S45 · Explainability & Transparency

Declared state: complete for now.

This is the repository plan and evidence, not a live health reading. A task marked done may still depend on credentials, devices, deployment or a newer acceptance test.

Dependencies

No dependencies are declared in the catalog.

Tasks and gates

45.F1 · Autonomous actions produce reports with reasoning. *gate:* `test_proactive_report.py`

Tier F · done · Verification: hermetic-test

Gate: `test_proactive_report.py`

  • unverified-import · undated · docs/SYSTEMS-DETAILS.md:4347

45.F2 · A full audit trail with scrubbed values. *gate:* `test_phasex_audit_health_modes.py`

Tier F · done · Verification: hermetic-test

Gate: `test_phasex_audit_health_modes.py`

  • unverified-import · undated · docs/SYSTEMS-DETAILS.md:4348

45.F3 · `why` as a first-class question about the *last turn*: tools used, sources, confidence.

Tier F · done · Verification: hermetic-test

Gate: `test_why_last_turn.py`

  • recorded-note · 2026-09-13 · docs/SYSTEMS-DETAILS.md:4349

45.R1 · Confidence is reported alongside answers where it varies (pairs with 01.F2).

Tier R · open · Verification: hermetic-test

Gate: `test_uncertainty.py` [reported confidence]

    45.R2 · Source attribution in spoken answers, short form ("from your calendar", "from the web").

    Tier R · in-progress · Verification: hermetic-test

    Gate: `test_why_last_turn.py` [attribution]

    • hermetic-green · undated · bench/test_citations.py

    45.R3 · Decision replay: reconstruct a past turn's inputs from the audit trail.

    Tier R · in-progress · Verification: hermetic-test

    Gate: `test_decision_replay.py` 36/36 — a past turn is reconstructed from the turn trace (the decision) and the audit trail (the actions) joined on `turn_id`; the three things a replay cannot show are named rather than left blank; and a tampered turn is explained and flagged in the same breath,

    • hermetic-green · undated · bench/test_decision_replay.py

    45.E1 · Any turn from the past 30 days can be explained on request.

    Tier E · open · Verification: manual

    Gate: audit replay drill.

      45.F4 · **A surface for reviewing everything done unattended** — Jev p=0.74, conf 0.65: the one safety addition that must exist before autonomous work runs. This is the exception to building the surface after the week; it gates the autonomous worker, not the week.

      Tier F · done · Verification: hermetic-test

      Gate: `test_unattended_review.py` — every unattended action appears with its actor, its correlation id and its outcome; the owner own actions are excluded, and an action with no correlation id is reported as a gap rather than merged into a neighbouring run.

      • recorded-note · 2026-09-20 · TODO.md

      45.R4 · **The control room, extending the existing browser clients** — interactive, not read-only. Jev: extend the existing clients against the brain's HTTP/WS surface with no new runtime (p=0.99, conf 0.99); a control room rather than a dashboard (p=0.93, conf 0.85) because seeing a wrong belief and being unable to correct it is worse than not seeing it; build it AFTER the first real week (p=0.88, conf 0.75).

      Tier R · open · Verification: planned-test

      Gate: new `test_control_room.py` — an operator can approve, reject, correct and retry from the surface, and each intervention is audited with an actor.

        45.R5 · **Show what Mushegh believes** — the memory and world-model inspector is the failure the owner most needs on a screen (p=0.75, conf 0.50): a stale or wrong belief produces confident wrong answers indefinitely, and 23 of 50 systems name silent wrongness as their dominant risk. Correctable, per the control-room directive.

        Tier R · open · Verification: planned-test

        Gate: new `test_belief_inspector.py` — a belief is visible with its provenance and validity, and an operator correction is persisted and audited.

          45.R6 · **The spatial HUD shell: one Mushegh command surface, one 12x12 canvas mesh, and a render gate** — the owner's newer React spatial direction supersedes the earlier five-route presentation constraint while retaining the static-production, local-asset, truthful-data and reduced-motion gates.

          Tier R · done · Verification: hermetic-test

          Gate: `test_hud_modes.py` plus the spatial client unit/browser suites — the only persistent chrome is one command/search surface above the 12x12 mesh; all 18 canvases are addressable; Mushegh publishes bounded presentation-only commands consumed idempotently by the typed layout reducer; background state is retained; real waits have truthful loaders; the 3D scene begins empty; local assets, responsive geometry and reduced motion pass without an external origin.

          • hermetic-green · undated · bench/test_hud_modes.py

          45.R7 · **AMBIENT mode** — the wall panel: six values, big type, no scrolling, legible across a room. (= Part P's P1.3.)

          Tier R · open · Verification: planned-test

          Gate: new `test_hud_ambient.py` — the route renders exactly the six declared values and nothing that scrolls; type scales by viewport rather than a fixed size; the generative field pauses when no value has changed; and anything red is distinguishable without colour alone.

            45.R8 · **TRACE mode** — one turn as it happens, joined on 31.F5's correlation id, with the transcript replayed at its real token cadence.

            Tier R · open · Verification: planned-test

            Gate: new `test_hud_trace.py` — a turn's spans are assembled from one correlation id with no gaps across edge/brain/tool/audit; the replay cadence comes from recorded timestamps and is not synthesised; a turn still in flight renders without its end; and the mode degrades to polling when the event stream is unavailable.

              45.R9 · **One panel dispatch and a preview strip** — `/panel/<name>.json` over tools that already return data, one card each. (= Part P's P2.1; pairs with 06.R4.)

              Tier R · open · Verification: planned-test

              Gate: new `test_hud_panels.py` — one dispatch serves every declared panel name and an unknown name is refused rather than guessed; each panel is backed by a tool that already exists, so no panel invents a data source; and adding a panel needs no new route.

                45.R10 · The audit trail is verifiable: the append-only JSONL carries an integrity check a reader can run without the framework, or the word tamper-evident is struck from every document (D-25, D-43).

                Tier R · in-progress · Verification: hermetic-test

                Gate: `test_audit_integrity.py` 45/45 — `python -m mushegh.brain.audit_verify --verify <path>` reports an edited, removed, reordered or spliced line and exits non-zero; a gap mid-chain is reported as a gap; and the two things it cannot detect are asserted as still undetectable.

                • hermetic-green · undated · bench/test_audit_integrity.py
                • recorded-note · undated · src/mushegh/brain/audit.py, src/mushegh/brain/review.py, 2026-10-10
                • recorded-note · undated · bench/test_finetune.py, 2026-10-10

                HUD screen contracts

                All subsystems · Source: docs/systems-plan.json.