[DO NOT MERGE] Implement Workflow Activity vNext console

.github/workflows/ci.yml

@@ -36,6 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       docs_only: ${{ steps.docs_only_route.outputs.docs_only }}
+      frontend_only: ${{ steps.docs_only_route.outputs.frontend_only }}
       all_changed: ${{ steps.filter.outputs.all_changed }}
       core_code: ${{ steps.filter.outputs.core_code }}
       product_runtime: ${{ steps.filter.outputs.product_runtime }}
@@ -130,18 +131,29 @@ jobs:
             console_web:
               - 'apps/aevatar-console-web/**'
               - '.github/workflows/ci.yml'
+            frontend_paths:
+              - 'apps/aevatar-console-web/**'
 
-      - name: Resolve Doc-Only Route
+      - name: Resolve Change Scope
         id: docs_only_route
         env:
           ALL_CHANGED_COUNT: ${{ steps.filter.outputs.all_changed_count }}
           DOCS_ONLY_COUNT: ${{ steps.filter.outputs.docs_only_count }}
+          FRONTEND_CHANGED_COUNT: ${{ steps.filter.outputs.frontend_paths_count }}
         run: |
           if [ "${ALL_CHANGED_COUNT:-0}" != "0" ] && [ "${ALL_CHANGED_COUNT:-0}" = "${DOCS_ONLY_COUNT:-0}" ]; then
             echo "docs_only=true" >> "$GITHUB_OUTPUT"
           else
             echo "docs_only=false" >> "$GITHUB_OUTPUT"
           fi
+          if [ "${ALL_CHANGED_COUNT:-0}" != "0" ] && [ "${ALL_CHANGED_COUNT:-0}" = "${FRONTEND_CHANGED_COUNT:-0}" ]; then
+            echo "frontend_only=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "frontend_only=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Verify Change Scope Routing
+        run: python3 tools/ci/tests/test_ci_change_scope.py
 
   fkst-host-policy:
     if: |
@@ -233,19 +245,54 @@ jobs:
       - name: Test Stability Guards
         run: bash tools/ci/test_stability_guards.sh
 
+  console-web-tests:
+    if: needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.console_web == 'true'
+    needs: changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.2.1
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: apps/aevatar-console-web/pnpm-lock.yaml
+
+      - name: Install console-web dependencies
+        run: pnpm --dir apps/aevatar-console-web install --frozen-lockfile
+
+      - name: Test console-web shard
+        run: pnpm --dir apps/aevatar-console-web test --runInBand --shard=${{ matrix.shard }}/4
+
   console-web:
     # Refactor (iter16/cluster-ci-systemic-refactor):
     #   Old pattern: console-web skipped scheduled CI and ran for every PR, workflow_dispatch, main/dev push, or console_web changes
     #   New principle: gate on changes.outputs.console_web per Phase 9 #716 r3 consensus A
-    if: needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.console_web == 'true'
-    needs: changes
+    # Keep the existing required check name and fail it if any test shard fails
+    # or is cancelled. All tests run once across the four Jest partitions.
+    if: always() && needs.changes.outputs.docs_only == 'false' && needs.changes.outputs.console_web == 'true'
+    needs: [changes, console-web-tests]
     runs-on: ubuntu-latest
-    # The serial suite grew into this budget: recent runs took 19m02s, 19m35s,
-    # 19m57s, then 20m10s and 20m17s, the last two cancelled mid-test at the
-    # 20m cap. The ~18m of test work is real, so give it headroom rather than
-    # letting every run decide the build on runner jitter.
-    timeout-minutes: 35
+    # Retain the base branch's budget for typecheck, build, and canvas benchmark.
+    timeout-minutes: 45
     steps:
+      - name: Require all console-web test shards
+        env:
+          TEST_SHARDS_RESULT: ${{ needs.console-web-tests.result }}
+        run: test "$TEST_SHARDS_RESULT" = success
+
       - uses: actions/checkout@v4
 
       - name: Setup pnpm
@@ -267,12 +314,22 @@ jobs:
       - name: Type-check console-web
         run: pnpm --dir apps/aevatar-console-web tsc
 
-      - name: Test console-web
-        run: pnpm --dir apps/aevatar-console-web test --runInBand
-
       - name: Build console-web
+        env:
+          AEVATAR_WORKFLOW_CANVAS_BENCHMARK: '1'
         run: pnpm --dir apps/aevatar-console-web build
 
+      - name: Benchmark workflow canvas
+        run: pnpm --dir apps/aevatar-console-web benchmark:workflow-canvas
+
+      - name: Upload workflow canvas benchmark
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: workflow-canvas-benchmark
+          path: apps/aevatar-console-web/artifacts/workflow-canvas-benchmark
+          if-no-files-found: warn
+
   slow-test-guards:
     needs: changes
     # Refactor (iter18/cluster-019-strict-coverage-aevatar-slnx):
@@ -388,11 +445,17 @@ jobs:
     #   Old pattern: coverage_quality_guard.sh 吞 test fail 继续 emit coverage;split-test-guards 漏跑 22 orphan project
     #   New principle: strict-coverage fail-fast(不吞 fail);aevatar.slnx-or-slow-test 唯一测试权威;
     #   retire slnf 测试执行(只保留 slnf build boundary);slow-tests 独立 CI job
+    # Frontend-only PRs do not need backend coverage, regardless of their target branch.
+    # Mixed changes and changes to CI/build infrastructure retain this gate.
     if: |
       github.event_name == 'schedule' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')) ||
-      needs.changes.outputs.docs_only == 'false'
+      (
+        github.event_name == 'pull_request' &&
+        needs.changes.outputs.frontend_only != 'true' &&
+        needs.changes.outputs.docs_only == 'false'
+      )
     runs-on: ubuntu-latest
     # Full coverage takes 34-35 minutes after a roughly 10-minute restore/build,
     # then still needs time to upload the report. Keep the fail-fast guard while

apps/aevatar-console-web/AGENTS.md

@@ -133,6 +133,58 @@ pnpm --dir apps/aevatar-console-web build
 - Do not add or preserve hidden `/teams/:scopeId...` compatibility routes.
   Parse paths by resource name, not by fragile segment indexes.
 
+## Workflow Activity vNext Baseline
+
+- Before changing any route, page, component, hook, query, adapter, model,
+  style, locale, or test for
+  `/scopes/:scopeId/workflow-activity-vnext`, read all three of these sources
+  completely:
+  `docs/design-baselines/workflow-activity-vnext/README.md` and
+  `docs/superpowers/specs/2026-08-04-workflow-activity-vnext-design.md` and
+  `docs/superpowers/specs/2026-08-04-workflow-activity-vnext-user-paths.md`.
+- Treat
+  `docs/design-baselines/workflow-activity-vnext/aevatar-workflow-activity-vnext.excalidraw`
+  as the primary visual, information-architecture, and interaction reference.
+  Treat the design specification as the normative route, product identity,
+  API, state, and backend-compatibility contract. Treat the user-path
+  specification as the normative journey, decision, recovery, and completion
+  evidence contract.
+- The PNG and HTML prototypes are reference artifacts, not runtime data
+  sources. Never copy their hard-coded records, `localStorage` persistence,
+  timers, simulated receipts, or successful-looking defaults into production
+  code.
+- Production remote state must come from real API responses or real user
+  actions acknowledged by those APIs. When an API is pending, empty,
+  unavailable, delayed, or failed, render that exact state; do not insert mock
+  or fixture fallback data.
+- Keep mock and fixture data in clearly named test-only files. Production
+  routes, components, hooks, queries, and API adapters must not import them.
+- Reuse the existing protected-route, `/login`, `/auth/callback`,
+  `NyxIDAuthClient`, sanitized `returnTo`, session restoration, sign-in,
+  sign-out, and service-access review behavior. Do not create a vNext auth
+  route, provider, callback, token cache, session store, or identity fallback.
+- Reuse the existing Umi locale configuration, `ConsoleLanguageSwitch`,
+  `getLocale`/`setLocale`, message helpers, and `en-US`/`zh-CN` catalogues. Add
+  every new vNext message to both catalogues; do not create a vNext locale
+  context, storage key, or hard-coded visible-copy path.
+- Login, callback, language, and account presentation may adopt the vNext
+  visual system, but auth, redirect, callback, session, language, persistence,
+  error, and accessibility behavior must remain unchanged. If vNext hides the
+  global header, reuse its existing language/account actions inside the local
+  shell rather than cloning their logic.
+- Include the design-baseline declaration from
+  `docs/design-baselines/workflow-activity-vnext/README.md` in every vNext
+  implementation task and pull request so the Excalidraw hash, contract
+  documents, user paths, and real-API-only data-source rule are reviewable.
+- Run
+  `python3 docs/design-baselines/workflow-activity-vnext/verify-baseline.py`
+  from `apps/aevatar-console-web/` before and after changing the baseline. The
+  verifier must confirm the declared hash, deterministic generator output, and
+  exact 17-frame inventory.
+- Keep this feature frontend-only and isolated to its new route namespace.
+  Do not change backend code or alter existing Workflow, Run, Settings, Studio,
+  Team, member, redirect, or menu behavior to implement it.
+
 ## UI and Interaction
 
 - For page, component, console, playground, or visual-polish work, follow
@@ -148,6 +200,32 @@ pnpm --dir apps/aevatar-console-web build
   magic values.
 - Treat the console as an operational tool: prioritize scannability, clear
   hierarchy, predictable navigation, and efficient repeated actions.
+- Every visible title or heading must add distinct orientation, resource
+  identity, current-state, or task meaning. Do not repeat the same noun at the
+  modal/drawer shell and content levels, and do not add helper copy that merely
+  paraphrases an adjacent heading. Prefer one resource-owned container title;
+  add a nested heading only when it names a genuinely different state, view,
+  or user task.
+- Scope asynchronous loading feedback to the data region owned by the query or
+  command. Keep committed sibling regions mounted and usable, preserving their
+  selection and scroll position when they are not being reloaded. Use a
+  whole-workspace loading state only when the initiating operation actually
+  invalidates or blocks the whole workspace.
+- Reuse the shared loading language instead of composing page-local spinners or
+  indicator cards: use `AevatarContentSkeleton` for an initial structured data
+  surface, `AevatarLoadingOverlay` when a command temporarily blocks committed
+  content, and `AevatarLoadingDots` only for compact inline progress.
+- Default user-facing surfaces must show only information needed to understand
+  the current task, result, or next action. Do not expose backend architecture,
+  transport, storage, or consistency terminology such as `read model`,
+  `projection`, `materialization`, `receipt`, raw actor/command/correlation
+  identifiers, state versions/watermarks, DTO or endpoint names, or query
+  sampling limits in page titles, descriptions, helper copy, primary tables,
+  empty states, or primary error messages. Preserve truthful loading, accepted,
+  delayed, and failed semantics in plain product language. When raw values are
+  genuinely useful for support or debugging, place them behind an explicit,
+  user-opened technical-details disclosure instead of making them the default
+  interface.
 - Preserve responsive behavior, keyboard access, focus visibility, semantic
   controls, and readable contrast. Verify dense real content and narrow mobile
   widths without overlap, clipping, or inaccessible actions.
@@ -157,6 +235,34 @@ pnpm --dir apps/aevatar-console-web build
 - Use established icon libraries and control patterns. Add accessible names or
   tooltips for icon-only or unfamiliar actions.
 
+### Action Feedback and Toasts
+
+- Use the shared `ConsoleToastProvider` and `useConsoleToast` from
+  `src/shared/ui/ConsoleToast.tsx` for transient user-action feedback. Do not
+  introduce new direct `antd` `message` or `notification` calls inside React
+  product surfaces. Non-React transport error boundaries retain their existing
+  handling unless the boundary receives a deliberate React-safe migration.
+- A success toast is evidence of a completed user-visible action, not of a
+  click, request dispatch, `202 Accepted` response, local optimistic update,
+  or background observation still in progress. Show it only after the API
+  contract has reached the state the copy claims.
+- Keep a toast short, localized, and action-oriented. Do not put endpoint
+  names, DTO fields, request IDs, raw backend errors, or recovery diagnostics
+  in it; expose those through the surface's existing technical-details path.
+- Report transient API request failures through the shared error toast. Do not
+  add page-wide warning or error banners above otherwise usable content, and
+  do not render an error while another request required to classify the same
+  state is still pending.
+- Use persistent inline state, alerts, or panels for loading, accepted,
+  observing, delayed, retryable, authorization, forbidden, and primary-content
+  failures where the user needs a durable next step. A toast must not be the
+  only evidence of a durable status or recovery action.
+- Emit at most one toast for one user action. Avoid success toasts for local
+  form edits that still require an explicit page-level save. Migrate touched
+  user-feedback paths to the shared abstraction while preserving legacy
+  behavior outside the requested surface unless a deliberate migration is in
+  scope.
+
 ## Change and Review Hygiene
 
 - Branch names use `<type>/YYYY-MM-DD_<purpose>`, where `<type>` is one of

apps/aevatar-console-web/config/config.ts

@@ -1,9 +1,9 @@
 // https://umijs.org/config/
 
 import { defineConfig } from '@umijs/max';
+import { aevatarThemeConfig } from '../src/shared/ui/aevatarWorkbench';
 import defaultSettings from './defaultSettings';
 import proxy from './proxy';
-import { aevatarThemeConfig } from '../src/shared/ui/aevatarWorkbench';
 
 import routes from './routes';
 
@@ -15,7 +15,9 @@ function resolvePublicPath(value?: string): string {
     return '/';
   }
 
-  const rootRelative = normalized.startsWith('/') ? normalized : `/${normalized}`;
+  const rootRelative = normalized.startsWith('/')
+    ? normalized
+    : `/${normalized}`;
   return rootRelative.endsWith('/') ? rootRelative : `${rootRelative}/`;
 }
 
@@ -157,20 +159,24 @@ const config: ReturnType<typeof defineConfig> = defineConfig({
   define: {
     'process.env.CI': JSON.stringify(process.env.CI),
     'process.env.NYXID_BASE_URL': JSON.stringify(process.env.NYXID_BASE_URL),
-    'process.env.NYXID_CLIENT_ID': JSON.stringify(
-      process.env.NYXID_CLIENT_ID,
-    ),
+    'process.env.NYXID_CLIENT_ID': JSON.stringify(process.env.NYXID_CLIENT_ID),
     'process.env.NYXID_REDIRECT_URI': JSON.stringify(
       process.env.NYXID_REDIRECT_URI,
     ),
     'process.env.NYXID_SCOPE': JSON.stringify(process.env.NYXID_SCOPE),
+    'process.env.AEVATAR_CHANNEL_WEBHOOK_BASE_URL': JSON.stringify(
+      process.env.AEVATAR_CHANNEL_WEBHOOK_BASE_URL,
+    ),
     'process.env.ORNN_BASE_URL': JSON.stringify(process.env.ORNN_BASE_URL),
     'process.env.AEVATAR_CONSOLE_TEAM_FIRST_ENABLED': JSON.stringify(
       process.env.AEVATAR_CONSOLE_TEAM_FIRST_ENABLED,
     ),
     'process.env.AEVATAR_CONSOLE_PUBLIC_PATH': JSON.stringify(
       process.env.AEVATAR_CONSOLE_PUBLIC_PATH,
     ),
+    'process.env.AEVATAR_WORKFLOW_CANVAS_BENCHMARK': JSON.stringify(
+      process.env.AEVATAR_WORKFLOW_CANVAS_BENCHMARK,
+    ),
   },
 });