hypgraph 0.5.3__tar.gz → 0.7.0__tar.gz

{hypgraph-0.5.3 → hypgraph-0.7.0}/.gitignore

@@ -15,5 +15,5 @@ research.hypgraph*
 Thumbs.db
 .claude/
 
-# study runs: outputs, sealed keys and records stay local until published on purpose
-studies/*/runs/
+# internal studies: kept on the machine that runs them, not published
+studies/

{hypgraph-0.5.3 → hypgraph-0.7.0}/CHANGELOG.md

@@ -1,5 +1,140 @@
 # Changelog
 
+## 0.7.0 — 2026-10-27: measure questions, and claim checks that know a version from a figure
+
+- **Measure questions.** A question may say `asks: "measure"`, and its workflow's `measure_skips` gates then don't
+  apply to it, in `Graph.stage()` and as order predicates. Until now every question met every gate of its profile:
+  a timing question was reworked for a diff, a count for a preregistered hypothesis, a look-ahead check for a
+  backtest. Real-model runs lost most of their calls to those reworks. `profiles.view()` lists the skipped gates.
+- **Claim checks:** dotted versions, inline code and labels (case 8, cases 9–12, #3) aren't figures; a measurement's
+  key written in place of its number is refused (KEY_FOR_NUMBER); a statement that says nothing ("Placeholder.")
+  is refused (STATEMENT_EMPTY).
+- **A rework's predicates are checked like an order's:** an unknown predicate is refused, naming every predicate the
+  target can take. A lead had reworked an order with an invented one (`claim_answers_q3`) that could never be met.
+- **Trading: a statistic about returns isn't a return earned.** Correlations, hit rates and other diagnostics of
+  returns no longer need fees and slippage (BACKTEST_WITHOUT_COSTS); a return, P&L or Sharpe still does.
+- **hypgraph.com in the app's design system.** One stylesheet on the HypGraph app's tokens and components, light by
+  default, restyles every page. The new homepage:
+  - opens on the live app, which can switch between the five workflows, Broad Street and the page's own record;
+  - offers the agent and engineer paths, then the facts, what the record refuses, the eight rules and the
+    arithmetic of never;
+  - ends with the workflows, the deployment options, the page's record and what the record shows and doesn't claim.
+- **The homepage proves its figures with its own HypGraph record** (`dev/site_record.py`, now run at every deploy):
+  - The instrument measures each figure: tests passing, runtime dependencies, the example records' chains, the bound
+    behind the arithmetic of never, and the refused overclaims.
+  - A reviewer re-measures each one another way.
+  - The page's text is checked against the record with `hypgraph check`, and a copy error fails the deploy.
+- **The report check no longer flags "not ruled out" as an absence claim.** Exclusion words that the sentence negates
+  are skipped, as absolutes already were. "Up to 58,155 … are not ruled out" and "a leak cannot be ruled out" are
+  hedges; the engine's own bound note says it in those words.
+
+- **Derivation scales with the record.** Working out which earlier results a result repeats (`derive.restates`) took a
+  pass over the whole graph for every result, recomputing each one's numbers, so deriving a record grew with the
+  square of its results. It now reads a per-snapshot index of each investigation's results by the numbers they carry,
+  and a result's numbers are computed once per version, shared across snapshots. On `dev/bench.py`'s record: 10,001
+  nodes derive in 0.34 s (was 20.35 s), 4,001 in 0.11 s (was 3.65 s). The write-time duplicate check uses the same
+  index.
+- **Two fixes to carried standing.** Both were found by the test at scale.
+  - Results written in the same second were ordered by id, so a result written later could count as "earlier" and
+    change what an older result repeats, after the older one's standing had been derived and carried forward. Ties now
+    go by write order.
+  - Revising or withdrawing a result now re-derives the results that repeat its numbers. They reach it through no
+    edge, so they used to keep their old standing.
+
+  The randomized incremental suite now gives results numbers, by several authors, and revises them. It fails on the
+  old code (5 of 6 seeds) and passes now.
+- `dev/bench.py`: reads, writes and derivation at a given record size, on your machine. The README's performance
+  figures come from it.
+
+## 0.6.0 — 2026-10-26: the HypGraph UI, live swarm observability, an example per profile
+
+The Atlas becomes **HypGraph**: one app for every profile, in each profile's own words, that watches a swarm
+work as it happens and replays any finished run. The design record is `docs/ui-plan.md`. Nothing in the record
+format changes; bundles gain optional fields that sit outside the hash chain.
+
+**The HypGraph UI**, which replaces the Atlas:
+- **Eight views in each profile's own words:** Overview, Live, Pipeline, Graph, Evidence, Work orders, Audit log and
+  Report. A software investigation shows Requirements and Verifications; a trading one shows Theses and Positions.
+- **Overview** has KPI tiles, the completion criteria, each question's stage, a "needs attention" list and recent
+  activity. Attention covers stale evidence, contested claims, premises that fell, leases held past their time,
+  returned orders, overclaims refused and a broken chain.
+- **Pipeline** is a swimlane of the profile's stages, with each gate met or not, its evidence, and what would meet it.
+- **Live** shows seats, the record growing and the event stream. It follows `/api/graph/stream` and falls back to
+  polling on hosts without it. Any run plays back with play, pause, scrub and speed controls.
+- **Drawers:** a node's drawer gives its standing, fields, links both ways, provenance and what would be at risk if
+  it fell. A question's drawer gives its stage and gates.
+- **Enterprise:**
+  - light by default, with dark one key away;
+  - WCAG AA text contrast in both themes, checked by a test;
+  - every screen is a URL, and Back and Forward work;
+  - ⌘K search over views, investigations and nodes, plus keys 1–8, `/`, `t` and Esc;
+  - CSV export for tables, PNG and JSON for the graph, Markdown and print-to-PDF for the report, and the bundle;
+  - the hash-chain badge, read-only, with no build step.
+- **Compatibility for one release:** `atlas.js` and `atlas.css` load the new app, `HypAtlas` is an alias of
+  `HypGraph`, and the `--hg-*` theme tokens still apply. Routes a host doesn't serve are hidden rather than failing,
+  so PegasusDMZ's older API still works.
+- `dev/ui_smoke.py` renders every view of five profile fixtures in both themes, plus an Atlas-style page, in headless
+  Chrome. CI runs it.
+
+**Live observability for a running swarm** (with hypswarm ≥ 0.1.0a7's telemetry):
+- **`hypgraph serve` streams a swarm's telemetry.** hypswarm writes `<record>.telemetry.jsonl` beside the record: every
+  model call, tool call, work order and scheduler decision, as spans. The server serves it at `GET /api/graph/telemetry`
+  (paged by byte offset) and tails it into `/api/graph/stream` as `telemetry` events. Ids become `<seq>:<offset>` so a
+  reconnect resumes both. A sidecar that appears after the server starts is picked up, and `--telemetry FILE` /
+  `--no-telemetry` override the default. Telemetry is shown, never trusted for standing.
+- **The Live view shows the swarm working:**
+  - each seat's call in flight (the model it's calling or the tool it's running, with seconds elapsed), and its calls,
+    tokens, cost and errors;
+  - KPI tiles for model calls, tokens in → out and cached, spend, tool calls, errors, and budget used against the run's cap;
+  - an event stream merging the record and telemetry, with a filter;
+  - a trace for any work order, showing each model and tool call on a timeline;
+  - alerts: a tool failing three times in a row, a seat repeating an identical tool call, failed model calls, the
+    budget passing 80 %;
+  - status from the run's own start and end ("Run ended · settled").
+
+  A record opened before its swarm starts picks the investigation up when it begins. Replay scopes telemetry to the
+  replay position. Overview's spend falls back to telemetry when the ledger isn't metered.
+- `dev/ui-fixtures/swarm.*` holds a real scripted swarm's bundle and telemetry, and the smoke check requires its trace.
+
+**What the UI needs from the engine:**
+- **Each profile speaks its own words.** `Profile.labels` gives the short noun a screen shows for each node type: a
+  software question is a **Requirement**, a trading hypothesis a **Thesis**, a decision a **Position**, an
+  optimization result a **Solution**. `profiles.view(pid)` returns what a UI needs: the labels for every node type
+  (the kernel's word where the profile has none), the meaning of each type, and the workflow's stages, gates and
+  report name. The `@1` profiles are frozen and keep the kernel's words. The labels are display only.
+- **A bundle carries the workflow views.** Each investigation's `derived` now has `profile`, `stages`, `completion`,
+  `board` and `orders` beside the report, so a viewer shows stages and gates without the engine. As before, derived
+  views are outside the hash chain and never trusted.
+- **Watch a record live.** `GET /api/graph/stream?inv=&after=` pushes every event as it is written, as Server-Sent
+  Events. It includes writes from another process on the same file, so a swarm running against the record is
+  watched as it works. Ids are event seqs, so a client resumes with `Last-Event-ID`. A comment line every 15 s keeps
+  proxies open, and `max_seconds` bounds a read.
+- `GET /api/graph/profile?inv=` gives the investigation's profile as a UI speaks it.
+- "Atlas" is now the HypGraph UI in the server, the CLI, the README and the skill.
+
+**A live example per profile on hypgraph.com:**
+- **Five live examples.** `/examples/` has one page per `@2` profile: scientific, software, trading, knowledge and
+  optimization. Each is a HypSwarm run on a real record that opens on its live replay. You see the seats take work
+  orders, model and tool calls in flight, writes refused and rewritten, and reviews landing, then you can explore the
+  pipeline, graph, evidence and report. The pages load offline from their bundles and re-verify each hash chain in
+  the browser. `dev/site_examples.py` rebuilds them from HypSwarm's scripted examples, pacing each reply 0.35–1.4 s,
+  and every page says so.
+- **A bundle can carry the run's telemetry.** `export(inv, telemetry=path)` and `hypgraph export --telemetry [FILE]`
+  (default `<db>.telemetry.jsonl`) add a swarm's sidecar for replay. It is outside the hash chain:
+  `verify_bundle` and `from_bundle` ignore it, and the UI labels it "not hash-chained". It is off unless asked for,
+  because a sidecar names a run's models, seats and spend.
+- **`play` opens on the replay.** The `play` mount option, or `#view=live&play=1`, opens the Live view and plays the
+  run from its first event. With reduced motion requested, it shows the finished run with Play one click away.
+- **A refused write is not an error.** In the Live view, a tool call the record refused counts as "refused by the
+  record", with its reason: amber on the seat, in the stream and in the trace. Errors count real failures only.
+- **The site's Atlas page is replaced.** The UI is served from `/app/`, `/explore/` opens any bundle full screen, and
+  `/atlas/` forwards there (keeping `?bundle=`, the hand-over from `/verify/` and the fragment). The home page embeds
+  the app directly. `/verify/` says when a bundle carries telemetry and opens bundles in HypGraph.
+- **A narrow layout.** Below 760 px of its own width (a phone, or a narrow frame), the app's sidebar becomes a strip of
+  tabs and the top bar wraps. It uses a container query, so an embed sizes it, not the window.
+- The smoke check also renders the site: each example opens replaying with its chain verified, plus the home page,
+  the explorer, the `/atlas/` forward and the gallery (106 pages).
+
 ## 0.5.3 — 2026-10-26: results that name no file can go stale
 
 - **A result that names no file it read can go stale.** Under a workflow (`@2` profiles), a result whose run has no

{hypgraph-0.5.3 → hypgraph-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hypgraph
-Version: 0.5.3
+Version: 0.7.0
 Summary: The evidence layer for AI research agents: a hash-chained research record that checks every claim as it is written and derives how well each is known.
 Project-URL: Homepage, https://hypgraph.com
 Project-URL: Documentation, https://hypgraph.com/engineers/
@@ -194,9 +194,16 @@ with g.writing_for(task_id):                                # every event carrie
 - **Multi-agent:** give each agent its own author name. Make your critic agents reviewers. Have your job runner
   write as the instrument, so its runs count as recorded, not reported.
 - **Your web framework:** `hypgraph.server.dispatch(graph, method, path, query, body)` is the JSON API, and
-  `hypgraph.ui.static_dir()` is the Atlas explorer to mount next to it.
+  `hypgraph.ui.static_dir()` is the HypGraph UI to mount next to it.
+- **Watching it live:** `GET /api/graph/stream?inv=` pushes every event as it is written (Server-Sent Events,
+  resumable with `Last-Event-ID`), including writes from another process on the same file, such as a swarm running
+  against the record. `GET /api/graph/profile?inv=` gives the investigation's profile as a UI speaks it: each node
+  type's label ("Requirement", "Thesis"), the workflow's stages and the report's name. A swarm's telemetry sidecar
+  (`<db>.telemetry.jsonl`, written by hypswarm) rides the same stream as `telemetry` events, so the Live view shows every
+  model and tool call as it happens.
 - **CI:** `hypgraph export -o record.bundle.json && hypgraph verify record.bundle.json`. The bundle is a single file
-  your reviewers or auditors can check with SHA-256, in any language or in the browser.
+  your reviewers or auditors can check with SHA-256, in any language or in the browser. `--telemetry` carries the
+  swarm's sidecar too, outside the chain, so the bundle replays the run with no server.
 
 The full guide is at [hypgraph.com/engineers](https://hypgraph.com/engineers/).
 
@@ -205,30 +212,33 @@ The full guide is at [hypgraph.com/engineers](https://hypgraph.com/engineers/).
 ```bash
 pip install hypgraph
 hypgraph demo        # a complete worked investigation (Broad Street, 1854) built into ./research.hypgraph
-hypgraph serve       # explore it in the Atlas: http://127.0.0.1:8765
+hypgraph serve       # explore it in the HypGraph UI: http://127.0.0.1:8765
 hypgraph report      # the facts, generated from the record
 ```
 
-Or try to get a claim past the real engine in your browser: [hypgraph.com/play](https://hypgraph.com/play/).
+Or watch a swarm work in each profile, replayed live from its record:
+[hypgraph.com/examples](https://hypgraph.com/examples/). Or try to get a claim past the real engine in your browser:
+[hypgraph.com/play](https://hypgraph.com/play/).
 
 ## Where it came from
 
-HypGraph is the research graph of PegasusDMZ, where a team of AI agents runs long investigations under governed
-egress, pulled out so anyone can use it. Each rule exists because the agents made the mistake behind it:
+HypGraph began as the research graph of a team of AI agents running long investigations under governed egress, and
+was pulled out so anyone can use it. Each rule exists because the agents made the mistake behind it:
 - a validation that was blind to the answer;
 - a null model that broke the system's own rules;
 - a summary whose numbers matched no result;
 - "never" written about something that happened once in a thousand.
 
-PegasusDMZ is the reference deployment, and its Atlas is built from this package. Against PegasusDMZ's live record
-(1,357 events, 790 nodes), the library derives the same standing for every node as the engine it replaced.
+That team still runs on it, and its graph UI is built from this package. Against the team's live record (1,357 events,
+790 nodes), the library derives the same standing for every node as the engine it replaced.
 
 ## Performance
 
-The engine is pure Python and stays fast at the sizes research records reach. At 10,000 nodes, deriving every node's
-standing takes 0.09 s, reading one node 0.3 ms, and a write about 10 ms, mostly SQLite committing to disk. A write
-costs what it touches: cached standing is kept for every node the write can't affect, and a randomized suite checks
-that against a full rebuild.
+The engine is pure Python and stays fast at the sizes research records reach. On `dev/bench.py`'s record (one
+investigation of questions, results, claims and reviews), at 10,001 nodes deriving every node's standing takes 0.34 s
+on a Windows laptop, reading one node 0.07 ms, and a write about 12 ms, mostly SQLite committing to disk; derivation
+grows in step with the record. A write costs what it touches: cached standing is kept for every node the write can't
+affect, and a randomized suite checks that against a full rebuild. Run `python dev/bench.py` for your machine.
 
 ## Made by
 

{hypgraph-0.5.3 → hypgraph-0.7.0}/README.md

@@ -162,9 +162,16 @@ with g.writing_for(task_id):                                # every event carrie
 - **Multi-agent:** give each agent its own author name. Make your critic agents reviewers. Have your job runner
   write as the instrument, so its runs count as recorded, not reported.
 - **Your web framework:** `hypgraph.server.dispatch(graph, method, path, query, body)` is the JSON API, and
-  `hypgraph.ui.static_dir()` is the Atlas explorer to mount next to it.
+  `hypgraph.ui.static_dir()` is the HypGraph UI to mount next to it.
+- **Watching it live:** `GET /api/graph/stream?inv=` pushes every event as it is written (Server-Sent Events,
+  resumable with `Last-Event-ID`), including writes from another process on the same file, such as a swarm running
+  against the record. `GET /api/graph/profile?inv=` gives the investigation's profile as a UI speaks it: each node
+  type's label ("Requirement", "Thesis"), the workflow's stages and the report's name. A swarm's telemetry sidecar
+  (`<db>.telemetry.jsonl`, written by hypswarm) rides the same stream as `telemetry` events, so the Live view shows every
+  model and tool call as it happens.
 - **CI:** `hypgraph export -o record.bundle.json && hypgraph verify record.bundle.json`. The bundle is a single file
-  your reviewers or auditors can check with SHA-256, in any language or in the browser.
+  your reviewers or auditors can check with SHA-256, in any language or in the browser. `--telemetry` carries the
+  swarm's sidecar too, outside the chain, so the bundle replays the run with no server.
 
 The full guide is at [hypgraph.com/engineers](https://hypgraph.com/engineers/).
 
@@ -173,30 +180,33 @@ The full guide is at [hypgraph.com/engineers](https://hypgraph.com/engineers/).
 ```bash
 pip install hypgraph
 hypgraph demo        # a complete worked investigation (Broad Street, 1854) built into ./research.hypgraph
-hypgraph serve       # explore it in the Atlas: http://127.0.0.1:8765
+hypgraph serve       # explore it in the HypGraph UI: http://127.0.0.1:8765
 hypgraph report      # the facts, generated from the record
 ```
 
-Or try to get a claim past the real engine in your browser: [hypgraph.com/play](https://hypgraph.com/play/).
+Or watch a swarm work in each profile, replayed live from its record:
+[hypgraph.com/examples](https://hypgraph.com/examples/). Or try to get a claim past the real engine in your browser:
+[hypgraph.com/play](https://hypgraph.com/play/).
 
 ## Where it came from
 
-HypGraph is the research graph of PegasusDMZ, where a team of AI agents runs long investigations under governed
-egress, pulled out so anyone can use it. Each rule exists because the agents made the mistake behind it:
+HypGraph began as the research graph of a team of AI agents running long investigations under governed egress, and
+was pulled out so anyone can use it. Each rule exists because the agents made the mistake behind it:
 - a validation that was blind to the answer;
 - a null model that broke the system's own rules;
 - a summary whose numbers matched no result;
 - "never" written about something that happened once in a thousand.
 
-PegasusDMZ is the reference deployment, and its Atlas is built from this package. Against PegasusDMZ's live record
-(1,357 events, 790 nodes), the library derives the same standing for every node as the engine it replaced.
+That team still runs on it, and its graph UI is built from this package. Against the team's live record (1,357 events,
+790 nodes), the library derives the same standing for every node as the engine it replaced.
 
 ## Performance
 
-The engine is pure Python and stays fast at the sizes research records reach. At 10,000 nodes, deriving every node's
-standing takes 0.09 s, reading one node 0.3 ms, and a write about 10 ms, mostly SQLite committing to disk. A write
-costs what it touches: cached standing is kept for every node the write can't affect, and a randomized suite checks
-that against a full rebuild.
+The engine is pure Python and stays fast at the sizes research records reach. On `dev/bench.py`'s record (one
+investigation of questions, results, claims and reviews), at 10,001 nodes deriving every node's standing takes 0.34 s
+on a Windows laptop, reading one node 0.07 ms, and a write about 12 ms, mostly SQLite committing to disk; derivation
+grows in step with the record. A write costs what it touches: cached standing is kept for every node the write can't
+affect, and a randomized suite checks that against a full rebuild. Run `python dev/bench.py` for your machine.
 
 ## Made by
 

{hypgraph-0.5.3 → hypgraph-0.7.0}/docs/profile-workflows-plan.md

@@ -25,8 +25,8 @@ exists only as a paragraph in the profile's notes and as a diagram on hypswarm.c
 | suggested seats | the **report**: every profile prints "Facts from the research graph" |
 | | the **order**: HypSwarm issues from the question board, not from the stage a question is in |
 
-The discovery study (HypSwarm `studies/discovery/`) showed what this costs: 110 of 118 refusals were vocabulary
-friction because the models were writing discipline work into scientific slots, and the honesty rules by themselves
+An internal study showed what this costs: most refusals were vocabulary
+friction, because the models were writing discipline work into scientific slots, and the honesty rules by themselves
 did not beat a prompt. What a prompt cannot do is remember that the code changed since the tests ran, that the
 source was retracted, that the regime moved, that the teammate's number is stale — the workflow's *invalidation*
 and *gates*. That is where the record should win, and it is exactly what profiles don't yet encode.
@@ -95,7 +95,7 @@ instrument, mechanical feasibility recomputation (P3). **P2 built in HypSwarm 0.
 orders, review on the node the previous gate produced, the record's word on done; the examples' scripted models walk
 the stages; the discovery stub run through its stages). P2 fed back into hypgraph 0.5.1: honest endings the stages
 lacked (a declined thesis, an inconclusive answer, a verified failure), artifacts that learn their kind on
-re-registration, optimization's `checked` stage. **P3 built (2026-10-26):** the instruments in HypSwarm 0.1.0a5 (world watcher, re-verification, source re-fetch, refresh orders) and hypgraph 0.5.2 (source freshness, fresh-only gates, stale in the report); the change suite in HypSwarm `studies/discovery/PLAN-CHANGE.md`, self-test and stub run at $0, predictions locked; the model run waits for the spend approval.
+re-registration, optimization's `checked` stage. **P3 built (2026-10-26):** the instruments in HypSwarm 0.1.0a5 (world watcher, re-verification, source re-fetch, refresh orders) and hypgraph 0.5.2 (source freshness, fresh-only gates, stale in the report); the change suite (an internal study), self-test and stub run at $0, predictions locked; the model run waits for the spend approval.
 
 ## 4. What stays as it is, on purpose
 

hypgraph-0.7.0/docs/site-plan.md

@@ -0,0 +1,116 @@
+# hypgraph.com and hypswarm.com — plan
+
+*Status (2026-10-27): P0 (this plan, the prototype) and P1 (the derivation fix) done; P2 built — hypgraph.com's
+homepage and stylesheet are the design below, and the homepage's record (`dev/site_record.py`) is built at every
+deploy. The prototype folder was retired once the real page replaced it (its screenshots are in the PR that added
+it). P3 (docs, trust page, refusal catalogue) and P4 (hypswarm.com) are next.*
+
+## 1. Where it stands
+
+The HypGraph UI (0.6) reads as a product: a verified chain, counts, states, a run replaying. The two sites read as
+landing pages: a dark neon theme, an animated graph behind the hero, a gradient headline and cards of copy. The copy
+itself is honest — a scan of both homepages found no overclaims — so the gap is presentation, not substance. A
+visitor who clicks from the site into an example also crosses from one visual world into another.
+
+What enterprise readers trust, in roughly this order: the product shown working, specifics they can check, docs with
+depth, a page saying what the thing guarantees and what it doesn't, and restraint. Decoration and adjectives count
+against a tool whose whole pitch is evidence.
+
+## 2. The principle: the site follows the record's rules
+
+HypGraph refuses a number no result accounts for and an "always" without the counts. The sites meet the same bar,
+and prove it with a HypGraph record of their own:
+
+- **Every figure on the page is a claim in the page's record** (`dev/site_record.py`), bound to the measurement it
+  came from. The build's instrument (`lab`) runs the measurements: the test suite, the pyproject, the example
+  bundles' hash chains, and the overclaims the page shows, written into a scratch record.
+- **A reviewer re-measures each one another way** (`site-check`): the suite run again and its tests counted by
+  collection, the pyproject parsed with `tomllib` instead of a regex, the bundles verified by the UI's JavaScript
+  verifier (`dev/js_verify.js`, WebCrypto) instead of the Python one, the overclaims written into a second fresh
+  record. Its verdict goes into the record: replicated, checked, or an objection.
+- **The page's text is linted against the record** with `hypgraph check`: with the figures filled in, a number no
+  claim or result accounts for, an absolute word with nothing behind it, or a citation the record doesn't hold, is
+  an error and fails the build. Words the page quotes as examples of what gets refused are marked `data-quote`; a
+  phrase true by the engine's design ("on every read": standing is derived on read) is marked `data-ok="<why>"` and
+  listed on the page with its reason.
+- **The record ships with the page**, as a bundle a visitor opens in the app on the page ("This page's own record")
+  or verifies themselves.
+
+### What building the record found already
+
+- **The README's performance sentence doesn't hold** on the record shape `dev/bench.py` builds (new: nothing in the
+  repo reproduced the figure before). The profile points to `derive.restates`, which compares each result with every
+  other result in its investigation and recomputes each one's numbers every time. That is an engine fix of its own
+  (P1), now in its own PR: 10,001 nodes derive in 0.34 s (was 20.35 s), and the README quotes the measured figures.
+  The fix also found two bugs in carried standing that the randomized suite had never exercised.
+- The record holds its builders to the same rules: the benchmark's own first writes were refused (a number in a
+  claim bound to nothing; a result repeating another's numbers), and the copy check failed the prototype's first
+  draft three times ("never set by an agent", "what the record guarantees", and a bare 256 in "SHA-256"). Each was
+  fixed: reworded, put in code, or marked true by design with its reason.
+- The derived standing caught a wiring mistake in the builder: the first claims carried `derived_from` but no
+  `supports` link, so each read "no live support · unverified report". With the support link, each reads "checked ·
+  1 independent line of support · lab-recorded run · no external replication" — which is what the page can honestly
+  say, and the page shows it as it is.
+
+## 3. One design system, the app's
+
+The site takes the app's tokens and components (`src/hypgraph/ui/hypgraph.css`): the same colours, type, cards,
+pills, tables and focus rings; light by default and dark one click away; text at WCAG AA in both themes (the
+existing contrast test extends to the site's tokens); motion only where it carries meaning (a run replaying),
+switched off under reduced motion. One header pattern across hypgraph.com and hypswarm.com, each linking the other.
+
+## 4. hypgraph.com
+
+Navigation: Product · Workflows · What it refuses · Docs · Trust · GitHub, plus the version and a copyable
+`pip install hypgraph`.
+
+The homepage, top to bottom (all in the prototype):
+
+| section | shows | backed by |
+|---|---|---|
+| Hero | one plain sentence on what it is; the slogan, smaller | — |
+| The product, live | the app replaying a run; a switch between the five workflows and **this page's own record**; the chain verified on load | the example bundles; the page's record |
+| Facts | tests passing, runtime dependencies, bundles verified in your browser (a button runs it) | each a claim in the page's record, with its review; click to open it |
+| What it refuses | three overclaims, the engine's refusal (codes and text) and the rewrite it accepted | generated at build, a claim in the record |
+| This page has a record | the claims with their reviews, the copy check's result, the phrases true by design | the record and `hypgraph check` |
+| Workflows | the five profiles: stages, what each refuses, when done; each with its live example | the profiles (`hypgraph profiles`) |
+| For the people who deploy agents | MCP + skill, Python, UI and API, CI gate, bundles, HypSwarm | the CLI as it is |
+| Trust | what the record shows and what it doesn't claim; local, no account, no network calls of its own; trusted publishing | the spec and the release workflow |
+
+Other pages: Docs (getting started, concepts, workflows, CLI, Python and HTTP API, MCP, the spec — generated from
+markdown by `dev/build_site.py`, no new dependencies), Trust (the long form of the section, including the bundle
+threat model: scoped bundles, telemetry outside the chain), the refusal catalogue (every code with a real refusal and
+its fix), and the existing Never, Playground, Verify and Examples pages, restyled.
+
+## 5. What we say and what we don't
+
+**We say** what the record checks, what it refused, what was measured (with where), and what it shows.
+Something the product doesn't do well yet stays off the sites until it does; it isn't dressed up.
+
+**We don't say** anything we haven't shown: that teams coordinated through the record beat a well-prompted single
+agent, or cost less; customer logos, testimonials, "trusted by", ROI figures, adjectives such as "enterprise-grade",
+pricing tiers or "contact sales". A short "what it doesn't claim" list sits on the homepage: it doesn't make a
+claim true, and it doesn't make a model reason better.
+
+## 6. hypswarm.com
+
+The same system, a sister site. The hero is the Live view of a swarm working. Then a free scripted quickstart; the
+framework bridges named only where tests cover them (LangChain, PydanticAI, CrewAI, Bedrock); telemetry and
+OpenTelemetry; "alpha" kept visible. It gets a record of its own the same way (its test suite, its examples
+settling, the bridges' tests).
+
+## 7. Phases
+
+| phase | what | verified by |
+|---|---|---|
+| **P0** | this plan, the prototype homepage, the page's record (`dev/site_record.py`), `dev/bench.py` | screenshots in #17; the record builds with 0 copy errors |
+| **P1** | the engine fix for `derive.restates`, measured with `dev/bench.py` (its own PR) | a test at scale; the benchmark |
+| **P2** | the shared design system and the new hypgraph.com homepage, with its record built in CI | the smoke check, the contrast test, the copy check failing the build |
+| **P3** | docs, the trust page, the refusal catalogue | the same |
+| **P4** | hypswarm.com on the same system, with its record | the same |
+
+## 8. Decisions taken
+
+1. No deployment is named on the sites.
+2. Timing stays off the sites until the engine fix lands; nothing the product doesn't do well yet is shown.
+3. The slogan stays as a small tagline under the headline, which says what the product does.

{hypgraph-0.5.3 → hypgraph-0.7.0}/docs/spec.md

@@ -231,4 +231,4 @@ the writer's assertion. Codes are matched within the investigation being reporte
 | warning | `REPORT_CAUSAL_UNCITED` | causal language with no node cited |
 | note | `REPORT_BOUND` | an absolute backed by a cited count: what the count supports |
 
-Calibrated on 24 real write-ups from PegasusDMZ against its live record.
+Calibrated on 24 real write-ups checked against the live record they report on.

hypgraph-0.7.0/docs/ui-plan.md

@@ -0,0 +1,128 @@
+# HypGraph UI — plan (Atlas → HypGraph)
+
+*Status (2026-10-26): P1–P4 built and released in hypgraph 0.6.0; P5 (the Pegasus pod) waits for a rebuild. The
+decisions in §6 were taken as proposed: plain "HypGraph", light by default, OpenTelemetry as an optional extra with
+prompts and outputs off. The prototype the plan refers to (`dev/ui-prototype/`, with screenshots) lives on the
+proposal's branch, `ui-hypgraph` (PR #10), not on main.*
+
+## 1. Where it stands
+
+The explorer shipped as **Atlas** (`src/hypgraph/ui/atlas.js`, `hypgraph serve`, the site's `/atlas/`). It predates the
+profiles-as-workflows release (0.5) and was never updated for it:
+
+- **It knows only the scientific method.** Its six views (Graph, Hypotheses, Claims, Provenance, Work, Timeline) are
+  built around hypotheses and claims. Nothing in it reads a profile, a workflow, a stage or a gate. A software
+  record shows "hypotheses" where the team wrote designs; a trading record has no place for positions; a knowledge
+  record's sources and excerpts are just nodes.
+- **It has no notion of a running swarm.** It polls the record's events, so writes appear, but who holds which work
+  order, which model call is in flight, what it costs, and whether the run is stuck are not visible.
+- **It looks like a demo.** It has a dark neon theme, one dense canvas and a single investigation at a time.
+
+## 2. What it becomes
+
+**One product name: HypGraph.** "Atlas" goes everywhere: the page title, `hypgraph serve`'s banner, the site and the
+docs. For one release, `HypAtlas` stays as a global alias and `/atlas/` redirects, so embeds don't break.
+
+**It speaks each profile's language.** Every profile gains `labels`, a short noun per node type: a software
+`question` is a **Requirement**, a trading `hypothesis` is a **Thesis**, an optimization `result` is a **Solution**.
+Every view uses them, and the stages, gates and report name come from the profile's workflow. A record with no
+profile falls back to the kernel's words.
+
+**Information architecture.** These are the prototype's eight views, all driven by data the engine already derives:
+
+| view | what it answers |
+|---|---|
+| **Overview** | Is this done, and is it sound? KPI tiles (settled, checked, stale, contested, work orders, spend), the completion criteria, each question's stage, recent activity |
+| **Live** | What is the swarm doing right now? (§3) |
+| **Pipeline** | Where is each question in the workflow, and what would move it? A swimlane of the profile's stages with each gate MET / NOT MET, its evidence and what would meet it |
+| **Graph** | What rests on what? The graph, with profile labels, checked and stale rings, and click-through to the node |
+| **Evidence** | Every claim, result, source and decision, with its derived standing: checked, stale, contested, at risk, re-run by the instrument |
+| **Work orders** | What was each seat asked to do, its predicates for done, and how it ended |
+| **Audit log** | The append-only event log, with the hash chain re-verified on read (the badge in the top bar) |
+| **Report** | The profile's report (Change report, Desk note, Sourced brief, …), with PDF and bundle export |
+
+**Enterprise properties.**
+- **Look:** light theme first, with dark available. Dense, tabular and calm. One accent colour (the brand blue);
+  status colour only for status.
+- **Every screen is a URL:** `#view=pipeline&inv=software@2&q=Q1&at=40`.
+- **Trust is visible:** a "chain verified · N events" badge, derived standing everywhere, nothing settable by hand.
+- **Search:** ⌘K across nodes, questions and orders.
+- **Keyboard and accessibility:** keyboard navigation, WCAG-AA contrast in both themes.
+- **Export:** CSV for tables, PNG and JSON for the graph, PDF for the report, a verifiable bundle for the record.
+- **Read-only by default:** the UI never writes. Approvals and human review, when they come, go through the
+  record's own API with an author, like every other write.
+- **No build step, no network:** vanilla ES modules plus the vendored Cytoscape, served by `hypgraph serve` or
+  opened from a static site.
+- **The CLI is unchanged.**
+
+## 3. Live observability for a running swarm
+
+The goal is everything a run does, from start to end, visible as it happens and auditable afterwards.
+
+**Two streams, one timeline.**
+1. **The record** (truth): every write, review, refusal, lease, supersession and stage change. It is already
+   hash-chained. `hypgraph serve` gains `GET /api/graph/stream?inv=` (Server-Sent Events) so the UI is pushed each
+   event instead of polling.
+2. **Swarm telemetry** (observation, never trusted for standing): what the record can't see. HypSwarm emits
+   structured events:
+   - **Run:** start, stop, why it stopped, budget and its warning line.
+   - **Seats:** each seat's lifecycle, what it holds and what it is doing now.
+   - **Model calls:** model id, tokens in, cached and out, $, latency, retries, errors.
+   - **Tool calls:** name, a scrubbed summary of the arguments, duration, ok or error.
+   - **Scheduler decisions:** dispatch, rework, escalation, re-verification, refresh, world changes, and report
+     assembled or lost.
+
+   Each event carries `run_id`, `inv`, `seat`, `order`, `span_id` and `parent_span_id`.
+
+**Where telemetry goes** (`run(..., telemetry=…)`):
+- **JSONL sidecar** (default, local): `<record>.telemetry.jsonl`. `hypgraph serve` tails it and merges it into the
+  stream.
+- **OpenTelemetry** (optional extra `hypswarm[otel]`): traces as run → order → model call / tool call spans; metrics
+  for tokens, $, calls and latency per seat and model; logs for the rest. This feeds Datadog, Grafana, Honeycomb and
+  Splunk without any HypGraph-specific code.
+- **Scrubbing:** secrets and arguments are scrubbed before they leave the process. Prompts and outputs are off by
+  default and can be switched on per run.
+
+**The Live view.** The prototype shows its shape on replayed real event logs:
+- **Run header:** running / settled / stopped, elapsed time, events per minute, budget burn ($ and calls against
+  the cap, warning line), and play / pause / scrub for replay of finished runs.
+- **Seats:** each seat with its current work order and, with telemetry, its in-flight model or tool call (spinner,
+  model, elapsed), writes, cost and errors.
+- **The record, growing:** nodes appear as they're written, with stale rings appearing as files change.
+- **Event stream:** record and telemetry merged, filterable by seat, kind and order.
+- **Alerts:** a seat holding an order past its lease, the same tool failing repeatedly, a loop of identical calls,
+  the budget warning line, a refusal burst, stale evidence, a lost report.
+- **Trace:** a waterfall per work order: the order's span with each model and tool call inside, tokens and $ per
+  span, and where the time went.
+
+A finished run's Live view is the same screen fed from the record plus its telemetry sidecar, so every run can be
+replayed exactly.
+
+## 4. The site: a working example per profile
+
+Each `@2` profile gets an interactive page, `/examples/<profile>/`, running the new UI read-only on a real record.
+The records come from HypSwarm's five scripted examples: 01 scientific, 02 software, 03 trading, 04 knowledge,
+05 optimization. Each page opens on the **Live replay** of that run, so a visitor watches the swarm work, then can
+explore the Pipeline, Graph, Evidence and Report.
+
+This needs the bundle to carry what the UI shows. `derived` gains `profile` (labels, stages, report name), `stages`,
+`completion`, `board`, `orders` and the `report` markdown, plus the telemetry sidecar when one exists. As now, the
+bundle's hash chain is re-verified in the browser, and its derived views are shown as derived and never trusted.
+
+## 5. Phases
+
+| phase | what | verified by |
+|---|---|---|
+| **P0** | this plan and the prototype (real data, eight views, deep links, light and dark) | screenshots in `dev/ui-prototype/shots/` |
+| **P1 · engine** | `Profile.labels` for the five profiles; the bundle's `derived` gains profile, stages, completion, board, orders and report; `GET /api/graph/stream` (SSE); "Atlas" renamed in server, CLI and docs | tests; a bundle round-trip; `hypgraph serve` streaming a write |
+| **P2 · UI** | `src/hypgraph/ui/` rebuilt as the HypGraph app (ES modules, no build), all eight views, ⌘K, exports, accessibility; `HypAtlas` alias and `/atlas` redirect | headless screenshots of every view × profile × theme in CI; keyboard and contrast checks |
+| **P3 · telemetry** | HypSwarm's event schema, JSONL sink and optional OTLP exporter; serve merges telemetry into the stream; Live view on a real running swarm, with alerts and the trace waterfall | an end-to-end test: a scripted swarm against a served record, with the UI updating as it runs |
+| **P4 · site** | five profile example pages with Live replay; the site's Atlas page replaced; docs | the pages load offline from the bundle; the chain verifies in the browser |
+| **P5 · pod** | Pegasus's `/atlas` moves to the new UI (needs a pod rebuild: your go-ahead) | the pod's UI smoke check |
+
+## 6. Decisions (taken as proposed)
+
+1. **Name in the UI:** "HypGraph" as the plain product name (prototype), or a qualifier ("HypGraph Console" /
+   "HypGraph Explorer")?
+2. **Theme:** light by default for enterprise (prototype), with dark one click away?
+3. **Telemetry:** OpenTelemetry as an optional extra (proposed), and prompts/outputs off by default?

{hypgraph-0.5.3 → hypgraph-0.7.0}/docs/workflows/README.md

@@ -15,6 +15,10 @@ Conventions used in every spec:
   AT RISK. Today only the scientific set (`requires`, `derived_from`, `based_on`, `works_on`, `rests_on`) does.
 - **Fresh** says when a result still speaks for the thing it measured.
 - **Typed artifacts** are `artifact` / `source` / `decision` nodes with required fields per `kind`, not new types.
+- **A measure question skips what it doesn't need.** A question with `asks: "measure"` (a rate, a count, a timing, a
+  check of the data or the code as it is) skips the gates its workflow lists in `measure_skips`, in the stage and
+  as an order predicate: scientific skips the hypothesis and preregistration; software the diff and the suite on a
+  new head; trading the thesis, preregistration, backtest and position. The run, result, claim and review stay.
 
 | spec | method it is taken from | the one gate a prompt can't keep |
 |---|---|---|

{hypgraph-0.5.3 → hypgraph-0.7.0}/src/hypgraph/__init__.py

@@ -16,7 +16,7 @@ Standing is derived on every read, never stored; every write is an event in a SH
 their numbers; reviews pin versions; independence is counted, not assumed. See https://hypgraph.com.
 """
 
-__version__ = "0.5.3"
+__version__ = "0.7.0"
 
 from .bundle import verify_bundle  # noqa: E402
 from .graph import Author, Graph, GraphError, file_sha256  # noqa: E402