Add workflow editor with synchronized user-flow coverage

.github/workflows/test.yml

@@ -99,10 +99,40 @@ jobs:
         run: |
           export AGENT_WORKFLOW_CONTAINER_IMAGE="$(cat "dist/worker-linux-$ARCH.iid")"
           go test ./pkg/clirunner -run '^TestContainer(ExecutionAndCleanup|RuntimeRemoval)$' -count=1
+  workflow-ui:
+    name: Workflow UI
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: ui/package-lock.json
+      - run: make ui-install
+      - name: Check flow checker and UF documentation synchronization
+        run: |
+          make ui-flow-checker-test
+          node ui/scripts/flows-check.mjs --ci
+      - run: make ui-check ui-test
+      - run: npm exec --prefix ui -- playwright install --with-deps chromium firefox webkit
+      - run: make ui-browser-test
+      - name: Upload UI browser failure reports
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: workflow-ui-browser-failure
+          path: |
+            ui/playwright-report/
+            ui/test-results/
+          if-no-files-found: ignore
   required:
     name: Required
     if: always()
-    needs: [native, workflow-validation, filesystem-conformance, container-conformance]
+    needs: [native, workflow-validation, workflow-ui, filesystem-conformance, container-conformance]
     runs-on: ubuntu-24.04
     steps:
       - env:

.gitignore

@@ -4,3 +4,10 @@
 node_modules/
 /dist/
 __pycache__/
+/ui/dist/
+/ui/.consumer-artifacts/
+/ui/consumers/*/dist/
+/ui/test-results/
+/ui/playwright-report/
+/ui/.verification-tmp/
+/ui/public/packed/

AGENTS.md

@@ -14,3 +14,20 @@ filesystem. Preserve unrelated workspace files.
 `make test` and `make check` are deterministic. The pinned-SDK fake-gateway test
 uses a local fake API and requires its locked Node dependencies. Real provider
 and publication evidence remains separate from deterministic validation.
+
+# UI flow verification on every PR
+
+Before declaring any PR ready, run `make ui-pr-check BASE=<PR target>`
+(for example `BASE=origin/main`). Run it again after subsequent relevant edits.
+This command checks documentation/test synchronization and runs affected user
+flows in Chromium without package builds or provider access. Even unrelated PRs
+must run it; they validate structure without starting a browser. Do not skip a
+missing baseline: fetch the target or supply an available target explicitly.
+
+Each `UF-NN` section in `docs/UI_USER_FLOWS.md` owns
+`ui/test/browser/flows/uf-NN.spec.ts` and links to it. Change both when changing
+either substantive prose or test behavior. Shared test helper/fixture changes
+require meaningful Coverage notes in every affected flow. If behavior stays the
+same, explain revised assertions or recovery scenarios in the Coverage note;
+comments, formatting, link edits, timestamps, and checksums do not acknowledge
+a change. Preserve stable UF IDs. See `ui/README.md` for setup and repairs.

Makefile

@@ -16,3 +16,25 @@ release-check: release-tooling-test
 	python3 scripts/validate-release.py "$(TAG)"
 release-tooling-test:
 	python3 -m unittest discover -s scripts -p 'test_*.py' -v
+
+.PHONY: ui-install ui-check ui-test ui-build ui-browser-test
+ui-install:
+	npm ci --prefix ui --ignore-scripts
+ui-check:
+	npm run check --prefix ui
+ui-test:
+	npm test --prefix ui
+ui-build:
+	npm run build --prefix ui
+ui-browser-test: ui-build
+	npm run test:consumers --prefix ui
+	npm run test:browser --prefix ui
+
+.PHONY: ui-flows-check ui-pr-check ui-flow-checker-test
+BASE ?= origin/main
+ui-flows-check:
+	node ui/scripts/flows-check.mjs --base="$(BASE)"
+ui-flow-checker-test:
+	node --test ui/scripts/flows-check.test.mjs
+ui-pr-check: ui-flow-checker-test
+	node ui/scripts/flows-check.mjs --base="$(BASE)" --run

README.md

@@ -552,3 +552,8 @@ standalone Go implementations.
 
 Stable release preparation, signed evidence, verification and remaining certification
 gates: [release operations](docs/RELEASE_PIPELINE.md).
+
+The independent [workflow viewer and editor](ui/README.md) provides React components,
+plain JavaScript mounts, and a standalone browser bundle for authoring workflow YAML.
+Run `make ui-install ui-check ui-test ui-browser-test` for deterministic UI validation,
+or `npm run dev --prefix ui` to explore the repository examples locally.