|
| 1 | +# Human UX Guide |
| 2 | + |
| 3 | +`pwcli-core` treats conversational UI as a focus-preserving control plane, not a |
| 4 | +license to hide consequential state changes behind fluent text. The user should |
| 5 | +see what the system inferred, what panel or route will hydrate, what costs or |
| 6 | +risks matter, and what will happen after approval. |
| 7 | + |
| 8 | +## Progressive Disclosure |
| 9 | + |
| 10 | +Use three practical disclosure modes. |
| 11 | + |
| 12 | +### Basic |
| 13 | + |
| 14 | +Basic mode favors speed for low-risk or reversible work. It should still leave a |
| 15 | +clear receipt after execution. |
| 16 | + |
| 17 | +- read-only summaries can run directly; |
| 18 | +- reversible idempotent mutations may use one-click confirmation; |
| 19 | +- show concise source references and fallback routes after completion. |
| 20 | + |
| 21 | +### Intermediate |
| 22 | + |
| 23 | +Intermediate mode is the default for mixed human and AI workflows. It should |
| 24 | +show an intent receipt before consequential work. |
| 25 | + |
| 26 | +- display intent, confidence, side-effect level, and candidate primitive; |
| 27 | +- show cost fields, risk labels, and likely output; |
| 28 | +- require explicit approval for state changes; |
| 29 | +- return focus with a deterministic ledger event and a separate interpretation. |
| 30 | + |
| 31 | +### Advanced |
| 32 | + |
| 33 | +Advanced mode favors auditability and operator control. It should expose |
| 34 | +structured payloads and provenance. |
| 35 | + |
| 36 | +- show the full intent telemetry payload; |
| 37 | +- show source records separately from AI interpretations; |
| 38 | +- expose fallback route and execution target metadata; |
| 39 | +- require approval for irreversible or externally visible actions; |
| 40 | +- keep replay and rollback policy visible. |
| 41 | + |
| 42 | +## Primitive UX Fields |
| 43 | + |
| 44 | +Registered primitives can include optional `ux` metadata in |
| 45 | +`schemas/primitive.schema.json`. These fields do not execute behavior; they give |
| 46 | +the host application predictable labels and empty/loading/error states. |
| 47 | + |
| 48 | +Recommended fields: |
| 49 | + |
| 50 | +- `primaryAction` for the approval button label; |
| 51 | +- `previewFields` for deterministic values to show before execution; |
| 52 | +- `riskLabels` for warnings, counterplay, privacy, or compliance notes; |
| 53 | +- `costFields` for energy, money, time, quota, or approval costs; |
| 54 | +- `emptyState`, `loadingState`, and `errorState` for bounded UI copy; |
| 55 | +- `undoPolicy` for rollback expectations. |
| 56 | + |
| 57 | +## Assertion Separation |
| 58 | + |
| 59 | +Never mix factual ledger state with model interpretation. A preview panel may |
| 60 | +show both, but it should label them separately: |
| 61 | + |
| 62 | +- deterministic source or event ledger: what the state engine knows; |
| 63 | +- advisor interpretation: what a model or heuristic inferred. |
| 64 | + |
| 65 | +The deterministic ledger remains the source of truth. |
0 commit comments