Add ACP-based local investigations and shared evidence

[Krzysztof-Cieslak]

Summary

• Add a generic ACP connector with browser pairing, owner-only execution authorization, exact-commit worktrees, and a run-scoped MCP bridge.
• Persist fenced investigation runs and bounded structured results in PostgreSQL; render native tables and charts with collaborative selections.
• Record immutable evidence-backed decisions and embed live or saved evidence in documents.
• Add Planner proposal/read tools, setup documentation, and an investigation authoring skill.

Scope

Universe scope is data-driven investigations rendered by Chopin-owned components. Local agents retain their normal tools and skills. Visual-design specimens, executable browser bundles, and live application previews are deferred.

The nine implementation increments remain separate commits, followed by the Docker packaging fix. Rebased onto 025d98e3, preserving the upstream diagram support, sidebar decision counts, and both migration histories. The connector uses the MCP SDK version already pinned by main.

Verification

After the latest rebase:

• bun install --frozen-lockfile
• bun run types
• bun run ci
• bun run build and production preview-exclusion check
• Full unit suite: 4,436 passed, 4 skipped (bun test --timeout 30000)
• PostgreSQL suite: 77 passed (30-second test timeout)
• Chromium integration: 20 passed across connector, investigation evidence, saved diagrams, Document activity, and sidebar decision counts
• Linux/amd64 Docker image build and production-image investigation import smoke test

Previously verified during implementation:

• Real Copilot CLI ACP smoke test

References

• Design RFC
• Setup and usage: docs/local-experiments.md

[Krzysztof-Cieslak]

Historical pre-fix report. The fix is now deployed and the fresh full Chat-driven workflow is documented in the new report.

Live preview E2E — corrected: Investigations dialog is invisible

The earlier blanket visual “passed” claim is withdrawn. Several screenshots—including those captioned as authorization, running, results, and shared selection—showed the underlying document instead. They did not support their captions. I should have reviewed the rendered images before publishing them.

Actual UI defect

At tested head cdd50149bb599c718372dc7ba6d9d7f11ce4ddf6, ExperimentsPanel passes motion={{ phase: "open", className: "" }} to NavigationDialog. The shared .motion-modal style has opacity 0 until the is-open class is present.

The dialog therefore exists in the accessibility tree and automation can operate its controls, while a person cannot see it. Ordinary Playwright visibility checks do not check opacity. This explains the misleading screenshots and invalidates visual acceptance of that workflow.

Local fix prepared: supply is-open and add an E2E assertion using element.checkVisibility({ checkOpacity: true }). The regression failed before the fix and the complete targeted browser test passed afterward; bun run types and bun run ci also passed. This fix has not been pushed/deployed to the preview yet.

Evidence that remains valid

The real OpenCode ACP run published result 495b71ff-39b2-410e-b573-0e5d649caf74 from sandbox commit f7aab2fc09f592e231658f91ae4b1c88128563ce. The persisted document visibly renders a fixed decision card and a live evidence card, shown below. Shared-state, record, reload, and disconnect checks were programmatic functional observations—not proof that the invisible modal was usable.

The 20-image gallery has been replaced by three distinct captures whose saved pixels were reviewed. These show current persisted state and the current UI defect, not reconstructed historical states.

• Corrected full report and three reviewed images
• Live test document

Saved decision: fixed single-workload values 5 / 25 / 13 B

Live card: repeated-workload values 500 / 30 / 18 B

UI defect: Investigations was opened, but no dialog or backdrop is painted

The separate Copilot stdio-injection limitation and connector SIGINT exit-code issue remain documented in the full report.

[Krzysztof-Cieslak]

Fresh deployed E2E — Chat → investigation → evidence: passed

The visibility fix is deployed and this is a new end-to-end run on 9785424c6ad2beb4b7ffce05e1002facd84c3c08. The trusted preview-ready timestamp advanced to 2026-10-09 14:05:48 UTC. All CI jobs passed.

• Preview: https://419-chopin.githubnext.com
• Fresh test document
• Investigation: 2723d2d5-6717-4e54-a877-55a7a720bd90
• Sandbox source: KC-Test-OSS/TestRepo at f7aab2fc09f592e231658f91ae4b1c88128563ce
• Local agent: OpenCode 2.0.24, via the existing generic opencode acp connector path

Workflow verified

Step	Result	Reviewed screenshot
Pair the real connector with the fresh document	Passed	Connection
Send @chopin request through Chat	Planner called propose_investigation; no manual proposal-form substitute	Chat request and tool action
Authorize execution in Investigations	Request stayed idle until the owner's Run click	Visible authorization dialog
Run locally and receive results	Exact-commit worktree; real ACP result published; chart/table visible	Results inside Investigations
Share selections and embed the live result	Filters/Raw selection synchronized across two tabs; Insert view created the live document card	Live embed
Ask Chat to interpret the evidence	Planner used list_investigations and read_investigation, reporting the captured numbers correctly	Evidence readback
Save a decision and insert fixed evidence	Recorded conclusion/rationale and the acknowledged single/Raw snapshot; record appeared in Decisions	Saved decision embed
Change live selection, reload, and disconnect	Live view changed to repeated/Zlib; fixed snapshot stayed single/Raw. Both persisted and live filters still synchronized without the connector	Final live evidence

The six values matched an independent calculation: single Raw/Gzip/Zlib = 5/25/13 bytes; repeated = 500/30/18 bytes. The saved conclusion is “Keep the single README uncompressed.” This is a tiny-file size experiment, not a general performance benchmark.

Full step-by-step report with eight distinct, pixel-reviewed screenshots

The images were inspected from their saved PNGs before publication. The modal and backdrop are actually painted in this deployment. Later persistence captures are explicitly labeled as final state, not as earlier transient actions.

Scope and remaining observations

• Two tabs used the same test account; cross-owner permissions were not tested with another identity. Reload and connector-disconnect persistence were tested, not a server restart.
• The connector is stopped and both sandbox worktrees are clean. SIGINT still exits with code 1 despite successful disconnect/lock cleanup (MCP error -32001: AbortError).
• The narrow dialog clips long investigation labels; its chart has a horizontal scroller. The numeric table and full-width document embeds are readable.
• The previously diagnosed Copilot ACP stdio limitation remains. This successful workflow used OpenCode.

Key visual evidence: Chat, visible result dialog, fixed decision