# WEBUI-1507-R1 review verdict

## APPROVED

Filbert, independent reviewer. Author Dewey. Reviewed 2026-09-13 against
Piece 4 in `docs/plans/2026-09-12_control-board-mvp.md` and the request at
`docs/plans/reviews/2026-09-13_webui-review-request.md`.

No blocking findings. Approval applies only to the exact package below. It
passes independent implementation review, not publication, deployment or user
acceptance. Gate E remains Jason's Monday 2026-09-14 ruling. Keep #1507 open
pending that acceptance.

## Exact candidate

HEAD was the requested baseline
`355b4308c31c4bd500a844787eb1461f98dd2be3` during provenance verification.
The candidate was the untracked `packages/webui/` overlay, not a committed tree.

Manifest: `docs/plans/reviews/webui-1507/manifest.sha256`.
Recomputed manifest SHA-256:
`509f20e53292d5731c866d84c73cfaf539a89104b38b12a43260075ee7c3cb4d`.
Its 21 entries cover all and only the 21 package files. All 21 content hashes
passed verification before review, in the independent test copy, and after
checks. This approval incorporates that exact manifest, not later package edits.

Behavior-bearing source hashes:

```text
20f8091e5fb3fcaba583b601ce258999d44afbe569e93c979938ace759b4eef4  packages/webui/src/cli.mjs
c0c1a360ce44a7439e67eea36b9237c59621aa3fd78571a823fd23dc15a950f6  packages/webui/src/serve.mjs
7f30847ba25eb7e2b176df614d7bcae45ab7d86615c84ad44ffc29f0f261759c  packages/webui/src/public/app.js
db055d5b8a3710f4164193550ac25b7c5d223dd890ae3e9d73daaada38849557  packages/webui/src/public/index.html
7add449911677c662a05ad5d9c2462f919e759574fe4b85bd13a705cc54f6856  packages/webui/src/public/live.css
```

## Independently reproduced evidence

Created `/tmp/filbert-webui-1507-N4Iiyg` from a read-only `git archive` of
baseline `packages`, `scripts`, and `tools`, then copied only the pinned WebUI
package over it. No unrelated working-tree source entered this test copy.
No dependency installation was needed. Node v26.8.1 and installed Chromium.

Commands run from that copy:

```sh
sha256sum -c manifest.sha256
WEBUI_EVIDENCE=/tmp/filbert-webui-1507-N4Iiyg/screenshots node --test packages/webui/tests/
node --test packages/webui/tests/ packages/control-board/tests/ packages/seat/tests/ packages/ledger/tests/ packages/mosaic/tests/
```

- WebUI: 6 passed, 0 failed, no skips, including both Chromium tests.
- Combined suite: 208 passed, 0 failed, no skips.
- Rendered contrast: 330 samples, no failures, minimum 4.504658476260286:1.
- Layout checks passed at 320, 390, 768, 1440 and 2560px, with and without
  the inspector. Table-local horizontal scrolling is intentional.
- Inspected all four independently generated screenshots: Harbor light page
  at 320/1440 and Grove dark inspector at 320/1440. Controls and text remain
  readable; the narrow inspector scrolls vertically to its reply controls.
- `node --check` passed for both server modules, both public scripts and all
  five test modules.
- `cmp` confirmed copied shared CSS, Console CSS, brand.js and all six font,
  source and license files are unchanged from Dewey's WUI assets.

Raw local results are `webui-tests.txt`, `combined-tests.txt` and `hashes.txt`
in the independent copy. Screenshots are in its `screenshots/` directory.
These temporary files supplement this durable result summary.

## Review conclusions

The page implements the approved Console layout using board data only. Project
counts and filters do not hide another project's waiting requests. The dense
table and inspector expose the specified fields; unsupported mockup controls
are absent. Palette and appearance remain on this one page. Refresh uses the
board page's ten-second cadence, with Pause and manual refresh, not a new scanner.

The server binds only to loopback, restricts the upstream to an HTTP loopback
origin, normalizes localhost without DNS resolution, rejects hostile Host and
Origin requests, and serves only allowlisted assets. POST routes require a JSON
object and enforce the 4096-byte limit. The proxy preserves accepted POST bytes,
upstream status and JSON text, refuses redirects, and does not retry actions.
Seen and Reply reach only fixture transports during verification.

Rendering escapes dynamic text and attributes. Hostile identifiers do not enter
CSS selectors. Drafts, receipts and caret positions survive refresh; stale
registration removes reply access without discarding the draft. A per-row
in-flight set prevents duplicate sends, and text changed during a send survives
its earlier success. Keyboard row navigation, inspector focus and Escape return
passed. Unreachable or malformed board data produces a warning without erasing
the last valid snapshot. Denied localStorage falls back safely.

The implementation is small and separated into CLI, proxy and page behavior.
Copied design assets remain separate from live-page adaptations. Source review
and tests support the declared boundaries; no board, seat or comms change is
part of this candidate.

## Limits and handoff

The checks used synthetic session and registration files and stubbed transport.
No real board scan, real-seat message, private-session read, credential access,
source edit or publication was performed. Git use was read-only provenance and
archive extraction. Browser evidence is Chromium, not a screen-reader audit or
Jason's workday acceptance. Contrast samples are not an exhaustive accessibility
certification. The README documents in-memory draft loss on reload and uncertain
delivery after a lost response.

Dewey should reverify the manifest before any separately authorized publication.
CURRENT.md remains with its existing owner for the verdict/publication transition.