Add experimental Jev features: natural-language workflow search and event history review

[rossnelson]

Summary

Two experimental features, both off by default, that use the TypeSafe System One model "Jev". Jev returns typed judgments (choice / yes-no / score) with probabilities. It never generates text. Code finds the candidates, Jev selects, and code builds the result.

nl-search-jev.mp4

1. Natural-language workflow search. An input above the workflow filter bar turns a sentence such as "failed order workflows from yesterday" into the existing filter pills. The frontend builds the visibility query with the existing pipeline, so the model cannot invent an attribute or a value. The pills are the verification step: the user sees what was understood and can edit it.

2. "Review with Jev" on the event history and the timeline. A button scores each row for importance to the workflow outcome. Runs of routine rows collapse into one toggle row. Each run has its own toggle, "Show all events" opens every run, and "Clear review" removes the review. One review is shared by the history and timeline views.

A short screen recording follows in a comment.

How it works

• POST /api/v1/nl-search and POST /api/v1/history-review in ui-server. The TypeSafe client and the two translators are plain Go packages with no Echo or config dependency.
• Both endpoints share one gate, in this order: 404 when off → rate limit → auth header → body limit → validation → DescribeNamespace with the caller's credentials → the paid call. A caller that the Temporal frontend rejects causes zero TypeSafe calls (covered by tests with a bufconn fake frontend).
• Rate limit: a deployment bucket, a per-IP bucket, and a per-caller bucket, with an overflow bucket so token rotation cannot grow the map or evict callers. On by default even when the config has no rateLimit block; rateLimit.disabled: true is the explicit opt-out.
• History review cost control: rows with the same signature share one question (300 identical workflow-task rows cost one question), at most 200 distinct signatures and 4 model requests per call.
• Fail visible: a row with no usable answer always stays visible. A failed batch returns 502 with no partial scores.

Privacy

• Nothing is sent before the user acts (submit / click).
• The history review request holds identifiers only: event type, category, classification, attempt, and names such as activity type, signal name, timer id. No payloads, failure messages, stack traces, user metadata, memo or search-attribute values. A unit test builds a history that contains all of those (plain and base64) and asserts that none reaches the request body, and that the body has a closed key set. markerName is the one name a workflow author can set freely; this is noted in the code.
• The API key stays in ui-server config. Settings expose two booleans only.
• Operators should know that search text and workflow type names go to a third party when they enable the features.

Configuration

typesafe:            # one key per ui-server deployment
  apiKey: ""
  model: jev-latest
  baseUrl: https://api.typesafe.ai
  timeout: 5s
  rateLimit: { disabled: false, requestsPerMinute: 30, burst: 10, deploymentRequestsPerMinute: 300 }
nlSearch:
  enabled: false
historyReview:
  enabled: false

Local: TEMPORAL_TYPESAFE_API_KEY=... pnpm dev:ui-server turns both features on in development.yaml. Docker: TEMPORAL_TYPESAFE_*, TEMPORAL_NL_SEARCH_ENABLED, TEMPORAL_HISTORY_REVIEW_ENABLED.

Testing

• Go: gofmt, go vet, go test -count=1 -race ./... (14 packages pass). httptest fake for TypeSafe, bufconn fake for the Temporal frontend, no network.
• Frontend: pnpm check (0 errors), pnpm lint, pnpm test (270 files, 3487 tests pass), pnpm vite build. New render tests for the search input and the hidden-run row (pnpm check does not detect a missing .svelte import; a render test does).
• Playwright integration: history-review.spec.ts (history + timeline, endpoint mocked).
• Manual, against a local dev server with a real key: search and history review both return 200 in roughly 0.2–0.4 s.

Also in this PR

• Fix: the config refresh goroutine kept looping after Close() (break inside select).
• Retry-After is added to the CORS exposed headers.

Open items before this leaves draft

• The default collapse threshold (0.35) hides completed activities (score ≈ 0.33) as well as bookkeeping rows. 0.20 would hide bookkeeping only. It is a frontend constant; no new model call is needed to change it.
• GROUP BY WorkflowType is not available on standard visibility, so the known-workflow-types hint is empty there; the search then selects a type only from the words in the text.
• The config loader uses html/template, so a key that contains + & < > ' " must be set as a quoted string in a config file. Startup rejects a key that was HTML-escaped.
• Docs for the new config block and environment variables.
• Whether the translator packages should later move to the visibility service so the CLI and SDKs get the same search.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
holocene	Ready	Preview	Sep 26, 2026 1:41pm UTC