# Work OS V2 - Prototype to Product Handoff

Date: August 9, 2026

## What the prototype is

The clickable prototype is the selected interaction design for the existing
Work OS product. It is not a second product and it does not replace the current
data, graph, orchestration, or receipt substrate.

The production target is the `/operator` React tree in
`artifacts/command-center/src/operator/`.

## The product contract

Every consequential object retains one causal chain:

`consequence -> proof -> your word -> machine work -> outcome -> receipt`

The furniture is fixed:

- line;
- watch;
- field;
- selected causal line;
- tape;
- one drawer;
- mobile machine strip.

No production arc may add a page, assistant pane, permanent navigation rail, or
parallel run model.

## Existing substrate to reuse

| Prototype behavior | Production owner |
| --- | --- |
| Four-band field | `/work-os/briefing` and `src/operator/room/` |
| Tape and traces | `/work-os/stream`, run events, and receipts |
| Open words and gates | `/orchestration/interventions` |
| Resolve a gate | `POST /orchestration/interventions/:id/resolve` |
| Effort state | canonical orchestration runs, steps, attempts, events |
| Stop and retry | existing run cancel and retry endpoints |
| Source depth | Notion page content plus native pointers |
| Requested versus actual | effect request plus immutable receipts |
| Mail read and draft | bridge contract only |

## Production build order

### Arc 1 - Word

Build `say it`, dynamic option consequences, maybe judgments, reopened
judgments, and append-only corrections first. This is the smallest real write
and every later arc depends on the same receipt grammar.

### Arc 2 - Work

Build editable effort proposals, approval, factual progress, stop/resume,
foreman checks, named rejection, run replay, and result receipts on the
canonical orchestration model.

### Arc 3 - Memory

Build the Dig, sourced deltas, promises kept and undone, learned arithmetic,
correction history, and source-coverage failure states.

### Arc 4 - Custody

Build tracked draft review, exact effect confirmation, bridge draft placement,
requested-versus-actual provider receipt, weekly close, and append-only reopen.
No mail-send control exists.

### Arc 5 - Daily driver

Bind keyboard and focus return, both themes, reduced motion, 390px behavior,
real-data browser verification, deployment, and production acceptance evidence.

## Component boundaries

- `CausalRow`: collapsed row contract and selected six-station expansion.
- `WordStation`: options, say-it, verbatim answer, machine read, reopen.
- `MachineStation`: factual state, current unit, trace.
- `Tape`: did/saw/thinks filter, room events, raw receipt.
- `DepthDrawer`: one shell with typed content variants.
- `EffortBlueprint`: proposal and replay over the same node map.
- `DraftCustody`: review, exact effect, provider receipt.
- `WeeklyClose`: computed ledger, stamp, reopen history.
- `CapabilityProposal`: failure, rehearsal, grant, execution, expiry.

## Safety invariants

- Fail closed on missing, stale, denied, or conflicting evidence.
- Nathan's words and the machine's interpretation are separate records.
- Judgments and corrections append; they never overwrite history.
- Progress uses factual stage and units, never invented percentages.
- Prepared is not sent.
- A Gmail draft is not a sent email.
- Every claimed action reaches a trace and receipt.
- Every unavailable action explains why.
- Model-composed suggestions never execute themselves.

## Test contract

For every production arc:

1. reducer or grammar tests for each new transition;
2. API contract and idempotency tests for each write;
3. browser assertions on durable visible state, not toast text;
4. both themes at 1440 and 390px;
5. keyboard-only core path and focus return;
6. source, failure, and deliberate non-action visible in the receipt;
7. drift lint and root test suite green.

## Prototype evidence

The current self-contained prototype passes 36 automated browser checkpoints
with zero console errors and no horizontal overflow at 1440px or 390px.

The expanded control audit adds 153 checks across 28 isolated scenarios:

- all 44 declared controls exercised;
- eight command parse classes verified;
- actionable Dig coverage, kept and undone promises, and native-pointer boundary;
- people court table, changesets, local verbs, and related-object return;
- five-second snooze undo by pointer and keyboard, including expiry;
- keyboard and focus-return paths verified;
- both themes and reduced motion verified;
- 390, 768, 1200, and 1440px checked;
- local-only network requests;
- no browser console errors.