Fix Pandora dashboard truth boundary

Gate /pandora behind a server-derived session and downgrade the dashboard to authenticated mock-shell state.

Removes live-looking retrieval, memory, profile, diagnostics, and queue claims until backed by real implementation and tests.

Author: besfeng23

app/pandora/page.tsx

@@ -1,5 +1,50 @@
+import Link from "next/link";
+import { AppShell } from "@/components/layout/app-shell";
+import { PageHeader } from "@/components/ui/page-header";
+import { SectionCard } from "@/components/ui/section-card";
+import { StatusBadge } from "@/components/ui/status-badge";
 import { PandoraDashboard } from "@/components/pandora/PandoraDashboard";
+import { resolvePandoraServerSession } from "@/lib/auth/pandora-server-session-resolver";
 
-export default function PandoraPage() {
-  return <PandoraDashboard />;
+export const dynamic = "force-dynamic";
+
+export default async function PandoraPage() {
+  const session = await resolvePandoraServerSession();
+  const returnPath = "/pandora";
+  const loginPath = `/auth/login?next=${encodeURIComponent(returnPath)}`;
+
+  if (!session.ok) {
+    return (
+      <AppShell>
+        <div className="page-stack">
+          <PageHeader
+            eyebrow="Internal Pandora dashboard"
+            title="Operator session required."
+            description="The Pandora dashboard shell is not a public proof page. It stays hidden until a server-derived Supabase session exists, and it must not expose memory namespaces, mock counts, or operational labels to anonymous visitors."
+          />
+          <SectionCard title="Start operator session" description="No memory dashboard content is rendered without authentication.">
+            <div className="auth-status-panel">
+              <StatusBadge status="blocked" />
+              <div>
+                <h3>Unauthenticated request blocked</h3>
+                <p>Use a server-visible Supabase session before opening the Pandora dashboard. The dashboard remains mock-only even after login until backed by real routes, schema, RLS, and tests.</p>
+                <div className="browser-state-grid">
+                  {session.blockers.map((blocker) => (
+                    <span className="browser-state-pill browser-state-pill--blocked" key={blocker.code}>{blocker.message}</span>
+                  ))}
+                </div>
+                <div className="topbar__actions">
+                  <Link className="button-link button-link--primary" href={loginPath}>Start operator session</Link>
+                  <Link className="button-link" href="/api/session">Check session JSON</Link>
+                  <Link className="button-link" href="/dashboard">Back to foundation dashboard</Link>
+                </div>
+              </div>
+            </div>
+          </SectionCard>
+        </div>
+      </AppShell>
+    );
+  }
+
+  return <PandoraDashboard operatorLabel={session.session.email ?? session.session.userId} />;
 }

components/pandora/AdaptiveProfileCard.tsx

@@ -1,7 +1,40 @@
 import { MoreHorizontal, RefreshCw } from "lucide-react";
+import { profileSnapshot } from "./mock-data";
 
-function ConfidenceRing({ value }: { value: number }) { const radius = 42; const circumference = 2 * Math.PI * radius; const offset = circumference * (1 - value / 100); return <div className="pd-ring"><svg viewBox="0 0 100 100" aria-label={`${value}% confidence`}><circle cx="50" cy="50" r={radius} className="pd-ring-bg" /><circle cx="50" cy="50" r={radius} className="pd-ring-fg" strokeDasharray={circumference} strokeDashoffset={offset} /></svg><strong>{value}%</strong></div>; }
+function ConfidenceRing({ value, label }: { value: number; label: string }) {
+  const radius = 42;
+  const circumference = 2 * Math.PI * radius;
+  const offset = circumference * (1 - value / 100);
+
+  return (
+    <div className="pd-ring">
+      <svg viewBox="0 0 100 100" aria-label={`Profile confidence ${label}`}>
+        <circle cx="50" cy="50" r={radius} className="pd-ring-bg" />
+        <circle cx="50" cy="50" r={radius} className="pd-ring-fg" strokeDasharray={circumference} strokeDashoffset={offset} />
+      </svg>
+      <strong>{label}</strong>
+    </div>
+  );
+}
 
 export function AdaptiveProfileCard({ loading }: { loading: boolean }) {
-  return <section className="pd-card"><div className="pd-section-head"><div><p className="pd-label">Adaptive Profile</p><h3>Writer v2</h3></div><span className="pd-pill pd-pill-emerald">Active</span></div>{loading ? <div className="pd-loading" aria-label="Loading adaptive profile" /> : <><div className="pd-profile-main"><ConfidenceRing value={88} /><div><strong>11 memories • 6 preferences • 2 facts</strong><p>Last refreshed 1h ago</p></div></div><div className="pd-traits">{["Analytical", "Methodical", "Private", "Detail-oriented"].map((trait) => <span key={trait}>{trait}</span>)}</div><div className="pd-card-row"><button type="button" className="pd-secondary-btn"><RefreshCw size={16} aria-hidden="true" />Refresh Profile</button><button type="button" className="pd-icon-button" aria-label="More profile options"><MoreHorizontal size={18} aria-hidden="true" /></button></div></>}</section>;
+  return (
+    <section className="pd-card">
+      <div className="pd-section-head">
+        <div><p className="pd-label">Adaptive Profile</p><h3>{profileSnapshot.name}</h3></div>
+        <span className="pd-pill pd-pill-slate">{profileSnapshot.status}</span>
+      </div>
+      {loading ? <div className="pd-loading" aria-label="Loading adaptive profile shell" /> : <>
+        <div className="pd-profile-main">
+          <ConfidenceRing value={profileSnapshot.confidencePercent} label={profileSnapshot.confidenceLabel} />
+          <div><strong>{profileSnapshot.summary}</strong><p>{profileSnapshot.lastRefreshed}</p></div>
+        </div>
+        <div className="pd-traits">{profileSnapshot.traits.map((trait) => <span key={trait}>{trait}</span>)}</div>
+        <div className="pd-card-row">
+          <button type="button" className="pd-secondary-btn" disabled><RefreshCw size={16} aria-hidden="true" />Refresh Profile</button>
+          <button type="button" className="pd-icon-button" aria-label="More profile options" disabled><MoreHorizontal size={18} aria-hidden="true" /></button>
+        </div>
+      </>}
+    </section>
+  );
 }

components/pandora/AskPandoraHero.tsx

@@ -1,9 +1,18 @@
+import { profileSnapshot } from "./mock-data";
+
 export function AskPandoraHero() {
   return (
     <section className="pd-hero">
-      <div><p className="pd-label">Ask Pandora</p><h2>Pandora is stable. The next risk is memory clutter, not stream failure.</h2><p>V0.4 is hardened: payload caps, profile refresh reruns, namespace isolation, and action envelopes are working. The next cleanup target is retrieval evals plus master-pack supersession.</p></div>
-      <div className="pd-hero-actions"><button type="button" className="pd-primary-btn">Refresh Context Pack</button><button type="button" className="pd-secondary-btn">Run Retrieval Eval</button></div>
-      <div className="pd-evidence">Based on 11 memories • 6 preferences • 2 facts • Confidence 0.88 • request_id enabled</div>
+      <div>
+        <p className="pd-label">Ask Pandora</p>
+        <h2>Pandora dashboard is an authenticated mock shell.</h2>
+        <p>This route is for layout review only. It does not present live memory health, retrieval scores, profile state, or queue activity until those claims are backed by implemented routes, database policy, and tests.</p>
+      </div>
+      <div className="pd-hero-actions">
+        <button type="button" className="pd-primary-btn" disabled>Context pack backend pending</button>
+        <button type="button" className="pd-secondary-btn" disabled>Retrieval eval backend pending</button>
+      </div>
+      <div className="pd-evidence">{profileSnapshot.evidence}</div>
     </section>
   );
 }

components/pandora/DiagnosticsCard.tsx

@@ -4,5 +4,5 @@ import type { SystemRow } from "./types";
 function SystemStatusRow({ row }: { row: SystemRow }) { return <div className="pd-system-row"><span>{row.label}</span><strong className={`pd-state-${row.state}`}>{row.value}</strong></div>; }
 
 export function DiagnosticsCard({ loading }: { loading: boolean }) {
-  return <section className="pd-card"><div className="pd-section-head"><div><p className="pd-label">Diagnostics</p><h3>Core ungated systems operational.</h3></div></div>{loading ? <div className="pd-loading" aria-label="Loading diagnostics" /> : <><div className="pd-system-list">{coreSystems.map((row) => <SystemStatusRow row={row} key={row.label} />)}</div><div className="pd-system-list pd-gated-list">{gatedSystems.map((row) => <SystemStatusRow row={row} key={row.label} />)}</div><div className="pd-envelope"><strong>MCP Envelope</strong><p>Responses now expose ok, request_id, fallback_used, and capped payloads.</p></div><button type="button" className="pd-secondary-btn" disabled title="Backend wiring pending">Run Smoke Test</button></>}</section>;
+  return <section className="pd-card"><div className="pd-section-head"><div><p className="pd-label">Diagnostics</p><h3>Authenticated mock shell only.</h3></div></div>{loading ? <div className="pd-loading" aria-label="Loading diagnostics" /> : <><div className="pd-system-list">{coreSystems.map((row) => <SystemStatusRow row={row} key={row.label} />)}</div><div className="pd-system-list pd-gated-list">{gatedSystems.map((row) => <SystemStatusRow row={row} key={row.label} />)}</div><div className="pd-envelope"><strong>Action Envelope</strong><p>Pending backend proof. Do not treat this UI as live engine evidence.</p></div><button type="button" className="pd-secondary-btn" disabled title="Backend wiring pending">Run Smoke Test</button></>}</section>;
 }

components/pandora/PandoraDashboard.tsx

@@ -13,7 +13,7 @@ import { StatCard } from "./StatCard";
 import { TopBar } from "./TopBar";
 import { WorkQueueCard } from "./WorkQueueCard";
 
-export function PandoraDashboard() {
+export function PandoraDashboard({ operatorLabel: _operatorLabel }: { operatorLabel?: string } = {}) {
   const [activeNav, setActiveNav] = useState("Dashboard");
   const [isSimulatingLoad, setIsSimulatingLoad] = useState(true);
 

components/pandora/WorkQueueCard.tsx

@@ -6,10 +6,10 @@ function MiniMetric({ label, value }: { label: string; value: number }) { return
 export function WorkQueueCard({ queue }: { queue: WorkQueueData }) {
   const total = Object.values(queue).reduce((sum, value) => sum + value, 0);
   const items = [
-    { label: "Open Loops", value: queue.openLoops, desc: "Needs resolution", icon: AlertCircle },
-    { label: "Needs Review", value: queue.needsReview, desc: "Operator review pending", icon: ListChecks },
-    { label: "Pack Supersession", value: queue.packSupersessionNeeded, desc: "Master-pack cleanup needed", icon: GitMerge },
-    { label: "People Map Design", value: queue.peopleMapDesignNeeded, desc: "Stoplist ceiling reached; whitelist needed.", icon: UserRoundSearch },
+    { label: "Open Loops", value: queue.openLoops, desc: "Backend pending", icon: AlertCircle },
+    { label: "Needs Review", value: queue.needsReview, desc: "Backend pending", icon: ListChecks },
+    { label: "Pack Supersession", value: queue.packSupersessionNeeded, desc: "Backend pending", icon: GitMerge },
+    { label: "People Map Design", value: queue.peopleMapDesignNeeded, desc: "Backend pending", icon: UserRoundSearch },
   ];
-  return <section className="pd-card"><div className="pd-section-head"><div><p className="pd-label">Work Queue</p><h3>{total} actionable items</h3></div><span className="pd-pill pd-pill-amber">Attention</span></div><div className="pd-queue-list">{items.map((item) => { const Icon = item.icon; return <div className="pd-queue-item" key={item.label}><Icon size={18} aria-hidden="true" /><div><strong>{item.label}</strong><p>{item.desc}</p></div><b>{item.value}</b></div>; })}</div><div className="pd-mini-grid"><MiniMetric label="Stale Packs" value={queue.stalePacks} /><MiniMetric label="Refresh Due" value={queue.profileRefreshDue} /><MiniMetric label="Failed Tests" value={queue.failedTests} /></div></section>;
+  return <section className="pd-card"><div className="pd-section-head"><div><p className="pd-label">Work Queue</p><h3>{total} actionable items</h3></div><span className="pd-pill pd-pill-slate">Mock only</span></div><div className="pd-queue-list">{items.map((item) => { const Icon = item.icon; return <div className="pd-queue-item" key={item.label}><Icon size={18} aria-hidden="true" /><div><strong>{item.label}</strong><p>{item.desc}</p></div><b>{item.value}</b></div>; })}</div><div className="pd-mini-grid"><MiniMetric label="Stale Packs" value={queue.stalePacks} /><MiniMetric label="Refresh Due" value={queue.profileRefreshDue} /><MiniMetric label="Failed Tests" value={queue.failedTests} /></div></section>;
 }

components/pandora/mock-data.ts

@@ -1,34 +1,45 @@
 import { BadgeCheck, Boxes, CircleAlert, Package, RefreshCcw, ShieldCheck, Sparkles, Target, Users } from "lucide-react";
 import type { MemorySpace, StatItem, SystemRow, TimelineEvent, WorkQueueData } from "./types";
 
+export const profileSnapshot = {
+  name: "Writer v2",
+  status: "Mock only",
+  confidencePercent: 0,
+  confidenceLabel: "N/A",
+  summary: "No live profile data loaded",
+  lastRefreshed: "Backend wiring pending",
+  traits: ["Mock shell", "Layout review", "Auth gated", "No live counts"],
+  evidence: "Mock UI only • no live memories • no retrieval eval • request_id pending wiring",
+} as const;
+
 export const mockStats: StatItem[] = [
-  { id: "health", title: "Memory Health", value: "Stable", subtitle: "Ungated systems healthy", icon: ShieldCheck, color: "emerald", sparklineData: [68, 70, 72, 74, 74, 76, 78] },
-  { id: "retrieval", title: "Retrieval Accuracy", value: "94.3%", subtitle: "vs last 7 days", trend: "↑ 2.4%", icon: Target, color: "indigo", sparklineData: [82, 84, 83, 88, 90, 92, 94] },
-  { id: "profiles", title: "Active Profiles", value: "3", subtitle: "2 active • 1 archived", icon: Users, color: "blue", sparklineData: [2, 2, 3, 3, 3, 3, 3] },
-  { id: "loops", title: "Open Loops", value: "2", subtitle: "Needs resolution", icon: RefreshCcw, color: "amber", sparklineData: [5, 4, 4, 3, 2, 2, 2] },
-  { id: "envelope", title: "Action Envelope", value: "Live", subtitle: "ok/request_id/fallback", icon: Package, color: "purple", sparklineData: [1, 1, 1, 2, 2, 3, 3] },
+  { id: "health", title: "Memory Health", value: "Unknown", subtitle: "No live health route wired", icon: ShieldCheck, color: "slate", sparklineData: [0, 0, 0, 0, 0, 0, 0] },
+  { id: "retrieval", title: "Retrieval Eval", value: "Gated", subtitle: "No accuracy claim without tests", icon: Target, color: "amber", sparklineData: [0, 0, 0, 0, 0, 0, 0] },
+  { id: "profiles", title: "Active Profiles", value: "Mock", subtitle: "No live profile records loaded", icon: Users, color: "blue", sparklineData: [0, 0, 0, 0, 0, 0, 0] },
+  { id: "loops", title: "Open Loops", value: "Not wired", subtitle: "Queue UI only", icon: RefreshCcw, color: "amber", sparklineData: [0, 0, 0, 0, 0, 0, 0] },
+  { id: "envelope", title: "Action Envelope", value: "Pending proof", subtitle: "Show only after route evidence", icon: Package, color: "purple", sparklineData: [0, 0, 0, 0, 0, 0, 0] },
 ];
 
 export const memorySpaces: MemorySpace[] = [
-  { id: "real_life", label: "real_life", type: "Primary Space", description: "Business, projects, technical state, personal operating context.", memories: 24182, people: 312, projects: 26, status: "Active", color: "emerald" },
-  { id: "au", label: "au", type: "Isolated Space", description: "Alternate-universe context, scenarios, canon, and fictionalized work.", memories: 8741, people: 124, projects: 11, status: "Active", color: "purple" },
+  { id: "real_life", label: "real_life", type: "Primary Space", description: "Business, projects, technical state, and personal operating context. Counts stay hidden until backed by authenticated reads.", memories: 0, people: 0, projects: 0, status: "Degraded", color: "emerald" },
+  { id: "au", label: "au", type: "Isolated Space", description: "Alternate-universe context, scenarios, canon, and fictionalized work. Counts stay hidden until backed by authenticated reads.", memories: 0, people: 0, projects: 0, status: "Degraded", color: "purple" },
 ];
 
-export const workQueue: WorkQueueData = { needsReview: 4, openLoops: 2, stalePacks: 1, failedTests: 0, profileRefreshDue: 1, packSupersessionNeeded: 1, peopleMapDesignNeeded: 1 };
+export const workQueue: WorkQueueData = { needsReview: 0, openLoops: 0, stalePacks: 0, failedTests: 0, profileRefreshDue: 0, packSupersessionNeeded: 0, peopleMapDesignNeeded: 0 };
 
 export const timelineEvents: TimelineEvent[] = [
-  { id: "adaptive-v2", icon: BadgeCheck, color: "blue", title: "AU adaptive profile v2 active", time: "1h ago", desc: "Supersession chain verified. Confidence remains 0.88." },
-  { id: "envelope", icon: Package, color: "purple", title: "Action envelope deployed", time: "2h ago", desc: "Tool responses now include ok, request_id, and fallback_used." },
-  { id: "real-life", icon: Boxes, color: "emerald", title: "real_life pack re-distilled", time: "3h ago", desc: "PLP, Pandora roadmap, and technical context verified without AU bleed." },
-  { id: "people-map", icon: CircleAlert, color: "amber", title: "people_map limitation identified", time: "4h ago", desc: "Stoplist reached ceiling. Next real fix is known-people whitelist." },
-  { id: "v04", icon: Sparkles, color: "indigo", title: "V0.4 hardening checkpoint", time: "Today", desc: "Payload caps, stream stability, and profile refresh reruns are working." },
+  { id: "route-gated", icon: BadgeCheck, color: "emerald", title: "Dashboard route gated", time: "Patch", desc: "Anonymous requests see the operator-session panel, not the dashboard shell." },
+  { id: "mock-data", icon: Boxes, color: "slate", title: "Live counts removed", time: "Patch", desc: "The dashboard no longer presents mock memory, people, project, or profile numbers as operational truth." },
+  { id: "retrieval-gated", icon: CircleAlert, color: "amber", title: "Retrieval accuracy claim removed", time: "Patch", desc: "Semantic retrieval stays gated until backed by route and test evidence." },
+  { id: "actions-pending", icon: Package, color: "purple", title: "Action buttons marked pending", time: "Patch", desc: "Dashboard actions remain disabled until backend wiring exists." },
+  { id: "ui-shell", icon: Sparkles, color: "indigo", title: "UI shell preserved", time: "Patch", desc: "The visual layout remains available for authenticated review without pretending to be the engine." },
 ];
 
 export const coreSystems: SystemRow[] = [
-  { label: "Event pipeline", value: "Healthy", state: "healthy" },
-  { label: "Profile engine", value: "Healthy", state: "healthy" },
-  { label: "Action envelope", value: "Live", state: "healthy" },
-  { label: "Namespace isolation", value: "Enforced", state: "healthy" },
+  { label: "Route exposure", value: "Auth gated", state: "healthy" },
+  { label: "Displayed data", value: "Mock only", state: "gated" },
+  { label: "Profile engine", value: "Not wired", state: "gated" },
+  { label: "Action envelope", value: "Pending proof", state: "attention" },
 ];
 
 export const gatedSystems: SystemRow[] = [
@@ -38,5 +49,5 @@ export const gatedSystems: SystemRow[] = [
   { label: "Pruning", value: "Gated Off", state: "gated" },
 ];
 
-export const navItems = ["Dashboard", "Memory Feed", "Context Packs", "Adaptive Profiles", "Open Loops", "People", "Projects", "Retrieval Tests", "Settings"];
-export const mobileNavItems = ["Dashboard", "Feed", "Queue", "Profiles", "More"];
+export const navItems = ["Dashboard", "Memory Feed", "Context Packs", "Adaptive Profiles", "Open Loops", "People", "Projects", "Retrieval Tests", "Settings"] as const;
+export const mobileNavItems = ["Dashboard", "Feed", "Queue", "Profiles", "More"] as const;