ASCEND Primary Interface and Extensible Agent Architecture PRD

Status: Historical implemented PRD — superseded by docs/agent-first-system-design-prd.md Updated: 2026-07-20 Primary owner: ASCEND Scope: Historical ASCEND P0-P2 primary-interface requirements

Archive note: this file preserves the accepted P0-P2 primary-interface scope and qualification criteria. Current product behavior is governed by the Agent-first system PRD, contracts, code, tests, and project progress record.

1. Product Decision

ASCEND is the only normal researcher and operator interface for SDLX. A user defines an objective, follows execution, handles approvals, sees requests for human work, reviews evidence, and controls the next iteration from ASCEND.

Composer, PACE, LabFlow, LabBridge, and PRISM keep Web applications because their owners need to develop Skills and workflows, inspect source records, diagnose integrations, and test modules independently. These applications are Engineering Consoles, not parallel product entry points.

P1 removes the two remaining normal-operation exceptions. Device-defined Human Tasks are rendered and submitted inside ASCEND from their immutable JSON/UI schemas, and committed PRISM reports are read through an ASCEND-owned read-only proxy. LabBridge and PRISM remain the sole owners of those records. Engineering Console links remain available for diagnosis, but no normal operator action requires navigating to another module or copying an internal identifier.

P2 changes the information architecture from an engineering cockpit with a secondary chat panel into a progressively disclosed, mobile-application-style research workspace. Home is the sole interactive work center: context-bound goal conversation and actionable Attention/Human Tasks appear together. The Experiments, Lab, Attention history, Round, Evidence, and Policy surfaces are primarily query and record views, with safety controls retained wherever they must remain immediately reachable. Historical rounds, complete reports, technical lineage, record management, raw traces, and module consoles are reached through successively deeper detail pages rather than displayed together by default. This is the accepted and implemented P2 primary-interface model.

2. Target User Journey

Researcher talks to ASCEND once
  -> ASCEND clarifies only unresolved scientific or governance boundaries
  -> ASCEND creates a Coordination and an immutable first Iteration
  -> Composer selects Skills, knowledge, workflows, and capabilities
  -> package review appears in the ASCEND conversation when policy requires it
  -> PACE and LabFlow execute through LabBridge
  -> Human Tasks appear in ASCEND and return to the same conversation
  -> PACE delivery automatically starts PRISM
  -> PRISM selects analysis Skills and commits an evidence-bound result
  -> ASCEND reads the result and decides next iteration, stop, block, or human review

The user must not visit another module to discover why work stopped, approve a normal lifecycle gate, manually enter an approval reference, or copy a run ID back into ASCEND.

Normal product language uses Experiment for a Coordination and Round for an Iteration. Stable API, persistence, trace, and engineering names remain Coordination and Iteration; the UI does not require a storage migration to use researcher-facing terminology.

3. Authority Boundaries

3.1 ASCEND

ASCEND owns conversation, Coordination and Iteration state, autonomy policy, the global Attention Inbox, operator decisions, concise evidence projections, and the decision to continue or stop. It stores stable references to records owned by other modules.

ASCEND must not:

• contain named experiment, material, device, workflow, or analysis-Skill logic;
• parse native instrument files or select device-specific analysis algorithms;
• mutate another module's database or infer success from UI state;
• ask a user to supply an internal approval or lineage reference that the platform already owns.

ASCEND separates three contracts that must not be collapsed into one form:

• Research Definition: objective, scientific scope, success criteria, and hard constraints. It is immutable within one Coordination lifecycle.
• Governance Policy: autonomy mode, approval gates, iteration limit, parameter bounds, and deterministic stop conditions. It may be revised for an active Coordination and every revision is audited.
• Iteration Candidate: sample/material lineage, hypothesis, and bounded parameters for one experimental round. Every round is immutable.

Changing a Research Definition creates a derived Coordination. The new record may copy and edit the definition and policy, but never copies prior Iterations as if they belonged to the new lifecycle. The source Coordination remains unchanged and is linked by derived_from_coordination_id.

3.2 Composer

Composer is an extensible process-design Agent. It selects versioned Composer Skills, knowledge, workflow modules, and semantic capabilities from their metadata, then emits a validated immutable PACE package.

Composer core must not auto-install a named demo workflow, invent a placeholder sample identity, or choose a device by a hardcoded ID. New experiment families belong in Composer Skills, knowledge, and workflow modules, not Python branches.

3.3 PRISM

PRISM is an extensible data-analysis Agent. It resolves immutable Analysis Skills from delivery metadata and evidence, mounts only those Skills into its sandbox, and commits a structured result plus archive.

PRISM core must not contain experiment-specific parsers or a switch statement over instruments. A new analysis method is delivered as a versioned Analysis Skill with declarative match metadata and tools.

3.4 Execution modules

PACE owns package execution and delivery archives. LabFlow owns deterministic workflow scheduling. LabBridge and controllers own device operations, native protocols, Human Tasks, capability result schemas, and artifact upload. These layers expose typed state and events; they do not make scientific next-round decisions.

3.5 Device source opacity

LabBridge is the only module allowed to know whether a device is backed by physical hardware, a development runtime, or another controller implementation. Every Agent and downstream workflow treats an enabled device as a real device through the same semantic capability contract.

The Agent-facing MCP surface must therefore use an explicit public projection:

• expose device identity, availability, capability schemas, operation state, measured results, and evidence references;
• omit controller IDs, runtime/template names, execution mode, generated scenario inputs, and engineering provenance;
• never expose a full/raw operation or trace endpoint to an Agent;
• write device artifacts under device/capability lineage without a runtime source prefix; and
• keep source-specific metadata available only in the LabBridge Engineering Console and internal registry.

Composer cannot branch a package on device source. PACE and PRISM receive the same result contract regardless of implementation. ASCEND receives only the committed scientific projection from PRISM.

4. Hardcoding Policy

Hardcoding is prohibited when it encodes replaceable laboratory or scientific knowledge in shared runtime code. Prohibited examples include:

• material, experiment, workflow, Skill, device, station, or sample names;
• demo-specific fallback imports;
• caller-entered *_confirmed=true preconditions;
• fabricated identities such as draft_sample;
• UI buttons that ignore an action's declared allowed_decisions;
• public module URLs embedded in a frontend bundle.

The following deterministic code is required and is not considered improper hardcoding:

• schemas, state machines, retry limits, idempotency, and integrity checks;
• safety invariants, authorization rules, and policy bounds;
• canonical protocol enums and localized presentation for those enums;
• capability contracts and versioned demo fixtures outside shared core code.

Runtime extension points are YAML metadata, versioned Skills, workflow modules, capability schemas, Attention events/actions, and deployment configuration.

5. Interface Requirements

5.1 ASCEND daily surface

ASCEND must render:

• conversation and bounded intake;
• current phase and Agent activity;
• package, workflow, Human Task, analysis, failure, and recovery notices;
• every actionable Attention item using its declared decisions;
• concise cross-iteration evidence and immutable downstream references;
• pause, resume, cancel, restart, retry, and policy controls appropriate to the current state.

Engineering Console links are deployment-configured and visually secondary. They are grouped in a compact Console menu beside language selection and open in an ASCEND-owned full-viewport window through fixed same-origin proxy paths. The menu shows service state and exposes fixed, confirmation-gated Start/Stop/Restart operations through the independent SDLX Supervisor; it is not an Experiment lifecycle step.

The normal primary navigation is intentionally small:

Home | Experiments | Lab

About remains a secondary navigation destination. Service administration is a top-bar Console menu, not a navigation destination or research progression requirement.

Home carries a pending-Attention badge and renders all actionable Needs you items inline beside conversation. Needs you is not a separate work tab; completed decisions and Human Tasks remain available through Attention history.

Evidence may become a primary destination only when cross-Experiment search, comparison, or review is a frequent product task. Experiment-owned evidence is otherwise reached from the Experiment workspace. Records, raw Activity/Trace, and Engineering Consoles are never normal primary-navigation peers.

Lab shows the LabBridge-owned spatial map before Take Over, provides a map-edit entry, and replaces the duplicate ASCEND device list with a full-viewport LabBridge device-management entry. Spatial edits and device registry mutations remain owned and validated by LabBridge.

5.2 Progressive disclosure and information hierarchy

ASCEND uses progressive disclosure: frequency, urgency, consequence, and reversibility determine how high information appears. Less common information is not removed; it is available through a stable detail route with browser history, deep links, and preserved list state.

The required hierarchy is:

Level	Surface	Default content
L0	Home	context-bound goal conversation, actionable Needs you, active Experiments, current Agent activity, recent completion, material system problems
L1	Experiment record	timeline, current activity, current Round summary, latest evidence, Pause/Stop and policy-appropriate safety actions
L2	Domain detail	all Rounds, hypothesis and parameters, complete evidence/report, Attention detail, Governance Policy
L3	Technical detail	package, workflow run, loop run, Operation, Analysis Run, Agent trace, correlations, raw JSON
L4	Advanced/Engineering	full Records catalog and delete-all, logs, workflow/Skill/capability administration, simulation administration, downstream Engineering Consoles

Rules:

• Home answers: Does anything need me?, What is running?, What is the Agent doing?, What changed recently?, and Is there a material problem?;
• conversation exists only on Home and has an explicit new-goal or Experiment context selected through a stable URL; Experiment pages remain durable activity/evidence records and link back to that Home context;
• actionable Attention and schema-driven Human Tasks are completed on Home; the Attention route is a read-oriented history rather than a competing work queue;
• desktop Home keeps conversation and Active Experiments in a stable left column, while a separately scrollable Needs you column uses bounded summary cards; selecting a card opens the complete decision or Human Task in an accessible modal, avoiding whole-page reflow as content changes;
• the Conversation context switcher contains New and active Experiments only, and uses the same stable display ID and persisted concise Agent-authored title as the full-width, single-column Active Experiments list;
• message history scrolls independently of a fixed, bounded auto-growing composer. An active Agent turn replaces Send with Stop reply; this cancels the durable turn and runtime Agent task without stopping the Experiment or devices, persists a canceled terminal state, and re-enables Send. A standalone New conversation exposes confirmed Discard when idle; it clears durable ASCEND and Agent-runtime history and starts with a new session ID. The browser response is not blocked on Podman cleanup: empty sessions skip runtime cleanup, while a persisted conversation queues runtime history/sandbox cleanup after the local deletion commits. Experiment-bound conversation is protected from independent discard. Needs you cards show a persisted one- or two-sentence summary plus an explicit review button, with deterministic fallbacks for legacy records;
• Goal conversation has an off-by-default Self-aware switch. The switch persists with the latest turn and clearly states that it exposes filtered project source read-only, not config, runtime data, network, or new execution authority. The backend owns the source-view policy and AgentRun trace; the browser sends only the typed boolean and does not construct filesystem paths or exclusion rules;
• Home and the Experiments header contain no second New Experiment action. The Home New conversation context is the normal creation entry. Experiments is the complete history/management index and exposes deletion only for records the backend projects as terminal and deletable;
• compact status indicators show Conversation phase/Agent activity and pending Attention count. Summary cards render backend-declared decision buttons for quick approval while destructive or rejecting choices retain confirmation;
• a fixed-height Experiment progress strip spans both Home columns and displays the selected round's ASCEND -> Composer -> PACE -> LabFlow -> PRISM handoffs, stage start times, live/final durations and bounded device activity. It is a backend-projected observability surface, not a manual progress funnel; mobile scrolls horizontally and centers the current stage;
• cards provide concise summaries and navigate to dedicated detail routes; drawers or sheets are limited to short previews and simple decisions;
• complex Human Tasks, long forms, complete reports, and technical diagnostics receive dedicated pages rather than nested modal dialogs;
• internal IDs are hidden by default and remain copyable from technical detail;
• navigation must work with browser Back/Forward, direct URLs, keyboard access, and responsive mobile/desktop layouts while preserving selection, filters, and scroll position where practical;
• Advanced/Engineering surfaces are visually separate and may be role-gated, but retaining them must not turn ASCEND into the owner of downstream domain records.
• ASCEND owns native, stable routes for the cross-module engineering projections it aggregates: /experiments/{coordination_id}/trace for read-only lineage and /advanced/records for the governed Records catalog. They use typed public contracts and do not expose manual lifecycle transitions.

The five user-facing phases Working, Needs you, Paused, Completed, and Problem are mutually exclusive state categories, not ordered lifecycle steps. They must not be rendered as a sequential stepper or progress funnel. The separate execution-progress view represents recorded module handoffs inside the selected round and cannot create or enable lifecycle actions. ASCEND shows one current phase plus a human-readable current activity and next expected outcome.

Progressive disclosure must never hide urgent or safety-relevant information. Open Attention, required physical work, verification failure, device/safety problems, experiment blocking, Pause, Stop, and Emergency Stop when applicable remain immediately visible and reachable from every relevant surface.

The Lab route can provide an on-demand camera viewer. Its collapsed state must not mount a media element or fetch video data. Media connects only after an explicit Watch action and is released when the viewer closes or the page becomes hidden. The viewer is observational; Take Over remains the governed capability execution path.

5.3 Attention actions

Every user action crossing a module boundary uses sdlx.attention-event/v1 and sdlx.attention-decision/v1:

• the producer owns durable event delivery and the action handler;
• ASCEND owns presentation, actor identity, decision audit, and retry feedback;
• allowed_decisions is authoritative for rendered controls and backend validation;
• action_id and decision_id provide idempotency and restart reconciliation;
• terminal producer state returns to ASCEND as a new lifecycle event.

No producer-specific approval form is recreated in ASCEND core.

An actionable Attention presentation must expose, directly or through its typed detail projection:

• why human involvement is required now;
• the concrete context, evidence, or governance items the person must address;
• the relevant committed evidence and uncertainty;
• each allowed choice and its consequence;
• a recommended choice when the producer or policy can make one safely;
• what work resumes, remains blocked, or stops after the decision; and
• deadline, physical-work, safety, and irreversibility information when present.

allowed_decisions remains authoritative. Presentation metadata may select a generic label, tone, icon, confirmation requirement, and field schema, but the frontend must not infer a producer lifecycle transition.

5.4 Downstream Engineering Consoles

Each downstream Web application must identify itself as an Engineering Console. It may expose module-local creation, deletion, raw logs, YAML, diagnostics, and test controls. Documentation must state that normal experiment operation and approval happen in ASCEND.

5.5 Context minimization

Each Agent receives the smallest complete context for its authority:

Agent	Receives	Must not receive
ASCEND	Research Definition, policy, Iteration lineage, committed PRISM scientific projection, concise decision history	PRISM Skills, raw delivery archives, PRISM workspace, device/controller implementation
Composer	Objective, hard constraints, current Iteration candidate and hypothesis, selected Composer Skills, public LabBridge capability snapshot	PRISM Skills/results, prior raw evidence, controller implementation, ASCEND conversation history
PRISM	Immutable PACE delivery, evidence files, matching Analysis Skills, run identity	ASCEND policy/conversation, Composer reasoning, next-round authority, controller implementation

PRISM may commit a rich result for its Engineering Console. ASCEND's decision projection is an allowlist containing scientific summary, data quality, metrics, cross-device findings, anomalies, uncertainties, and evidence references. Skill instructions, presentation metadata, workspace paths, and analysis archive internals are excluded from the decision prompt.

5.6 Record management and provenance

Records are managed through their module-owned aggregate roots, not by deleting arbitrary children that would break lineage:

• ASCEND manages Coordinations and standalone ASCEND conversations. Copy creates a derived lifecycle; cancel stops active external work; archive removes a terminal Coordination from the working set without deleting evidence; delete removes ASCEND-owned Iterations, policies, decisions, notifications, and chat links only. A standalone conversation can be deleted independently.
• Composer manages conversations and composition jobs. Active jobs must be canceled before deletion; an approved package referenced by execution remains immutable.
• PACE manages Loop Runs and delivery archives without deleting LabFlow, LabBridge, or PRISM records owned elsewhere.
• LabFlow manages workflow definitions and runs while preserving referenced run evidence.
• LabBridge manages devices, operations, Human Tasks, and artifacts within its own retention rules.
• PRISM manages Analysis Runs, local workspaces, reports, and analysis archives. Deleting a terminal Analysis Run never mutates its source PACE delivery.

Every Engineering Console must provide discoverable cancel/delete controls for its aggregate roots, require confirmation for destructive actions, reject unsafe active deletion, and state which requested records were skipped.

All record lists use the same interaction contract:

• a checkbox is the first column/control for each record;
• the header checkbox selects or clears the currently filtered records;
• a persistent selection toolbar shows the count and exposes Delete selected;
• partial bulk failures retain skipped selections and explain every skip;
• successful deletion selects a sensible adjacent record without resetting the current filter;
• destructive actions require confirmation and never silently cancel active work; and
• configuration assets such as devices, Skills, packages, workflow definitions, policies, and spatial maps are excluded from the global record purge.

ASCEND exposes a Records tab backed by a disposable local lifecycle index for Coordinations and conversations, Composer jobs and conversations, PACE Loop Runs, LabFlow runs, LabBridge Human Tasks and operations, and PRISM Analysis Runs. Every owner returns the shared record-projection/v1 fields plus public correlation identifiers while keeping module-specific details behind its own API. The index contains no raw evidence and can be rebuilt from its owners.

Owner projections are reconciled periodically and on explicit operator demand. Normal reads use the local index and therefore do not block on six service requests. Source availability and last reconciliation time are visible. A record's coordination_id, iteration_id, loop_run_id, and downstream public references form a dependency projection; no cross-database foreign keys are introduced.

Destructive management uses a two-stage contract:

1. ASCEND builds a deletion plan for the selected roots or the complete indexed Coordination chain. The plan groups impact by owner and identifies active roots, lifecycle-protected roots, and external evidence that will remain.
2. Confirmation creates a durable background cleanup job. ASCEND dispatches idempotent owner deletion in dependency order, stores per-record outcomes, marks confirmed deletions in the index immediately, and streams job progress to the UI. Failed or protected items remain visible with their reason.

The normal Experiments index uses this same contract for a terminal Coordination. It reconciles all six owners before planning, shows the affected record and owner counts, and submits coordination_chain with require_all. The job is rejected before dispatch when any owner is unavailable or any linked record is active or lifecycle protected. Deletion runs downstream-first; if an owner later refuses or fails deletion, ASCEND does not delete the Coordination root, so the remaining chain stays discoverable for retry and diagnosis.

Experiments also exposes an explicit experiment-record factory reset for a deliberate clean rebuild. Its confirmation states that all active Agent replies and nonterminal Coordinations will be stopped before deletion. ASCEND first verifies that every record owner is available, propagates cancellation to Composer, PACE, and PRISM as applicable, waits for owner projections to become terminal, and only then creates a factory_reset cleanup job. If any work cannot stop or any owner becomes unavailable, deletion does not start. The cleanup is downstream-first and retains ASCEND experiment roots if a later owner deletion fails. Research-goal presets, system settings, device definitions, Skills, workflow definitions, and other configuration assets remain available so the researcher can immediately launch a fresh Experiment.

A direct terminal-Coordination deletion commits the ASCEND-owned database transaction first and returns immediately; cleanup of its isolated Agent chat sessions runs in the background. This cleanup never delays removal from the working history and never deletes downstream scientific evidence. This compatibility endpoint is not the Experiments management action.

"Delete all records" uses the same plan and job contract, remains subject to every owner's lifecycle checks, and never deletes configuration assets. An owner may delete artifacts that are children of a successfully deleted root; active roots are skipped rather than partially removed. Full scientific archive purging remains a separate governed operation rather than an implicit cascade.

SQLite is the development and single-node storage implementation. A production deployment should use PostgreSQL as the durable system of record, object storage for immutable archives, and an optional Redis cache for locks, rate limits, and ephemeral progress only. Redis must never be the sole store for experiments, decisions, inbox actions, or cleanup jobs.

5.7 Embedded Human Tasks

ASCEND resolves a Human Task only from an Inbox event reference and requests the full task from LabBridge server-to-server. It renders submission_schema, ui_schema, localized labels, defaults, and required_artifacts without device- or process-specific branches. Files flow through ASCEND to LabBridge and its configured object store; omitted required test attachments use LabBridge's explicit dummy-artifact contract. Claim, submit, accept, reject, and cancel continue to be validated and audited by LabBridge. ASCEND stores no second task state.

5.8 Embedded PRISM reports

ASCEND may proxy only reports whose analysis_run_id is linked to one of its Iterations. The proxy is read-only and returns the committed Markdown report; PRISM remains responsible for report generation, archive retention, and run deletion. ASCEND renders the report using the same safe Markdown pipeline as Agent chat and keeps the concise allowlisted result as the only input to its decision Agent.

6. P0 Implementation Scope

This PRD's immediate implementation slice is intentionally narrow:

1. Replace ASCEND's hardcoded module icons with a deployment-configured Engineering Consoles menu.
2. Render Attention controls from allowed_decisions instead of fixed Approve/Reject buttons.
3. Derive package approval provenance server-side when starting PACE; remove the user-entered approval-reference field.
4. Remove Composer's named demo fallback, draft_sample fabrication, and experiment-specific clarification example.
5. Replace LabFlow's fixed protected-workflow ID set with workflow metadata.
6. Mark downstream Web and README surfaces as Engineering Consoles without removing their development and diagnostic capabilities.
7. Add regression tests that prove missing lineage blocks composition, empty pools stay empty, arbitrary metadata can protect a workflow, and ASCEND's public console list is configuration-driven.

7. Acceptance Criteria

P0 is complete when:

1. A researcher can approve or reject a Composer package from ASCEND and start execution without typing or copying an approval reference.
2. An Attention action declaring a non-package decision such as retry or acknowledge renders that decision without an ASCEND code path for the producer.
3. Changing Engineering Console URLs requires configuration only and an empty configuration renders no downstream links.
4. Composer with an empty workflow pool fails explicitly and does not import a demo; a package without a real sample identity is blocked before emission.
5. Composer and PRISM production core contains no names from the ZIF/ORR demo and PRISM continues to resolve analysis behavior from Skill metadata.
6. Any LabFlow workflow can declare itself protected through metadata; no workflow ID is privileged in Python.
7. Downstream consoles are visibly identified as engineering/debug surfaces.
8. Affected backend tests, locale checks, and frontend production builds pass.
9. A Coordination can be copied from any lifecycle state, edited before creation, and traced to its unchanged source.
10. Agent-facing device lists, operations, traces, results, artifacts, and planning snapshots contain no device-source or controller provenance.
11. ASCEND decision prompts contain no PRISM Skill content, presentation profile, workspace path, or raw analysis archive reference.
12. Agent-facing Coordination reads use an allowlist and cannot expose PRISM Skill selection, report presentation, workspace, archive, or callback transport metadata.
13. Intake/model failures remain blocked and unmatched Composer requests do not silently select the first Skill or fabricate sample lineage.
14. Coordinations, conversations, composition jobs, Loop Runs, Human Tasks, and Analysis Runs have module-owned lifecycle controls; active work must be stopped before destructive deletion and retained external evidence is named.
15. A human-visible PACE incident reaches ASCEND through a durable outbox, can be resolved or dismissed from ASCEND, returns idempotently to PACE, and publishes a terminal lifecycle event after restart-safe delivery.
16. A referenced LabBridge Human Task can be completed entirely in ASCEND from its device-defined schema, including typed defaults and artifact upload, without ASCEND containing a device-specific form.
17. A linked committed PRISM report renders in ASCEND through a read-only proxy and unlinked analysis identifiers are rejected.
18. Each module's aggregate-root list supports select-visible and bulk delete with per-record skipped reasons, and active work is never deleted.
19. ASCEND's Records tab aggregates all supported module records and can request deletion of selected records or walk all owner pages while preserving configuration assets and skipping active work.

8. Implementation Record

Implemented through 2026-07-19. The P2 implementation record follows the P0/P1 history below.

• Consolidated the daily interaction model around Home. Home now renders the selected new-goal or Experiment conversation beside the complete actionable Attention/Human Task list, with URL-owned context and focused Attention deep links. The primary navigation is Home, Experiments, and Lab; Home carries the pending count. Experiment pages, Attention history, and other domain routes are query/record surfaces, while server-provided Pause/Stop and deliberate Take over controls remain available for safety. Legacy new-conversation and direct-Attention URLs redirect into the corresponding Home context.

• Stabilized Home under changing workloads. Conversation and Active Experiments form equal-width rows in the left column; conversation, active lists, and the right-side Needs you column have bounded scrolling. Conversation history now scrolls independently of its fixed auto-growing composer, and its New/active context switcher shares stable display IDs and concise Agent-authored titles with the full-width single-column Active Experiments list. Attention defaults to a persisted one- or two-sentence summary with an explicit review button and opens the full producer-declared decision or Human Task in a keyboard-contained, responsive overlay; legacy records receive deterministic bounded fallbacks. Polished live indicators expose Conversation/Attention state, while eligible backend-declared decisions can be applied directly from a summary card without opening details.

• Closed the P2 normal-user journeys with durable, restart-recoverable chat turns and stable history; newly created Coordinations are correlated through the Agent session and open as Experiments without client lifecycle polling.

• Added schema-driven Human Task claim/submit/review/cancel with real artifact upload, normal-route semantic capability Take over through Policy and Operation evidence, and safe inline rendering of complete PRISM reports.

• Corrected Home so Problem work is not duplicated as active work and recent completions remain visible; existing Experiment pages retain their durable conversation surface.

• Added API/migration tests for restart recovery and lineage preservation plus desktop/mobile browser journeys for conversation reload, Human Task, Take over, embedded report, Home projection, and direct Attention navigation.

• Added copy-as-derived Coordination creation with editable Research Definition and Governance Policy, immutable source history, explicit lineage, API tests, and trilingual UI controls.

• Centralized ASCEND autonomy policy profiles and aligned the default iteration limit across intake, API, stored policy, and UI.

• Replaced the process-specific decision prompt rule with a general evidence-bound rule and introduced an allowlisted PRISM-to-ASCEND scientific decision projection.

• Added a LabBridge MCP operation/trace projection that omits controller internals. Device-runtime results and artifact records no longer carry source-specific provenance into PACE or PRISM.

• PRISM verifies the original immutable PACE archive before normalizing storage artifact references in the read-only Agent workspace. This keeps historical deliveries replayable without exposing an old backing-store layout to the analysis Agent or rewriting the committed source archive.

• ASCEND Agent tools now return explicit Coordination, Iteration, and committed analysis projections. PRISM Skill metadata, report presentation, workspace paths, archive URIs, and callback transport details remain available to the Engineering Console but cannot enter the decision Agent context.

• Composer's model context removes local Skill/knowledge paths and LabBridge snapshot source details. Failed ASCEND intake remains blocked, unmatched requests select no Skill, and incomplete sample lineage is rejected instead of being fabricated from module or sample names.

• Coordination deletion removes ASCEND-owned chat and Inbox state while retaining named downstream references. Composer supports cooperative cancel_requested -> canceled job termination before deletion and uses concurrency-safe atomic progress writes. LabBridge permits Human Task deletion only after a terminal state and retains operation and artifact evidence. PRISM's existing terminal Analysis Run deletion remains scoped to its own record and workspace.

• PACE now owns a durable Attention outbox for human-visible incidents. It sends requested/resolved lifecycle events with minimal lineage, accepts idempotent resolve/dismiss decisions from ASCEND, resolves linked TODOs, and exposes outbox list/retry/dispatch APIs for its Engineering Console.

• ASCEND exposes a configuration-driven Engineering Consoles menu through /api/ui-config; an empty list produces no downstream links, and report deep-links resolve from the same deployment configuration.

• The global Attention Inbox renders every action from its declared allowed_decisions. Canonical decisions receive localized presentation, and unknown future decisions remain usable without producer-specific UI code. ASCEND does not synthesize a missing downstream event from polled module state; the owning module remains the sole durable event producer.

• PACE start derives its approval provenance from the terminal Composer review action, or from explicit Coordination policy when review is not required. The operator no longer enters an internal reference.

• Composer no longer imports a demo into an empty pool, fabricates draft_sample, or embeds an experiment-specific clarification example.

• LabFlow protection and draft-template behavior are declared by workflow YAML metadata. Neither its API nor its primary/fallback Web source privileges a workflow ID.

• Composer, PACE, LabFlow, LabBridge, and PRISM identify their Web applications as Engineering Consoles, while their module-local development controls remain available.

• Current backend suites pass: ASCEND 46, Composer 46, PACE 67, LabFlow 76, LabBridge 149 plus 17 subtests, and PRISM 23. All six Web production builds and trilingual locale checks pass after the unified operations changes.

• Historical Coordination reads now use compact projections, view-scoped evidence/activity loading, a bounded newest-first chat page, and client-side request de-duplication. An SSE channel invalidates live Inbox and chat state; a 60-second visibility-aware refresh is retained only as recovery.

• Operator actions are accepted into a durable Attention outbox before remote delivery. The UI immediately reports queued delivery, while the producer's terminal acknowledgement, bounded retries, and restart recovery update the same declared action without blocking the chat surface.

• Deployed browser verification loaded a 20,199-byte compact historical Coordination instead of the 78,966-byte full projection. The initial chat page is bounded to eight latest messages, with explicit older-message paging.

• Two real-process qualifications pass: the existing PACE -> PRISM -> ASCEND restart/replay loop and a new PACE incident -> ASCEND decision -> PACE resolved-event round trip. The restart test uses the current Attention endpoint only; no legacy analysis-event compatibility route is retained.

• Embedded LabBridge Human Tasks in ASCEND using immutable task validation schemas plus the current controller presentation/default projection. Boolean, numeric, enum, text, and artifact fields render generically; uploaded or explicit dummy artifacts use the same owner API and audit trail.

• Added an allowlisted ASCEND proxy for complete linked PRISM reports. The report is rendered with the shared Markdown component while PRISM remains its sole writer and storage owner.

• Added the shared record-projection/v1 contract, module-owned record catalogs, select-visible and bulk-delete controls in all six module consoles, and an ASCEND Records view that aggregates owner health and records on demand. Delete-all requires an explicit confirmation token and preserves every module's active-record guard.

9. P2 Current Frontend Baseline

The 2026-07-18 audit confirms that ASCEND is functionally the normal entry point but is not yet the intended Agent-first workspace:

• web/admin/src/main.tsx is approximately 1,379 lines and owns routing, bootstrap, cache coordination, SSE, polling, API calls, feature views, forms, dialogs, status presentation, and lifecycle action presentation;
• the file contains approximately 44 direct compatibility API calls, 82 local state hooks, and 23 effects;
• BrowserRouter and QueryClientProvider are mounted, but navigation uses manual window.history and feature code does not yet use TanStack Query queries/mutations as the server-state owner;
• TypeScript is configured with strict: false, the compatibility request returns any, and only part of the SPA uses TypeScript;
• conversation and Needs you are docked utility panels beside a Coordination-record cockpit instead of the primary Experiment experience;
• Coordination, Iteration, internal references, raw Activity, and Records are more prominent than their normal-user frequency justifies;
• the UI special-cases take_over, stop, and restart_as_new and maintains local status/tone presentation maps; and
• there is no committed automated browser test suite for the primary journey.

These measurements are an audit baseline, not permanent file-size limits. Completion is determined by the behavioral and architectural acceptance criteria below, not by moving the same code into more files.

10. P2 Hierarchical Interface Delivery

P2 replaces the current information architecture without changing domain authority or requiring a flag-day backend rewrite. Delivery order is:

1. establish route modules, strict generated API types, server-state query ownership, shared UI primitives, and browser regression coverage;
2. introduce Home, Experiments, and Lab navigation while moving actionable Needs you into Home and Records, raw Activity/Trace, and console links to read-oriented history or Advanced/Engineering;
3. replace the record cockpit with a Home conversation-and-decision work center plus dedicated Experiment, Round, Evidence, Attention history, and policy record routes;
4. add Control-owned read projections for Home and Experiment workspace when client-side assembly would otherwise expose internal service records or require multiple blocking downstream reads; and
5. retire compatibility routing, duplicated status/action presentation maps, and obsolete dock-layout behavior after browser migration coverage passes.

Initial Control-owned read projections should cover the semantics of:

Home summary
Experiment workspace
global Attention / Needs you
Lab overview
unified human-readable activity timeline
Attention presentation with consequences, recommendation, resume outcome,
and evidence references

Exact public paths are fixed through OpenAPI during implementation; candidate routes are /api/home, /api/experiments/{id}/workspace, /api/attention, and /api/lab/overview. These are ASCEND read/command projections, not new ownership of Composer, PACE, LabFlow, LabBridge, or PRISM domain records.

P2 is accepted when:

1. a researcher can create and follow an Experiment from conversation without first navigating a technical record form;
2. Home makes all unresolved Attention and material problems discoverable while keeping routine implementation state out of the default view;
3. Home can select any active/recent Experiment conversation, while its Experiment page explains the current activity, latest evidence, next expected outcome, and available safety controls without displaying internal IDs;
4. the five user phases are never rendered as ordered lifecycle stages;
5. every Experiment Round, complete report, Attention, policy revision, and technical lineage remains reachable by a stable detail route;
6. Records, raw traces, cleanup, and downstream consoles are outside normal primary navigation and remain available through Advanced/Engineering;
7. mobile and desktop navigation preserve Back/Forward behavior, direct links, list selection, and safe access to urgent controls;
8. Attention cards render reason, evidence, consequences, recommendation when available, and resume/stop outcome from typed producer/backend data;
9. the primary SPA uses route modules, real server-state query ownership, strict generated API types, and automated browser coverage for the main journey;
10. no downstream database authority, lifecycle decision, or device protocol is moved into ASCEND to implement the unified experience.

The route, contract, strict-TypeScript, query ownership, progressive layout, and normal primary-flow implementation are qualified. The following hard closure journeys now pass without entering the legacy cockpit:

1. a device-defined Human Task can be claimed, completed, uploaded, submitted, accepted, rejected, or canceled from its dedicated Needs you route;
2. a conversation turn is durable across an ASCEND API restart, reloads from its stable session, receives event-driven completion, and navigates to a newly created Experiment when the Agent creates one;
3. an existing Experiment retains a conversation surface and history instead of reducing the workspace to a read-only activity timeline;
4. Take over capability input, policy result, Operation state, and evidence are available on a normal Lab route, and a complete linked PRISM report is safely rendered on a stable ASCEND route; and
5. committed browser/API tests cover Human Task, Take over, report rendering, chat reload/restart recovery, and Home problem/recent-completion projection.
6. a queued or running conversation turn can be stopped from Home, reaches the Agent runtime instead of only changing UI state, remains terminally canceled across late worker results, and does not invoke Coordination or device stop.
7. an idle standalone New conversation can be discarded from Home, removes both ASCEND turn/session state and Agent runtime history, receives a fresh session without waiting on sandbox teardown, and cannot use this path to discard an Experiment-bound conversation.

The browser suite now covers these flows directly rather than treating the previous three route smoke tests as sufficient evidence.

The post-audit convergence pass also makes Problem experiments discoverable in the complete Experiments index, projects Agent/execution/evidence events into the primary timeline, derives the next expected outcome from recorded Agent or round semantics, routes material Take over decisions through the global durable Attention Inbox, distinguishes terminal unverified Operations, and renders typed Human Task UI-schema hints. Stable semantic presentation keys localize dynamic phase/activity/action/status labels without moving lifecycle authority or a transition map into the browser.

Production infrastructure and physical-device certification remain separate fail-closed gates in docs/release-qualification.md.

11. Deferred Work

• Move Engineering Console discovery to a service registry when deployments require dynamic module installation.
• Add cross-process browser qualification for approval, Human Task, PRISM result, cancellation, restart, and retry from ASCEND alone.
• Replace the process-local SSE broker with Redis, NATS, or another durable fan-out transport only when ASCEND is deployed with multiple API instances.

LabBridge does not emit a second workflow-terminal Attention event directly. LabFlow is the authoritative owner of workflow and Human Task blocking lifecycle and already publishes those events with Coordination lineage; duplicating them at the device gateway would create two competing sources. LabBridge remains the source of controller-defined forms and operation evidence.