lidge-jun · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026
@@ -0,0 +1,48 @@
+# Release train 4 — GUI UX lane
+
+The current dashboard exposes routed-model facts that still require editing `config.json`, and a combo with a text-only member still requires a manual Vision Sidecar declaration. This lane reviews those focused GUI changes on the live `dev` shape, verifies their actual browser flows, and lands only changes whose state transitions and CI are proven. `001_inventory.md` records the intake snapshot and PR age; each decade document below gives the file-level implementation or disposition contract.
+
+## Loop specification
+
+- **Archetype / trigger / goal:** satisfy the delegated release-train GUI acceptance contract by reviewing seven PRs and three issues, integrating safe lane-owned changes into `dev` with browser, test and CI evidence.
+- **Non-goals:** main/preview, release/version changes, live user home/accounts/service, account-pool and picker lane code, a wholesale #5408 adoption, native GitHub stacks, and security findings in tracked files.
+- **Tool and write scope:** GitHub reads/writes authorized in the delegation; source edits/Git operations in `/Users/jun/.codex/worktrees/t4-gui-ux/opencodex`; docs in this `gui-ux/` directory; focused tests there, with `test:changed`/full suites in a verification-only worktree at `/private/tmp/t4-gui-ux-verify` after the exact commit; isolated proxy homes and distinct local ports via the direct server entrypoint with client integrations OFF; subagents only `gpt-6-sol`; no other-thread messages. No user-imposed token or wall-clock limit.
+- **Verifier:** focused Bun tests for changed behavior, `bun run test:changed`, `bun run typecheck`, `bun run lint:gui`, `bun run build:gui`, `cd gui && bun run lint:i18n` for JSX copy, `cd gui && bun test tests/locale-parity.test.ts` for ten-locale key parity, `bun run privacy:scan`, `bun run structure:check`, `bun run skill:surface:check` when capability maps change, and `bun test tests/ci-workflows/file-size-ratchet.test.ts` for capped files; browser click flows and screenshots for UI states; required PR CI at the exact head and post-merge `dev` CI. Script existence is grounded in root and GUI `package.json`; the locale parity test reads `src/i18n/<locale>.ts` directly (`gui/tests/locale-parity.test.ts:6,229`). `lint:i18n` does not itself inspect locale dictionaries, so translation meaning also needs manual review and browser proof. `bun run test:changed` follows imports but misses subprocess/source-oracle edges, so explicit regression files remain necessary. Seven concurrent worktrees justify the documented full-local-suite contention exception; CI supplies the broad suite.
+- **Stop / outcomes:** DONE when selected PRs are merged with exact-head/post-merge CI and every assigned PR/issue has a linked disposition; NOOP only if current `dev` already satisfies the whole lane; NEEDS_HUMAN for a genuine product/security decision that cannot be inferred; BLOCKED only on a repeated external blocker; UNSAFE when a change fails the security boundary; BUDGET_EXHAUSTED only on an actual user/host bound.
+- **Memory artifact:** this numbered unit, PR Verification bodies, exact-head CI links, and local `.tmp/gui-ux/` screenshots/receipts.
+- **Escalation:** a changed PR head, another lane changing a shared owner, auth/security objections, irreconcilable CI or browser environment, or an unowned external contract changes the disposition before publication.
+
+## Design Read
+
+```yaml
+name: opencodex-dashboard
+colors:
+  primary: "var(--accent)"
+  accent: "var(--amber)"
+  background: "var(--bg)"
+typography:
+  heading: { fontFamily: "var(--font-ui)", fontSize: "var(--text-subtitle)" }
+  body: { fontFamily: "var(--font-ui)", fontSize: "var(--text-body)" }
+iconography:
+  system: "existing OpenCodex controls"
+  weight: "regular"
+  domain: "existing components"
+```
+
+This is an operator dashboard for repeated model and provider work. Preserve compact rows, stable navigation, semantic status color and the existing dialog shell from `gui/design-system/`; add actions where a user is already inspecting the affected model. Never apply an editorial or floating-glass kit. **DESIGN_VARIANCE 3 / MOTION_INTENSITY 1 / density D6.** A save needs a clear committed/no-op/unknown outcome, visible loading state, recovery after timeout, focus restoration, keyboard activation, and readable 400px plus long-locale layout. A restore is a separate explicit action because it discards declarations.
+
+## Ordered work phases and decisions
+
+| Phase | Decision | Why / acceptance |
+|---|---|---|
+| `010` | Carry and repair #6058 on current `dev` | Capability editor is a cohesive lane-owned slice with no merge-tree conflict. Fix remaining fractional-window and persistence-failure concerns, prove model settings save/restore in an isolated proxy and browser, and land after exact-head CI. |
+| `020` | Reimplement #4932 on current `dev` after `010` | Its model modality declaration shares the new editor's provider map. Resolve `combo-routes.ts` against current code, add Vietnamese copy, and prove a mixed combo's sidecar enrollment plus sibling-axis preservation. |
+| `030` | Assess/reimplement #5617 on current `dev` after model changes | Large stale visibility semantic change intersects `model-routes.ts`, `Models.tsx`, catalog, and provider UI. Reimplement only after the account-pool lane finishes the shared provider UI owner, and if global-vs-provider semantics survive current catalog convergence and security review; otherwise leave open with concrete deferral comment. |
+| `040` | Defer auth/config/account PRs and resolve issues | Defer #4649/#4644 pending explicit security review and iOS proof; #5932 overlaps account-pool ownership; #2355 is 2,971 commits old with eight conflicts; #5408 is 7,790 added lines and shares the account-pool domain. Keep #3379 open because selector rename is missing, and clarify #4189's intended provider contract. No auth implementation is in this train. |
+| `050` | Integration and disposition | Build selected branches sequentially from the preceding accepted `dev` merge SHA, rebase to the current `dev` tip, validate file caps/union/ten locales, attach screenshots by `pr-assets` SHA, merge only after required exact-head checks and review findings, verify `dev`, then close solved issues/original PRs with links and credit. |
+
+Each phase is its own PABCD cycle. A later P rechecks this plan against the latest `origin/dev` and may narrow or append a slice with a written reason. `structure/INDEX.md` owns the source-document map; relevant SoT targets are `structure/gui-and-management-api.md`, `structure/dashboard-and-usage.md`, `structure/catalog.md`, and `structure/config.md` when their contracts actually change. User-facing changes update the matching `docs-site/` guide or reference. All new tests are registered in both test-layout inventories. PR screenshots live on `pr-assets`, never in the code PR branch.
+
+## Consultation
+
+Architect handle `01a0e33b-a8a7-7ab3-8682-461189c7d1c8` proposed GUI-01→GUI-02→GUI-03, conditional auth/config work, account-pool handoff for #5932, and wholesale #5408 deferral. I accept its dependency order, but reject its suggestion that the current OAuth account alias editor resolves #3379's Codex selector rename. `CodexAccountPickerSetting.tsx` still only toggles picker visibility; `codexAccountNamespaces` keys still lack a rename API. The issue remains open. Same-architect reflections first found a #3379 wording gap, #5617 owner/rollback gaps, and then #4932/#5617 decision wording and conditional-path gaps. Those were folded into this revision, `020_combo_sidecar.md` and `030_visibility.md`. The same handle's final response was **ALIGNED**, with no material gap in those amended passages. The independent A reviewer remains separate.
@@ -0,0 +1,17 @@
+# GUI UX lane — current intake evidence
+
+Read at `origin/dev` `24b2f39b77` on 2026-09-27. The seven candidate heads were fetched as `t4/pr<N>` for read-only comparison. `git merge-tree --write-tree origin/dev t4/pr<N>` was used to identify textual conflicts without changing the checkout. All candidates target `dev`.
+
+| PR | Head | Commits behind current dev | Merge-tree conflicts | Initial ownership judgment |
+|---|---|---:|---|---|
+| #6058 | `0798999c6f` | 51 | none | Routed model capability editor; lane-owned. Current CodeRabbit finding permits a positive fractional context window that floors to zero. |
+| #5617 | `f65144160d` | 369 | `app-routing.ts`, `Providers.tsx`, `structure/config.md` | Global visibility and provider-local visibility semantics; potentially lane-owned, but must reconcile with the current catalog and Models UX. |
+| #4932 | `99f3abc39f` | 317 | `combo-routes.ts` | Mixed combo Vision Sidecar enrollment; lane-owned. Branch lacks `vi.ts` although current GUI has ten locales. |
+| #4649 | `c9b24c20bf` | 317 | none | Remembered admin token for #4644; lane-owned with an auth/security review gate. |
+| #5932 | `e4387ea001` | 126 | provider workspace `types.ts` | Antigravity account plan presentation; overlaps account-pool lane's provider workspace files. |
+| #2355 | `ec0c68daca` | 2,971 | eight runtime, CLI and GUI files | Config-versus-running-proxy warning; old architecture and broad shared-file collisions. |
+| #5408 | `d4112b3e5d` | 108 | six provider/account files | 7,790 added lines and account-pool overlap; release suitability assessment only per lane assignment. |
+
+Current issue status: #4644, #3379 and #4189 are open. #4644 tracks standalone Safari AutoFill and depends on the security verdict for #4649. #3379 already had journal deletion and custom usage ranges landed; selector naming remains and overlaps the picker/account lane. #4189 conflates ZCode client integration with Z.AI provider login; the existing issue discussion describes both interpretations, but the current code must be checked before disposition.
+
+The candidate files, comments and later `dev` movement are point-in-time evidence. Recheck heads and merge bases immediately before any carry or merge.
@@ -0,0 +1,11 @@
+# Dashboard UX state contract
+
+The lane uses the current OpenCodex design system: one compact row action, the existing dialog/notice primitives, semantic color tokens, no decorative motion. The operator must be able to tell whether a value is inherited, explicitly declared, saved, unsaved, or unknown after a network failure. A default GUI scan cannot prove these states; each is a separate browser or fault-injection activation.
+
+| Flow | Empty / inherited | Loading | Error / recovery | Keyboard and narrow-width proof |
+|---|---|---|---|---|
+| Routed model settings | An unticked modality field means no declaration; show the upstream value it follows. No reasoning ladder must be distinct from inherited ladder. | Save/restore disables duplicate submit and exposes busy text; preserve the current fields. | Validation names the field. A confirmed write with failed catalog refresh says the write happened and offers refresh. An unknown save outcome avoids a false “failed” claim and lets the operator reload. | Tab to row Edit, Enter opens; dialog focus is contained, Escape and Close restore focus when idle. At 400px actions stack without horizontal scrolling, and long German/Russian labels wrap. |
+| Mixed combo | No target or an unknown catalog row gives an explanation and a next action, not an available Image toggle. Known text-only members are named in the hint before save. | Save shows one in-progress state; the target list remains visible for review. | A rejected sidecar target leaves combo/provider config unchanged and shows the server reason; retry is available. | Toggle and Save work by keyboard. The list and hint wrap at 400px, including long locale/model IDs. |
+| Global/provider visibility | A provider with no visible rows distinguishes global hide from local selection and points to the restoring control. | A bounded PUT shows busy state; no switch can become stuck after timeout. | Failed save leaves the previous rendered switch state with retry guidance. | Global scope wording remains clear when rows are grouped by provider; keyboard toggles and 400px filter/action layout remain usable. |
+
+Screenshots for adopted GUI changes cover the pre-change view and the post-change first action, plus at least one narrow/long-locale and one error/empty/loading state. A screenshot is inspected visually, not merely generated. Text content and focus outcome are checked with browser DOM/keyboard actions. Synthetic credentials and models in an isolated home prevent touching the user's running 10100 proxy.
@@ -0,0 +1,16 @@
+# Roadmap audit and baseline proof
+
+The independent reviewer (`01a0e349-7a9f-73f3-a3d1-b32cfdf9de9a`, `gpt-6-sol`) audited the docs-first plan at `dev` `24b2f39b77`. Its first verdict was `GO-WITH-FIXES`: the named i18n command was not a root script and did not inspect locale dictionaries, and Phase 030 omitted catalog/GUI consumers of #5617. Both High blockers were folded. Three Medium gaps were also fixed: Phase 040 now explicitly defers auth work, Phase 050 names the real file-size test and treats layout.json as an inventory, and branches are sequential from the previous accepted `dev` merge. A final one-line summary and NEW-vs-MODIFY path correction were rechecked. The last verdict was **PASS** with no blocking issue.
+
+The same architect (`01a0e33b-a8a7-7ab3-8682-461189c7d1c8`) reflected on the initial plan and later field/consumer and phase-dependency amendments; its final verdict was **ALIGNED**. Main rejected its early inference that an OAuth account alias closes #3379: the requested Codex selector rename remains absent. Explorer findings used for the plan were read-only and tied to PR heads in `001_inventory.md`.
+
+Baseline command evidence in this worktree:
+
+| Command | Result | What it actually observes |
+|---|---|---|
+| `bun run privacy:scan` | pass | Credential/privacy patterns in repository content; rerun after staging docs. |
+| `bun test tests/ci-workflows/file-size-ratchet.test.ts` | first attempt failed: missing `zod/v4`; after `bun install --frozen-lockfile`, 9 pass / 0 fail | Repository file-size cap including `gui/src/pages/Models.tsx`. No baseline was updated. |
+| `cd gui && bun test tests/locale-parity.test.ts` | after GUI frozen install, 5 pass / 0 fail | Reads locale modules directly and checks key-set parity for ten locales; translation meaning still needs human/browser review. |
+| `cd gui && bun run lint:i18n` | not yet run on a changed GUI | Oxlint checks visible JSX copy, not locale dictionary key parity. |
+
+All installs used the committed lockfiles in the lane worktree. No production home, service, token, account, browser session or `dev` branch was touched in this docs-only phase. The `0.2.39` Codexclaw cache path disappeared during the audit; the now-installed `0.2.36` CLI read the same bound session/source and continued with explicit `--session`. That tool drift is not verification of product behavior.
@@ -0,0 +1,5 @@
+# Before-change Models UI observation
+
+At `a60b078cda` (source code from `dev` `24b2f39b77`), a direct `startServer(18761)` call with synthetic `demo` models and isolated OpenCodex/Codex homes served the packaged dashboard. A separate headless Chrome profile opened Models, dismissed the first-run surface, selected Demo and used Expand all. The rendered two rows had visibility, alias, Name and Price controls. Neither row had capability editing. The inspected desktop screenshot is in ignored `.tmp/gui-ux/before-models-desktop.png`; its eventual PR evidence copy must live on `pr-assets`, not the code branch.
+
+The baseline browser interaction verified the live proxy reported version 2.69.0 and showed `demo/text-demo` plus `demo/vision-demo`. The synthetic provider used an unreachable loopback upstream and no real key, so no model request was sent. A CLI startup attempted to synchronize an installed local client despite isolated proxy homes; that process was stopped and its one observed real-home managed endpoint was restored. Operational detail and restoration evidence are kept in ignored `.tmp/gui-ux/qa-isolation-incident.md`. Later QA uses only the direct server entrypoint with local-client integrations explicitly OFF. This observation does not prove any changed UI behavior or iOS Safari behavior.