Studio

Studio is Tarski’s visual inspection surface: a browser app where you inspect observations, facts, intents, effects, provenance, activity, worldviews, and cloud state without reading raw store files. The hosted Studio lives at https://app.tarski.run.

Studio renders the platform’s observation-first model — it is not a second source of truth. The browser keeps only interaction state (selected tab, focused row, open panel, draft forms). Semantic derivation, provenance traversal, action availability, mutation safety, query execution, and reconciliation are all backend-owned. Every mutation carries an idempotency key and expected-state preconditions, destructive actions are two-step confirmed, and a disabled action always shows a backend-supplied reason.

Signing in

Studio’s front door is a hard sign-in gate. An unauthenticated, expired, or revoked session renders only the gate — no sidebar, command palette, or data surfaces mount.

1. Enter your email address. Tarski sends a one-time sign-in code.
2. Enter the code. Session cookies are set server-side (HttpOnly; Secure; SameSite=Lax) — the app never stores durable bearer tokens in the browser.
3. The app boots into the shell. Sign-out genuinely revokes the server-side session.

Wrong, expired, replayed, or rate-limited codes return typed diagnostics. Deep links are retained in memory only and restored after sign-in, and signing in or out in one tab reconciles other open tabs.

Local development: tarski serve can mint a labeled fixture session for local Studio work — only when you explicitly set TARSKI_STUDIO_LOCAL_AUTH_FIXTURE=1. The session shows an amber “fixture session” pill, and production authorities refuse the fixture entirely. Without it, local boot shows guidance naming the fixture switch and tarski login.

The shell

• Sidebar — grouped navigation, collapsible to an icon rail (forced on small viewports); your collapse choice persists.
• Scope controls — organization (read-only) plus workspace, worldview, and environment selectors fed by backend catalogs. Scope switches are backend-confirmed: a blocking overlay locks the controls until the backend confirms, and only a confirmed response rewrites the URL scope.
• Command palette — Cmd/Ctrl+K merges “Go to…” navigation with the backend command catalog, including shortcut labels and disabled reasons.
• Inspector dock — a shell-level right dock; any row with inspector metadata opens it, and sections render in backend order.
• Status — a session-mode banner plus a runtime status pill that is green only for production_authoritative and amber otherwise.

Surfaces

Group	Surface	What it shows
Studio	Overview /	Summary cards, health, onboarding, create-from-template
Studio	Activity /activity	The semantic event feed — observations, candidates, facts, proposals, decisions, intents, effects, gates — with filters, saved views, session follow, and a causal timeline inspector
Studio	Agents /agents	Agent cards, dataflow topology, per-agent inspection, session catalog, and a chat panel whose composer is gated by backend authorization
Studio	Cloud /cloud	Hosted apps with readiness evidence, metrics, provider bindings (credential metadata, never values), usage, and the admission/verification tab
Studio	Ontology /ontology	Read-only relation catalog, admitted source text, and the rule dependency graph — the ontology is inspected here, never edited
Inspect	Observations, Facts, Intents, Effects, Events, Projections	The six semantic planes on one shared surface, so evidence and derived truth stay visually distinct; every row offers provenance handoffs
Inspect	Provenance /provenance	Seed-driven neighborhood exploration as a deterministic graph; the only client-side control is a labeled, presentation-only view depth
Inspect	Workviews /workviews	Workview and Work Queue read models; ambiguous queue rows render amber and hand off to Reconcile
Operate	Schedules /schedules	Schedule list, fire history, receipts, preview-before-create; manifest-declared schedules surface tarski.toml guidance instead of edit controls
Operate	Storage /storage	Usage, blob inventory, uploads, downloads, and strictly dry-run-gated reclamation
Operate	Commands /commands	The backend command catalog; replay, export, and GC run as preview-then-confirmed commits
Operate	Reconcile /reconcile	Ambiguous-effect and contradiction queues, each preview-then-confirm with receipts
Operate	Query /query	The query workbench — declared and ad-hoc runs, explain, saved queries, cross-door history, relation browsing, and access-audit reads
Operate	Settings, Account	Backend-validated settings, secrets metadata (values never rendered), identity, and confirmed sign-out

Observation authoring lives on the Observations plane: draft a JSON payload, preview the atoms the mapper would deterministically emit, then append via two-step confirm.

Design language and accessibility

Studio is built on the Tarski design system: deep blue ground, volt yellow as a strictly rationed accent (live dots, selection, focus rings, verified states), the ⊨ double-turnstile mark reserved for verified states, hairline surfaces without gradients, and IBM Plex Mono for every identifier, digest, count, and timestamp.

Light and dark themes are both first-class, with a compact density mode for data-heavy views — all persisted across visits. WCAG AA contrast is enforced, focus is always visible, and every route passes automated accessibility checks with zero serious or critical violations in both themes.