Isis governed-generation workbenches — design

Status: current-state record, generated. Not ratified — see §12.

This document answers I0.13 of V1_DOMAIN_WORKBENCHES_TODOS_2026-07-23.md. Its first child fixes the standard for all eleven sections: the current state must be code-derived. So every number and every list below is read out of a committed artifact under evidence/v1-workbenches when this file is generated, and §13 lists every one of those reads. A design document rots and a measurement does not: this one is checked byte-for-byte in CI, so a route that appears, a package that is retired or a gate that starts passing makes it stale loudly rather than quietly wrong.

Where a section's subject is a decision nobody has taken, it says so and names the cell that owns the decision. The document does not manufacture an authority it does not have.

1. Current state (I0.13.a)#

Source: evidence/v1-workbenches/isis-package-inventory.json, evidence/v1-workbenches/isis-page-inventory.json, evidence/v1-workbenches/isis-persistence-inventory.json, evidence/v1-workbenches/isis-route-register.json.

Isis is 77 packages, 26 operator SPA pages and 24 declared persistence aggregates. It is not one page and it is not one service, which is why every section below is keyed by audience and host rather than by feature.

1.1 Packages and their disposition#

29 packages have no consumer at all: @isis/3d-comfyui-nodes, @isis/3d-control, @isis/3d-scene-assembly, @isis/3d-semantic-editing, @isis/3d-video-diffusion … (24 more). 2 have no test: @isis/anomaly-detection, @isis/comfyui-sdk. A package with no consumer is not a reuse candidate however good its code is, so the disposition column and the consumer column are kept separate.

1.2 Pages, and the ones no route reaches#

24 of 26 pages are routed. The unrouted ones are JobSubmissionStudio, WorkflowControlBlendPanel — built, tested, and unreachable. evidence/v1-workbenches/isis-page-walkthrough.json then asks the harder question, whether a routed page's API calls are served: of 127 distinct operations, 92 are built and unserved, and only 1 of 4 client namespaces reaches the service it was written for. AN ENDPOINT THAT EXISTS AND ONE THAT ARRIVES ARE DIFFERENT CLAIMS.

1.3 Live, fixture, or dead#

Page behaviour, measured by driving the surfaces rather than by reading them:

• live: 9 pages
• not-configured: 15 pages
• partial: 2 pages

Fixture mechanisms found: 0. No surface here stands in a fixture for missing data; where a surface has none it returns a not-configured contract, which is the honest form and is counted as such above.

1.4 Contracts, jobs and providers#

Contract paths: generation, models, outputs, workflows. 30 AI providers are implemented, across 9 provider kinds (anthropic, openai, google, xai, ollama, elevenlabs, runcomfy, civitai, runpod). Endpoint modules: dead-letter, health-monitor, queue-metrics, registry, router, with 16 operator UI components over them.

The workflow job machine has 4 states (DRAFT, PUBLISHED, DEPRECATED, ARCHIVED) and 8 implemented transitions: create, edit, activate, deprecate, archive, restore, version, publish. Transitions intended and not implemented: submit, review, approve, revoke.

An endpoint's implemented lifecycle dimension is health, with 4 states (healthy, degraded, unhealthy, unknown). This matters for §6: the dispatch model derived in I1.3.b–e names a richer lifecycle including disabled (unconfigured, configured, validating, ready, draining, maintenance, disabled, retired), and no enum in source implements it — the only endpoint states the code has are the four health states above. A PROPOSED LIFECYCLE IS NOT A CONTROL: a reader who takes disabled from the model would conclude that an operator can disable a provider, and §6 records that nobody can.

2. Audience (I0.13.b)#

Source: evidence/v1-workbenches/isis-audience-capability-matrix.json, evidence/v1-workbenches/isis-tier-decision-rows.json, evidence/v1-workbenches/isis-curated-payload-leak.json.

Four audiences: operator-admin, aaa-creator, curated-creator, contemplative. The boundary between them is the product, not a convenience: an operator may see a raw graph and a curated creator may not.

6 distinct audience alphabets exist in the estate and 2 of them cannot name every audience. An alphabet that cannot say contemplative cannot deny it either, so a capability expressed in that alphabet has a hole where the narrowest audience should be.

The capability matrix is 42 capabilities × 4 audiences = 168 cells, with no blank cell (noBlankCells: true):

• allow: 96 cells
• deny: 68 cells
• not-expressible: 4 cells

not-expressible is a separate verdict from deny on purpose. 4 cells are cases where the alphabet in force cannot state the audience, which is not the same as stating that it is refused.

2.1 Enforcement layers#

3 layers are declared, and 1 has no producer: route. A declared layer with nothing writing into it enforces nothing.

Operator endpoint scopes: admin:*, admin:studio, admin:workspace:isis, admitted by the rule scope === 'admin:*' || scope.startsWith('admin:'). 22 scopes were probed against it and 2 were elevated and still refused — so the rule is not a rubber stamp.

1 contradiction remains in the matrix. A contradiction names a pair of sources that disagree; it does not name a culprit, and resolving it is a decision (see §12).

3. Hosts and routes (I0.13.c)#

Source: evidence/v1-workbenches/isis-route-register.json, evidence/v1-workbenches/isis-route-dispositions.json, evidence/v1-workbenches/isis-operator-surface-matrix.json.

Isis has four hosts, and they are not interchangeable:

• Operator SPA (apps/isis/web): 27 routes.
• Oshun admin (apps/oshun/admin): 9 Isis routes, 9 of them guarded by the workspace scope.
• Oshun Studio (apps/oshun/web): 88 Isis-segment routes.
• BFF operator API (apps/oshun/bff/src/isis): 77 modules.

3.1 The Studio boundary#

The boundary authority is libs/isis/entitlements/src/studio-boundary.ts. Its allowlist is empty (allowListEmpty: true), and every one of the 88 Studio Isis routes is therefore blocked (studioIsisAllBlocked: true). AN EMPTY ALPHABET MEANS WHATEVER THE FIELD IT FEEDS MEANS: here it means "deny all", which is the safe reading, and it also means the allowlist has never been exercised.

Of the 87 blocked segments, 56 are undocumented — blocked by an allowlist that names nothing and described by no cell: account-protection, ai-video, ai-video-generation, analytics-and-reporting, anomaly-detection, artifact-detection, automated-quality-scoring, benchmarking … (48 more). 31 AAA segments are documented.

3.2 Operator surface coverage#

14 operator families are declared. Measured against them:

• Families whose every verdict is not-configured: I0.18.a, I0.18.b, I0.18.c, I0.18.e, I0.18.f, I0.18.g.
• Families with no operator page: I0.18.h, I0.18.i, I0.18.j, I0.18.l, I0.18.m.
• Families with no operator API: I0.18.e, I0.18.f, I0.18.h.
• BFF modules claimed by no family: 48 of 77.
• Operator SPA routes claimed by no family: 8.

0 rows carry a page, an API and a verdict together. A page with no API and an API with no page are different failures and neither is a working surface.

4. Data contracts, stores and retention (I0.13.d)#

Source: evidence/v1-workbenches/isis-asset-kind-registry.json, evidence/v1-workbenches/isis-schema-gap.json, evidence/v1-workbenches/isis-data-classification-matrix.json, evidence/v1-workbenches/isis-output-format-matrix.json.

4.1 Asset kinds: seventeen enums and no taxonomy#

11 asset kinds are named by the product requirements and 0 have a registry row. 17 asset-kind enums exist in the estate and 1 is on the Isis surface; there is no registry module at all. The best overlap any single enum achieves with the required kinds is 6 of 11. A NAME IS NOT THE THING IT NAMES: seventeen enumerations of asset kinds do not constitute a taxonomy, because none of them is authoritative for the others.

Kinds with no product contract: image, portrait, texture, video, audio, foley, voice, mesh, rig, gaussian splat, composite scenes. Asset families declaring a kind: 0 of 32.

4.2 Stores#

24 aggregates are declared in libs/isis/database/prisma/schema.prisma. There are, however, two schema authorities: that Prisma schema, and the raw SQL the deployed apps/isis/output-registry service issues at start-up. They resolve the same connection string and they do not agree on table names. §8.3 records what that costs.

Contract-to-column gaps, from the schema-gap sweep: 14 contracts and 131 fields checked; record types blocked on a missing tenancy column: gate-verdict, release, run, stage.

4.3 Retention and classification#

7 data classes are named by the product requirements. 1 has no row in the canonical artifact register (I0.11.b) and 4 have only part of one (I0.11.a, I0.11.c, I0.11.d, I0.11.f). The Isis schema declares 0 classification columns and 0 modules on the Isis path name a data-classification vocabulary, while the estate declares 6 classification alphabets elsewhere. Every one of those is a ladder of sensitivity values; A SENSITIVITY LEVEL IS AN ANSWER AND THIS DOMAIN HAS NOT ASKED THE QUESTION.

Of 98 lifecycle cells (class × attribute), 30 are defined, 14 cannot be started because the class has no register row at all, and 54 name an attribute the register has no field for.

4.4 Output and interchange formats#

19 formats are declared; 17 use the shared artifact manifest, and 0 carry all ten required columns. Columns carried by no format at all: quality, downstreamIngest, authorizedHost. Formats with no registry symbol: I0.19.o.

5. Services, APIs and contracts (I0.13.e)#

Source: evidence/v1-workbenches/isis-read-contracts.json, evidence/v1-workbenches/isis-endpoint-dispatch-model.json, evidence/v1-workbenches/isis-mutation-envelope.json, evidence/v1-workbenches/isis-read-authorization.json.

5.1 Read contracts#

Route dispositions across the swept globs:

• not-configured: 8 routes
• other: 21 routes
• reads-store: 63 routes
• static-context: 42 routes

47 contract dimensions are absent. Every cell is classified and every dimension states its own duty (everyCellIsClassified: true, everyDimensionStatesItsDuty: true), so an absent dimension is a measured absence rather than an unexamined one.

Some dimensions are not derivable from source and say so rather than guessing: pagination determinism, authorization behaviour, handler bodies past the next route registration.

5.2 Query shapes and indexes#

evidence/v1-workbenches/isis-workload-catalog.json derives the query workload from source. Every query has a shape and names a table (everyQueryHasAShape: true). Deep-page-risk queries: 1. Unindexed filter hotspots: 8 tables; unindexed sort hotspots: 1. Cardinalities are not derivable from source and are recorded as such, not estimated.

6. Jobs, operations and emergency controls (I0.13.f)#

Source: evidence/v1-workbenches/isis-workflow-state-machine.json, evidence/v1-workbenches/isis-replay-execution.json, evidence/v1-workbenches/isis-emergency-controls.json.

6.1 Emergency controls#

A CONTROL IS A VERB, and the five required controls differ not in how complete each is but in what kind of thing each is:

1 of 5 is an operator command (output recall); 3 are absent (provider disable, workflow revoke, model quarantine). Of 33 scope dimensions the requirements name, 2 are expressible, and 18 cannot be measured at all because the control they would scope does not exist.

Two consequences are worth stating plainly because they are easy to misread as partial implementations rather than as different things:

• The spend kill switch is not a switch. Its evaluator returns an armed status and no field that could stop anything, and the curated-card flag is a frozen literal — assigning to it raises Cannot assign to read only property. A SWITCH THAT ONLY A DEPLOY CAN THROW IS NOT AN EMERGENCY CONTROL. The enforcement gate is correct and denies when the flag is set, so the gap is the switch and not the gate.
• Provider disable is an automatic breaker. It trips on consecutive failures, in process, with no operator trigger and no authority. AN AUTOMATIC BREAKER ANSWERS "IS IT FAILING" AND AN EMERGENCY CONTROL ANSWERS "STOP USING IT": a provider that is healthy and unsafe passes it.

Output recall, the one real command, cannot cascade: takedownCascade: 'unavailable', and the output record carries no lineage field, so a dependent derivative is not merely unreached — it is unexpressible on the shape.

Two of the three absent controls are corroborated by artifacts that were not looking for them, which is the strongest form the evidence takes here. The workflow job machine's unimplemented transitions are submit, review, approve, revoke — revoke among them, measured independently of §6. And the endpoint dispatch model names a disabled state that no source enum implements (§1.4), so the one place disabled appears is a proposal.

A reverse dependency index exists (evidence/v1-workbenches/blast-radius.json) and 0 controls consult it. No game-day artifact rehearses any of the five (controlsWithARehearsal: 0).

7. Workspace and UI (I0.13.g)#

Source: evidence/v1-workbenches/isis-page-inventory.json, evidence/v1-workbenches/isis-comparison-nonvisual.json, evidence/v1-workbenches/isis-continuity-presentation.json.

The operator SPA is 26 pages; 20 use the Isis client and 15 use React Query. Roles:

• apiParityMonitor: 1
• auditLogs: 1
• dashboard: 1
• featureFlags: 1
• jobs: 2
• models: 3
• outputs: 5
• providers: 1
• public: 2
• runpod: 2
• unrouted: 2
• workflows: 5

Pages with no test: LoginPage, NotFoundPage, UnauthorizedPage, WorkflowControlBlendPanel, WorkflowsPage.

Non-visual alternatives are a product requirement for this domain, not an afterthought: an output that can only be judged by looking at it cannot be reviewed by everyone who has to review it. evidence/v1-workbenches/isis-comparison-nonvisual.json records what the comparison surfaces offer.

8. Trust: threats, safety, rights and provenance (I0.13.h)#

Source: evidence/v1-workbenches/isis-threat-mitigation-map.json, evidence/v1-workbenches/isis-data-classification-matrix.json, evidence/v1-workbenches/isis-provenance-recovery.json, evidence/v1-workbenches/isis-gate-lineage-plans.json.

8.1 Threat model#

10 threats are modelled. 9 have a control on the Isis path (brief injection, workflow injection, malicious graphs, model supply chain, unsafe media … (4 more)); 1 is controlled only in another domain (training rights), which means the estate has the control and this path does not call it; and 0 are mapped to a test id, against a stated bar of "mitigations map to test IDs". 0 artifacts anywhere map a threat to a test. A CONTROL, A TEST, AND A MAPPING FAIL SEPARATELY, so "no unmapped high-risk scenario" is currently unevaluable rather than satisfied.

8.2 Data classification#

See §4.3. The short form: the schema has no classification column, no module on this path names a classification vocabulary, and six of seven data classes have no complete row in the canonical register.

8.3 The subject-erasure path addresses a table nothing produces#

This is the sharpest live defect in the current state, and it is a defect rather than an open decision. The account-deletion fan-out erases generated_outputs through the Isis Prisma client. Of the 24 models the schema declares, 6 have a producer among that client's consumers, and all of them are the pipeline_state_* family. The deployed output-registry writes its own raw-SQL tables on the same connection string, and the eraser and the service share 0 tables. A zero-row erasure is indistinguishable from a subject who owned nothing, so the fan-out signs success. apps/oshun/bff/src/isis/output-lineage-store.ts already records the same boundary — "No production generation path writes those normalized tables" — so the estate contains its own answer and the erasure path did not read it.

Fixing it means either repointing a GDPR deletion path or re-plumbing a deployed service's storage. Both have blast radius across a signed-attestation contract, so it is recorded here and pinned by a ratchet test rather than changed silently.

9. Migration and rollout (I0.13.i)#

Source: evidence/v1-workbenches/isis-route-dispositions.json, evidence/v1-workbenches/isis-shared-package-gate.json, evidence/v1-workbenches/isis-promotion-transfer.json, evidence/v1-workbenches/isis-release-binding-probe.json.

Migration here is mostly disposition: which of the four hosts owns a surface, and what happens to the copies. The route dispositions artifact carries that assignment, and the package inventory carries the library half — 29 retire candidates and 4 refactor candidates.

Two constraints bind every rollout step and both are measured elsewhere in this document: no Studio Isis route is reachable while the boundary allowlist is empty (§3.1), and the operator API is only arriving for one of four client namespaces (§1.2). A rollout plan that assumes either is already solved will report progress it has not made.

The rollout cohorts, SLOs, support model and DR posture that I0.13.i also asks for are decisions, not measurements. They are listed as open in §12 rather than drafted here.

10. Standards and environment (I0.13.i, continued)#

Environment and standards conformance is measured outside this domain’s artifacts and is referenced rather than restated: see evidence/v1-workbenches/isis-shared-package-gate.json for the shared-vs-domain boundary and evidence/v1-workbenches/isis-index-rationale.json for the barrel policy.

11. Verification posture#

1173 test files cover 77 packages and 20505 public symbols. That ratio is not a quality claim: §1.1 lists the packages with no test at all, and §1.2 lists the pages and operations that are built and unreachable. A test suite measures what it was pointed at.

12. Decision appendix (I0.13.j)#

Source: V1_DOMAIN_WORKBENCHES_TODOS_2026-07-23.md.

Every Phase I cell whose own evidence bar names a decision, an approval or a ratification is listed below. All 29 are open: the cell is unchecked, so by construction no decision has been recorded. The options and consequences a decision record needs are held in the evidence artifacts this document cites; the approver and the review are empty, and a generator cannot fill them in. Recording an approver that does not exist is the exact failure this lane was built to catch, so the column is left blank rather than defaulted.

The blocker split is part of the record and not decoration. "decision appendix", "decision tests" and "threshold decision record" all contain the word decision and none of them is a decision anybody has to take — they are engineering work that happens to be about decisions. Mixing the two would make this table useless for the one thing it is for: knowing what is waiting on a person.

The rule is stated so it can be audited rather than trusted. Three signals: (1) the instruction's leading verb asks somebody to give something (Obtain, Ratify); (2) the bar names an authorization as its deliverable (approval, signoff, ratification, or a trailing "decision"); (3) the bar names an artifact (test, schema, matrix, ledger, record, policy, contract). Then human-approval = (1 or 2) and not 3; engineering-artifact = 3 and neither 1 nor 2; both = everything else. Boundary cases land in both, which is the safe direction: it says a person is probably needed and does not claim to know that engineering is finished.

12.1 Waiting on a named person (14)#

12.2 Waiting on a person AND on engineering work (10)#

12.3 Engineering work about decisions, not a decision (5)#

13. Source ledger and consistency checks (I0.13.k)#

This document makes 123 distinct measured claims drawn from 19 evidence artifacts. Every claim is a dotted-path read that throws when the path is absent, so a field that moves breaks the build instead of interpolating undefined into a design document. Every repo path cited above is checked to exist. The whole file is compared byte-for-byte in pnpm verify:inventory:v1-workbenches.

13.1 Coverage against each child, and what is still missing#

Each of I0.13.a–k names a list of subjects. The table below says which sections answer it and what the child asks for that this document does not contain. The "missing" column is a judgment, stated here so it can be argued with; it is the reason every I0.13 cell is still unchecked, and it is the list a later pass has to close.

13.2 What is checked, and what is not#

Checked mechanically: every artifact exists; every cited path inside it resolves; every repo path cited exists; the generated bytes match the committed bytes.

Not checked, and not claimable: I0.13.k also asks to "obtain named reviews, resolve every comment, and ratify exact document revision". No generator can obtain a review. This document is therefore unratified, and Phase I stands at 758 of 1583 cells checked. The absence of a ratification is stated here so that the presence of a thorough current-state section is not mistaken for approval of it.