@abelxiaoxing/cadence 2.0.13 → 2.0.15

package/README.md

@@ -1,8 +1,9 @@
 # Cadence
 
 `@abelxiaoxing/cadence` is a shared Pi task workspace with two independently usable clients: native `/cadence` and a browser WebUI.
-One persistent service owns tasks, bounded subagent collaboration, real parent checks and retained history.
-Ordinary conversations, resource discovery and opening history never start work or a service.
+One authenticated workbench entry routes to independent project owners, which own tasks, bounded subagent collaboration, real parent checks and retained history.
+Resource discovery and opening history never start work or a service.
+The WebUI also supports ordinary Pi conversations: only an explicit Send starts their direct host-tool work, independently of Cadence task admission.
 `cadence server install` registers that service with the user's service manager and starts its WebUI on the default address.
 
 This is a trusted workflow assistant, **not a sandbox, certified executor or transactional application system**.
@@ -21,7 +22,9 @@ cadence server install
 The global install puts `cadence` (and its alias `cadence-service`) on `PATH`.
 Cadence ships no install script, so npm 12 and Bun, which skip untrusted install scripts by default, change nothing.
 They may still report blocked scripts from the pinned Pi SDK's dependencies: `@google/genai`'s preinstall only echoes `no-op`, and `protobufjs`'s postinstall only warns about a dependent's version scheme, so neither needs approval.
-`cadence server install` registers and starts the background service for `~/cadence` on `http://127.0.0.1:17423`; `--workspace /absolute/project` selects another workspace.
+`cadence server install` registers and starts the project-less workbench on `http://127.0.0.1:17423`; it does not create `~/cadence` or select a working directory.
+Open an existing folder explicitly in the workbench to associate its project owner.
+The explicit `--workspace /absolute/project` option retains the older single-project service route for compatibility; it never creates a missing project.
 It prints the private link to open, `http://127.0.0.1:17423/?token=…`.
 The port and that token live with the research settings in `~/.pi/agent/cadence/.env`.
 Install creates that file from the research template when missing (Pi's startup card names the path until it exists), and adds either line when it is missing, never changing an existing one:
@@ -89,7 +92,10 @@ cadence token-link --workspace /absolute/project --reveal
 Use the installed `cadence` bin (or `cadence-service`), or `node /absolute/cadence/src/service-cli.mjs` followed by those arguments.
 Default binding is numeric loopback `127.0.0.1:17423`; `--foreground` is available for an explicitly configured supervisor.
 Start reads the existing Pi agent directory (or an explicit private configuration), never creates another login/profile.
-A directory that contains the private state home (the home directory and its ancestors, such as `C:\Users\<you>`) cannot be a workspace, so commands there use `~/cadence` instead of refusing; only `start` creates it, and `/cadence` started there attaches to that owner.
+Without `--workspace`, `cadence start|status|diagnose|stop|token-link|token-rotate` address the workbench; `cadence workbench <operation>` is the explicit equivalent.
+Project-scoped commands and native `/cadence` require an actual project directory.
+A directory containing private state, or inside the private namespace, is refused as a project root without redirection, mkdir or reconstruction.
+An existing `~/cadence` is consumer data: it is neither deleted nor automatically associated.
 See [service management](docs/service-management.md) for configuration, model/auth policy, Stop, diagnosis and informed recovery.
 
 ### Native terminal
@@ -131,18 +137,51 @@ For manual checks, `pi -e ./src/index.ts -e ./scripts/agent-panel-demo.ts` adds
 
 Open the private link that `cadence server install` printed, or that `cadence token-link --reveal` reveals.
 Valid bootstrap redirects to a token-free URL and uses an HttpOnly SameSite cookie for subsequent HTTP/WebSocket access; no localStorage token copy.
-The browser can create/plan/Start/Cancel, run exact configured checks and record human review without a live Pi terminal.
+The unified browser entry first shows projects, without an execution cwd, SDK session or default workspace.
+Only explicit Open starts or reuses a project owner.
+Within that project, the browser opens on an ordinary conversation with a real message composer, retained multi-turn context and standard read/write/edit/bash tools; no Cadence task is created by Send.
+Use `cadence <goal>` or `/cadence <goal>` at the beginning of the input, or select Cadence task, to prepare a separate task.
+Mentions, quotations and fenced code do not select task mode.
+Create is not Start: the readable plan, explicit Start, exact configured checks and human review remain separate.
+A task created from an existing ordinary conversation retains a navigation link back; the old conversation is not converted and its history is not silently injected into the task.
+All of this works without a live Pi terminal.
 A token grants workspace access, not action consent.
-Every mutation needs its own context-bound preview/confirmation; stale/duplicate/lost replies do not silently replay work.
+Cadence task mutations need their own context-bound preview/confirmation.
+Ordinary Send binds its exact text, conversation head, epoch, access and selected model; stale/duplicate/lost replies do not silently replay work.
 The WebUI provides task/run/assignment navigation, long retained messages and tool detail, exact literal search, timeline and complete scoped NDJSON/Markdown downloads.
 Desktop panes and phone drawers retain cancellation and keyboard controls.
-Its layout follows pi-web-ui: the topbar shows the connection state, every recorded view as a tab, icon actions, the exact owner model and a **New task** chip; the left sidebar lists the project, running conversations and task history, each task's runs and subagents nested under it; the right panel holds the task's plan, checks, changes and review; a statusbar sits below.
-With no task selected the page is pi's new conversation: a welcome page with starter cards above a composer whose Enter previews Create (kind and model chips beside it), and a confirmed Create opens its new task.
-A selected task shows its conversation and, where the composer sits, a next-step bar (goal → plan → start → check and review) whose buttons only open panels or request previews; every effect still needs its own confirmation.
-Phones wrap the topbar into an action row and an icon tab row, with both panels as drawers.
+Its chrome follows pi-web-ui: a compact topbar with view tabs and icon actions, a sectioned task sidebar, pill inspector tabs, transcript/tool cards and a bottom statusbar; phones wrap the topbar into an action row and an icon tab row.
+The left sidebar lists recent projects and running/retained conversations; a separate lower-left dock observes Cadence subagents and opens their retained transcripts.
+It is not pi-web-ui's subagent engine.
+The right sidebar defaults to readonly files, bounded text previews and path-only references; task plan/check/change/review controls occupy its Task details tab.
+The lower-right folder button browses directories on the service host and explicitly opens another independent project owner.
+The unified entry switches project clients on the same origin, including an explicitly configured HTTPS proxy; it never changes a running task's cwd, registers a boot service or cancels the project left behind.
+Backend cookies and native capabilities never reach the browser; proxied actions remain browser-authority actions, with owner-side consent/build/CSRF checks.
+The gateway refuses the legacy project-level Open command: all project openings use its own association route, without returning an independent backend token link.
+Direct legacy project entries remain available; only that compatibility route retains its older loopback-only cross-project navigation.
 The interface is in English or Simplified Chinese: it follows the browser's first preferred language, and the topbar's globe chip (`中文` / `EN`) switches it, remembered only in that browser.
 Error codes, identifiers, commands and recorded content stay untranslated.
 
+#### Ordinary conversation boundaries
+
+Ordinary conversations run through the same isolated SDK process launcher, exact model/auth sources and orderly Stop as tasks, with a separate private `service-v1/conversations-v1` store rather than fabricated task records or imported Pi sessions.
+Their tools operate on the host, not in a sandbox.
+Each turn holds the checkout's exclusive gate, so ordinary turns, Cadence children and parent checks cannot edit/read across one another's active write window; leaving a tab only detaches.
+Conversation identities are not recreated when their metadata disappears, unaccepted turn directories are never adopted, and rolling private writes compare their exact expected bytes.
+An active turn retains independent interruption authority even when its metadata is unavailable; readonly views do not reconstruct that metadata.
+Access-token rotation revokes viewers, not admitted queued turns.
+A completed turn retains sanitized text and tool exchanges for its next explicit Send.
+The bounded checkpoint passes through an anonymous pipe and owner-side credential redaction before persistence; hidden thinking, signatures and media are not retained.
+Failed, interrupted or over-budget turns remain visible but currently require a new conversation instead of replaying incomplete context.
+A restart never resumes pending turns; unknown work keeps fences.
+There is no upstream goal/delegate loop, subagent tool/template pack, PTY, plugin loader, prompt composer or automatic retry/compaction.
+Ordinary resources are Pi's base prompt, applicable `SYSTEM.md`/`APPEND_SYSTEM.md`/project instructions and the default skill directories, loaded on demand at Send; package extensions and package-discovered resources are not loaded into these workers.
+Limits are explicit: 200 conversations, 1000 turns per conversation, eight admitted turns (serialized within one checkout), 384KiB per retained visible turn, 2MiB continuation context, and 512MiB/10,000 entries for the separate conversation store, without eviction.
+Task history retains its existing independent bounds.
+File browsing lists at most 200 entries from 2000 directory entries and previews at most 128KiB of UTF-8 text.
+It refuses symlinks, hard-linked files, private state, Pi's agent directory (including its configured alias target), `.git`, `.env` variants, common credential directories such as `.ssh`/`.aws`, and credential/config filenames; limitations remain visible.
+This is not a filesystem sandbox for model tools.
+
 ### Root services and independent projects
 
 Linux can run Cadence as a system-level root service, without a user bus or linger:
@@ -165,7 +204,7 @@ cadence project open /absolute/new-project --create
 
 A new project selects an available loopback port once; reopening keeps its exact owner, port, cwd and history.
 The command prints its private WebUI entry link; it does not create a task, choose a model or Start execution, and existing projects' admitted work continues.
-Each project has its own WebUI entry and native `/cadence` attachment, not a global mutable cwd or a same-page cross-project router.
+Each project retains its native `/cadence` attachment and independent owner; the unified browser routes to it without a global mutable execution cwd.
 For independent boot services, use `cadence server install --system --name api --workspace /srv/api --port 17424` as root, and manage it with the same `--system --name api` flags.
 See [service management](docs/service-management.md) for migration, named port/token files and limits.
 
@@ -193,6 +232,10 @@ Capture reports redaction, omitted binary/hidden data, source truncation and inc
 Known-secret redaction is not universal detection of business secrets.
 Storage exhaustion refuses new work rather than silently evicting history.
 
+Workbench state lives separately under `<state-home>/cadence-assistant-v1/workbenches-v1/<configuration-hash>/`, not in a hidden substitute workspace.
+Whole-workbench Stop joins its accepted openings and associated exact-epoch project owners, serializing their final registry releases; unrelated, unassociated owners are not stopped.
+A changed epoch, uncertain launch or unconfirmed Stop keeps the workbench fenced, but does not prevent Stop from reaching its other known associated owners.
+Workbenches never repair missing private state or erase uncertain locks.
 Service restart never resumes the old queue.
 Uncertain process/auth/storage settlement keeps fences; use documented local informed recovery, not PID-only deletion or automatic cleanup.
 
@@ -265,6 +308,13 @@ Historical logs are not runtime dependencies, and removing development tooling m
 | `web/src/`                                                                                                 | Reused presentation and thin shared-client adapters, not SDK/session/execution ownership                                   |
 | `scripts/`, `provenance/`, `licenses/`                                                                     | Reproducible builds, exact package/body/reference/notice audits and pinned reuse                                           |
 
+`src/service/{gateway,gateway-store,gateway-cli}.ts` owns the no-project entry, private workbench coordination and same-origin project routing, not task execution.
+A root access rotation retires its proxy attachment IDs and detaches those exact browser viewers at the owners, without cancelling admitted work.
+The first version requires a selected project for ordinary Send/tools; the empty workbench is a project selector, not an unbound chat executor.
+`src/service/{workbench,conversations,workbench-files}.ts` owns ordinary conversations, their private retained turns, readonly files and explicit project navigation; `src/service/contracts/workbench.ts` is the portable closed DTO boundary.
+Conversation auth intents and original settlements use their own flushed private journal, never fabricated task/history receipts.
+Their original Stop lifetime and exclusive checkout barrier belong to the existing service owner and scheduler.
+
 The native path is `index → shell → native client → service → scheduler/process/history`.
 `src/task-controller.ts` remains a legacy regression subject, not a reachable or shipped production executor.
 The readonly operator and independent research/startup modules must not gain service startup or execution side effects.
@@ -282,6 +332,11 @@ Use their current declarations rather than copying DTO parsing, reducers, a seco
   Ordinary-user Git trust behavior remains unchanged.
   System services require uid0, bypass user managers/logind entirely and require confirmed native Stop before manager stop or definition replacement; changed state-home inputs, old user units and detached running owners refuse implicit adoption.
   Registry reservation atomically rejects canonical ancestor/descendant overlaps, including nested Git roots and aliases; a different state-home does not coordinate arbitrary other owners.
+- The short global registry lock never expires or auto-reclaims from PID absence.
+  `recover inspect|resolve` handles a valid dead same-host lock explicitly before project recovery, with fresh local-terminal acknowledgments, exact registry/unreserved-project checks and a flushed exclusive evidence receipt.
+  Concurrent or interrupted resolvers cannot remove a successor lock; all project reservations, locks and history remain intact.
+  Unreserved partial release, unsafe/corrupt registry or receipt bytes, live/remote/ambiguous holders and changed resources stay fenced.
+  Readonly diagnosis and project Open name `registry-locked`; see [global registry recovery](docs/service-management.md#residual-global-registry-lock).
 - Native entry requires fresh raw Enter within1500ms, trusted/idle TUI, no pending modal/messages and no child guard.
   Browser authentication grants access, not task consent; normal mutation ingress also requires independently built compatible client/service/assets identities.
 - Boot model choice is absent until explicitly selected.
@@ -334,7 +389,8 @@ Local operation errors neither hide an independent observation error nor imply t
 
 ### Capture, retained history and privacy
 
-The maintained worker uses public SDK APIs, explicit empty resources, in-memory session/settings and disabled retries/compaction/cache warming.
+Task workers use public SDK APIs, explicit empty resources, in-memory session/settings and disabled retries/compaction/cache warming.
+Ordinary-conversation workers share that launcher/auth/capture boundary but load only the explicit ordinary resource policy above and restore their own bounded sanitized checkpoint into an in-memory SessionManager.
 Verify exact model and effective thinking before READY/prompt; no provider discovery, credential argv/file envelope or implicit network fallback.
 Use the awaited public core-agent subscription for backpressure, reserving synchronous tool/update ingress before any copy or await.
 Custom bash uses public local operations plus the bounded redacted accumulator, not the stock raw-spill accumulator.
@@ -381,51 +437,53 @@ Browser download requested is not UI-verified completion; native export verifies
 
 Byte values are UTF-8/encoded bounds where specified; they are not targets to silently increase when a fixture fails.
 
-| Boundary              | Default / ceiling                                                                                                |
-| --------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| Graph / assignments   | 512KiB body;1–16 required assignments                                                                            |
-| Scheduling            | 8 episodes;128 queued assignments;2 preparing/running/closing child-or-check reservations                        |
-| Policy deadlines      | 6h episode;10min ready wait;20min default worker                                                                 |
-| Dependency input      | 16KiB per predecessor;32KiB aggregate; oversized required input blocks, not clips                                |
-| Worker request        | 96KiB public pre-auth plus32KiB reserve; actual complete envelope128KiB                                          |
-| Process stop          | TERM then KILL after1000ms; unknown after3000ms without confirmed close                                          |
-| Native service checks | 16MiB aggregate raw output;64KiB raw chunk;32MiB retained detail; legacy256KiB/64KiB behavior unchanged          |
-| Capture               | 64KiB encoded frame;8KiB decoded chunk;32MiB detail;128MiB child protocol                                        |
-| Capture queues        | Worker4MiB/1024 frames; owner8MiB/2048;5s reporting stall retains original charges                               |
-| Task v1               | 128KiB record; goal8KiB/plan32KiB/result and baseline16KiB;32 checks/64 activity;1000-task compatibility ceiling |
-| Read quantum          | 8MiB or100ms cooperative work, including resumed proof/accounting                                                |
-| Read replies          | 512KiB full paged/progress Reply;256KiB detail text; graph data/export-frame1MiB with graph body512KiB           |
-| Paging/search         | 50 default/200 maximum entries; literal case-sensitive query1–1024 bytes                                         |
-| Navigation            | 8192 encoded ASCII bytes; encrypted plaintext6000 bytes; no execution authority                                  |
-| Live/export           | 16 viewers,256 messages/1MiB each; two search/two export readers;120s download idle, not total archive timeout   |
-| Storage               | 10GiB checkout quota;512MiB reserved per episode;256MiB free-space floor; no TTL cleanup                         |
-| Assets                | 16MiB per member/64MiB closure; fixed complete manifest and all font bodies                                      |
+| Boundary              | Default / ceiling                                                                                                    |
+| --------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| Graph / assignments   | 512KiB body;1–16 required assignments                                                                                |
+| Scheduling            | 8 episodes;128 queued assignments;2 preparing/running/closing child-or-check reservations                            |
+| Policy deadlines      | 6h episode;10min ready wait;20min default worker                                                                     |
+| Dependency input      | 16KiB per predecessor;32KiB aggregate; oversized required input blocks, not clips                                    |
+| Worker request        | 96KiB public pre-auth plus32KiB reserve; actual complete envelope128KiB                                              |
+| Process stop          | TERM then KILL after1000ms; unknown after3000ms without confirmed close                                              |
+| Native service checks | 16MiB aggregate raw output;64KiB raw chunk;32MiB retained detail; legacy256KiB/64KiB behavior unchanged              |
+| Capture               | 64KiB encoded frame;8KiB decoded chunk;32MiB detail;128MiB child protocol                                            |
+| Capture queues        | Worker4MiB/1024 frames; owner8MiB/2048;5s reporting stall retains original charges                                   |
+| Task v1               | 128KiB record; goal8KiB/plan32KiB/result and baseline16KiB;32 checks/64 activity;1000-task compatibility ceiling     |
+| Read quantum          | 8MiB or100ms cooperative work, including resumed proof/accounting                                                    |
+| Read replies          | 512KiB full paged/progress Reply;256KiB detail text; graph data/export-frame1MiB with graph body512KiB               |
+| Paging/search         | 50 default/200 maximum entries; literal case-sensitive query1–1024 bytes                                             |
+| Navigation            | 8192 encoded ASCII bytes; encrypted plaintext6000 bytes; no execution authority                                      |
+| Live/export           | 16 viewers,256 messages/1MiB each; two search/two export readers;120s download idle, not total archive timeout       |
+| Storage               | 10GiB checkout quota;512MiB reserved per episode;256MiB free-space floor; no TTL cleanup                             |
+| Registry recovery     | 1024 namespace entries; 128 immutable attempts per lock incarnation; no evidence eviction                            |
+| Unified workbench     | 128 associated projects; 1024 durable opening receipts; 64 connections; bounded proxy frames and bodies; no eviction |
+| Assets                | 16MiB per member/64MiB closure; fixed complete manifest and all font bodies                                          |
 
 ### Validation and regression lessons
 
-| Condition                                                      | Required behavior                                                                   |
-| -------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| Missing/unsafe/corrupt/partial selected state                  | Absent or fixed refusal; no bootstrap, adoption, repair or cleanup on observation   |
-| Native exit0 with recording/stdin/final/cleanup failure        | Preserve native zero independently; no workflow success                             |
-| Stale grant, selected task bytes or model/source identity      | Refuse and require fresh observation/confirmation                                   |
-| Unknown original stop/auth/storage or changed lease            | Retain fences/charges; no guessed process signaling or automatic release            |
-| Failed/unrun/stale check, partial child or incomplete coverage | Explicit issues review; preserve independent recorded outcomes                      |
-| Lost reply or detached view                                    | Observe original receipt/run; no mutation replay or implicit Cancel                 |
-| Invalid read proof or changed source/key                       | Refuse; never rebase or interpret budget exhaustion as absence                      |
-| Dirty/partial/extra compiled assets or unsafe archive          | Refuse in place; no source refill, wildcard serving or fallback build               |
-| Extension import outside Pi aliases declared only as a peer    | Exact production dependency; Pi's install omits peers and Pi fails to start         |
-| Server install without the optional SDK or Pi `auth.json`      | No SDK: nothing written; no `auth.json`: registered, not started (no quarantine)    |
-| Package files hard-linked into a package manager's store (Bun) | Packaged reads ignore link count, bind exact bodies; other files stay single-link   |
-| Host refuses during startup                                    | Fixed code/stage only; unregistered exits `refused`, registered stays `quarantined` |
-| Workspace containing the private state home                    | Land on `~/cadence` (only start creates it); never move state into the working copy |
-| Restart changes the definition's workspace or Node path        | Stop with the loaded definition before rewriting, not only a signal                 |
-| npm 12 or Bun skips untrusted install scripts by default       | Ship none; `cadence server install` registers the service and creates the template  |
-| Service manager that only signals (launchd, Windows login)     | Orderly Stop first; an unconfirmed Stop changes nothing; no SIGTERM or `taskkill`   |
-| Pi's TUI replaces an info status with the next one             | The missing-service hint is its own warning notification                            |
-| Token source the user edits (`CADENCE_TOKEN` in `.env`)        | Read once before binding, never bound for the run: an edit cannot fence Stop        |
-| Saved port/token source differs from `.env`                    | Only when stopped, reselect just those under the reservation; running ones refuse   |
-| User-made `.env` (0755/0644, umask 002, dotfiles links)        | Like Pi's sources: ownership only, links followed; each refusal names its reason    |
-| Credential value inside a provider/model ID (Ollama `ollama`)  | Withhold and count only that catalog entry; choosing it refuses; others selectable  |
+| Condition                                                      | Required behavior                                                                                     |
+| -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
+| Missing/unsafe/corrupt/partial selected state                  | Absent or fixed refusal; no bootstrap, adoption, repair or cleanup on observation                     |
+| Native exit0 with recording/stdin/final/cleanup failure        | Preserve native zero independently; no workflow success                                               |
+| Stale grant, selected task bytes or model/source identity      | Refuse and require fresh observation/confirmation                                                     |
+| Unknown original stop/auth/storage or changed lease            | Retain fences/charges; no guessed process signaling or automatic release                              |
+| Failed/unrun/stale check, partial child or incomplete coverage | Explicit issues review; preserve independent recorded outcomes                                        |
+| Lost reply or detached view                                    | Observe original receipt/run; no mutation replay or implicit Cancel                                   |
+| Invalid read proof or changed source/key                       | Refuse; never rebase or interpret budget exhaustion as absence                                        |
+| Dirty/partial/extra compiled assets or unsafe archive          | Refuse in place; no source refill, wildcard serving or fallback build                                 |
+| Extension import outside Pi aliases declared only as a peer    | Exact production dependency; Pi's install omits peers and Pi fails to start                           |
+| Missing optional SDK or Pi `auth.json`                         | Project-less workbench may start without loading either; explicit project startup retains its refusal |
+| Package files hard-linked into a package manager's store (Bun) | Packaged reads ignore link count, bind exact bodies; other files stay single-link                     |
+| Host refuses during startup                                    | Fixed code/stage only; unregistered exits `refused`, registered stays `quarantined`                   |
+| Workspace containing the private state home                    | Refuse the project selection; no redirection, default directory or state relocation                   |
+| Restart changes the definition's workspace or Node path        | Stop with the loaded definition before rewriting, not only a signal                                   |
+| npm 12 or Bun skips untrusted install scripts by default       | Ship none; `cadence server install` registers the service and creates the template                    |
+| Service manager that only signals (launchd, Windows login)     | Orderly Stop first; an unconfirmed Stop changes nothing; no SIGTERM or `taskkill`                     |
+| Pi's TUI replaces an info status with the next one             | The missing-service hint is its own warning notification                                              |
+| Token source the user edits (`CADENCE_TOKEN` in `.env`)        | Read once before binding, never bound for the run: an edit cannot fence Stop                          |
+| Saved port/token source differs from `.env`                    | Only when stopped, reselect just those under the reservation; running ones refuse                     |
+| User-made `.env` (0755/0644, umask 002, dotfiles links)        | Like Pi's sources: ownership only, links followed; each refusal names its reason                      |
+| Credential value inside a provider/model ID (Ollama `ollama`)  | Withhold and count only that catalog entry; choosing it refuses; others selectable                    |
 
 Good: current context → explicit grant → durable acceptance → genuine original native/storage settlement → exact retained dependency → real checks → human review.
 Base: a client leaves and another reattaches to the same accepted run without launching it again.
@@ -453,7 +511,7 @@ Preserve failed attempts; correct a demonstrated cause before rerunning, and nev
 Regression owners:
 
 - `service-contract`, `service-current`, `service-model-choice`, `service-auth`: closed DTOs, exact source/choice/current authority, security and compatibility.
-- `service-owner`, `service-accepted-work`, `service-stop-continuation`, `service-recovery`: original operations, overlap, Stop, unknown fences and informed recovery.
+- `service-owner`, `service-accepted-work`, `service-stop-continuation`, `service-recovery`, `service-registry-recovery`: original operations, overlap, Stop, unknown fences and informed recovery.
 - `service-scheduler`, `service-checks`, `service-human-review`, `service-accepting-host`: real SDK overlap/exclusion, native checks, review and publication.
 - `worker-*`, `lightweight-sdk`, `lightweight-process-diff`: genuine SDK/tool capture, split redaction, no-spill bounds and original native facts.
 - `service-history-*`: durable ordering, cold/no-index/restarted proof/search/export, corruption/torn/quota and expected-byte publication.
@@ -463,20 +521,20 @@ Regression owners:
 - `package-*`, `distribution`, `service-package`, `independence`: exact tar/member/body/import/notice closure and nonactivating discovery.
 - `service-autostart`, `project-start`, `install-config`: explicit `cadence server` registration on systemd (root system scope without linger, legacy user scope), launchd and the Windows Run key, separate named service definitions and directory owners, definition escaping, restart/disable/mask/foreign handling, orderly Stop before every change, the `.env` port and token lines and a package without install scripts.
 - `service-cli`: real owners started from the `.env` port and token, reselection of a stopped workspace, edits while running and rotation of the token line.
-- `workspace-landing`: home-directory redirection to `~/cadence` across management, native attach and observation.
+- `workspace-landing`: no-default-workspace startup, explicit root refusal and noncreating native/readonly entry.
+- `service-gateway` and `gateway-browser`: real same-origin project routing, browser-only authority, retirement on token rotation, continuing ordinary work and genuine multi-owner Stop; loopback and isolated HTTPS browser lanes.
 
 Regenerate operator/service/native/browser outputs only through their canonical builders; `--check` variants compare new private output without overwriting canonical bytes.
 WebUI text is keyed by its English source: fixed text goes through `useT().t`, whose type requires a `web/src/i18n/zh.ts` entry with the same `{name}` marks, and run-time status words or kept notices through `tx`, which passes unknown text and codes through.
 The timeline client takes the chosen language from its bridge and is remounted on a switch; browser scenarios pin `locale: "en-US"` so English assertions do not follow the host's `LANG`.
-The browser is conversation-first: the left panel groups the current service project, the actual active roster and retained task conversations, with run/subagent children under their task.
-One service still exposes one checkout; the project section is not a cross-project registry, Pi session importer or cwd switcher.
-The center shows retained message text as Markdown by default; tools/context/timeline/run facts are direct topbar tabs beside export/link actions, while the collapsible right inspector remains bound to the task's current plan/check/change/review context even when viewing a child.
-With no task selected the center is the new-task composer; Enter only requests a Create preview, and a followed Create receipt opens its task once published.
-A selected task's next-step bar derives its step from the saved graph revision, observed runs and the active roster (the Cancel authority); it opens inspector tabs or requests Generate/Start previews.
-An observation poll withholds action capability while it reads, which invalidates an open confirmation, so automatic follow-ups (receipt lookups, roster rereads after a run settles) never poll or navigate while a preview is prepared or confirmed.
-A failed poll is observed again after 2s, doubling to the 30s cadence; the owner can answer a read `receipt-inconclusive` briefly while it publishes.
+The browser is conversation-first: ordinary chat and explicit Cadence task conversations share its sidebar, while a lower-left dock observes actual Cadence child identities.
+One service still owns one checkout.
+The recent-project directory records only explicit project openings in the same private namespace; navigation opens that project's independent authenticated entry rather than changing global cwd, importing Pi sessions or adopting another account's state.
+The center shows ordinary streamed messages or retained task text as Markdown.
+Task tools/context/timeline/run facts and export/link actions live under Details.
+The right panel defaults to files; its Task details inspector remains bound to the task's current plan/check/change/review context even when viewing a child.
 Historical child links bind exact scope and watermark.
-Bounded history and Back never silently rebase; a conversation that fits its first page follows newer snapshots with one bounded read at a time, paged history offers an explicit new-activity update, and source limitations/progress stay visible even when complete-record metadata is folded.
+Bounded history and Back never silently rebase; running conversations offer an explicit new-activity update, and source limitations/progress stay visible even when complete-record metadata is folded.
 Cancel uses the independent active roster (including the fallback strip when workspace discovery fails); navigation, project selection and hiding panels never cancel or authorize execution.
 
 Publish `web/dist` from Node: Vite run under Bun lays out its preload helper differently, so a Bun build fails a Node `build:web:check`.
@@ -484,13 +542,48 @@ Review the independently enumerated package member list and every emitted body,
 Keep public Pi peers external for the extension, the exact Undici/ws runtime edges, the exact optional SDK pins for the standalone owner and all upstream/font/vendor notices.
 Preserve original license bytes through their precise Git attributes; line-ending normalization must not invalidate audited source/notice hashes.
 
-### Release 2.0.13 acceptance snapshot
+### Release 2.0.15 acceptance snapshot
+
+The release candidate passed the complete root suite: 2034 tests in 85 files, with 27 platform skips on Linux.
+The final browser-only frame-readiness adjustment then passed all 9 real-browser scenarios; 130 web tests and the 135-member real-pack audit also passed.
+This is separate-lane evidence, not a claim that one final `verify` invocation was entirely green.
+Observed environment: Linux x86_64, Node26.7.0, Bun1.3.14, Pi SDK0.84.3 and existing Chrome for Testing151.0.7922.34; root runs used `VITEST_MAX_WORKERS=1` without changing test deadlines.
+New coverage includes actual registry-writer and resolver exits, concurrent resolvers, unchanged project fences/history, changed/linked/remote/live resources, a removed stopped workspace, piped/pasted/canceled refusal, genuine native-TTY confirmation and browser Open after explicit recovery without replay.
 
-Full `verify` passed on the 2.0.13 release candidate before this evidence-only paragraph: 1983 root tests in 80 files (27 skipped on Linux), 133 web tests, 6 real-browser scenarios and the 132-member pack audit.
-Observed environment: Linux x86_64, Node22.22.1, Bun1.3.14, Pi SDK0.84.3 and existing Chrome for Testing153.0.8010.12.
-The WebUI follows pi-web-ui's new-conversation layout: a bottom composer whose Enter only previews Create, starter cards that only fill the draft, a next-step bar per task, direct topbar view tabs and a New task chip; a followed Create receipt opens the created task.
-The accepting-browser scenario first failed with Confirm start disabled because automatic follow-ups polled while a confirmation was open; they now skip while a preview is prepared or confirmed.
-Service contracts are unchanged; no new Windows/macOS, real service-manager installation or paid-provider qualification is claimed.
+The first integration command was cut off by its 25-minute outer command budget while tests were still running.
+The next completed root run failed one omitted browser-test provenance pin (updated) and three owner/proxy settlement or timeout cases, which passed separately; their timing cause was not established.
+A later complete root/web pass encountered Chromium's first screenshot-capture failure; the browser fixture now waits for painted frames before that capture, without retrying operations or swallowing capture errors, and all browser scenarios passed afterward.
+The last full attempt hit six history-test deadlines in two files; those unchanged files passed all 45 tests in a subsequent diagnostic run, and the earlier complete root pass remains distinct from that later failure.
+Failed logs and isolated fixture evidence were preserved; no test budget was increased, dependency/browser downloaded, consumer lock deleted or service installed/restarted.
+No paid-provider use or new native Windows/macOS qualification is claimed.
+
+### Release 2.0.14 acceptance snapshot
+
+Full `verify` passed on the release candidate before this evidence-only note, with `VITEST_MAX_WORKERS=1`: 2000 root tests in 84 files (27 skipped on Linux), 130 web tests, 9 real-browser scenarios and the 135-member real-pack audit.
+Observed environment: Linux x86_64, Node26.7.0, Bun1.3.14, Pi SDK0.84.3 and existing Chrome for Testing151.0.7922.34.
+Review fixes refuse hard-linked file previews, common credential paths and configured private-directory alias targets; block legacy project Open through the gateway so backend token links and unassociated owners cannot escape its route; and continue serial Stop attempts for other associated owners after an earlier refusal, without releasing uncertain fences.
+Each boundary regression was observed failing before its fix and passing afterward; the generated service and browser outputs were rebuilt through their canonical builders.
+The first default-concurrency integration run failed 25 tests: 21 timeouts, three state refusals and one stale provenance pin.
+The reviewed destination pins were refreshed, the three state-refusal cases passed independently, and the complete single-worker run passed without increasing any deadline or omitting tests; the earlier failures remain failure evidence, not retrospectively successful runs.
+No consumer service installation/restart, paid-provider use or new native Windows/macOS qualification is claimed.
+
+### Unified-entry verification snapshot
+
+The unified no-default-workspace change passed full `verify` before this evidence-only note: 1997 root tests in 84 files (27 skipped on Linux), 130 web tests, 9 real-browser scenarios and the 135-member real-pack audit.
+New browser cases exercise a real generated workbench and independently opened owners under both loopback and a CA-validated HTTPS proxy: no default directory, same-origin switching, ordinary Send, explicit Create without Start, and retained chat/task navigation after refresh.
+The genuine SDK uses an isolated fabricated provider; no paid account, physical device or new native Windows/macOS qualification is implied.
+An early browser attempt completed its UI assertions but left one concurrently stopped owner quarantined; its failed closure receipt remains failure evidence, and the gateway now serializes associated owner Stop through their shared registry.
+The first full integration attempt then passed root/web checks but hit an existing browser harness's late response-body read; the harness now reads that exact response immediately, without request replay or a larger wait, and the subsequent complete `verify` passed.
+No consumer service was installed or restarted, and no existing `~/cadence` or uncertain state was deleted.
+
+### Ordinary-chat workbench integration snapshot
+
+Full `verify` passed on the working tree before this evidence-only note: 1994 root tests in 82 files (27 skipped on Linux), 130 web tests, 7 real-browser scenarios and the 135-member real pack audit.
+Observed environment: Linux x86_64, Node26.7.0, Bun1.3.14, Pi SDK0.84.3 and existing Chrome for Testing151.0.7922.34.
+The new lane used the genuine SDK against a fabricated loopback provider: ordinary multi-turn restore, a real write tool, duplicate-send observation, directory/credential boundaries, queued cancellation, orderly Stop/restart, rotation while queued, independent project owners/ports, and preserved unaccepted or missing metadata.
+Browser coverage includes the ordinary composer, file preview/reference, explicit Cadence creation without Start, retained origin navigation, and settled desktop/390px/320px drawer layouts.
+Early attempts caught an optional-envelope decoder regression, late OAuth-settlement tracking during Stop, old package/body counts and worker source pins, plus browser interactions that needed to await modal closure and reference/drawer updates; those were corrected before the final full pass.
+No existing budgets were enlarged, no browser/dependency was downloaded, and no consumer service installation, paid-provider or new Windows/macOS qualification is claimed.
 
 ### Release 2.0.12 acceptance snapshot
 

package/THIRD_PARTY_NOTICES.md

@@ -17,6 +17,7 @@ Cadence directly adapts token digest comparison, cookie encoding/decoding, boots
 The source/destination inventory and deliberate security changes are recorded in `provenance/auth-reuse.json`.
 The complete upstream notice is preserved at `licenses/pi-web-ui-MIT.txt`.
 The substantial workspace/navigation/transcript/tool/Markdown/review/search/timeline/responsive/reconciliation adaptations are inventoried in `provenance/webui-reuse.json` and summarized in shipped `docs/reuse-and-distribution.md`.
+The ordinary-chat composer, directory picker, readonly file browser and agent-dock presentation additionally reference pi-web-ui revision `944f556463d6693a3f0cfe375c22680090e85bbe`, under the same retained MIT notice; its subagent/goal/delegate engines and prompt composer are not included.
 
 ## Bundled browser dependencies, icons and fonts
 

package/docs/remote-access.md

@@ -59,3 +59,16 @@ Environment-backed tokens require explicit Stop/restart with changed environment
 Links may already exist in clipboard/history or external logs; redirecting cannot retract disclosure.
 Use [management and recovery](service-management.md) for Stop, uncertainty and exact local resolution.
 Loopback HTTPS/viewport tests are not physical-device or second-machine deployment qualification.
+
+## Unified workbench entry
+
+The default workbench can route associated projects on the same HTTPS origin; it does not redirect remote browsers to a project owner's loopback port.
+Its explicit `cadence workbench start --config /absolute/private-http-policy.json` accepts the HTTP policy object (schema `cadence-service-http/1`, `host`, `port`, `proxy`), not a project HostConfig or an execution cwd.
+Use the same `proxy.origin` and trusted immediate proxy addresses as above; the `.env` remains authoritative for the port and token.
+The selected policy is retained in private workbench state, so after orderly `cadence workbench stop` a default `cadence server install` can register that entry without a project or a default workspace.
+Do not install over an independently running detached entry; stop it explicitly first.
+The gateway authenticates and validates Host/Origin before routing, rejects browser local-capability headers and management paths, and forwards project requests with browser cookies, not native authority.
+Project attachment IDs, owner CSRF/build compatibility, consent, retained read proofs and exports remain owner-validated.
+A workbench token rotation revokes its routes and retires its exact browser viewers without cancelling admitted project work.
+Project ports, backend cookies and local capabilities remain server-side.
+This is one entry for a trusted service account, not multi-tenant filesystem isolation or an OS sandbox.

package/docs/reuse-and-distribution.md

@@ -3,6 +3,7 @@
 ## Source families
 
 Cadence adapts `xing-shuyin/pi-web-ui@e8bab487af208bc9a1ab60a821652323f598127f`, MIT copyright 2026 xing-shuyin.
+The ordinary-chat composer, folder picker and file/dock presentation additionally reference sibling revision `944f556463d6693a3f0cfe375c22680090e85bbe`; the separate reference hashes are retained alongside the original pins.
 The full original license is `licenses/pi-web-ui-MIT.txt`.
 Repository `provenance/webui-reuse.json` records source/destination hashes and explicit incompatible branches removed; `provenance/auth-reuse.json` records token/cookie adaptation.
 
@@ -18,8 +19,9 @@ Repository `provenance/webui-reuse.json` records source/destination hashes and e
 | use-chat, message-delta              | Shared typed reconciliation, gaps/resync and no mutation replay          |
 | Token/cookie and upgrade guards      | Cookie-first authenticated HTTP/WS, explicit Host/Origin/CSRF boundaries |
 
-No upstream runtime, general chat server, PTY, plugin loader, browser shell, credentials editor, reconnect continuation or task repair ships.
-Cadence's finite owner/admission/history contracts replace those incompatible seams.
+No upstream chat/subagent runtime, goal/delegate loop, PTY, plugin loader, browser shell, credentials editor, prompt composer, reconnect replay or task repair ships.
+Cadence owns ordinary conversations separately, using its existing native launcher, exact model/auth resolution and checkout gate; its finite task admission/history contracts remain unchanged.
+Readonly file browsing and explicit independent project opening are new Cadence service operations, not upstream filesystem mutation or global `set_cwd` routes.
 
 ## Emitted licenses
 
@@ -43,3 +45,12 @@ The retired shell-local controller is not a shipped competing executor.
 The real pack audit rejects missing/extra/duplicate/linked/special/unsafe members, altered bodies, pin/notice/font drift and linked extraction roots/ancestors.
 Extracted tests use tar-only package bodies and explicitly linked existing fixture peers; they never fill missing package files from source.
 No version bump, dependency install or publication is implied by this redesign.
+
+## Unified entry without a default workspace
+
+`web/src/Workbench.tsx` composes the project selector and existing project UI without importing pi-web-ui's session/execution service.
+The Cadence-owned gateway uses the existing authentication, public codecs, private-files discipline and independently coordinated project owners.
+The no-project entry never initializes an SDK session, manufactures a checkout, creates `~/cadence`, or repairs a missing project directory.
+A technical service-process cwd is not a model/tool workspace.
+The built same-origin routing covers both HTTP requests and WebSockets, while browser authority and project consent remain distinct from native management capability.
+New Linux manager tests exercise the no-workspace default; macOS/Windows generated-definition tests are not native-platform execution qualification.