feat(console): cool slate ops chrome and company-day demo (#40)

* feat(console): cool slate ops chrome and company-day demo timeline

Ship restrained teal slate console, ordered agent activity timeline with
stage-reveal, Contracts panel, and multi-frame demo.gif under ADR-05.

* chore(supply-chain): enforce allowScripts and harden verify installs (#41)

Bump to npm 11.17 so strict-allow-scripts is real, pin hono node-server,
stop default node_modules wipes that raced npm ci, and gate pending
install scripts in verify.

Co-authored-by: Sage Hart <sagehart@MacBookAir.attlocal.net>

* fix(ci): use corepack npm and portable grep in verify

setup-node leaves npm 10 on PATH so bare npm -v failed the >=11 gate.
Invoke the packageManager pin via corepack npm, and replace rg with grep
for GitHub-hosted runners.

---------

Co-authored-by: Sage Hart <sagehart@MacBookAir.attlocal.net>

Author: SafetyMP

.corp-harness/site.json

@@ -2,7 +2,7 @@
   "schema": "corporate-site-site/v1",
   "site_id": "corpos",
   "corporate_program": "corpos-autonomous-company",
-  "corporate_handoff_sha256": "c0bb90e70fdfe705192e435869c30ab401339ec6b47c0576be34d7f48bae1975",
+  "corporate_handoff_sha256": "0953f106918b8ffe1a61e30f3a69afbd0498bd44df695ff6b3c15c4b6915af68",
   "verify_argv": ["./scripts/harness/verify.sh"],
   "adversarial_argv": ["./scripts/harness/adversarial.sh"]
 }

.cursor/hooks/verify-on-stop.py

@@ -10,7 +10,8 @@
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 from _common import read_input, emit, log_event, resolve_workspace_root  # noqa: E402
 
-TIMEOUT = 120
+# Full clean+ci verify can exceed 2m; default verify reuses node_modules.
+TIMEOUT = 300
 VERIFY_SCRIPT = "scripts/verify.sh"
 
 

.github/workflows/ci.yml

@@ -26,9 +26,11 @@ jobs:
       - name: Activate packageManager npm
         run: |
           corepack enable
-          corepack prepare npm@10.9.2 --activate
+          corepack prepare npm@11.17.0 --activate
+          # setup-node's npm 10 stays on PATH; assert the pin via corepack npm.
+          test "$(corepack npm -v | cut -d. -f1)" -ge 11
       - name: Site verify (build, typecheck, test, lint, format)
-        run: ./scripts/harness/verify.sh
+        run: CORPOS_VERIFY_CLEAN=1 ./scripts/harness/verify.sh
 
   adversarial:
     runs-on: ubuntu-latest
@@ -43,8 +45,9 @@ jobs:
       - name: Activate packageManager npm
         run: |
           corepack enable
-          corepack prepare npm@10.9.2 --activate
-      - run: npm ci
-      - run: npm run build
+          corepack prepare npm@11.17.0 --activate
+          test "$(corepack npm -v | cut -d. -f1)" -ge 11
+      - run: corepack npm ci --include=dev
+      - run: corepack npm run build
       - name: Site adversarial
         run: ./scripts/harness/adversarial.sh

.npmrc

@@ -0,0 +1,3 @@
+# Fail install if a dependency has install scripts not covered by package.json allowScripts.
+# Approvals are pinned in package.json "allowScripts" (esbuild + fsevents only).
+strict-allow-scripts=true

CONTRIBUTING.md

@@ -21,14 +21,16 @@ Please also follow the [Code of Conduct](CODE_OF_CONDUCT.md).
 ## Prerequisites
 
 - **Node.js ≥ 22** (see [`.nvmrc`](.nvmrc); CI covers 22 and 24).
-- npm **10.9.2** via Corepack (`packageManager` in [`package.json`](package.json)).
+- npm **11.17.0** via Corepack (`packageManager` in [`package.json`](package.json)).
+  Required for enforceable `allowScripts` / `strict-allow-scripts`.
 
 ## Setup
 
 ```bash
-npm install
+npm ci --include=dev
 npm run build
-./scripts/harness/verify.sh   # typecheck · test · lint · format:check · stack guards
+./scripts/harness/verify.sh   # build · typecheck · test · lint · format · stack guards
+# Force a clean reinstall (CI does this): CORPOS_VERIFY_CLEAN=1 ./scripts/harness/verify.sh
 ```
 
 A contribution is not finished until `./scripts/harness/verify.sh` is green

Dockerfile

@@ -5,8 +5,8 @@ COPY packages ./packages
 COPY apps ./apps
 COPY scripts ./scripts
 COPY tsconfig*.json vitest.config.ts eslint.config.mjs ./
-RUN corepack enable && corepack prepare npm@10.9.2 --activate \
- && npm ci && npm run build
+RUN corepack enable && corepack prepare npm@11.17.0 --activate \
+ && npm ci --include=dev && npm run build
 ENV PORT=3000
 EXPOSE 3000
 CMD ["npm", "run", "start"]

README.md

@@ -21,7 +21,7 @@ Read the thesis: [`docs/future-of-the-firm.md`](docs/future-of-the-firm.md).
 ## Demo
 
 <p align="center">
-  <img src="docs/assets/demo.gif" alt="CorpOS ops console — capital and trust, company day result, and Governor audit controls (synthetic demo data)" width="900" />
+  <img src="docs/assets/demo.gif" alt="CorpOS ops console — agents hand off a company day (support → finance → ops), trust unlock, and Governor (synthetic demo data)" width="900" />
 </p>
 
 ### Screenshots
@@ -33,7 +33,7 @@ Read the thesis: [`docs/future-of-the-firm.md`](docs/future-of-the-firm.md).
 - **Local demo:** `npm install && npm run build && npm run dev` → [http://localhost:3000](http://localhost:3000)
 - **Regenerate GIF/PNGs:** start the console, then `npm run screenshots` — see [`docs/assets/README.md`](docs/assets/README.md)
 
-Click **Run company day** for the multi-handoff demo (support → finance → ops), including an autonomous settle, an exception approval path, compensation, and trust unlock.
+Click **Run company day** to watch the agent activity timeline: support → finance → ops handoffs, an autonomous settle, an exception approval path, compensation, and trust unlock.
 
 ---
 

SECURITY.md

@@ -22,6 +22,22 @@ Treat it as a design artifact you can run locally.
 
 When `CORPOS_MODE=shared`, `DASHBOARD_API_TOKEN` is required for approval and kill mutations.
 
+## Dependency / supply-chain hygiene
+
+- Install from the committed `package-lock.json` via `npm ci --include=dev`.
+- `packageManager` is **npm@11.17.0** (Corepack). npm 10 cannot enforce `allowScripts`.
+- Registry must remain `https://registry.npmjs.org/` — no project `.npmrc` registry override.
+- Install scripts are **opt-in and enforced**: `package.json` `allowScripts` pins only
+  `esbuild` / `fsevents` versions in the lockfile; `.npmrc` sets `strict-allow-scripts=true`.
+  `./scripts/harness/verify.sh` fails if `npm approve-scripts --allow-scripts-pending` reports gaps.
+- Verify does **not** wipe `node_modules` by default (avoids concurrent `ENOTEMPTY` races).
+  CI sets `CORPOS_VERIFY_CLEAN=1` for a full reinstall. Never fetch npm via `npx` inside verify.
+- `@hono/node-server` is pinned to `2.0.11` via root dependency + `overrides` (covers API
+  `serveStatic` and `@modelcontextprotocol/sdk`).
+- Review Dependabot PRs before merge; re-run `npm approve-scripts --allow-scripts-pending`
+  after lockfile changes that introduce new install scripts.
+- Do **not** set `dangerously-allow-all-scripts=true` in CI.
+
 ## Reporting
 
 Use GitHub Security Advisories on the CorpOS repository.

apps/api/package.json

@@ -12,7 +12,7 @@
   },
   "dependencies": {
     "@corpos/core": "0.2.0",
-    "@hono/node-server": "^1.14.4",
+    "@hono/node-server": "^2.0.11",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.32"
   },

apps/console/index.html

@@ -4,6 +4,12 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>CorpOS Ops Console</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;600&family=IBM+Plex+Serif:wght@500&display=swap"
+      rel="stylesheet"
+    />
   </head>
   <body>
     <div id="app"></div>