spec: desktop-tabbed-app

[stark-claude-21s]

Stage-1 authored spec+plan (stark-author). Gate: accepted by operator 2026-07-27.

Four-tab main window (Chat / Ingest / Stats / Config, Cmd+1..4), model dropdowns + Gemini models.list detection, masked key with show-while-typing, CodeMirror YAML editor with live schema validation, ADR-0005 engine-access expansion, new brain stats command. 7 advisory findings dispositioned at the gate; accepted-base 686807a (post #430–#432 refresh).

🤖 Generated with Claude Code

[stark-claude-21s]

Review round 1 — local multi-agent review (operator-invoked)

Five lenses (internal consistency, repo fact-check @ 686807a, task-DAG soundness, requirements coverage, implementer red-team), every finding adversarially verified by an independent skeptic. 14 raw → 8 confirmed → 4 distinct defects. All four fixed in 008c764.

Confirmed → fixed

#	Finding	Fix
1	T10 (YAML editor) missing dependency edges — its file column edits src/renderer/app.ts (created by T5) and builds the Config tab's second sub-view (host built by T8), sharing config-ipc.ts edits with T8 with no ordering; declared deps were only T4, T6. Found independently by five lenses; a DAG-honoring parallel dispatch would run T10 against a nonexistent file.	T10 depends → T4, T6, T8 (T5 transitive via T8)
2	T7 hidden dependency on T2 — the frozen stats argv builder + per-schema JSON validation need stats.schema.json, which only T2 creates; T7 declared only T6. Fake-spawn tests could go green against a guessed shape.	T7 depends → T2, T6
3	T2's done-when couldn't see its own enforcement gate — tools/contract-lint.test.ts lives in the tools workspace (never runs under pnpm --filter @atlas/cli test) and pins exact per-phase command membership, so adding the 25th stats row is guaranteed to fail it until that file is edited — a file absent from T2's scope, surfacing only at T14.	tools/contract-lint.test.ts added to T2's files; pnpm -r test added to its done-when
4	resolveGeminiApiKey misattributed to packages/models/src/gemini.ts in the "facts the implementer must not re-derive" block — it lives in src/client.ts:91 (lazy default wired at :370); gemini.ts owns only Transport + GeminiAdapter.	Attribution corrected; T3 pattern description now points at client.ts

Refuted at verification (recorded, no action)

1. "T7 omits status so the Stats fanout has no sanctioned spawn path" — wrong: cli.ts is the second sanctioned spawn module and already owns the frozen STATUS_ARGV; T11 now says so explicitly (clarification added, not a fix).
2. "T2 must list generated commands-overview.md" — the spec's add-a-command ceremony already names pnpm contract:write, which regenerates it.
3. "Intent's 'projection-table insert' contradicts 'operational registry insert'" — repo itself uses "projection" loosely for the whole SQLite DB; normative sections carry the precise wording.
   4/5. "Digest's 'skips the Gemini call' is wrong — retrieval-only still embeds" (two lenses) — engine fact true, but the digest is explicitly non-normative and the spec states the correct behavior three times (embedding-retryable in Chat EARS, T7 timeout rationale).
4. "Show-toggle is requirement drift vs 'ability to show it'" — masked-field + show-while-typing satisfies the ask; stored-key reveal was never promised, write-only Keychain posture predates this spec, and the operator gate accepted the behavior explicitly.

Review stats: 19 agents, 191 tool calls, ~1.17M tokens. Cloud ultrareview pending GitHub re-authorization; this local round stands on its own.

🤖 Generated with Claude Code

[stark-claude-21s]

Fix-all follow-up (2523d19): the five refuted-but-true observations are now hardened too — Intent's source add gloss reads operational SQLite source-registry insert; T7 states status stays on cli.ts's spawn class; T2's file column lists the regenerated commands-overview.md; the digest's Search-only line now says the answer step is skipped while a small embedding call still runs. Declined (with reason): revealing the stored Gemini key — write-only Keychain + no-read-back IPC is doctrine (ADR-0004, kept by ADR-0005); the show toggle covers in-flight typed text only, as the operator gated. All 10 round-1 findings are now dispositioned: 4 fixed, 5 hardened, 1 declined.

🤖 Generated with Claude Code