P0 Walking Skeleton — Execution Prompt Pack
Status: Approved-plan execution pack, verified 2026-07-28 · Parent: frontend-stack-deep-research-2026.md (§6 architecture, §8 P0 backlog) · Mode: local/Docker-first, production-ready posture from commit 1 Operating model: 1 HITL + talent-bench agents. Each work stream (WS) below = one fresh Claude Cowork session with a copy/paste prompt — cheaper (small context, right-sized model) and faster (parallel-safe) than one mega-session.
A. Scoring Addendum — assistant-ui + AG-UI vs CopilotKit + AG-UI
Both candidates are MIT clients of the same AG-UI wire, so this is a UI-layer decision — the FastAPI gateway, Claude-SDK bridge, MCP tool plane, and AgentCore path are identical and 100% preserved either way. That reversibility is itself the risk control.
New facts vs the parent report (verified 2026-07-28): CopilotKit React components now connect directly to any AG-UI endpoint — Copilot Runtime is optional; its docs list Claude Agent SDK (Python/TS) among supported frameworks; it offers styled and headless modes (docs.copilotkit.ai). CopilotKit Cloud pricing is per-developer: Free (1 dev, 3-day thread retention, 200 threads), Pro $39/dev/mo, Team $100/dev/mo (self-hosting incl. database gated here, +$500/dev/mo), Enterprise custom (pricing). assistant-ui's persistence self-host (ThreadHistoryAdapter → own Postgres) is free and documented; its optional Cloud is $50/mo flat Pro.
| Criterion (weight) | assistant-ui + AG-UI | CopilotKit + AG-UI | Why the delta |
|---|---|---|---|
| Solo velocity (20) | 4 | 4 | Both scaffold fast. assistant-ui ships docs-as-MCP (@assistant-ui/mcp-docs-server) so talent-bench agents build the UI against live docs; CopilotKit's drop-in CopilotSidebar/Chat is equally quick but less white-label out of the gate |
| Claude + portability (20) | 5 | 5 | Tie. CopilotKit is the AG-UI steward (1st-party client, AWS AgentCore blog uses it, docs list Claude Agent SDK); assistant-ui maintains its own AG-UI runtime + AssistantTransport/AI-SDK fallback wires |
| Python/Jupyter/Vizro (20) | 5 | 4 | Same Python backend. assistant-ui's artifacts ("Open Source Claude Artifacts"), thread management, and chat-product affordances map 1:1 to rendering Plotly/papermill outputs in a chat console. CopilotKit's superpower is the inverse — embedding a copilot inside an existing app (Vizro/Backstage pages) |
| Enterprise day-1 (20) | 3 | 3 | Tie — both BYO auth/RBAC/tenancy; both keep persistence in our Postgres (never buy per-dev cloud tiers) |
| Business value (15) | 5 | 4 | Our products are chat-first consoles (Claude-clone + artifacts + approval cards = the product vision, all existing assistant-ui examples). CopilotKit's copilot-in-app UX is the right shape for 2027 Platform·IDP embedded assistants, not the 2026 revenue products |
| Voice (5) | 4 | 3 | assistant-ui ships Realtime/Dictation/SpeechSynthesis adapters + LiveKit/ElevenLabs examples; CopilotKit voice is DIY |
| Weighted /100 | 87 🥇 | 79 🥈 |
Decision unchanged, sharpened: assistant-ui is the product shell; CopilotKit is the contracted fallback client and the 2027+ embedded-copilot sidecar (exactly what ADR-003 foreshadowed at 80%). One gateway, one wire, two possible faces.
Per-product example mapping (all verified on assistant-ui.com/examples)
| Product | assistant-ui examples to port | Revenue moment it enables |
|---|---|---|
| CloudOps · Runbooks | claude clone (threads/streaming/history) + generative-ui (charts, tables) + stockbroker pattern (LangGraph HITL → our approval cards) | "Watch the fleet run your runbook, approve the gate" — the paid CloudOps assessment demo |
| FinOps · FOCUS | artifacts (OSS Claude Artifacts) + generative-ui charts + Vizro iframe route | CFO cost brief as artifact + KPI page in one session |
| Resume/Talent/job-search | form-demo (AssistantSidebar form-filling copilot, field-aware tool calls) + interactables (application-tracker board) | Guided ATS-ready resume + tracked applications — subscription UX |
What-if analysis (solo-founder 2026–2030)
| # | What if… | Impact | Pre-positioned answer |
|---|---|---|---|
| WI-1 | assistant-ui stalls (YC bus factor, ~3 people) | UI layer only | Swap client to CopilotKit (MIT, $27M-funded steward). Gateway/tools/agents untouched; est. 1–2 sprints of UI rework. Primitives + styled components already live in our repo (shadcn-style copy-in), so nothing breaks day 1 |
| WI-2 | CopilotKit gates more behind Cloud ($39–$100/dev/mo; self-host DB at Team +$500/dev/mo) | None | We never adopt Copilot Cloud; threads live in our Postgres via the gateway. Same policy for assistant-ui Cloud |
| WI-3 | 2027: Platform·IDP needs a copilot inside Vizro/Backstage pages | Additive | CopilotKit sidecar speaks to the same /agui/* endpoints — two clients, one wire |
| WI-4 | AG-UI pre-1.0 churn breaks events | Contained | Wire pinned + contract fixtures in CI (WS-0); gateway is the only place that speaks protocol; fallback wires exist (AssistantTransport, AI-SDK data stream via Pydantic-AI adapter). AWS AgentCore native support anchors the spec |
| WI-5 | Claude Agent SDK upgrade breaks the bridge | Contained | We own the forked ~300-LOC bridge (WS-2) with replay tests; CopilotKit docs now list Claude Agent SDK — upstream support is materializing (watch ag-ui #439) |
| WI-6 | Resume needs form-filling copilot at launch | None | assistant-ui form-demo covers it natively — no second framework needed |
B. How to Run the Sessions (cheaper & faster)
- One WS per fresh Cowork session. Connect only
/Volumes/Working/projects/command-center(run "On your computer" via the desktop picker for direct file access, or cloud with the folder connected). Paste the WS prompt verbatim. Small context = cheaper, faster, less drift. - Models — session-level: Claude Sonnet 5 for WS-0…WS-4 (build work; intro pricing $2/$10 to Aug 31); Claude Opus 5 for WS-5 (review/integration gate) and for any architecture dispute. Never burn Opus/Fable on scaffolding. Code-level tiering (inside
AgentDefinitions, WS-2): Haiku 4.5 triage → Sonnet 5 workhorse → Opus 5 orchestrator. - No re-research. Facts are frozen in the parent report; sessions read it first and only consult pinned docs via the MCP docs servers below. If a session wants to "verify the ecosystem", stop it — that's this document's job.
- Evidence or it didn't happen (ADLC): every WS ends with
tmp/p0-ws<N>/evidence (test output, screenshots), a conventional commit, and the Components-Used footer per.claude/skills/quality/verification-before-completion. - Order & parallelism: WS-0 first (contract + scaffold). Then WS-1 ∥ WS-2 ∥ WS-3 ∥ WS-4 in parallel sessions (all build against WS-0's frozen AG-UI contract fixtures). WS-5 last.
- Product MCPs (WS-0 writes
product-shell/.mcp.jsonso every later session auto-loads):assistant-ui-docs(npx -y @assistant-ui/mcp-docs-server),vizro-mcp(uvx vizro-mcp), plus your existingcontext7. Keep your 31-server SSOT out of these sessions — minimal profile only. - Your ADLC assets to invoke (available when the session runs inside
command-centerwith.claudelinked): commands/adlc,/adlc.plan,/ceremony:standup; agentscloud-architect(WS-0),fullstack-engineer(WS-1),python-engineer(WS-2/3/4),qa-engineer+code-reviewer(WS-5); skillsfinops/*,dashboards/*,resume/*,quality/verification-before-completion.
Version pins (SSOT — WS-0 writes this into product-shell/versions.lock.md; sessions must not bump)
| Layer | Pin |
|---|---|
| Node / Python / pnpm / Postgres | Node 22 LTS · Python 3.12 (runbooks needs >=3.11,<3.14) · pnpm ≥9 · postgres:16 |
| Shell | @assistant-ui/react 0.15.0 · @assistant-ui/react-ag-ui 0.0.48 · @ag-ui/client 0.0.57 · Next.js as scaffolded by assistant-ui create |
| Gateway | ag-ui-protocol==0.1.19 · claude-agent-sdk (latest; pin exact at install) · fastapi + uvicorn latest · forked ag-ui-claude-sdk 0.1.5 → packages/agui_claude_bridge |
| Tool plane | fastmcp>=3.4,<4 · mcp>=1.27,<2 (v2.0.0 landed 2026-07-28 — do NOT migrate yet) · runbooks==1.5.5 (local editable) |
| Insight | vizro==0.1.59 · vizro-mcp==0.1.4 · papermill==2.7.0 · duckdb (via runbooks[focus]) |
Compose topology (WS-0): web :3000 · gateway :8000 (/agui/{cloudops|finops|resume} SSE) · runbooks-mcp :8100 (streamable HTTP, stateless) · insight-vizro :8200 (gunicorn, iframed at /dash) · postgres :5432. Secrets only via env from command-center/.env (never committed, never printed).
C. The Prompts (copy/paste, one per fresh Cowork session)
WS-0 · Bootstrap monorepo, contract fixtures, guardrails — Sonnet 5, ~1–2 h
ROLE: Principal platform engineer (ADLC v3.7.6: HITL → product-owner → cloud-architect → specialist).
Act as cloud-architect + platform-engineer. KISS: ≤200 LOC/module. Evidence-based: everything you
claim done has a test/output in tmp/p0-ws0/. Never print secret values from .env; reference names only.
READ FIRST (no other research):
.adlc/docs/docs/architecture/frontend-stack-deep-research-2026.md (§6 architecture, §8 P0)
.adlc/docs/docs/architecture/frontend-stack-p0-prompt-pack-2026.md (§B pins + topology — the SSOT)
MISSION: Bootstrap the P0 walking-skeleton workspace at product-shell/ (new subdir of this repo).
Structure: apps/web · services/gateway · services/runbooks-mcp · services/insight ·
packages/agui-contract · deploy/ · versions.lock.md.
DELIVERABLES
1) pnpm workspace (apps/web placeholder) + uv workspaces for the three Python services (py 3.12).
2) versions.lock.md with the exact pin table from prompt-pack §B. This file is law for WS-1..WS-5.
3) packages/agui-contract: golden AG-UI event fixtures (JSONL) for one happy-path run:
RUN_STARTED → TEXT_MESSAGE_* deltas → TOOL_CALL_START/ARGS/END (tool: finops_cost_summary,
result carries a small Plotly JSON payload) → CUSTOM approval_request/approval_response →
RUN_FINISHED. Include a tiny fixture-replay SSE server (python, <150 LOC) so apps/web can
develop against it before the real gateway exists. These fixtures are the WS-1↔WS-2 contract.
4) deploy/docker-compose.p0.yml: web:3000, gateway:8000, runbooks-mcp:8100, insight-vizro:8200,
postgres:16 :5432; healthchecks; one shared network; env_file: ../../.env (repo root).
Placeholder images fine where the service doesn't exist yet.
5) product-shell/.mcp.json: assistant-ui-docs (npx -y @assistant-ui/mcp-docs-server),
vizro-mcp (uvx vizro-mcp), context7 (copy server entry from repo .mcp.json).
6) Append to repo .env.example (do NOT touch .env): ANTHROPIC_API_KEY, ANTHROPIC_MODEL=claude-sonnet-5,
ANTHROPIC_SMALL_FAST_MODEL=claude-haiku-4-5, PRODUCT_POSTGRES_URL, AWS_OPERATIONS_PROFILE
(readonly), NEXT_PUBLIC_BRAND_NAME, NEXT_PUBLIC_PRODUCTS=cloudops,finops,resume.
7) Taskfile targets (root Taskfile.yml include or product-shell/Taskfile.yml): p0:up, p0:down,
p0:test, p0:e2e, p0:evidence.
8) CI seed: .github/workflows/p0.yml — lint + unit on the workspace only.
OUT OF SCOPE: any feature code, any UI, any real agent calls, version bumps.
DoD: `task p0:up` starts postgres + fixture server; fixtures replay over SSE (curl transcript saved
to tmp/p0-ws0/); pnpm install + uv sync green; conventional commit `feat(p0): bootstrap walking
skeleton workspace`; finish with Components-Used footer per
.claude/skills/quality/verification-before-completion.
WS-1 · Product shell (assistant-ui) — Sonnet 5, fullstack-engineer, ~2–4 h
ROLE: Senior fullstack-engineer (ADLC v3.7.6). White-label product shell, not a demo.
KISS; every component we copy in is code we own. No secrets in client bundles (NEXT_PUBLIC_* only).
READ FIRST: frontend-stack-deep-research-2026.md §5–6; prompt-pack §A example mapping + §B pins.
MCPs available: assistant-ui-docs (USE IT for every API question — do not guess), context7.
PREREQ: WS-0 merged (fixtures + compose + pins exist). Work only in product-shell/apps/web.
MISSION: Scaffold the shell with `npx assistant-ui@latest create -e with-ag-ui apps/web`,
pin per versions.lock.md, then port these four documented example patterns
(https://www.assistant-ui.com/examples — use the docs MCP, not memory):
1. claude — thread list, streaming, message history as the base layout (our console UX)
2. artifacts — right-side artifacts panel (reports/HTML from papermill land here)
3. generative-ui — toolkit Tool UIs; implement: CostChart (Plotly via react-plotly.js),
EvidenceTable, ApprovalCard (approve/reject → posts AG-UI CUSTOM approval_response),
VizroFrame (same-origin iframe to /dash, sandboxed)
4. form-demo — AssistantSidebar form-filling copilot, wired on the /resume route
(field-aware tool calls fill a profile form)
REQUIREMENTS
- Routes /cloudops /finops /resume; product switcher; branding 100% env-driven
(NEXT_PUBLIC_BRAND_NAME, logo path, palette via CSS vars) — zero hardcoded brand strings.
- AG-UI runtime: HttpAgent → http://localhost:8000/agui/{product}; dev fallback to the WS-0
fixture server via NEXT_PUBLIC_AGUI_URL. Tool UIs keyed by MCP tool names (finops_cost_summary,
papermill_run, …) so gateway/tool renames are config, not code.
- Render CUSTOM approval_request events as blocking ApprovalCard (this is the ADLC authority
chain as product UX — the demo moment).
- a11y pass on interactive components; dark/light theme.
OUT OF SCOPE: auth (dev mode header stub), real backend, voice.
DoD: pnpm build green; Playwright smoke (thread renders fixture replay: text stream + CostChart +
ApprovalCard + artifact opens); screenshots to tmp/p0-ws1/; commit `feat(p0-web): assistant-ui
product shell`; Components-Used footer.
WS-2 · FastAPI AG-UI gateway + Claude-SDK bridge — Sonnet 5, python-engineer, ~3–5 h
ROLE: Senior python-engineer (ADLC v3.7.6). This service is the ONLY place that speaks AG-UI
protocol — isolate it. Security: never log prompts containing secrets; readonly AWS only.
READ FIRST: research report §6–7; prompt-pack §B pins; packages/agui-contract fixtures (the law);
Claude Agent SDK docs at code.claude.com/docs/en/agent-sdk (streaming input mode, sessions,
permissions, hosting) — fetch only these docs.
PREREQ: WS-0. Work only in product-shell/services/gateway (+ packages/agui_claude_bridge).
MISSION: FastAPI gateway exposing POST /agui/{product} (SSE) that runs Claude Agent SDK sessions
and emits AG-UI events per the golden fixtures.
DELIVERABLES
1) Fork PyPI ag-ui-claude-sdk==0.1.5 into packages/agui_claude_bridge — WE OWN IT now.
Map: SDK stream → TEXT_MESSAGE_*/TOOL_CALL_*/STEP_*; SDK errors → RUN_ERROR; add replay tests
against packages/agui-contract fixtures (pytest). Target ≤400 LOC + tests.
2) Session mapping: AG-UI threadId ↔ Agent SDK session (resume via session_id); SessionStore
adapter → Postgres (PRODUCT_POSTGRES_URL) per Agent SDK session-storage docs.
3) ClaudeSDKClient streaming-input mode, one subprocess per active session; per-product
AgentDefinition personas: cloudops / finops / resume — model tiering: orchestrator
claude-opus-5 (or fable-5 only if HITL sets it in .env), workers claude-sonnet-5, triage
claude-haiku-4-5. Skills: load ONLY an allowlisted subset from .claude/skills (finops, cloudops,
resume domains) via plugins/setting_sources — start with setting_sources=[] and mount explicitly.
4) Tenant isolation defaults (from Agent SDK hosting guide): per-session cwd under
/var/lib/product/{tenant}/{session}, CLAUDE_CODE_DISABLE_AUTO_MEMORY=1, no user settings.
5) HITL gate: canUseTool callback — mutating/gated tools emit AG-UI CUSTOM approval_request and
BLOCK until approval_response arrives (WS-1 ApprovalCard). Allowlist read-only tools pass.
6) MCP wiring: runbooks-mcp at http://runbooks-mcp:8100 (streamable HTTP); in-process SDK MCP
server exposing papermill_run + vizro_link tools (WS-4 implements internals; stub contract now).
7) Ops: /healthz; structured logs (no message bodies at INFO); OTel env flags documented;
Dockerfile (python:3.12-slim, non-root) sized 1 CPU / 1 GiB per session guidance.
OUT OF SCOPE: OIDC (dev header auth), Managed Agents adapter (P1), rate limiting beyond a
per-IP token bucket.
DoD: contract test replays golden fixtures byte-compatible (event type/order); e2e-lite: curl SSE
transcript with ANTHROPIC_API_KEY from .env saved to tmp/p0-ws2/ (redacted); compose service
healthy; commit `feat(p0-gateway): AG-UI gateway + owned claude-sdk bridge`; Components-Used footer.
WS-3 · runbooks-mcp (curated typed tools) — Sonnet 5, python-engineer, ~3–4 h
ROLE: Senior python-engineer + finops-engineer (ADLC v3.7.6). This is the product's tool contract —
curated, typed, auditable. NOT an auto-wrap of 68 CLI commands.
READ FIRST: research report §7 (integration blueprint); prompt-pack §B pins; runbooks/ package
(src/runbooks — import its Python APIs directly, subprocess only as last resort); FastMCP v3 docs
(gofastmcp.com) — fetch only these.
PREREQ: WS-0. Work only in product-shell/services/runbooks-mcp. AWS: $AWS_OPERATIONS_PROFILE
readonly; moto for tests — no live mutations ever in P0.
MISSION: FastMCP 3 server, STATELESS streamable HTTP :8100 (2026-07-28 MCP spec posture),
10 READONLY tools importing runbooks==1.5.5 (local editable install):
1. finops_cost_summary(period, group_by, accounts?) → monthly spend by service/account
2. finops_cost_anomalies(lookback_days) → anomaly list + severity
3. finops_focus_report(month) → FOCUS 1.2 rollup via runbooks[focus] duckdb pipeline
4. inventory_resources(scope, resource_types?) → multi-account inventory snapshot
5. cfat_assessment(sections?) → Cloud Foundations findings summary
6. vpc_topology_analysis(vpc_id?) → topology + risky paths
7. security_baseline_check(framework=cis) → pass/fail table
8. compute_rightsizing_candidates(min_saving?) → idle/oversized EC2/RDS
9. s3_lifecycle_recommendations() → lifecycle/storage-class savings
10. org_account_map() → OU/account tree
Design per tool: pydantic v2 In/Out models; docstring = when-to-use + args + example (agents read
these); outputs sized for chat (summary + optional plotly_json + optional markdown table ≤50 rows;
large payloads → write file under /artifacts and return path); consistent error envelope; tags
{readonly:true, product:finops|cloudops}.
ALSO: tool allowlist config (yaml) the gateway consumes; Dockerfile (non-root, 3.12-slim);
pytest with moto fixtures per tool (happy + empty + throttled); latency budget noted per tool.
OUT OF SCOPE: mutating remediation tools (P1, HITL-gated), FOCUS ingest scheduling, awslabs
servers (P1 — stdio wrap later).
DoD: `fastmcp list`/`call` transcript vs local server in tmp/p0-ws3/; pytest green; compose
healthy; gateway smoke calls finops_cost_summary via MCP (record SSE snippet); commit
`feat(p0-tools): runbooks-mcp with 10 curated readonly tools`; Components-Used footer.
WS-4 · Insight plane: Vizro CxO page + papermill evidence — Sonnet 5, python-engineer, ~2–3 h
ROLE: python-engineer + data/dashboards specialist (ADLC v3.7.6). Dashboards are governed,
versioned Python configs — authored WITH vizro-mcp, validated, committed.
READ FIRST: research report §7 (Vizro + notebooks blueprint); prompt-pack §B pins.
MCPs: vizro-mcp (USE IT to draft + validate the dashboard config), context7.
PREREQ: WS-0 (+ WS-3 helpful for real data shapes; sample data acceptable).
Work only in product-shell/services/insight.
MISSION (two halves):
A) Vizro CxO Cost Command dashboard (vizro==0.1.59):
- Page 1 "CxO Overview": KPI tiles (MTD spend, forecast, anomaly count, savings pipeline),
cost trend line, top-10 services bar, anomalies table.
- Data: sample FOCUS 1.2 parquet/duckdb built by a small seed script using runbooks[focus]
fixtures (no live AWS in P0).
- Serve: gunicorn, Dockerfile, :8200; stateless; dark/light theme matching shell CSS vars where
Vizro theming allows. Reached ONLY via compose network (shell iframes /dash — no public port
in prod profile).
B) papermill evidence tool (implements the WS-2 stub):
- papermill_run(notebook_id, params) executing an allowlisted copy of
cloudops/notebooks/finops/finops-dashboard.ipynb (vendor it into services/insight/notebooks/
with pinned kernel deps) → nbconvert HTML → /artifacts/{run_id}.html + summary JSON
(key metrics extracted from a tagged results cell).
- Register in the gateway's in-process SDK MCP server; output contract: {summary, artifact_path,
plotly_json?} so WS-1 renders card + artifact link.
OUT OF SCOPE: oauth2-proxy (P0 runs behind dev auth; note the P1 wiring in README), marimo,
jupyter-mcp-server, live AWS data.
DoD: dashboard renders with seed data (screenshot tmp/p0-ws4/); vizro-mcp validate passes on the
config; papermill run produces HTML artifact end-to-end from a gateway tool call (transcript);
pytest green; commit `feat(p0-insight): vizro cxo page + papermill evidence tool`;
Components-Used footer.
WS-5 · Integration, E2E, review gate, ADR-022 — Opus 5, qa-engineer + code-reviewer, ~2–3 h
ROLE: qa-engineer + code-reviewer under tech-lead review gate (ADLC v3.7.6 Phase 3+: HITL approval
required). You are the quality gate — hunt integration seams, do not add features.
READ FIRST: research report §6/§8/§10 (Q3 2026 DoD); all WS READMEs; prompt-pack §D checklist.
PREREQ: WS-0..WS-4 merged. Work across product-shell/ only.
MISSION
1) `task p0:up` — full compose (web, gateway, runbooks-mcp, insight, postgres) healthy from clean
checkout + .env; fix integration drift (ports, env names, contract mismatches) with surgical diffs.
2) GOLDEN DEMO (the sellable 10 minutes) as Playwright E2E `task p0:e2e`:
a. open /finops → ask "What did we spend last month and where is the waste?"
b. agent streams; TOOL_CALL renders CostChart + EvidenceTable (runbooks-mcp data)
c. "Generate the CFO brief" → papermill_run → artifact panel opens HTML report
d. trigger a gated tool → ApprovalCard blocks → Approve → run completes (HITL chain visible)
e. open CxO KPI page (VizroFrame) — renders inside the shell
f. /resume → form-demo copilot fills 3 profile fields from a pasted job description
3) Security pass: gitleaks on diff; bandit on the three Python services; pnpm audit (fail on
high); images run non-root; no secret values in logs/images (grep evidence).
4) Ops pass: healthchecks wired to compose depends_on; cold-start p95 recorded; cost note —
tokens per golden-demo run from gateway logs → estimated $/demo at Sonnet-5 intro pricing.
5) Evidence bundle tmp/p0-ws5/: E2E video/screenshots, test reports, security outputs, timing +
cost table. Tag v0.1.0-p0.
6) Draft .adlc/docs/docs/adrs/adr-022-product-frontend.md from research report §11 (status:
Proposed; decision: assistant-ui+AG-UI product shell / LibreChat internal; supersedes-scope
note on ADR-003; includes §A head-to-head numbers). HITL approves the ADR — do not mark Accepted.
DoD: e2e green twice consecutively; checklist §D all ✅ with evidence links; PR-style review
summary (top risks, debt register for P1) delivered to HITL; Components-Used footer.
D. Master DoD Checklist (WS-5 verifies; HITL signs)
- Clean checkout +
.env→task p0:up→ all 5 services healthy (evidence: compose ps + healthz) - Golden demo E2E passes ×2 (video + screenshots)
- AG-UI contract fixtures replay byte-compatible against live gateway (drift = fail)
- 10 runbooks tools: typed schemas, moto tests green, readonly IAM enforced
- ApprovalCard blocks gated tools until HITL approve (authority chain visible in UI)
- Vizro page + papermill artifact render inside the shell
- No secrets in repo/images/logs (gitleaks + grep evidence) · non-root containers · pnpm/bandit clean
- versions.lock.md untouched by WS-1..WS-5 (any bump = explicit HITL decision)
- Cost per golden-demo run recorded ($ at Sonnet-5 intro rates) — the CFO unit-economics seed
- ADR-022 drafted; evidence bundles in tmp/p0-ws0..5/; tag v0.1.0-p0
E. Sources (this pack)
Parent research: frontend-stack-deep-research-2026.md (§12 full citation list). New verifications 2026-07-28: CopilotKit docs (direct AG-UI connection, Claude Agent SDK listed, headless + styled) · CopilotKit pricing · assistant-ui examples (form-demo, claude, artifacts, generative-ui, interactables, stockbroker) · Claude Agent SDK docs · FastMCP · Vizro-MCP.
Pack method: facts frozen from the parent deep-research report (5-agent verified) + 3 fresh primary-source checks (CopilotKit docs/pricing, assistant-ui examples index). Prompts encode ADLC v3.7.6 guardrails (authority chain, KISS ≤200 LOC, evidence in tmp/, no-NATO) and the §B pin table as session law.