feat(workspace, resolver, strategy-curator), test(prove-didi-auth): curator liveness — domain/source mutations broadcast to every connected session

Step 6 of the humain-vc unlock build order. Aniel adds a link, Michael's
screen updates without a refresh, and vice versa — two people in the same
tenant, broadcast-to-all-sessions is the whole liveness model, no
presence/cursors/CRDTs needed.

Backend (services/record-surrealdb-resolver/src/domains.ts,
services/workspace/src/ws.ts):
- registerDomainHandlers gained a broadcast() helper (fire-and-forget
  nc.publish, same pattern as workspaces.ts's workspace.active.changed),
  called after domain.create/retype and source.add/update/remove/
  extract.add each commit — domain.created, domain.retyped, source.added,
  source.updated, source.removed, extract.added, payload carries slugs +
  client_slug(s) + actor.
- Those six subjects added to ws.ts's BROADCAST_SUBJECTS.

Frontend (apps/strategy-curator):
- App.svelte watches workspace.events, dedups by seq (record-collector's
  App.svelte set this precedent — an $effect re-fires on every reactive
  dependency, not just new events), refetches strategies on domain events
  or sources on source/extract events, scoped to the viewer's active
  client + domain.
- curation.svelte.ts gained refreshSources() — re-fetches without
  resetting focus/tags, unlike select()'s user-driven switch-domain reset.

Verification (scripts/prove-didi-auth.mjs):
- New LIVENESS=1 mode, same shape as GATE=1/ATTRIBUTION=1 — two
  independently-authenticated WS sessions against the live local stack;
  session A invokes domain.create then source.add, session B (idle)
  asserted to receive the matching broadcasts with no polling. Passed
  both against rebuilt workspace-service + record-surrealdb-resolver
  containers. Test rows/files cleaned up after, same discipline as step 4.

apps/strategy-curator (svelte-check) and both touched services
(tsc --noEmit) are clean.

Files changed:
- services/record-surrealdb-resolver/src/domains.ts
- services/workspace/src/ws.ts
- apps/strategy-curator/src/App.svelte
- apps/strategy-curator/src/curation.svelte.ts
- scripts/prove-didi-auth.mjs
- context-v/plans/Build-Order-Humain-VC-Unlock-Flow.md
- changelog/2026-07-08_01_Curator-Liveness-Domain-And-Source-Mutations-Broadcast-Live.md

Author: mpstaton

apps/strategy-curator/src/App.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { onMount } from 'svelte';
+  import { workspace } from '@augment-it/workspace';
   import { curation } from './curation.svelte';
   import StrategyPicker from './StrategyPicker.svelte';
   import SourceList from './SourceList.svelte';
@@ -10,6 +11,46 @@
   onMount(() => {
     curation.init();
   });
+
+  // Curator liveness (Build-Order Step 6): two people in the same tenant
+  // see each other's domain/source edits without a refresh. Broadcasts
+  // land on workspace.events (ws.ts's BROADCAST_SUBJECTS); dedup by seq
+  // the same way record-collector's App.svelte does, so each event is
+  // handled exactly once regardless of how many reactive deps re-fire
+  // this effect. domain.retyped carries client_slugs (plural — a domain
+  // can span clients); every other subject carries client_slug (singular).
+  let lastProcessedSeq = -1;
+  $effect(() => {
+    const ev = workspace.events[workspace.events.length - 1];
+    if (!ev || ev.seq <= lastProcessedSeq) return;
+    lastProcessedSeq = ev.seq;
+
+    const payload = ev.payload as {
+      client_slug?: string;
+      client_slugs?: string[];
+      domain_slug?: string;
+      type?: string;
+      old_type?: string;
+    };
+
+    if (ev.subject === 'domain.created' || ev.subject === 'domain.retyped') {
+      const inThisClient =
+        ev.subject === 'domain.retyped'
+          ? (payload.client_slugs ?? []).includes(curation.clientSlug ?? '')
+          : payload.client_slug === curation.clientSlug;
+      const touchesActiveType = payload.type === curation.domainType || payload.old_type === curation.domainType;
+      if (inThisClient && touchesActiveType) void curation.loadStrategies();
+    } else if (
+      ev.subject === 'source.added' ||
+      ev.subject === 'source.updated' ||
+      ev.subject === 'source.removed' ||
+      ev.subject === 'extract.added'
+    ) {
+      if (payload.client_slug === curation.clientSlug && payload.domain_slug === curation.activeSlug) {
+        void curation.refreshSources();
+      }
+    }
+  });
 </script>
 
 <div class="sc-app">

apps/strategy-curator/src/curation.svelte.ts

@@ -461,6 +461,20 @@ class CurationState {
     const i = this.sources.findIndex((x) => x.source_uuid === s.source_uuid);
     if (i >= 0) this.sources[i] = withSlug(s);
   }
+
+  // Re-fetch the active domain's sources without resetting focus/tags —
+  // the curator-liveness path (App.svelte's workspace.events effect, Step
+  // 6) calls this when a REMOTE session's mutation lands, as opposed to
+  // select() which is the user-driven "switch domain" path and resets
+  // focus deliberately.
+  async refreshSources(): Promise<void> {
+    if (!this.activeSlug) return;
+    const r = await this.call<{ sources: Source[] }>('domain.assemble', { type: this.domainType, slug: this.activeSlug, client_slug: this.clientSlug });
+    if (!r) return;
+    const nextSources = (r.sources ?? []).map(withSlug);
+    this.sources = nextSources;
+    if (this.focusIdx >= nextSources.length) this.focusIdx = Math.max(0, nextSources.length - 1);
+  }
 }
 
 // Belt-and-suspenders: if a source arrives without source_slug but with a

changelog/2026-07-08_01_Curator-Liveness-Domain-And-Source-Mutations-Broadcast-Live.md

@@ -0,0 +1,65 @@
+---
+date_created: 2026-07-08
+date_modified: 2026-07-08
+title: "Curator liveness — domain and source mutations broadcast live, proven with two independent sessions"
+lede: "Step 6 of the humain-vc unlock build order: Aniel adds a link, Michael's screen updates without a refresh, and vice versa. The resolver now broadcasts after every domain/source mutation commits; the curator surface refetches on the ones that touch its active view."
+publish: true
+authors:
+  - Michael Staton
+augmented_with:
+  - Claude Code on Claude Sonnet 5
+files_changed:
+  - services/record-surrealdb-resolver/src/domains.ts
+  - services/workspace/src/ws.ts
+  - apps/strategy-curator/src/App.svelte
+  - apps/strategy-curator/src/curation.svelte.ts
+  - scripts/prove-didi-auth.mjs
+  - context-v/plans/Build-Order-Humain-VC-Unlock-Flow.md
+tags:
+  - Progress-Update
+  - Curator-Liveness
+  - Augment-It
+  - Didi-Platform
+  - humain-vc
+  - NATS
+---
+
+## Why Care?
+
+Flow 1's whole point is two people working the same thesis corpus side by side. Without this step, "Aniel adds a link → Michael's screen updates" required a manual refresh — fine solo, friction the moment two people are actually in the room together. Step 6 closes that gap the cheap way: broadcast-to-all-sessions within one tenant, no presence, no cursors, no CRDTs — just an event and a refetch.
+
+## What's New?
+
+- **Six mutations now broadcast on commit**: `domain.created`, `domain.retyped`, `source.added`, `source.updated`, `source.removed`, `extract.added`. All owned by `services/record-surrealdb-resolver/src/domains.ts`'s `registerDomainHandlers` — the single service that already runs each mutation's full DB-plus-filesystem lifecycle, so it's the one place that actually knows a mutation succeeded before announcing it. Payload carries the domain/source slugs, `client_slug` (or `client_slugs` for retype, which can span clients), and `actor`.
+- **`services/workspace/src/ws.ts`** forwards those six subjects to every connected session alongside the existing `record_set.*` / `prompt.*` / `response.*` / `workspace.active.changed` broadcasts — no new plumbing needed there, just six more subject strings.
+- **`apps/strategy-curator/src/App.svelte`** watches `workspace.events`, dedups by `seq` (record-collector's App.svelte set this precedent — a naive `$effect` re-fires on every reactive dependency, not just new events), and calls `loadStrategies()` for domain events or the new `refreshSources()` for source/extract events — scoped to the viewer's active client + domain so a broadcast from someone else's workspace or thesis is a no-op.
+- **`refreshSources()`** is new on the curator's state singleton: re-fetches the active domain's sources without resetting focus or the tag vocabulary, unlike `select()` (the user-driven "switch domain" path, which resets both on purpose).
+
+## The Story
+
+Verifying this without two literal browser windows: added a `LIVENESS=1` mode to `scripts/prove-didi-auth.mjs`, following the same pattern as step 3's `GATE=1` and step 4's `ATTRIBUTION=1`. Two independently-authenticated WS sessions open against the live local stack — session A invokes `domain.create` then `source.add`; session B, which never invokes anything, is asserted to receive the `domain.created` and `source.added` broadcast frames with matching payloads, no polling. Both passed against `docker compose`'s live `workspace-service` + `record-surrealdb-resolver` containers (rebuilt for this change). Test domain and source cleaned up from SurrealDB and the humain-vc filesystem afterward — same discipline step 4 established.
+
+```mermaid
+sequenceDiagram
+    participant A as Session A (Aniel)
+    participant R as resolver (domains.ts)
+    participant W as workspace-service (ws.ts)
+    participant B as Session B (Michael)
+    A->>R: source.add
+    R->>R: DB write + content-ingest file write
+    R->>W: nc.publish('source.added', {...})
+    W->>B: EventFrame (broadcast)
+    B->>B: refreshSources()
+```
+
+`apps/strategy-curator` (`svelte-check`) and both touched services (`tsc --noEmit`) are clean.
+
+## What's Next
+
+Step 7 — instance posture + sign-in wall: when the workspace-service reports `DIDI_AUTH=required` and the session has no `didi_id`, the shell should render the sign-in panel as a full pre-auth wall instead of mounting remotes, and hide the WorkspaceSwitcher when the instance is pinned to one client.
+
+## Related
+
+- `context-v/plans/Build-Order-Humain-VC-Unlock-Flow.md` — Step 6, now done
+- `context-v/plans/Unlock-Humain-VC-Team-Access-To-Augment-It.md` (ai-labs level) — the scope of record, item 8
+- `context-v/specs/Workspaces-as-Tenant-Primitive.md` — the tenant-aware envelope Step 4's actor attribution and this step's broadcasts both build on

context-v/plans/Build-Order-Humain-VC-Unlock-Flow.md

@@ -2,12 +2,13 @@
 title: "Build order: the humain-vc unlock flow, step by step"
 lede: "The execution sequence for Flow 1 (Michael + Aniel, side-by-side thesis corpus building on a hosted augment-it) — each step names its repo, files, and verification so any fresh session can pick up mid-sequence. The strategy and scope cuts live in the ai-labs plan; this is the how."
 date_created: 2026-07-06
-date_modified: 2026-07-06
+date_modified: 2026-07-08
 authors:
   - Michael Staton
 augmented_with:
   - Claude Code on Claude Fable 5
-semantic_version: 0.0.1.0
+  - Claude Code on Claude Sonnet 5
+semantic_version: 0.0.2.0
 status: Ready
 tags:
   - Plan
@@ -26,20 +27,27 @@ tags:
 > deliberately-NOT-built list. Read it first; this doc only sequences.
 > Identity spec of record: `ai-labs/context-v/specs/Id-Didi-Sh-Identity-Service.md`.
 
-## State as of writing (2026-07-06, end of day — verify, don't assume)
+## State as of writing (2026-07-08 — verify, don't assume)
 
 - **Live URLs:** `https://id.didi.sh` (identity service on Fly — full
   magic-link loop operator-clicked in production; Resend domain-verified,
   sender `no-reply@didi.sh`), `https://didi.sh` + `www` (the `site/`
   conversion surface on Vercel), the GitHub splash.
-- **Steps 1–5 DONE** (see their sections): real email, orgs + memberships
+- **Steps 1–6 DONE** (see their sections): real email, orgs + memberships
   seeded local AND prod (Michael = superuser, 3 addresses; Aniel pends his
   address), the membership gate proven (4401 / admitted / 4403), the
   actor attribution envelope proven live (created_by/updated_by on
-  domains/sources/source_usages + corpus frontmatter), and thesis
+  domains/sources/source_usages + corpus frontmatter), thesis
   vocabulary (Corpora Curator rename, operator-defined + per-workspace-
   default domain type, `domain.retype` migration — `consumer-immunology`
-  is now `thesis:consumer-immunology`).
+  is now `thesis:consumer-immunology`), and curator liveness (domain/source
+  mutations broadcast over NATS; the curator surface refetches on events
+  from a second session — proven via `LIVENESS=1` on the prove script).
+- **Interleaved but separate:** `feature/augment-affiliations` (the
+  Augment-From-Affiliations MVP, `context-v/specs/Augment-From-Affiliations.md`)
+  shipped and merged into `rebuild/turbo-rsbuild` on 2026-07-08, between
+  steps 5 and 6 of this sequence — a different flow, same repo, not part of
+  this build order.
 - augment-it workspace-service verifies `didi_session` on WS upgrade
   (`services/workspace/src/didi.ts`); shell has the DidiBadge sign-in AND
   a "Flows" jumbo popdown ("Build Corpora" → strategyCurator, full-screen);
@@ -54,7 +62,8 @@ tags:
   repeatable check either way.
 - The DO droplet (167.172.42.247) is prepped: Coolify removed, 2GB swap,
   Docker 28, ports 80/443 free, SSH via the id_rsa_nopass key.
-- **NEXT: step 6** (curator liveness), then 7–8, then the deploy tail.
+- **NEXT: step 7** (instance posture + sign-in wall), then 8, then the
+  deploy tail.
 
 Steps 1–8 are local, each verifiable on the laptop; 9–12 are the deploy
 tail. Steps marked ⚑ need an operator decision or action first.
@@ -197,20 +206,39 @@ more general than the original sketch:
   frontmatter, verified by direct SurrealDB query and `cat`); reach-edu
   untouched, still resolves `'strategy'`.
 
-## Step 6 — Curator liveness (augment-it)
-
-- Resolver + content-ingest handlers publish NATS events after mutations:
-  `domain.created`, `domain.retyped`, `source.added`, `source.updated`,
-  `source.removed`, `extract.added` (payload: slugs + client_id + actor).
-- Add those subjects to `BROADCAST_SUBJECTS` in
+## Step 6 — Curator liveness (augment-it) ✅ DONE 2026-07-08
+
+Done as sketched, with the broadcast owned by the resolver alone (the single
+service that already runs each mutation's full DB + content-ingest
+lifecycle end to end, so it's the one place that knows a mutation actually
+succeeded) rather than split across resolver and content-ingest:
+
+- `services/record-surrealdb-resolver/src/domains.ts`'s
+  `registerDomainHandlers` gained a `broadcast(subject, payload)` helper
+  (fire-and-forget `nc.publish`, same pattern as `workspaces.ts`'s
+  `workspace.active.changed`) called after each of the six mutations
+  commits: `domain.created`, `domain.retyped`, `source.added`,
+  `source.updated`, `source.removed`, `extract.added` — payload carries
+  the domain/source slugs, `client_slug` (or `client_slugs` for retype,
+  which can span clients), and `actor`.
+- Those six subjects added to `BROADCAST_SUBJECTS` in
   `services/workspace/src/ws.ts`.
-- `apps/strategy-curator/src/curation.svelte.ts`: subscribe via the
-  workspace singleton's event stream; refetch the affected list on events
-  for the active domain/client (skip events from own invokes if double-
-  render annoys; correctness first).
-- **Verify:** two browser windows, both on humain-vc; add a source in one;
-  the other's list updates without refresh. This is the Flow-1 step-4
-  acceptance, locally.
+- `apps/strategy-curator/src/App.svelte` (not `curation.svelte.ts` — an
+  `$effect` needs a component, and `record-collector`'s App.svelte already
+  set the precedent) watches `workspace.events`, dedups by `seq` the same
+  way `record-collector` does, and calls the state singleton's
+  `loadStrategies()` (domain events, type-and-client-scoped) or new
+  `refreshSources()` (source/extract events, domain-and-client-scoped —
+  refetches without resetting focus/tags, unlike the user-driven `select()`).
+- **Verify:** ran the protocol-level equivalent of "two browser windows" —
+  a new `LIVENESS=1` mode in `scripts/prove-didi-auth.mjs` opens two
+  independently-authenticated WS sessions against the live local stack;
+  session A invokes `domain.create` then `source.add`; session B (idle,
+  never invokes) asserted receipt of `domain.created` then `source.added`
+  with matching payloads, no polling. Passed both. `apps/strategy-curator`
+  (`svelte-check`) and the two touched services (`tsc --noEmit`) all clean.
+  Test domain + source cleaned up from SurrealDB and the humain-vc
+  filesystem after the run, same discipline as step 4's ATTRIBUTION mode.
 
 ## Step 7 — Instance posture + sign-in wall (augment-it, shell)
 

scripts/prove-didi-auth.mjs

@@ -109,6 +109,59 @@ if (process.env.ATTRIBUTION === '1') {
   process.exit(0);
 }
 
+// ── LIVENESS MODE (build-order step 6) — curator liveness proof ────────────
+// Two independently-connected WS sessions, both signed in (the same protocol
+// two browser windows use): session A invokes domain.create then source.add;
+// session B — which never invokes anything — must receive the domain.created
+// and source.added broadcast EventFrames without polling. This is the
+// protocol-level equivalent of "two browser windows, add a source in one,
+// the other's list updates without refresh."
+if (process.env.LIVENESS === '1') {
+  const client_slug = process.env.LIVENESS_CLIENT ?? 'humain-vc';
+  step('LIVENESS 1. sign in, open two independent sessions');
+  const jwt = await signInAs(EMAIL);
+  const sessionA = await openSession(WS_URL, { Cookie: `didi_session=${jwt}` });
+  const sessionB = await openSession(WS_URL, { Cookie: `didi_session=${jwt}` });
+  console.log('session A + session B both connected and signed in ✓');
+
+  step('LIVENESS 2. session A: domain.create — session B must see domain.created');
+  const domainSlug = `liveness-proof-${Date.now().toString(36)}`;
+  const domainWait = waitForEvent(sessionB, 'domain.created', 10_000);
+  const domainResult = await invokeOn(sessionA, 'domain.create', {
+    type: 'thesis',
+    slug: domainSlug,
+    title: 'Liveness proof',
+    client_slug,
+    tags: [],
+  });
+  if (!domainResult.ok) fail(`domain.create failed: ${domainResult.error}`);
+  const domainEvent = await domainWait;
+  console.log('session B received domain.created:', JSON.stringify(domainEvent.payload));
+  if (domainEvent.payload.slug !== domainSlug || domainEvent.payload.client_slug !== client_slug) {
+    fail(`domain.created payload mismatch: ${JSON.stringify(domainEvent.payload)}`);
+  }
+
+  step('LIVENESS 3. session A: source.add — session B must see source.added');
+  const sourceWait = waitForEvent(sessionB, 'source.added', 10_000);
+  const sourceResult = await invokeOn(sessionA, 'source.add', {
+    url: `https://example.com/liveness-proof-${Date.now()}`,
+    domain_type: 'thesis',
+    domain_slug: domainSlug,
+    client_slug,
+  });
+  if (!sourceResult.ok) fail(`source.add failed: ${sourceResult.error}`);
+  const sourceEvent = await sourceWait;
+  console.log('session B received source.added:', JSON.stringify(sourceEvent.payload));
+  if (sourceEvent.payload.domain_slug !== domainSlug || sourceEvent.payload.client_slug !== client_slug) {
+    fail(`source.added payload mismatch: ${JSON.stringify(sourceEvent.payload)}`);
+  }
+
+  sessionA.ws.close();
+  sessionB.ws.close();
+  console.log('\n\x1b[32mCURATOR LIVENESS PROVEN (domain.created + source.added broadcast to a second session)\x1b[0m');
+  process.exit(0);
+}
+
 // ── GATE MODE (build-order step 3) — runs ONLY the gate tests ──────────────
 // The base steps below assume DIDI_AUTH=optional; gate mode assumes the
 // container is running with:
@@ -258,6 +311,69 @@ function wsInvoke(url, headers, capability, args) {
   }).catch((err) => fail(err.message));
 }
 
+// Opens a WS connection and resolves once the session frame lands, keeping
+// the socket open (unlike firstFrame, which closes immediately) so LIVENESS
+// mode can invoke on it and/or listen for later broadcast EventFrames.
+function openSession(url, headers) {
+  return new Promise((resolve, reject) => {
+    const ws = new WebSocket(url, { headers });
+    const listeners = new Set();
+    const timer = setTimeout(() => {
+      ws.terminate();
+      reject(new Error('timeout waiting for session frame'));
+    }, 8000);
+    ws.on('message', (raw) => {
+      const frame = JSON.parse(raw.toString('utf8'));
+      if (frame.kind === 'session') {
+        clearTimeout(timer);
+        resolve({ ws, listeners });
+        return;
+      }
+      for (const fn of listeners) fn(frame);
+    });
+    ws.on('error', (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  }).catch((err) => fail(err.message));
+}
+
+// Sends one invoke frame on an already-open session and resolves with its
+// matching result frame's `result` (or throws via the session's own error
+// path) — does NOT close the socket, so the caller can keep listening.
+function invokeOn(session, capability, args) {
+  return new Promise((resolve, reject) => {
+    const id = `live_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`;
+    const timer = setTimeout(() => reject(new Error(`timeout waiting for result of ${capability}`)), 15000);
+    const onFrame = (frame) => {
+      if (frame.kind === 'result' && frame.id === id) {
+        clearTimeout(timer);
+        session.listeners.delete(onFrame);
+        resolve(frame);
+      }
+    };
+    session.listeners.add(onFrame);
+    session.ws.send(JSON.stringify({ kind: 'invoke', id, capability, args }));
+  }).catch((err) => fail(err.message));
+}
+
+// Resolves with the first EventFrame on `session` whose subject matches, or
+// rejects (via fail) after timeoutMs — the "browser B's list updates without
+// refresh" assertion at the protocol level.
+function waitForEvent(session, subject, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`timeout waiting for ${subject} broadcast`)), timeoutMs);
+    const onFrame = (frame) => {
+      if (frame.kind === 'event' && frame.subject === subject) {
+        clearTimeout(timer);
+        session.listeners.delete(onFrame);
+        resolve(frame);
+      }
+    };
+    session.listeners.add(onFrame);
+  }).catch((err) => fail(err.message));
+}
+
 function firstFrame(url, headers) {
   return new Promise((resolve, reject) => {
     const ws = new WebSocket(url, { headers });