refactor(*): replay the frontend rebuild onto main as individual commits

.github/workflows/ci.yml

@@ -438,9 +438,10 @@ jobs:
       # generated.ts is committed; a schema edit without regeneration is the
       # drift this catches. Then the transport layer compiles against it and
       # the fixture transport's behaviour is pinned by vitest.
-      - name: Check contract, types, and tests
+      - name: Check contract, lint, types, and tests
         run: |
           npm run gen:check
+          npm run lint
           npm run type-check
           npm test
         working-directory: ui-web
@@ -468,7 +469,6 @@ jobs:
           npm run --prefix ui-web build
           python3 ui-web/build.py
           node ui-web/scripts/check-page.mjs
-          node ui-web/scripts/count-shared-globals.mjs
           node ui-web/scripts/check-css.mjs
           node ui-web/scripts/check-class-namespace.mjs
 

CONTEXT-MAP.md

@@ -4,6 +4,7 @@
 
 - [Raven Runtime](./CONTEXT.md) — the Python agent runtime: channels, spine, agent loop, engines, providers
 - [TUI](./ui-tui/CONTEXT.md) — the terminal frontend (`ui-tui/`, React/Ink); talks to the Runtime only via the RPC protocol
+- [Web UI](./ui-web/CONTEXT.md) — the served page (`ui-web/`, React); talks to the Runtime only via the RPC protocol
 - [Agents over ACP](./agents/README.md) -- the agent-serving vocabulary: rendered config, state root, ACP home, tool-face pin, seed-once; `agents/BUILDING.md` is the from-zero guide
 
 ## Relationships

CONTEXT.md

@@ -439,6 +439,15 @@ parsing so a playbook can leave it for the model to fill, and `validate_and_orde
 it before any node runs. It replaces the first-line-of-the-template guess a row used to
 make.
 
+**Task** (`tasks.list`, `raven/rpc/methods/tasks.py`):
+one unit of delegated work a conversation started, as the wire lists it: a `spawn` call, or
+a `run_subagent_dag` run (a playbook run is one), each as a run-level row carrying its nodes.
+Built from the run dir, the session node registry (`subagents/nodes.json`) and the Instance
+Registry, without the live graph tool; the row's status is derived from its nodes'
+(`docs/specs/2026-09-18-desk-tasks-list-design.md`).
+_Avoid_: "task" for a spine `TurnRequest`, an asyncio task, or the `task` text handed to a
+sub-agent -- those are a Turn, a coroutine, and a prompt.
+
 **Instance Title** / **Run Title** (`InstanceRow.title` / `InstanceRow.runTitle`):
 what one instance was asked, and what the graph it belongs to was asked. Computed by
 `subagents.instances` rather than stored, the way `resumable` is and for the same reason:
@@ -2507,7 +2516,8 @@ this instance that the client never sent and so has no row of its own to anchor
 those two lanes this read is the only thing that carries any of it (the wire tags an instance
 on the four events of a *direct* turn and nothing else). Addressed by
 `(session_key, agent, handle)` through a second live index, because the first one is keyed by
-the record's directory - a task id no reader of a *conversation* ever sees.
+the record's address - the conversation's node root plus a node id no reader of a
+*conversation* ever sees.
 _Avoid_: reading the absence of live rows as "the turn ended" - a transport with no per-step
 visibility reports none for the whole of every turn.
 
@@ -2652,7 +2662,9 @@ under `agent_memory/profile/` (soul.md, agent.md) and `user_memory/profile/` (us
 
 **Onboarding** (`raven onboard` → `run_wizard`):
 The first-run wizard (LLM provider → sandbox → channel → EverOS memory → web access → sub-agents → cold-start import) that also seeds
-Agent home via `sync_workspace_templates()`; gated at startup by `ensure_configured_or_onboard()`.
+Agent home via `sync_workspace_templates()`; gated at startup by `ensure_configured_or_onboard()`. The web page has its own
+four-step wizard (model → search → agents → data sync, `ui-web/src/features/onboard/`) that opens when `setup.status` reports no
+provider; its data-sync step drives the same cold-start import over `import.*` (`raven/rpc/methods/import_sync.py`).
 
 **Bootstrap Files**:
 The identity files concatenated into every prompt — `soul.md` + `agent.md` + `TOOLS.md` —

Makefile

@@ -83,6 +83,7 @@ lint-types:
 
 lint-ui:
 	npm run gen:check --prefix ui-web
+	npm run lint --prefix ui-web
 	npm run type-check --prefix ui-web
 
 lint-tui:

agents/raven-code/run.py

@@ -477,12 +477,19 @@ def render_config(source: Path, partition: Path, mode: str | None = None, *, una
         # a reply and exits, so the gate refuses every write and every command
         # instead of prompting (measured 2026-09-08: the model could not edit
         # one line and reported the task incomplete), and trunk's own one-shot
-        # spine names this the operator's call. The ACP hosting keeps the
-        # default: raven dispatching a sub-agent answers those prompts itself,
-        # and a person in an editor should still be asked. Builtin refusals
-        # (the catastrophic-command list) hold in every mode, and an explicit
+        # spine names this the operator's call. Builtin refusals (the
+        # catastrophic-command list) hold in every mode, and an explicit
         # permissions block in a custom config wins.
         config.setdefault("permissions", {}).setdefault("mode", "full")
+    else:
+        # The ACP hosting used to inherit trunk's default because that default
+        # was the ask tier; it has since moved to smart, where a reviewer
+        # speaks for that tier and lets most of it through. That is a product
+        # decision about raven's own surfaces, and this is not one of them:
+        # the person here is in an editor, watching an agent work on their
+        # checkout, and the prompt is how they see each write before it lands.
+        # Pinned rather than inherited so the tier stops moving under them.
+        config.setdefault("permissions", {}).setdefault("mode", "ask")
 
     # Declared, not merged: the engine composes a profile per session from the
     # catalogue over session/set_mode, and --mode only picks the starting entry.