@lchase/kiln 0.1.0 → 0.3.0

package/README.md

@@ -1,10 +1,10 @@
 # Kiln
 
-Kiln runs a workflow against a git checkout. Register any repo, add a job from a markdown spec, a prompt, a directory of tickets, or a Jira Cloud issue, and tick. Tick launches ready jobs in yak worktrees. Status shows each job. Approve or reject answers a human gate.
+Kiln runs a workflow against a git checkout. Register any repo, add a job from a markdown spec, a prompt, a directory of tickets, or a Jira Cloud issue, and tick. Tick launches ready jobs in yak worktrees. Status shows each job. Approve or reject answers a human gate. `kiln serve` opens that same derived state in a browser on this machine.
 
 A ready spec is the input. Kiln does not build or iterate requirements.
 
-This repository is public. Checkout paths and jobs stay in gitignored `.kiln/` or `~/.kiln/`. Do not commit them.
+This repository is public. Checkout paths and jobs stay in `~/.kiln/` (or `$KILN_HOME` when that is set). Do not commit them.
 
 ## Install
 
@@ -14,6 +14,10 @@ kiln repo add web /absolute/path/to/web --test "npm test"
 kiln repo list
 ```
 
+Run `kiln repo add <name> <path>` from any directory. The first run creates `~/.kiln/kiln.config.json`. Jobs, logs, and deliveries live in that same directory, whichever directory you run `kiln` from. Set `KILN_HOME` or pass `--config <file>` to use a different kiln home.
+
+If `./.kiln/kiln.config.json` is still in the working directory and the home config does not exist, kiln stops. Move it with `mv ./.kiln ~/.kiln`, or pass `--config` / set `KILN_HOME`. Kiln does not move it for you.
+
 `kiln` is the command. The subcommands in the rest of this file are the same ones. Examples that say `npm run kiln --` are the in-checkout form.
 
 ## Develop from a checkout
@@ -47,12 +51,12 @@ npm run kiln -- repo add api /absolute/path/to/api --test "npm test"
 npm run kiln -- repo list
 ```
 
-`npm run kiln` builds first. `npm run kiln -- repo add` writes `./.kiln/kiln.config.json` (or updates `~/.kiln/kiln.config.json` when that file already exists). A relative path is stored relative to the config file's directory. `~` is expanded from the home directory. `test` is optional on the entry and required before tick can launch a job in that repo.
+`npm run kiln` builds first. `kiln repo add <name> <path>` writes `~/.kiln/kiln.config.json`. When `KILN_HOME` is set it writes `$KILN_HOME/kiln.config.json`. `--config <file>` writes that file instead, and jobs live in the file's directory. A relative path is stored absolute, resolved from the working directory at add time. `~` is expanded from the home directory. `test` is optional on the entry and required before tick can launch a job in that repo.
 
 ```json
 {
   "repos": {
-    "web": { "path": "../web", "test": "npm test" },
+    "web": { "path": "/absolute/path/to/web", "test": "npm test" },
     "api": { "path": "~/src/api", "test": "npm test" }
   },
   "maxConcurrent": 2,
@@ -64,7 +68,7 @@ npm run kiln -- repo list
 
 ## Add a job
 
-A job is one workflow run. The workflow name is a file `workflows/<name>.yaml`. `feature` is the factory loop. Bug, investigation, and security workflows are next. A later `pr-review` workflow is not in this repo yet.
+A job is one workflow run. The workflow name is a file `workflows/<name>.yaml`. `feature` is the factory loop. `investigation` answers a spike and stops for a person to approve the findings. Bug and security workflows are next. A later `pr-review` workflow is not in this repo yet.
 
 ```bash
 npm run kiln -- add feature --repo web --spec spec.md --title "Show a Sunday summary"
@@ -72,7 +76,7 @@ npm run kiln -- add feature --repo api --spec api-spec.md --after <job-id>
 npm run kiln -- add feature --repo web --jira PROJ-123
 ```
 
-`--title` defaults to the first `#` heading in the spec, then the file name. `--after` may be repeated. Those jobs must already exist. Kiln copies the spec to `.kiln/specs/<id>.md` and writes `.kiln/jobs/<id>.json`:
+`--title` defaults to the first `#` heading in the spec, then the file name. `--after` may be repeated. Those jobs must already exist. Kiln copies the spec to `~/.kiln/specs/<id>.md` and writes `~/.kiln/jobs/<id>.json`:
 
 ```json
 {
@@ -87,7 +91,7 @@ npm run kiln -- add feature --repo web --jira PROJ-123
 }
 ```
 
-`dependsOn` is omitted when the job has no `--after`. `stack: true` is set by `--stack` and is omitted otherwise. `source` records which intake created the job. Jobs written before intake omit `source` and still run. State is not stored. The pull request url is not stored on the job; Kiln writes it under `.kiln/deliveries/`.
+`dependsOn` is omitted when the job has no `--after`. `stack: true` is set by `--stack` and is omitted otherwise. `source` records which intake created the job. Jobs written before intake omit `source` and still run. State is not stored. The pull request url is not stored on the job; Kiln writes it under `~/.kiln/deliveries/`.
 
 ## Intake
 
@@ -121,7 +125,7 @@ npm run kiln -- import ./tickets --repo web --workflow feature --context spec.md
 
 One file becomes one job. Blocked-by becomes `dependsOn` on the imported job ids. An unknown number is an error that names the ticket file, and no new job is written.
 
-`--workflow` defaults to `feature`. Kiln switches a ticket to `investigation` only when `workflows/investigation.yaml` exists and the ticket is a spike: front matter `type` is `spike`, `investigation`, or `research` (the word after a colon counts, as in `wayfinder:research`), the title contains spike or probe, or the text says "no product code". A body that only mentions an upstream spike stays on the requested workflow. `investigation` is not in this repo, so a spike ticket stays on the requested workflow and Kiln prints a warning.
+`--workflow` defaults to `feature`. Kiln switches a ticket to `investigation` when the ticket is a spike: front matter `type` is `spike`, `investigation`, or `research` (the word after a colon counts, as in `wayfinder:research`), the title contains spike or probe, or the text says "no product code". A body that only mentions an upstream spike stays on the requested workflow.
 
 `--context` defaults to `spec.md` in the parent of the ticket directory when that file is present. The text is appended to every job spec as a `## Background` section. A context file larger than 40KB is not copied in. The spec names its path instead.
 
@@ -136,7 +140,7 @@ npm run kiln -- add feature --repo web --jira PROJ-123 --after <job-id> --dry-ru
 
 `--jira` reads one Jira Cloud issue over REST API v3 and writes the same job as the other intakes. `source.kind` is `jira`. `source.ref` is the issue key (`PROJ-123`). The title is `PROJ-123: <summary>`. The spec is that heading, a `Source:` line with the issue's browse URL, then the description converted from Atlassian document format to markdown.
 
-Set `JIRA_BASE_URL` (for example `https://acme.atlassian.net`), `JIRA_EMAIL`, and `JIRA_API_TOKEN`. Each value falls back to the optional `jira` block in the gitignored kiln config (`./.kiln/kiln.config.json`, or `~/.kiln/kiln.config.json` when the working directory has no config):
+Set `JIRA_BASE_URL` (for example `https://acme.atlassian.net`), `JIRA_EMAIL`, and `JIRA_API_TOKEN`. Each value falls back to the optional `jira` block in the kiln config (`~/.kiln/kiln.config.json`, or `$KILN_HOME/kiln.config.json` when `KILN_HOME` is set, or the file passed with `--config`). Environment variables override the block:
 
 ```json
 "jira": {
@@ -148,10 +152,30 @@ Set `JIRA_BASE_URL` (for example `https://acme.atlassian.net`), `JIRA_EMAIL`, an
 
 Create a token at <https://id.atlassian.com/manage-profile/security/api-tokens>. Kiln sends it as Basic auth and does not write it into the job, the spec, or error text. A missing value is an error that names `JIRA_BASE_URL`, `JIRA_EMAIL`, or `JIRA_API_TOKEN`.
 
-A Blocks link where this issue is blocked by another key becomes `dependsOn` when a kiln job with `source` `jira` and that key already exists. Otherwise Kiln prints a warning naming the key and still creates the job. `--after` is merged with those ids. Issue type Spike or Research uses the same rule as a spike ticket: `investigation` when `workflows/investigation.yaml` exists, and a warning on the requested workflow when it does not. Running add again for the same key prints the existing job id and creates nothing. `--dry-run` prints the job and writes nothing.
+A Blocks link where this issue is blocked by another key becomes `dependsOn` when a kiln job with `source` `jira` and that key already exists. Otherwise Kiln prints a warning naming the key and still creates the job. `--after` is merged with those ids. Issue type Spike or Research uses the same rule as a spike ticket and is imported as `investigation`. Running add again for the same key prints the existing job id and creates nothing. `--dry-run` prints the job and writes nothing.
 
 `examples/spec.md` is a fictional spec you can copy.
 
+## Serve
+
+```bash
+kiln serve
+kiln serve --port 4100 --tick 30
+kiln serve --no-tick
+```
+
+`kiln serve` listens on `127.0.0.1` only (port 4100 unless `--port` is set). It reads the same derived state as `kiln status` and calls the same approve and reject functions. Nothing new is stored.
+
+`/` is the inbox: jobs in `needs-human`, with the gate prompt, the artifacts and review output yak wrote, links to the spec and the log, and Approve / Reject. An investigation job also links to its findings. `/board` groups every job by state, shows `dependsOn` (including blocked-by), the stacked flag, the pull request for `in-review` and `done`, and the failure or launch error for `failed`. Both pages refresh every 3 seconds.
+
+`GET /jobs/<id>/findings` renders the approved findings markdown as text. HTML in that file is escaped. The page is read-only.
+
+`GET /api/jobs` and `GET /api/jobs/<id>` return that view as JSON. `POST /api/jobs/<id>/approve` and `POST /api/jobs/<id>/reject` answer the gate. A browser POST from another origin is rejected. The page and the stylesheet ship inside the package (`assets/serve.css`, read from the package root).
+
+By default, serve runs `kiln tick` once when it starts and then every 30 seconds. `--tick <seconds>` changes the interval. `--no-tick` leaves the factory where it is. The tick uses the same lock as `kiln tick`, so a second tick exits with "another kiln tick is running" instead of launching twice. There is no intake form in this UI yet.
+
+The Jira API token is not rendered. Do not commit checkout paths or job files.
+
 ## Tick, status, approve
 
 ```bash
@@ -169,7 +193,7 @@ while true; do npm run kiln -- tick; sleep 30; done
 
 A job is ready when its dependencies are met and the number of jobs in flight is under `maxConcurrent`. The default is after merged: every job in `dependsOn` is `done`. `--stack` is met when that one upstream has landed. A rejected gate does not unblock the next job. An ok run with no readable approval does not either.
 
-`npm run kiln -- status` lists jobs across repos. When a job has `source`, status prints `source <kind> <ref>`. For `needs-human` it prints `approve: kiln approve <id>` and `reject: kiln reject <id>`. Run those as `npm run kiln -- approve <id>` and `npm run kiln -- reject <id>`. For `done` and `in-review` it prints `branch yak/<run-id>`. For `deliver=pr` it also prints the pull request url once one exists. For `blocked` on a dependency id that has no job file, it prints `blocked on missing job <id>`. While an upstream pull request is open, it prints `waiting for PR #N to merge`.
+`npm run kiln -- status` lists jobs across repos. When a job has `source`, status prints `source <kind> <ref>`. For `needs-human` it prints `approve: kiln approve <id>` and `reject: kiln reject <id>`. Run those as `npm run kiln -- approve <id>` and `npm run kiln -- reject <id>`. For `done` and `in-review` it prints `branch yak/<run-id>`. For `deliver=pr` it also prints the pull request url once one exists. For an investigation whose findings file exists, it prints `findings <path>`. That path is `findingsPath` on the same status view `kiln serve` renders, and the inbox and board link it. For `blocked` on a dependency id that has no job file, it prints `blocked on missing job <id>`. While an upstream pull request is open, it prints `waiting for PR #N to merge`.
 
 State is derived from the yak journal, the gate files, and (for `deliver=pr`) `gh pr view`:
 
@@ -184,7 +208,7 @@ State is derived from the yak journal, the gate files, and (for `deliver=pr`) `g
 | `failed` | The run failed, the launch died before a journal, the run finished ok with no readable approval, or a pull request could not be opened |
 | `dead` | The journal's process is gone. Status prints the cancel command |
 | `in-review` | `deliver=pr` and the run has landed. The pull request is open, or the next tick still has to open it |
-| `done` | `deliver=local`: the run finished ok and the gate says approve. `deliver=pr`: that pull request has merged |
+| `done` | `deliver=local`: the run finished ok and the gate says approve. `deliver=pr`: that pull request has merged. An investigation is `done` when the gate says approve, including when the repo is `deliver=pr`. It does not enter `in-review` |
 
 ## What a feature job runs
 
@@ -196,6 +220,18 @@ Verify runs the repo's `test` command with `failOn: never`. Stdout and stderr st
 
 The first launch adds `.runs/` and `.yak/` to that checkout's `.git/info/exclude`.
 
+## What an investigation job runs
+
+A spike, probe, or research ticket runs `workflows/investigation.yaml`. One agent explores the worktree. It may run commands and scripts. It must not change product code: the step has no Write or Edit tool, and the prompt forbids creating, editing, deleting, committing, and pushing. The agent returns a markdown document with four sections: Questions, Answers (each answer includes evidence: file paths and command output), Unconfirmed, and Implications for dependent tickets.
+
+The run then suspends on a human gate. There is no build, review, verify, or land step. `npm run kiln -- approve <job-id>` stores that markdown at `<kiln-dir>/findings/<job-id>.md` and the job is `done`. Writing the same text again does not change the file. `npm run kiln -- reject <job-id>` is `rejected` and writes no findings file. A rejected investigation does not unblock a dependent.
+
+`deliver=pr` does not change this. Kiln does not push the investigation branch and does not run `gh pr create`.
+
+A later job whose `dependsOn` includes that investigation receives the findings in the spec yak sees. Kiln appends a `## Findings from <title>` section for each investigation dependency. The copy under `<kiln-dir>/specs/` is left as it was. After merged still waits until the investigation is `done`. `--stack` onto an investigation is an error: there is no branch to target.
+
+`adapter: "mock"` reads `test/fixtures/kiln-investigation/explore.json` from the checkout. The prompt is `prompts/kiln/investigation.md`. The published package includes `prompts` and `workflows`.
+
 ## Delivery and dependencies
 
 `deliver` is set on the repo. The default is `local`: the job is `done` when the run lands on `yak/<run-id>`, and Kiln does not push. Existing repos and tests stay on that path.
@@ -206,7 +242,7 @@ npm run kiln -- repo add web /absolute/path/to/web --test "npm test" --deliver p
 
 `deliver` is `local` or `pr`. `base` is the pull request base branch. When `base` is omitted, Kiln uses origin's default branch, from `refs/remotes/origin/HEAD` after `git fetch`.
 
-With `deliver=pr`, the tick after an approved land pushes `yak/<run-id>` and runs `gh pr create --draft`. The title is the job title. The body is the spec's first paragraph, the line `Kiln job: <id>`, and the security, ux, ui, code, and approver verdicts. The branch, pull request number, and url are written to `.kiln/deliveries/<job-id>.json`, not the job file. A later tick looks up an existing pull request for that branch and does not push when origin already has the same commit. Kiln does not merge, and it does not push the base branch.
+With `deliver=pr`, the tick after an approved land pushes `yak/<run-id>` and runs `gh pr create --draft`. The title is the job title. The body is the spec's first paragraph, the line `Kiln job: <id>`, and the security, ux, ui, code, and approver verdicts. The branch, pull request number, and url are written to `~/.kiln/deliveries/<job-id>.json`, not the job file. A later tick looks up an existing pull request for that branch and does not push when origin already has the same commit. Kiln does not merge, and it does not push the base branch. An investigation is not delivered this way: approve stores findings and the job is `done`.
 
 If `gh` is missing or not authenticated, that job becomes `failed` and status prints what to run (`gh auth login`, then `kiln tick`). The rest of the tick still runs. The next tick tries again.
 
@@ -216,7 +252,7 @@ If `gh` is missing or not authenticated, that job becomes `failed` and status pr
 
 The default is after merged. A job stays `blocked` until every upstream is `done`. Status says `waiting for PR #N to merge` while an upstream pull request is open. A `deliver=pr` worktree is cut from `origin/<base>` after `git fetch`, not from checkout `HEAD`.
 
-`--stack` on `kiln add` or `kiln import` waits for one upstream to be approved and landed, then cuts the worktree from that upstream branch (`yak/<run-id>`). The pull request targets that branch. `stack` with any count other than one dependency is an error at add time, and the upstream job has to be in the same repo. Stacked work does not wait for the upstream pull request to merge.
+`--stack` on `kiln add` or `kiln import` waits for one upstream to be approved and landed, then cuts the worktree from that upstream branch (`yak/<run-id>`). The pull request targets that branch. `stack` with any count other than one dependency is an error at add time, and the upstream job has to be in the same repo. Stacking onto an investigation is an error, because that job does not land a branch. Stacked work does not wait for the upstream pull request to merge.
 
 ```bash
 npm run kiln -- add feature --repo web --spec spec.md --after <job-id> --stack
@@ -225,4 +261,4 @@ npm run kiln -- import ./tickets --repo web --stack
 
 ## Not included
 
-No requirement refinement. Bug, investigation, security, and pr-review workflows are not in this repo yet. Kiln does not merge pull requests and does not push the base branch.
+No requirement refinement. Bug, security, and pr-review workflows are not in this repo yet. Kiln does not merge pull requests and does not push the base branch.

package/assets/serve.css

@@ -0,0 +1,233 @@
+/* kiln-serve */
+:root {
+  color-scheme: light;
+  --bg: #efe6d6;
+  --bg-2: #e7dcc8;
+  --card: #fffaf3;
+  --ink: #241c16;
+  --muted: #6f6256;
+  --line: #e0d3c2;
+  --accent: #c2410c;
+  --accent-ink: #fff7f2;
+  --good: #1f6b45;
+  --bad: #9b2c2c;
+  --chip: #f3e7d6;
+  --shadow: 0 1px 0 rgba(36, 28, 22, 0.04);
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  background:
+    radial-gradient(1200px 400px at 10% -10%, #f7efe2, transparent 50%),
+    var(--bg);
+  color: var(--ink);
+  font: 15px/1.45 ui-sans-serif, system-ui, sans-serif;
+}
+
+a { color: inherit; }
+
+.top {
+  display: flex;
+  align-items: baseline;
+  gap: 1.25rem;
+  padding: 1rem 1.5rem;
+  border-bottom: 1px solid var(--line);
+  background: rgba(255, 250, 243, 0.9);
+  position: sticky;
+  top: 0;
+}
+
+.kiln-mark {
+  font-weight: 700;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  text-decoration: none;
+  color: var(--accent);
+}
+
+nav { display: flex; gap: 0.9rem; }
+
+nav a {
+  text-decoration: none;
+  color: var(--muted);
+}
+
+nav a[aria-current="page"] {
+  color: var(--ink);
+  font-weight: 650;
+}
+
+.refresh {
+  margin: 0 0 0 auto;
+  color: var(--muted);
+  font-size: 0.85rem;
+}
+
+main {
+  width: min(980px, calc(100% - 2rem));
+  margin: 1.25rem auto 3rem;
+}
+
+h1 {
+  font-size: 1.35rem;
+  font-weight: 650;
+  margin: 0 0 0.35rem;
+}
+
+.lede {
+  margin: 0 0 1.25rem;
+  color: var(--muted);
+}
+
+.empty {
+  padding: 1.25rem;
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: 12px;
+}
+
+.card, .job {
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: 12px;
+  box-shadow: var(--shadow);
+  padding: 1rem 1.1rem 1.05rem;
+  margin: 0 0 0.85rem;
+}
+
+.card h2, .job h3 {
+  margin: 0;
+  font-size: 1.15rem;
+  font-weight: 650;
+}
+
+.meta, .deps, .links, .why {
+  color: var(--muted);
+}
+
+.meta { margin: 0.25rem 0 0.75rem; }
+
+.meta code, .deps a {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.86em;
+}
+
+.prompt {
+  margin: 0 0 0.75rem;
+  padding: 0.7rem 0.8rem;
+  background: #fff;
+  border-left: 3px solid var(--accent);
+  white-space: pre-wrap;
+}
+
+.facts {
+  list-style: none;
+  margin: 0 0 0.75rem;
+  padding: 0;
+}
+
+.facts li { margin: 0.2rem 0; }
+
+.facts .name {
+  display: inline-block;
+  min-width: 5.5rem;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 0.86em;
+  color: var(--muted);
+}
+
+h4 {
+  margin: 0.4rem 0 0.2rem;
+  font-size: 0.78rem;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--muted);
+}
+
+.links a { margin-right: 0.9rem; }
+
+.actions { display: flex; gap: 0.5rem; margin-top: 0.85rem; }
+
+button {
+  font: inherit;
+  border-radius: 8px;
+  padding: 0.4rem 0.85rem;
+  cursor: pointer;
+}
+
+button.approve {
+  background: var(--accent);
+  color: var(--accent-ink);
+  border: 1px solid var(--accent);
+}
+
+button.reject {
+  background: transparent;
+  color: var(--ink);
+  border: 1px solid var(--line);
+}
+
+.group { margin: 0 0 1.4rem; }
+
+.group h2 {
+  font-size: 0.95rem;
+  margin: 0 0 0.45rem;
+  display: flex;
+  gap: 0.5rem;
+  align-items: baseline;
+}
+
+.count {
+  color: var(--muted);
+  font-weight: 450;
+  font-size: 0.85rem;
+}
+
+.chips { display: flex; flex-wrap: wrap; gap: 0.35rem; margin: 0.45rem 0; }
+
+.chip {
+  background: var(--chip);
+  border-radius: 999px;
+  padding: 0.1rem 0.5rem;
+  font-size: 0.78rem;
+}
+
+.chip.state-needs-human,
+.chip.state-blocked { background: #f6d7b8; }
+
+.chip.state-failed,
+.chip.state-rejected,
+.chip.state-dead,
+.chip.state-invalid { background: #f3d0d0; color: var(--bad); }
+
+.chip.state-approved,
+.chip.state-done,
+.chip.state-in-review { background: #d7eadf; color: var(--good); }
+
+.chip.state-running,
+.chip.state-queued { background: #d9e4f2; }
+
+.deps { margin: 0.35rem 0; }
+
+.details {
+  margin: 0.4rem 0 0;
+  padding: 0;
+  list-style: none;
+  color: var(--muted);
+}
+
+.details li.bad { color: var(--bad); }
+
+pre.text {
+  white-space: pre-wrap;
+  word-break: break-word;
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: 12px;
+  padding: 1rem;
+  margin: 0;
+}
+
+.back { display: inline-block; margin-bottom: 0.75rem; }

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { addRepo, renderRepoList, resolveKilnConfig } from "./config.js";
 import { answerJob, runStatus, runTick } from "./driver.js";
+import { startServe } from "./serve.js";
 import { addFromFile } from "./intake/file.js";
 import { addFromJira } from "./intake/jira.js";
 import { addFromPrompt } from "./intake/prompt.js";
@@ -16,15 +17,24 @@ function usage() {
         "       kiln status [jobId] [--config <file>]",
         "       kiln approve <jobId> [--config <file>]",
         "       kiln reject <jobId> [--config <file>]",
+        "       kiln serve [--port 4100] [--tick <seconds>|--no-tick] [--config <file>]",
         "",
-        "repo add registers a checkout. Relative paths are stored relative to the",
-        "config directory. ~ is expanded from the home directory.",
+        "repo add registers a checkout. A relative path is stored absolute, resolved",
+        "from the working directory. ~ is expanded from the home directory.",
+        "",
+        "Config, jobs, logs, and deliveries live in one kiln home: --config <file>",
+        "if given, otherwise $KILN_HOME/kiln.config.json when KILN_HOME is set,",
+        "otherwise ~/.kiln/kiln.config.json. repo add creates that directory.",
+        "Run kiln repo add <name> <path> from any directory. A leftover",
+        "./.kiln/kiln.config.json is an error until you mv ./.kiln ~/.kiln,",
+        "pass --config <file>, or set KILN_HOME.",
         "",
         "add writes one job from a spec file, from --prompt text (--prompt - reads stdin),",
         "or from a Jira Cloud issue (--jira PROJ-123). Pass one of those, not more.",
         "The repo and the workflow (workflows/<name>.yaml) must already exist.",
         "--after names jobs that must be done before this one launches. --stack waits",
         "for one upstream to land and opens the pull request against that branch.",
+        "--stack cannot target an investigation job: that workflow does not land a branch.",
         "A Jira Blocks link where this issue is blocked by another key is included",
         "when a kiln job for that key already exists.",
         "--dry-run with --jira prints the job and writes nothing. Running add again",
@@ -36,13 +46,20 @@ function usage() {
         "",
         "tick launches at most one ready job. After merged, dependencies must be done.",
         "Stacked jobs launch once the upstream has landed. deliver=pr then pushes",
-        "yak/<run-id> and opens a draft pull request. status prints the derived state.",
+        "yak/<run-id> and opens a draft pull request. An investigation is done when",
+        "its gate is approved. It does not open a pull request. status prints the",
+        "derived state, and the findings path once an investigation is approved.",
         "approve and reject answer the human gate.",
+        "",
+        "serve listens on 127.0.0.1. The inbox lists needs-human jobs. The board",
+        "groups every job by the same derived state as status. Approve and reject",
+        "call the same functions as the CLI. POST from another origin is rejected.",
+        "A tick runs every 30 seconds unless --no-tick is set, using the tick lock.",
     ].join("\n"));
     process.exit(2);
 }
 function parseFlags(argv) {
-    const bag = { positionals: [], after: [], dryRun: false, stack: false };
+    const bag = { positionals: [], after: [], dryRun: false, stack: false, noTick: false };
     for (let i = 0; i < argv.length; i += 1) {
         const flag = argv[i];
         const next = argv[i + 1];
@@ -138,6 +155,30 @@ function parseFlags(argv) {
             i += 1;
             continue;
         }
+        if (flag === "--port") {
+            if (!next || !/^\d+$/.test(next))
+                usage();
+            const port = Number(next);
+            if (port > 65535)
+                usage();
+            bag.port = port;
+            i += 1;
+            continue;
+        }
+        if (flag === "--tick") {
+            if (!next || !/^[1-9]\d*$/.test(next))
+                usage();
+            const seconds = Number(next);
+            if (seconds > 86_400)
+                usage();
+            bag.tickSeconds = seconds;
+            i += 1;
+            continue;
+        }
+        if (flag === "--no-tick") {
+            bag.noTick = true;
+            continue;
+        }
         if (flag?.startsWith("--"))
             usage();
         if (flag !== undefined)
@@ -145,9 +186,14 @@ function parseFlags(argv) {
     }
     return bag;
 }
+function rejectServeFlags(flags) {
+    if (flags.port !== undefined || flags.tickSeconds !== undefined || flags.noTick)
+        usage();
+}
 function repoCommand(argv) {
     const sub = argv[0];
     const flags = parseFlags(argv.slice(1));
+    rejectServeFlags(flags);
     if (sub === "list") {
         if (flags.positionals.length !== 0 || hasIntakeFlags(flags) || flags.test || flags.deliver || flags.base)
             usage();
@@ -174,6 +220,7 @@ function repoCommand(argv) {
 }
 async function addCommand(argv) {
     const flags = parseFlags(argv);
+    rejectServeFlags(flags);
     const workflow = flags.positionals[0];
     const selected = [flags.spec !== undefined, flags.prompt !== undefined, flags.jira !== undefined].filter(Boolean).length;
     if (!workflow ||
@@ -226,6 +273,7 @@ async function addCommand(argv) {
 }
 function importCommand(argv) {
     const flags = parseFlags(argv);
+    rejectServeFlags(flags);
     const dir = flags.positionals[0];
     if (!dir ||
         flags.positionals.length !== 1 ||
@@ -255,6 +303,7 @@ function importCommand(argv) {
 }
 function tickCommand(argv) {
     const flags = parseFlags(argv);
+    rejectServeFlags(flags);
     if (flags.positionals.length !== 0 || flags.test || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
         usage();
     }
@@ -263,6 +312,7 @@ function tickCommand(argv) {
 }
 function statusCommand(argv) {
     const flags = parseFlags(argv);
+    rejectServeFlags(flags);
     if (flags.positionals.length > 1 || flags.test || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
         usage();
     }
@@ -271,6 +321,7 @@ function statusCommand(argv) {
 }
 function gateCommand(choice, argv) {
     const flags = parseFlags(argv);
+    rejectServeFlags(flags);
     const jobId = flags.positionals[0];
     if (!jobId || flags.positionals.length !== 1 || flags.test || hasIntakeFlags(flags) || flags.deliver || flags.base || flags.stack) {
         usage();
@@ -278,6 +329,26 @@ function gateCommand(choice, argv) {
     const config = resolveKilnConfig({ configPath: flags.configPath });
     process.stdout.write(answerJob(config, jobId, choice));
 }
+async function serveCommand(argv) {
+    const flags = parseFlags(argv);
+    if (flags.positionals.length !== 0 ||
+        flags.test ||
+        hasIntakeFlags(flags) ||
+        flags.deliver ||
+        flags.base ||
+        flags.stack ||
+        (flags.noTick && flags.tickSeconds !== undefined)) {
+        usage();
+    }
+    const config = resolveKilnConfig({ configPath: flags.configPath });
+    const port = flags.port ?? 4100;
+    const tickSeconds = flags.noTick ? undefined : (flags.tickSeconds ?? 30);
+    await startServe({
+        config,
+        port,
+        ...(tickSeconds !== undefined ? { tickSeconds } : {}),
+    });
+}
 function hasIntakeFlags(flags) {
     return Boolean(flags.repo ||
         flags.spec ||
@@ -323,6 +394,10 @@ async function main() {
         gateCommand("reject", argv.slice(1));
         return;
     }
+    if (command === "serve") {
+        await serveCommand(argv.slice(1));
+        return;
+    }
     usage();
 }
 try {