One wallet, one shared Review, N request origins — you, a dapp, an agent. The v4 visual system (the two-signal actor model, tokens, widgets) is unchanged; the information architecture and the flows are rebuilt around where a request came from, not around a mode. This epic transcribes the approved build plan into 8 independently-shippable children (E0–E8). Note: there is no separate E6-cap — E5 is the one merged trust-critical issue.
Implements #170; supersedes #174.
Implementer Contract (every child links here — read before writing code)
Reuse, never hand-roll (convention; /code-review + the per-view fidelity checklist enforce it). Compose every view from widgets.rs. If a primitive is missing, add it to widgets.rs (see E1) — do NOT inline a one-off copy. Existing: short_addr, caution_line, error_line, section_label, divider, identity_mark, budget_gauge, truncated_address (+ money.rs). v4 primitives (E1, SHIPPED in #189 — reuse, do NOT re-roll): key_cap/KeyCap, origin_header/Origin/Trust, agent_mark (handle-aware cyan squircle), action_tag/ActionKind, status_glyph/StatusGlyph, kv_row/KvValue, page_header, meta_rail/meta_section/meta_obj, balance_diff/DiffRow, stop_brake/BrakeState; tokens MARK_MD/MARK_LG/ICON_MD/ALPHA_TINT/RAIL_W. Each carries a // reason: naming its consumer child, so grep your issue number in crates/deckard-app/src/widgets.rs to find yours. Composite widgets take theme: &Theme; atomic ones take explicit Hsla. When you wire a primitive's first call site, delete its #[allow(dead_code)]. Colors via theme.* + amber/agent only (no raw hex); sizes/spacing/radii/motion via tokens (no magic px()); money + addresses via money.rs (mono, tabular, dimmed decimals).
Never regress (trust invariants — a PR that touches these must prove they still hold):
- Clear-signing renders before every value move; the
⌘↵ arm-delay confirm (never hold-to-confirm).
- No blind approve: an approval resolves ONLY the still-pending record the human actually reviewed.
- STOP is always reachable, zeroizes the key, and denies in-flight work.
- Cap enforcement is real: the UI never shows an enforcement claim the engine doesn't back.
Definition of Done — ALL issues:
cargo fmt --all --check clean · just check green (clippy -D warnings, both feature configs) · cargo test --workspace green.- No new/changed deps (
Cargo.toml/Cargo.lock) without explicit approval.
- Every new user-facing action has a ⌘K
Command (palette_commands.rs + handled in run_palette_command).
- GUI issues: annotated before/after screenshots off the funded
just demo (use E0's recipe), AND the per-view fidelity checklist checked off in the PR.
- A short "do not touch" honored (per child).
Definition of Done — trust-critical (E5 only), in addition:
6. Regression tests for the two invariants at stake: cap-enforced-on-shields (a shield over the stated per-move cap ASKS, never auto-broadcasts) and no-blind-approve (approve resolves only the still-pending reviewed record). Paste the passing test output.
7. A codex adversarial review (GPT-5 xhigh, cross-model) of the FIX diff, looped until 0 findings (per docs/AGENTIC-ENGINEERING.md + the "verify the fixes, not just features" practice).
Golden-ref match rule: the target is the matching view in designs/deckard-v4.html (open it, switch views via the top bar). Fidelity = the per-view checklist passes AND the before/after screenshot reads like that view in layout + hierarchy. The HTML is web; the app is GPUI — there is no pixel diff, so the checklist is the gate.
Children
Dependency graph + sequencing
E0 driving ·(prereq for every GUI issue's evidence)
E1 widgets ─┬─> E2 identity
├─> E4 money
├─> E3 rail ─┬─> E6 activity/waiting
│ └─> E7 transaction
└─> E5 🔴 shared review + enforced cap ──> E7
E2..E7 ─────────────────────────────────────────> E8 ⌘K
E0 first (so evidence is possible). E1 next (all reuse it). E2/E4 small early wins. E3 structural (E6/E7 rail content needs it). E5 is the trust-critical center (enforcement + the review that displays it, merged, one adversarial review). E8 wires ⌘K last.
Out of scope (documented slots — deferred)
Agent internals / in-wallet agent-interaction model; deep dapp Connections editing (ADR-0001 / #44); session keys (ADR-0002 / #33); multi-chain portfolio expansion.
Golden ref: designs/deckard-v4.html. Contract + checklists + full detail: docs/research/13-v4-build-plan.md. Audit: docs/research/11-ia-flows-audit.md.
One wallet, one shared Review, N request origins — you, a dapp, an agent. The v4 visual system (the two-signal actor model, tokens, widgets) is unchanged; the information architecture and the flows are rebuilt around where a request came from, not around a mode. This epic transcribes the approved build plan into 8 independently-shippable children (E0–E8). Note: there is no separate E6-cap — E5 is the one merged trust-critical issue.
Implements #170; supersedes #174.
Implementer Contract (every child links here — read before writing code)
Reuse, never hand-roll (convention;
/code-review+ the per-view fidelity checklist enforce it). Compose every view fromwidgets.rs. If a primitive is missing, add it towidgets.rs(see E1) — do NOT inline a one-off copy. Existing:short_addr,caution_line,error_line,section_label,divider,identity_mark,budget_gauge,truncated_address(+money.rs). v4 primitives (E1, SHIPPED in #189 — reuse, do NOT re-roll):key_cap/KeyCap,origin_header/Origin/Trust,agent_mark(handle-aware cyan squircle),action_tag/ActionKind,status_glyph/StatusGlyph,kv_row/KvValue,page_header,meta_rail/meta_section/meta_obj,balance_diff/DiffRow,stop_brake/BrakeState; tokensMARK_MD/MARK_LG/ICON_MD/ALPHA_TINT/RAIL_W. Each carries a// reason:naming its consumer child, sogrepyour issue number incrates/deckard-app/src/widgets.rsto find yours. Composite widgets taketheme: &Theme; atomic ones take explicitHsla. When you wire a primitive's first call site, delete its#[allow(dead_code)]. Colors viatheme.*+amber/agentonly (no raw hex); sizes/spacing/radii/motion viatokens(no magicpx()); money + addresses viamoney.rs(mono, tabular, dimmed decimals).Never regress (trust invariants — a PR that touches these must prove they still hold):
⌘↵arm-delay confirm (never hold-to-confirm).Definition of Done — ALL issues:
cargo fmt --all --checkclean ·just checkgreen (clippy-D warnings, both feature configs) ·cargo test --workspacegreen.Cargo.toml/Cargo.lock) without explicit approval.Command(palette_commands.rs+ handled inrun_palette_command).just demo(use E0's recipe), AND the per-view fidelity checklist checked off in the PR.Definition of Done — trust-critical (E5 only), in addition:
6. Regression tests for the two invariants at stake: cap-enforced-on-shields (a shield over the stated per-move cap ASKS, never auto-broadcasts) and no-blind-approve (approve resolves only the still-pending reviewed record). Paste the passing test output.
7. A codex adversarial review (GPT-5 xhigh, cross-model) of the FIX diff, looped until 0 findings (per
docs/AGENTIC-ENGINEERING.md+ the "verify the fixes, not just features" practice).Golden-ref match rule: the target is the matching view in
designs/deckard-v4.html(open it, switch views via the top bar). Fidelity = the per-view checklist passes AND the before/after screenshot reads like that view in layout + hierarchy. The HTML is web; the app is GPUI — there is no pixel diff, so the checklist is the gate.Children
Dependency graph + sequencing
E0 first (so evidence is possible). E1 next (all reuse it). E2/E4 small early wins. E3 structural (E6/E7 rail content needs it). E5 is the trust-critical center (enforcement + the review that displays it, merged, one adversarial review). E8 wires ⌘K last.
Out of scope (documented slots — deferred)
Agent internals / in-wallet agent-interaction model; deep dapp Connections editing (ADR-0001 / #44); session keys (ADR-0002 / #33); multi-chain portfolio expansion.
Golden ref:
designs/deckard-v4.html. Contract + checklists + full detail:docs/research/13-v4-build-plan.md. Audit:docs/research/11-ia-flows-audit.md.