VOLATILE: public data plane, ChatOps, sandbox, and cockpit slice

[ION-operations]

VOLATILE / NOT TRUSTED ION STATE

This PR is the current public collaboration branch for the ION GitHub data-plane bootstrap and live integration work. It is useful for humans and AI carriers to inspect, but it is not production authority, Steward acceptance, or final trusted ION state.

Branch: docs/github-public-data-plane-policy -> rawsource
Latest head observed by Codex: 38fcbf1
Current GitHub merge status should be rechecked before any merge.

Includes:

• public landing README and GitHub community-health surfaces
• deeper docs split: ION_FUNDAMENTALS, TEMPLATE_LAW, CONTEXT_SYSTEM, AGENTS_ROLES_CARRIERS
• full encyclopedia link with authority caution
• public repo navigation and cleanup plan
• GitHub issue/PR templates and branch trust class
• volatile live-state branch policy
• root witness manifest relocation evidence from the earlier bootstrap
• ChatGPT sandbox return intake protocol, schema, kernel owner, daemon endpoints, cockpit projection, and tests
• ChatOps browser extension cockpit evolution: top status rail, composer-native tabs, upward drawer, DOM action registry, YAML markers, Agent preview/latest-run controls, package/sandbox lanes, and receipt surfaces
• emergency extension stability repair: safe mode, debounced scanner, narrow auto selectors, extension-owned mutation ignore, degraded scan status
• guarded artifact/file attachment lane: attachable artifact listing, Braden-approved daemon upload tickets, localhost download endpoint, visible browser drag/drop attempt, and receipt boundary
• local operator artifact attach lane: Braden-approved upload ticket, extension attach-target rectangle, xdotool-first Linux file-picker assist, active ChatGPT window check, no Send click, and receipt/log result
• local attach repair: accepts normal Chrome/Chromium conversation-title windows, sends screen coordinates to the desktop helper, compactly summarizes attachables instead of dumping raw JSON, and keeps the composer drawer shorter and exactly composer-width aligned
• local attach target instrumentation: Preview Target, Dry Run Attach, required geometry evidence, daemon-side target plausibility checks, LOCAL_OPERATOR_TARGET_GEOMETRY_INVALID fail-closed receipts, and dry-run-before-click behavior
• local attach target calibration: Settings -> Pick Attach Target stores the exact ChatGPT attach/add-file selector, Clear Attach Target resets it, saved targets fail closed if hidden/stale/not near composer, and tab/drawer layout tuning is exposed as local browser settings
• direct drag/drop upload targeting: Drop Latest now uses an explicit page/composer drop zone, Settings -> Pick Drop Zone stores the target, Preview Drop Zone shows the blue-ring target, and Local Attach is documented as a fallback rather than the primary ChatGPT upload path
• synthetic drop overlay cleanup: after Drop Latest dispatches drop events, it now sends best-effort dragleave/dragend/Escape cleanup so ChatGPT\x27s Add anything overlay does not remain latched; no Send click is performed
• browser file attachment automation protocol documenting browser-only, local-operator, native/debugger, and future macro lanes under visible/approved/receipted boundaries
• composer attachment anchoring and capture polish: full composer-shell anchoring, attachment thumbnail tracking, ResizeObserver refresh, polished code/YAML badges, visual capture borders for composer controls/source chips, and diagnostics capture registry
• restored JOC cockpit shell support files required by current shell imports
• queue hygiene and runtime evidence receipts showing stale work packets classified without deletion

Latest validation:

• node --check ION/09_integrations/browser_extension/ion_chatops_bridge/dist/content.js: passed
• node --check ION/09_integrations/browser_extension/ion_chatops_bridge/dist/background.js: passed
• node ION/09_integrations/browser_extension/ion_chatops_bridge/tests/live_smoke_parser_simulation.js: passed
• PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=ION/04_packages python3 -m py_compile ION/04_packages/kernel/ion_chatops_bridge.py: passed
• focused ChatOps bridge policy tests: 19 passed
• full pytest suite: 274 passed
• kernel.ion_status: ION_STATUS_READY

Boundaries:

• no production authority
• no secret or credential authority
• no direct main push requested
• no silent macro/send/file-upload automation
• artifact upload lane is approval-gated and does not click Send
• local operator artifact attach lane is approval-gated, target-checked, active-window checked, file-picker assisted, and does not click Send
• local operator desktop clicks use extension-provided screen coordinates; viewport coordinates are retained as evidence
• Local Attach cannot move the pointer until the daemon dry run accepts target kind, target rect, screen rect, composer proximity, page URL, timestamp freshness, and display bounds
• synthetic browser drop may be blocked by ChatGPT/browser and must fail visibly
• capture borders are visual perception markers only; they do not click, send, upload, or mutate ION state
• no source patching from ChatGPT sandbox returns; returns are inbox evidence until reviewed
• no deletion; queue cleanup used status transitions and receipts
• live Cloudflare tunnel runtime files remain uncommitted local state

Review posture:

• Do not merge blindly as a docs-only PR.
• Treat this as a broad volatile integration branch.
• Prefer follow-up split PRs for stable promotion once reviewed: docs, sandbox runtime, extension cockpit/stability, artifact lane, local operator lane, JOC restoration, queue evidence.

Local browser acceptance still needed:

• reload unpacked extension
• confirm top rail remains in ChatGPT header area
• confirm composer area shows tabs/drawer only
• confirm tabs align with actual composer pill and drawer opens upward
• type multiline input and confirm tabs track composer growth
• upload/remove an image or file and confirm tabs track the full composer shell
• confirm Developer Mode tab remains visible
• confirm code/YAML badges are subtle and show valid/blocked/duplicate states
• confirm capture borders appear around input, attach/send/voice controls, selected GitHub/source chip if present, and uploaded thumbnail
• confirm Diagnostics lists composer anchor rect, attachment detection, capture roles, and selected sources
• confirm manual Rescan and YAML approval still work
• with daemon running, open Artifacts -> Attachables
• create or find an attachable package/ZIP, then test Artifacts -> Drop Latest
• confirm any browser drop failure is visible and no Send click occurs
• test Artifacts -> Local Attach only with the current ChatGPT tab active and no sensitive files selected
• confirm Local Attach either attaches the approved artifact or fails visibly with the specific blocker
• confirm no Send click occurs after Local Attach
• use Artifacts -> Preview Drop Zone first; the blue ring should cover the page/composer area where manual file drops work
• if Preview Drop Zone is wrong, use Settings -> Pick Drop Zone, then click the normal ChatGPT drop area once
• if Preview Target rings the wrong element, use Settings -> Pick Attach Target, then click the real ChatGPT attach/add-file button once
• use Preview Target first; the green ring must appear on the attach/add-file control before Dry Run Attach or Local Attach
• use Dry Run Attach next; if geometry is rejected, no pointer movement should occur

[ION-operations]

Live browser feedback: composer cockpit is loading and looks promising. Next UI correction: keep the compact ION ChatOps status rail in the page top/header area, while the composer surface contains only the tab rail and upward drawer. Improve code/YAML badges so they are less intrusive and more readable. Also fix composer anchoring when uploaded image/file thumbnails expand the composer height: tabs should stay attached to the composer top edge, not remain at the old single-line input position. Treat this as visual/anchor refinement only; no new macro automation, upload automation, Codex behavior, or daemon mutation in this slice.

[ION-operations]

Live UI feedback / next extension refinement:

Composer capture affordances need to be first-class. Every actionable/captured element in the ChatGPT composer should show a subtle ION border/halo so the operator can see what the extension has detected and can potentially act on.

Targets to identify and visually mark:

• composer/input area itself;
• add/attach file button;
• send button;
• microphone / voice button;
• model/thinking selector if visible;
• source/tool selector area, including selected sources such as GitHub;
• uploaded file/image thumbnail chips;
• selected source chips / pills / dropdowns if present.

Design intent:

• borders should be beautiful, subtle, and matched to the orange Developer Mode / composer-tab aesthetic;
• each captured element should indicate detection, not automatic permission;
• use distinct but restrained status tones: detected, available, blocked, warning, active;
• Diagnostics should list each detected composer element with role, bounds, enabled/disabled state, and stale/healthy status;
• Automation tab should eventually expose these detected targets as previewable macro targets, but this slice should remain visual/detection only unless already-gated behavior exists.

Important anchor fix:

• uploaded image/file thumbnails must be considered part of the full composer shell;
• tab rail and drawer geometry must track the expanded composer height when thumbnails or source chips appear/disappear.

Non-scope for this refinement:

• no silent send click;
• no silent file upload;
• no new Codex/daemon mutation path;
• no automatic use of GitHub/source selection beyond visual detection and diagnostics.

[ION-operations]

Live browser feedback after commit 42657a5:

The composer cockpit is improving, but the next refinement should correct these specific UI regressions:

1. Composer tabs are no longer aligned cleanly with the composer top edge. They appear partially clipped/cut by the top edge. They should sit just above the composer border, not inside the composer body or clipped by the border.

2. Uploaded image/file thumbnail expansion still does not move the tab rail upward correctly. Anchor geometry still appears to be tracking part of the composer rather than the full expanded composer shell. The full shell must include attachment thumbnail rows/chips and source chips.

3. ION code/YAML badges are placed in the top-left of code blocks and obstruct code text. They should move to the top-right code-block chrome area, immediately left of the copy button, as compact workflow badges.

4. Multiple badges are stacking/overlapping on the same code block. There should be one badge container per code block, updated in place, not repeated overlays. Prefer a single badge such as: ION CODE #N, ION YAML #N ✓, ION YAML #N blocked, or ION YAML #N duplicate.

5. Badge design should become more intuitive: use compact status icons/checkmarks and restrained tones. The badge should communicate whether ION sees/understands the block and whether it is valid/blocked/duplicate without covering code.

6. Top status rail is vertically misaligned in the ChatGPT header. It needs to sit centered in the top bar with balanced top/bottom padding. Current rail appears too high, with little padding above and excess padding below.

Scope for next patch: visual and anchor refinement only. Preserve existing safe mode, scanner throttle, YAML detection, approval behavior, Agent/Sandbox controls, and no-silent-automation boundary.

[ION-operations]

ION orchestration note: shift from ad hoc ChatGPT/MCP dependence toward a GitHub-backed, CLI-first local runtime.

Current strategic direction:

1. GitHub becomes the durable coordination/data plane: PR comments, issues, branch state, commits, validation notes, and work-packet witnesses.
2. MCP remains useful when available, but it is optional live control/status, not the only transport.
3. The browser extension becomes the ChatGPT interaction plane: DOM cockpit, YAML detection, artifact attachment, source/file awareness, and operator-present approvals.
4. The local daemon becomes the execution/package plane: package local slices, expose attachable artifacts, ingest returns, queue Codex, write receipts.
5. Codex CLI becomes the primary development worker runtime: bounded subprocess workers with compiled context packages, role profiles, captured events, proof-bearing returns, tests, diffs, and receipts.
6. ION remains the authority membrane: GitHub comments, Codex outputs, browser artifacts, and ChatGPT responses are candidates until proof-gated and receipted.

Recommended implementation workstreams:

A. Finish local artifact attachment automation: target geometry dry run, active-window verification, approved file-picker assist, upload-chip verification, no Send click.
B. Build GitHub intake: poll PR comments/issues/branch updates, dedupe by GitHub ID, classify into work packets/feedback/receipts, queue local Codex only when gated.
C. Build Codex CLI capability probe and supervisor: discover local CLI flags/modes, handle approval prompts through policy, auto-approve only allowed bounded actions, fail closed on unknown prompts.
D. Build CLI worker broker: render role/template/context packets, launch Codex exec, capture events/return/diff/tests, run proof gates, write receipt, update cockpit.
E. Add worker profiles: Mason, Nemesis, Scribe, Vizier, Steward-review as bounded Codex CLI invocation profiles, not persistent personalities.
F. Connect extension Agent tab to the CLI broker: queue, run, latest return, proof state, diff/test evidence, receipt.
G. Prepare OpenAI technical review packet: AI-built provenance, architecture, safety posture, demo path, risks, and exact ask.

Boundary: this comment is a planning witness, not accepted ION state. No production authority, secret authority, deployment authority, direct main mutation, or silent automation is implied.