# Command Dashboard Operator UX Clarification + Safe Workspace

Use after a real operator handoff works technically (legacy dashboard links are configured and reachable), but user testing shows the workflow still feels confusing or too passive.

## Trigger

- Module detail pages show redundant navigation such as “Open module” while the operator is already on that module page.
- Operators do not understand the distinction between internal command-center summaries and external specialist dashboards.
- A sensitive domain such as Health has no safe external dashboard but still needs a useful internal workspace.
- `/settings` presents a policy lock as `not_configured`, making an intentional safety boundary look like a broken setup.

## Pattern

1. **Keep the federated architecture explicit**
   - JARVIS/command dashboard remains the command center.
   - Finance/AutoShorts-style systems remain separate specialist frontends opened by link-only handoff.
   - Do not add iframes, rebuild full legacy UIs, or introduce write actions.

2. **Fix module-detail workflow labels**
   - On overview/review/report hub pages, an internal route button may say “Zusammenfassung öffnen” / “Open summary”.
   - On a module detail page, remove redundant “Open module”.
   - Show three clear work paths instead:
     - internal current summary / safe workspace;
     - external specialist dashboard when configured;
     - actions locked / read-only.

3. **Use policy states, not failure states**
   - For intentionally locked sensitive domains, expose a status such as `locked_by_policy` and a positive internal state such as `safe workspace: available`.
   - Avoid showing Health as simply `not_configured` when no external detail dashboard should exist.
   - `/api/demo-info` and Settings should still expose only categories, never URLs, ports, paths, or env values.

4. **Build a safe internal workspace for ultra-sensitive domains**
   - Example Health Safe Workspace may show only safe metadata:
     - pipeline status category;
     - backup freshness;
     - bounded review count;
     - source health;
     - last success / last attempt;
     - contract version.
   - Explicitly state that no medical details are loaded.
   - Do not show labs, diagnoses, medications, PDFs, OCR, reports, symptoms, filenames, local paths, Drive links, DB rows, or raw health content.

5. **Make review/report pages real navigation hubs**
   - `/approvals` or equivalent: show attention/review items with “Open summary” and optional “Open specialist dashboard”; no Approve/Reject controls.
   - `/reports` or equivalent: show safe cards linking to existing specialist dashboards or the safe workspace; do not list files or load reports.

6. **Localize operator copy consistently**
   - For German operator demos, prefer labels like:
     - “Zusammenfassung öffnen”
     - “Fachdashboard öffnen”
     - “Aktionen gesperrt”
     - “Nur Lesen”
     - “Externes Dashboard”
     - “Sicherer Health-Status”
     - “Detaildaten gesperrt”
   - Keep technical badges like Read-only when useful, but do not mix English action labels with German UX copy unnecessarily.

7. **Strengthen smoke/tests around UX clarity**
   - Add dashboard tests for module workflow labels, settings workspace-link categories, review/report handoff pages, and no iframe/action buttons.
   - Extend smoke to check source text or rendered routes for:
     - no redundant “Open module” on detail UI;
     - Finance/AutoShorts configured;
     - Health locked/safe workspace available;
     - `/health`, `/reports`, `/approvals`, `/settings` reachable;
     - no iframes and no active Upload/Render/Publish/Approve/Reject controls.

## Pitfalls

- Broad smoke regexes for words like `Start` or `Upload` can false-positive on explanatory text. Prefer checking active button labels/elements or exact button-text patterns, while still keeping operator copy neutral.
- If a test uses raw component mounts, stub `RouterLink`; otherwise Vue warnings can obscure meaningful failures.
- Settings tests should assert absence of URL/port/path/secret patterns, not just status labels.
- If API contract categories gain `locked_by_policy`, update backend Pydantic types, frontend TypeScript types, tests, OpenAPI/schema export, and fallback fixtures together.

## Verification

Run and report real output:

```bash
make test-gateway
make dashboard-test
make dashboard-build
python3 scripts/verify-repo-safety.py
make verify
make smoke-operator-handoff
make handoff-stop || true
make handoff
curl -fsS http://<runtime-host>:<jarvis-dashboard-port>
curl -fsS http://<runtime-host>:<finance-dashboard-port>
curl -fsS http://<runtime-host>:<autoshorts-dashboard-port>
curl -fsS http://<runtime-host>:<jarvis-api-port>/api/demo-info
```

Leave the handoff running for operator testing unless the user explicitly asks to stop it.