The GOVENANT Standard — Part 11: The UI Surface (the Ant Farm)
Trust is not only a code property — it must be seeable at a glance. A collection of governed agents is an organization; the UI’s job is to make the organization — hierarchy, schedules, deliberation, delivery, accountability — visible like an ant farm. Nothing the org does is invisible, and nothing it depends on can die silently. These surfaces are the differentiator and the sales demo, not chrome.
Inventory check: the audit (P10) verifies each surface exists and that its numbers reproduce from the DB (“call BS on the data”), and that delivery/coverage — not just activity — is shown.
11.1 The governance spine
| Surface | Makes visible | Notes |
|---|---|---|
| Org Chart | The accountability structure, rendered live from the role registry — chiefs → operating roles as a reporting tree; per-node drill-in to scorecard, duty-delivery ratio, and action logs. | A runtime rename/reassign redraws it. This page is where a buyer sees an organization instead of a chatbot. |
| Coverage Board / Day View ⭐ | The roster diffed against reality: every role × every day — planned duties vs delivered / skipped / blocked / missed / preempted, with drill-in to the duty_run → action → outcome chain (Part 3 §3.8). | New in v1.0. The most legible governance artifact in the standard: “here is your AI employee’s calendar and what she actually did against it.” Zero education required. |
| Motion vs Delivery | Runs completed vs outcomes verified, per terminal edge — the performed-autonomy detector. | Must be a first-class panel. An implementation that computes this and surfaces it nowhere has built the detector and blindfolded the operator. |
| Agent Configuration | Per role, five tabs: Prompt / Skills / Tools / Context / Schedule with provenance chips, human-lock, per-scope overrides, usage stats against the record (Part 2 §2.6). | The full role contract on one surface. |
| Decision Ledger | Every decision + prediction + measured outcome + per-role calibration; ledger rules (binding lessons) visible and editable. | The calibration view is how you decide who to trust with what. |
| Approvals | The human oversight queue with context, preview, tier, and expiry — plus decided history and expiry-rate. | |
| Control Board | Feature flags, autonomy modes/tiers per scope, pause states, pinned-action list (read-only — it’s code). | |
| Daily Standup | The roster-diff narrative per tenant: did what, delivered what, skipped why, went silent where — a readable feed, not a log table. | The artifact a stakeholder reads with coffee. |
11.2 Observability (logs, health, cost)
| Surface | Makes visible |
|---|---|
| Agent Runs + drill-down | Every run: status, cost, live progress; per-action input / output / chain-of-thought / model / tokens / duration / errors. |
| Cost Ledger | Spend by scope × role × model over 1/7/30d — every token attributed. Per-duty cost rollups (the roster is the budget layer). |
| Data-Source Freshness (Meta-Health) | Freshness of every feed the org reasons over. Stale feeds = agents deciding on dead data — this page is how you know. Includes the monitors’ own heartbeats (watchdog independence, made visible). |
| Delivery-Edge Queue Health | The terminal-edge queue: queued, stuck, shipped, failed — per edge. |
| Dependency / Breaker Status | Open / half-open / closed per external dependency; last transition. |
| Validation Log | Every gate decision: kind, pass/fail, failed lens/rule, revision count. |
| Readiness Audit | Per-tenant go-live gates with per-gate verification links. |
11.3 Command (act on what you see)
| Surface | Makes visible / operable |
|---|---|
| Ops Overview | All tenants at a glance: pending approvals, autonomy levels, costs, quick controls (pause scope/agent, set mode, set direction). |
| Triggers | Manual buttons to fire any duty on demand — the human can always turn any crank by hand (each manual firing is a duty_run with fired_by=human). |
| Executive Board | Multi-chief command: scorecards, ledger accuracy per chief, disputes, experiments, forecast. |
| Constitutional-Human Console | The human’s own layer above all tenants: Today, Operator, Signals, Directives, Approvals, Weekly Review — the five powers as a daily-usable surface, not buried toggles (Part 8 §8.2). |
11.4 Measurement
| Surface | Makes visible |
|---|---|
| Scorecard | Metrics vs targets: green / yellow / red / insufficient (the significance gate’s UI — no confident red off n=2). |
| Target Cascade | Strategy → tenant targets → per-role KPIs → the duties that serve them, one traceable chain. |
| Experiments | Every A/B with statistical status (running / winner / stopped). |
| Entity Timeline | Any governed entity replayed across every channel (a contact, a work item, a filing) — the micro-audit companion to the org chart’s macro view. |
| Funnel / Forecast / Value Mining | Lifecycle progression, portfolio forecast vs target, SCALE/CUT/HOLD verdicts on effort. |
11.5 The conversational layer
Chat is the org’s front door and a governed actuation surface (Part 5 §5.4) — never a bolted-on bot:
- Persistent boardroom per tenant/project — durable conversation state; “why did we decide X two weeks ago?” is answerable because the room is organizational memory.
- @mention any role — mentioned roles join the thread, deliberate with each other in persona, and check each other’s claims (affirm or call BS). One thread, many governed participants.
- Uploads → pinned context — documents dropped in chat are extracted, stored, and injected as session context; an RFP in chat becomes org knowledge (Part 2 §2.5).
- Page-context grounding — the dock knows what page/project you’re on; replies are grounded in the blackboard and the knowledge fabric, not the model’s imagination.
- Chat that acts — the tool-calling runtime under the chat runs the full gauntlet; the transcript is backed by the action ledger.
- Role-scoped working chats — same runtime, narrower grants (a drafting session, a debugging session).
- Customer-facing tier kept separate — shared plumbing, never shared permissions: hard tenant isolation, minimal toolsets, validation gate on every outbound reply.
11.6 The review session (the client feedback loop)
The surface for Part 8.1-style delivery review, treating the human as the client:
- “Start review” on a real build/preview — never against the agents’ self-report.
- The walkthrough (voice / video / nitpick transcript) is recorded, appended to the record, and converted into structured issues for the org to execute.
- Definition-of-done is pinned as a ledgered artifact — feedback can amend it (new tickets through the normal gauntlet) but an agent cannot silently move its own goalposts.
- The trust receipt closes each delivery: did it do what I asked? create anything I didn’t ask for? delete anything? decide anything on my behalf? — each answered from the record.
11.7 Navigation principles
- Ubiquitous collapsible left nav — collapses inside a project/build experience, expands for governance and dashboards.
- Right-side ChatDock on every page, context-aware, collapsible.
- Buyer dashboards separated from builder surfaces: the exec rollup (compliance, health, uptime, delivery, cost across 1–N projects) is its own clean surface — “give me a rundown on all my teams across all 200 environments” — distinct from the project-specific working view.