create-principles-disciple 1.146.8 → 1.146.9

package/console/dist/server/routes/examiner.js

@@ -1,9 +1,12 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { sendSuccess, sendError, sendNotFound } from '../utils/response.js';
+import { sendSuccess, sendError, sendNotFound, sendJson } from '../utils/response.js';
 import { PrinciplesConsoleModel } from '../models/PrinciplesConsoleModel.js';
-import { loadLabModules, loadHostCapability, preflightCheck, offlineStudyPass, reportMaterialize, listStudyNames, resolveStudyAccess, resolveStudyRoots, studyStatusPayload, studyReportPayload, materializeConsoleStudy, verifyConsoleOwnership, writableRootProblem, isJsonObject, ExaminerPreflightBlockedError, } from './examiner-executor.js';
+import { ExaminerEvidenceModel } from '../models/ExaminerEvidenceModel.js';
+import { loadLabModules, loadHostCapability, preflightCheck, offlineStudyPass, reportMaterialize, listStudyNames, resolveStudyAccess, resolveStudyRoots, studyReportPayload, materializeConsoleStudy, verifyConsoleOwnership, writableRootProblem, isJsonObject, ExaminerPreflightBlockedError, } from './examiner-executor.js';
+import { listSuiteCatalog, isSuiteKey, gatherProductionSnapshot, deriveStudyRuleCodeFacts, readProductionSnapshot, } from './examiner-study-inputs.js';
+import { appendConsoleRunEventLocked, readConsoleRuns, currentConsoleRun, recoverUnfinishedConsoleRuns, acceptConsoleRun, hostDryRunPass, f2AuthorizationGate, CONSOLE_RUN_SCHEMA, CONSOLE_RUN_MODES, ConsoleRunInProgressError, ConsoleLedgerUnreadableError, studyStatusPayload, assertOfflineAdmissionAllowed, } from './examiner-runs.js';
 /* eslint-disable @typescript-eslint/max-params -- node:http handler signature (req, res, workspaceDir, subPath) matches every other route */
 const LAB_ENTRY = path.join('lib', 'examiner-study.mjs');
 const PRINCIPLE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
@@ -83,6 +86,30 @@ async function loadLab() {
         return null;
     }
 }
+/**
+ * v0.10.1 §12.3 restart recovery runs ONCE per process per writable root,
+ * lazily on the first examiner request touching studies — a crashed holder's
+ * unfinished console run becomes CONSOLE_RUN_ABANDONED (RESULT_UNKNOWN,
+ * never retried) before any status/run request can observe or extend it.
+ */
+const recoveryInFlight = new Map();
+async function ensureConsoleRunRecovery(roots, labRootDir) {
+    const key = roots.writable;
+    const pending = recoveryInFlight.get(key);
+    if (pending)
+        return pending;
+    // Cache the IN-FLIGHT promise, not a "done" flag: a transient scan failure
+    // (an unavailable studies root) must be retried by the next request instead
+    // of leaving a crashed run blocking this study for the process lifetime.
+    const attempt = recoverUnfinishedConsoleRuns(roots, labRootDir)
+        .then(() => undefined)
+        .catch((error) => {
+        recoveryInFlight.delete(key);
+        logRefusal('run recovery', error);
+    });
+    recoveryInFlight.set(key, attempt);
+    return attempt;
+}
 function readBody(req) {
     return new Promise((resolve) => {
         let raw = '';
@@ -105,27 +132,47 @@ function readBody(req) {
     });
 }
 export async function handleExaminerRoute(req, res, workspaceDir, subPath) {
+    const method = req.method ?? 'GET';
+    // ── v0.10.1 §4/§5: production evidence aggregate (BEFORE the lab gate —
+    // production evidence is a property of the workspace runtime, not of the
+    // research engine; an installation without the lab still answers honestly).
+    // Segment parsing (no regex): /principles/<charset-validated-id>/evidence.
+    const evidencePrefix = '/principles/';
+    const evidenceSuffix = '/evidence';
+    const evidencePrincipleId = subPath.startsWith(evidencePrefix) && subPath.endsWith(evidenceSuffix)
+        ? subPath.slice(evidencePrefix.length, subPath.length - evidenceSuffix.length)
+        : null;
+    if (evidencePrincipleId !== null && PRINCIPLE_ID_PATTERN.test(evidencePrincipleId) && method === 'GET') {
+        const model = new ExaminerEvidenceModel(workspaceDir);
+        const evidence = await model.getPrincipleEvidence(evidencePrincipleId);
+        if (!evidence) {
+            sendError(res, 404, 'principle_not_found', 'the principle was not found in the workspace ledger');
+            return;
+        }
+        sendSuccess(res, { ...evidence });
+        return;
+    }
     const lab = await loadLab();
     if (!lab || !labModules || !labRoot) {
         sendError(res, 503, 'examiner_lab_unavailable', `the Examiner research engine could not be loaded from this installation: ${labUnavailableReason ?? 'unknown reason'}`);
         return;
     }
-    const method = req.method ?? 'GET';
     const roots = resolveStudyRoots(labRoot, path.join(workspaceDir, '.pd', 'examiner'));
     const context = { labRoot, roots };
     const rootProblem = writableRootProblem(roots);
+    await ensureConsoleRunRecovery(roots, labRoot);
     // GET /overview
     if (subPath === '/overview' && method === 'GET') {
         const writable = listStudyNames(roots.writable);
         const historical = listStudyNames(roots.historical);
         sendSuccess(res, {
-            spec: 'SPEC-PD-EXAMINER-001 v0.9',
-            executionScope: 'offline-stub only — every study uses SYNTHETIC_OFFLINE gold and the deterministic local stub; this panel validates the research contract, never real host behavior',
+            spec: 'SPEC-PD-EXAMINER-001 v0.10.1',
+            executionScope: 'offline-stub studies validate the research contract; host dry-run checks F2 readiness with ZERO model calls; real host runs require an APPROVED Stage R authorization inside the study and stay refused otherwise',
             gates: {
                 gate1_challenge_trust: 'BLOCKED — independent human Gold review has not been performed for any Examiner suite (code tests can never substitute)',
                 gate2_behavior_evaluation: 'NOT_READY — requires Gate 1 + real-host authorization',
                 gate3_llm_authoring: 'NOT_STARTED',
-                gate4_product_integration: 'ACTIVE — the offline research panel (create / run / report) ships with the console; real model calls and real host runs stay refused under this gate',
+                gate4_product_integration: 'ACTIVE — the offline research panel (create / run / report) ships with the console; v0.10.1 adds production evidence, host-backed study inputs and the async run contract; real model calls and real host runs stay refused under this gate',
             },
             hostInjectionCapability: lab,
             fullConclusionMinimumLevel: 'CONTEXT_PRESENT',
@@ -149,6 +196,28 @@ export async function handleExaminerRoute(req, res, workspaceDir, subPath) {
         sendSuccess(res, { principles, note: 'study inputs are read from the workspace ledger (read-only); eligibility filtering happens inside the Examiner contract' });
         return;
     }
+    // ── v0.10.1 §9: challenge-suite catalog (server-fixed keys, read-only).
+    if (subPath === '/suites' && method === 'GET') {
+        const suites = await listSuiteCatalog(labRoot);
+        sendSuccess(res, { suites, note: 'every suite reuses the lab\u2019s authored calibration case variants; gold is SYNTHETIC_OFFLINE until Gate 1 (independent human Gold review) passes' });
+        return;
+    }
+    // ── v0.10.1 §6.2: OpenClaw host readiness (workspace-level, zero model calls).
+    if (subPath === '/hosts/openclaw/readiness' && method === 'GET') {
+        sendSuccess(res, {
+            host: 'openclaw',
+            maxProvableInjectionLevel: lab.openclaw ?? 'SUBMITTED',
+            executionModes: ['offline-stub', 'host-dry-run', 'f2-real-host'],
+            requirements: [
+                { id: 'stage_r_authorization', detail: 'an APPROVED F2-real-host run-authorization.json inside the study, bound to its frozen suite hash (issued by the Owner — never by the console)' },
+                { id: 'host_cli', detail: 'the OpenClaw CLI reachable on PATH (verified by the per-study host dry-run local version probe)' },
+                { id: 'isolation', detail: 'per-arm round directories creatable inside the writable study root' },
+                { id: 'gate1_gold_trust', detail: 'independent human Gold review — currently BLOCKED, so real runs cannot produce formal effect conclusions even when authorized' },
+            ],
+            note: 'this readiness projection performs no host calls; run the per-study host dry-run for the live checklist',
+        });
+        return;
+    }
     // POST /studies — create an offline examiner study (identity server-minted)
     if (subPath === '/studies' && method === 'POST') {
         if (rootProblem) {
@@ -160,6 +229,9 @@ export async function handleExaminerRoute(req, res, workspaceDir, subPath) {
         const requestedMode = typeof body.experimentMode === 'string' ? body.experimentMode : '';
         const repetitionsRaw = Number(body.repetitionsPerCase);
         const repetitionsPerCase = Number.isInteger(repetitionsRaw) && repetitionsRaw >= 1 && repetitionsRaw <= 5 ? repetitionsRaw : 2;
+        // v0.10.1 §9: the suite travels as a CATALOG KEY (server-fixed list);
+        // anything unrecognized falls back to the v0.9 default suite.
+        const suiteKey = isSuiteKey(body.suiteKey) ? body.suiteKey : 'didactic-pair';
         if (!PRINCIPLE_ID_PATTERN.test(requestedTarget)) {
             sendError(res, 400, 'invalid_target_principle', 'targetPrincipleId required (charset-validated principle id; one target Principle per study)');
             return;
@@ -178,18 +250,35 @@ export async function handleExaminerRoute(req, res, workspaceDir, subPath) {
         }
         const isolatedMode = requestedMode === 'isolated_principle';
         try {
+            // v0.10.1 host-backed inputs (SPEC §4/§6/§7): freeze the production
+            // snapshot, derive RuleCode facts from RUNTIME activation truth,
+            // carry the real pain lineage and compile the selected suite's cases.
+            // The study handle is minted inside materializeConsoleStudy, so the
+            // suite cases are compiled with per-study ids there via a second pass
+            // (suiteCaseDefs is deterministic; the ids are re-minted below).
+            const snapshot = await gatherProductionSnapshot(workspaceDir, requestedTarget, 2000);
+            const detailOutput = await model.getPrincipleDetail(requestedTarget);
+            const painRefs = detailOutput?.principle.derivedFromPainIds ?? [];
             const created = await materializeConsoleStudy(labModules, labRoot, roots, {
                 isolatedMode,
                 targetIndex,
                 ledgerPrinciples,
                 repetitionsPerCase,
+                suiteKey,
+                hostBacked: {
+                    productionSnapshot: { ...snapshot },
+                    ruleCodeFacts: deriveStudyRuleCodeFacts(snapshot),
+                    painRefs,
+                },
             });
             sendSuccess(res, {
                 studyId: created.studyId,
                 targetPrincipleId: created.targetPrincipleId,
                 experimentMode: isolatedMode ? 'isolated_principle' : 'full_library_incremental',
+                suiteKey,
                 plannedPairs: created.plannedPairs,
                 manifestHash: created.manifestHash,
+                productionSnapshotMarkers: snapshot.experimentVsProduction.markers,
                 note: 'offline study created with SYNTHETIC gold — run preflight, then the offline-stub execution; results demonstrate the contract pipeline, never real host behavior',
             });
         }
@@ -201,6 +290,11 @@ export async function handleExaminerRoute(req, res, workspaceDir, subPath) {
     }
     // /studies/:studyId[/...]
     const studyMatch = STUDY_ROUTE_PATTERN.exec(subPath);
+    // CodeQL js/user-controlled-bypass (dismissed as false positive): this is a route
+    // SELECTOR, not an authorization decision. Every privileged action below
+    // runs only after resolveStudyAccess() (server-side enumeration + study-id
+    // charset allowlist + canonical boundary + ownership marker); a non-match
+    // simply falls through to 404.
     if (studyMatch && studyMatch[1]) {
         const rest = studyMatch[2] ?? '';
         const access = resolveStudyAccess(roots, studyMatch[1]);
@@ -211,7 +305,33 @@ export async function handleExaminerRoute(req, res, workspaceDir, subPath) {
         const studyDir = access.dir;
         // GET status
         if (rest === '' && method === 'GET') {
-            sendSuccess(res, { ...studyStatusPayload(studyDir), readOnly: access.readOnly, access: access.reason });
+            // P1-4B: an unreadable ledger is reported STRUCTURALLY on the read path
+            // (rc-9) and refuses runs on the write path — never shown as "no runs".
+            let consoleRuns = null;
+            let ledgerProblem = null;
+            try {
+                consoleRuns = readConsoleRuns(roots, studyDir);
+            }
+            catch (error) {
+                if (error instanceof ConsoleLedgerUnreadableError) {
+                    ledgerProblem = { code: error.code, message: error.message };
+                }
+                else {
+                    throw error;
+                }
+            }
+            sendSuccess(res, {
+                ...studyStatusPayload(roots, studyDir),
+                readOnly: access.readOnly,
+                access: access.reason,
+                productionSnapshot: readProductionSnapshot(studyDir),
+                consoleRuns: {
+                    runs: consoleRuns === null ? [] : consoleRuns.slice(-10),
+                    current: consoleRuns === null ? null : currentConsoleRun(consoleRuns),
+                    asyncModes: CONSOLE_RUN_MODES,
+                    ledgerProblem,
+                },
+            });
             return;
         }
         // POST /preflight — the fail-closed gate over the frozen study facts
@@ -224,21 +344,140 @@ export async function handleExaminerRoute(req, res, workspaceDir, subPath) {
         // P1-1/P1-4: the study must be server-owned and writable, and the SERVER
         // preflight must pass BEFORE the runner is entered. A blocker returns 409
         // with no RUN_STARTED event, no reservation and no actor creation.
+        // CodeQL js/user-controlled-bypass (dismissed as false positive): route selector. The
+        // mode allowlist, access.readOnly refusal and the preflight/Stage R gates
+        // below all run before any execution side effect.
         if (rest === '/run' && method === 'POST') {
             const body = await readBody(req);
             // Real execution needs an Owner-approved run-authorization.json plus the
-            // Stage R gate — this console route NEVER transports a caller-supplied
-            // mode into the runner; only the offline-stub default is reachable.
-            if (body.mode !== undefined && body.mode !== 'offline-stub') {
-                sendError(res, 403, 'real_execution_not_authorized', 'non-offline execution requires explicit Owner authorization (run-authorization.json + Stage R gate) — NOT GRANTED this round');
+            // Stage R gate. The reachable modes are fixed: offline-stub (v0.9,
+            // synchronous), host-dry-run / f2-real-host (v0.10.1 §12.3 async).
+            const requestedMode = typeof body.mode === 'string' ? body.mode : 'offline-stub';
+            if (requestedMode !== 'offline-stub' && !CONSOLE_RUN_MODES.includes(requestedMode)) {
+                sendError(res, 403, 'real_execution_not_authorized', `unknown execution mode '${requestedMode}' — allowed: offline-stub, host-dry-run, f2-real-host`);
                 return;
             }
             if (access.readOnly) {
                 sendError(res, 403, 'study_read_only', `this study cannot be executed from the console: ${access.reason}`);
                 return;
             }
+            // ── v0.10.1 §12.3 async modes (host-dry-run / f2-real-host) ──
+            if (requestedMode === 'host-dry-run' || requestedMode === 'f2-real-host') {
+                // P1-5: the full Stage R authority contract (schema/stage/binding/
+                // window/revocation/probe) is verified BEFORE acceptance; the same
+                // authority re-verifies per unit inside the runner for real runs.
+                // CodeQL js/user-controlled-bypass (dismissed as false positive): selecting the F2
+                // mode ADDS the Stage R gate (it cannot skip one); the other two
+                // reachable modes perform no real-host action at all.
+                if (requestedMode === 'f2-real-host') {
+                    const gate = await f2AuthorizationGate(labRoot, studyDir);
+                    if (!gate.authorized) {
+                        sendError(res, 403, 'real_execution_not_authorized', `F2 real-host execution was refused: ${gate.reasons.join('; ')}`);
+                        return;
+                    }
+                }
+                // P1-4: read-check-verify-append acceptance happens ATOMICALLY under
+                // the existing lab study write lock — two concurrent requests can
+                // never both pass. A corrupt/unreadable ledger refuses the run.
+                let acceptance;
+                try {
+                    acceptance = await acceptConsoleRun(roots, studyDir, { studyId: access.studyId, mode: requestedMode, labRoot });
+                }
+                catch (error) {
+                    if (error instanceof ConsoleRunInProgressError) {
+                        sendError(res, 409, 'run_in_progress', `console run ${error.runId} (${error.mode}) is still in progress for this study — wait for its terminal event or recover after a restart; never start a second run`, { runId: error.runId, mode: error.mode, acceptedAt: error.acceptedAt });
+                        return;
+                    }
+                    if (error.name === 'OfflineRunInFlightError') {
+                        sendError(res, 409, 'run_in_progress', 'an offline execution is currently in progress for this study (RUN_STARTED without RUN_FINISHED) — wait for it to settle');
+                        return;
+                    }
+                    if (error.name === 'StudyLockError') {
+                        sendError(res, 409, 'run_in_progress', 'another writer holds the study lock right now (a concurrent acceptance or the offline runner) — exactly one run may start; retry after the holder settles');
+                        return;
+                    }
+                    if (error instanceof ConsoleLedgerUnreadableError) {
+                        sendError(res, 500, 'console_ledger_unreadable', `the run was refused because the study event ledger could not be honestly read (${error.code}): ${error.message} — the ledger is never auto-cleared or rebuilt`);
+                        return;
+                    }
+                    logRefusal('console run acceptance failed', error);
+                    sendError(res, 500, 'run_acceptance_failed', 'the run could not be accepted (details in the console server log)');
+                    return;
+                }
+                const { runId, acceptedAt } = acceptance;
+                // Detached work: the accepted run settles itself through the study
+                // ledger. The promise is intentionally not awaited (§12.3: long work
+                // never rides the HTTP request); all failures append terminal events.
+                // finishedAt is taken at SETTLEMENT time (P1-4C), never up front.
+                void (async () => {
+                    let terminal;
+                    try {
+                        if (requestedMode === 'host-dry-run') {
+                            const dryRun = await hostDryRunPass({ modules: labModules, labRoot, studyDir, context });
+                            terminal = {
+                                type: dryRun.ok ? 'CONSOLE_RUN_FINISHED' : 'CONSOLE_RUN_FAILED',
+                                schema: CONSOLE_RUN_SCHEMA, runId, studyId: access.studyId,
+                                mode: 'host-dry-run', acceptedAt, pid: process.pid, owner: 'pd-console',
+                                finishedAt: new Date().toISOString(),
+                                outcome: dryRun.ok ? 'DRY_RUN_CHECKS_PASSED' : 'DRY_RUN_CHECKS_FAILED',
+                                reason: dryRun.ok ? undefined : `failing prerequisites: ${dryRun.checks.filter((entry) => !entry.ok && entry.severity !== 'info').map((entry) => entry.id).join(', ')}`,
+                                checks: dryRun.checks,
+                            };
+                        }
+                        else {
+                            // f2-real-host passed the console gate. Real console-driven
+                            // execution is NOT enabled this round (SPEC §Owner Decision:
+                            // real model calls require separate Owner authorization); the
+                            // run settles LOUDLY with zero model calls — never a stub.
+                            terminal = {
+                                type: 'CONSOLE_RUN_FAILED', schema: CONSOLE_RUN_SCHEMA, runId, studyId: access.studyId,
+                                mode: 'f2-real-host', acceptedAt, pid: process.pid, owner: 'pd-console',
+                                finishedAt: new Date().toISOString(),
+                                outcome: 'F2_EXECUTION_NOT_ENABLED_THIS_ROUND',
+                                reason: 'authorization was accepted, but console-driven F2 real execution stays disabled this round; use the lab F2 driver under Owner supervision; zero model calls were made',
+                            };
+                        }
+                    }
+                    catch (error) {
+                        logRefusal(`console run ${runId} failed`, error);
+                        terminal = {
+                            type: 'CONSOLE_RUN_FAILED', schema: CONSOLE_RUN_SCHEMA, runId, studyId: access.studyId,
+                            mode: requestedMode, acceptedAt, pid: process.pid, owner: 'pd-console',
+                            finishedAt: new Date().toISOString(),
+                            outcome: 'RUN_ERROR', reason: 'the console run failed (details in the console server log)',
+                        };
+                    }
+                    // The terminal event is appended UNDER the study write lock: startup
+                    // recovery takes the same lock and re-reads the terminal state there,
+                    // so a settled run can never be turned into ABANDONED afterwards.
+                    try {
+                        await appendConsoleRunEventLocked({ labRoot, roots, studyDir }, terminal);
+                    }
+                    catch (error) {
+                        logRefusal(`console run ${runId} terminal event could not be appended`, error);
+                    }
+                })();
+                // 202 Accepted — the §12.3 async contract answer.
+                sendJson(res, 202, {
+                    success: true,
+                    data: {
+                        studyId: access.studyId,
+                        runId,
+                        mode: requestedMode,
+                        status: 'ACCEPTED',
+                        note: requestedMode === 'host-dry-run'
+                            ? 'host dry-run accepted — zero model calls; poll the study status for the console-run checklist'
+                            : 'F2 real-host run accepted under the Owner authorization — poll the study status; the runner re-verifies the Stage R authority per unit',
+                    },
+                });
+                return;
+            }
+            // ── v0.9 synchronous offline-stub path (unchanged, AC-02 compat) ──
             try {
-                const summary = await offlineStudyPass(labModules, studyDir, context);
+                // P1-3 (offline→async): the admission check runs INSIDE the lab's study
+                // write lock, before RUN_STARTED/reservation/actor. The callback lives
+                // here (composition root) so executor↔runs stay acyclic.
+                const summary = await offlineStudyPass(labModules, studyDir, context, () => assertOfflineAdmissionAllowed(roots, studyDir));
                 sendSuccess(res, { studyId: access.studyId, units: summary.units.map((unit) => ({ unit: unit.unit, state: unit.state })) });
             }
             catch (error) {
@@ -246,6 +485,16 @@ export async function handleExaminerRoute(req, res, workspaceDir, subPath) {
                 // refuses BEFORE RUN_STARTED; the runner re-verifies UNDER the study
                 // lock and refuses on drift discovered after that first check. Either
                 // way: no RUN_STARTED, no reservation, no actor, no attempt file.
+                if (error instanceof ConsoleRunInProgressError) {
+                    sendError(res, 409, 'run_in_progress', 'an execution is already running for this study; no run started, no unit reserved, no actor created', {
+                        runId: error.runId, mode: error.mode, acceptedAt: error.acceptedAt,
+                    });
+                    return;
+                }
+                if (error instanceof ConsoleLedgerUnreadableError) {
+                    sendError(res, 500, 'console_ledger_unreadable', 'the study event ledger is unreadable; refusing to start an offline run (fail-closed)', { code: error.code });
+                    return;
+                }
                 if (error instanceof ExaminerPreflightBlockedError) {
                     sendError(res, 409, 'preflight_blocked', 'offline preflight blocked; no run started, no unit reserved, no actor created', {
                         blockers: error.blockers,

package/console/dist/types.d.ts

@@ -82,6 +82,7 @@ export type ApiResponse<T> = {
 } | {
     success: false;
     error: string;
+    code?: string;
     reason?: string;
     nextAction?: string;
     status?: number;

package/console/dist/web/assets/app.css

@@ -25,7 +25,13 @@
     --color-green-500: oklch(72.3% 0.219 149.579);
     --color-green-600: oklch(62.7% 0.194 149.214);
     --color-green-700: oklch(52.7% 0.154 150.069);
+    --color-emerald-400: oklch(76.5% 0.177 163.223);
+    --color-emerald-500: oklch(69.6% 0.17 162.48);
+    --color-emerald-700: oklch(50.8% 0.118 165.612);
     --color-teal-600: oklch(60% 0.118 184.704);
+    --color-sky-400: oklch(74.6% 0.16 232.661);
+    --color-sky-500: oklch(68.5% 0.169 237.323);
+    --color-sky-700: oklch(50% 0.134 242.749);
     --color-rose-400: oklch(71.2% 0.194 13.428);
     --color-black: #000;
     --color-white: #fff;
@@ -464,6 +470,9 @@
   .mt-\[14px\] {
     margin-top: 14px;
   }
+  .mr-1 {
+    margin-right: var(--spacing);
+  }
   .mr-2 {
     margin-right: calc(var(--spacing) * 2);
   }
@@ -569,6 +578,10 @@
   .table {
     display: table;
   }
+  .size-3\.5 {
+    width: calc(var(--spacing) * 3.5);
+    height: calc(var(--spacing) * 3.5);
+  }
   .size-4 {
     width: calc(var(--spacing) * 4);
     height: calc(var(--spacing) * 4);
@@ -995,6 +1008,9 @@
   .flex-wrap {
     flex-wrap: wrap;
   }
+  .content-start {
+    align-content: flex-start;
+  }
   .items-baseline {
     align-items: baseline;
   }
@@ -1118,6 +1134,10 @@
     margin-block-start: calc(14px * var(--tw-space-y-reverse));
     margin-block-end: calc(14px * calc(1 - var(--tw-space-y-reverse)));
   }
+  .gap-x-3 {
+    -moz-column-gap: calc(var(--spacing) * 3);
+         column-gap: calc(var(--spacing) * 3);
+  }
   .gap-x-4 {
     -moz-column-gap: calc(var(--spacing) * 4);
          column-gap: calc(var(--spacing) * 4);
@@ -1264,6 +1284,12 @@
       border-color: color-mix(in oklab, var(--color-amber-400) 50%, transparent);
     }
   }
+  .border-amber-500\/40 {
+    border-color: color-mix(in srgb, oklch(76.9% 0.188 70.08) 40%, transparent);
+    @supports (color: color-mix(in lab, red, red)) {
+      border-color: color-mix(in oklab, var(--color-amber-500) 40%, transparent);
+    }
+  }
   .border-amber\/20 {
     border-color: color-mix(in srgb, #a66a2a 20%, transparent);
     @supports (color: color-mix(in lab, red, red)) {
@@ -1486,6 +1512,12 @@
       border-color: color-mix(in oklab, var(--color-rose-400) 50%, transparent);
     }
   }
+  .border-sky-500\/40 {
+    border-color: color-mix(in srgb, oklch(68.5% 0.169 237.323) 40%, transparent);
+    @supports (color: color-mix(in lab, red, red)) {
+      border-color: color-mix(in oklab, var(--color-sky-500) 40%, transparent);
+    }
+  }
   .border-transparent {
     border-color: transparent;
   }
@@ -1525,6 +1557,18 @@
   .bg-amber-500 {
     background-color: var(--color-amber-500);
   }
+  .bg-amber-500\/10 {
+    background-color: color-mix(in srgb, oklch(76.9% 0.188 70.08) 10%, transparent);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--color-amber-500) 10%, transparent);
+    }
+  }
+  .bg-amber-500\/15 {
+    background-color: color-mix(in srgb, oklch(76.9% 0.188 70.08) 15%, transparent);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--color-amber-500) 15%, transparent);
+    }
+  }
   .bg-amber\/5 {
     background-color: color-mix(in srgb, #a66a2a 5%, transparent);
     @supports (color: color-mix(in lab, red, red)) {
@@ -1582,6 +1626,18 @@
       background-color: color-mix(in oklab, var(--color-destructive) 10%, transparent);
     }
   }
+  .bg-destructive\/15 {
+    background-color: color-mix(in srgb, #8b3a3a 15%, transparent);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--color-destructive) 15%, transparent);
+    }
+  }
+  .bg-emerald-500\/15 {
+    background-color: color-mix(in srgb, oklch(69.6% 0.17 162.48) 15%, transparent);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--color-emerald-500) 15%, transparent);
+    }
+  }
   .bg-gov {
     background-color: var(--color-gov);
   }
@@ -1717,6 +1773,18 @@
       background-color: color-mix(in oklab, var(--color-rose-400) 15%, transparent);
     }
   }
+  .bg-sky-500\/10 {
+    background-color: color-mix(in srgb, oklch(68.5% 0.169 237.323) 10%, transparent);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--color-sky-500) 10%, transparent);
+    }
+  }
+  .bg-sky-500\/15 {
+    background-color: color-mix(in srgb, oklch(68.5% 0.169 237.323) 15%, transparent);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--color-sky-500) 15%, transparent);
+    }
+  }
   .bg-surface {
     background-color: var(--color-surface);
   }
@@ -2231,6 +2299,9 @@
   .text-destructive {
     color: var(--color-destructive);
   }
+  .text-emerald-700 {
+    color: var(--color-emerald-700);
+  }
   .text-foreground {
     color: var(--color-foreground);
   }
@@ -2288,6 +2359,9 @@
   .text-red-700 {
     color: var(--color-red-700);
   }
+  .text-sky-700 {
+    color: var(--color-sky-700);
+  }
   .text-teal-600 {
     color: var(--color-teal-600);
   }
@@ -2917,6 +2991,9 @@
     .sm\:grid-cols-3 {
       grid-template-columns: repeat(3, minmax(0, 1fr));
     }
+    .sm\:grid-cols-4 {
+      grid-template-columns: repeat(4, minmax(0, 1fr));
+    }
     .sm\:flex-row {
       flex-direction: row;
     }
@@ -2962,6 +3039,9 @@
     }
   }
   @media (width >= 64rem) {
+    .lg\:col-span-2 {
+      grid-column: span 2 / span 2;
+    }
     .lg\:ml-\[256px\] {
       margin-left: 256px;
     }
@@ -2971,9 +3051,15 @@
     .lg\:hidden {
       display: none;
     }
+    .lg\:grid-cols-2 {
+      grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
     .lg\:grid-cols-4 {
       grid-template-columns: repeat(4, minmax(0, 1fr));
     }
+    .lg\:grid-cols-\[280px_1fr\] {
+      grid-template-columns: 280px 1fr;
+    }
     .lg\:pt-0 {
       padding-top: 0px;
     }
@@ -2981,12 +3067,18 @@
   .dark\:text-amber-400:is([data-theme="dark"] *) {
     color: var(--color-amber-400);
   }
+  .dark\:text-emerald-400:is([data-theme="dark"] *) {
+    color: var(--color-emerald-400);
+  }
   .dark\:text-green-400:is([data-theme="dark"] *) {
     color: var(--color-green-400);
   }
   .dark\:text-red-400:is([data-theme="dark"] *) {
     color: var(--color-red-400);
   }
+  .dark\:text-sky-400:is([data-theme="dark"] *) {
+    color: var(--color-sky-400);
+  }
   .\[\&\>span\]\:line-clamp-1 > span {
     overflow: hidden;
     display: -webkit-box;