A-Team Project / Sovereign Vault

A-Team Development Studio is a local-first Tauri v2 desktop studio prototype with a React/TypeScript frontend, a Rust/Tauri command boundary, and SQLite-backed mock persistence.

The current documented baseline includes pinned Node 24.15.0 and Rust 1.95.0 toolchains, verification-only CI, the Phase 2.0C Codex workflow protocol, the Phase 2.0G restrictive Tauri CSP, and the Phase 2.0K supply-chain baseline policy. A private GitHub remote remains the project posture, and no public release has been made.

Current State

• Tauri v2 shell and React/TypeScript UI are in place.
• The Rust/Tauri backend command boundary is in place.
• The three-pane studio UI, memory tabs, artifact selection, pane collapse controls, and command injector are implemented.
• SQLite-backed mock persistence is implemented with DB schema version 2.
• Seed integrity repair exists.
• Soft Brake trigger and resolution state persist across relaunch.
• Soft Brake resolution actions persist as exact selected actions.
• governance_events exists as backend-only audit history.
• Loopback-only Local AI HTTP runtime exists for approved local endpoints (localhost, 127.0.0.1, and ::1).
• Local AI streaming exists and is consumed by the frontend through stream lifecycle events.
• Local AI response regeneration controls exist for Try Again, Longer, and Shorter.
• Local AI transcript state is in-memory only and is not persisted.
• Local AI endpoint/model configuration is React state only and is not persisted.
• A Manual Boardroom shell exists.
• Boardroom can run one Director-selected role turn through the Local AI streaming path.
• Boardroom is not autonomous; no multi-agent loop, scheduler, or background runtime is active.
• Boardroom sessions, transcripts, and decision packet drafts are session-only and are not persisted or exported.
• Listen / Voice controls are scaffold-only and do not invoke TTS.
• Deep Research is mock/debug-only and does not fetch, persist, or save to the vault.
• AgentFlow is visual-only and not persisted.
• Inert orchestration scaffolds exist and remain disabled.
• Inert Rust sandbox state contracts exist and remain non-runtime.
• Node and Rust toolchains are pinned for deterministic local verification.
• Verification-only CI exists for pull requests to master and manual dispatch.
• A restrictive Tauri CSP is configured under app.security.csp.
• ESLint / Prettier hygiene baseline tooling is present for local lint and format checks.
• SECURITY.md defines the supply-chain baseline policy for dependency changes, lockfile review, vulnerability triage, audit disclosure, and deferred automation.
• The runtime gate contract is disabled by default.
• Frontend runtime gate status data-layer integration exists.
• The Manual Decision Packet Builder is an in-memory local draft workflow.
• Root AGENTS.md provides short mandatory Codex operating instructions.
• docs/codex-agentic-workflow-protocol.md provides the detailed Codex workflow protocol.

Codex Workflow

Codex development workflow for this repository is governed by AGENTS.md and docs/codex-agentic-workflow-protocol.md.

These documents govern Codex planning, execution, review, hydration, evidence, scope, Git, and checkpoint behavior only. They do not activate runtime agents, app automation, provider calls, tool calls, sandbox execution, app runtime filesystem writes, or release behavior.

Local-First Boundary

The current app is designed around local desktop execution and local SQLite persistence. Local app data, SQLite databases, logs, environment files, generated build output, and checkpoint archives must not be committed.

No cloud/provider/model-routing/network runtime exists, except approved loopback-only Local AI HTTP runtime and streaming.

This repository does not currently implement cloud sync, cloud routing, OPFS/native sync, model routing, remote orchestration, MCP/tool execution, browser automation, autonomous loops, or release behavior.

Disabled Future Integration Scaffolds

The orchestration/ directory contains disabled scaffold material only. The following seams are not runtime-enabled:

• WebMCP
• A2A
• A2UI
• ADK-Python
• Browser-Harness

These files are not loaded, parsed, validated, or executed by Rust, Tauri, or the frontend. They do not enable cloud/provider/model-routing/network runtime, subprocesses, filesystem writes, tool execution, schedulers, task queues, or agent orchestration.

Future-intent concepts that are not implementation authorization are tracked in docs/future-implementation-ledger.md.

Not Implemented

The following are not implemented runtime behavior:

• Live agents
• Autonomous loops
• Provider execution
• Cloud/provider/model-routing/network runtime beyond approved loopback-only Local AI HTTP runtime and streaming
• MCP/tool execution
• Sandbox runtime
• A2A runtime
• A2UI telemetry runtime
• ADK-Python runtime
• Browser-harness runtime
• Runtime toggle or run commands
• App runtime filesystem writes
• Schema-driven runtime
• New database migrations or schema-driven migration expansion beyond the existing local SQLite mock persistence schema
• Persistent manual decision packets
• Exported decision packets
• Persistent or exported Boardroom sessions, transcripts, or decision packets
• Persisted Local AI transcripts or endpoint/model configuration
• Real TTS, browser speech synthesis, cloud TTS, provider TTS, local TTS sidecar, automatic playback, or persisted voice selection
• Real Deep Research fetching, research automation, vault save, or export behavior
• Persisted AgentFlow workflows
• Cloud routing
• Browser automation
• Public release
• Deploy, release, or artifact publication
• Product-facing governance event viewer

Schema Law

Files under schemas/** are architectural contracts. Do not modify, normalize, rewrite, regenerate, refactor, reformat, or derive SQLite migrations from them without explicit approval.

Local Setup

Toolchain pins:

• Node: 24.15.0 in .nvmrc and .node-version
• Rust: 1.95.0 in rust-toolchain.toml

Install dependencies from the committed lockfile:

cd "C:\dev\a-team-studio"
npm.cmd ci

Run the desktop app locally:

cd "C:\dev\a-team-studio"
npm.cmd run tauri dev

Verification Commands

On Windows PowerShell, use npm.cmd rather than npm if script execution policy blocks npm.ps1.

Run TypeScript checks:

cd "C:\dev\a-team-studio"
npm.cmd exec tsc -- --noEmit

Run the frontend production build:

cd "C:\dev\a-team-studio"
npm.cmd run build

Run Rust checks:

cd "C:\dev\a-team-studio\src-tauri"
$env:CARGO_TARGET_DIR = Join-Path $env:TEMP 'a-team-studio-check-target'; cargo check --locked

Run Rust tests:

cd "C:\dev\a-team-studio\src-tauri"
$env:CARGO_TARGET_DIR = Join-Path $env:TEMP 'a-team-studio-test-target'; cargo test --locked

If Cargo reports access-denied errors in a target or incremental cache directory, rerun with an isolated CARGO_TARGET_DIR as shown above. Delete temporary target directories only when explicitly approved.

Verification-only CI runs for pull requests to master and by manual dispatch. It runs npm ci, TypeScript check, lint, format check, frontend production build, Rust check, and Rust tests using the pinned Node and Rust toolchains. It does not deploy, release, publish, upload artifacts, use secrets, run audits, add dependency automation, or activate runtime/provider/agent/sandbox behavior.

License

No license has been selected. Reuse, redistribution, derivative work, or commercial use is not granted by default. A license decision must be made separately by the Director before public release.