feat(workflows): author checks, typed decisions, and bounded rework

[Igloczek]

Summary

Workflows grow from an agent sequence into checks, typed decisions, bounded rework and human review in the same Graph editor. Canonical server validation, routing and persisted execution evidence remain authoritative.

Implementation → Check → ordered All/Any decision
                       → repeat once / explicit limit destination
                       → human review → End

Refs #27 and parent #3. Layer 3/5: #30 → #31 → #34 → #35 → #36. Graph is the editor/run representation; the separate Routes screen was removed at the maintainer’s request. Inspector route controls, Definition exchange, textual direction/status and keyboard controls remain.

Current head 508f50cbc218dcf04db384216dbc69eb11a2cee2 is based on approved #26 6180bd328ebf590fdff9e7162228332ed7fbb3e6, on main 294aa94c427c2bd9690af172f07374bfc9877a9c. The initial rebase preserved all 27 owning files from approved 90c69de. Independent R7 subsequently found an upgrade-specific cached-action defect; this head fixes it. Fresh independent GPT-6-Astra/Gilfoyle R8 and the primary agent approve this exact head with no material findings. R8 reassessed all 27 paths and eight criteria, independently passed the unchanged upgrade probe and owning regression, and confirmed R7-1 is resolved. Its two case executions remain distinct from the writer’s 20. Current-head CI passed; GitHub confirms the draft is mergeable.

Evidence

• Before: Check, Decision, Human gate and their typed/repeat controls were unavailable in the preceding authoring layer. After: eight original before/after images and two motion clips, with capture heads and clip limitations identified.
• Upgrade correction: an older saved gate could retain Request changes after current rules withheld it. Both display and command authorization now derive actions from the existing canonical rules when decoding persisted runs and command receipts. Reads do not write storage, change revisions/history/counters or launch work. The original real parent-service → current-service regression failed before the fix and passes unchanged now.
• Fresh correction checks: 20 passing case entries — eight owning decision cases, nine existing run/recovery cases, two complete authenticated client principals and the unchanged upgrade regression. Their scopes overlap; these are not 20 new feature suites. The new owning regression also failed before the fix. It changes only the demonstrated legacy cached metadata on a real service-created gate, then verifies reads/streams/receipt replay/refusals preserve exact raw run, command, event and outbox rows. Valid approval/idempotent replay and terminal restart remain correct, with zero launches.
• Prepared server/workflows types, formatting/lint of both changed paths and the complete layer diff check pass. No lint warnings or errors on those paths. All original backend and client assertions remain; principals retain 135/209 sites. Other 25 owning files, UI, helpers, schema, dependencies and configs are unchanged by this correction. Previous nine-case main-compatibility checks and historical units/format/lint remain separately attributed reuse.
• Earlier accepted fixes preserve empty Check arguments without allowing invalid trailing lines and exact 1.5-minute display before Save/reload with persisted/runtime 90000 ms. Typed fields/operators come from canonical contracts; nested All/Any, first-match, Otherwise and absent-field semantics remain. Server settlement owns actual repeat spending, own-limit exits and whole-run diversion, including refusal of unsafe human transitions.
• Primary real-client evidence, captured at the identified earlier heads: actual Bun check outputs, saved nested predicate and repeat/limit trace, explicit human decision, same-state restart, keyboard controls, responsive inspector and authenticated HTTPS fractional-timeout save/reload. UI source is unchanged by the persisted-decoder correction. Current compiled authenticated client principals pass; no new physical upgrade-client capture at 508f50c is claimed.

Original human usability feedback was negative/inconclusive; it was recorded and the interface simplified to Graph as requested. No positive uncoached comprehension, live provider, hardware touch, second device, relay/tunnel, production bundle, wall-clock timeout expiry or benchmark is claimed. External systems use deterministic replay with real authorization, services, SQL and graph routing. Seven known broad generic PluginPage type errors and historical fixture/heap failures remain disclosed baseline debts, not green results. Parent nonblocking start-dialog selection and thread-link/offline Retry limitations remain.

Merge Danger

Door: two-way. Editor controls are reversible; saved definitions and mutations remain server-owned. Persisted reads only refresh derived action metadata in memory and do not migrate stored history.

Blast Radius: workflows. Typed authoring, canonical bound settlement, persisted action decoding and recorded run evidence. No additional predicate, retry, scheduler or workspace engine.

Implementation: Claude Opus 5.5 / Claude Code and OpenAI GPT-6.1-Sol / Codex. Orchestration, integration and primary verification: GPT-6.1-Sol / Codex in T3 Code. Independent review: GPT-6-Astra / Codex with Gilfoyle; historical rounds also used Claude Opus 5.5 / Claude Code.

[Igloczek]

Original before/after and execution evidence for #27. Independent GPT-6-Astra/Gilfoyle R6 approved 90c69dea8cfdeb982c15ee3d0a9d699500c6156b. Graph/typed-route/run evidence was captured at 413e5b8fba2ed836331c88e5701b8a75bbb1dbf9; the subsequent correction only preserves exact fractional Check timeout entry and is separately captured on the approved head. Actual checks, gate commands and persisted trace are real; no live provider, positive human-comprehension, physical-touch or production-build claim. Original images/videos are unedited.

Before: the reviewed parent #26 exposes Check as read-only and disables the later authoring palette entries.

After: typed nested All/Any, Otherwise and the selected decision stay in the shared Graph inspector. Captured at 413e5b8; these controls are unchanged in 90c69de.

Human changes points back to the actual Check with Repeat once and a separate At limit Human destination. Captured at 413e5b8.

Current-head fractional timeout correction: Save/reload retains 1.5 minutes, corresponding to the canonical 90000ms.

Actual server Check evidence remains distinct from accepted agent claims.

Recorded repeat limit reaches Human with no third Check execution.

Explicit approval completes the persisted Graph; clean capture without the earlier notice overlap.

Labeled narrow Inspector supports the same authored definition without dragging.

Original first-rework recording. The later pointer attempt in this clip is intercepted by a notice; it is not proof of the second limit action, which is shown in the persisted trace and PNG above.

pr34-first-rework-original.mp4

Original explicit approval transition.

pr34-approval-original.mp4

Implementation: Claude Opus 5.5 / Claude Code and GPT-6.1-Sol / Codex. Primary verification and publication: GPT-6.1-Sol / Codex in T3 Code. Independent review: GPT-6-Astra / Codex with Gilfoyle.