feat: ship agent-first mission control v0.2.57

2026-07-31 22:39:47 +02:00
parent 3bc7622977
commit f5552218bc
535 changed files with 95242 additions and 8791 deletions
@@ -0,0 +1,180 @@
+# OpenClaw Core Integration — Implementation Evidence
+
+**Stand:** 2026-07-28
+**Scope:** Nexus frontend, authenticated API facade, OpenClaw Gateway transport,
+core-route wiring and operated browser QA.
+
+## Ergebnis
+
+Nexus now has one browser-safe OpenClaw control-plane path:
+
+```text
+Browser
+  -> authenticated Nexus API
+  -> IOpenClawControlService
+  -> IGatewayConnector
+  -> OpenClaw Gateway protocol v4
+  -> provider and tools selected by OpenClaw
+```
+
+The browser never receives an OpenClaw token, password or OpenAI credential.
+OpenClaw remains authoritative for runtime agents, sessions, tasks, approvals,
+cron jobs, models and runtime events. Nexus remains authoritative for users,
+projects, product tasks, notifications and the control-plane UX.
+
+This checkpoint is a functional vertical slice, not yet proof that the deployed
+OpenClaw instance and OpenAI provider are production-ready. The repository has
+contract coverage and a clearly labelled browser-QA simulation; a real
+credentialed OpenClaw/OpenAI smoke test remains required.
+
+## Protocol-v4 connector
+
+`GatewayConnector` and `OpenClawGatewayProtocol` now provide:
+
+- `connect.challenge` detection followed by a protocol-v4 `connect` request and
+  validated `hello-ok`;
+- request/response correlation with backend-only request IDs;
+- advertised method, event and granted-scope discovery;
+- configurable handshake/RPC timeouts and receive-frame size limits;
+- bounded recent-event buffering;
+- reconnect backoff with jitter and explicit
+  `initializing/reconnecting/disconnected/failed/connected` states;
+- optional exact Gateway-version pinning through
+  `OPENCLAW_REQUIRED_VERSION`;
+- fail-closed method availability checks before RPC invocation;
+- safe error projection without returning credentials or raw transport state to
+  the browser.
+
+The current trusted backend flow intentionally omits device identity only for
+the OpenClaw-supported direct-loopback/shared-secret topology. A remote or
+container-to-host Gateway topology needs a paired device identity and signed
+challenge response before it can be claimed production-ready.
+
+## Typed Nexus facade
+
+All endpoints below require Nexus authentication. Mutations additionally
+require the `owner` role and use the existing agent rate-limit policy.
+
+| Method | Endpoint | OpenClaw operation |
+|---|---|---|
+| `GET` | `/api/v1/openclaw/connection` | Connection and recovery state |
+| `GET` | `/api/v1/openclaw/capabilities` | Advertised method/scope matrix |
+| `GET` | `/api/v1/openclaw/overview` | Aggregated control-plane read model |
+| `GET` | `/api/v1/openclaw/tasks` | `tasks.list` |
+| `POST` | `/api/v1/openclaw/tasks/{id}/cancel` | `tasks.cancel` |
+| `GET` | `/api/v1/openclaw/sessions` | `sessions.list` |
+| `POST` | `/api/v1/openclaw/sessions/abort` | `sessions.abort` |
+| `POST` | `/api/v1/openclaw/sessions/model` | `sessions.patch` |
+| `GET` | `/api/v1/openclaw/cron` | `cron.list` |
+| `POST` | `/api/v1/openclaw/cron/{id}/run` | `cron.run` with force mode |
+| `GET` | `/api/v1/openclaw/approvals` | approval snapshot/events |
+| `POST` | `/api/v1/openclaw/approvals/{id}/resolve` | approval resolution |
+| `GET` | `/api/v1/openclaw/activity` | normalized recent Gateway events |
+| `GET` | `/api/v1/openclaw/models` | `models.list` |
+| `GET` | `/api/v1/openclaw/agents` | `agents.list` |
+
+Each read returns its own state, message, recovery action and observation time.
+Missing scopes and missing Gateway methods are distinct from disconnection.
+Mutations return an explicit `ok/state/message/data/recovery/completedAt`
+envelope instead of silently succeeding.
+
+## Frontend integration
+
+The authenticated shell polls only the Nexus facade and exposes one shared
+OpenClaw status/recovery contract. The implemented operator paths are:
+
+- Run Control: tasks, sessions, approvals, cron, events, inspector and
+  confirmation dialogs;
+- Dashboard: authoritative agent/session projection, focus tasks, runtime
+  status, model patching and Iris chat through Nexus;
+- Agents and Agent Detail: live OpenClaw agents and session state merged with
+  Nexus-safe metadata;
+- Models: provider-safe live catalog with availability and recovery reasons;
+- Activity: OpenClaw runtime events combined with Nexus control-plane events;
+- Calendar: live cron list and owner-confirmed `cron.run`;
+- Notifications: live approval summary plus working notification actions;
+- Security and Settings: connection, version, scope and trust-boundary
+  diagnostics without secret values;
+- Projects, Tasks, Memory, Docs and Incidents: explicit OpenClaw context and
+  recovery links while preserving Nexus ownership of their domain state.
+
+Iris chat is hidden by default, opens as a modal and keeps the dashboard space
+for live orchestration. Sending uses `POST /api/v1/chat`; the conversation ID is
+stable per browser. The former `/chat` route is intentionally absent.
+
+## Additional reliability fixes
+
+- Initial authentication now shares an in-flight refresh between overlapping
+  router guards. Direct authenticated route loads no longer race into
+  `/login`.
+- Authenticated post-login hydration refreshes operations/sidebar state.
+- Task Board and live-SSE consumers validate snapshot shape before assignment
+  and fall back to polling instead of blanking the route.
+- Iris history uses stable timestamps in the QA fixture, preventing false
+  duplicate-poll evidence.
+
+## Verification
+
+### Automated
+
+| Check | Result |
+|---|---|
+| `pnpm test` | 3 files, 5 tests passed |
+| `pnpm build` | Typecheck and Vite production build passed; 1886 modules |
+| `.tools/dotnet/dotnet.exe test backend-tests/Nexus.Api.Tests.csproj --configuration Release` | 201/201 passed |
+| Gateway protocol/normalization tests | challenge, hello, errors, capabilities, tasks, cron, approvals and session-model patch covered |
+| Frontend state tests | concurrent auth initialization, disconnected recovery and API failure covered |
+
+### Operated browser paths
+
+- all 17 authenticated routes loaded at 375, 768, 1024, 1440 and 1920 px;
+- no document-level horizontal overflow or visible alert remained;
+- Run Control node selection, cancel confirmation, approval resolution and cron
+  execution worked;
+- Activity and Models search/detail dialogs worked and closed with `Escape`;
+- Task Board opened a real task detail;
+- dashboard Iris chat loaded once, sent, received, closed and restored focus;
+- the Iris agent session model changed through the typed facade;
+- a notification marked read and routed to its target; mark-all-read cleared the
+  unread count;
+- the final browser console contained no warning or error entries.
+
+The browser data came from `scripts/qa/openclaw-ui-mock.mjs`. Every response is
+labelled with `X-Nexus-QA-Fixture`, and the UI visibly reports
+`QA SIMULATION`; it is not live OpenClaw evidence.
+
+## Visual evidence
+
+- [Dashboard reference vs current](dashboard-reference-vs-current.png)
+- [Run Control mockup vs functional build](run-control-mock-vs-current.png)
+- [All core pages contact sheet](core-pages-contact-sheet.png)
+- [Run Control responsive contact sheet](run-control-responsive-contact-sheet.png)
+- [Route evaluation](ROUTE_EVALUATION.md)
+- [Design QA](design-qa.md)
+
+## Remaining production boundary
+
+The next release-blocking proof is:
+
+1. pair a backend device identity for the actual remote/container topology, or
+   run Nexus in the documented direct-loopback topology;
+2. pin the deployed Gateway version;
+3. configure OpenAI exclusively inside OpenClaw;
+4. run one credentialed flow
+   `Nexus -> OpenClaw session -> OpenAI -> OpenClaw result -> Nexus`;
+5. record provider/model evidence, an unauthorized negative case, reconnect
+   recovery and an audited owner mutation.
+
+Until this proof exists, Nexus is a tested control-plane implementation but not
+yet a verified replacement for every OpenClaw operational workflow.
+
+## Primary sources
+
+- [OpenClaw Gateway protocol](https://docs.openclaw.ai/gateway/protocol)
+- [Building an OpenClaw Gateway client](https://docs.openclaw.ai/gateway/clients)
+- [OpenClaw operator scopes](https://docs.openclaw.ai/gateway/operator-scopes)
+- [OpenClaw models](https://docs.openclaw.ai/models)
+- [OpenClaw background tasks](https://docs.openclaw.ai/automation/tasks)
+- [OpenClaw cron operations](https://docs.openclaw.ai/cli/cron)
+- [OpenClaw tools invoke HTTP API](https://docs.openclaw.ai/gateway/tools-invoke-http-api)
+- [OpenClaw Gateway troubleshooting](https://docs.openclaw.ai/gateway/troubleshooting)
@@ -0,0 +1,93 @@
+# Nexus Core Route Evaluation
+
+**Stand:** 2026-07-28
+**Bewertungsziel:** Wie nah ist jede Seite an einer agent-first Mission Control,
+die tägliche OpenClaw-Bedienung ersetzt?
+
+## Zusammenfassung
+
+The core route set is now coherent and functionally connected, but Nexus is not
+yet complete OpenClaw parity.
+
+| Dimension | Reife | Bewertung |
+|---|---:|---|
+| Browser -> Nexus -> OpenClaw trust boundary | 9/10 | Correct architectural boundary; no provider secrets in the browser |
+| Gateway protocol foundation | 7/10 | Protocol v4, states, scopes and reconnect exist; remote device pairing and live interop proof remain |
+| Runtime visibility | 8/10 | Tasks, sessions, agents, approvals, cron, models and events are visible |
+| Safe runtime mutations | 5/10 | Cancel, abort, model patch, approval and run-now work; lifecycle coverage is incomplete |
+| Agent-first operator workflow | 6/10 | Iris, Run Control and contextual recovery work; start/resume/retry/artifacts are incomplete |
+| Full daily OpenClaw replacement | 4/10 | Tools, config, nodes, channels, complete scheduler and recovery are still missing |
+| Production proof | 3/10 | Contract/browser QA is green; credentialed OpenClaw/OpenAI E2E is not yet recorded |
+
+**Overall:** solid functional control-plane foundation, not yet a production
+claim of “OpenClaw is no longer needed for normal operation.”
+
+## Route-by-route evaluation
+
+| Route | Current functional state | OpenClaw integration | Highest-value next improvement |
+|---|---|---|---|
+| `/login` | Owner login, rotating refresh path and return-to-route work; overlapping refresh race fixed | Indirect: protects every facade route | Add passkeys/2FA, device/session management and explicit recovery |
+| `/dashboard` | Live orchestration dominates the workspace; Iris chat is an on-demand modal; model change works | Agents, sessions, tasks, activity, Gateway health and chat are real Nexus-facade data | Add streaming chat, stop/retry, live usage/cost and run-start intent |
+| `/runs` | Functional work graph, inspector, tasks, sessions, approvals, cron and recent activity | Strongest integrated surface; cancel, abort, approve/deny and run-now are wired | Add start/resume/retry/branch, durable run deep links, tool trace and artifact output |
+| `/agents` | Runtime inventory with status, model and workspace-safe metadata | Live `agents.list` plus session state | Add create/import, enable/disable, restart, capability/tool policy and drift |
+| `/agents/:id` | Agent identity, activity and config workspace render; dashboard model selection patches a session | Live agents, sessions, activity and `sessions.patch` | Add session explorer, lifecycle controls, tools, budget, effective permissions and evals |
+| `/projects` | Functional Nexus portfolio and create flow | Shared connection/recovery context; project remains correctly Nexus-owned | Correlate active OpenClaw runs, agents, approvals, usage and artifacts per project |
+| `/projects/:id` | Project detail, progress and task list work | Same explicit runtime boundary | Add “delegate to Iris”, run start, project automation, budget and artifact timeline |
+| `/tasks` | Parent/child task board works and opens real details; horizontal board scrolling is intentional | Shared OpenClaw status and Run Control handoff | Persist task <-> session/run correlation and add retry/resume/cancel at the task |
+| `/tasks/:id` | Detail, children, activity and task mutations work | Runtime boundary is visible, but the Nexus task remains the domain record | Add linked session/run, approvals, tool calls, artifacts and replay |
+| `/memory` | Search, list, selected-file and empty states work | Connection/recovery is explicit; data remains Nexus/workspace-owned | Add OpenClaw ingestion status, scope, provenance, freshness, retention and retrieval evals |
+| `/docs` | Category/search/list/reader and empty states work | Same safe boundary as Memory | Add upload/import, versioning, citations, sync status and approval |
+| `/models` | Live catalog, provider filter, availability reasons and detail dialog work | Direct typed `models.list`; no hardcoded UI catalog | Add OpenAI auth-profile status, primary/alias/fallback policy, limits, budgets and test run |
+| `/activity` | Search, type/source filters and event details work | OpenClaw runtime events and Nexus events share one surface | Add durable correlation ID, actor/diff, pagination, export, retention and trace links |
+| `/calendar` | Live schedule list, next/last run and owner-confirmed run-now work | `cron.list` and admin-scoped `cron.run` | Add create/edit/enable/pause/delete, timezone editor, run history, retry and delivery |
+| `/security` | Real Nexus JWT settings and OpenClaw trust/pairing boundary are visible | Connection, version and trust posture are no longer invented | Add effective scope/policy audit, 2FA/passkeys, sessions/devices, secret rotation and remediation |
+| `/incidents` | Incident list/detail selection and Run Control recovery link work | Runtime status is visible; incident content remains Nexus-owned | Add create/ack/assign/escalate/resolve, event correlation, remediation and postmortem |
+| `/notifications` | Unread state, target routing, mark-read and mark-all work; OpenClaw approvals are summarized | Live approval queue is visible | Add inline decision, snooze, quiet hours, preference routing and incident actions |
+| `/settings` | Profile/password/users plus read-only Gateway diagnostics work | Endpoint, version, protocol, scopes and recovery are visible without secrets | Add paired-device setup, validated config forms, provider policy and controlled reload/rollback |
+
+The old `/chat` page is intentionally removed. Iris is a contextual modal on
+the dashboard and a global entry links to that real destination.
+
+## Capability gaps that still force OpenClaw or break-glass access
+
+### P0
+
+- paired device identity for remote/container Gateway access;
+- one real OpenAI-over-OpenClaw E2E proof with negative auth and reconnect;
+- start, resume, retry and durable deep link for a run/session;
+- durable Nexus task/project <-> OpenClaw run/session correlation;
+- audit/correlation/idempotency for every privileged mutation.
+
+### P1
+
+- agent lifecycle and effective tool permissions;
+- model/auth-profile/fallback/budget policy editing;
+- complete cron CRUD and history;
+- tool/approval trace and artifacts;
+- incident lifecycle and recovery actions;
+- knowledge ingestion, provenance and retrieval evaluation.
+
+### P2
+
+- channels, connectors and node inventory/pairing;
+- config schema forms, diff, backup, reload and rollback;
+- provider usage/cost/latency dashboards;
+- eval datasets, regression gates, export and retention.
+
+## Recommendation
+
+Do not broaden the navigation again yet. The highest-value next slice is one
+real, durable run:
+
+```text
+Iris intent
+  -> create/start OpenClaw run
+  -> correlate Nexus project/task
+  -> observe session and tool events
+  -> owner approval
+  -> artifact/result
+  -> stop/retry/reload recovery
+```
+
+That single path will close more of the “return to OpenClaw” gap than adding
+more read-only pages.
@@ -0,0 +1,107 @@
+# Nexus OpenClaw Core Integration — Design QA
+
+**Stand:** 2026-07-28
+**Reference:** existing Nexus Dashboard design language and approved Run Control
+mockup.
+
+## Visual contract
+
+- Existing Galaxy background, glass panels, blue-violet accents, Manrope,
+  Space Grotesk and JetBrains Mono remain the only design language.
+- Sidebar categories, 248 px desktop rail and 62 px topbar stay consistent.
+- Glows are limited to active navigation, primary actions and meaningful live
+  state.
+- Standard pages remain bounded while Run Control and Task Board keep the wider
+  operational workspace.
+- Iris chat stays hidden until requested, leaving maximum space for live
+  orchestration.
+
+## Same-input comparisons
+
+The required side-by-side comparisons were generated from current-run
+screenshots:
+
+- [Dashboard reference vs current](dashboard-reference-vs-current.png)
+- [Run Control mockup vs functional build](run-control-mock-vs-current.png)
+
+The current Dashboard preserves the reference visual system while removing the
+persistent chat column and secondary dashboard clutter. Run Control is denser
+than the approved mockup because it includes real capability, approval and
+recovery state; the hierarchy, spacing rhythm, color use and panel treatment
+remain consistent.
+
+## Core-page review
+
+[Core pages contact sheet](core-pages-contact-sheet.png)
+
+Observed result:
+
+- all page families use the same sidebar, topbar, background, headings, panels,
+  inputs, buttons, status chips and focus treatment;
+- no route reintroduced the former flat gray legacy shell;
+- empty views on Memory, Docs and Incidents are deliberate content states, not
+  failed layouts;
+- Settings correctly uses a narrower form/diagnostic measure;
+- Task Board keeps an internal horizontal work-surface scroller without causing
+  document-level overflow;
+- no P0, P1 or P2 visual inconsistency remained after the final pass.
+
+## Responsive and geometry QA
+
+[Run Control responsive contact sheet](run-control-responsive-contact-sheet.png)
+
+Every authenticated route was loaded at:
+
+| Viewport | Routes | Document overflow | Visible alerts |
+|---:|---:|---:|---:|
+| 375 x 812 | 17 | 0 | 0 |
+| 768 x 900 | 17 | 0 | 0 |
+| 1024 x 900 | 17 | 0 | 0 |
+| 1440 x 900 | 17 | 0 | 0 |
+| 1920 x 1080 | 17 | 0 | 0 |
+
+The mobile/sidebar drawer, responsive columns and wide orchestration workspace
+all remained usable. The project does not ship a separate mobile product; these
+checks only guarantee that the authenticated web UI does not break at the
+required narrow viewport.
+
+## Interaction and accessibility QA
+
+Verified in the in-app browser:
+
+- categorized desktop and narrow-viewport navigation;
+- direct authenticated deep links after reload;
+- Run Control node selection and inspector update;
+- cancel, approval and cron confirmation dialogs;
+- `Escape` closes detail/confirmation dialogs;
+- Activity and Models search/filter/detail paths;
+- Task Board card to Task Detail navigation;
+- Iris modal open/send/response/close and focus restoration;
+- agent session-model change;
+- notification target routing, mark-read and mark-all-read;
+- explicit labels for buttons, links, dialogs and status regions;
+- final browser console: no warnings or errors.
+
+## State QA
+
+- Loading: Run Control and shared OpenClaw polling show explicit loading state.
+- Empty: every collection keeps its section and explains the absence of data.
+- Error/disconnected: the shared notice reports message, recovery and a working
+  Run Control link; the store never substitutes simulated production data.
+- Unsupported/forbidden: capability state distinguishes missing Gateway methods
+  from missing operator scopes.
+
+The QA fixture is intentionally visible as `QA SIMULATION`; screenshots are
+design/interaction evidence only, not proof of a live OpenClaw deployment.
+
+## Remaining visual debt
+
+No P0–P2 design issue blocks this checkpoint. P3 polish remains:
+
+- finish language consistency between German owner workflows and English
+  runtime vocabulary;
+- add a compact correlation/trace breadcrumb once durable run deep links exist;
+- replace temporary loading copy with skeletons only if measured latency makes
+  it useful;
+- add screenshots for real degraded/version-mismatch states after live Gateway
+  pairing.
@@ -0,0 +1,180 @@
+# Nexus Sites Mockup: Mission-Control-Evaluation
+
+**Stand:** 2026-07-28
+**Artefakt:** `sites/nexus-mission-control`
+**Umfang:** 18 bedienbare Routen, ausschließlich deterministische Mockdaten
+**Zielbild:** Nexus als agent-first Bedienoberfläche über OpenClaw; OpenAI bleibt
+der primäre Modellprovider innerhalb von OpenClaw.
+
+## Kurzurteil
+
+Der Sites-Mockup ist als visuelles und interaktives Zielbild überzeugend. Die
+Navigation ist konsistent, Iris bleibt kontextuell erreichbar und die neue
+Run-Control-Seite macht Ziel, Agentenhierarchie, Budget, aktuellen Schritt,
+Freigabegrenze und Wiederaufnahme erstmals gemeinsam sichtbar.
+
+**Bewertung des Zielbilds:**
+
+| Dimension | Wertung | Urteil |
+|---|---:|---|
+| Visuelle Konsistenz und Informationshierarchie | 4,5 / 5 | Stark |
+| Agent-first Bedienmodell | 3,7 / 5 | Gute Richtung |
+| Abdeckung des täglichen Mission-Control-Betriebs | 2,9 / 5 | Wesentliche Flächen fehlen |
+| Nachweis realer Betriebsfähigkeit | 0 / 5 | Absichtlich nicht Teil dieses statischen Mockups |
+
+Der Mockup zeigt damit ein belastbares Produktziel, aber noch keine produktive
+Control Plane. Er ruft weder Nexus noch OpenClaw, OpenAI, Authentifizierung,
+Persistenz, Analytics oder andere Provider auf. Alle sichtbaren Daten und
+Interaktionen werden im Browser aus einem fest definierten Fixture erzeugt und
+bei einem Reload zurückgesetzt.
+
+## Visuelle Evidenz
+
+![Alle 18 geprüften Routen](./route-contact-sheet.png)
+
+![Referenz-, Breakpoint- und Detailzustände](./evidence-contact-sheet.png)
+
+### Veröffentlichtes Sites-Artefakt
+
+![Privat veröffentlichtes Dashboard](./24-deployed-dashboard.png)
+
+![Privat veröffentlichte Run-Control-Seite](./25-deployed-run-control.png)
+
+## Verbindlicher Mission-Control-Vertrag
+
+Die folgenden Anforderungen ergeben sich sowohl aus dem Nexus-Zielbild als auch
+aus den aktuellen Runtime-Schnittstellen:
+
+1. **OpenClaw bleibt die Runtime-Quelle.** Das
+   [OpenClaw Gateway Protocol](https://docs.openclaw.ai/gateway/protocol)
+   stellt den typisierten Control-Plane-Zugang für Status, Sessions, Runs,
+   Tools, Approvals, Cron, Nodes und Ereignisse bereit. Nexus sollte diesen
+   Vertrag serverseitig hinter domänenspezifischen Read-/Control-Clients
+   kapseln; der Browser darf weder Gateway-Credentials noch rohe RPC-Rechte
+   erhalten.
+2. **Freigaben sind Teil des Run-Zustands.** Der
+   [OpenAI Agents SDK HITL-Flow](https://openai.github.io/openai-agents-js/guides/human-in-the-loop/)
+   pausiert Ausführungen vor einem freigabepflichtigen Tool-Aufruf und setzt sie
+   aus demselben `RunState` fort. Die Run-Control-Darstellung braucht deshalb
+   dauerhafte, versionierte Checkpoints statt lokaler UI-Schalter.
+3. **Jede Ausführung braucht beweisbare Ereignisse.** Das
+   [OpenAI Agents SDK Tracing](https://openai.github.io/openai-agents-js/guides/tracing/)
+   bildet Agenten-, Modell-, Tool-, Handoff- und Guardrail-Arbeit als
+   verschachtelte Spans ab. Nexus benötigt einen korrelierten Run-/Event-Read
+   Model mit gezielter Redaction sensitiver Inhalte.
+4. **Tool-Rechte ersetzen keine Freigabeoberfläche.** Die
+   [OpenClaw Tools Invoke API](https://docs.openclaw.ai/gateway/tools-invoke-http-api)
+   fügt für erreichbare Tools nicht automatisch eine zusätzliche
+   Einzel-Freigabe hinzu und sperrt besonders riskante Shell-, Datei-,
+   Session-, Cron-, Gateway- und Node-Flächen standardmäßig. Nexus muss
+   Least-Privilege-Policies und seine menschlichen Freigabegrenzen explizit
+   modellieren.
+5. **Automationen sind laufende Arbeit, keine Kalenderdekoration.**
+   [OpenClaw Scheduled Tasks](https://docs.openclaw.ai/automation/cron-jobs)
+   besitzen persistente Jobs, Ausführungshistorie, Fehlerzustände,
+   Retry/Backoff und Session-Modi. Die Calendar-Seite muss diesen vollständigen
+   Lebenszyklus abbilden.
+
+## Evaluation aller Seiten
+
+Skala für **Mockup-Reife**: 1 = Platzhalter, 3 = verständlicher Teilfluss,
+5 = belastbares interaktives Zielbild. Die Wertung bewertet nicht die reale
+Backend-Funktion.
+
+| Route | Rolle im Mission Control | Mockup-Reife | Was bereits gut funktioniert | Was für den produktiven Zielzustand fehlt | Priorität |
+|---|---|---:|---|---|---|
+| `/login` | Sicherer Zugang | 3,5 / 5 | Ruhiger Einstieg, Passwortzustand, klare Produktidentität | SSO/Passkeys/2FA, Recovery, Geräte und Sessions, Return-to-Route, Lockout- und Break-glass-Flows | P1 |
+| `/dashboard` | Lagebild und Einstieg | 4,5 / 5 | Dominante Live-Orchestrierung, knappe Statusleisten, Agentenpfad, Iris als Modal | Autoritative Run-/Queue-Daten, globale Command Bar, Provider-/Budgetalarme, echte Offline-/Stale-/Partial-Zustände, Deep Link zum Run | P0 |
+| `/runs` | Aktive Ausführung steuern | 4,5 / 5 | Ziel, Hierarchie, aktueller Agent, Budget, Event Rail, zweistufige Freigabe, Pause/Stop/Resume/Checkpoint | Dauerhafte Run-ID und State-Version, Toolargumente/Diff, Artifact-Preview, Idempotenz, Race-Konflikte, Replay-Sicherheit, vollständige Trace-Suche | P0 |
+| `/agents` | Runtime-Workforce | 4 / 5 | Rollen, Status, Modell und Policy sind scanbar; Karten führen in Details | Create/Import, Enable/Disable/Restart, Capability- und Permission-Diff, Auslastung, Kosten, Drift und Versionsstatus | P1 |
+| `/agents/:id` | Agent Cockpit | 4 / 5 | Identität, Live-Zusammenfassung, Aktivität und Konfiguration sind sinnvoll gruppiert | Sessions/Runs, Toolrechte, Modellpolicy, Workspace, Budget, Secrets-Referenzen, Evals, Lifecycle und Rollback | P1 |
+| `/projects` | Portfolio und Outcomes | 3,5 / 5 | Projekte und Fortschritt sind schnell erfassbar; Karten sind klickbar | Ziele/KPIs, verantwortliche Agenten, aktive Runs, Budget, Risiken, Artifacts, Automationen und Health-Aggregation | P1 |
+| `/projects/:id` | Outcome Control | 3,5 / 5 | Projektkontext und Aufgabenfortschritt sind verdichtet | Delegation, Runstart, Agententeam, Timeline, Abhängigkeiten, Budget, Playbooks, Artifacts und Abschlusskriterien | P1 |
+| `/tasks` | Agentische Arbeitswarteschlange | 4 / 5 | Board, Erstellen, Status und Assignee sind bedienbar; fachlich horizontales Board bleibt intern scrollbar | Run-/Approval-Verknüpfung, Dependencies, Bulk-Aktionen, Retry/Resume/Cancel, Queue-SLAs, Blocker und ehrliche Fehlerzustände | P1 |
+| `/tasks/:id` | Einzelauftrag steuern | 4 / 5 | Bearbeitung, Agentenzuweisung, Status und Kontext sind gut nutzbar | Session/Run, Tool Calls, Approvals, Artifacts, Checkpoints, Replay, Abhängigkeiten und Abnahmeevidenz | P1 |
+| `/memory` | Kuratiertes Langzeitwissen | 3,5 / 5 | Suche, Liste und anklickbare Detailansicht funktionieren | Create/Edit/Archive, Provenienz, Scope, Freshness, Retention, Konflikte, Retrieval-Test und Versions-Rollback | P1 |
+| `/docs` | Knowledge Ingestion | 3,5 / 5 | Kategorien, Suche und Dokumentdetail sind verständlich | Upload/Import/Authoring, Ingestionstatus, Parserfehler, Zitate, Versionen, Freigaben, Sync und Retrieval-Evals | P1 |
+| `/models` | OpenAI-Policy über OpenClaw | 3 / 5 | Primär-/Fallback-Routing und Status sind klar dargestellt | Auth-Profilstatus ohne Secrets, Fähigkeiten, Limits, Qualität/Kosten/Latenz, Policy-Diff, Testlauf, Circuit Breaker und Rollback | P0 |
+| `/activity` | Audit- und Eventstream | 3,5 / 5 | Filterbarer, chronologischer Überblick | Autoritative Eventquelle, Run-/Correlation-ID, Actor, Diff, Payload-Redaction, Suche, Export, Retention und Deep Links | P0 |
+| `/calendar` | Scheduler und Automation | 3,5 / 5 | Upcoming und Jobs sind getrennt und scanbar | Vollständiges Cron-CRUD, Run now, Pause/Resume, Owner, Zeitzone, Session Mode, Run History, Retry, Delivery und Fehlerdiagnose | P1 |
+| `/security` | Sicherheits- und Policy-Lage | 3,5 / 5 | Auth-, Token-, Rate- und Transportkonfiguration sind als Übersicht lesbar | Tatsächliche effektive Scopes, Findings, Remediation, Schlüsselrotation, Nutzergeräte, Secret-Referenzen, Auditbelege und Drift | P0 |
+| `/incidents` | Operative Störungsbearbeitung | 3,5 / 5 | Liste und anklickbares Incident-Detail funktionieren | Create/Acknowledge/Assign, Severity, Timeline, Run-/Provider-Korrelation, Playbook, Remediation, Resolve und Postmortem | P1 |
+| `/notifications` | Persönliche Action Inbox | 3,5 / 5 | Read/Read-all und Priorisierung sind verständlich | Acknowledge, Snooze, Assignee, Quiet Hours, Routingregeln, Kanalpräferenzen sowie direkte Approval-/Incident-Aktionen | P1 |
+| `/settings` | Control-Plane-Konfiguration | 3 / 5 | Profil, Passwort und Benutzerverwaltung sind klar getrennt | Gateway-/OpenAI-via-OpenClaw-Status, Rollen, Tools, Approval Policies, Budgets, Connectoren, Retention, Secrets-Referenzen und Audit | P0 |
+
+Die frühere Mobile-Chat-Seite ist bewusst entfernt. `/chat` leitet im Mockup
+auf `/dashboard` um; Iris bleibt auf jeder authentifizierten Seite als
+kontextuelles Modal verfügbar.
+
+## Produktweite Lücken
+
+### P0 – Vor jeder realen Steuerung
+
+- Typisierte Nexus-Fassade für den OpenClaw-Gateway-Vertrag mit
+  Capability-Discovery und kompatibler Protokollversion.
+- Authenticated-by-default, getrennte Benutzer-/Service-/Agentenidentitäten,
+  Least-Privilege-Scopes und keinerlei Secrets im Browser.
+- Dauerhafte Domäne für Run, Session, Parent/Child-Agent, Tool Call,
+  Approval, Artifact, Usage, Budget und State-Version.
+- Jede Mutation mit Actor, Correlation ID, Idempotency Key, erwarteter Version,
+  Policyentscheidung, Ergebnis und unveränderbarem Audit-Eintrag.
+- Recovery für Reconnect, Reload, Gateway-Neustart, verlorene Events,
+  doppelte Zustellung und bereits ausgeführte Seiteneffekte.
+- Zentrale Approval Inbox mit Ablaufzeit, Begründung, exaktem Ziel,
+  Toolargumenten, Konsequenz, Reviewerbindung und First-answer-wins-Semantik.
+
+### P1 – Täglicher agent-first Betrieb
+
+- Globale Command Bar: Ziel formulieren, Kontext prüfen, Plan freigeben und
+  direkt einen dauerhaften Run starten.
+- Eigene Deep Links für `/runs/:id` und eine zentrale `/approvals`-Arbeitsfläche.
+- Tool-Katalog und effektive Rechte, Artifact-Browser, Session Explorer und
+  vollständiger Scheduler-Lifecycle.
+- Kontextuelle Delegation auf Projekt, Task, Incident, Dokument und Zeitplan.
+- Quellen- und Freshness-Markierung für jede operative Zahl; Offline, Stale,
+  Partial, Unauthorized und Incompatible dürfen nicht wie leere Daten wirken.
+- Provider-Quoten, Budgets, Fallbacks, Circuit Breaker und kostenbewusste
+  Routingregeln für OpenAI innerhalb von OpenClaw.
+
+### P2 – Qualität und Plattformreife
+
+- Eval-Arbeitsfläche für Datensätze, Run-Vergleiche, Regressionen,
+  Tool-Argumentgenauigkeit und Release Gates.
+- Gespeicherte Ansichten, globale Suche, Command-History und Operator-Shortcuts.
+- SLOs für Agentenqualität, Latenz, Kosten, Queuezeit und Approval-SLA.
+- Wiederverwendbare Run-, Agenten-, Incident- und Automations-Playbooks.
+- Channels, Connectors und Nodes erst nach stabiler Trust-, Approval- und
+  Recovery-Schicht als eigenständige Flächen ergänzen.
+
+## Empfohlene nächste Mockups
+
+1. `/approvals` als zentrale, risiko- und SLA-sortierte Freigabe-Inbox.
+2. `/runs/:id` als dauerhafter Run-Explorer mit Trace, Tooldiff und Artifacts.
+3. `/tools` als Katalog für Schemas, effektive Rechte und Policy-Diffs.
+4. `/artifacts` als nachvollziehbare Output- und Provenienzfläche.
+5. `/evals` als Vergleichs- und Release-Gate-Arbeitsfläche.
+
+## Durchgeführte Abnahme
+
+| Prüfung | Ergebnis |
+|---|---|
+| Registrierte Zielrouten | 18 / 18 visuell geprüft |
+| Geometrie-/Overflow-Matrix | 90 Prüfungen bei 375, 768, 1024, 1440 und 1920 px; kein dokumentweiter horizontaler Overflow |
+| Run Control | Approval Review/Confirm/Undo, Pause/Resume, Stop/Checkpoint-Restart und Eventdetail bedient |
+| Kerninteraktionen | Navigation, Detailwechsel, Filter, Formulare, Task-Erstellung, Settings, Notifications und Iris-Modal bedient |
+| Browserkonsole | Keine Fehler oder Warnungen im geprüften Ablauf |
+| TypeScript | `npm run typecheck` erfolgreich |
+| Komponententests | `npm test` erfolgreich |
+| Sites-Build | `npm run build` erfolgreich |
+| Worker-/SPA-Routing | `npm run test:sites` erfolgreich |
+| Private Sites-Produktion | Version 2 erfolgreich; Dashboard, Run Control und zweistufige Approval-Interaktion bedient; keine aktuellen Workerfehler |
+
+## Entscheidung
+
+**Sites-Freigabe als Mockup: Go.**
+**Produktiver Einsatz als Mission Control: No-Go.**
+
+Der nächste Umsetzungsslice sollte nicht noch eine reine Übersichtsseite sein.
+Er sollte `/runs` mit einer dauerhaften OpenClaw-Session, dem autoritativen
+Eventstream und einer echten Approval-Grenze verbinden. Erst dann wird aus dem
+visuellen Mission-Control-Versprechen eine belastbare Control Plane.
@@ -0,0 +1,92 @@
+Add-Type -AssemblyName System.Drawing
+
+$auditDirectory = Split-Path -Parent $MyInvocation.MyCommand.Path
+
+function New-ContactSheet {
+    param(
+        [Parameter(Mandatory)]
+        [string[]]$Files,
+        [Parameter(Mandatory)]
+        [string]$OutputName,
+        [int]$Columns = 3
+    )
+
+    $thumbnailWidth = 360
+    $thumbnailHeight = 256
+    $labelHeight = 38
+    $cellPadding = 14
+    $cellWidth = $thumbnailWidth + ($cellPadding * 2)
+    $cellHeight = $thumbnailHeight + $labelHeight + ($cellPadding * 2)
+    $rows = [Math]::Ceiling($Files.Count / $Columns)
+    $sheet = New-Object System.Drawing.Bitmap ($cellWidth * $Columns), ($cellHeight * $rows)
+    $graphics = [System.Drawing.Graphics]::FromImage($sheet)
+    $graphics.Clear([System.Drawing.Color]::FromArgb(8, 12, 28))
+    $graphics.InterpolationMode = [System.Drawing.Drawing2D.InterpolationMode]::HighQualityBicubic
+    $graphics.SmoothingMode = [System.Drawing.Drawing2D.SmoothingMode]::HighQuality
+    $font = New-Object System.Drawing.Font 'Segoe UI', 13, ([System.Drawing.FontStyle]::Regular)
+    $brush = New-Object System.Drawing.SolidBrush ([System.Drawing.Color]::FromArgb(229, 235, 255))
+
+    try {
+        for ($index = 0; $index -lt $Files.Count; $index++) {
+            $column = $index % $Columns
+            $row = [Math]::Floor($index / $Columns)
+            $x = ($column * $cellWidth) + $cellPadding
+            $y = ($row * $cellHeight) + $cellPadding
+            $sourcePath = Join-Path $auditDirectory $Files[$index]
+            $source = [System.Drawing.Image]::FromFile($sourcePath)
+
+            try {
+                $ratio = [Math]::Min($thumbnailWidth / $source.Width, $thumbnailHeight / $source.Height)
+                $drawWidth = [int]($source.Width * $ratio)
+                $drawHeight = [int]($source.Height * $ratio)
+                $drawX = $x + [int](($thumbnailWidth - $drawWidth) / 2)
+                $drawY = $y + [int](($thumbnailHeight - $drawHeight) / 2)
+                $graphics.DrawImage($source, $drawX, $drawY, $drawWidth, $drawHeight)
+                $label = [IO.Path]::GetFileNameWithoutExtension($Files[$index]) -replace '^\d+-', ''
+                $graphics.DrawString($label, $font, $brush, $x, ($y + $thumbnailHeight + 8))
+            }
+            finally {
+                $source.Dispose()
+            }
+        }
+
+        $outputPath = Join-Path $auditDirectory $OutputName
+        $sheet.Save($outputPath, [System.Drawing.Imaging.ImageFormat]::Png)
+    }
+    finally {
+        $brush.Dispose()
+        $font.Dispose()
+        $graphics.Dispose()
+        $sheet.Dispose()
+    }
+}
+
+New-ContactSheet -OutputName 'route-contact-sheet.png' -Files @(
+    '01-dashboard.png',
+    '02-run-control.png',
+    '03-login.png',
+    '04-agents.png',
+    '05-agent-detail.png',
+    '06-projects.png',
+    '07-project-detail.png',
+    '08-task-board.png',
+    '09-task-detail.png',
+    '10-memory.png',
+    '11-docs.png',
+    '12-models.png',
+    '13-activity.png',
+    '14-calendar.png',
+    '15-security.png',
+    '16-incidents.png',
+    '17-notifications.png',
+    '18-settings.png'
+)
+
+New-ContactSheet -OutputName 'evidence-contact-sheet.png' -Files @(
+    '00-baseline-login.png',
+    '19-run-control-1920.png',
+    '20-run-control-1024.png',
+    '21-memory-detail.png',
+    '22-doc-detail.png',
+    '23-incident-detail.png'
+)