feat(web): compose P5 frontend acceptance

.agent/context/20260909T062151Z-p5-frontend-acceptance.md

@@ -0,0 +1,84 @@
+# Session Context: Gate P5 Frontend Acceptance
+
+## Date/time
+
+- UTC: 2026-09-09T06:21:51Z
+
+## User goal
+
+Compose the A05, B05, and C05 frontend slices described by P5 in `plan.md`
+into the OneShot operator experience and verify the frontend acceptance gate.
+
+## Acceptance criteria
+
+- The root web app exposes create/replay, authoritative status, settlement
+  evidence, and recovery evidence surfaces in one accessible shell.
+- B05 is consumed through its read-only public route/client entry points; no
+  settlement, resend, force-pay, or policy-bypass action is added.
+- C05 is consumed through its public recovery route/client entry points and is
+  clearly marked as synthetic fixture review when the live API lacks the
+  package's richer timeline contract.
+- Frontend tests cover the composed shell and the existing package fixtures
+  continue to cover replay/conflict, committed/UNKNOWN, denial, Graph
+  discovery, lag/error/multiple-candidate, and unavailable states.
+- Package/root format, lint, type, test, build, generated-contract, fixture,
+  and no-secret checks pass where applicable.
+
+## Assumptions and non-goals
+
+- The frozen OpenAPI v1 exposes `recovery-view`, not the full C05 timeline
+  schema; this change does not widen or mutate that contract.
+- Live B05 reads use the existing OneShot API client seam and runtime token.
+- Live settlement behavior, external payment execution, and sponsor evidence
+  remain outside P5 frontend composition.
+
+## Branch state
+
+- Branch: `feature/ethonline-2026-prize-audit`
+- Base: `develop` at the current checked-out commit
+- No formal Gate A/B run by the agent. A manual `free-pi-cli` review was
+  supplied afterward; its FAIL was process-closed because the candidate is
+  staged/uncommitted with no PR or CI, and it also identified missing loaded
+  settlement no-action coverage and interactive browser smoke.
+
+## Follow-up changes after manual review
+
+- Added a loaded `SettlementDetailsRoute` composition test proving the rendered
+  settlement evidence surface has no interactive controls.
+- Added keyboard navigation and roving focus semantics for the application
+  tabs, with explicit tab/panel labelling.
+- Added a Playwright/Chromium browser acceptance suite for the P5 state matrix,
+  responsive widths, and keyboard tab flow; CI installs Chromium and runs it.
+- Made denial, rate-limit, and service-not-ready outcomes explicit in the
+  create/replay surface instead of collapsing them into generic failure copy.
+- Kept the browser smoke item open because this host exposes no browser
+  provider; no gate was started after these changes.
+
+## Gate A follow-up fixes
+
+- Root Vitest now aliases `@oneshot/settlement-ui` and
+  `@oneshot/recovery-ui` to workspace source, so the required clean-build
+  `pnpm build && pnpm test` path does not depend on stale package bundles.
+- Playwright `test-results/` and `playwright-report/` outputs are ignored by
+  Git and Prettier; `pnpm format:check` was rerun after browser acceptance.
+- Clean validation: `pnpm build` passed with both UI package `dist/`
+  directories removed; `pnpm test` passed with 59 files and 916 tests;
+  `pnpm test:browser` passed 4/4; `pnpm format:check` passed afterward.
+- The web package Vitest config also aliases both workspace UI packages to
+  source; after removing both UI `dist/` directories, `pnpm --filter
+  @oneshot/web test` passed all 31 tests.
+
+## Selected safety cases
+
+- Same request twice and conflicting payloads remain handled by A05 with one
+  stable `business_intent_id`.
+- UNKNOWN remains reconciliation-only; the composed shell exposes no payment
+  action.
+- Privy denial/cap and Graph degraded evidence remain fixture-driven UI states;
+  no fixture can grant settlement permission.
+
+## Review instruction
+
+Before every FreePi review prompt, issue `/model free-pi/glm-5.3-flash` first.
+Inspect the end of the output for an explicit `VERDICT: PASS` or
+`VERDICT: FAIL`; do not spend tokens following streamed reasoning.

.agent/context/20260909T115157Z-ethonline-prize-audit.md

@@ -0,0 +1,131 @@
+# Session Context: ETHOnline 2026 Prize Audit
+
+## Date/time
+
+- UTC: 2026-09-09T11:51:57Z
+
+## User goal
+
+Audit `plan.md` against the official ETHOnline 2026 requirements for The
+Graph, Arc, and Privy; clarify whether Circle/Arc products can coexist with a
+Privy-first wallet architecture; and update the plan on a new branch.
+
+## Original request
+
+Review `plan.md` against the official ETHOnline 2026 prize page for The Graph,
+Arc, and Privy, add the Privy-versus-Arc-wallet analysis and detailed bounty
+compliance checklist, and do all work in a new branch.
+
+## Acceptance criteria
+
+- Explain Circle's platform, Arc, Circle Wallets, and the ambiguous term "Arc
+  wallet" without treating them as one product.
+- State which Circle integrations can preserve Privy as the load-bearing wallet
+  and policy boundary.
+- Map every selected sponsor requirement to repository evidence and a
+  fail-closed status.
+- Identify missing submission artifacts and unclaimed/ineligible tracks.
+- Update only documentation; do not change payment behavior or external state.
+
+## Assumptions and non-goals
+
+- The official prize page captured on 2026-09-09 is the source of truth for
+  sponsor requirements.
+- The repository began after the 2026-09-04 ETHOnline kickoff, so The Graph's
+  Start Fresh pool is the intended pool; ETHGlobal registration must still
+  match that selection.
+- Existing P5 work belongs to the user and is preserved unchanged.
+- No Circle Wallets, Agent Stack, App Kit, EURC, or mainnet integration is
+  implemented as part of this documentation-only audit.
+
+## Plan
+
+1. Compare official sponsor criteria with the current plan and live evidence.
+2. Correct stale or over-broad sponsor claims.
+3. Add wallet-stack compatibility guidance and per-requirement checklists.
+4. Run documentation-focused validation and inspect the final diff.
+
+## Key decisions
+
+- Keep Privy as the source wallet, signer, and remote policy boundary for the
+  required settlement path.
+- Treat Arc as the EVM L1 settlement rail and Circle Wallets as an optional,
+  separate wallet product; there is no required product named "Arc Wallet."
+- Keep Circle Agent Stack unclaimed because its current agent-wallet path is
+  not implemented.
+- Downgrade Privy and Arc submission status to `NOT VERIFIED`: the repository
+  has strong live records but no concrete Privy `WalletProvider`, no production
+  bootstrap wiring it, and production authorization currently defaults to
+  allowed when the optional port is absent.
+- Treat sponsor integration evidence separately from final submission
+  readiness; missing videos or final submission fields remain open gates.
+
+## Files/components touched
+
+- `plan.md`
+- This context record
+
+## Commands/checks
+
+- Inspected branch, status, repository policy, sponsor evidence, Graph proof,
+  subgraph source, and Arc/Privy adapters.
+- Reviewed official ETHGlobal, Arc, Circle, The Graph, and Privy documentation.
+- `pnpm exec prettier --check plan.md .agent/context/20260909T115157Z-ethonline-prize-audit.md`
+  - PASS after formatting `plan.md`.
+- `git diff --check` - PASS.
+- `pnpm --filter @oneshot/testkit-settlement evidence:b06` - PASS for the
+  recorded evidence bundle; this validates the static capture, not the absent
+  concrete Privy provider/runtime.
+- `pnpm --filter @oneshot/reconciliation test` - PASS, 8 files / 84 tests.
+
+## External-doc findings
+
+- ETHGlobal permits live Subgraph Studio data for The Graph's AI track and
+  requires a public repository plus a two-to-four-minute demo video.
+- Arc's official account-abstraction documentation lists both Privy and Circle
+  Wallets and says providers may be mixed.
+- Arc App Kit supports Viem/Ethers and extensible wallet adapters; Circle
+  Wallets is one adapter, not a prerequisite.
+- Privy's 2026 tracks require a Privy wallet and a core functional flow; they do
+  not require custom authentication or ban additional wallet providers.
+- The checked-in Privy package models scope/policy and accepts an injected
+  provider, but does not depend on or instantiate the Privy SDK/API. The worker
+  also treats a missing production authorization port as authorized; both are
+  blockers to a public-source qualification claim.
+
+## Unresolved questions
+
+- Confirm the ETHGlobal submission is registered in The Graph's Start Fresh
+  pool.
+- Record and link the required sponsor demo video(s).
+- Check in the concrete Privy provider/runtime composition and remove the
+  production authorization bypass.
+- Re-check official Arc mainnet parameters and deployment readiness after the
+  announced 2026-09-16 launch and before the 2026-09-30 deadline.
+
+## Branch/commit/PR state
+
+- Branch: `feature/ethonline-2026-prize-audit`
+- Current review base: `origin/develop` /
+  `779c6cf77796f4f6773a7959b1e2b5257b64de99`.
+- The branch was merged with the current `origin/develop` so Gate A reviews the
+  current base rather than the stale branch point. The merge also brought in
+  PR #49's Circle Agent Stack planning material; the audit reconciled it with
+  the official requirements by marking that track unclaimed and
+  `NOT QUALIFIED` until a real Agent Stack integration exists.
+- While this audit was in progress, another workspace process committed and
+  pushed the pre-existing P5 work on this branch as
+  `f1cba9023f260f04207489541c279c3df353f113`; that work was not modified by this
+  audit.
+- The audit edits remain uncommitted and unpushed. No audit commit, push, or PR
+  was requested.
+
+## Gate A/B state
+
+- Gate A: not run; documentation audit remains uncommitted.
+- Gate B: not applicable without a PR.
+
+## Handoff/next steps
+
+- Run Gate A against the exact staged candidate tree, then commit/push only
+  after an explicit `PASS`.

.github/workflows/stack-lint.yml

@@ -112,3 +112,27 @@ jobs:
         env:
           TEST_POSTGRES: '1'
         run: pnpm test:integration
+
+  browser:
+    name: Frontend browser acceptance
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: pnpm
+
+      - name: Install locked dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Chromium
+        run: pnpm --filter @oneshot/web exec playwright install --with-deps chromium
+
+      - name: Run frontend browser acceptance
+        run: pnpm test:browser

.gitignore

@@ -49,6 +49,8 @@ dist/
 site-dist/
 build/
 coverage/
+apps/web/test-results/
+apps/web/playwright-report/
 node_modules/
 .venv/
 venv/

.prettierignore

@@ -1,5 +1,7 @@
 dist
 coverage
+apps/web/test-results
+apps/web/playwright-report
 node_modules
 pnpm-lock.yaml
 packages/contracts/generated

README.md

@@ -126,14 +126,15 @@ lock: OneShot's durable state is.
 
 ```text
 apps/api                      HTTP seam
-apps/web                      operator intent and status UI
+apps/web                      composed operator UI (intent, settlement, recovery)
 apps/worker                   settlement and reconciliation workers
 packages/contracts            frozen v1 contract pack, OpenAPI, fixtures
 packages/domain               intent, attempt, and settlement state
 packages/storage-postgres     durable ledger and migrations
 packages/arc-adapter          Arc profiles, money, receipts, readiness
 packages/privy-adapter        authorization, requests, policy, adapters
 packages/reconciliation       recovery evidence and safety core
+packages/settlement-ui        policy, authorization, and settlement evidence UI
 packages/recovery-ui          synthetic recovery evidence viewer
 packages/testkit-*            simulators and sanitized fixtures
 subgraph                      Arc Testnet USDC transfer indexer
@@ -147,9 +148,18 @@ Requires Node `24.19.0`, pnpm `11.19.0`, and PostgreSQL for integration tests.
 pnpm install
 pnpm lint && pnpm typecheck && pnpm build
 pnpm test
-pnpm dev:frontend
+pnpm test:browser
+pnpm build:frontend
+pnpm --filter @oneshot/web dev
 ```
 
+Open `http://localhost:3000/`. The app shell composes create/replay,
+authoritative status, settlement evidence, and recovery evidence tabs. The
+settlement tab reads the configured OneShot API; the recovery tab is an
+explicitly labelled synthetic C05 fixture review because the frozen OpenAPI
+v1 exposes a smaller `recovery-view` contract than the full C05 timeline. The
+P5 browser acceptance suite runs with Playwright/Chromium in CI.
+
 Integration tests need a database:
 
 ```bash
@@ -169,7 +179,7 @@ pnpm --filter @oneshot/arc-adapter probe
 
 That command is read-only. It cannot sign, send, or mutate anything.
 
-To view the recovery UI locally:
+To view the standalone recovery fixture UI locally:
 
 ```bash
 pnpm --filter @oneshot/recovery-ui dev
@@ -204,7 +214,7 @@ Under active development. **Testnet only.**
 | Settlement adapters and error taxonomy        | Implemented; simulator-tested and live-verified on Arc Testnet through Privy        |
 | Recovery evidence and safety core             | Implemented against simulators                                                      |
 | Subgraph MCP discovery and LLM recovery agent | Implemented boundary; live path not verified                                        |
-| Operator frontend                             | Intent/status UI and synthetic recovery viewer implemented; live API wiring pending |
+| Operator frontend                             | P5-composed intent/status, settlement-evidence, and synthetic recovery UI; live recovery timeline wiring remains contract-gated |
 
 **One live testnet settlement has been executed.** A Privy-controlled execution
 wallet and scoped policy authorized one 1.00 USDC Arc Testnet transfer; live