100 lines
5.2 KiB
Markdown
100 lines
5.2 KiB
Markdown
---
|
|
name: cto-hermes-webui-control-panel-prd
|
|
tier: local
|
|
status: draft
|
|
owner: jp
|
|
source: .sot/03-PROTOCOLS/CTO-HERMES-REAL-REFRESH-CONTROL-REPLAY-EVIDENCE.md
|
|
created: 2026-06-01
|
|
last_reviewed: 2026-06-01
|
|
lifecycle_classification: planning
|
|
core_promotion_status: not-promoted
|
|
description: Child-local PRD for a Hermes WebUI consumer panel over the CTO Harness control summary.
|
|
---
|
|
|
|
# CTO Hermes WebUI Control Panel PRD
|
|
|
|
Local planning SOT only. Not a Core Protocol. Not active Core authority.
|
|
|
|
## Problem Statement
|
|
|
|
Hermes now has a machine-readable CTO Harness control summary with Stage 6 real-governed refresh evidence. The operator still needs a visual control surface that can show the proof state, replay paths, blocked lanes, read-only target proof, and runtime-default status without opening raw JSON by hand.
|
|
|
|
## Solution
|
|
|
|
Add a bounded Hermes WebUI consumer panel through the existing Hermes extension/plugin surface. The panel must read the Harness-backed summary contract and render evidence state only. Hermes controls visibility and replay. Cortex remains SOT authority. CTO routes. Harness proves. Case remains a gated adapter and is not activated by the panel.
|
|
|
|
## Scope
|
|
|
|
- Add a WebUI-visible CTO Harness panel or endpoint consumer through the Hermes-owned extension/plugin surface.
|
|
- Read the existing `webui-summary.json` contract or a Harness summary command result.
|
|
- Display Stage 6 real-governed refresh status.
|
|
- Display refresh comparison artifact path, real Stage 5 pass report path, and Stage 5 proof path.
|
|
- Display target repository read-only proof status.
|
|
- Display candidate-default refresh eligibility separately from runtime default activation.
|
|
- Display Codex/Pi blocked-lane rationale.
|
|
- Display next operator action.
|
|
- Keep all source data Harness-backed.
|
|
|
|
## Non-Goals
|
|
|
|
- Do not edit upstream `hermes-webui`.
|
|
- Do not edit upstream `hermes-agent`.
|
|
- Do not activate Case as default backend.
|
|
- Do not add approval, mutation, deploy, push, merge, close, PR open, or issue-close actions.
|
|
- Do not rerun Case or mutate a Target Repository from the panel.
|
|
- Do not expose secrets, endpoints, credential values, or raw Target Repository content.
|
|
- Do not promote child-local CTO artifacts into Core.
|
|
|
|
## User Stories
|
|
|
|
1. As JP, I want a CTO Harness panel in Hermes, so that I can inspect real-refresh proof quickly.
|
|
2. As Hermes, I want to render a stable summary contract, so that the UI does not reinterpret raw backend logs.
|
|
3. As CTO, I want target read-only proof visible, so that real-repo protection is prominent.
|
|
4. As Harness, I want replay links/paths visible, so that evidence can be audited.
|
|
5. As Cortex, I want runtime default activation shown as false, so that visual control cannot create authority drift.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] PRD requires the panel to use the Hermes-owned extension/plugin surface, not upstream `hermes-webui` or `hermes-agent` edits.
|
|
- [ ] PRD requires Harness-backed summary data as the source of truth.
|
|
- [ ] PRD requires Stage 6 real-governed refresh status to be visible.
|
|
- [ ] PRD requires replay paths for refresh comparison, real Stage 5 pass report, and Stage 5 proof.
|
|
- [ ] PRD requires target repository read-only proof status to be visible.
|
|
- [ ] PRD separates candidate-default refresh eligibility from runtime default activation.
|
|
- [ ] PRD requires blocked Codex/Pi lane rationale to be visible.
|
|
- [ ] PRD forbids mutation actions, default activation, upstream source edits, Core promotion, target mutation, and secret exposure.
|
|
- [ ] Local CTO validator checks the PRD and issue artifact.
|
|
|
|
## Validation
|
|
|
|
Planning validator: `python3 tools/validate_cto_child.py`.
|
|
|
|
Implementation validation must use the relevant Hermes extension/plugin validator or a small deterministic contract validator. If WebUI runtime validation is unavailable, the implementation must at minimum validate the endpoint/rendered data contract without editing upstream code.
|
|
|
|
## Risks
|
|
|
|
- A visual panel may imply authority if default activation is not shown as false.
|
|
- A panel may expose too much if it renders raw target content instead of artifact paths.
|
|
- Editing upstream WebUI would violate the Hermes extension boundary.
|
|
- Building mutation controls now would overreach the evidence surface.
|
|
|
|
## Dependencies
|
|
|
|
- `CTO-WORK-057` control summary real-refresh replay evidence is validated.
|
|
- Hermes extension/plugin surface exists for WebUI additions.
|
|
- CTO Harness `webui-summary.sh --json` remains validated.
|
|
|
|
## Challenge Notes
|
|
|
|
Accepted feedback: This is now worth doing because the machine-readable summary contract exists and is validated.
|
|
|
|
Accepted feedback: The panel must be read-only and replay-oriented; approval and mutation controls require a later governed route.
|
|
|
|
Rejected feedback: Editing upstream `hermes-webui` is not acceptable because Hermes customizations belong in the extension/plugin surface.
|
|
|
|
Rejected feedback: Calling this complete from the CLI summary alone is insufficient because the endgoal explicitly requires Hermes visualization/ease of control.
|
|
|
|
## Success Definition
|
|
|
|
This slice succeeds when CTO has a validated route for adding a read-only Hermes WebUI consumer panel over the CTO Harness summary, preserving Cortex authority, Harness proof, target protection, and runtime default activation false.
|