feat: AI Atlas KeepSimple leads + Copilot dormancy + session monitor#132
Conversation
Codifies the copy voice reference ("Rise of the Choice Architect") and the
"never fabricate UX Core bias data" rule into the agent-facing CLAUDE.md so
future agents land on it before writing user-facing copy or content.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The Ask widget panel was a fixed 480×660 between the mobile breakpoint (≤480px) and infinity, so on 13–14" laptops it overlapped the host navbar and felt too heavy. Adds an intermediate breakpoint that drops the panel to 380px wide and caps height to fit shorter viewports. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds OffSec as a third UX Core use-case alongside Product Management and HR. Mutually exclusive with PM/HR — switching to PM/HR exits OffSec and vice versa. - New isOffsecView state in useUXCoreGlobals with localStorage persistence - "Offensive Cybersecurity" button on the UX Core landing below the PM/HR switcher, with a placeholder shield icon (TODO: swap for the hexens.io logo SVG when the asset lands) - Bias modal: matching OffSec toggle row below the PM/HR switcher and a "coming soon" panel for the use-case section while per-bias OffSec scenarios are being authored - URL hash extended with #offsec - Localized OffSec strings for en / ru / hy Mobile (MobileView, UXCoreModalMobile) keeps current 2-state behaviour; mirroring there is a follow-up step. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…ckbar
Follow-ups from Wolf's review of the OffSec scaffold:
- Replaces the placeholder shield icon with the Hexens brand mark
(bold X framed by top-left + bottom-right corner brackets), reproduced
inline as SVG.
- Landing-page button label shortens to "Cybersecurity" and tucks
directly under the PM/HR strip with shared borders and matching
width, so the three buttons read as one block.
- Switching to OffSec now fires the same snackbar pattern used by PM/HR
("You are viewing offensive security use cases"), with a pre-set
text so the first frame doesn't flash the previous PM/HR label.
- Bias modal uses the full name "Offensive Security" instead of the
"OffSec" short form.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Matches the actual rendered width of the PM/HR strip so the three buttons line up flush as one block. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
PM and HR are 79px each (border-box), so the strip is 158px wide. Sets the Cybersecurity button to the same with box-sizing forced, so the three buttons render as a flush block regardless of global box model. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Reshapes the right-hand control on the UX Core landing so PM, HR, and Cybersecurity render as one stacked block, all the same width, each row a full button with icon + label aligned left. Replaces the side-by- side PM/HR ViewSwitcher and the separate Cybersecurity strip. - New setUseCase action in useUXCoreGlobals — sets PM/HR/OffSec atomically so clicks are explicit instead of toggling. - Single click handler picks the right snackbar text and calls setUseCase. Every click fires the chip, matching prior PM/HR behaviour. - Cybersecurity label shortens to "OffSec" below 1280px so the row still fits comfortably; the full name stays on primary desktop. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- View type switcher gets a `wide` variant (99px buttons → 198px total) so the Core/Folder strip and the Use cases column line up flush on both edges on the primary desktop view. - The Cybersecurity / OFFSEC row renders all-caps with light letter spacing — applies regardless of source string so localized labels keep the same visual weight. - Adds dark-mode rules for the new Use cases panel (rows + label) and for the modal's OffSec switcher + coming-soon panel so both surfaces read correctly against the dark page background. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- ViewSwitcher.wide overrides the 1360px column-mode breakpoint so the Core/Folder pair stays the same 168px width as the Use cases column underneath on 13–14" laptops, not the default 63px. - Hexens mark now renders with `fill: currentColor`, so its colour cascades from the row's CSS. The dark-mode active row already sets white text, so the icon inverts to white automatically without a second asset or theme prop. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The standalone @media (max-width:1360px) block targeting .ViewSwitcher .ViewSwitcherButton was source-ordered after the .wide override and tied on specificity, so on Wolf's 1272px viewport the column-mode 63x28 shrink was still winning. Re-anchors the override on .ViewSwitcher.wide (chained, 4-class) and moves it after the legacy media blocks so both specificity and source order favour it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Two small-screen quality fixes: - When the View type ViewSwitcher restacks into a column at <=1360px, its bottom edge sits below 150px, which is where the Use cases panel was anchored — so the "Use cases" label overlapped the Folder icon. Drops the panel to top:220px in the same breakpoint so the label clears the second View type button. - Removes the 1px #fafafa border-left on the html scrollbar and thumb. Combined with scrollbar-gutter:stable, it was painting a thin white line down the right edge of every UX Core page in dark mode. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…tics First worked example under the Offensive Cybersecurity use case — when the visitor toggles to OffSec on the Availability Heuristics bias they get a full attacker-side breakdown plus defender takeaway, in a Hexens visual register (crimson accents, monospace metadata, sharp corner brackets on the visual card). - New OffsecBiasView component renders prose intro, scenario, side-by- side inbox mock, with/without-bias outcome contrast, why-it-works paragraph, and the blue-team countermeasure. - Themed light + dark variants; collapses to single-column visual + a stacked outcome grid below 720px. - Modal looks up the bias slug via the new biasOffsec data module; if no OffSec content exists yet for a given bias the existing "coming soon" panel still renders. - Modal label now reads "Offensive Cybersecurity" (full form) again in the per-bias OffSec row, matching the landing-page block. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Removes the fabricated open-rate badges (2.8% / 21.4%), the made-up ~7x lift claim, and the false-precision operational windows (14 days / 72 hours) from the Availability Heuristics OffSec example. Keeps the directional contrast — the visual still shows generic vs breach-themed framing side by side, and the outcome rows now describe the effect qualitatively rather than quoting unprovable percentages. Rule going forward: zero mocked numbers in the OffSec layer; if a figure cannot be sourced, it does not ship. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Drops the "by team" qualifier from the modal section header so it covers the new Offensive Cybersecurity use case alongside Product and People Management. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The modal's use-case content block was popping on every switch — PM/HR had the sliding indicator on the switcher itself but the body text swapped instantly, and the OffSec branch had no transition at all. Wraps the content slot in a keyed div that replays a short fade-in (opacity + 6px Y) every time the active use case changes, so all three toggles feel continuous on click. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…lears ViewSwitcher ToolHeader carried z-index: 2, sandboxing its LanguageSwitcher dropdown (z-index: 50) inside that stacking context. The page-level View type switcher and Use cases panel both sit at root z-index: 3, so they floated above the entire navbar — visible as the View-type icon obscuring the Armenian row of the open language menu on /uxcore. Bump ToolHeader to z-index: 10. Navbar now outranks page chrome and the dropdown renders cleanly over both controls. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Surgical pass on the Offensive Cybersecurity section of the bias modal: - Drop the italic intro paragraph (duplicated WHY IT WORKS). - Drop the WITHOUT/WITH outcome rows (narrated the visual cards). - Sharpen the scenario into a single attack-frame line. - Name the cognitive mechanism in WHY IT WORKS (availability + base-rate neglect) and the substitution the target makes. - Expand BLUE-TEAM into a lede + 4 concrete defender moves. No fabricated stats — directional language only. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Clicking the active OffSec row was a no-op — once selected, Cybersecurity locked in with no way back to PM/HR. Now a second click on the active row reverts to the user's last PM/HR selection (lastBaseUseCase, tracked across setUseCase calls and persisted in localStorage). Snackbar pre-set mirrors the resolution so the first frame lands on the correct label. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
OffSec already ships its own visual (the email-card pair) inside the section body. Showing the PM/HR "Visual example" block underneath made the modal look like the OffSec content had been bolted on top of an unrelated demo. Suppressing BiasBody when isOffsecView is true keeps the OffSec layer self-contained. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…from example header Cuts one section, removes the brand-conflated icon from the example, and sharpens two blue-team moves (grammar + "out of band" instead of "in band", "lookalike" instead of "neighboring"). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
… elevation
Moves 1 and 2 were too vague ("tune detection", "pre-publish a runbook").
Replace with technical blue-team actions tied to the attack's kill chain:
treat the breach disclosure itself as an IOC, and elevate mail posture
(URL rewriting, sandbox detonation, forced SSO re-auth) for the news-cycle
window.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…dual reader The audience for UX Core isn't security teams; it's product/design folk and curious readers. Re-cast the section as "Protect yourself" with user-level habits (slow down on topical lures, out-of-band verify, password manager as domain judge, treat breach references as citations to check). Rename the schema field blueTeam/blueTeamLabel -> defense/defenseLabel so the same shape carries across all 105 biases. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…al emails
Eyebrow becomes plain "Scenario" with two-beat copy ("A major company
just got breached… now an attacker emails your finance team") so non-
technical readers grok the setup at a glance. The two cards lose their
inline tags (now sit outside as captions), gain a sender + timestamp
header row, a hairline rule between subject and body, and an attachment
chip on the generic invoice — they now read as email previews rather
than abstract spec cards.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…d bias modal Single source of truth for the moon/sun toggle. Previously the only toggle lived as an inline div in src/components/Header/Header.tsx; bias modals had none. Extracted into src/components/ThemeToggle/, swapped the inline version, and dropped the same component next to the language selector inside the bias-modal header. Cross-realm sync (window event in useGlobals) keeps both trees in lockstep, so a click anywhere reaches everywhere. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…lock The crimson L-brackets in the top-left and bottom-right corners that already frame the Scenario block now repeat on Why-it-works, so the two analytical blocks read as a matched pair instead of one decorated card next to a plain one. Protect-yourself keeps its crimson left rule. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Root cause: handlePageViewChange used a toggle-with-guard
"(type === secondViewLabel) !== isSecondView". When OffSec was active
the underlying isProductView still pointed at the prior PM/HR side,
so clicking that same side made the guard false-out and the click
got swallowed — user had to click twice (or click HR first then PM)
to actually land on PM.
Replace the toggle with an explicit setUseCase('product' | 'hr') call.
Always lands on the clicked side in one click, regardless of whether
OffSec was active. setUseCase already drops isOffsecView atomically.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Scenario said "your team", Why-it-works said "the target / a finance employee", Protect-yourself said "you". Re-cast Scenario and Why-it-works in the same direct second-person register as Protect-yourself so the reader stays the protagonist from setup to defence. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Drops the "handle the perimeter / handle your inbox" parallel for a sharper "while your security team handles the perimeter — here's your homework" opener. Reads as a directive instead of a parallelism; "homework" sets expectation that what follows is actionable and personal. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…OffSec view One-liner under the Protect-yourself block — "Examples co-authored with kemmio." — where kemmio is a button that opens a portal-rendered read-only popup. The popup closes on backdrop click and on Escape (capture-phase listener with stopImmediatePropagation so the parent bias modal does not also close on the same keypress). Bio is constant across all OffSec biases (component-internal copy, not per-bias data): Hexens co-founder, Aptos critical-vulnerability research ($1T+ Web3 exposure averted), and the historically biggest Web3 critical-vulnerability disclosure ($500M instant + $1.7T cascade, caught in private disclosure). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
… project Atlas changes: - Optional childrenArc field on a project independently governs the angular spread of its satellite children, separate from territoryArc (which drives the territory band backdrop). Multimove now uses childrenArc: 36 so Orchestrator, Telegram, LinkedIn, Twitter and Medium read as a cluster instead of a 70° fan. - New project entity SeoGeoSolver at theta=45 (between Multimove and elea) with its Engineering Lead chip. Workspace lives at /workspace/seo-geo-solved; current CLAUDE.md size (148 lines) surfaced in the dossier description. EN + RU data mirrored. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…Solidity TSTORE bullet - Replace the broken AM-fallback emoji with an inline SVG of the Armenian tricolor (renders identically across all browsers/fonts). - Add italic tagline under his real name: "Among the most consequential whitehat hackers alive." - Wrap Hexens in an external-tab link to hexens.io; styling unchanged (inherits the crimson strong colour). - Add a third fact: first critical Solidity compiler vulnerability in over a decade — the TSTORE poison bug, with link to the Hexens research write-up. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…de.md row - SeoGeoSolver moves from theta=45 to theta=26 (inside Multimove's CONTENT · PR territory band) and uses default lead positioning so its Eng. Lead chip sits below it the same way Multimove's does. Treated as a peer/partner of Multimove inside the content+PR wing. - Multimove children further tightened (childrenArc 36 -> 28) so the satellite stack reads as a unit. - Static claudeMdLines field on dossiers now feeds the same structured "claude.md" row as the live metrics endpoint (live overrides static when present). Drops the awkward prose mention from the SeoGeoSolver description; the 148-line CLAUDE.md surfaces in the lead dossier in the same format used for every other Eng. Lead. EN + RU mirrored. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Banner reads "The heart of KeepSimple Team's operations" now (RU mirrored). Same all-caps treatment via existing CSS. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…usory truth)
Two new entries that follow the same structure as availability-heuristics:
scenario, two side-by-side email-style cards (with the bias-exploiting
side flagged), why-it-works paragraph, and a four-move Protect-yourself
list keyed to the bias mechanism.
- Attentional bias: a loud "URGENT sign-in from Moscow" decoy beside a
quiet "updated wire details" ask one minute earlier. The bias mechanism
is attention budget — the noisy one is bait, the quiet one is the
attack. Defenses: scan the same window after the loud event, never
trust an alert's link, decoys travel in pairs.
- Illusory truth effect: a cold "vendor banking update" ask vs. the
same content reframed as a third touch ("Re: Re: ... as mentioned
last week"). Two prior friendly notes were a deposit into your
credibility account; the third is the withdrawal. Defenses: thread
length is not verification, treat first money/credential ask as new
no matter how familiar, cross-check sender against external contacts.
Plus a small refactor: OffsecBiasContent moved out of
availabilityHeuristics.ts into a dedicated types.ts so the type now
defines attachment/flagged as truly optional and the same shape applies
across all 105 future biases without each file needing to mirror every
field of the first one.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…chat DMs Email was overused for the first three examples. Generalised the visual chassis with a discriminated card kind so each bias picks the surface that matches its actual attack vector. Email stays for availability (news-anchored phishing IS email-shaped); attentional bias #2 pivots to two competing push notifications (Microsoft Defender "unauthorised sign-in" decoy vs Wire Approvals "bank details changed" quiet ask); illusory truth #3 pivots to a LinkedIn-style chat (cold ask vs same message reframed as the third touch with a "2 messages this month" context line). Future biases (browser alerts, OS dialogs, voice calls, etc.) can add their own card kind to types.ts without breaking the existing two. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Modal tab row is now a single 3-position pill (PM | HR | Cybersecurity) instead of a 2-pill + separate OffSec button below. OffSec slot uses the actual Hexens brand mark served from /public/uxcore/. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The 16×16 PNG asset blurred badly when rendered at 18px next to the crisp SVG PM/HR icons. Replaced with a stroke-based SVG that uses currentColor — scales to any size, picks up the active-state colour (crimson on active OffSec, white in dark mode) without a separate filter trick. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Strapi-served project glyphs were dark ink on transparent — invisible against the dark panel. Apply invert+brightness in dark theme, with stacked grayscale for in-development rows. Also flip GitHub/API icon swap so the light icon shows at rest and the dark icon takes over when the button hovers to a light background. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The QUIET ASK side was rendering as a second push notification, so the
cross-channel attack ("two pings, different surfaces") didn't show.
Convert it to the email card kind and dress the header with a crimson
envelope glyph plus a From: label so the surface is unmistakable.
Scenario copy updated to call out 'phone push + email'.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Three OffSec biases were stacking up too inbox-shaped (attentional had half-email, availability was email+email). Convert availability to a new 'browser' card kind — faux Chrome chrome with URL bar, lookalike host, page heading + body + CTA. The crimson host on the flagged side calls out the deceptive subdomain stacking that real news-anchored phishing relies on. Surface diversity now: attentional = push + email, illusory = chat, availability = browser. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Behavioral guardrails for Claude Code agents working in this repo (think before coding, simplicity first, surgical changes, goal-driven execution). Sourced from multica-ai/andrej-karpathy-skills. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Screenshots Wolf pastes into the chat land here and trip the "unsaved" badge after every push. Local-only artefacts — keep them out of git entirely. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Manual fallback used when the live metrics endpoint is unreachable. Live count now also reports 142 after the host script picked up the recent CLAUDE.md trim. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
# Conflicts: # src/uxcore/components/OurProjectsModal/OurProjectsModal.module.scss # src/uxcore/components/ToolHeader/ToolHeader.module.scss
- Point CLAUDE.md at the global Wolf rules and MemPalace; drop the duplicated Karpathy block now that it lives globally. - Capture the May-25 staging-to-prod safety assessment and The Order's pipeline-correction response so future agents have the audit trail. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The KeepSimple project's lead pin was the only outlier showing a gold (human) diamond — every other project (terminal, multimove, agentsforge, elea, seogeosolved) renders its eng lead as an AI agent. Switch keepsimple to match: leadDiamond blue + dossier reshaped to mirror lead-terminal / lead-seogeosolved. The lead-keepsimple key already exists in the live metrics feed, so the dossier picks up its CLAUDE.md line count automatically. EN + RU kept in sync. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
KeepSimple has both an AI engineering lead (the agent owning this repo, counted in claudeMdLines) and a human engineering lead (custodian of the open-source wing). Previously the data model allowed only one lead per project, forcing a choice. Adds opt-in support for a second lead pin via `leadDiamond2` / `leadDeg2` / `leadR2` on a project, rendered as `lead2-<projectId>` with its own dossier. KeepSimple now exposes both; all other projects are unaffected. EN + RU in sync. The AI lead keeps the live claudeMdLines wiring (metrics key `lead-keepsimple`); the human lead has no CLAUDE.md, by design. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Without a static value, the claude.md line-count row only appears after the live metrics fetch resolves — leaving a perceptible flash where the AI lead's dossier shows no count. Seed 34 so the row renders instantly; the live metrics feed still overrides it whenever fresher. Mirrors lead-seogeosolved's existing static fallback pattern. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…er action Two changes so the Copilot stays fully dormant until the visitor opens the pill themselves: 1. Boot the panel closed every time. Previously the open state was restored from localStorage, so a visitor who had ever left the panel open would see it auto-pop on the next visit — even on a different page — with no fresh signal that the Copilot was acting. 2. Seed `lastFlashedTurnIdRef` with the latest restored turn id. The host-page highlight effect fires whenever the most recent turn has citations, which means rehydrated turns from a prior session were re-flashing UI elements on page load — visible to the visitor while the closed pill gave no hint where the highlight was coming from. Seeding the ref makes the effect skip the rehydrated last turn and only ever fire for turns the visitor produces in the current session. The persisted transcript is still loaded (and visible once the visitor opens the pill) — only the proactive side-effects are gated. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds a column that tells at-a-glance whether a session contains at least one user-typed message (event kind = "question") versus nav/dwell/card-click-only browsing noise. Computed in getServerSideProps via N parallel /events fetches, fine for the limit=100 dev viewer; a single-query aggregation on the events service would be cheaper for larger limits. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
@claude review this PR. |
|
Claude finished @MaryWylde's task in 3m 3s —— View job PR Review — feat/atlas-upd-28-mayReviewing PR #132 · 48 files · +2,763 / -195 · 5 feature commits on top of Tasks
SummarySolid, well-scoped set of threads. The widget dormancy fix is correct, the Atlas two-lead model wires cleanly, and the OffSec type system is well-structured. Two issues need attention before merge — one is a real (if silent) bug, and one is a file that should not be in the repo at all. Issues1. Stale prop on
|
… infra docs Remove dead toggleIsProductView prop from UXCoreModal (type field + call site) — it was unused inside the component. Also remove internal staging-to-prod assessment docs that should not live in the public repo. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Summary
Ships three threads on top of
feat/uxcore-cybersec:lead-keepsimplegets aclaudeMdLinesfallback seed so the dossier renders even when the metrics feed lags./admin/copilot-sessions—Typed?column. New column flags sessions that contain user-typed text vs cold opens, so the session monitor can separate signal from noise.May-28 commits (top of branch)
168f168feat(admin/copilot-sessions): addTyped?column for user-text sessions54558f8fix(widget): never auto-engage on page load — open + flash require user action305749echore(ai-atlas): seedlead-keepsimpleclaudeMdLinesfallbackc982b56feat(ai-atlas): support a second engineering lead per project2989f6afeat(ai-atlas): flip KeepSimple eng lead to AI agent (blue diamond)Rides on top of
feat/uxcore-cybersecThis branch was cut from
feat/uxcore-cybersec, so merging this PR also ships everything that branch carries on top ofdev:claude.mdrow, atlas header banner trimmed (drop "Welcome to" prefix).ThemeToggle,2026-05-25staging-to-prod notes, Karpathy 4-rules adopted inCLAUDE.md,/attachments/gitignored.Full list:
git log origin/dev..feat/atlas-upd-28-may(~41 commits, 48 files, +2,763 / -195).Test plan
lead-keepsimpledossier renders even ifmetrics.jsonlags (fallback seed kicks in)./admin/copilot-sessionsshows aTyped?column; sorts/filters work; existing columns unchanged.