Guide reviewed runs and retained-raw date repair

Dockerfile

@@ -29,15 +29,16 @@ ARG TARGETARCH
 RUN XCADDY_SETCAP=0 CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
     xcaddy build v2.11.4 \
       --output /usr/bin/caddy \
+      --replace golang.org/x/crypto=golang.org/x/crypto@v0.55.0 \
       --replace golang.org/x/net=golang.org/x/net@v0.56.0 \
       --replace golang.org/x/text=golang.org/x/text@v0.39.0 \
-      --replace google.golang.org/grpc=google.golang.org/grpc@v1.82.1
+      --replace google.golang.org/grpc=google.golang.org/grpc@v1.83.2
 
 FROM scratch AS runner
 
 ARG SOURCE_REVISION=unrecorded
 ARG SOURCE_CREATED=1970-01-01T00:00:00Z
-ARG DRUFF_VERSION=0.1.0
+ARG DRUFF_VERSION=0.2.0-rc.1
 
 LABEL org.opencontainers.image.title="Druff"
 LABEL org.opencontainers.image.description="Static, provider-neutral Dander control-plane interface"

HANDOFF.md

@@ -2,34 +2,40 @@
 
 ## Finished
 
-- Merged current-Dander compatibility in PR #23 and passed exact-main CI at `34acec00dfc9aafe93a62b1e3ed2b1b807a66487`.
-- Exercised Druff's production clients against protected Dander RC32 at `33801213ee8c1bab78b8847a4b86bd9b4b8d1c63`.
-- Built and retained exact active and rollback multi-platform OCI artifacts with SBOM and provenance attestations.
-- Verified both artifacts are source-free, non-root, read-only, route-complete, and clean under the protected Trivy policy.
+- Added a hosted Choose → Configure → Review → Run → Results journey with one primary action and existing technical controls under advanced details.
+- Bound unsaved change previews to the draft, graph address and revision; running requires the reviewed content hash to match the saved graph.
+- Added recorded outcome explanations, missing-measurement handling and explicit retained-raw date repair with date/revision invalidation and safe retry keys.
+- Preserved loopback editing, OIDC/capability gates, graph conflicts, logs, cancellation and replay; corrected the existing font variable and toolbar overflow.
+- Documented the experimental repair boundary and added a read-only production-client observation test for an already-completed native repair.
 
 ## Try It
 
-Resolve the retained artifacts with `oras resolve --oci-layout /Users/harrison/.codex/artifacts/druff/2026-08-24-release/druff-active-34acec00dfc9.oci.tar:active` or the matching `druff-rollback-55f1565f3cb8.oci.tar:rollback`. For Control API acceptance, start current Dander and run `DANDER_CONTROL_URL=http://127.0.0.1:8770 DANDER_EXPECTED_VERSION=0.9.0rc32 pnpm test:current-dander`.
+In hosted mode, browse a graph, edit its source/output configuration, choose **Preview changes**, then **Save reviewed changes** and **Run reviewed graph**. Expand **Repair selected output dates** for an eligible saved graph. Existing operator configuration still supplies connections and deployed environments.
+
+For real HTTP contract checks, start an ephemeral Dander Control API and use `DANDER_CONTROL_URL=... DANDER_EXPECTED_VERSION=... pnpm test:current-dander`. For an accepted native repair, use the explicit project, graph and run ID variables documented in README with `pnpm test:repair-observation`.
 
 ## Checks
 
-- PR #23 and exact-main run `32787930579` passed Frontend quality, Source-free container, and Secret scan.
-- Current-Dander acceptance, contract/artifact checks, lint, types, format, 669 unit tests, and 11 Playwright journeys passed.
-- Both exact artifacts passed reproducible-layer, promotion, archive, amd64/arm64 runtime/export, and Trivy 0.70.0 HIGH/CRITICAL plus secret checks with zero findings.
+- Passed 685 unit/component tests, nine artifact checks, TypeScript, ESLint, Prettier and static build against the verified published RC33 wheel; independent contract regeneration reports no drift.
+- Passed all 11 Playwright journeys, including reviewed save/run, date invalidation, repair submission and existing conflict/retry behavior. Browser OIDC/API responses are synthetic.
+- Passed real HTTP acceptance against published RC34 Control: exact hashes, canvas round trip, unsaved preview/save, stale rejection and truthful unsupported execution. Final RC34 regeneration/drift, 29 contract tests, 18 journey/API tests, TypeScript and focused lint passed; its bundle is unchanged.
+- Visually inspected the synthetic browser screenshot; font and horizontal overflow defects are corrected. A focused test also confirms late explanations cannot replace newer run status.
+- PR #25 initially found three fixed high Caddy dependency findings. Pinned x/crypto 0.55.0 and gRPC 1.83.2; CI `36870826744` passed both architecture scans, reproducibility, runtime checks and frontend/secret checks.
 
 ## Decisions
 
-- Active is merge commit `34acec00dfc9`; rollback is green PR head `55f1565f3cb8`; both share tree `ce829147ef3b`.
-- Retain the public RC19 contract pin because protected RC32's bundle is byte-identical.
-- Keep the release artifacts as local OCI archives; public registry publication remains a separate external action.
+- Dander remains the only semantic/execution authority; no provider client or new auth infrastructure was added.
+- Missing result documents display Unknown instead of interpreting default counters as measured zeros.
+- Date repair rebuilds output partitions from retained raw data; it is explicitly experimental and does not recover historical source records.
 
 ## Remaining
 
-- No Druff implementation or release-readiness gap remains.
-- Publish or deploy the retained artifact only when a destination is explicitly approved.
+- Candidate version is `0.2.0-rc.1`, paired with published RC34 Control and the unchanged contract digest in README. This does not promote the RC20 public beta.
+- Observe the separately authorized native repair once its accepted run ID is available; no provider workload was launched by Druff tests.
+- Complete protected PR #25, exact-main checks and candidate image publication with the final RC34 pin.
 
 ## Review First
 
-- `tickets/DRUFF-31-current-dander-release-acceptance.md`
-- `integration/current-dander-control.test.ts`
-- `/Users/harrison/.codex/artifacts/druff/2026-08-24-release/records`
+- `src/features/hosted-control/useGraphChangePreview.ts` and `DateRepairPanel.tsx`
+- `src/features/hosted-control/control-api.ts` and `integration/`
+- `tickets/DRUFF-32-guided-pipeline-journey.md`

README.md

@@ -4,13 +4,15 @@ Front-end companion to **[Dander](https://github.com/harrisonoconnorhover/dander
 editor for Dander's canonical
 `PipelineGraph` files (drag/drop nodes, wire connections, configure sources/transforms/writes).
 
-Druff opens and saves one graph file through Dander's localhost API. Dander owns parsing,
-validation, conflict detection, and atomic filesystem writes. When the operator binds that graph
-to one manifest pipeline, Druff can also validate it, manually run its already-deployed Cloud Run
-job, and show compact execution/run-ledger status. A version-1 `dander.yaml` can still be imported
-as a detached, one-way visualization. When Dander explicitly enables it with complete operator
-inputs, Druff can also request a source-free candidate and display its non-applyable Terraform
-plan; Druff never writes the manifest or applies infrastructure.
+Druff connects to Dander's hosted Control API or its single-file localhost API. Hosted users sign
+in, choose a graph, configure it on the canvas, review unsaved changes, save, run and inspect the
+recorded outcome. Dander owns parsing, validation, revision conflicts, storage and execution.
+
+In localhost mode, an operator can bind the open graph to one manifest pipeline to validate it,
+run its already-deployed Cloud Run job and inspect the run ledger. A version-1 `dander.yaml` can
+still be imported as a detached, one-way visualization. When Dander explicitly enables it with
+complete operator inputs, Druff can also request a source-free candidate and display its
+non-applyable Terraform plan; Druff never writes the manifest or applies infrastructure.
 
 When that manifest pins installed connector plugins, Druff discovers their presentation-safe
 descriptors from Dander and adds them to the palette dynamically. The first dynamic connector is
@@ -31,7 +33,7 @@ read-only instead of being rewritten.
 See `CLAUDE.md` and `steering/00-project-overview.md` for the full picture (why this exists, the
 module map, decision log). The accepted documentation-only Druff 1.0 architecture checkpoint is
 in `steering/03-control-plane-roadmap.md`. Druff's DTOs now come from Dander's published contract
-bundle; hosted graph storage, identity, and run APIs remain later phases.
+bundle; hosted graph storage, identity, and run controls are implemented by the static client.
 
 ## Stack
 
@@ -57,11 +59,13 @@ pnpm install
 pnpm dev              # http://localhost:3000
 ```
 
-Contract output is generated only from the pinned public
-`dander-platform==0.9.0rc19` wheel on PyPI. The generator verifies the wheel, manifest, every file,
-and the whole bundle before writing output; it never reads a sibling Dander checkout. Current
-protected Dander RC32 retains the exact same `io.dander.control.contracts/v1` bundle bytes, so the
-published pin remains the authority instead of being relabeled from an unpublished checkout.
+Contract output is generated only from the pinned
+[`dander-platform==0.9.0rc34` GitHub integration-candidate wheel](https://github.com/harrisonoconnorhover/dander/releases/download/v0.9.0rc34/dander_platform-0.9.0rc34-py3-none-any.whl),
+SHA-256 `d37c1d91c15cca9ce3d080af6dec384f7cd9cbc521dea253e10dc44772d35bad`.
+The generator verifies the wheel, manifest, every file, and the whole bundle before writing output;
+it never reads a sibling Dander checkout. This client requires the matching RC34 bundle. The
+GitHub integration candidate does not promote Dander's public PyPI RC20 beta or qualify additional
+provider profiles.
 
 ```bash
 pnpm contracts:check     # re-generate in a temporary directory and fail on committed drift
@@ -72,12 +76,12 @@ Release acceptance can additionally exercise Druff's production graph and operat
 against a locally running current Dander Control API:
 
 ```bash
-# In the protected Dander checkout:
-uv run dander control serve --ephemeral --project demo-project --port 8770
+# In an environment installed from the pinned RC34 wheel above (not the RC20 PyPI beta):
+dander control serve --ephemeral --project demo-project --port 8770
 
 # In Druff:
 DANDER_CONTROL_URL=http://127.0.0.1:8770 \
-DANDER_EXPECTED_VERSION=0.9.0rc32 \
+DANDER_EXPECTED_VERSION=0.9.0rc34 \
 pnpm test:current-dander
 ```
 
@@ -133,6 +137,45 @@ cancel, and replay APIs. Dander remains authoritative for authorization and sema
 discards stale or mismatched responses and never receives provider credentials or native payloads.
 When `/bootstrap.json` is absent, the existing local-loopback workspace remains unchanged.
 
+The hosted workspace guides one saved graph through **Choose → Configure → Review → Run → Results**:
+
+1. Browse a project and open a graph, or create a graph from the current canvas draft. Configure
+   source and output nodes in the existing inspector. Connections and deployed environments still
+   belong to Dander's operator configuration.
+2. Choose **Preview changes** to compare the unsaved draft with its saved revision. The review
+   lists changed nodes and connections, downstream outputs, and the write behavior of every
+   output a full run will write. This comparison does not query rows or estimate a bill.
+3. Choose **Save reviewed changes**, then **Run reviewed graph**. Edits invalidate the review;
+   Dander checks the saved revision again before accepting execution. Saving alone does not run.
+4. Read the recorded outcome and suggested next action. Missing result measurements stay
+   **Unknown**, including server-default counters before a result document exists. Advanced
+   validation, deployment preview, logs, cancellation and replay remain available.
+5. Expand **Repair selected output dates** to preview a saved graph's half-open UTC date window
+   (first date included, end date excluded). A compatible environment can rebuild those output
+   partitions from retained raw warehouse data. This does not fetch historical source records or
+   move normal ingestion progress. Dander determines eligibility and publishes the selected
+   ranges atomically; unsupported graphs/environments return an explicit explanation.
+
+Date repair is an experimental producer capability until its stated qualification gates are met.
+A generated client and its Dander deployment must use the same published contract bundle. Browser
+journey tests use synthetic HTTP/OIDC fixtures; they do not establish live provider success.
+
+To inspect an already-completed operator-owned native repair through Druff's real HTTP client,
+without starting another workload:
+
+```bash
+DANDER_CONTROL_URL=http://127.0.0.1:8876 \
+DANDER_REPAIR_PROJECT=repair-proof-rc34 \
+DANDER_REPAIR_GRAPH=repair-corrections \
+DANDER_REPAIR_RUN_ID=REPLACE_WITH_ACCEPTED_RUN_ID \
+pnpm test:repair-observation
+```
+
+This observation verifies the exact contract, saved graph, repair preview, status and explanation
+for the September 10–12 synthetic fixture, including zero extracted rows, two output rows written
+and four output rows affected.
+The operator's separate provider evidence must establish warehouse results, watermarks and cleanup.
+
 To enable the narrow operational controls for one graph that is already deployed, start Dander
 with its matching manifest pipeline and GCP project: