ -831,20 +830,33 @@
     var selectedConv = conversations.find(c => c.id === selectedId);
     var threadTitle = selectedConv ? (selectedConv.title || 'Direct Message') : '';
 
+    // ── Shell topbar ───────────────────────────
+    useEffect(() => {
+      if (!sw.shell?.topbar) return;
+      sw.shell.topbar.setTitle('Chat');
+    }, []);
+
+    useEffect(() => {
+      if (!sw.shell?.topbar) return;
+      if (selectedId) {
+        sw.shell.topbar.setSlot(html`
+          <span class="ext-chat-topbar__thread-title">${threadTitle}</span>
+          <${Button} size="sm" variant="secondary"
+                     onClick=${() => setShowParticipants(!showParticipants)}>
+            ${showParticipants ? 'Hide' : 'People'}
+          <//>
+        `);
+      } else {
+        sw.shell.topbar.setSlot(null);
+      }
+    }, [selectedId, threadTitle, showParticipants]);
+
     if (loading) {
       return html`<div class="ext-chat-loading"><${Spinner} /></div>`;
     }
 
     return html`
       <div class="ext-chat-app">
-        <${Topbar} title="Chat">
-          ${selectedId && html`
-            <span class="ext-chat-topbar__thread-title">${threadTitle}</span>
-            <${Button} size="sm" variant="secondary"
-                       onClick=${() => setShowParticipants(!showParticipants)}>
-              ${showParticipants ? 'Hide' : 'People'}
-            <//>`}
-        <//>
         <div class="ext-chat-body">
           <${ConversationList}
             selected=${selectedId}

packages/chat/manifest.json

@@ -6,7 +6,7 @@
   "route": "/s/chat",
   "auth": "authenticated",
   "layout": "single",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "icon": "\ud83d\udcac",
   "description": "Chat surface — conversations, messaging, typing indicators, read receipts.",
   "author": "armature",

packages/hello-dashboard/css/main.css

@@ -1,17 +0,0 @@
-/* Hello Dashboard — sample extension surface styles.
-   Uses CSS custom properties from the platform theme system (variables.css).
-   See EXTENSION-SURFACES.md for the full property reference. */
-
-.ext-hello-dashboard { max-width: 720px; margin: 0 auto; padding: var(--sp-10) var(--sp-6); }
-.ext-hello-dashboard-header { margin-bottom: var(--sp-8); }
-.ext-hello-dashboard-header h1 { font-size: 28px; font-weight: 700; color: var(--text); margin: 0 0 var(--sp-2) 0; }
-.ext-hello-dashboard-subtitle { font-size: 14px; color: var(--text-2); margin: 0; }
-.ext-hello-dashboard-subtitle code,
-.ext-hello-dashboard-card-value code { background: var(--bg-raised); padding: 2px 6px; border-radius: var(--radius-sm); font-size: 13px; }
-.ext-hello-dashboard-cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: var(--sp-4); margin-bottom: var(--sp-6); }
-.ext-hello-dashboard-card { background: var(--bg-surface); border: 1px solid var(--border); border-radius: var(--radius-lg); padding: var(--sp-4); }
-.ext-hello-dashboard-card-title { font-size: 12px; font-weight: 600; color: var(--text-2); text-transform: uppercase; letter-spacing: 0.5px; margin-bottom: var(--sp-2); }
-.ext-hello-dashboard-card-value { font-size: 20px; font-weight: 600; color: var(--text); margin-bottom: var(--sp-1); }
-.ext-hello-dashboard-card-detail { font-size: 12px; color: var(--text-3); }
-.ext-hello-dashboard-actions { display: flex; gap: var(--sp-3); margin-bottom: var(--sp-6); }
-.ext-hello-dashboard-manifest { background: var(--bg-surface); border: 1px solid var(--border); border-radius: var(--radius); padding: var(--sp-4); font-size: 12px; color: var(--text-2); overflow-x: auto; white-space: pre-wrap; font-family: var(--mono); line-height: 1.5; }

packages/hello-dashboard/js/main.js

@@ -1,84 +0,0 @@
-/**
- * Hello Dashboard — sample extension surface.
- *
- * Platform contract:
- *   - Mounts into #extension-mount
- *   - window.__MANIFEST__ — surface manifest (json, lowercase keys)
- *   - sw.auth.user         — authenticated user (from SDK boot)
- *   - UI.toast(msg, type) — platform toast (success/error/info/warning)
- *   - API._get(path)      — authenticated fetch (returns parsed JSON)
- */
-(function() {
-    'use strict';
-
-    var mount = document.getElementById('extension-mount');
-    if (!mount) return;
-
-    var manifest = window.__MANIFEST__ || {};
-    var user = window.sw?.auth?.user || {};
-    var isDark = document.documentElement.getAttribute('data-theme') === 'dark';
-    var name = user.display_name || user.username || 'World';
-
-    mount.innerHTML =
-        '<div class="ext-hello-dashboard">' +
-            '<div class="ext-hello-dashboard-header">' +
-                '<h1>Hello, ' + esc(name) + '!</h1>' +
-                '<p class="ext-hello-dashboard-subtitle">Extension surface <code>' + esc(manifest.id || 'unknown') + '</code> loaded successfully.</p>' +
-            '</div>' +
-            '<div class="ext-hello-dashboard-cards">' +
-                card('Platform Access', (typeof UI !== 'undefined' ? '\u2713 Connected' : '\u2717 Unavailable'),
-                     'API, Theme, UI primitives available', 'var(--accent)') +
-                card('Theme', isDark ? '\uD83C\uDF19 Dark' : '\u2600\uFE0F Light',
-                     'Reads from platform theme system', '') +
-                card('Route', '<code>' + esc(manifest.route || '/s/hello-dashboard') + '</code>',
-                     'Registered via surface manifest', '') +
-            '</div>' +
-            '<div class="ext-hello-dashboard-actions">' +
-                '<button class="sw-btn sw-btn--primary sw-btn--md" id="helloToast">Show Toast</button>' +
-                '<button class="sw-btn sw-btn--secondary sw-btn--md" id="helloApi">Test API</button>' +
-            '</div>' +
-            '<pre class="ext-hello-dashboard-manifest">' + esc(JSON.stringify(manifest, null, 2)) + '</pre>' +
-        '</div>';
-
-    // Wire toast button
-    document.getElementById('helloToast').addEventListener('click', function() {
-        if (typeof UI !== 'undefined' && UI.toast) {
-            UI.toast('Extension surface is working!', 'success');
-        } else {
-            alert('Extension surface is working! (UI.toast not available)');
-        }
-    });
-
-    // Wire API test button
-    document.getElementById('helloApi').addEventListener('click', function() {
-        if (typeof API === 'undefined' || !API._get) {
-            toast('API module not available', 'error');
-            return;
-        }
-        API._get('/api/v1/surfaces').then(function(resp) {
-            toast('API returned ' + (resp.surfaces || []).length + ' registered surfaces', 'info');
-        }).catch(function(e) {
-            toast('API error: ' + e.message, 'error');
-        });
-    });
-
-    function toast(msg, type) {
-        if (typeof UI !== 'undefined' && UI.toast) UI.toast(msg, type);
-        else alert(msg);
-    }
-
-    function card(title, value, detail, color) {
-        var style = color ? ' style="color:' + color + ';"' : '';
-        return '<div class="ext-hello-dashboard-card">' +
-            '<div class="ext-hello-dashboard-card-title">' + esc(title) + '</div>' +
-            '<div class="ext-hello-dashboard-card-value"' + style + '>' + value + '</div>' +
-            '<div class="ext-hello-dashboard-card-detail">' + esc(detail) + '</div>' +
-        '</div>';
-    }
-
-    function esc(s) {
-        var el = document.createElement('span');
-        el.textContent = s;
-        return el.innerHTML;
-    }
-})();

packages/hello-dashboard/manifest.json

@@ -1,13 +0,0 @@
-{
-  "id": "hello-dashboard",
-  "icon": "👋",
-  "type": "surface",
-  "title": "Hello Dashboard",
-  "route": "/s/hello-dashboard",
-  "auth": "authenticated",
-  "layout": "single",
-  "components": [],
-  "hooks": ["surface"],
-  "version": "0.1.0",
-  "description": "Sample extension surface — verifies the /s/:slug pipeline works end-to-end."
-}

packages/icd-test-runner/css/main.css

@@ -1,38 +0,0 @@
-/* ICD Test Runner — Surface Styles */
-
-.ext-icd-test-runner-root {
-  font-family: var(--font, 'DM Sans', sans-serif);
-}
-
-.ext-icd-test-runner-root h1 {
-  font-family: var(--font, 'DM Sans', sans-serif);
-  letter-spacing: -0.3px;
-}
-
-.ext-icd-test-runner-root table {
-  font-variant-numeric: tabular-nums;
-}
-
-.ext-icd-test-runner-root table td,
-.ext-icd-test-runner-root table th {
-  border-color: var(--border);
-}
-
-.ext-icd-test-runner-root table tbody tr:last-child {
-  border-bottom: none;
-}
-
-.ext-icd-test-runner-root table tbody tr:hover {
-  background: var(--bg-hover) !important;
-}
-
-/* Buttons — uses kernel sw-btn system, minor overrides for weight */
-.ext-icd-test-runner-root .sw-btn {
-  font-weight: 600;
-}
-
-/* Status dot animation for running state */
-@keyframes ext-icd-test-runner-pulse-dot {
-  0%, 100% { opacity: 1; }
-  50% { opacity: 0.4; }
-}

packages/icd-test-runner/js/crud/channels.js

@@ -1,517 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Channels
- * Channel lifecycle, DMs, folders, participants, model roster,
- * KB linking, files, messages, typing, mark-read, user search.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.channels = async function (testTag) {
-
-    // ── Channels CRUD ──
-    var channelId = null;
-    await T.test('crud', 'channels', 'POST /channels (create)', async function () {
-      var d = await T.apiPost('/channels', {
-        title: testTag + '-channel',
-        type: 'direct',
-        description: 'ICD integration test channel',
-        tags: ['icd-test']
-      });
-      T.assertShape(d, T.S.channelFull, 'created channel');
-      T.assert(d.type === 'direct', 'type should be direct');
-      T.assert(d.is_archived === false, 'should not be archived');
-      channelId = d.id;
-      T.registerCleanup(function () { if (channelId) return T.safeDelete('/channels/' + channelId); });
-    });
-
-    if (channelId) {
-      await T.test('crud', 'channels', 'GET /channels/:id (read)', async function () {
-        var d = await T.apiGet('/channels/' + channelId);
-        T.assertShape(d, T.S.channelFull, 'channel');
-        T.assert(d.id === channelId, 'id mismatch');
-        T.assert(d.title.indexOf(testTag) !== -1, 'title mismatch');
-      });
-
-      await T.test('crud', 'channels', 'PUT /channels/:id (update title+topic+ai_mode)', async function () {
-        var d = await T.apiPut('/channels/' + channelId, {
-          title: testTag + '-updated',
-          topic: 'ICD test topic',
-          ai_mode: 'mention_only'
-        });
-        T.assert(d.title === testTag + '-updated', 'title not updated');
-        T.assert(d.topic === 'ICD test topic', 'topic not set');
-        T.assert(d.ai_mode === 'mention_only', 'ai_mode not set');
-      });
-
-      await T.test('crud', 'channels', 'PUT /channels/:id (restore ai_mode)', async function () {
-        var d = await T.apiPut('/channels/' + channelId, { ai_mode: 'auto' });
-        T.assert(d.ai_mode === 'auto', 'ai_mode not restored');
-      });
-
-      // ── Channel List Query Filters ──
-      await T.test('crud', 'channels', 'GET /channels?type=direct', async function () {
-        var d = await T.apiGet('/channels?type=direct&per_page=5');
-        var arr = d.data || [];
-        T.assert(Array.isArray(arr), 'expected data array');
-        arr.forEach(function (ch) { T.assert(ch.type === 'direct', 'type filter leaked: ' + ch.type); });
-      });
-
-      await T.test('crud', 'channels', 'GET /channels?search=...', async function () {
-        var d = await T.apiGet('/channels?search=' + encodeURIComponent(testTag) + '&per_page=5');
-        var arr = d.data || [];
-        T.assert(Array.isArray(arr), 'expected data array');
-        T.assert(arr.length >= 1, 'search should find our channel');
-      });
-
-      await T.test('crud', 'channels', 'GET /channels?archived=true (empty)', async function () {
-        var d = await T.apiGet('/channels?archived=true&per_page=5');
-        var arr = d.data || [];
-        T.assert(Array.isArray(arr), 'expected data array');
-        // Our channel is not archived, so it shouldn't appear here
-      });
-
-      // ── Message Tree ──
-      await T.test('crud', 'channels', 'GET /channels/:id/path (empty)', async function () {
-        var d = await T.apiGet('/channels/' + channelId + '/path');
-        T.assertHasKey(d, 'messages', '/path');
-        T.assert(Array.isArray(d.messages), 'messages should be array');
-      });
-
-      // ── Participants ──
-      await T.test('crud', 'channels', 'GET /channels/:id/participants (auto owner)', async function () {
-        var d = await T.apiGet('/channels/' + channelId + '/participants');
-        T.assertHasKey(d, 'participants', '/participants');
-        T.assert(Array.isArray(d.participants), 'participants should be array');
-        T.assert(d.participants.length >= 1, 'should have at least owner participant');
-        if (d.participants.length > 0) {
-          T.assertShape(d.participants[0], T.S.participant, 'participant[0]');
-          T.assert(d.participants[0].role === 'owner', 'first participant should be owner');
-        }
-      });
-
-      // ── Participant CRUD (add fixture user, update role, remove) ──
-      var addedParticipantId = null;
-      var fixtureUser = T.getFixtureUser ? T.getFixtureUser('-user') : null;
-      if (fixtureUser && fixtureUser.id) {
-        await T.test('crud', 'channels', 'POST /channels/:id/participants (add user)', async function () {
-          var d = await T.apiPost('/channels/' + channelId + '/participants', {
-            participant_type: 'user',
-            participant_id: fixtureUser.id,
-            role: 'member'
-          });
-          // Response varies — may be participant object or list
-          var p = d.participant || d;
-          T.assert(p.id || p.participants, 'expected participant id or list');
-          if (p.id) addedParticipantId = p.id;
-          // Verify by re-listing
-          var list = await T.apiGet('/channels/' + channelId + '/participants');
-          var found = list.participants.find(function (pp) { return pp.participant_id === fixtureUser.id; });
-          T.assert(found, 'added user not found in participant list');
-          if (!addedParticipantId && found) addedParticipantId = found.id;
-        });
-
-        if (addedParticipantId) {
-          await T.test('crud', 'channels', 'PATCH /channels/:id/participants/:id (update role)', async function () {
-            var d = await T.apiPatch('/channels/' + channelId + '/participants/' + addedParticipantId, {
-              role: 'observer'
-            });
-            T.assert(typeof d === 'object', 'expected response');
-            // Verify
-            var list = await T.apiGet('/channels/' + channelId + '/participants');
-            var found = list.participants.find(function (pp) { return pp.id === addedParticipantId; });
-            T.assert(found && found.role === 'observer', 'role not updated to observer');
-          });
-
-          // ── Multi-user access: participant can GET channel (CS1 fix) ──
-          await T.test('crud', 'channels', 'GET /channels/:id (as participant, CS1 fix)', async function () {
-            var d = await T.authFetch(fixtureUser.token, 'GET', '/channels/' + channelId);
-            T.assert(d._status === 200, 'participant should see channel, got ' + d._status);
-            T.assert(d.id === channelId, 'id mismatch');
-          });
-
-          await T.test('crud', 'channels', 'GET /channels/:id/path (as participant)', async function () {
-            var d = await T.authFetch(fixtureUser.token, 'GET', '/channels/' + channelId + '/path');
-            T.assert(d._status === 200, 'participant should see path, got ' + d._status);
-            T.assertHasKey(d, 'messages', 'participant path');
-          });
-
-          await T.test('crud', 'channels', 'DELETE /channels/:id/participants/:id (remove)', async function () {
-            await T.apiDelete('/channels/' + channelId + '/participants/' + addedParticipantId);
-            var list = await T.apiGet('/channels/' + channelId + '/participants');
-            var found = list.participants.find(function (pp) { return pp.id === addedParticipantId; });
-            T.assert(!found, 'participant should be removed');
-            addedParticipantId = null;
-          });
-        }
-      }
-
-      // ── Model Roster CRUD ──
-      await T.test('crud', 'channels', 'GET /channels/:id/models (roster)', async function () {
-        var d = await T.apiGet('/channels/' + channelId + '/models');
-        T.assertHasKey(d, 'models', '/channel-models');
-        T.assert(Array.isArray(d.models), 'models should be array');
-      });
-
-      var rosterModelId = null;
-      await T.test('crud', 'channels', 'POST /channels/:id/models (add)', async function () {
-        var d = await T.apiPost('/channels/' + channelId + '/models', {
-          model_id: 'icd-test-model',
-          display_name: 'ICD Test Model',
-          provider_config_id: null
-        });
-        T.assertHasKey(d, 'models', '/models add');
-        T.assert(Array.isArray(d.models), 'models should be array');
-        var added = d.models.find(function (m) { return m.model_id === 'icd-test-model'; });
-        T.assert(added, 'added model not found in roster');
-        rosterModelId = added ? added.id : null;
-      });
-
-      if (rosterModelId) {
-        await T.test('crud', 'channels', 'PATCH /channels/:id/models/:id (update)', async function () {
-          var d = await T.apiPatch('/channels/' + channelId + '/models/' + rosterModelId, {
-            display_name: 'ICD Updated Model'
-          });
-          T.assertHasKey(d, 'models', '/models update');
-          var updated = d.models.find(function (m) { return m.id === rosterModelId; });
-          T.assert(updated && updated.display_name === 'ICD Updated Model', 'display_name not updated');
-        });
-
-        await T.test('crud', 'channels', 'DELETE /channels/:id/models/:id (remove)', async function () {
-          var d = await T.apiDelete('/channels/' + channelId + '/models/' + rosterModelId);
-          T.assertHasKey(d, 'models', '/models delete');
-          var models = d.models || [];
-          var found = models.find(function (m) { return m.id === rosterModelId; });
-          T.assert(!found, 'deleted model still in roster');
-          rosterModelId = null;
-        });
-      }
-
-      // ── KB linking ──
-      await T.test('crud', 'channels', 'GET /channels/:id/knowledge-bases', async function () {
-        var d = await T.apiGet('/channels/' + channelId + '/knowledge-bases');
-        T.assertHasKey(d, 'data', '/channel-kbs');
-      });
-
-      // ── Files ──
-      await T.test('crud', 'channels', 'GET /channels/:id/files', async function () {
-        var d = await T.apiGet('/channels/' + channelId + '/files');
-        T.assertHasKey(d, 'files', '/channel-files');
-        T.assert(Array.isArray(d.files), 'files should be array');
-      });
-
-      // ── File Upload/Download Lifecycle (conditional on storage) ──
-      var storageOk = false;
-      if (T.user.role === 'admin') {
-        try {
-          var ss = await T.apiGet('/admin/storage/status');
-          storageOk = ss && ss.configured === true;
-        } catch (e) { /* not admin or storage disabled */ }
-      }
-
-      var uploadedFileId = null;
-      if (storageOk) {
-        await T.test('crud', 'channels', 'POST /channels/:id/files (upload)', async function () {
-          var blob = new Blob(['ICD test file content'], { type: 'text/plain' });
-          var d = await T.apiUpload('/channels/' + channelId + '/files', blob, 'icd-test.txt');
-          T.assert(d.id, 'expected file id');
-          T.assert(d.filename === 'icd-test.txt', 'filename mismatch');
-          T.assert(d.origin === 'user_upload', 'origin should be user_upload');
-          T.assert(d.content_type === 'text/plain', 'content_type mismatch');
-          uploadedFileId = d.id;
-          T.registerCleanup(function () { if (uploadedFileId) return T.safeDelete('/files/' + uploadedFileId); });
-        });
-
-        if (uploadedFileId) {
-          await T.test('crud', 'channels', 'GET /files/:id (metadata)', async function () {
-            var d = await T.apiGet('/files/' + uploadedFileId);
-            T.assertShape(d, T.S.file, 'file metadata');
-            T.assert(d.id === uploadedFileId, 'id mismatch');
-            T.assert(d.channel_id === channelId, 'channel_id mismatch');
-          });
-
-          await T.test('crud', 'channels', 'GET /files/:id/download', async function () {
-            var token = await T.getAuthToken();
-            var resp = await fetch(T.base + '/api/v1/files/' + uploadedFileId + '/download', {
-              headers: { 'Authorization': 'Bearer ' + token },
-              credentials: 'same-origin'
-            });
-            T.assert(resp.ok, 'download should succeed, got ' + resp.status);
-            var text = await resp.text();
-            T.assert(text === 'ICD test file content', 'download content mismatch');
-          });
-
-          await T.test('crud', 'channels', 'DELETE /files/:id', async function () {
-            var delId = uploadedFileId;
-            await T.safeDelete('/files/' + delId);
-            uploadedFileId = null;
-            // Verify gone
-            try {
-              await T.apiGet('/files/' + delId);
-              T.assert(false, 'file should be deleted');
-            } catch (e) {
-              T.assert(e.message.indexOf('404') !== -1 || e.message.indexOf('not found') !== -1, 'expected 404');
-            }
-          });
-        }
-      }
-
-      // ── Message Create + Edit + Cursor + Siblings ──
-      var msgId = null;
-      await T.test('crud', 'channels', 'POST /channels/:id/messages (create)', async function () {
-        var d = await T.apiPost('/channels/' + channelId + '/messages', {
-          role: 'user',
-          content: 'ICD integration test message'
-        });
-        T.assertShape(d, T.S.message, 'message');
-        msgId = d.id;
-      });
-
-      if (msgId) {
-        await T.test('crud', 'channels', 'GET /channels/:id/messages (all)', async function () {
-          var d = await T.apiGet('/channels/' + channelId + '/messages');
-          var arr = d.messages || d.data;
-          T.assert(Array.isArray(arr), 'expected array');
-          T.assert(arr.length >= 1, 'expected at least 1 message');
-        });
-
-        await T.test('crud', 'channels', 'GET /channels/:id/messages/:id/siblings', async function () {
-          var d = await T.apiGet('/channels/' + channelId + '/messages/' + msgId + '/siblings');
-          T.assertHasKey(d, 'siblings', '/siblings');
-          T.assert(Array.isArray(d.siblings), 'siblings should be array');
-        });
-
-        // Edit creates sibling
-        var editedMsgId = null;
-        await T.test('crud', 'channels', 'POST /channels/:id/messages/:id/edit', async function () {
-          var d = await T.apiPost('/channels/' + channelId + '/messages/' + msgId + '/edit', {
-            content: 'ICD edited message content'
-          });
-          T.assertShape(d, T.S.message, 'edited message');
-          T.assert(d.id !== msgId, 'edit should create new message id');
-          T.assert(d.content === 'ICD edited message content', 'content mismatch');
-          editedMsgId = d.id;
-        });
-
-        if (editedMsgId) {
-          await T.test('crud', 'channels', 'GET siblings (after edit, expect 2)', async function () {
-            var d = await T.apiGet('/channels/' + channelId + '/messages/' + msgId + '/siblings');
-            T.assert(d.siblings.length >= 2, 'edit should create sibling, got ' + d.siblings.length);
-          });
-
-          await T.test('crud', 'channels', 'PUT /channels/:id/cursor (switch branch)', async function () {
-            var d = await T.apiPut('/channels/' + channelId + '/cursor', {
-              active_leaf_id: msgId
-            });
-            T.assertHasKey(d, 'messages', '/cursor');
-            T.assert(Array.isArray(d.messages), 'cursor response should have messages array');
-          });
-        }
-
-        await T.test('crud', 'channels', 'GET /messages/:id/files', async function () {
-          var d = await T.apiGet('/messages/' + msgId + '/files');
-          T.assertHasKey(d, 'files', '/message-files');
-          T.assert(Array.isArray(d.files), 'files should be array');
-        });
-
-        await T.test('crud', 'channels', 'GET /channels/:id/path (after messages)', async function () {
-          var d = await T.apiGet('/channels/' + channelId + '/path');
-          T.assertHasKey(d, 'messages', '/path');
-          T.assert(d.messages.length >= 1, 'path should have messages');
-        });
-
-        await T.test('crud', 'channels', 'POST /channels/:id/generate-title', async function () {
-          try {
-            var d = await T.apiPost('/channels/' + channelId + '/generate-title', {});
-            T.assert(typeof d === 'object', 'expected object');
-          } catch (e) {
-            if (e.message && (e.message.indexOf('400') !== -1 || e.message.indexOf('502') !== -1 || e.message.indexOf('model') !== -1))
-              return;
-            throw e;
-          }
-        });
-      }
-
-      // ── Typing indicator ──
-      await T.test('crud', 'channels', 'POST /channels/:id/typing', async function () {
-        var d = await T.apiPost('/channels/' + channelId + '/typing', {});
-        T.assert(d.ok === true, 'expected { ok: true }');
-      });
-
-      // ── Mark Read ──
-      await T.test('crud', 'channels', 'POST /channels/:id/mark-read', async function () {
-        var d = await T.apiPost('/channels/' + channelId + '/mark-read', {});
-        T.assert(typeof d === 'object', 'expected object');
-      });
-
-      // ── Delete ──
-      await T.test('crud', 'channels', 'DELETE /channels/:id', async function () {
-        await T.safeDelete('/channels/' + channelId);
-        channelId = null;
-      });
-    }
-
-    // ── DM Creation + Dedup ──
-    var dmChannelId = null;
-    var dmUser = T.getFixtureUser ? T.getFixtureUser('-user') : null;
-    if (dmUser && dmUser.id) {
-      await T.test('crud', 'channels', 'POST /channels (type=dm, create)', async function () {
-        var d = await T.apiPost('/channels', {
-          title: testTag + '-dm',
-          type: 'dm',
-          participants: [dmUser.id]
-        });
-        T.assert(d.id, 'DM channel should have id');
-        T.assert(d.type === 'dm', 'type should be dm');
-        dmChannelId = d.id;
-        T.registerCleanup(function () { if (dmChannelId) return T.safeDelete('/channels/' + dmChannelId); });
-      });
-
-      if (dmChannelId) {
-        await T.test('crud', 'channels', 'POST /channels (dm dedup → 200)', async function () {
-          var d = await T.apiPost('/channels', {
-            title: testTag + '-dm-dup',
-            type: 'dm',
-            participants: [dmUser.id]
-          });
-          T.assert(d.id === dmChannelId, 'dedup should return same channel id');
-        });
-
-        await T.test('crud', 'channels', 'GET /channels?types=dm (type filter)', async function () {
-          var d = await T.apiGet('/channels?types=dm&per_page=10');
-          var arr = d.data || [];
-          T.assert(Array.isArray(arr), 'expected data array');
-          var found = arr.find(function (ch) { return ch.id === dmChannelId; });
-          T.assert(found, 'DM channel should appear in dm type filter');
-        });
-
-        await T.test('crud', 'channels', 'DELETE /channels/:id (dm cleanup)', async function () {
-          await T.safeDelete('/channels/' + dmChannelId);
-          dmChannelId = null;
-        });
-      }
-    }
-
-    // ── Channel Types (group, channel) ──
-    var groupChId = null;
-    await T.test('crud', 'channels', 'POST /channels (type=group)', async function () {
-      var d = await T.apiPost('/channels', {
-        title: testTag + '-group',
-        type: 'group',
-        description: 'ICD group test'
-      });
-      T.assertShape(d, T.S.channelFull, 'group channel');
-      T.assert(d.type === 'group', 'type should be group, got: ' + d.type);
-      groupChId = d.id;
-      T.registerCleanup(function () { if (groupChId) return T.safeDelete('/channels/' + groupChId); });
-    });
-
-    var teamChId = null;
-    await T.test('crud', 'channels', 'POST /channels (type=channel)', async function () {
-      var d = await T.apiPost('/channels', {
-        title: testTag + '-team-channel',
-        type: 'channel',
-        description: 'ICD channel test'
-      });
-      T.assertShape(d, T.S.channelFull, 'team channel');
-      T.assert(d.type === 'channel', 'type should be channel, got: ' + d.type);
-      teamChId = d.id;
-      T.registerCleanup(function () { if (teamChId) return T.safeDelete('/channels/' + teamChId); });
-    });
-
-    // ── Multi-type filter ──
-    await T.test('crud', 'channels', 'GET /channels?types=group,channel (multi)', async function () {
-      var d = await T.apiGet('/channels?types=group,channel&per_page=50');
-      var arr = d.data || [];
-      T.assert(Array.isArray(arr), 'expected data array');
-      arr.forEach(function (ch) {
-        T.assert(ch.type === 'group' || ch.type === 'channel',
-          'multi-type filter leaked: ' + ch.type);
-      });
-    });
-
-    await T.test('crud', 'channels', 'GET /channels?types=direct,dm,group,channel (all)', async function () {
-      var d = await T.apiGet('/channels?types=direct,dm,group,channel&per_page=50');
-      var arr = d.data || [];
-      T.assert(Array.isArray(arr), 'expected data array');
-      var types = new Set(arr.map(function (ch) { return ch.type; }));
-      T.assert(types.size <= 4, 'should only contain known types');
-    });
-
-    // Cleanup channel types
-    if (groupChId) {
-      await T.test('crud', 'channels', 'DELETE /channels/:id (group cleanup)', async function () {
-        await T.safeDelete('/channels/' + groupChId);
-        groupChId = null;
-      });
-    }
-    if (teamChId) {
-      await T.test('crud', 'channels', 'DELETE /channels/:id (channel cleanup)', async function () {
-        await T.safeDelete('/channels/' + teamChId);
-        teamChId = null;
-      });
-    }
-
-    // ── Folders CRUD + Channel Assignment ──
-    var folderId = null;
-    await T.test('crud', 'channels', 'POST /folders (create)', async function () {
-      var d = await T.apiPost('/folders', { name: testTag + '-folder', sort_order: 0 });
-      var folder = d.folder || d.data || d;
-      T.assert(folder.id || folder.ID, 'folder response missing id, got keys: ' + Object.keys(folder).join(', '));
-      folderId = folder.id || folder.ID;
-      T.registerCleanup(function () { if (folderId) return T.safeDelete('/folders/' + folderId); });
-    });
-
-    if (folderId) {
-      await T.test('crud', 'channels', 'PUT /folders/:id (update)', async function () {
-        var d = await T.apiPut('/folders/' + folderId, { name: testTag + '-folder-updated', sort_order: 1 });
-        T.assert(typeof d === 'object', 'expected object');
-      });
-
-      // Create a channel, assign to folder, verify filter works
-      var folderCh = null;
-      await T.test('crud', 'channels', 'PUT /channels/:id { folder_id } (assign)', async function () {
-        var ch = await T.apiPost('/channels', { title: testTag + '-folder-test', type: 'direct' });
-        folderCh = ch.id;
-        T.registerCleanup(function () { if (folderCh) return T.safeDelete('/channels/' + folderCh); });
-        var d = await T.apiPut('/channels/' + folderCh, { folder_id: folderId });
-        T.assert(d.folder_id === folderId, 'folder_id should be set, got: ' + d.folder_id);
-      });
-
-      if (folderCh) {
-        await T.test('crud', 'channels', 'GET /channels?folder_id=... (filter)', async function () {
-          var d = await T.apiGet('/channels?folder_id=' + folderId + '&per_page=10');
-          var arr = d.data || [];
-          T.assert(Array.isArray(arr), 'expected data array');
-          var found = arr.find(function (ch) { return ch.id === folderCh; });
-          T.assert(found, 'channel should appear in folder_id filter');
-        });
-
-        await T.test('crud', 'channels', 'PUT /channels/:id { folder_id: "" } (unbind)', async function () {
-          var d = await T.apiPut('/channels/' + folderCh, { folder_id: '' });
-          T.assert(!d.folder_id, 'folder_id should be cleared');
-        });
-
-        await T.test('crud', 'channels', 'DELETE /channels/:id (folder test cleanup)', async function () {
-          await T.safeDelete('/channels/' + folderCh);
-          folderCh = null;
-        });
-      }
-
-      await T.test('crud', 'channels', 'DELETE /folders/:id', async function () {
-        await T.safeDelete('/folders/' + folderId);
-        folderId = null;
-      });
-    }
-
-    // ── User Search ──
-    await T.test('crud', 'channels', 'GET /users/search', async function () {
-      var d = await T.apiGet('/users/search?q=' + encodeURIComponent(T.user.username.substring(0, 3)));
-      T.assertHasKey(d, 'users', '/users/search');
-      T.assert(Array.isArray(d.users), 'users should be array');
-    });
-
-  };
-})();

packages/icd-test-runner/js/crud/knowledge.js

@@ -1,238 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Knowledge Bases
- * KB lifecycle — create, read, update, documents, search, discoverable,
- * channel binding, scope auth, cross-user isolation, delete.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.knowledge = async function (testTag) {
-
-    // ── KB CRUD ──
-    var kbId = null;
-    await T.test('crud', 'knowledge', 'POST /knowledge-bases (create)', async function () {
-      var d = await T.apiPost('/knowledge-bases', {
-        name: testTag + '-kb',
-        description: 'ICD integration test KB',
-        scope: 'personal'
-      });
-      T.assertShape(d, T.S.kb, 'kb');
-      T.assert(d.scope === 'personal', 'scope should be personal');
-      T.assert(d.status === 'active', 'status should be active');
-      T.assert(d.document_count === 0, 'new KB should have 0 documents');
-      T.assert(d.chunk_count === 0, 'new KB should have 0 chunks');
-      kbId = d.id;
-      T.registerCleanup(function () { if (kbId) return T.safeDelete('/knowledge-bases/' + kbId); });
-    });
-
-    if (!kbId) return;
-
-    await T.test('crud', 'knowledge', 'GET /knowledge-bases/:id (read)', async function () {
-      var d = await T.apiGet('/knowledge-bases/' + kbId);
-      T.assertShape(d, T.S.kb, 'kb');
-      T.assert(d.id === kbId, 'id mismatch');
-    });
-
-    await T.test('crud', 'knowledge', 'PUT /knowledge-bases/:id (update)', async function () {
-      var newName = testTag + '-kb-updated';
-      var d = await T.apiPut('/knowledge-bases/' + kbId, { name: newName });
-      T.assertShape(d, T.S.kb, 'kb-update');
-      T.assert(d.name === newName, 'name should have updated, got: ' + d.name);
-    });
-
-    await T.test('crud', 'knowledge', 'PUT /knowledge-bases/:id (empty body → 400)', async function () {
-      var token = await T.getAuthToken();
-      var resp = await T.authFetch(token, 'PUT', '/knowledge-bases/' + kbId, {});
-      T.assert(resp._status === 400, 'expected 400 for empty update, got ' + resp._status);
-    });
-
-    // ── Documents ──
-    await T.test('crud', 'knowledge', 'GET /knowledge-bases/:id/documents (empty)', async function () {
-      var d = await T.apiGet('/knowledge-bases/' + kbId + '/documents');
-      T.assertHasKey(d, 'data', '/kb-documents');
-      T.assert(Array.isArray(d.data), 'data should be array');
-      T.assert(d.data.length === 0, 'new KB should have 0 documents');
-    });
-
-    // Document upload → status → delete (requires object store)
-    var docId = null;
-    var storageOk = false;
-    try {
-      var ss = await T.apiGet('/admin/storage/status');
-      storageOk = ss && ss.configured === true;
-    } catch (e) { /* non-admin or storage not configured */ }
-
-    if (storageOk) {
-      await T.test('crud', 'knowledge', 'POST /knowledge-bases/:id/documents (upload)', async function () {
-        var blob = new Blob(['# ICD Test Document\n\nThis is test content for KB ingestion.'], { type: 'text/markdown' });
-        try {
-          var d = await T.apiUpload('/knowledge-bases/' + kbId + '/documents', blob, 'icd-test.md');
-          T.assert(d.id, 'expected document id');
-          T.assert(d.filename === 'icd-test.md', 'filename mismatch: ' + d.filename);
-          T.assert(d.status === 'pending', 'initial status should be pending, got: ' + d.status);
-          T.assert(d.kb_id === kbId, 'kb_id mismatch');
-          docId = d.id;
-        } catch (e) {
-          // 412 = no embedding model role configured (infrastructure, not contract bug)
-          if (e.message && (e.message.indexOf('412') !== -1 || e.message.indexOf('embedding') !== -1)) return;
-          throw e;
-        }
-      });
-
-      if (docId) {
-        await T.test('crud', 'knowledge', 'GET /knowledge-bases/:id/documents/:docId/status', async function () {
-          var d = await T.apiGet('/knowledge-bases/' + kbId + '/documents/' + docId + '/status');
-          T.assert(d.id === docId, 'doc id mismatch');
-          T.assert(typeof d.status === 'string', 'status should be string');
-          T.assert(typeof d.filename === 'string', 'filename should be string');
-        });
-
-        await T.test('crud', 'knowledge', 'GET /knowledge-bases/:id/documents (has doc)', async function () {
-          var d = await T.apiGet('/knowledge-bases/' + kbId + '/documents');
-          T.assertHasKey(d, 'data', '/kb-documents');
-          T.assert(d.data.length >= 1, 'should have at least 1 document');
-        });
-
-        await T.test('crud', 'knowledge', 'DELETE /knowledge-bases/:id/documents/:docId', async function () {
-          var token = await T.getAuthToken();
-          var resp = await fetch(T.base + '/api/v1/knowledge-bases/' + kbId + '/documents/' + docId, {
-            method: 'DELETE',
-            headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' },
-            credentials: 'same-origin'
-          });
-          T.assert(resp.ok, 'delete doc should succeed, got ' + resp.status);
-          var body = await resp.json();
-          T.assert(body.deleted === true, 'deleted should be true');
-          docId = null;
-        });
-
-        await T.test('crud', 'knowledge', 'GET /documents/:docId/status (deleted → 404)', async function () {
-          var token = await T.getAuthToken();
-          var resp = await T.authFetch(token, 'GET',
-            '/knowledge-bases/' + kbId + '/documents/00000000-0000-0000-0000-000000000099/status');
-          T.assert(resp._status === 404, 'expected 404 for deleted doc, got ' + resp._status);
-        });
-      }
-    }
-
-    // ── Search ──
-    await T.test('crud', 'knowledge', 'POST /knowledge-bases/:id/search', async function () {
-      try {
-        var d = await T.apiPost('/knowledge-bases/' + kbId + '/search', {
-          query: 'test', limit: 5
-        });
-        // Response envelope uses "data" key (not "results")
-        T.assertHasKey(d, 'data', '/kb-search');
-        T.assertHasKey(d, 'query', '/kb-search');
-        T.assertHasKey(d, 'total', '/kb-search');
-        T.assert(Array.isArray(d.data), 'data should be array');
-      } catch (e) {
-        // "failed to embed query" = no embedding model configured (infrastructure, not contract bug)
-        if (e.message && e.message.indexOf('embed') !== -1) return;
-        throw e;
-      }
-    });
-
-    // ── Rebuild (no documents = 400, or no ingester = 503) ──
-    await T.test('crud', 'knowledge', 'POST /knowledge-bases/:id/rebuild (empty → 400|503)', async function () {
-      var token = await T.getAuthToken();
-      var resp = await T.authFetch(token, 'POST', '/knowledge-bases/' + kbId + '/rebuild', {});
-      T.assert(resp._status === 400 || resp._status === 503,
-        'expected 400 (no docs) or 503 (no ingester), got ' + resp._status);
-    });
-
-    // ── Channel KB Binding ──
-    var bindChannelId = null;
-    await T.test('crud', 'knowledge', 'PUT /channels/:id/knowledge-bases (bind)', async function () {
-      // Create a temp channel
-      var ch = await T.apiPost('/channels', { title: testTag + '-kb-bind' });
-      bindChannelId = ch.id;
-      T.registerCleanup(function () { if (bindChannelId) return T.safeDelete('/channels/' + bindChannelId); });
-
-      // Bind KB
-      var d = await T.apiPut('/channels/' + bindChannelId + '/knowledge-bases', {
-        kb_ids: [kbId]
-      });
-      T.assertHasKey(d, 'data', '/channel-kb-set');
-    });
-
-    if (bindChannelId) {
-      await T.test('crud', 'knowledge', 'GET /channels/:id/knowledge-bases (verify)', async function () {
-        var d = await T.apiGet('/channels/' + bindChannelId + '/knowledge-bases');
-        T.assertHasKey(d, 'data', '/channel-kbs');
-        T.assert(d.data.length === 1, 'should have 1 linked KB, got ' + d.data.length);
-        var linked = d.data[0];
-        T.assert(linked.kb_id === kbId, 'linked kb_id mismatch');
-        T.assert(typeof linked.kb_name === 'string', 'kb_name should be string');
-        T.assert(typeof linked.enabled === 'boolean', 'enabled should be boolean');
-      });
-
-      await T.test('crud', 'knowledge', 'PUT /channels/:id/knowledge-bases (unbind)', async function () {
-        var d = await T.apiPut('/channels/' + bindChannelId + '/knowledge-bases', { kb_ids: [] });
-        T.assertHasKey(d, 'data', '/channel-kb-unbind');
-        T.assert(d.data.length === 0, 'should have 0 linked KBs after unbind');
-      });
-    }
-
-    // ── Discoverable ──
-    await T.test('crud', 'knowledge', 'PUT /knowledge-bases/:id/discoverable (toggle)', async function () {
-      var d = await T.apiPut('/knowledge-bases/' + kbId + '/discoverable', { discoverable: false });
-      T.assert(d.status === 'ok', 'expected status ok');
-
-      // Toggle back
-      d = await T.apiPut('/knowledge-bases/' + kbId + '/discoverable', { discoverable: true });
-      T.assert(d.status === 'ok', 'expected status ok on re-enable');
-    });
-
-    // ── Cross-user isolation (requires fixtures) ──
-    var fixtureUser = T.getFixtureUser ? T.getFixtureUser('-user') : null;
-    if (fixtureUser && fixtureUser.token) {
-      await T.test('crud', 'knowledge', 'isolation: other user cannot access personal KB', async function () {
-        var resp = await T.authFetch(fixtureUser.token, 'GET', '/knowledge-bases/' + kbId);
-        // Personal KB of admin should be hidden (404) from other user
-        T.assert(resp._status === 404, 'expected 404 for other user, got ' + resp._status);
-      });
-
-      await T.test('crud', 'knowledge', 'isolation: other user cannot delete personal KB', async function () {
-        var resp = await T.authFetch(fixtureUser.token, 'DELETE', '/knowledge-bases/' + kbId);
-        T.assert(resp._status === 404, 'expected 404 for delete by other user, got ' + resp._status);
-      });
-
-      await T.test('crud', 'knowledge', 'scope: non-admin global create → 403', async function () {
-        var resp = await T.authFetch(fixtureUser.token, 'POST', '/knowledge-bases', {
-          name: testTag + '-sneaky-global', scope: 'global'
-        });
-        T.assert(resp._status === 403, 'expected 403 for non-admin global KB, got ' + resp._status);
-      });
-
-      await T.test('crud', 'knowledge', 'discoverable: other user cannot toggle', async function () {
-        var resp = await T.authFetch(fixtureUser.token, 'PUT',
-          '/knowledge-bases/' + kbId + '/discoverable', { discoverable: false });
-        T.assert(resp._status === 404 || resp._status === 403,
-          'expected 403/404 for non-owner toggle, got ' + resp._status);
-      });
-    }
-
-    // ── Delete ──
-    await T.test('crud', 'knowledge', 'DELETE /knowledge-bases/:id', async function () {
-      await T.safeDelete('/knowledge-bases/' + kbId);
-      kbId = null;
-    });
-
-    await T.test('crud', 'knowledge', 'GET /knowledge-bases/:id (deleted → 404)', async function () {
-      var token = await T.getAuthToken();
-      var resp = await T.authFetch(token, 'GET', '/knowledge-bases/00000000-0000-0000-0000-000000000099');
-      T.assert(resp._status === 404, 'expected 404 for nonexistent KB, got ' + resp._status);
-    });
-
-    // Cleanup temp channel
-    if (bindChannelId) {
-      try { await T.safeDelete('/channels/' + bindChannelId); } catch (e) { /* ok */ }
-      bindChannelId = null;
-    }
-
-  };
-})();

packages/icd-test-runner/js/crud/memory.js

@@ -1,92 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Memory
- * Memory listing, count shape, error paths, admin endpoints.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.memory = async function (testTag) {
-
-    // ── Memory CRUD ──
-    // No REST POST for memories (created by AI tools / background extraction).
-    // Test error paths, count shape, and admin endpoints.
-    var fakeMemId = '00000000-0000-0000-0000-000000000000';
-
-    await T.test('crud', 'memory', 'GET /memories (list, envelope shape)', async function () {
-      var d = await T.apiGet('/memories');
-      T.assertHasKey(d, 'data', '/memories');
-      T.assert(Array.isArray(d.data), 'data should be array');
-      // If memories exist, validate shape
-      if (d.data.length > 0) {
-        T.assertShape(d.data[0], T.S.memory, 'memory[0]');
-      }
-    });
-
-    await T.test('crud', 'memory', 'GET /memories?status=pending_review', async function () {
-      var d = await T.apiGet('/memories?status=pending_review');
-      T.assertHasKey(d, 'data', '/memories?status=pending_review');
-      T.assert(Array.isArray(d.data), 'data should be array');
-    });
-
-    await T.test('crud', 'memory', 'GET /memories/count (shape)', async function () {
-      var d = await T.apiGet('/memories/count');
-      T.assertHasKey(d, 'active', '/memories/count');
-      T.assertHasKey(d, 'pending', '/memories/count');
-      T.assert(typeof d.active === 'number', 'active should be number');
-      T.assert(typeof d.pending === 'number', 'pending should be number');
-      T.assert(d.active >= 0, 'active should be >= 0');
-      T.assert(d.pending >= 0, 'pending should be >= 0');
-    });
-
-    await T.test('crud', 'memory', 'PUT /memories/:id (not found → 404)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'PUT', '/memories/' + fakeMemId, { value: 'x' });
-      T.assertStatus(d, 404, 'update non-existent memory');
-    });
-
-    await T.test('crud', 'memory', 'DELETE /memories/:id (not found → 404)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'DELETE', '/memories/' + fakeMemId);
-      T.assertStatus(d, 404, 'delete non-existent memory');
-    });
-
-    await T.test('crud', 'memory', 'POST /memories/:id/approve (not found → 404)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/memories/' + fakeMemId + '/approve');
-      T.assertStatus(d, 404, 'approve non-existent memory');
-    });
-
-    await T.test('crud', 'memory', 'POST /memories/:id/reject (not found → 404)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/memories/' + fakeMemId + '/reject');
-      T.assertStatus(d, 404, 'reject non-existent memory');
-    });
-
-    if (T.user.role === 'admin') {
-      await T.test('crud', 'memory', 'GET /admin/memories/pending (admin)', async function () {
-        var d = await T.apiGet('/admin/memories/pending');
-        T.assertHasKey(d, 'data', '/admin/memories/pending');
-        T.assert(Array.isArray(d.data), 'data should be array');
-        if (d.data.length > 0) {
-          T.assertShape(d.data[0], T.S.memory, 'pending[0]');
-        }
-      });
-
-      await T.test('crud', 'memory', 'POST /admin/memories/bulk-approve (empty ids)', async function () {
-        var d = await T.apiPost('/admin/memories/bulk-approve', { ids: [] });
-        T.assertHasKey(d, 'approved', 'bulk-approve');
-        T.assert(d.approved === 0, 'empty ids should approve 0');
-      });
-
-      await T.test('crud', 'memory', 'POST /admin/memories/bulk-approve (bad body → 400)', async function () {
-        var token = await T.getAuthToken();
-        var d = await T.authFetch(token, 'POST', '/admin/memories/bulk-approve', 'not-json');
-        T.assertStatus(d, 400, 'bad body');
-      });
-    }
-
-  };
-})();

packages/icd-test-runner/js/crud/models.js

@@ -1,116 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Models
- * Model preference lifecycle — hide/unhide, bulk, validation.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.models = async function (testTag) {
-
-    // ── Model Preferences CRUD ──
-    // Depends on provider setup from smoke tier — needs at least one model in /models/enabled
-
-    await T.test('crud', 'models', 'GET /models/preferences (initially empty for test user)', async function () {
-      var d = await T.apiGet('/models/preferences');
-      T.assertHasKey(d, 'data', '/models/preferences');
-      T.assert(Array.isArray(d.data), 'data should be array');
-    });
-
-    // Find a model to use for preference tests
-    var prefModelId = null;
-    var prefConfigId = null;
-    await T.test('crud', 'models', 'GET /models/enabled (pick model for pref test)', async function () {
-      var d = await T.apiGet('/models/enabled');
-      var models = d.data || [];
-      var catalog = models.filter(function (m) { return !m.is_persona && m.provider_config_id; });
-      if (catalog.length === 0) return;  // no catalog models yet — skip pref write tests
-      prefModelId = catalog[0].model_id;
-      prefConfigId = catalog[0].provider_config_id;
-    });
-
-    if (prefModelId && prefConfigId) {
-      await T.test('crud', 'models', 'PUT /models/preferences (hide model)', async function () {
-        var d = await T.apiPut('/models/preferences', {
-          model_id: prefModelId,
-          provider_config_id: prefConfigId,
-          hidden: true
-        });
-        T.assert(d.message === 'preference updated', 'expected success message');
-      });
-
-      await T.test('crud', 'models', 'GET /models/preferences (verify hidden)', async function () {
-        var d = await T.apiGet('/models/preferences');
-        var prefs = d.data || [];
-        var found = prefs.find(function (p) {
-          return p.model_id === prefModelId && p.provider_config_id === prefConfigId;
-        });
-        T.assert(found, 'preference entry should exist after PUT');
-        T.assert(found.hidden === true, 'hidden should be true');
-        T.assertShape(found, T.S.modelPreference, 'preference');
-      });
-
-      await T.test('crud', 'models', 'GET /models/enabled (hidden flag propagated)', async function () {
-        var d = await T.apiGet('/models/enabled');
-        var models = d.data || [];
-        var found = models.find(function (m) {
-          return m.model_id === prefModelId && m.provider_config_id === prefConfigId;
-        });
-        if (found) {
-          T.assert(found.hidden === true, 'model should have hidden=true in /models/enabled');
-        }
-      });
-
-      await T.test('crud', 'models', 'PUT /models/preferences (unhide — upsert)', async function () {
-        var d = await T.apiPut('/models/preferences', {
-          model_id: prefModelId,
-          provider_config_id: prefConfigId,
-          hidden: false
-        });
-        T.assert(d.message === 'preference updated', 'expected success message');
-      });
-
-      await T.test('crud', 'models', 'GET /models/preferences (verify unhidden, no dup)', async function () {
-        var d = await T.apiGet('/models/preferences');
-        var prefs = d.data || [];
-        var matches = prefs.filter(function (p) {
-          return p.model_id === prefModelId && p.provider_config_id === prefConfigId;
-        });
-        T.assert(matches.length === 1, 'upsert should not duplicate: got ' + matches.length);
-        T.assert(matches[0].hidden === false, 'hidden should be false after unhide');
-      });
-
-      await T.test('crud', 'models', 'PUT /models/preferences (missing provider_config_id → 400)', async function () {
-        var token = await T.getAuthToken();
-        var d = await T.authFetch(token, 'PUT', '/models/preferences', { model_id: prefModelId, hidden: true });
-        T.assertStatus(d, 400, 'missing provider_config_id');
-      });
-
-      await T.test('crud', 'models', 'PUT /models/preferences (missing model_id → 400)', async function () {
-        var token = await T.getAuthToken();
-        var d = await T.authFetch(token, 'PUT', '/models/preferences', { provider_config_id: prefConfigId, hidden: true });
-        T.assertStatus(d, 400, 'missing model_id');
-      });
-
-      await T.test('crud', 'models', 'POST /models/preferences/bulk (hide)', async function () {
-        var d = await T.apiPost('/models/preferences/bulk', {
-          entries: [{ model_id: prefModelId, provider_config_id: prefConfigId }],
-          hidden: true
-        });
-        T.assert(d.message === 'preferences updated', 'expected bulk success message');
-        T.assert(d.count === 1, 'count should be 1');
-      });
-
-      await T.test('crud', 'models', 'POST /models/preferences/bulk (unhide cleanup)', async function () {
-        var d = await T.apiPost('/models/preferences/bulk', {
-          entries: [{ model_id: prefModelId, provider_config_id: prefConfigId }],
-          hidden: false
-        });
-        T.assert(d.message === 'preferences updated', 'expected bulk success message');
-      });
-    }
-
-  };
-})();

packages/icd-test-runner/js/crud/notes.js

@@ -1,64 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Notes
- * Note lifecycle — create, read, update, search, backlinks, delete.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.notes = async function (testTag) {
-
-    // ── Notes CRUD ──
-    var noteId = null;
-    await T.test('crud', 'notes', 'POST /notes (create)', async function () {
-      var d = await T.apiPost('/notes', {
-        title: testTag + '-note',
-        content: '# ICD Test Note\n\nTest content with [[wikilink]].',
-        folder: 'icd-test'
-      });
-      T.assertShape(d, T.S.note, 'note');
-      noteId = d.id;
-      T.registerCleanup(function () { if (noteId) return T.safeDelete('/notes/' + noteId); });
-    });
-
-    if (noteId) {
-      await T.test('crud', 'notes', 'GET /notes/:id (read)', async function () {
-        var d = await T.apiGet('/notes/' + noteId);
-        T.assertShape(d, T.S.note, 'note');
-        T.assert(d.id === noteId, 'id mismatch');
-        T.assert(d.title.indexOf(testTag) !== -1, 'title mismatch');
-      });
-
-      await T.test('crud', 'notes', 'PUT /notes/:id (update)', async function () {
-        var d = await T.apiPut('/notes/' + noteId, {
-          title: testTag + '-note-updated',
-          content: '# Updated\n\nNew content.'
-        });
-        T.assert(d.title === testTag + '-note-updated' || (d.id && d.id === noteId), 'update response');
-      });
-
-      await T.test('crud', 'notes', 'GET /notes/search', async function () {
-        var d = await T.apiGet('/notes/search?q=' + encodeURIComponent(testTag));
-        T.assertHasKey(d, 'data', '/notes/search');
-      });
-
-      await T.test('crud', 'notes', 'GET /notes/search-titles', async function () {
-        var d = await T.apiGet('/notes/search-titles?q=' + encodeURIComponent(testTag));
-        T.assertHasKey(d, 'data', '/notes/search-titles');
-      });
-
-      await T.test('crud', 'notes', 'GET /notes/:id/backlinks', async function () {
-        var d = await T.apiGet('/notes/' + noteId + '/backlinks');
-        T.assertHasKey(d, 'data', '/backlinks');
-      });
-
-      await T.test('crud', 'notes', 'DELETE /notes/:id', async function () {
-        await T.safeDelete('/notes/' + noteId);
-        noteId = null;
-      });
-    }
-
-  };
-})();

packages/icd-test-runner/js/crud/observability.js

@@ -1,73 +0,0 @@
-/**
- * ICD Test Runner — Observability CRUD Tests (v0.33.0)
- * Tests /metrics, /api/docs, /admin/dashboard, X-Request-Id, structured logging.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-
-  T.crud.observability = async function () {
-
-    // -- GET /metrics (Prometheus endpoint, no auth required) --
-    await T.test('crud', 'observability', 'GET /metrics returns Prometheus text', async function () {
-      var resp = await fetch(T.base + '/metrics');
-      T.assert(resp.ok, 'expected 200 from /metrics, got ' + resp.status);
-      var text = await resp.text();
-      T.assert(text.indexOf('armature_http_requests_total') !== -1, 'expected armature_http_requests_total in /metrics');
-      T.assert(text.indexOf('armature_http_request_duration_seconds') !== -1, 'expected armature_http_request_duration_seconds in /metrics');
-      T.assert(text.indexOf('armature_websocket_connections') !== -1, 'expected armature_websocket_connections in /metrics');
-    });
-
-    // -- GET /api/docs (Swagger UI) --
-    await T.test('crud', 'observability', 'GET /api/docs returns Swagger UI HTML', async function () {
-      var resp = await fetch(T.base + '/api/docs');
-      T.assert(resp.ok, 'expected 200 from /api/docs, got ' + resp.status);
-      var text = await resp.text();
-      T.assert(text.indexOf('swagger-ui') !== -1, 'expected swagger-ui in /api/docs HTML');
-    });
-
-    // -- GET /api/docs/openapi.yaml --
-    await T.test('crud', 'observability', 'GET /api/docs/openapi.yaml returns valid YAML', async function () {
-      var resp = await fetch(T.base + '/api/docs/openapi.yaml');
-      T.assert(resp.ok, 'expected 200 from /api/docs/openapi.yaml, got ' + resp.status);
-      var text = await resp.text();
-      T.assert(text.indexOf('openapi:') !== -1, 'expected openapi: key in YAML');
-      T.assert(text.indexOf('paths:') !== -1, 'expected paths: key in YAML');
-    });
-
-    // -- X-Request-Id header propagation --
-    await T.test('crud', 'observability', 'X-Request-Id header on API responses', async function () {
-      var resp = await fetch(T.base + '/health');
-      T.assert(resp.ok, 'expected 200');
-      var rid = resp.headers.get('X-Request-Id');
-      T.assert(rid, 'expected X-Request-Id header in response');
-      T.assert(rid.length === 36, 'X-Request-Id should be UUID (36 chars), got ' + rid.length);
-    });
-
-    // -- X-Request-Id passthrough (client sends, server echoes) --
-    await T.test('crud', 'observability', 'X-Request-Id passthrough', async function () {
-      var customId = 'test-' + Date.now();
-      var resp = await fetch(T.base + '/health', {
-        headers: { 'X-Request-Id': customId }
-      });
-      T.assert(resp.ok, 'expected 200');
-      var echoed = resp.headers.get('X-Request-Id');
-      T.assert(echoed === customId, 'expected echoed X-Request-Id "' + customId + '", got "' + echoed + '"');
-    });
-
-    // -- GET /admin/dashboard (admin auth required) --
-    await T.test('crud', 'observability', 'GET /admin/dashboard returns dashboard data', async function () {
-      var d = await T.apiGet('/admin/dashboard');
-      T.assertHasKey(d, 'uptime', '/admin/dashboard');
-      T.assertHasKey(d, 'ws_connections', '/admin/dashboard');
-      T.assertHasKey(d, 'provider_health', '/admin/dashboard');
-      T.assert(typeof d.ws_connections === 'number', 'ws_connections should be number');
-      T.assert(typeof d.uptime === 'string', 'uptime should be string');
-      // provider_health can be null or array
-      if (d.provider_health) {
-        T.assert(Array.isArray(d.provider_health), 'provider_health should be array');
-      }
-    });
-  };
-})();

packages/icd-test-runner/js/crud/personas.js

@@ -1,247 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Personas
- * Admin persona lifecycle (create → list → update → tool grants →
- * KB bindings → delete), personal persona (policy-gated), team persona
- * (fixture team), persona groups CRUD.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.personas = async function (testTag) {
-
-    // ── Personas CRUD (admin + personal + team + tool grants + groups) ──
-    var personaId = '';
-    var personalPersonaId = '';
-    var teamPersonaId = '';
-
-    // Admin persona CRUD
-    await T.test('crud', 'personas', 'POST /admin/personas (create global)', async function () {
-      var d = await T.apiPost('/admin/personas', {
-        name: 'ICD Test Persona', base_model_id: 'test-model',
-        system_prompt: 'You are a test persona.', description: 'Created by ICD test runner'
-      });
-      T.assert(d.id, 'persona should have id');
-      T.assert(d.scope === 'global', 'admin persona scope should be global');
-      T.assert(d.handle, 'handle should be auto-generated');
-      personaId = d.id;
-    });
-
-    if (personaId) {
-      await T.test('crud', 'personas', 'GET /admin/personas (list contains new)', async function () {
-        var d = await T.apiGet('/admin/personas');
-        T.assertHasKey(d, 'data', '/admin/personas');
-        var found = d.data.some(function (p) { return p.id === personaId; });
-        T.assert(found, 'created persona should appear in admin list');
-      });
-
-      await T.test('crud', 'personas', 'PUT /admin/personas/:id (update)', async function () {
-        var d = await T.apiPut('/admin/personas/' + personaId, { name: 'ICD Updated Persona' });
-        T.assert(d.message === 'persona updated', 'expected update confirmation');
-      });
-
-      // Tool grants
-      await T.test('crud', 'personas', 'GET /admin/personas/:id/tool-grants (empty)', async function () {
-        var d = await T.apiGet('/admin/personas/' + personaId + '/tool-grants');
-        T.assertHasKey(d, 'data', 'tool-grants');
-        T.assert(Array.isArray(d.data), 'grants should be array');
-        T.assert(d.data.length === 0, 'initial grants should be empty');
-      });
-
-      await T.test('crud', 'personas', 'PUT /admin/personas/:id/tool-grants (set)', async function () {
-        var d = await T.apiPut('/admin/personas/' + personaId + '/tool-grants', {
-          tool_names: ['web_search', 'calculator']
-        });
-        T.assert(d.status === 'ok', 'expected ok');
-      });
-
-      await T.test('crud', 'personas', 'GET /admin/personas/:id/tool-grants (verify)', async function () {
-        var d = await T.apiGet('/admin/personas/' + personaId + '/tool-grants');
-        T.assert(d.data.length === 2, 'should have 2 grants, got ' + d.data.length);
-      });
-
-      await T.test('crud', 'personas', 'PUT /admin/personas/:id/tool-grants (clear)', async function () {
-        await T.apiPut('/admin/personas/' + personaId + '/tool-grants', { tool_names: [] });
-        var d = await T.apiGet('/admin/personas/' + personaId + '/tool-grants');
-        T.assert(d.data.length === 0, 'grants should be empty after clear');
-      });
-
-      // KB bindings
-      await T.test('crud', 'personas', 'GET /admin/personas/:id/knowledge-bases (empty)', async function () {
-        var d = await T.apiGet('/admin/personas/' + personaId + '/knowledge-bases');
-        T.assertHasKey(d, 'data', 'persona-kbs');
-        T.assert(Array.isArray(d.data), 'kbs should be array');
-      });
-
-      await T.test('crud', 'personas', 'DELETE /admin/personas/:id', async function () {
-        await T.apiDelete('/admin/personas/' + personaId);
-      });
-
-      await T.test('crud', 'personas', 'GET /admin/personas (deleted gone)', async function () {
-        var d = await T.apiGet('/admin/personas');
-        var found = d.data.some(function (p) { return p.id === personaId; });
-        T.assert(!found, 'deleted persona should not appear in list');
-      });
-    }
-
-    // Personal persona (policy-gated)
-    await T.test('crud', 'personas', 'POST /personas (create personal)', async function () {
-      // Ensure policy allows personal personas
-      try { await T.apiPut('/admin/settings/allow_user_personas', { value: 'true' }); } catch (e) { /* may already be set */ }
-      var d = await T.apiPost('/personas', {
-        name: 'ICD Personal Bot', base_model_id: 'test-model',
-        system_prompt: 'Personal test.'
-      });
-      T.assert(d.id, 'personal persona should have id');
-      T.assert(d.scope === 'personal', 'scope should be personal');
-      personalPersonaId = d.id;
-    });
-
-    if (personalPersonaId) {
-      await T.test('crud', 'personas', 'PUT /personas/:id (update personal)', async function () {
-        var d = await T.apiPut('/personas/' + personalPersonaId, { description: 'updated desc' });
-        T.assert(d.message === 'persona updated', 'expected update confirmation');
-      });
-
-      await T.test('crud', 'personas', 'GET /personas (list contains personal)', async function () {
-        var d = await T.apiGet('/personas');
-        T.assertHasKey(d, 'data', '/personas');
-        var found = d.data.some(function (p) { return p.id === personalPersonaId; });
-        T.assert(found, 'personal persona should appear in user list');
-      });
-
-      await T.test('crud', 'personas', 'DELETE /personas/:id (delete personal)', async function () {
-        await T.apiDelete('/personas/' + personalPersonaId);
-      });
-    }
-
-    // Team persona (uses fixture team)
-    if (T.fixtures.team) {
-      var tId = T.fixtures.team.id;
-
-      await T.test('crud', 'personas', 'POST /teams/:teamId/personas (create)', async function () {
-        var d = await T.apiPost('/teams/' + tId + '/personas', {
-          name: 'ICD Team Bot', base_model_id: 'test-model',
-          system_prompt: 'Team test.'
-        });
-        T.assert(d.id, 'team persona should have id');
-        T.assert(d.scope === 'team', 'scope should be team');
-        teamPersonaId = d.id;
-      });
-
-      if (teamPersonaId) {
-        await T.test('crud', 'personas', 'PUT /teams/:teamId/personas/:id (update)', async function () {
-          var d = await T.apiPut('/teams/' + tId + '/personas/' + teamPersonaId, { name: 'ICD Team Bot v2' });
-          T.assert(d.message === 'persona updated', 'expected update confirmation');
-        });
-
-        await T.test('crud', 'personas', 'GET /teams/:teamId/personas/:id/tool-grants', async function () {
-          var d = await T.apiGet('/teams/' + tId + '/personas/' + teamPersonaId + '/tool-grants');
-          T.assertHasKey(d, 'data', 'team-tool-grants');
-          T.assert(Array.isArray(d.data), 'grants should be array');
-        });
-
-        await T.test('crud', 'personas', 'PUT /teams/:teamId/personas/:id/tool-grants (set)', async function () {
-          await T.apiPut('/teams/' + tId + '/personas/' + teamPersonaId + '/tool-grants', {
-            tool_names: ['kb_search']
-          });
-          var d = await T.apiGet('/teams/' + tId + '/personas/' + teamPersonaId + '/tool-grants');
-          T.assert(d.data.length === 1, 'team persona should have 1 grant');
-        });
-
-        await T.test('crud', 'personas', 'GET /teams/:teamId/personas/:id/knowledge-bases', async function () {
-          var d = await T.apiGet('/teams/' + tId + '/personas/' + teamPersonaId + '/knowledge-bases');
-          T.assertHasKey(d, 'data', 'team-persona-kbs');
-        });
-
-        await T.test('crud', 'personas', 'DELETE /teams/:teamId/personas/:id', async function () {
-          await T.apiDelete('/teams/' + tId + '/personas/' + teamPersonaId);
-        });
-
-        await T.test('crud', 'personas', 'GET /teams/:teamId/personas (deleted gone)', async function () {
-          var d = await T.apiGet('/teams/' + tId + '/personas');
-          var found = d.data.some(function (p) { return p.id === teamPersonaId; });
-          T.assert(!found, 'deleted team persona should not appear in list');
-        });
-      }
-    }
-
-    // Persona Groups CRUD
-    var pgId = '';
-    var pgMemberId = '';
-
-    await T.test('crud', 'personas', 'POST /persona-groups (create)', async function () {
-      var d = await T.apiPost('/persona-groups', { name: 'ICD Test Group', description: 'Test' });
-      T.assert(d.id, 'group should have id');
-      T.assert(d.scope === 'personal', 'group scope should be personal');
-      pgId = d.id;
-    });
-
-    if (pgId) {
-      await T.test('crud', 'personas', 'GET /persona-groups/:id (read)', async function () {
-        var d = await T.apiGet('/persona-groups/' + pgId);
-        T.assert(d.id === pgId, 'group id should match');
-        T.assert(d.name === 'ICD Test Group', 'group name should match');
-        T.assert(Array.isArray(d.members), 'members should be array');
-      });
-
-      await T.test('crud', 'personas', 'PUT /persona-groups/:id (update)', async function () {
-        var d = await T.apiPut('/persona-groups/' + pgId, { name: 'ICD Updated Group' });
-        T.assert(d.ok === true, 'expected ok');
-      });
-
-      await T.test('crud', 'personas', 'GET /persona-groups (list)', async function () {
-        var d = await T.apiGet('/persona-groups');
-        T.assertHasKey(d, 'data', '/persona-groups');
-        var found = d.data.some(function (g) { return g.id === pgId; });
-        T.assert(found, 'created group should appear in list');
-      });
-
-      // Add a member (need a persona — create a temporary one)
-      var tmpPersonaId = '';
-      await T.test('crud', 'personas', 'POST /admin/personas (for group member)', async function () {
-        var d = await T.apiPost('/admin/personas', {
-          name: 'Group Member Bot', base_model_id: 'test-model'
-        });
-        tmpPersonaId = d.id;
-      });
-
-      if (tmpPersonaId) {
-        await T.test('crud', 'personas', 'POST /persona-groups/:id/members (add)', async function () {
-          var d = await T.apiPost('/persona-groups/' + pgId + '/members', {
-            persona_id: tmpPersonaId, is_leader: true
-          });
-          T.assert(d.ok === true, 'expected ok');
-        });
-
-        await T.test('crud', 'personas', 'GET /persona-groups/:id (with member)', async function () {
-          var d = await T.apiGet('/persona-groups/' + pgId);
-          T.assert(d.members.length === 1, 'should have 1 member');
-          T.assert(d.members[0].is_leader === true, 'member should be leader');
-          pgMemberId = d.members[0].id;
-        });
-
-        if (pgMemberId) {
-          await T.test('crud', 'personas', 'DELETE /persona-groups/:id/members/:mid', async function () {
-            await T.apiDelete('/persona-groups/' + pgId + '/members/' + pgMemberId);
-          });
-
-          await T.test('crud', 'personas', 'GET /persona-groups/:id (member removed)', async function () {
-            var d = await T.apiGet('/persona-groups/' + pgId);
-            T.assert(d.members.length === 0, 'should have 0 members after removal');
-          });
-        }
-
-        // Cleanup temp persona
-        try { await T.apiDelete('/admin/personas/' + tmpPersonaId); } catch (e) { /* ok */ }
-      }
-
-      await T.test('crud', 'personas', 'DELETE /persona-groups/:id', async function () {
-        await T.apiDelete('/persona-groups/' + pgId);
-      });
-    }
-
-  };
-})();

packages/icd-test-runner/js/crud/projects.js

@@ -1,194 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Projects
- * Full project lifecycle — CRUD, channel/KB/note associations, files,
- * isolation, and admin list.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.projects = async function (testTag) {
-
-    // ── Create ──
-    var projectId = null;
-    await T.test('crud', 'projects', 'POST /projects (create, 201 + shape)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/projects', {
-        name: testTag + '-project',
-        description: 'ICD integration test project',
-        color: '#3b82f6',
-        icon: 'folder'
-      });
-      T.assertStatus(d, 201, 'POST /projects');
-      T.assertShape(d, T.S.project, 'project');
-      T.assert(d.scope === 'personal', 'scope forced to personal, got ' + d.scope);
-      T.assert(typeof d.owner_id === 'string' && d.owner_id.length > 0, 'owner_id must be set');
-      projectId = d.id;
-      T.registerCleanup(function () { if (projectId) return T.safeDelete('/projects/' + projectId); });
-    });
-
-    if (!projectId) return;
-
-    // ── Read ──
-    await T.test('crud', 'projects', 'GET /projects/:id (read, shape)', async function () {
-      var d = await T.apiGet('/projects/' + projectId);
-      T.assertShape(d, T.S.project, 'project');
-      T.assert(d.id === projectId, 'id mismatch');
-      T.assert(d.name === testTag + '-project', 'name mismatch');
-      T.assert(d.description === 'ICD integration test project', 'description mismatch');
-    });
-
-    // ── Update ──
-    await T.test('crud', 'projects', 'PUT /projects/:id (update, returns refreshed)', async function () {
-      var d = await T.apiPut('/projects/' + projectId, { name: testTag + '-proj-updated', is_archived: false });
-      T.assertShape(d, T.S.project, 'project');
-      T.assert(d.name === testTag + '-proj-updated', 'name not updated');
-      T.assert(d.id === projectId, 'id changed unexpectedly');
-    });
-
-    // ── List envelope ──
-    await T.test('crud', 'projects', 'GET /projects (list envelope)', async function () {
-      var d = await T.apiGet('/projects');
-      T.assertHasKey(d, 'data', '/projects');
-      T.assert(Array.isArray(d.data), 'data must be array');
-      var found = d.data.some(function (p) { return p.id === projectId; });
-      T.assert(found, 'created project not in list');
-    });
-
-    // ── Channel association ──
-    var channelId = null;
-    await T.test('crud', 'projects', 'POST /projects/:id/channels (add channel)', async function () {
-      // Create a scratch channel for association testing
-      var ch = await T.apiPost('/channels', { title: testTag + '-proj-ch', type: 'direct' });
-      channelId = ch.id;
-      T.registerCleanup(function () { if (channelId) return T.safeDelete('/channels/' + channelId); });
-
-      var d = await T.apiPost('/projects/' + projectId + '/channels', { channel_id: channelId, position: 0 });
-      T.assert(typeof d === 'object', 'expected object response');
-    });
-
-    await T.test('crud', 'projects', 'GET /projects/:id/channels (list, has added)', async function () {
-      var d = await T.apiGet('/projects/' + projectId + '/channels');
-      T.assertHasKey(d, 'data', '/project-channels');
-      T.assert(Array.isArray(d.data), 'data must be array');
-      T.assert(d.data.length >= 1, 'expected at least 1 channel association');
-      var entry = d.data[0];
-      T.assert(typeof entry.channel_id === 'string', 'missing channel_id');
-      T.assert(typeof entry.project_id === 'string', 'missing project_id');
-      T.assert(typeof entry.added_at === 'string', 'missing added_at');
-    });
-
-    await T.test('crud', 'projects', 'DELETE /projects/:id/channels/:channelId (remove)', async function () {
-      await T.apiDelete('/projects/' + projectId + '/channels/' + channelId);
-      var d = await T.apiGet('/projects/' + projectId + '/channels');
-      T.assert(d.data.length === 0, 'channel should be removed');
-    });
-
-    // ── KB association ──
-    var kbId = null;
-    await T.test('crud', 'projects', 'POST /projects/:id/knowledge-bases (add KB)', async function () {
-      // Create a scratch KB
-      var kb = await T.apiPost('/knowledge-bases', { name: testTag + '-proj-kb', scope: 'personal' });
-      kbId = kb.id;
-      T.registerCleanup(function () { if (kbId) return T.safeDelete('/knowledge-bases/' + kbId); });
-
-      var d = await T.apiPost('/projects/' + projectId + '/knowledge-bases', { kb_id: kbId, auto_search: true });
-      T.assert(typeof d === 'object', 'expected object response');
-    });
-
-    await T.test('crud', 'projects', 'GET /projects/:id/knowledge-bases (list, has added)', async function () {
-      var d = await T.apiGet('/projects/' + projectId + '/knowledge-bases');
-      T.assertHasKey(d, 'data', '/project-kbs');
-      T.assert(d.data.length >= 1, 'expected at least 1 KB association');
-      var entry = d.data[0];
-      T.assert(typeof entry.kb_id === 'string', 'missing kb_id');
-      T.assert(typeof entry.project_id === 'string', 'missing project_id');
-      T.assert(typeof entry.added_at === 'string', 'missing added_at');
-    });
-
-    await T.test('crud', 'projects', 'DELETE /projects/:id/knowledge-bases/:kbId (remove)', async function () {
-      await T.apiDelete('/projects/' + projectId + '/knowledge-bases/' + kbId);
-      var d = await T.apiGet('/projects/' + projectId + '/knowledge-bases');
-      T.assert(d.data.length === 0, 'KB should be removed');
-    });
-
-    // ── Note association ──
-    var noteId = null;
-    await T.test('crud', 'projects', 'POST /projects/:id/notes (add note)', async function () {
-      // Create a scratch note
-      var n = await T.apiPost('/notes', { title: testTag + '-proj-note', content: 'test' });
-      noteId = n.id;
-      T.registerCleanup(function () { if (noteId) return T.safeDelete('/notes/' + noteId); });
-
-      var d = await T.apiPost('/projects/' + projectId + '/notes', { note_id: noteId });
-      T.assert(typeof d === 'object', 'expected object response');
-    });
-
-    await T.test('crud', 'projects', 'GET /projects/:id/notes (list, has added)', async function () {
-      var d = await T.apiGet('/projects/' + projectId + '/notes');
-      T.assertHasKey(d, 'data', '/project-notes');
-      T.assert(d.data.length >= 1, 'expected at least 1 note association');
-      var entry = d.data[0];
-      T.assert(typeof entry.note_id === 'string', 'missing note_id');
-      T.assert(typeof entry.project_id === 'string', 'missing project_id');
-      T.assert(typeof entry.added_at === 'string', 'missing added_at');
-    });
-
-    await T.test('crud', 'projects', 'DELETE /projects/:id/notes/:noteId (remove)', async function () {
-      await T.apiDelete('/projects/' + projectId + '/notes/' + noteId);
-      var d = await T.apiGet('/projects/' + projectId + '/notes');
-      T.assert(d.data.length === 0, 'note should be removed');
-    });
-
-    // ── Files (shape only — no upload in runner) ──
-    await T.test('crud', 'projects', 'GET /projects/:id/files (files key + count)', async function () {
-      var d = await T.apiGet('/projects/' + projectId + '/files');
-      T.assertHasKey(d, 'files', '/project-files');
-      T.assertHasKey(d, 'count', '/project-files');
-      T.assert(Array.isArray(d.files), 'files must be array');
-      T.assert(typeof d.count === 'number', 'count must be number');
-    });
-
-    // ── Isolation ──
-    await T.test('crud', 'projects', 'isolation: other user cannot GET personal project', async function () {
-      var other = T.getFixtureUser('-user');
-      if (!other || !other.token) { T.assert(true, 'skip — no fixture user'); return; }
-      var d = await T.authFetch(other.token, 'GET', '/projects/' + projectId);
-      T.assert(d._status === 404, 'expected 404 for other user, got ' + d._status);
-    });
-
-    await T.test('crud', 'projects', 'isolation: other user cannot DELETE personal project', async function () {
-      var other = T.getFixtureUser('-user');
-      if (!other || !other.token) { T.assert(true, 'skip — no fixture user'); return; }
-      var d = await T.authFetch(other.token, 'DELETE', '/projects/' + projectId);
-      T.assert(d._status === 404, 'expected 404 for other user DELETE, got ' + d._status);
-    });
-
-    // ── Admin list ──
-    await T.test('crud', 'projects', 'GET /admin/projects (envelope + owner_name)', async function () {
-      var d = await T.apiGet('/admin/projects');
-      T.assertHasKey(d, 'data', '/admin/projects');
-      T.assert(Array.isArray(d.data), 'data must be array');
-      var found = d.data.find(function (p) { return p.id === projectId; });
-      T.assert(found, 'created project not in admin list');
-      T.assert(typeof found.owner_name === 'string', 'admin list must include owner_name');
-      T.assert(typeof found.channel_count === 'number', 'admin list must include channel_count');
-      T.assert(typeof found.kb_count === 'number', 'admin list must include kb_count');
-      T.assert(typeof found.note_count === 'number', 'admin list must include note_count');
-    });
-
-    // ── Delete ──
-    await T.test('crud', 'projects', 'DELETE /projects/:id', async function () {
-      await T.safeDelete('/projects/' + projectId);
-      projectId = null;
-    });
-
-    // Cleanup scratch resources (cleanups run in reverse but let's be explicit)
-    if (channelId) { try { await T.safeDelete('/channels/' + channelId); channelId = null; } catch (e) { /* ok */ } }
-    if (kbId) { try { await T.safeDelete('/knowledge-bases/' + kbId); kbId = null; } catch (e) { /* ok */ } }
-    if (noteId) { try { await T.safeDelete('/notes/' + noteId); noteId = null; } catch (e) { /* ok */ } }
-
-  };
-})();

packages/icd-test-runner/js/crud/tasks.js

@@ -1,314 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Tasks
- * Personal task lifecycle, validation (missing name, invalid cron,
- * workflow type), webhook-triggered tasks, webhook secret auto-gen,
- * admin task operations.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.tasks = async function (testTag) {
-
-    // ── Personal Tasks CRUD ──
-    var taskId = null;
-    var taskTriggerToken = null;
-
-    await T.test('crud', 'tasks', 'POST /tasks (create prompt task)', async function () {
-      var d = await T.apiPost('/tasks', {
-        name: testTag + '-task',
-        description: 'ICD integration test task',
-        task_type: 'prompt',
-        schedule: '@daily',
-        user_prompt: 'Summarize test data',
-        model_id: 'test-model',
-        timezone: 'UTC'
-      });
-      T.assertShape(d, T.S.taskFull, 'created task');
-      T.assert(d.task_type === 'prompt', 'task_type should be prompt');
-      T.assert(d.scope === 'personal', 'default scope should be personal');
-      T.assert(d.is_active === true, 'new task should be active');
-      T.assert(d.next_run_at !== null && d.next_run_at !== undefined, 'cron task should have next_run_at');
-      T.assert(d.max_tokens > 0, 'budget defaults should be applied');
-      taskId = d.id;
-      T.registerCleanup(function () { if (taskId) return T.safeDelete('/tasks/' + taskId); });
-    });
-
-    if (taskId) {
-      await T.test('crud', 'tasks', 'GET /tasks/:id (read)', async function () {
-        var d = await T.apiGet('/tasks/' + taskId);
-        T.assertShape(d, T.S.taskFull, 'task');
-        T.assert(d.id === taskId, 'id mismatch');
-        T.assert(d.name.indexOf(testTag) !== -1, 'name mismatch');
-      });
-
-      await T.test('crud', 'tasks', 'PUT /tasks/:id (update)', async function () {
-        var d = await T.apiPut('/tasks/' + taskId, {
-          name: testTag + '-task-updated',
-          user_prompt: 'Updated prompt'
-        });
-        T.assert(d.name === testTag + '-task-updated', 'name not updated');
-      });
-
-      await T.test('crud', 'tasks', 'GET /tasks (list mine)', async function () {
-        var d = await T.apiGet('/tasks');
-        T.assertHasKey(d, 'data', '/tasks');
-        T.assert(Array.isArray(d.data), 'data should be array');
-        T.assert(d.data.length >= 1, 'should have at least 1 task');
-        var found = d.data.some(function (t) { return t.id === taskId; });
-        T.assert(found, 'created task should be in list');
-      });
-
-      await T.test('crud', 'tasks', 'GET /tasks/:id/runs (list runs)', async function () {
-        var d = await T.apiGet('/tasks/' + taskId + '/runs');
-        T.assertHasKey(d, 'data', '/runs');
-        T.assert(Array.isArray(d.data), 'data should be array');
-      });
-
-      await T.test('crud', 'tasks', 'POST /tasks/:id/run (run now)', async function () {
-        var d = await T.apiPost('/tasks/' + taskId + '/run', {});
-        T.assertHasKey(d, 'scheduled', '/run');
-        T.assert(d.scheduled === true, 'should be scheduled');
-      });
-
-      await T.test('crud', 'tasks', 'POST /tasks/:id/kill (no active run → 404)', async function () {
-        var token = await T.getAuthToken();
-        var d = await T.authFetch(token, 'POST', '/tasks/' + taskId + '/kill');
-        // 200 = killed (if run started), 404 = no active run — both acceptable
-        T.assert(d._status === 200 || d._status === 404,
-          'expected 200 or 404, got ' + d._status);
-      });
-
-      await T.test('crud', 'tasks', 'PUT /tasks/:id (update schedule)', async function () {
-        var d = await T.apiPut('/tasks/' + taskId, { schedule: '@hourly' });
-        T.assert(d.schedule === '@hourly', 'schedule not updated');
-      });
-
-      await T.test('crud', 'tasks', 'PUT /tasks/:id (deactivate)', async function () {
-        var d = await T.apiPut('/tasks/' + taskId, { is_active: false });
-        T.assert(d.is_active === false, 'should be deactivated');
-      });
-
-      await T.test('crud', 'tasks', 'DELETE /tasks/:id', async function () {
-        await T.safeDelete('/tasks/' + taskId);
-        taskId = null;
-      });
-    }
-
-    // ── Task Validation Tests ──
-    await T.test('crud', 'tasks', 'POST /tasks (missing name → 400)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/tasks', {
-        task_type: 'prompt', schedule: '@daily',
-        user_prompt: 'x', model_id: 'm'
-      });
-      T.assertStatus(d, 400, 'missing name');
-    });
-
-    await T.test('crud', 'tasks', 'POST /tasks (invalid cron → 400)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/tasks', {
-        name: testTag + '-bad-cron', task_type: 'prompt',
-        schedule: 'not-a-cron', user_prompt: 'x', model_id: 'm'
-      });
-      T.assertStatus(d, 400, 'invalid cron');
-    });
-
-    await T.test('crud', 'tasks', 'POST /tasks (workflow type → 400 not implemented)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/tasks', {
-        name: testTag + '-wf', task_type: 'workflow',
-        schedule: '@daily', workflow_id: '00000000-0000-0000-0000-000000000001',
-        model_id: 'm'
-      });
-      T.assertStatus(d, 400, 'workflow type rejected');
-    });
-
-    // ── Webhook-Triggered Task + Trigger Endpoint ──
-    var webhookTaskId = null;
-    var webhookTriggerToken = null;
-
-    await T.test('crud', 'tasks', 'POST /tasks (create webhook task)', async function () {
-      var d = await T.apiPost('/tasks', {
-        name: testTag + '-webhook-task',
-        task_type: 'prompt',
-        schedule: 'webhook',
-        user_prompt: 'Process trigger data',
-        model_id: 'test-model'
-      });
-      T.assertShape(d, T.S.taskFull, 'webhook task');
-      T.assert(d.schedule === 'webhook', 'schedule should be webhook');
-      T.assert(d.trigger_token && d.trigger_token.length > 0, 'webhook task should have trigger_token');
-      T.assert(d.next_run_at === null || d.next_run_at === undefined, 'webhook task should have no next_run_at');
-      webhookTaskId = d.id;
-      webhookTriggerToken = d.trigger_token;
-      T.registerCleanup(function () { if (webhookTaskId) return T.safeDelete('/tasks/' + webhookTaskId); });
-    });
-
-    if (webhookTaskId && webhookTriggerToken) {
-      await T.test('crud', 'tasks', 'POST /hooks/t/:token (fire trigger → 202)', async function () {
-        var d = await T.publicPost('/hooks/t/' + webhookTriggerToken, {
-          build_id: 12345, status: 'failed', repo: 'icd-test'
-        });
-        T.assertStatus(d, 202, 'trigger');
-        T.assert(d.triggered === true, 'should be triggered');
-        T.assert(d.run_id && d.run_id.length > 0, 'should return run_id');
-        T.assert(d.task_id === webhookTaskId, 'task_id should match');
-      });
-
-      await T.test('crud', 'tasks', 'POST /hooks/t/:token (duplicate → 409)', async function () {
-        var d = await T.publicPost('/hooks/t/' + webhookTriggerToken, { test: true });
-        T.assertStatus(d, 409, 'duplicate trigger');
-      });
-
-      await T.test('crud', 'tasks', 'POST /hooks/t/bad-token (invalid → 404)', async function () {
-        var d = await T.publicPost('/hooks/t/nonexistent-token-value', { test: true });
-        T.assertStatus(d, 404, 'bad token');
-      });
-
-      // Deactivate then trigger → 410
-      await T.test('crud', 'tasks', 'PUT+POST deactivated webhook task → 410', async function () {
-        await T.apiPut('/tasks/' + webhookTaskId, { is_active: false });
-        var d = await T.publicPost('/hooks/t/' + webhookTriggerToken, { test: true });
-        T.assertStatus(d, 410, 'inactive trigger');
-        // Re-activate for cleanup
-        await T.apiPut('/tasks/' + webhookTaskId, { is_active: true });
-      });
-
-      await T.test('crud', 'tasks', 'GET /tasks/:id/runs (webhook task has queued run)', async function () {
-        var d = await T.apiGet('/tasks/' + webhookTaskId + '/runs');
-        T.assertHasKey(d, 'data', '/runs');
-        T.assert(Array.isArray(d.data), 'data should be array');
-        T.assert(d.data.length >= 1, 'webhook task should have at least 1 run from trigger');
-        T.assertShape(d.data[0], T.S.taskRun, 'run[0]');
-      });
-
-      await T.test('crud', 'tasks', 'DELETE /tasks/:id (webhook task)', async function () {
-        await T.safeDelete('/tasks/' + webhookTaskId);
-        webhookTaskId = null;
-      });
-    }
-
-    // ── Webhook Secret Auto-Generation ──
-    await T.test('crud', 'tasks', 'POST /tasks (webhook_url → auto webhook_secret)', async function () {
-      var d = await T.apiPost('/tasks', {
-        name: testTag + '-secret-task',
-        task_type: 'prompt', schedule: '@daily',
-        user_prompt: 'x', model_id: 'm',
-        webhook_url: 'https://example.com/hook'
-      });
-      T.assert(d.webhook_secret && d.webhook_secret.length > 0,
-        'webhook_secret should be auto-generated when webhook_url is set');
-      if (d.id) await T.safeDelete('/tasks/' + d.id);
-    });
-
-    // ── Admin Task Operations ──
-    if (T.user.role === 'admin') {
-      var adminTaskId = null;
-
-      await T.test('crud', 'tasks', 'POST /tasks (create for admin ops)', async function () {
-        var d = await T.apiPost('/tasks', {
-          name: testTag + '-admin-task',
-          task_type: 'prompt', schedule: '@daily',
-          user_prompt: 'admin test', model_id: 'm'
-        });
-        adminTaskId = d.id;
-        T.registerCleanup(function () { if (adminTaskId) return T.safeDelete('/tasks/' + adminTaskId); });
-      });
-
-      await T.test('crud', 'tasks', 'GET /admin/tasks (list all)', async function () {
-        var d = await T.apiGet('/admin/tasks');
-        T.assertHasKey(d, 'data', '/admin/tasks');
-        T.assert(Array.isArray(d.data), 'data should be array');
-        if (adminTaskId) {
-          var found = d.data.some(function (t) { return t.id === adminTaskId; });
-          T.assert(found, 'admin-created task should appear in admin list');
-        }
-      });
-
-      if (adminTaskId) {
-        await T.test('crud', 'tasks', 'POST /admin/tasks/:id/run (admin run)', async function () {
-          var d = await T.apiPost('/admin/tasks/' + adminTaskId + '/run', {});
-          T.assertHasKey(d, 'scheduled', '/admin/run');
-          T.assert(d.scheduled === true, 'should be scheduled');
-        });
-
-        await T.test('crud', 'tasks', 'POST /admin/tasks/:id/kill (admin kill)', async function () {
-          var token = await T.getAuthToken();
-          var d = await T.authFetch(token, 'POST', '/admin/tasks/' + adminTaskId + '/kill');
-          T.assert(d._status === 200 || d._status === 404,
-            'expected 200 or 404, got ' + d._status);
-        });
-
-        await T.test('crud', 'tasks', 'DELETE /admin/tasks/:id (admin delete)', async function () {
-          await T.safeDelete('/admin/tasks/' + adminTaskId);
-          adminTaskId = null;
-        });
-      }
-    }
-
-    // ── System functions (v0.28.6) ──
-
-    await T.test('crud', 'tasks', 'GET /admin/system-functions', async function () {
-      var d = await T.apiGet('/admin/system-functions');
-      T.assertHasKey(d, 'data', 'system-functions');
-      T.assert(Array.isArray(d.data), 'data should be array');
-      T.assert(d.data.length >= 4, 'should have at least 4 built-in functions, got ' + d.data.length);
-      var names = d.data.map(function(f) { return f.name; });
-      T.assert(names.indexOf('session_cleanup') >= 0, 'should include session_cleanup');
-      T.assert(names.indexOf('staleness_check') >= 0, 'should include staleness_check');
-      T.assert(names.indexOf('retention_sweep') >= 0, 'should include retention_sweep');
-      T.assert(names.indexOf('health_prune') >= 0, 'should include health_prune');
-      // Verify shape
-      T.assert(typeof d.data[0].name === 'string', 'name should be string');
-      T.assert(typeof d.data[0].description === 'string', 'description should be string');
-    });
-
-    var sysTaskId = null;
-    await T.test('crud', 'tasks', 'POST /tasks (create system task)', async function () {
-      var d = await T.apiPost('/tasks', {
-        name: testTag + '-system-task',
-        task_type: 'system',
-        system_function: 'health_prune',
-        schedule: '0 3 * * *',
-        scope: 'global',
-      });
-      T.assert(d.id, 'should return id');
-      T.assert(d.task_type === 'system', 'task_type should be system');
-      T.assert(d.system_function === 'health_prune', 'system_function should be health_prune');
-      sysTaskId = d.id;
-      T.registerCleanup(function () { if (sysTaskId) return T.safeDelete('/tasks/' + sysTaskId); });
-    });
-
-    if (sysTaskId) {
-      await T.test('crud', 'tasks', 'DELETE /tasks/:id (cleanup system task)', async function () {
-        await T.safeDelete('/tasks/' + sysTaskId);
-        sysTaskId = null;
-      });
-    }
-
-    await T.test('crud', 'tasks', 'POST /tasks (system task — invalid function → 400)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/tasks', {
-        name: 'bad-func',
-        task_type: 'system',
-        system_function: 'nonexistent_func',
-        schedule: '0 3 * * *',
-      });
-      T.assertStatus(d, 400, 'invalid system function');
-    });
-
-    await T.test('crud', 'tasks', 'POST /tasks (system task — missing function → 400)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/tasks', {
-        name: 'no-func',
-        task_type: 'system',
-        schedule: '0 3 * * *',
-      });
-      T.assertStatus(d, 400, 'missing system_function');
-    });
-
-  };
-})();

packages/icd-test-runner/js/crud/teams.js

@@ -85,7 +85,8 @@
             user_prompt: 'Team task test',
             model_id: 'test-model'
           });
-          T.assertShape(d, T.S.taskFull, 'team task');
+          T.assert(typeof d.id === 'string', 'team task should have id');
+          T.assert(typeof d.name === 'string', 'team task should have name');
           T.assert(d.scope === 'team', 'team task scope should be team');
           T.assert(d.team_id === teamId, 'team_id should match');
           teamTaskId = d.id;

packages/icd-test-runner/js/crud/workflow-product.js

@@ -1,180 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Workflow Product (v0.35.0)
- * Tests for conditional routing, progressive forms, conditional fields,
- * review comments, monitoring dashboard, and SLA computation.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.workflowProduct = async function (testTag) {
-
-    if (T.user.role !== 'admin') return;
-
-    var wfId = null;
-    var wfSlug = testTag.toLowerCase().replace(/[^a-z0-9-]/g, '-') + '-wp';
-    var channelId = null;
-
-    // ── Setup: Create workflow with conditions ──
-
-    await T.test('crud', 'workflow-product', 'Create workflow for routing tests', async function () {
-      var d = await T.apiPost('/workflows', {
-        name: testTag + '-routing-wf',
-        slug: wfSlug,
-        description: 'Workflow product routing test',
-        entry_mode: 'team_only',
-      });
-      T.assert(d.id, 'workflow created');
-      wfId = d.id;
-      T.registerCleanup(function () { if (wfId) return T.safeDelete('/workflows/' + wfId); });
-    });
-
-    if (!wfId) return;
-
-    // Create 3 stages: Intake → Review (condition: category=billing) → Fallback
-    await T.test('crud', 'workflow-product', 'Create stage 0: Intake', async function () {
-      var d = await T.apiPost('/workflows/' + wfId + '/stages', {
-        name: 'Intake',
-        ordinal: 0,
-        stage_mode: 'form_only',
-        form_template: { fields: [
-          { key: 'category', type: 'select', label: 'Category', required: true,
-            options: [{ value: 'billing', label: 'Billing' }, { value: 'general', label: 'General' }] },
-          { key: 'notes', type: 'textarea', label: 'Notes', condition: { when: 'category', op: 'eq', value: 'general' } }
-        ] },
-        history_mode: 'full',
-        auto_transition: true,
-        transition_rules: {
-          conditions: [
-            { field: 'category', op: 'eq', value: 'billing', target_stage: 'Billing Review' }
-          ]
-        },
-        sla_seconds: 3600,
-      });
-      T.assert(d.id || d.name, 'stage created');
-    });
-
-    await T.test('crud', 'workflow-product', 'Create stage 1: Billing Review', async function () {
-      var d = await T.apiPost('/workflows/' + wfId + '/stages', {
-        name: 'Billing Review',
-        ordinal: 1,
-        stage_mode: 'review',
-        history_mode: 'full',
-        sla_seconds: 7200,
-      });
-      T.assert(d.id || d.name, 'stage created');
-    });
-
-    await T.test('crud', 'workflow-product', 'Create stage 2: General Fallback', async function () {
-      var d = await T.apiPost('/workflows/' + wfId + '/stages', {
-        name: 'General Fallback',
-        ordinal: 2,
-        stage_mode: 'chat_only',
-        history_mode: 'full',
-      });
-      T.assert(d.id || d.name, 'stage created');
-    });
-
-    // Activate and publish
-    await T.test('crud', 'workflow-product', 'Activate + publish', async function () {
-      await T.apiPatch('/workflows/' + wfId, { is_active: true });
-      var d = await T.apiPost('/workflows/' + wfId + '/publish', {});
-      T.assert(d.version_number >= 1, 'published');
-    });
-
-    // ── Conditional routing test ──
-
-    await T.test('crud', 'workflow-product', 'Start instance + advance with condition match → routes to Billing Review', async function () {
-      var start = await T.apiPost('/workflows/' + wfId + '/start', {});
-      channelId = start.channel_id;
-      T.assert(channelId, 'instance started');
-      T.assert(start.current_stage === 0, 'starts at stage 0');
-
-      // Advance with category=billing → should route to stage 1 (Billing Review)
-      var adv = await T.apiPost('/channels/' + channelId + '/workflow/advance', {
-        data: { category: 'billing' }
-      });
-      T.assert(adv.current_stage === 1, 'routed to stage 1 (Billing Review), got: ' + adv.current_stage);
-      T.assert(adv.stage && adv.stage.name === 'Billing Review', 'stage name is Billing Review');
-    });
-
-    // ── Conditional field validation ──
-
-    await T.test('crud', 'workflow-product', 'Conditional field: hidden field skipped in validation', async function () {
-      // The "notes" field has condition {when: "category", eq: "general"}
-      // When category=billing, "notes" should be skipped even though it exists
-      // This test verifies the server-side validation logic
-      var start = await T.apiPost('/workflows/' + wfId + '/start', {});
-      var ch = start.channel_id;
-      T.assert(ch, 'second instance started');
-
-      // Submit form with category=billing and no notes → should succeed
-      // (notes field condition not met, so it's skipped)
-      var adv = await T.apiPost('/channels/' + ch + '/workflow/advance', {
-        data: { category: 'billing' }
-      });
-      T.assert(adv.status === 'active' || adv.status === 'completed', 'advance succeeded without notes field');
-    });
-
-    // ── Review comments ──
-
-    await T.test('crud', 'workflow-product', 'POST /workflow-assignments/:id/comment (add review comment)', async function () {
-      // Create a new instance and advance to the review stage
-      var start = await T.apiPost('/workflows/' + wfId + '/start', {});
-      var ch = start.channel_id;
-
-      // Advance to Billing Review (stage 1)
-      await T.apiPost('/channels/' + ch + '/workflow/advance', {
-        data: { category: 'billing' }
-      });
-
-      // Check status to verify we're at review stage
-      var status = await T.apiGet('/channels/' + ch + '/workflow/status');
-      T.assert(status.current_stage === 1, 'at review stage');
-    });
-
-    // ── Monitoring dashboard ──
-
-    await T.test('crud', 'workflow-product', 'GET /admin/workflows/monitor/instances', async function () {
-      var d = await T.apiGet('/admin/workflows/monitor/instances');
-      T.assert(Array.isArray(d.data), 'returns array');
-      // Should have at least the instances we created above
-    });
-
-    await T.test('crud', 'workflow-product', 'GET /admin/workflows/monitor/funnel/:id', async function () {
-      var d = await T.apiGet('/admin/workflows/monitor/funnel/' + wfId);
-      T.assert(Array.isArray(d.data), 'returns array');
-      T.assert(d.data.length === 3, 'has 3 stages in funnel, got: ' + d.data.length);
-    });
-
-    await T.test('crud', 'workflow-product', 'GET /admin/workflows/monitor/stale', async function () {
-      var d = await T.apiGet('/admin/workflows/monitor/stale?threshold_hours=0');
-      T.assert(Array.isArray(d.data), 'returns array');
-      // With threshold=0, all active instances should be "stale"
-    });
-
-    // ── SLA fields ──
-
-    await T.test('crud', 'workflow-product', 'Monitor instances include SLA fields', async function () {
-      var d = await T.apiGet('/admin/workflows/monitor/instances');
-      var myInstances = d.data.filter(function (i) { return i.workflow_id === wfId; });
-      if (myInstances.length > 0) {
-        var inst = myInstances[0];
-        T.assert('sla_seconds' in inst, 'has sla_seconds field');
-        T.assert('sla_breached' in inst, 'has sla_breached field');
-        T.assert('stage_age_seconds' in inst, 'has stage_age_seconds field');
-      }
-    });
-
-    // ── Stage entered_at tracking ──
-
-    await T.test('crud', 'workflow-product', 'Workflow status includes stage_entered_at', async function () {
-      if (!channelId) return;
-      var status = await T.apiGet('/channels/' + channelId + '/workflow/status');
-      T.assert('stage_entered_at' in status, 'stage_entered_at present in status');
-    });
-
-  };
-})();

packages/icd-test-runner/js/crud/workspaces.js

@@ -1,198 +0,0 @@
-/**
- * ICD Test Runner — CRUD: Workspaces
- * Workspace lifecycle — create, read, update, file ops, stats, isolation, delete.
- * Git credentials list envelope.
- */
-(function () {
-  'use strict';
-  var T = window.ICD;
-  if (!T) return;
-  if (!T.crud) T.crud = {};
-
-  T.crud.workspaces = async function (testTag) {
-
-    // ── GET /workspaces — list envelope ──
-    await T.test('crud', 'workspaces', 'GET /workspaces (list envelope)', async function () {
-      var d = await T.apiGet('/workspaces');
-      T.assertHasKey(d, 'data', 'GET /workspaces');
-      T.assert(Array.isArray(d.data), 'data must be array');
-    });
-
-    // ── GET /git-credentials — list envelope ──
-    await T.test('crud', 'workspaces', 'GET /git-credentials (list envelope)', async function () {
-      var d = await T.apiGet('/git-credentials');
-      T.assertHasKey(d, 'data', 'GET /git-credentials');
-      T.assert(Array.isArray(d.data), 'data must be array');
-    });
-
-    // ── POST /git-credentials/generate — server-side keygen (v0.28.6) ──
-    var generatedKeyId = null;
-    await T.test('crud', 'workspaces', 'POST /git-credentials/generate', async function () {
-      var d = await T.apiPost('/git-credentials/generate', { name: 'ICD Test Key' });
-      T.assert(d.id, 'should return id');
-      T.assert(d.auth_type === 'ssh_key', 'auth_type should be ssh_key');
-      T.assert(d.public_key && d.public_key.length > 0, 'should return public_key');
-      T.assert(d.fingerprint && d.fingerprint.startsWith('SHA256:'), 'should return SHA256 fingerprint');
-      T.assert(!d.encrypted_data, 'must NOT expose encrypted_data');
-      T.assert(!d.nonce, 'must NOT expose nonce');
-      generatedKeyId = d.id;
-      T.registerCleanup(function () { if (generatedKeyId) return T.safeDelete('/git-credentials/' + generatedKeyId); });
-    });
-
-    if (generatedKeyId) {
-      await T.test('crud', 'workspaces', 'GET /git-credentials/:id/public-key', async function () {
-        var d = await T.apiGet('/git-credentials/' + generatedKeyId + '/public-key');
-        T.assertHasKey(d, 'public_key', 'public-key response');
-        T.assertHasKey(d, 'fingerprint', 'public-key response');
-        T.assert(d.public_key.length > 0, 'public_key should be non-empty');
-      });
-
-      await T.test('crud', 'workspaces', 'GET /git-credentials (list after generate)', async function () {
-        var d = await T.apiGet('/git-credentials');
-        var found = (d.data || []).find(function (c) { return c.id === generatedKeyId; });
-        T.assert(found, 'generated key should appear in list');
-        T.assert(found.public_key, 'list item should have public_key');
-        T.assert(found.fingerprint, 'list item should have fingerprint');
-      });
-
-      await T.test('crud', 'workspaces', 'DELETE /git-credentials/:id', async function () {
-        var d = await T.apiDelete('/git-credentials/' + generatedKeyId);
-        T.assert(d.deleted === true, 'should return deleted: true');
-        generatedKeyId = null;
-      });
-    }
-
-    await T.test('crud', 'workspaces', 'POST /git-credentials/generate (missing name → 400)', async function () {
-      var token = await T.getAuthToken();
-      var d = await T.authFetch(token, 'POST', '/git-credentials/generate', {});
-      T.assertStatus(d, 400, 'missing name');
-    });
-
-    // ── Workspace CRUD ──
-    var wsId = null;
-    await T.test('crud', 'workspaces', 'POST /workspaces (create)', async function () {
-      var d = await T.apiPost('/workspaces', {
-        name: testTag + '-ws',
-        owner_type: 'user',
-        owner_id: T.user.id
-      });
-      T.assertShape(d, T.S.workspace, 'workspace');
-      T.assert(d.owner_id === T.user.id, 'owner_id mismatch');
-      T.assert(d.status === 'active', 'status should be active');
-      wsId = d.id;
-      T.registerCleanup(function () { if (wsId) return T.safeDelete('/workspaces/' + wsId); });
-    });
-
-    if (wsId) {
-      await T.test('crud', 'workspaces', 'GET /workspaces/:id (read)', async function () {
-        var d = await T.apiGet('/workspaces/' + wsId);
-        T.assertShape(d, T.S.workspace, 'workspace');
-        T.assert(d.id === wsId, 'id mismatch');
-        T.assert(d.name === testTag + '-ws', 'name mismatch');
-      });
-
-      // ── PATCH /workspaces/:id ──
-      await T.test('crud', 'workspaces', 'PATCH /workspaces/:id (update name)', async function () {
-        var d = await T.apiPatch('/workspaces/' + wsId, { name: testTag + '-ws-updated' });
-        T.assertShape(d, T.S.workspace, 'workspace-patched');
-        T.assert(d.name === testTag + '-ws-updated', 'name not updated');
-      });
-
-      // ── root_path must never be exposed ──
-      await T.test('crud', 'workspaces', 'GET /workspaces/:id (no root_path)', async function () {
-        var d = await T.apiGet('/workspaces/' + wsId);
-        T.assert(d.root_path === undefined, 'root_path must not be exposed in API');
-      });
-
-      // ── File operations ──
-      await T.test('crud', 'workspaces', 'GET /workspaces/:id/files (list root)', async function () {
-        var d = await T.apiGet('/workspaces/' + wsId + '/files?path=/');
-        T.assertHasKey(d, 'data', 'ListFiles envelope');
-        T.assert(Array.isArray(d.data), 'files should be array');
-      });
-
-      // mkdir
-      await T.test('crud', 'workspaces', 'POST /workspaces/:id/files/mkdir', async function () {
-        var d = await T.apiPost('/workspaces/' + wsId + '/files/mkdir?path=/testdir', {});
-        T.assert(d.ok === true, 'mkdir should return ok:true');
-        T.assert(d.path === '/testdir', 'path mismatch');
-      });
-
-      // Write a file then read it back
-      await T.test('crud', 'workspaces', 'PUT /workspaces/:id/files/write', async function () {
-        var d = await T.apiPut('/workspaces/' + wsId + '/files/write?path=' + encodeURIComponent('/test.txt'), {
-          content: 'Hello from ICD test runner'
-        });
-        T.assert(typeof d === 'object', 'expected object');
-      });
-
-      await T.test('crud', 'workspaces', 'GET /workspaces/:id/files/read', async function () {
-        var d = await T.apiGet('/workspaces/' + wsId + '/files/read?path=/test.txt');
-        T.assertHasKey(d, 'content', '/ws-file-read');
-        T.assert(d.content === 'Hello from ICD test runner', 'content mismatch');
-      });
-
-      await T.test('crud', 'workspaces', 'GET /workspaces/:id/stats', async function () {
-        var d = await T.apiGet('/workspaces/' + wsId + '/stats');
-        T.assert(typeof d === 'object', 'expected object');
-        T.assertHasKey(d, 'file_count', 'stats.file_count');
-        T.assertHasKey(d, 'total_bytes', 'stats.total_bytes');
-      });
-
-      await T.test('crud', 'workspaces', 'GET /workspaces/:id/index-status', async function () {
-        var d = await T.apiGet('/workspaces/' + wsId + '/index-status');
-        T.assertHasKey(d, 'workspace_id', 'index-status.workspace_id');
-        T.assertHasKey(d, 'status_counts', 'index-status.status_counts');
-        T.assertHasKey(d, 'total_chunks', 'index-status.total_chunks');
-      });
-
-      // ── File cleanup ──
-      await T.test('crud', 'workspaces', 'DELETE /workspaces/:id/files (file)', async function () {
-        try {
-          await T.safeDelete('/workspaces/' + wsId + '/files/delete?path=' + encodeURIComponent('/test.txt'));
-        } catch (e) {
-          if (e.message && e.message.indexOf('404') === -1) throw e;
-        }
-      });
-
-      await T.test('crud', 'workspaces', 'DELETE /workspaces/:id', async function () {
-        await T.safeDelete('/workspaces/' + wsId);
-        wsId = null;
-      });
-    }
-
-    // ── Workspace isolation: other user cannot access ──
-    // Create workspace as running admin user, try to access from fixture regular user
-    if (T.fixtures.ready) {
-      var fixtureUser = T.getFixtureUser('-user');
-      if (fixtureUser && fixtureUser.token) {
-        var isolWsId = null;
-
-        await T.test('crud', 'workspaces', 'isolation: create admin workspace', async function () {
-          var d = await T.apiPost('/workspaces', {
-            name: testTag + '-iso-ws',
-            owner_type: 'user',
-            owner_id: T.user.id
-          });
-          T.assertShape(d, T.S.workspace, 'workspace-iso');
-          isolWsId = d.id;
-          T.registerCleanup(function () { if (isolWsId) return T.safeDelete('/workspaces/' + isolWsId); });
-        });
-
-        if (isolWsId) {
-          await T.test('crud', 'workspaces', 'isolation: user cannot GET other workspace', async function () {
-            var d = await T.authFetch(fixtureUser.token, 'GET', '/workspaces/' + isolWsId);
-            T.assert(d._status === 403, 'expected 403, got ' + d._status);
-          });
-
-          // cleanup
-          await T.test('crud', 'workspaces', 'isolation: cleanup admin workspace', async function () {
-            await T.safeDelete('/workspaces/' + isolWsId);
-            isolWsId = null;
-          });
-        }
-      }
-    }
-
-  };
-})();

packages/icd-test-runner/js/fixtures.js

@@ -17,11 +17,11 @@
   T.provisionFixtures = async function () {
     var fixtures = T.fixtures;
     if (fixtures.ready) {
-      if (typeof UI !== 'undefined') UI.toast('Fixtures already provisioned — tear down first', 'warning');
+      console.log('[ICD] Fixtures already provisioned — tear down first');
       return;
     }
     if (T.user.role !== 'admin') {
-      if (typeof UI !== 'undefined') UI.toast('Admin required to provision fixtures', 'error');
+      console.log('[ICD] Admin required to provision fixtures');
       return;
     }
 
@@ -72,13 +72,11 @@
     } catch (e) { errors.push('Group: ' + e.message); }
 
     fixtures.ready = true;
-    if (typeof T.renderFixtures === 'function') T.renderFixtures();
 
     if (errors.length > 0) {
-      if (typeof UI !== 'undefined') UI.toast('Fixtures created with ' + errors.length + ' errors', 'warning');
+      console.warn('[ICD] Fixtures created with ' + errors.length + ' errors', errors);
-      console.warn('Fixture errors:', errors);
     } else {
-      if (typeof UI !== 'undefined') UI.toast('Fixtures provisioned (' + fixtures.users.length + ' users, team, group)', 'success');
+      console.log('[ICD] Fixtures provisioned (' + fixtures.users.length + ' users, team, group)');
     }
   };
 
@@ -91,8 +89,7 @@
       try { await T.safeDelete('/admin/users/' + fixtures.users[i].id); } catch (e) { /* ok */ }
     }
     T.fixtures = { ready: false, users: [], team: null, group: null };
-    if (typeof T.renderFixtures === 'function') T.renderFixtures();
+    console.log('[ICD] Test fixtures torn down');
-    if (typeof UI !== 'undefined') UI.toast('Test fixtures torn down', 'info');
   };
 
   T.getFixtureUser = function (suffix) {

packages/icd-test-runner/js/framework.js

@@ -1,40 +1,13 @@
 /**
  * ICD Test Runner — Framework
- * DOM helpers, assertion library, ICD shapes, API wrappers, test harness.
+ * Assertion library, ICD shapes, API wrappers, token capture.
+ * (DOM helpers and test harness removed — runner now uses sw.testing)
  */
 (function () {
   'use strict';
   var T = window.ICD;
   if (!T) return;
 
-  // ─── DOM Helpers ────────────────────────────────────────────
-
-  T.esc = function (s) {
-    var el = document.createElement('span');
-    el.textContent = String(s);
-    return el.innerHTML;
-  };
-
-  T.$ = function (tag, attrs, children) {
-    var el = document.createElement(tag);
-    if (attrs) Object.keys(attrs).forEach(function (k) {
-      if (k === 'className') el.className = attrs[k];
-      else if (k === 'style' && typeof attrs[k] === 'object')
-        Object.assign(el.style, attrs[k]);
-      else if (k.indexOf('on') === 0)
-        el.addEventListener(k.slice(2).toLowerCase(), attrs[k]);
-      else el.setAttribute(k, attrs[k]);
-    });
-    if (children) {
-      if (!Array.isArray(children)) children = [children];
-      children.forEach(function (c) {
-        if (typeof c === 'string') el.appendChild(document.createTextNode(c));
-        else if (c) el.appendChild(c);
-      });
-    }
-    return el;
-  };
-
   // ─── Assertion Library ──────────────────────────────────────
 
   function assertType(val, type, path) {
@@ -126,49 +99,11 @@
 
   var S = T.S;
 
-  S.channel = { id: 'string', title: 'string', type: 'string', created_at: 'string', updated_at: 'string' };
-  S.channelFull = {
-    id: 'string', user_id: 'string', title: 'string', type: 'string',
-    ai_mode: 'string?', topic: 'string?',
-    description: 'string?', model: 'string?', provider_config_id: 'string?',
-    system_prompt: 'string?', is_archived: 'bool', is_pinned: 'bool',
-    folder: 'string?', folder_id: 'string?', project_id: 'string?', workspace_id: 'string?',
-    tags: 'array', created_at: 'string', updated_at: 'string'
-  };
-  S.channelModel = { id: 'string', channel_id: 'string', model_id: 'string', is_default: 'bool', created_at: 'string' };
-  S.message = { id: 'string', channel_id: 'string', role: 'string', content: 'string', created_at: 'string' };
-  S.persona = { id: 'string', name: 'string', scope: 'string', created_at: 'string', updated_at: 'string' };
-  S.note = { id: 'string', title: 'string', created_at: 'string', updated_at: 'string' };
-  S.project = {
-    id: 'string', name: 'string', scope: 'string', owner_id: 'string',
-    is_archived: 'bool', created_at: 'string', updated_at: 'string',
-    description: 'string?', color: 'string?', icon: 'string?',
-    team_id: 'string?', workspace_id: 'string?', settings: 'object?',
-    channel_count: 'number?', kb_count: 'number?', note_count: 'number?'
-  };
-  S.kb = {
-    id: 'string', name: 'string', scope: 'string',
-    embedding_config: 'object', document_count: 'number',
-    chunk_count: 'number', total_bytes: 'number', status: 'string',
-    created_at: 'string', updated_at: 'string'
-  };
-  S.folder = { id: 'string', name: 'string', created_at: 'string' };
-  S.workspace = { id: 'string', name: 'string', owner_type: 'string', owner_id: 'string', status: 'string', created_at: 'string', updated_at: 'string' };
-  S.gitCredSummary = { id: 'string', name: 'string', auth_type: 'string', created_at: 'string' };
   S.notification = { id: 'string', type: 'string', title: 'string', read: 'bool', created_at: 'string' };
-  S.memory = { id: 'string', scope: 'string', owner_id: 'string', key: 'string', value: 'string', confidence: 'number', status: 'string', created_at: 'string', updated_at: 'string' };
+  S.profile = { id: 'string', username: 'string', email: 'string', role: 'string?', settings: 'object', created_at: 'string' };
-  S.profile = { id: 'string', username: 'string', email: 'string', role: 'string', settings: 'object', created_at: 'string' };
   S.surface = { id: 'string', title: 'string', source: 'string', enabled: 'bool' };
   S.surfaceNav = { id: 'string', title: 'string', route: 'string' };
   S.surfaceAdmin = { id: 'string', title: 'string', manifest: 'object', enabled: 'bool', source: 'string', installed_at: 'string', updated_at: 'string' };
-  S.providerConfig = { id: 'string', name: 'string', provider: 'string', scope: 'string' };
-  S.safeConfig = { id: 'string', name: 'string', provider: 'string', is_active: 'bool', has_key: 'bool' };
-  S.catalogModel = { model_id: 'string', provider: 'string' };
-  S.modelEnabled = { id: 'string', model_id: 'string', display_name: 'string', model_type: 'string', source: 'string', provider_config_id: 'string', provider_name: 'string', provider_type: 'string', capabilities: 'object', scope: 'string', is_persona: 'bool', hidden: 'bool' };
-  S.modelPreference = { id: 'string', user_id: 'string', model_id: 'string', provider_config_id: 'string', hidden: 'bool', sort_order: 'number', created_at: 'string', updated_at: 'string' };
-  S.task = { id: 'string', name: 'string', task_type: 'string', schedule: 'string', is_active: 'bool', created_at: 'string' };
-  S.taskFull = { id: 'string', owner_id: 'string', name: 'string', task_type: 'string', scope: 'string', schedule: 'string', timezone: 'string', is_active: 'bool', max_tokens: 'number', max_tool_calls: 'number', max_wall_clock: 'number', output_mode: 'string', run_count: 'number', created_at: 'string', updated_at: 'string' };
-  S.taskRun = { id: 'string', task_id: 'string', status: 'string', started_at: 'string' };
   S.workflow = { id: 'string', name: 'string', slug: 'string', entry_mode: 'string', is_active: 'bool', created_at: 'string', updated_at: 'string' };
   S.workflowStage = { id: 'string', workflow_id: 'string', ordinal: 'number', name: 'string', history_mode: 'string', created_at: 'string', surface_pkg_id: 'string?' };
   S.workflowVersion = { id: 'string', workflow_id: 'string', version_number: 'number', created_at: 'string' };
@@ -179,53 +114,9 @@
   S.group = { id: 'string', name: 'string' };
   S.extension = { id: 'string', title: 'string', type: 'string', version: 'string', tier: 'string', enabled: 'bool', is_system: 'bool', scope: 'string', source: 'string', installed_at: 'string', updated_at: 'string' };
   S.auditEntry = { id: 'string', action: 'string', created_at: 'string' };
-  S.file = { id: 'string', filename: 'string', content_type: 'string', origin: 'string', created_at: 'string' };
-  S.participant = { id: 'string', channel_id: 'string', participant_type: 'string', role: 'string', joined_at: 'string' };
   S.adminUser = { id: 'string', username: 'string', role: 'string', created_at: 'string' };
   S.loginResponse = { access_token: 'string', refresh_token: 'string' };
 
-  // ─── Test Harness ───────────────────────────────────────────
-
-  T.registerCleanup = function (fn) { T.cleanup.push(fn); };
-
-  T.runCleanup = async function () {
-    for (var i = T.cleanup.length - 1; i >= 0; i--) {
-      try { await T.cleanup[i](); } catch (e) { /* best effort */ }
-    }
-    T.cleanup = [];
-  };
-
-  T.test = async function (tier, domain, name, fn) {
-    var t0 = performance.now();
-    var entry = { tier: tier, domain: domain, name: name, status: 'pass', duration: 0, detail: '' };
-    try {
-      await fn();
-    } catch (e) {
-      if (e && e._skip) {
-        entry.status = 'skip';
-        entry.detail = String(e.message || 'skipped');
-      } else {
-        entry.status = 'fail';
-        entry.detail = String(e && e.message ? e.message : e);
-      }
-    }
-    entry.duration = Math.round(performance.now() - t0);
-    T.results.push(entry);
-    if (typeof T.renderProgress === 'function') T.renderProgress();
-    return entry;
-  };
-
-  /**
-   * Skip a test with a reason. Call inside a T.test() fn body.
-   * Skipped tests appear in results as status='skip' — not pass, not fail.
-   * @param {string} reason — why this test was skipped
-   */
-  T.skip = function (reason) {
-    var e = new Error(reason || 'skipped');
-    e._skip = true;
-    throw e;
-  };
-
   // ─── API Wrappers ───────────────────────────────────────────
   // Raw fetch — kernel provides no global API wrappers; extensions use fetch directly.
 
@@ -263,7 +154,6 @@
 
   T.captureAuthToken = async function () {
     if (_capturedToken) return _capturedToken;
-    // v0.37.14: read directly from localStorage (old API._get interceptor removed)
     _capturedToken = getAuthTokenFromStorage();
     return _capturedToken;
   };
@@ -403,4 +293,5 @@
     return data;
   };
 
+
 })();