---
name: cto-hermes-webui-control-panel-prd
tier: local
status: draft
owner: jp
source: .sot/03-PROTOCOLS/CTO-HERMES-REAL-REFRESH-CONTROL-REPLAY-EVIDENCE.md
created: 2026-06-01
last_reviewed: 2026-06-01
lifecycle_classification: planning
core_promotion_status: not-promoted
description: Child-local PRD for a Hermes WebUI consumer panel over the CTO Harness control summary.
---

# CTO Hermes WebUI Control Panel PRD

Local planning SOT only. Not a Core Protocol. Not active Core authority.

## Problem Statement

Hermes now has a machine-readable CTO Harness control summary with Stage 6 real-governed refresh evidence. The operator still needs a visual control surface that can show the proof state, replay paths, blocked lanes, read-only target proof, and runtime-default status without opening raw JSON by hand.

## Solution

Add a bounded Hermes WebUI consumer panel through the existing Hermes extension/plugin surface. The panel must read the Harness-backed summary contract and render evidence state only. Hermes controls visibility and replay. Cortex remains SOT authority. CTO routes. Harness proves. Case remains a gated adapter and is not activated by the panel.

## Scope

- Add a WebUI-visible CTO Harness panel or endpoint consumer through the Hermes-owned extension/plugin surface.
- Read the existing `webui-summary.json` contract or a Harness summary command result.
- Display Stage 6 real-governed refresh status.
- Display refresh comparison artifact path, real Stage 5 pass report path, and Stage 5 proof path.
- Display target repository read-only proof status.
- Display candidate-default refresh eligibility separately from runtime default activation.
- Display Codex/Pi blocked-lane rationale.
- Display next operator action.
- Keep all source data Harness-backed.

## Non-Goals

- Do not edit upstream `hermes-webui`.
- Do not edit upstream `hermes-agent`.
- Do not activate Case as default backend.
- Do not add approval, mutation, deploy, push, merge, close, PR open, or issue-close actions.
- Do not rerun Case or mutate a Target Repository from the panel.
- Do not expose secrets, endpoints, credential values, or raw Target Repository content.
- Do not promote child-local CTO artifacts into Core.

## User Stories

1. As JP, I want a CTO Harness panel in Hermes, so that I can inspect real-refresh proof quickly.
2. As Hermes, I want to render a stable summary contract, so that the UI does not reinterpret raw backend logs.
3. As CTO, I want target read-only proof visible, so that real-repo protection is prominent.
4. As Harness, I want replay links/paths visible, so that evidence can be audited.
5. As Cortex, I want runtime default activation shown as false, so that visual control cannot create authority drift.

## Acceptance Criteria

- [ ] PRD requires the panel to use the Hermes-owned extension/plugin surface, not upstream `hermes-webui` or `hermes-agent` edits.
- [ ] PRD requires Harness-backed summary data as the source of truth.
- [ ] PRD requires Stage 6 real-governed refresh status to be visible.
- [ ] PRD requires replay paths for refresh comparison, real Stage 5 pass report, and Stage 5 proof.
- [ ] PRD requires target repository read-only proof status to be visible.
- [ ] PRD separates candidate-default refresh eligibility from runtime default activation.
- [ ] PRD requires blocked Codex/Pi lane rationale to be visible.
- [ ] PRD forbids mutation actions, default activation, upstream source edits, Core promotion, target mutation, and secret exposure.
- [ ] Local CTO validator checks the PRD and issue artifact.

## Validation

Planning validator: `python3 tools/validate_cto_child.py`.

Implementation validation must use the relevant Hermes extension/plugin validator or a small deterministic contract validator. If WebUI runtime validation is unavailable, the implementation must at minimum validate the endpoint/rendered data contract without editing upstream code.

## Risks

- A visual panel may imply authority if default activation is not shown as false.
- A panel may expose too much if it renders raw target content instead of artifact paths.
- Editing upstream WebUI would violate the Hermes extension boundary.
- Building mutation controls now would overreach the evidence surface.

## Dependencies

- `CTO-WORK-057` control summary real-refresh replay evidence is validated.
- Hermes extension/plugin surface exists for WebUI additions.
- CTO Harness `webui-summary.sh --json` remains validated.

## Challenge Notes

Accepted feedback: This is now worth doing because the machine-readable summary contract exists and is validated.

Accepted feedback: The panel must be read-only and replay-oriented; approval and mutation controls require a later governed route.

Rejected feedback: Editing upstream `hermes-webui` is not acceptable because Hermes customizations belong in the extension/plugin surface.

Rejected feedback: Calling this complete from the CLI summary alone is insufficient because the endgoal explicitly requires Hermes visualization/ease of control.

## Success Definition

This slice succeeds when CTO has a validated route for adding a read-only Hermes WebUI consumer panel over the CTO Harness summary, preserving Cortex authority, Harness proof, target protection, and runtime default activation false.