@nanobpm/nano-workforce 0.123.2 → 0.124.0

package/pages/delivery-graphs/mount.js

@@ -1,29 +1,31 @@
-// pages/delivery-graphs/mount.js — the Delivery Graphs compose → preview → dispatch view (ADR 0005,
-// issue #441). The human front door for a delivery graph: author/paste a `DeliveryGraph` JSON,
-// PREVIEW it (a pure compile — nothing is dispatched) to SEE the rendered plan before approving it,
-// then DISPATCH it through the gated two-step.
+// pages/delivery-graphs/mount.js — the Delivery Graphs compose → preview → STAGE view (ADR 0005,
+// issues #441 + #460). The human front door for a delivery graph: author/paste a `DeliveryGraph` JSON
+// and PREVIEW it — a compile that renders the plan (mermaid `diagram`, the `humanNodes[]` stop-points,
+// the `sideEffects[]` a dispatch will perform) AND stages it as a proposal for dispatch.
+//
+// Dispatch is deliberately NOT here (issue #460): it is an OPERATOR action on the **Staged proposals**
+// grid on the same page (the Dispatch row-action, which posts the proposal's `digest`). Removing the
+// dispatch affordance from every agent-reachable seam closes the self-approval hole the old replayable
+// approval token (a content digest handed back to the same caller) left open — this view only ever
+// stages, never launches.
 //
 // A self-contained, dependency-free renderer in the SAME shape as the demand×supply board
 // (pages/board/mount.js) and the agent cockpit: the SAME module mounts embedded in the console (App
 // View) and standalone on a phone — only the host element and injected endpoint config differ. The app
-// has no browser build step, so this consumes the preview/dispatch doors straight off the wire.
+// has no browser build step, so this consumes the preview door straight off the wire.
 //
-// It is a THIN UI over the EXISTING doors — there is no parallel compile/dispatch path:
-//   • PREVIEW  → POST previewUrl  (previewDeliveryGraph)  — pure; renders the mermaid `diagram`, the
-//                `humanNodes[]` stop-points, the `sideEffects[]` the operator is asked to approve, and
-//                path-qualified validation `errors[]` inline for a 400 (the fix-and-recompile loop).
-//   • DISPATCH → POST dispatchUrl (dispatchDeliveryGraph → startDeliveryGraph) — the gated two-step:
-//                a side-effecting graph parks `awaiting-approval` (400 + `approvalToken`); the view
-//                shows the side-effect summary and, on confirm, re-submits with `approve` → 202
-//                running. A graph with only `wait`/`human` nodes dispatches without approval.
+// It is a THIN UI over the EXISTING door — there is no parallel compile/stage path:
+//   • PREVIEW & STAGE → POST previewUrl (previewDeliveryGraph) — renders the mermaid `diagram`, the
+//     `humanNodes[]` stop-points, the `sideEffects[]` a dispatch will perform, and path-qualified
+//     validation `errors[]` inline for a 400 (the fix-and-recompile loop); on success the compiled
+//     graph is STAGED as a proposal (an operator dispatches it from the Staged proposals grid below).
 
 const DEFAULT_PREVIEW_URL = "app/api/actions/delivery-graph/preview";
-const DEFAULT_DISPATCH_URL = "app/api/actions/delivery-graph/dispatch";
 
-// A bounded timeout for every door request. Without it a hung preview/dispatch endpoint leaves the
-// fetch promise pending forever, so the busy() lock never clears and the UI is stranded (buttons
-// disabled, status stuck) with no way to retry. On timeout the AbortController rejects the fetch,
-// which surfaces as an error banner and re-enables the controls via the callers' finally blocks.
+// A bounded timeout for every door request. Without it a hung preview endpoint leaves the fetch
+// promise pending forever, so the busy() lock never clears and the UI is stranded (buttons disabled,
+// status stuck) with no way to retry. On timeout the AbortController rejects the fetch, which surfaces
+// as an error banner and re-enables the controls via the callers' finally blocks.
 const REQUEST_TIMEOUT_MS = 30000;
 
 const EXAMPLE_GRAPH = JSON.stringify(
@@ -89,11 +91,11 @@ function renderHumanNodes(humanNodes) {
   </section>`;
 }
 
-/** Render the side-effects table — WHAT the graph will do (what approval authorises, Decision 7). */
+/** Render the side-effects table — WHAT the graph will do once an operator dispatches it (Decision 7). */
 function renderSideEffects(sideEffects) {
   const rows = Array.isArray(sideEffects) ? sideEffects : [];
   if (rows.length === 0) {
-    return '<section class="card"><h2>Side effects <span class="count">0</span></h2><p class="ok">No side effects — this graph has only <code>wait</code>/<code>human</code> nodes, so it dispatches without approval.</p></section>';
+    return '<section class="card"><h2>Side effects <span class="count">0</span></h2><p class="ok">No side effects — this graph has only <code>wait</code>/<code>human</code> nodes.</p></section>';
   }
   const body = rows
     .map(
@@ -107,7 +109,7 @@ function renderSideEffects(sideEffects) {
     .join("");
   return `<section class="card card-warn">
     <h2>Side effects <span class="count">${rows.length}</span></h2>
-    <p class="warn">These actions the graph WILL perform once dispatched — approving the preview authorises them.</p>
+    <p class="warn">These actions the graph WILL perform once an operator dispatches it — dispatching authorises them.</p>
     <table class="grid"><thead><tr><th>Node</th><th>Kind</th><th>Effect</th><th>Dedupe key</th></tr></thead><tbody>${body}</tbody></table>
   </section>`;
 }
@@ -123,15 +125,17 @@ function renderErrors(message, errors) {
   </section>`;
 }
 
-/** Render the successful preview: summary chips, the human/side-effect tables, and the mermaid source. */
+/** Render the successful preview: the staged banner, summary chips, the human/side-effect tables, and
+ * the mermaid source. Dispatch is NOT offered here — the operator dispatches the staged proposal from
+ * the Staged proposals grid below (issue #460). */
 function renderPreview(result) {
   const title = result.title ? `<code>${esc(result.title)}</code>` : '<span class="muted">(unnamed)</span>';
   const gate = result.sideEffecting
-    ? '<span class="pill pill-connector">requires approval</span>'
-    : '<span class="pill pill-wait">no approval needed</span>';
-  const summary = `<section class="card">
-    <h2>Preview ${gate}</h2>
-    <p class="muted">Pure compile — nothing was dispatched. Review the plan below, then Dispatch it.</p>
+    ? '<span class="pill pill-connector">side-effecting</span>'
+    : '<span class="pill pill-wait">no side effects</span>';
+  const summary = `<section class="card card-ok">
+    <h2>Staged ${gate}</h2>
+    <p class="ok">Compiled and staged as a proposal. Dispatch is an operator action — review it in the <b>Staged proposals</b> grid below and click <b>Dispatch</b> on the one you approve.</p>
     <div class="chips">
       <span class="chip">Graph ${title}</span>
       <span class="chip">Nodes <b>${esc(result.nodeCount)}</b></span>
@@ -148,26 +152,10 @@ function renderPreview(result) {
   return summary + renderSideEffects(result.sideEffects) + renderHumanNodes(result.humanNodes) + diagram;
 }
 
-/** Render the dispatch outcome banner (running / already-running). */
-function renderDispatched(result) {
-  const already = result.alreadyRunning
-    ? ' <span class="muted">(re-dispatch short-circuited onto the already-running run)</span>'
-    : "";
-  return `<section class="card card-ok">
-    <h2>Dispatched — ${esc(result.status || "running")}${already}</h2>
-    <p class="ok">Watch it advance in the in-flight grid below.</p>
-    <div class="chips">
-      ${result.runKey ? `<span class="chip">Run <code>${esc(result.runKey)}</code></span>` : ""}
-      ${result.processInstanceKey ? `<span class="chip">Instance <code>${esc(result.processInstanceKey)}</code></span>` : ""}
-      ${result.processDefinitionId ? `<span class="chip">Definition <code>${esc(result.processDefinitionId)}</code></span>` : ""}
-    </div>
-  </section>`;
-}
-
 /**
- * Mount the compose → preview → dispatch view into `host`.
+ * Mount the compose → preview → stage view into `host`.
  * @param {Element|null} host — the element to render into (or null → look up #delivery-graphs-root).
- * @param {{previewUrl?:string, dispatchUrl?:string, hookSecret?:string}} [config]
+ * @param {{previewUrl?:string, hookSecret?:string}} [config]
  */
 export function mountDeliveryGraphs(host, config = {}) {
   const isElement = host != null && host.nodeType === 1 && typeof host.innerHTML === "string";
@@ -175,7 +163,6 @@ export function mountDeliveryGraphs(host, config = {}) {
   if (!root) return () => {};
 
   const previewUrl = config.previewUrl ?? DEFAULT_PREVIEW_URL;
-  const dispatchUrl = config.dispatchUrl ?? DEFAULT_DISPATCH_URL;
   const headers = () => ({
     "content-type": "application/json",
     ...(config.hookSecret ? { "x-hook-secret": config.hookSecret } : {}),
@@ -188,25 +175,19 @@ export function mountDeliveryGraphs(host, config = {}) {
       <h2>1 · Compose</h2>
       <p class="muted">Paste or author a <code>DeliveryGraph</code> JSON (nodes/edges over the closed <code>agent</code>/<code>wait</code>/<code>human</code>/<code>connector</code> vocabulary).</p>
       <textarea id="dg-json" class="json" spellcheck="false" placeholder='{ "name": "…", "nodes": [ … ], "edges": [ … ] }'></textarea>
-      <label class="idem"><span>Idempotency key <span class="muted">(optional — a re-dispatch with the same key won't double-launch)</span></span><input id="dg-idem" class="input" type="text" placeholder="(optional)" /></label>
       <div class="actions">
-        <button id="dg-preview" class="btn btn-primary" type="button">Preview</button>
-        <button id="dg-dispatch" class="btn" type="button">Dispatch</button>
+        <button id="dg-preview" class="btn btn-primary" type="button">Preview &amp; stage</button>
         <button id="dg-example" class="btn btn-ghost" type="button">Load example</button>
         <span id="dg-status" class="status"></span>
       </div>
     </section>
-    <div id="dg-approval"></div>
     <div id="dg-output"></div>
   </div>`;
 
   const jsonEl = root.querySelector("#dg-json");
-  const idemEl = root.querySelector("#dg-idem");
   const statusEl = root.querySelector("#dg-status");
   const outputEl = root.querySelector("#dg-output");
-  const approvalEl = root.querySelector("#dg-approval");
   const previewBtn = root.querySelector("#dg-preview");
-  const dispatchBtn = root.querySelector("#dg-dispatch");
   const exampleBtn = root.querySelector("#dg-example");
 
   function setStatus(text, tone) {
@@ -216,17 +197,6 @@ export function mountDeliveryGraphs(host, config = {}) {
 
   function busy(on) {
     previewBtn.disabled = on;
-    dispatchBtn.disabled = on;
-  }
-
-  // While a side-effecting graph is parked awaiting approval, LOCK the compose inputs so the operator
-  // cannot edit `graphJson`/idempotency key out from under the token they are about to approve — the
-  // approval must bind to the exact graph that was previewed and parked (the server derives the
-  // approval digest from whatever body it receives, so an edited textarea would silently approve a
-  // DIFFERENT graph). `doApprove` dispatches the FROZEN graph captured at park time, not the live field.
-  function lockCompose(on) {
-    jsonEl.readOnly = on;
-    idemEl.readOnly = on;
     exampleBtn.disabled = on;
   }
 
@@ -258,25 +228,18 @@ export function mountDeliveryGraphs(host, config = {}) {
     return jsonEl.value;
   }
 
-  function idempotencyKey() {
-    const v = idemEl.value.trim();
-    return v === "" ? undefined : v;
-  }
-
   async function doPreview() {
-    approvalEl.innerHTML = "";
-    lockCompose(false);
     if (graphJson().trim() === "") {
       setStatus("Paste a delivery-graph JSON to preview.", "err");
       return;
     }
     busy(true);
-    setStatus("Compiling preview…");
+    setStatus("Compiling & staging…");
     try {
       const { status, body } = await post(previewUrl, { graphJson: graphJson() });
       if (status === 200 && body.ok) {
         outputEl.innerHTML = renderPreview(body);
-        setStatus("\u2713 Compiled — nothing was dispatched.", "ok");
+        setStatus("\u2713 Staged — dispatch it from the Staged proposals grid below.", "ok");
       } else {
         outputEl.innerHTML = renderErrors(body.error, body.errors);
         setStatus("Preview failed — fix the errors and re-preview.", "err");
@@ -289,74 +252,11 @@ export function mountDeliveryGraphs(host, config = {}) {
     }
   }
 
-  /** Show the approval confirmation panel for a side-effecting graph parked awaiting-approval. The
-   * `frozen` graph/idempotency key are the EXACT values that produced this park — on confirm we
-   * dispatch those, never the (now-locked) live fields, so approval binds to the previewed graph. */
-  function showApproval(parked, frozen) {
-    approvalEl.innerHTML = `<section class="card card-warn">
-      <h2>Approval required</h2>
-      <p class="warn">${esc(parked.message || "This graph performs side effects and needs explicit approval to dispatch.")}</p>
-      <p class="muted">Approval token <code>${esc(parked.approvalToken || parked.digest || "")}</code>. Approving confirms the side effects rendered in the preview above.</p>
-      <div class="actions">
-        <button id="dg-approve" class="btn btn-primary" type="button">Approve &amp; dispatch</button>
-        <button id="dg-cancel" class="btn btn-ghost" type="button">Cancel</button>
-      </div>
-    </section>`;
-    approvalEl.querySelector("#dg-cancel").addEventListener("click", () => {
-      approvalEl.innerHTML = "";
-      lockCompose(false);
-      setStatus("Dispatch cancelled — the graph was not approved.", "");
-    });
-    approvalEl.querySelector("#dg-approve").addEventListener("click", () => doDispatch(true, frozen));
-  }
-
-  async function doDispatch(approve, frozen) {
-    // On approve, dispatch the graph FROZEN at park time; otherwise read the live compose fields.
-    const graph = frozen ? frozen.graphJson : graphJson();
-    if (graph.trim() === "") {
-      setStatus("Paste a delivery-graph JSON to dispatch.", "err");
-      return;
-    }
-    busy(true);
-    setStatus(approve ? "Approving & dispatching…" : "Dispatching…");
-    try {
-      const payload = { graphJson: graph, approve: approve === true };
-      const idem = frozen ? frozen.idempotencyKey : idempotencyKey();
-      if (idem !== undefined) payload.idempotencyKey = idem;
-      const { status, body } = await post(dispatchUrl, payload);
-      if (status === 202 && body.ok) {
-        approvalEl.innerHTML = "";
-        lockCompose(false);
-        outputEl.innerHTML = renderDispatched(body);
-        setStatus("\u2713 Dispatched.", "ok");
-      } else if (status === 400 && body.status === "awaiting-approval") {
-        // The gated two-step: a side-effecting graph parked at approval. Freeze the exact graph +
-        // idempotency key that parked and lock the compose inputs, then surface the confirm panel; the
-        // operator's confirm re-submits THAT frozen graph with approve=true → 202 running.
-        lockCompose(true);
-        showApproval(body, { graphJson: graph, idempotencyKey: idem });
-        setStatus("Approval required before this side-effecting graph can dispatch.", "warn");
-      } else {
-        approvalEl.innerHTML = "";
-        lockCompose(false);
-        outputEl.innerHTML = renderErrors(body.error, body.errors);
-        setStatus("Dispatch refused — fix the errors and try again.", "err");
-      }
-    } catch (err) {
-      outputEl.innerHTML = renderErrors(err && err.message ? err.message : String(err), []);
-      setStatus("Dispatch request failed.", "err");
-    } finally {
-      busy(false);
-    }
-  }
-
   previewBtn.addEventListener("click", doPreview);
-  dispatchBtn.addEventListener("click", () => doDispatch(false));
   exampleBtn.addEventListener("click", () => {
     jsonEl.value = EXAMPLE_GRAPH;
-    approvalEl.innerHTML = "";
     outputEl.innerHTML = "";
-    setStatus("Example loaded — Preview it.", "");
+    setStatus("Example loaded — Preview & stage it.", "");
   });
 
   return () => {

package/pages/delivery-graphs.page.json

@@ -70,7 +70,7 @@
       "type": "text",
       "id": "subtitle",
       "props": {
-        "text": "The human front door for delivery graphs (ADR 0005). Compose an agent-authored delivery-graph JSON, Preview it (a pure compile \u2014 nothing is dispatched) to SEE the rendered plan \u2014 its mermaid diagram, the human stop-points where it parks on a person, and the side effects it will perform \u2014 and fix any path-qualified validation errors inline. Then Dispatch it: a graph with any side-effecting node (it merges PRs / publishes packages) parks for an explicit Approve & dispatch confirm of the rendered preview; a graph with only wait/human nodes dispatches straight away. The compose \u2192 preview \u2192 dispatch view is a thin UI over the same compileDeliveryGraph / startDeliveryGraph doors \u2014 there is no parallel submit path.",
+        "text": "The human front door for delivery graphs (ADR 0005). An agent composes a delivery-graph JSON and compiles it \u2014 a valid compile is STAGED here as a proposal (issue #460); the agent surface ends there and hands you a proposal to review. Paste a graph below to preview + stage it yourself: SEE the rendered plan \u2014 its mermaid diagram, the human stop-points where it parks on a person, and the side effects it will perform \u2014 and fix any path-qualified validation errors inline. Then DISPATCH is your call: the Staged proposals grid below lists every staged proposal (agent- or operator-composed); review its preview and click Dispatch on the one you approve \u2014 that click IS the approval, content-addressed to the exact graph you previewed. There is no agent dispatch endpoint to replay.",
         "variant": "sub"
       }
     },
@@ -78,12 +78,59 @@
       "type": "appView",
       "id": "delivery-graphs-compose",
       "props": {
-        "title": "Compose \u2192 preview \u2192 dispatch",
+        "title": "Compose \u2192 preview \u2192 stage",
         "embed": "./delivery-graphs/embed.html",
         "standalone": "./delivery-graphs/standalone.html",
         "fill": true
       }
     },
+    {
+      "type": "dataGrid",
+      "id": "delivery-graphs-staged",
+      "props": {
+        "title": "Staged proposals",
+        "collapsible": true,
+        "defaultCollapsed": false,
+        "showCount": true,
+        "rowKey": "digest",
+        "refreshMs": 5000,
+        "empty": "No staged proposals awaiting dispatch. Compile a graph (as an agent) or preview + stage one above, then Dispatch it here.",
+        "data": {
+          "kind": "datasource",
+          "source": "app",
+          "table": "delivery_graph_proposals",
+          "orderBy": { "field": "created_at", "dir": "desc" },
+          "filter": [{ "field": "status", "in": ["staged"] }]
+        },
+        "columns": [
+          { "field": "title", "template": "{{title}}", "header": "Graph", "subtitleField": "digest", "truncate": true, "width": "34%" },
+          { "field": "node_count", "header": "Nodes" },
+          { "field": "human_node_count", "header": "Human" },
+          { "field": "side_effect_count", "header": "Side effects" },
+          { "field": "created_at", "header": "Staged", "width": "9rem", "format": "datetime" },
+          { "field": "expires_at", "header": "Expires", "width": "9rem", "format": "datetime" }
+        ],
+        "rowActions": [
+          {
+            "label": "Dispatch",
+            "confirm": "Dispatch this staged delivery graph? This launches the graph engine-natively \u2014 any side-effecting node (it merges PRs / publishes packages) will run. Clicking Dispatch IS the approval, content-addressed to exactly the graph shown here.",
+            "action": {
+              "path": "/app/api/actions/delivery-graph/dispatch",
+              "body": { "digest": "{{row.digest}}" }
+            }
+          }
+        ],
+        "detail": {
+          "fields": [
+            { "field": "digest", "label": "Digest" },
+            { "field": "logical_key", "label": "Logical key" },
+            { "field": "side_effecting", "label": "Side-effecting" },
+            { "field": "preview", "label": "Preview (diagram, human stop-points, side effects)" },
+            { "field": "graph", "label": "Graph JSON (normalized serialization to be dispatched)" }
+          ]
+        }
+      }
+    },
     {
       "type": "dataGrid",
       "id": "delivery-graphs-inflight",
@@ -119,7 +166,7 @@
         "detail": {
           "fields": [
             { "field": "process_definition_id", "label": "Definition" },
-            { "field": "digest", "label": "Digest (approval token)" },
+            { "field": "digest", "label": "Digest" },
             { "field": "phase_node_id", "label": "Parked node" }
           ]
         }

package/scripts/check-migrations.test.ts

@@ -93,4 +93,13 @@ test("collision detector flags a non-NNN shape and grandfathers historical dupes
     [],
     "grandfathered prefix 052 is not a new violation",
   );
+  // 075 (#458 vs #460/#463) is a merged, immutable, disjoint-object collision grandfathered in #470.
+  assertEquals(
+    collisionErrorsFromFiles([
+      "075_delivery_graph_proposals.sql",
+      "075_feature_read_model_attention_from_user_tasks.sql",
+    ]),
+    [],
+    "grandfathered prefix 075 is not a new violation",
+  );
 });

package/scripts/check-migrations.ts

@@ -51,7 +51,17 @@ const MIGRATIONS_DIR = join(REPO_ROOT, "db", "migrations");
 // below — renumbering a merged migration is itself forbidden (the rename would re-run it and abort
 // boot, issue #357). The two create disjoint tables (`worker_durable_resume`, `plan_conformance`), so
 // apply order is irrelevant. Grandfather 052; any NEW duplicate prefix still fails the build.
-const GRANDFATHERED_DUPES: ReadonlySet<string> = new Set(["004", "005", "006", "007", "049", "052"]);
+//
+// 075 is the same merge-skew story across two PRs that never saw each other (issue #470): #458 landed
+// `075_feature_read_model_attention_from_user_tasks` and #460/#463 landed `075_delivery_graph_proposals`,
+// each the branch-local "next" prefix, colliding silently only once both were on main (releases then
+// stalled behind the red gate). Both are already applied forward-only and immutable (#357) — renumbering
+// a merged migration would re-run it and abort boot, and the immutability check would itself flag the
+// rename. They create DISJOINT objects (`075_delivery_graph_proposals` adds the `delivery_graph_proposals`
+// table + its indexes; `075_feature_read_model_…` redefines the `feature_read_model` VIEW and adds one
+// `user_tasks` index), so their relative apply order is irrelevant. Grandfather 075; any NEW duplicate
+// prefix still fails the build (the next migration is 076).
+const GRANDFATHERED_DUPES: ReadonlySet<string> = new Set(["004", "005", "006", "007", "049", "052", "075"]);
 
 const PREFIX = /^(\d{3})_[^/]*\.sql$/;
 

package/test/cockpit-embed-endpoints.test.ts

@@ -1,14 +1,23 @@
-// Regression guard for issue #279: the cockpit renders empty when viewed through the Studio console
-// App-View because its default supply/transcript endpoints were ABSOLUTE (leading-slash) paths.
+// Regression guard for issues #279 and #467: the cockpit renders empty when its default supply /
+// transcript endpoints don't resolve to the app's `/app/api/agentic/…` root.
 //
-// Studio frames the app in an iframe whose document base is the app-view path
-// (`/console/app-view/<AppName>/`) but whose ORIGIN is the console (`:8080`). A leading-slash fetch
-// therefore resolves against the console origin root — `:8080/app/api/agentic/supply` → 404 — instead
-// of the app-view base that actually serves the API. The console does NOT inject
-// `window.__NANO_APP_VIEW__`, so `mount.js` falls back to its default; the default must be
-// BASE-RELATIVE (no leading slash) so the browser resolves it against `document.baseURI` and it lands
-// on the app-view base standalone AND embedded alike. This test pins that resolution behaviour so the
-// absolute-path regression can't return.
+// The cockpit shell (embed.html / standalone.html) — and therefore mount.js — is served ONE DIRECTORY
+// DEEP under `/cockpit/` on every surface:
+//   • standalone / local urban-SPA App-View: `<origin>/cockpit/mount.js`
+//   • Studio console App-View (proxied):      `<console>/console/app-view/<AppName>/cockpit/mount.js`
+// while the API is served at the app root, a sibling of `/cockpit/`: `<appMount>/app/api/agentic/…`.
+//
+// #279 (first attempt) used ABSOLUTE (leading-slash) defaults, which through Studio resolved against
+// the console ORIGIN (:8080) not the app-view base → 404. The base-relative fix that followed traded
+// that for a subtler bug (#467): a document-base-relative default resolves against the `…/cockpit/`
+// shell base to `…/cockpit/app/api/agentic/supply` → 404 on ALL surfaces. The earlier guard hid this
+// by resolving against the app-view/app ROOT (dropping the real `/cockpit/` segment the shell is
+// served under), so it validated a base the browser never actually uses.
+//
+// The correct default is anchored to mount.js's OWN url (import.meta.url), i.e. `../app/api/agentic/…`
+// relative to `<appMount>/cockpit/mount.js`, which resolves to `<appMount>/app/api/agentic/…` on every
+// surface regardless of the document base. This test pins that resolution against the REAL, `/cockpit/`
+// -deep module url so neither the absolute-path (#279) nor the base-relative (#467) regression can return.
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import { readFileSync } from "node:fs";
@@ -17,51 +26,65 @@ const ROOT = decodeURIComponent(new URL("../", import.meta.url).pathname);
 const MOUNT_JS = readFileSync(`${ROOT}pages/cockpit/mount.js`, "utf8");
 const EMBED_HTML = readFileSync(`${ROOT}pages/cockpit/embed.html`, "utf8");
 
-// Pull the string default out of `const <name> = opts.<name> ?? "<default>";` in mount.js.
-function defaultEndpoint(name: string): string {
-  const m = MOUNT_JS.match(new RegExp(`opts\\.${name}\\s*\\?\\?\\s*"([^"]*)"`));
-  assert(m, `mount.js must default opts.${name} to a string literal`);
+// Pull the module-relative default spec out of
+// `const <name> = opts.<name> ?? new URL("<spec>", import.meta.url).href;` in mount.js.
+function defaultSpec(name: string): string {
+  const m = MOUNT_JS.match(
+    new RegExp(`opts\\.${name}\\s*\\?\\?\\s*new URL\\(\\s*"([^"]*)"\\s*,\\s*import\\.meta\\.url\\s*\\)\\s*\\.href`),
+  );
+  assert(
+    m,
+    `mount.js must default opts.${name} to new URL("<spec>", import.meta.url) so the endpoint is ` +
+      `anchored to the module's own served location, not the document base (#467)`,
+  );
   return m![1];
 }
 
-// The two surfaces mount.js serves, per the issue's URL table:
-const APP_VIEW_BASE = "http://studio-host:8080/console/app-view/Workforce/"; // Studio iframe base
-const STANDALONE_BASE = "http://127.0.0.1:3000/"; // standalone shell served at the app root
+// The REAL served location of mount.js on each surface: one directory deep under `/cockpit/`.
+const STANDALONE_MOUNT = "http://127.0.0.1:3000/cockpit/mount.js";
+const STUDIO_MOUNT = "http://studio-host:8080/console/app-view/Workforce/cockpit/mount.js";
 
-for (const name of ["reportUrl", "transcriptsUrl"] as const) {
-  test(`#279: mount.js default ${name} is base-relative (no leading slash)`, () => {
-    const def = defaultEndpoint(name);
+for (const [name, endpoint] of [
+  ["reportUrl", "app/api/agentic/supply"],
+  ["transcriptsUrl", "app/api/agentic/transcripts"],
+] as const) {
+  test(`#467: default ${name} is module-anchored (relative to import.meta.url, not the document base)`, () => {
+    const spec = defaultSpec(name);
+    assert(
+      !spec.startsWith("/"),
+      `default ${name} spec "${spec}" must not be absolute: a leading-slash path resolves against ` +
+        `the iframe ORIGIN (console :8080), not the app-view base, so every fetch 404s (#279)`,
+    );
     assert(
-      !def.startsWith("/"),
-      `default ${name} "${def}" must not start with "/": a leading-slash path resolves against the ` +
-        `iframe ORIGIN (console :8080), not the app-view base, so every fetch 404s through Studio (#279)`,
+      spec.startsWith("../"),
+      `default ${name} spec "${spec}" must step up out of /cockpit/ (import.meta.url points at ` +
+        `<appMount>/cockpit/mount.js; the API is a sibling at <appMount>/app/api/…) (#467)`,
     );
   });
 
-  test(`#279: default ${name} resolves onto the app-view base inside the Studio iframe`, () => {
-    const def = defaultEndpoint(name);
-    // The bug: the default resolved to the console origin root (dropping /console/app-view/Workforce/).
-    // The fix: it must resolve UNDER the app-view base so it hits the endpoint the console proxies.
+  test(`#467: default ${name} resolves to the app root standalone (not under /cockpit/)`, () => {
+    const spec = defaultSpec(name);
     assertEquals(
-      new URL(def, APP_VIEW_BASE).href,
-      `http://studio-host:8080/console/app-view/Workforce/${def}`,
-      `default ${name} must resolve under the app-view base, not the console origin root (#279)`,
+      new URL(spec, STANDALONE_MOUNT).href,
+      `http://127.0.0.1:3000/${endpoint}`,
+      `default ${name} must resolve to the app root, not the /cockpit/ shell base (#467)`,
     );
   });
 
-  test(`#279: default ${name} still resolves to the origin root standalone`, () => {
-    const def = defaultEndpoint(name);
+  test(`#467: default ${name} resolves onto the app-view base inside the Studio iframe`, () => {
+    const spec = defaultSpec(name);
     assertEquals(
-      new URL(def, STANDALONE_BASE).href,
-      `http://127.0.0.1:3000/${def}`,
-      `default ${name} must keep working for the standalone shell at the app root`,
+      new URL(spec, STUDIO_MOUNT).href,
+      `http://studio-host:8080/console/app-view/Workforce/${endpoint}`,
+      `default ${name} must resolve under the app-view base the console proxies, not the console ` +
+        `origin root (#279) nor the /cockpit/ shell base (#467)`,
     );
   });
 }
 
 test("#279: embed.html forwards BOTH reportUrl and transcriptsUrl from the injected config", () => {
   // embed.html previously forwarded only reportUrl, so even if the console injected endpoint config
-  // the transcripts panel kept its (formerly absolute) default. Both must be forwarded.
+  // the transcripts panel kept its default. Both must be forwarded.
   assert(
     /transcriptsUrl:\s*cfg\.transcriptsUrl/.test(EMBED_HTML),
     "embed.html must forward transcriptsUrl: cfg.transcriptsUrl so the injected config reaches the past-sessions panel (#279)",