Journey result: Editorial review and approval

Walked: 2026-05-29 by Claude against commit bf12b0f7d8; that pass verified the then-current access gate and operator queue surface.
Reconciled: 2026-07-18 against the current journey, Studio fixture, decision component, release-stream BFF, audit store, and focused browser suites. This was a source reconciliation, not a fresh runtime walk.
Verdict: partial — deep automation proves the current fixture-backed review workspace and real audited approve/request-changes release-stream seam. It does not prove author submission, live queue ingestion, automated pre-review, artifact-specific rejection, final publication, provenance emission, author delivery, or customer readback.
Primary specs: operator-studio-surface.spec.ts, editorial-release-streams.spec.ts, and operator-editorial-review-approval.spec.ts.

Result at a glance#

Evidence lane	Current result	Authority limit
Review queue and artifact	Seven-row fixture queue, fixed `TR-047` detail, waveform, transcript, notes, citations, and gate	No author submission, live ingestion, or selectable artifact data
Approve decision	Creates a real `hotfix` release stream and patches it from `pending` to `in_progress`	Does not publish at 06:00 or create a customer edition
Request changes	Requires a 20-character rationale and records a blocked stream with the rationale	Does not notify the author or attach to an editable draft
Audit and validation	Scope, invalid-blocker, terminal-transition, BFF-failure, and audit-readback branches are covered	Artifact-level idempotency and concurrency remain open
Reject/retract	Adjacent `/operator/admin` decision panel records audited reject/retract decisions	Not the `TR-047` editorial lifecycle
Publish and provenance	Not implemented by this seam	No final gates, edition write, Isis bundle, or customer readback

Evidence map#

The visible label contains the word “publish,” but the current write stops at an in-progress release stream. The diagram keeps the fixture, durable seam, and missing customer-release leg separate.

flowchart LR A[Author submission] -. not connected .-> B[Seven-row fixture queue] B --> C[Fixed TR-047 workspace] C --> D{Operator decision} D -->|approve| E[Create hotfix stream] E --> F[Patch to in_progress] D -->|request changes| G[Create hotfix stream] G --> H[Patch to blocked with rationale] F --> I[Audit receipt] H --> I J[Adjacent admin reject] -. different artifact seam .-> I I -. no final gate .-> K[Published customer edition and Isis provenance]

Proven observations#

Current review workspace#

/operator/studio is protected by the operator gate and renders the Lilith Studio / Editorial context, seven fixture rows, one selected Tara artifact, transcript and deterministic waveform, four seeded notes, and three seeded citation rows.
Citation statuses are visible in text rather than color alone. The focused suite also pins 44 px row sizing, the decision entry point, mobile behavior, and anonymous redirect.
Queue rows are currently non-interactive orientation rows. Selecting another row does not load a different artifact, note set, citation set, or decision target.

Real release-stream decisions#

The approve branch creates a hotfix stream for TR-047, then patches the stream from pending to in_progress. The UI shows the returned stream id and state and restores its visible receipt from localStorage after reload.
The request-changes branch reveals a rationale field, blocks fewer than 20 trimmed characters, then records a stream as blocked with blocker other and the supplied rationale.
The BFF rejects missing editorial scope, blocked-without-blocker mutations, and post-terminal reopening without mutating canonical state or fabricating audit rows. UI network failures remain explicit and do not invent a receipt.
Created and transition audit events are read back from the real audit route. These receipts prove release-stream state, not final content publication.

Adjacent decision evidence#

/operator/admin has a separate decision panel with rationale validation, reject/retract writes, readback, and reopen behavior. That is useful shared operator infrastructure.
The adjacent panel does not reject TR-047 and cannot close the missing artifact-specific policy, appeal, and queue-state path.

Boundaries and gaps#

Fixture review is not live editorial ingestion. The queue, selected artifact, automated note, citations, waveform, and transcript are seeded. There is no author-side submit endpoint feeding this workspace.
Approve is not publish. “Approve · publish 06:00” creates an in-progress hotfix stream. It does not schedule or perform a 06:00 release, rerun policy gates, write a customer edition, or verify customer visibility.
A local receipt is not server rehydration. The release stream is real, but the component restores its visible receipt from localStorage instead of fetching the stream on mount.
Reopen is only a view reset. It does not cancel or reverse the already- created BFF stream.
Request changes stops before collaboration. No author notification, editable-draft link, assignment, due date, or resubmission path is driven.
Adjacent reject is not artifact reject. The admin-inbox panel uses a different decision substrate and must not be described as rejecting the Studio artifact.
Publication proof is absent. There is no final rights/citation/policy check, customer-surface write, Isis provenance bundle, cross-surface readback, or linked end-to-end audit chain.
Concurrency is undefined. Local reopen can permit multiple streams; artifact-level idempotency, stale reviewer state, and double approval are not closed.

Re-run evidence#

The current focused suite can be run serially with:

bash

PW_BROWSER_CHANNEL=chrome pnpm exec playwright test \
  -c apps/oshun/web/playwright.config.ts \
  apps/oshun/web/e2e/operator-studio-surface.spec.ts \
  apps/oshun/web/e2e/editorial-release-streams.spec.ts \
  apps/oshun/web/e2e/operator-editorial-review-approval.spec.ts \
  --workers=1

It requires the real-development-infrastructure web/BFF harness. A green run proves the workspace presentation and audited release-stream decision seam; it must not be summarized as a complete submit-to-publish journey.

Source trail#

Cross-references#

Open questions#

What author-scoped submit contract creates the durable artifact identity and feeds a live, selectable operator queue?
Should the current approve button be relabeled until scheduling/publication exists, and must approval collect an explicit reviewer rationale?
Which automated Lilith/Sophia evidence, policy versions, reviewer roles, and second-opinion rules become part of the durable review record?
How will artifact-specific reject, appeal, resubmission, and author delivery connect to the same lifecycle rather than the adjacent admin panel?
What final gate atomically binds release authorization, customer edition, Isis bundle, audit chain, and cross-surface readback?
Which idempotency and concurrency rules prevent duplicate streams or stale approvals when two reviewers act on the same artifact?