okengine 0.10.2 → 0.10.3

package/src/docker/images-config.test.ts

@@ -0,0 +1,168 @@
+/**
+ * `ImagesConfig` (config surface, nested) → internal flat role map.
+ *
+ * Two guarantees:
+ * 1. Every built-in image recipe is reachable through the nested shape,
+ *    correctly placed under its owning element (or flat, for roles with no
+ *    driver counterpart) — the type-safety gap this closes.
+ * 2. A nested config produces byte-identical `deriveInfrastructure()` output
+ *    (Dockerfile / compose / stack env) to the flat-shape equivalent it
+ *    replaces — nesting is a config-surface change only, never an internal
+ *    representation change.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { flattenImagesConfig, type ImagesConfig } from "../config/index.ts";
+import { deriveInfrastructure } from "./derive.ts";
+import { builtinRecipes, recipeFor } from "./recipes/index.ts";
+import type { ServiceCredentials } from "./types.ts";
+
+describe("ImagesConfig nesting — recipe coverage", () => {
+  test("every built-in recipe id is reachable, correctly nested/flat by role", () => {
+    const cases: ReadonlyArray<{ images: ImagesConfig; role: string; image: string }> = [
+      // store.sql — postgres-family
+      {
+        images: { store: { sql: "postgres:18-alpine" } },
+        role: "store.sql",
+        image: "postgres:18-alpine",
+      },
+      {
+        images: { store: { sql: "cockroachdb/cockroach:v24.1.0" } },
+        role: "store.sql",
+        image: "cockroachdb/cockroach:v24.1.0",
+      },
+      {
+        images: { store: { sql: "yugabytedb/yugabyte:2024.1.0.0-b1" } },
+        role: "store.sql",
+        image: "yugabytedb/yugabyte:2024.1.0.0-b1",
+      },
+      {
+        images: { store: { sql: "timescale/timescaledb:2.15.0-pg16" } },
+        role: "store.sql",
+        image: "timescale/timescaledb:2.15.0-pg16",
+      },
+      {
+        images: { store: { sql: "supabase/postgres:15.1.0.117" } },
+        role: "store.sql",
+        image: "supabase/postgres:15.1.0.117",
+      },
+      // store.kv — redis-family
+      { images: { store: { kv: "redis:8-alpine" } }, role: "store.kv", image: "redis:8-alpine" },
+      {
+        images: { store: { kv: "valkey/valkey:8-alpine" } },
+        role: "store.kv",
+        image: "valkey/valkey:8-alpine",
+      },
+      {
+        images: { store: { kv: "docker.dragonflydb.io/dragonflydb/dragonfly:v1.24.0" } },
+        role: "store.kv",
+        image: "docker.dragonflydb.io/dragonflydb/dragonfly:v1.24.0",
+      },
+      // store.files / store.index
+      {
+        images: { store: { files: "rustfs/rustfs:1.0.0-beta.11" } },
+        role: "store.files",
+        image: "rustfs/rustfs:1.0.0-beta.11",
+      },
+      {
+        images: { store: { index: "getmeili/meilisearch:v1.37" } },
+        role: "store.index",
+        image: "getmeili/meilisearch:v1.37",
+      },
+      // channel.email
+      {
+        images: { channel: { email: "axllent/mailpit:v1.22.3" } },
+        role: "channel.email",
+        image: "axllent/mailpit:v1.22.3",
+      },
+      // flat roles — no driver counterpart in DriversConfig
+      {
+        images: { vault: "openbao/openbao:2.6.1" },
+        role: "vault",
+        image: "openbao/openbao:2.6.1",
+      },
+      {
+        images: { ai: "ghcr.io/ggml-org/llama.cpp:server-b10290" },
+        role: "ai",
+        image: "ghcr.io/ggml-org/llama.cpp:server-b10290",
+      },
+      { images: { ai: "vllm/vllm-openai:v0.26.0" }, role: "ai", image: "vllm/vllm-openai:v0.26.0" },
+      {
+        images: { ai: "lmsysorg/sglang:v0.5.16-runtime" },
+        role: "ai",
+        image: "lmsysorg/sglang:v0.5.16-runtime",
+      },
+      { images: { ai: "ollama/ollama:0.32.6" }, role: "ai", image: "ollama/ollama:0.32.6" },
+      {
+        images: { pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51" },
+        role: "pgdog",
+        image: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      },
+      { images: { proxy: "caddy:2-alpine" }, role: "proxy", image: "caddy:2-alpine" },
+      { images: { proxy: "traefik:v3.1" }, role: "proxy", image: "traefik:v3.1" },
+    ];
+
+    const matchedIds = new Set<string>();
+    for (const { images, role, image } of cases) {
+      // The nested literal flattens to exactly the dotted/flat role key the
+      // rest of the pipeline (buildSpecs, credentials, env prefixes) expects.
+      expect(flattenImagesConfig(images)).toEqual({ [role]: image });
+      matchedIds.add(recipeFor(image).id);
+    }
+
+    expect(matchedIds).toEqual(new Set(builtinRecipes.map((r) => r.id)));
+  });
+});
+
+describe("ImagesConfig nesting — compose output parity", () => {
+  test("nested config derives byte-identical output to its flat-shape equivalent", () => {
+    const flatImages: Readonly<Record<string, string>> = {
+      "store.sql": "postgres:18-alpine",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      "store.kv": "redis:8-alpine",
+      "store.files": "rustfs/rustfs:1.0.0-beta.11",
+      "channel.email": "axllent/mailpit:v1.22.3",
+      vault: "openbao/openbao:2.6.1",
+    };
+
+    const nestedImages: ImagesConfig = {
+      store: {
+        sql: "postgres:18-alpine",
+        kv: "redis:8-alpine",
+        files: "rustfs/rustfs:1.0.0-beta.11",
+      },
+      channel: { email: "axllent/mailpit:v1.22.3" },
+      vault: "openbao/openbao:2.6.1",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+    };
+
+    // Same nested→flat set, written in a different field order — proves the
+    // parity holds independent of source object key order.
+    expect(flattenImagesConfig(nestedImages)).toEqual(flatImages);
+
+    const credentials: Readonly<Record<string, ServiceCredentials>> = {
+      "store.sql": { user: "oke", password: "fixed-pw-sql", database: "oke" },
+      "store.kv": { user: "oke", password: "fixed-pw-kv", database: "oke" },
+      "store.files": { user: "oke", password: "fixed-pw-files", database: "oke" },
+      "channel.email": { user: "oke", password: "fixed-pw-email", database: "oke" },
+      vault: { user: "oke", password: "fixed-pw-vault", database: "oke" },
+      pgdog: { user: "oke", password: "fixed-pw-pgdog", database: "oke" },
+    };
+
+    const fromFlat = deriveInfrastructure({
+      images: flatImages,
+      app: "images-nesting-parity",
+      credentials,
+    });
+    const fromNested = deriveInfrastructure({
+      images: flattenImagesConfig(nestedImages),
+      app: "images-nesting-parity",
+      credentials,
+    });
+
+    expect(fromNested.specs).toEqual(fromFlat.specs);
+    expect(fromNested.files).toEqual(fromFlat.files);
+    expect(fromNested.stackEnv).toEqual(fromFlat.stackEnv);
+    expect(fromNested.composeFiles).toEqual(fromFlat.composeFiles);
+  });
+});

package/src/kernel/boot-bind/channel.ts

@@ -3,6 +3,11 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import {
+  CHANNEL_EMAIL_DEFAULTS,
+  CHANNEL_SMS_DEFAULTS,
+  dockerFlagDefaults,
+} from "../../config/driver-defaults.ts";
 import { openConsoleChannel } from "../../drivers/channel-console.ts";
 import { openMsegatChannel } from "../../drivers/channel-msegat.ts";
 import { openResendChannel } from "../../drivers/channel-resend.ts";
@@ -81,9 +86,12 @@ export function resolveEmailDriverId(
   env: ConfigEnv,
   docker: boolean,
 ): string {
-  return (
-    resolveDriverId(options.config?.drivers?.channel?.email, env) ?? (docker ? "smtp" : "console")
-  );
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(
+    options.config?.drivers?.channel?.email,
+    env,
+    dockerFlagDefaults(CHANNEL_EMAIL_DEFAULTS, docker),
+  )!;
 }
 
 /**
@@ -93,7 +101,7 @@ export function resolveEmailDriverId(
  * @param env - Active environment
  */
 export function resolveSmsDriverId(options: BootOptions, env: ConfigEnv): string | undefined {
-  return resolveDriverId(options.config?.drivers?.channel?.sms, env);
+  return resolveDriverId(options.config?.drivers?.channel?.sms, env, CHANNEL_SMS_DEFAULTS);
 }
 
 /**

package/src/kernel/boot-bind/clock.ts

@@ -15,6 +15,7 @@ import {
 } from "../../elements/clock.ts";
 import { createPostgresCronStore } from "../../drivers/clock-postgres.ts";
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { CLOCK_DEFAULTS } from "../../config/driver-defaults.ts";
 import type { BootOptions } from "../boot.ts";
 
 /** Result of binding a clock runtime. */
@@ -33,9 +34,8 @@ export const DEFAULT_FILE_CRON_PATH = ".oke/crons.json";
  * @param env - Active environment
  */
 export function resolveClockDriverId(options: BootOptions, env: ConfigEnv): string {
-  const resolved = resolveDriverId(options.config?.drivers?.clock, env);
-  if (resolved) return resolved;
-  return env === "test" ? "frozen" : "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(options.config?.drivers?.clock, env, CLOCK_DEFAULTS)!;
 }
 
 /**

package/src/kernel/boot-bind/gate.ts

@@ -3,6 +3,7 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { dockerFlagDefaults, STORE_KV_DEFAULTS } from "../../config/driver-defaults.ts";
 import { memoryDrivers } from "../../drivers/memory.ts";
 import { redisDriver } from "../../drivers/redis.ts";
 import type { KvClientLike } from "../../drivers/types.ts";
@@ -27,10 +28,12 @@ export function resolveGateKvDriverId(
   const fromEnv = process.env.OKE_KV_DRIVER?.trim();
   if (docker && fromEnv === "redis") return "redis";
   if (docker && fromEnv === "memory") return "memory";
-  const resolved = resolveDriverId(options.config?.drivers?.store?.kv, env);
-  if (resolved === "redis") return "redis";
-  if (resolved === "memory") return "memory";
-  return docker ? "redis" : "memory";
+  const resolved = resolveDriverId(
+    options.config?.drivers?.store?.kv,
+    env,
+    dockerFlagDefaults(STORE_KV_DEFAULTS, docker),
+  );
+  return resolved === "redis" ? "redis" : "memory";
 }
 
 function kvUrlFor(docker: boolean): string {

package/src/kernel/boot-bind/journal.ts

@@ -12,6 +12,7 @@ import {
 } from "../journal.ts";
 import { createPostgresJournalStore } from "../../drivers/journal-postgres.ts";
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { JOURNAL_DEFAULTS } from "../../config/driver-defaults.ts";
 import type { BootOptions } from "../boot.ts";
 
 /** Bound journal runtime — store + this instance's lease identity. */
@@ -37,9 +38,8 @@ export const DEFAULT_FILE_JOURNAL_PATH = ".oke/journal.json";
  * @param env - Active environment
  */
 export function resolveJournalDriverId(options: BootOptions, env: ConfigEnv): string {
-  const resolved = resolveDriverId(options.config?.drivers?.journal, env);
-  if (resolved) return resolved;
-  return "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(options.config?.drivers?.journal, env, JOURNAL_DEFAULTS)!;
 }
 
 /**

package/src/kernel/boot-bind/signal.ts

@@ -3,6 +3,7 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { SIGNAL_DEFAULTS } from "../../config/driver-defaults.ts";
 import { memorySignalDriver } from "../../drivers/signal-memory.ts";
 import { createBunSignalRedisClient, redisSignalDriver } from "../../drivers/signal-redis.ts";
 import type { SignalRedisClientLike } from "../../drivers/signal-types.ts";
@@ -17,7 +18,8 @@ import type { BootOptions } from "../boot.ts";
  * @param env - Active environment
  */
 export function resolveSignalDriverId(options: BootOptions, env: ConfigEnv): string {
-  return resolveDriverId(options.config?.drivers?.signal, env) ?? "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(options.config?.drivers?.signal, env, SIGNAL_DEFAULTS)!;
 }
 
 function redisUrlFor(docker: boolean): string | undefined {

package/src/kernel/boot-bind/store.test.ts

@@ -78,6 +78,25 @@ describe("bindStore driver resolution", () => {
     expect(resolveKvDriverId({}, "docker", true)).toBe("redis");
     expect(resolveFilesDriverId({}, "docker", true)).toBe("s3");
   });
+
+  test("pinning only `local` never leaks into docker/test/prod — each keeps its real default", () => {
+    const options = {
+      config: {
+        drivers: {
+          store: {
+            sql: { local: "pglite" },
+          },
+        },
+      },
+    };
+    expect(resolveSqlDriverId(options, "local", false)).toBe("pglite");
+    expect(resolveSqlDriverId(options, "docker", true)).toBe("postgres");
+    expect(resolveSqlDriverId(options, "test", false)).toBe("memory");
+    expect(resolveSqlDriverId(options, "prod", true)).toBe("postgres");
+    // kv / files are untouched by the sql-only override.
+    expect(resolveKvDriverId(options, "local", false)).toBe("memory");
+    expect(resolveKvDriverId(options, "docker", true)).toBe("redis");
+  });
 });
 
 describe("bindStore files fs multi-instance warn", () => {

package/src/kernel/boot-bind/store.ts

@@ -3,6 +3,12 @@
  */
 
 import { resolveDomainDdlMode, resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import {
+  dockerFlagDefaults,
+  STORE_FILES_DEFAULTS,
+  STORE_KV_DEFAULTS,
+  STORE_SQL_DEFAULTS,
+} from "../../config/driver-defaults.ts";
 import { fsDriver } from "../../drivers/fs.ts";
 import { libsqlDriver, libsqlIndexDriver } from "../../drivers/libsql.ts";
 import { meilisearchDriver } from "../../drivers/meilisearch.ts";
@@ -138,9 +144,12 @@ function resolveAutoPush(options: BootOptions): boolean {
 export function resolveSqlDriverId(options: BootOptions, env: ConfigEnv, docker: boolean): string {
   const fromEnv = process.env.OKE_SQL_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
-  const resolved = resolveDriverId(options.config?.drivers?.store?.sql, env);
-  if (resolved) return resolved;
-  return docker ? "postgres" : "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(
+    options.config?.drivers?.store?.sql,
+    env,
+    dockerFlagDefaults(STORE_SQL_DEFAULTS, docker),
+  )!;
 }
 
 /**
@@ -151,9 +160,12 @@ export function resolveSqlDriverId(options: BootOptions, env: ConfigEnv, docker:
 export function resolveKvDriverId(options: BootOptions, env: ConfigEnv, docker: boolean): string {
   const fromEnv = process.env.OKE_KV_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
-  const resolved = resolveDriverId(options.config?.drivers?.store?.kv, env);
-  if (resolved) return resolved;
-  return docker ? "redis" : "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(
+    options.config?.drivers?.store?.kv,
+    env,
+    dockerFlagDefaults(STORE_KV_DEFAULTS, docker),
+  )!;
 }
 
 /**
@@ -168,9 +180,12 @@ export function resolveFilesDriverId(
 ): string {
   const fromEnv = process.env.OKE_FILES_DRIVER?.trim();
   if (docker && fromEnv) return fromEnv;
-  const resolved = resolveDriverId(options.config?.drivers?.store?.files, env);
-  if (resolved) return resolved;
-  return docker ? "s3" : "memory";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(
+    options.config?.drivers?.store?.files,
+    env,
+    dockerFlagDefaults(STORE_FILES_DEFAULTS, docker),
+  )!;
 }
 
 /**

package/src/kernel/boot-bind/vault.ts

@@ -3,6 +3,7 @@
  */
 
 import { resolveDriverId, type ConfigEnv } from "../../config/index.ts";
+import { VAULT_DEFAULTS } from "../../config/driver-defaults.ts";
 import { createVaultRuntime, type VaultRuntime } from "../../elements/vault.ts";
 import { buildVaultBootChain, normalizeVaultDriverId } from "../../elements/vault/boot-chain.ts";
 import type { BootOptions } from "../boot.ts";
@@ -14,9 +15,8 @@ import type { BootOptions } from "../boot.ts";
  * @param env - Active environment
  */
 export function resolveVaultDriverId(options: BootOptions, env: ConfigEnv): string {
-  const resolved = resolveDriverId(options.config?.drivers?.vault, env);
-  if (resolved) return resolved;
-  return env === "test" ? "memory" : "env";
+  // Defaults cover every ConfigEnv key, so this is never undefined.
+  return resolveDriverId(options.config?.drivers?.vault, env, VAULT_DEFAULTS)!;
 }
 
 /**

package/site/content/docs/console/access.mdx

@@ -1,29 +0,0 @@
----
-title: "Access"
-description: "Identities, roles, API keys."
-icon: "Users"
-source: "docs/spec/console.md"
----
-
-Answers: **identities, roles, API keys**
-
-<Callout title="Governing rule">
-  Granting an application scope to an operator is impossible in the UI — taught by absence, not
-  refusal.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Two planes" description="Operators and application users never mix." />
-  <Card title="Key creation" description="Value shown once; attenuation to creator scopes only." />
-  <Card title="Revocation" description="Blast radius plus honest JWT validity delay." />
-  <Card title="Hygiene" description="Unused keys, never-signed-in operators, expired invites." />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="✓" />
-  <Card title="Prod" description="✓ (admin)" />
-</Cards>

package/site/content/docs/console/ai.mdx

@@ -1,35 +0,0 @@
----
-title: "AI"
-description: "Prompt versions, eval scores, cost, agent runs."
-icon: "Sparkles"
-source: "docs/spec/console.md"
----
-
-Answers: **prompt versions, eval scores, cost, agent runs**
-
-<Callout title="Governing rule">
-  Everything else in the Console is deterministic; this panel is built on distributions, not single
-  values.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Prompt versions" description="A version bump is Manifest Diff blast radius." />
-  <Card title="Eval + shape" description="Schema-validation failure is its own class." />
-  <Card
-    title="Agent tools"
-    description="Tools are the app’s own flows — undeclared reach is denied and shown."
-  />
-  <Card
-    title="Budgets"
-    description="Cost, semantic cache, and `allowPii` as standing review surfaces."
-  />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="full" />
-  <Card title="Prod" description="read + budgets" />
-</Cards>

package/site/content/docs/console/architecture.mdx

@@ -1,35 +0,0 @@
----
-title: "Architecture"
-description: "How it all connects — the diagram that is the code."
-icon: "Network"
-source: "docs/spec/console.md"
----
-
-Answers: **how it all connects — the diagram that _is_ the code**
-
-<Callout title="Governing rule">
-  Flows answers “which one”; Architecture answers “what shape”. Never shows the whole system by
-  default.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Unit clusters" description="Default aggregated edges; focus one or two hops." />
-  <Card title="Element layers" description="Toggle data, messaging, time, external edges." />
-  <Card
-    title="Live traffic"
-    description="Edge thickness from real traffic; dashed = never traversed."
-  />
-  <Card
-    title="Pathologies"
-    description="Cycles, god nodes, orphan signals, SPOFs — computed from the graph."
-  />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="✓" />
-  <Card title="Prod" description="✓" />
-</Cards>

package/site/content/docs/console/channels.mdx

@@ -1,37 +0,0 @@
----
-title: "Channels"
-description: "Templates, delivery receipts, bounces, opt-outs."
-icon: "Mailbox"
-source: "docs/spec/console.md"
----
-
-Answers: **templates, delivery receipts, bounces, opt-outs, deliverability (SPF/DKIM/DMARC)**
-
-<Callout title="Governing rule">
-  Suppression is not failure — the taxonomy of “did not arrive” has seven states with verdicts.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Dev inbox" description="`console` driver lands every medium locally." />
-  <Card
-    title="Deliverability"
-    description="SPF/DKIM/DMARC, bounces, complaints, suppression list."
-  />
-  <Card
-    title="Fallback chains"
-    description="Recorded as chains (e.g. WhatsApp → SMS), not single outcomes."
-  />
-  <Card
-    title="Locale previews"
-    description="Template data bound to schema; RTL-accurate previews."
-  />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="full + console inbox" />
-  <Card title="Prod" description="send test, inspect delivery" />
-</Cards>

package/site/content/docs/console/clock.mdx

@@ -1,51 +0,0 @@
----
-title: "Clock"
-description: "Upcoming crons, sleeping durable flows, journal."
-icon: "Clock"
-source: "docs/spec/console.md"
----
-
-Answers: **upcoming crons, sleeping durable flows, journal**
-
-<Callout title="Governing rule">
-  Looks like time — a forward timeline for schedules and pending wakes, not a flat grid.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Schedules" description="Drift, overdue, missed runs · catch-up one, lease holder." />
-  <Card title="Pending wakes" description="Every sleeping durable flow and when it wakes." />
-  <Card
-    title="DST warnings"
-    description="Gap or overlap badge — detect only, no schedule rewrite."
-  />
-  <Card title="Actions" description="Run now, wake early, pause; edit when overridable." />
-</Cards>
-
-## Health numbers
-
-Each cron row projects four numbers plus the lease holder:
-
-| Field           | Meaning                                                           |
-| --------------- | ----------------------------------------------------------------- |
-| Drift           | How far the last run sat from the expected slot                   |
-| Overdue         | Whether the schedule is past due                                  |
-| Missed + policy | Slot count while down · always catch-up `"one"` (one fire, not N) |
-| Lease           | Which instance holds the leader lease (empty when none)           |
-
-## Actions
-
-| Action        | When                                                                   |
-| ------------- | ---------------------------------------------------------------------- |
-| Pause         | Any cron — not gated by `overridable`                                  |
-| Edit schedule | Only when the declaration has `overridable: true`; else loud refuse    |
-| Wake early    | Sleeping durable run — advances `wakeAt` and can resume the journal    |
-| Run now       | Still requires the leader lease across replicas that share a CronStore |
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="full" />
-  <Card title="Prod" description="trigger/pause; edit if `overridable`" />
-</Cards>

package/site/content/docs/console/flows.mdx

@@ -1,31 +0,0 @@
----
-title: "Flows"
-description: "What exists; call it; read its contract."
-icon: "GitBranch"
-source: "docs/spec/console.md"
----
-
-Answers: **what exists; call it; read its contract**
-
-<Callout title="Governing rule">
-  Renders the one law as three columns: `Causes ← Flows → Effects` — not a tree.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Causes column" description="Triggers and callers — what runs this." />
-  <Card title="Flows column" description="Context-adaptive centre with contracts and invoke." />
-  <Card title="Effects column" description="What changes — store, signal, channel, AI, vault." />
-  <Card
-    title="Flow drawer"
-    description="Workshop peek/expand — save as bun:test from a real response."
-  />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="full + source links" />
-  <Card title="Prod" description="read + invoke per gates" />
-</Cards>