Document workspace design pass: themes, verdict undo, sandboxed reports, type scale

[cailmdaley]

This is the visual and interaction design pass on the document workspace from #6, together with the security hardening that the pre-merge review required. The UI and daemon ship together: the daemon now adds the sandbox CSP and nosniff headers and the /file-assets route that sandboxed reports load through.

Opus 5.5 on behalf of Cail.

What changes for a person using the board

• Reader. The Desk recedes behind a desaturated veil with slight parallax, and the chrome floats on plates. The filmstrip tabs are thumbnails in recency order, with declared titles and fresh marks. A sidebar lists the cards in the open card's Desk column (c).
• The fiber page leads with the outcome, and its controls follow the Desk column: Temper/Discard while a card awaits review, the composer's verb, history and settings.
• Verdicts. Every verdict goes through one delayed commit with a 6 s undo toast: the worker plate, the fiber page's buttons, t/x, and z to undo. A new verdict on a fiber replaces its pending one. A pending verdict binds to the fiber's uid and owner, and is re-checked against the current card when it commits.
• Overview (Board tab). It opens with what changed since you were here, capped at eight rows with needs you first, then lays out folios in graduated density, grouped by recent work, project or host.
• Per-constitution themes. Four themes are bundled (Portolan, Blueprint, Laboratory Paper, Night Chart), or a fiber can carry a theme.css beside it. Themes are CSSOM-scoped to their channel and stop at the act zone. A Plain item in the page menu drops a theme. See docs/concepts/themes.md.
• Reports run in an opaque-origin sandbox over a versioned bridge. Filenames in a report link to their pages, and audio plays inline.
• Audio page. It has a waveform and A/B compare. [ and ] seek back and forward 5 s, and p plays or pauses.
• Type. A named scale: IBM Plex Mono for data, EB Garamond for names and verbs (11 / 15 / 18–21 / 24 / 34), defined as tokens in tokens.css.
• Phone. The reader runs edge to edge, with one bottom bar and a page sheet. Checked in the iOS Simulator's Mobile Safari.

Overview	Sidebar open	Audio page

Filmstrip on a report	Phone: fiber page	Phone: Mobile Safari

The screenshots come from the fixture harness (npm run harness:board). Live-data shots for every lane, themes included, are in the felt constitution ai-futures/felt/constitutions/document-workspace (shots-6/).

Security

The pre-merge review's two must-fixes, each with a regression test that fails before its fix:

1. A report can't act on its own constitution. The parent re-dispatches only an allowlist of navigation intents from a frame: stepping, scrolling, back, sidebar/find and help. The allowlist sits beside the intents in keymap.ts, so a new intent is excluded by default. Verdicts, undo, compose, conversation, audio transport and expand are refused. The bridge also forwards only trusted key events.
2. Every API response is sandboxed. Content-Security-Policy: sandbox … and X-Content-Type-Options: nosniff are applied to every response whose percent-decoded path starts with /api (and to any path that doesn't decode), whatever the extension. That covers .xml, .svg, unknown types, error bodies, 206/304 responses, and responses relayed from an owner host: the hub sets the headers and doesn't trust the owner's. Matching decoded segments matters because the router decodes them too: /api/v1/fil%65?path=… reaches the file controller. The board page itself is unaffected.

Fix-soons, also landed:

• The one-verdict path described above. It closes a theme painting a fake label over Discard, and the case where x followed by Temper wrote twice.
• Theme @font-face families are renamed per channel, and theme url() may reference only the fiber's folder, data: or Google Fonts.
• The overview no longer fetches theme.css per fiber. Only the open reader loads custom CSS.
• Bridge messages are size-checked, and references messages are capped and rate-limited per frame.

Known limitation. A report at an opaque origin can't fetch() sibling data files. A sample of real reports turned up none that do. The proposed remedy is a bounded parent-bridge fetch, limited to the fiber's own folder and owner, rather than Access-Control-Allow-Origin: null.

Verification

Gates on this head, observed:

• npm test: 1,497 passed under each pinned time zone, on Node 25 locally and Node 22 (CI's runtime).
• npm run typecheck: clean.
• npm run e2e: 81/81; the reference-limit probe passes 6 of 6 runs in isolation.
• mix test test/shuttle_web: 558/558, including 97 file-controller tests.
• make build SKIP_CLI=1: passes.

An independent Opus review (high effort) of the merged hardening and finish diffs confirmed that must-fix #1 is closed, with no other parent-side route around the allowlist. It also confirmed the verdict path, the theme confinement and the merge resolution. Its findings, and what happened to each:

1. Blocker: percent-encoded route spellings skipped the CSP and nosniff. This was a regression from the base, where the controller sandboxed by the path parameter. Fixed (007f0792) by the decoded, default-deny rule above, with an encoded-route test that failed before the fix.
2. The references throttle used the wall clock. A backward jump in Date.now(), from NTP or a report stubbing Date, stalled rescans for hours. This was why the "ambiguous basenames" e2e test was flaky. Fixed (aaff0937): both sides now use performance.now(), the wait is clamped, and the parent defers the newest over-budget batch rather than dropping it.
3. The live-worker confirm fired 6 s after the gesture, which hit every verdict on a Codex-app card. Fixed (d6ed27bd): it now asks at queue time, and the commit is refused with a toast if a worker started during the undo window.
4. A stored Plain choice on a channel with no declared theme couldn't be cleared. Fixed (b7930db3).
5. [ and ] need Option on AZERTY and QWERTZ layouts. Accepted for now; p still plays and pauses.

CI's UI job also caught that 8 workspace integration tests failed under Node 22. The cause was too short a microtask flush in the test harness, present since the earlier design lanes, and it's fixed (5d33379a).

Follow-ups

• The worker plate has no "last step": the daemon doesn't yet serve last_step or turn_active.
• A sibling-data bridge for reports, as proposed above.
• Safari under the CSP sandbox is unverified for native PDF viewing. Chrome was checked.
• A deeper pass on a real iPhone, for media and Back.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LwX9WpuD7VnV6mfmN9eb67