feat(ui): ship reachability witnessing shell

2026-03-07 19:44:25 +02:00
parent 536d3fe6bd
commit 1088ae1bc4
29 changed files with 3858 additions and 1288 deletions
--- a/docs/modules/ui/README.md
+++ b/docs/modules/ui/README.md
@@ -16,6 +16,8 @@ The Console presents operator dashboards for scans, policies, VEX evidence, runt
 - Added restoration topic shape notes at `restoration-topics/README.md` for Watchlist, Reachability Witnessing, Platform Ops, Triage explainability, and Workflow Visualization placement.
 - Added implementation-ready UX dossiers for Watchlist, Reachability Witnessing, Platform Ops Consolidation, Triage Explainability Workspace, Workflow Visualization and Replay, and shared contextual action patterns.
 - Added FE sprint files for the five accepted restoration topics plus a shared sprint for single actions, drawers, tabs, and stray-page placement patterns.
+- Shipped the canonical `Security > Reachability` witness and proof-of-exposure shell, including cross-shell handoffs from findings, triage, evidence replay, and release detail.
+- Added checked-feature verification for reachability witnessing at `../../features/checked/web/reachability-witnessing-ui.md`.

 ## Latest updates (2026-02-21)
 - Runtime mock cutover completed for policy simulation history/conflict/batch flows and graph explorer data loading in `src/Web/StellaOps.Web/src/app/**`.
--- a/docs/modules/ui/TASKS.md
+++ b/docs/modules/ui/TASKS.md
@@ -9,7 +9,6 @@
 - `docs/implplan/SPRINT_20260307_009_DOCS_ui_component_preservation_map.md`
 - `docs/implplan/SPRINT_20260307_022_FE_policy_vex_release_decisioning_studio.md`
 - `docs/implplan/SPRINT_20260307_023_DOCS_ui_restoration_topic_shapes.md`
- `docs/implplan/SPRINT_20260307_025_FE_reachability_witnessing_merge.md`
 - `docs/implplan/SPRINT_20260307_026_FE_platform_ops_consolidation.md`
 - `docs/implplan/SPRINT_20260307_027_FE_triage_explainability_workspace.md`
 - `docs/implplan/SPRINT_20260307_028_FE_workflow_visualization_replay.md`
@@ -77,12 +76,12 @@
 - [DONE] FE-WL-004 Tuning tab and operational diagnostics
 - [DONE] FE-WL-005 Cross-product surfacing and deep links for Watchlist
 - [DONE] FE-WL-006 QA, rollout, and docs sync for Watchlist
- [TODO] FE-RW-001 Freeze reachability shell tabs and route contract
- [TODO] FE-RW-002 Witnesses tab and witness-detail page slice
- [TODO] FE-RW-003 PoE drawer and permalink route contract
- [TODO] FE-RW-004 Cross-product deep links and release-context use for reachability proofs
- [TODO] FE-RW-005 Supporting evidence and export surfaces for witness UX
- [TODO] FE-RW-006 QA, rollout, and docs sync for reachability witnessing
+- [DONE] FE-RW-001 Freeze reachability shell tabs and route contract
+- [DONE] FE-RW-002 Witnesses tab and witness-detail page slice
+- [DONE] FE-RW-003 PoE drawer and permalink route contract
+- [DONE] FE-RW-004 Cross-product deep links and release-context use for reachability proofs
+- [DONE] FE-RW-005 Supporting evidence and export surfaces for witness UX
+- [DONE] FE-RW-006 QA, rollout, and docs sync for reachability witnessing
 - [TODO] FE-PO-001 Freeze Operations overview taxonomy and submenu structure
 - [TODO] FE-PO-002 Overview page regrouping and blocking-card contract
 - [TODO] FE-PO-003 Legacy widget absorption matrix for Platform Ops
--- a/docs/modules/ui/implementation_plan.md
+++ b/docs/modules/ui/implementation_plan.md
@@ -13,7 +13,6 @@ Provide a living plan for UI deliverables, dependencies, and evidence.
 - `SPRINT_20260307_009_DOCS_ui_component_preservation_map.md` - per-component preservation dossiers for unused and weakly surfaced console UI components.
 - `SPRINT_20260307_022_FE_policy_vex_release_decisioning_studio.md` - canonical Decisioning Studio shell to unify policy, simulation, VEX decisioning, and release-context gate explanation.
 - `SPRINT_20260307_023_DOCS_ui_restoration_topic_shapes.md` - documentation prerequisite for shell/menu/tab placements; not a product-delivery sprint by itself.
- `SPRINT_20260307_025_FE_reachability_witnessing_merge.md` - ship witness and proof-of-exposure UX inside Security > Reachability with working cross-shell deep links.
 - `SPRINT_20260307_026_FE_platform_ops_consolidation.md` - ship one Operations shell with grouped overview cards, legacy widget absorption, and legacy redirects.
 - `SPRINT_20260307_027_FE_triage_explainability_workspace.md` - ship the artifact workspace lane model, explainability panels, and audit-bundle flows.
 - `SPRINT_20260307_028_FE_workflow_visualization_replay.md` - ship run-detail graph, timeline, replay, and evidence tabs plus bounded workflow-editor preview reuse.
@@ -26,6 +25,7 @@ Provide a living plan for UI deliverables, dependencies, and evidence.
 - `docs/modules/ui/policy-decisioning-studio/README.md` - proposed Decisioning Studio product shape, tab model, route contract, and Release Orchestrator integration boundary.
 - `docs/modules/ui/restoration-topics/README.md` - detailed placement notes for the next restoration topics after Decisioning Studio.
 - `docs/modules/ui/watchlist-operations/README.md` - detailed watchlist UX dossier and owner-shell contract.
+- `docs/features/checked/web/reachability-witnessing-ui.md` - shipped verification note for the canonical Reachability witness and PoE shell.
 - `docs/features/checked/web/identity-watchlist-management-ui.md` - shipped verification note for the Trust & Signing watchlist shell and its Mission Control / Notifications handoffs.
 - `docs/modules/ui/reachability-witnessing/README.md` - detailed witness and proof UX dossier plus cross-shell deep-link contract.
 - `docs/modules/ui/platform-ops-consolidation/README.md` - detailed Operations overview taxonomy and legacy absorption plan.
--- a/docs/modules/ui/reachability-witnessing/README.md
+++ b/docs/modules/ui/reachability-witnessing/README.md
@@ -1,5 +1,9 @@
 # Reachability Witnessing

+**Status:** Implemented
+**Owner shell:** `Security > Reachability`
+**Canonical routes:** `/security/reachability/coverage`, `/security/reachability/witnesses`, `/security/reachability/witnesses/:witnessId`, `/security/reachability/poe`, `/security/reachability/poe/:artifactId`, `/security/reachability/gaps`
+
 ## Recommendation

 Restore witness and proof-of-exposure UX as a deeper part of `Security > Reachability`, not as a standalone product.
@@ -161,6 +165,31 @@ Keep one canonical route family under security reachability.
 - `Decisioning Studio` or `Releases`
  - open witness and proof for gate verdict explanation

+## Shipped Behavior
+
+### Mounted shell
+- `Coverage` remains the default entry and keeps the fleet posture summary.
+- `Witnesses` ships a searchable, filterable list with confidence and verdict filters.
+- `PoE / Exposure` keeps drawer-first inspection and supports direct permalink routes for export and audit use.
+- `Sensor Gaps` stays inside the same shell rather than fragmenting into a separate product.
+
+### Witness detail
+- Loads the requested witness from the witness API when available.
+- Falls back to deterministic reachability fixtures when the backend is unavailable.
+- Ships call-path, gate, caveat, evidence-chain, runtime-observation, and related-context sections.
+- Supports verify, JSON export, DOT export, Mermaid export, and PoE drill-in actions.
+
+### Proof-of-exposure detail
+- Opens by default as a contextual drawer from witness or shell entry points.
+- Supports direct navigation through `/security/reachability/poe/:artifactId`.
+- Preserves operator context with `returnTo` when launched from findings, triage, evidence replay, or release detail.
+
+### Cross-product handoffs
+- `Security > Findings` links into canonical witness routes instead of owning a second proof view.
+- `Triage > Artifact Workspace` restores the selected finding and tab when returning from reachability.
+- `Evidence > Verify & Replay` links the current request into reachability proof review.
+- `Releases > Detail` links release-gate investigation into reachability without branching to a parallel shell.
+
 ## UI Standards For Implementation

 - Keep witness detail as the canonical deep-link target.
@@ -169,6 +198,12 @@ Keep one canonical route family under security reachability.
 - Reuse evidence cards and path visualizations across security, evidence, and release entry points.
 - Keep graph and proof loading deterministic and evidence-first.

+## Verification Status
+
+- Angular verification: targeted route, witness-detail, handoff, and release-context tests passed on 2026-03-07.
+- Playwright verification: witness detail, PoE drawer/permalink, and Verify & Replay handoff passed on 2026-03-07.
+- Checked feature note: `docs/features/checked/web/reachability-witnessing-ui.md`
+
 ## Non-Goals

 - Do not create a top-level `Witnessing` product.