Layer 4: Agent Oversight Layer UI for Orchestrator, Reviewer, and Security Agents

[d3v07]

using opus 4.8 on extra high effort

Before starting this issue, confirm you are using Opus 4.8 on extra high effort. Ask this every time you start a new work item.

Shared execution rules:

• Work on branch: feature/frex22-layers-1-4-operator-control
• Submit Layers 1 to 4 as one PR only.
• PR title: Build Layers 1-4 Operator, Intake, Control Plane, and Oversight UI
• d3v07 reviews that PR before any work starts on Layers 5 to 8.
• Do not change EvidencePack v1.
• Do not add API endpoints.
• Do not rename tools.
• Do not modify backend verification logic unless a frontend build cannot compile without a tiny type-safe adapter. If a backend change seems necessary, stop and ask d3v07.
• All agents remain read-only. Mutation remains backend-only after matching hash-bound approval.

Title:
Layer 4: Agent Oversight Layer UI for Orchestrator, Reviewer, and Security Agents

Assignee:
frex22

Branch:
feature/frex22-layers-1-4-operator-control

Context:
Use the Layer 4 architecture image as the visual spec. This layer introduces new read-only oversight agent roles. For this PR, implement the dashboard/system-map representation and evidence display hooks only. Do not implement backend agent execution unless the repo already contains compatible data.

Goal:
Add a clear Agent Oversight Layer view showing:

• Main Orchestrator Agent
• Reviewer Agent
• Security Agent

These agents are oversight-only. They inspect and challenge. They never execute.

Required agent cards:

1. Main Orchestrator Agent
   Purpose:
   oversees agent workflow, completeness, and consistency; no mutation authority

Inputs:

• run context
• plan
• tasks
• evidence
• agent outputs

Checks performed:

• workflow completeness
• agent sequencing
• consistency

Outputs:

• gaps identified
• routing recommendations
• clarifications

2. Reviewer Agent
   Purpose:
   reviews evidence quality, missing fields, and reasoning consistency

Inputs:

• evidence items
• rationale
• citations
• field requirements

Checks performed:

• field completeness
• data quality
• reasoning alignment

Outputs:

• missing fields
• quality findings
• improvement suggestions

3. Security Agent
   Purpose:
   reviews permissions, scope, policy fit, and index risk

Inputs:

• requested actions
• roles
• scopes
• policies
• index selection

Checks performed:

• permissions
• policy alignment
• index risk and exposure

Outputs:

• risk flags
• policy deviations
• safer alternatives

Required constraints panel:
Oversight-only constraints

• read-only
• no credentials exposure
• no mutation authority
• suggestions must be validated downstream

Required catches panel:
What this layer catches

• incomplete evidence
• inconsistent reasoning
• risky index choice
• out-of-policy action

Required downstream section:
Show read-only handoff to Specialist Reasoning Agents:

• observes agent plans, outputs, and intermediate artifacts
• may request clarifications or re-checks

Required sideways section:
Show read-only access to Control Plane / Policy Data:

• policies
• approvals
• execution guardrails
• verification rules
• historical signals

Strict constraints:

• Do not give oversight agents mutation authority.
• Do not expose credentials.
• Do not mark oversight suggestions as final decisions.
• Do not change EvidencePack v1.
• Do not rename current tools.
• Do not add backend calls unless existing API already supports the data.
• If real oversight outputs are not present yet, show a clear empty state:
  No oversight findings recorded for this run.

Acceptance criteria:

• Agent Oversight Layer is visible in System Map or equivalent navigation.
• Three oversight agent cards render cleanly.
• Constraints panel exists.
• Catches panel exists.
• Empty states are honest and not fake.
• Read-only nature is obvious.
• UI does not imply agents can execute.

Tests:
Run:
cd dashboard && npm run lint
cd dashboard && ./node_modules/.bin/tsc --noEmit
cd dashboard && npm run build

Manual QA:

• desktop 1440x1100
• mobile 390x1000
• no clipped cards
• no horizontal overflow
• cards remain readable
• empty oversight state looks intentional

Single PR body template to use when all four layers are complete:

Title:
Build Layers 1-4 Operator, Intake, Control Plane, and Oversight UI

Summary:
This PR implements the frontend/product surfaces for Layers 1-4:

• Layer 1: Multipage Operator Console
• Layer 2: Intake + API Gateway
• Layer 3: Control Plane
• Layer 4: Agent Oversight Layer

Safety boundaries preserved:

• UI reads EvidencePack v1 JSON only.
• No EvidencePack schema changes.
• No new mutation path.
• No tool renames.
• No API expansion.
• Agents remain read-only.
• Mutation remains backend-only after matching hash-bound approval.

Required screenshots:

• Overview desktop
• Run Review desktop
• System Map desktop
• History & Compare desktop
• Audit View desktop
• Run Review mobile 390x1000
• System Map mobile 390x1000
• Agent Oversight mobile 390x1000

Test results:
Paste output from:
cd dashboard && npm run lint
cd dashboard && ./node_modules/.bin/tsc --noEmit
cd dashboard && npm run build

Manual QA checklist:

• desktop 1440x1100
• mobile 390x1000
• no horizontal overflow
• no clipped hashes
• no clipped buttons
• no unreadable trace rows
• pending approval state renders
• approved state renders
• rejected state renders
• verified happy path renders
• verification failed trace renders

Reviewer:
d3v07 must review this PR before Layers 5-8 begin.