Maia Desktop and mobile UI

Status: user-approved target, not implemented. The mounted shell differs: routed pages in one app shell from the Pencil core frames (Home, Workspace, Project, Session, attention, all Sessions, Nodes, Get started, settings and voice), with the scope switcher, quick navigation chips and the command dock (decision, current implementation). Exposing coordinator chats needs R3 owner and history admission; the UI ships with R9/R9a. Worker and ordinary Sessions do not get chats in this shell: the work panel hosts a cockpit and any Session opens there as a focused detail (decision).

The full Desktop app section below is the planned complete Desktop; where the older layout sections differ from D-091's routed pages, D-091 and that section govern.

This document owns the app layout, scope switching and exposed conversations. The presentation runtime owns rendering and data contracts; the client architecture owns platform and authority boundaries. Why one coordinator chat per scope: decision.

One coordinator, one work panel

The interface has three parts:

1. Top-left scope switcher: select Maia, a Workspace or a Project.
2. Left: coordinator chat: exactly one visible coordinator conversation.
3. Right: scoped work: workers, results, approvals and on-demand inspection.

There is one canonical Maia conversation, one per Workspace and one per Project. Switching scope restores that coordinator's existing history; it never creates another chat. Text and optional voice address only the selected coordinator. Users manage workers directly in the work panel, not through worker chats.

There is no permanent navigation sidebar, conversation directory, worker chat, mandatory canvas or set of top-level feature pages. Settings and details open on demand without replacing the coordinator conversation.

Desktop

+-------------------------------------------------------------------+
| [Backend v] Company A                                  [Settings] |
+-----------------------------------------+-------------------------+
| BACKEND COORDINATOR                     | WORK                    |
|                                         |                         |
| You                                     | API checks              |
| Check the API and update the docs.      | Running                 |
|                                         | [Inspect] [Manage]      |
| Backend                                 |                         |
| Both dispatched. I'll report back       | Documentation           |
| when something needs your attention.    | Running                 |
|                                         | [Inspect] [Manage]      |
|                                         |                         |
|                                         | Release                 |
|                                         | Needs approval          |
|                                         | [Review]                |
+-----------------------------------------+-------------------------+
| [Message Backend...         ] [Mic] [>] |                         |
+-----------------------------------------+-------------------------+

The chat stays on the left while a worker, result or approval opens on the right. Inspecting an item never switches coordinators. Worker management uses explicit controls; it never opens a second composer or a worker conversation. Status labels come from Node observations, not the coordinator's claims. The example states are illustrative.

Top-left switcher and Cmd+K

Clicking the scope name or pressing Cmd+K opens the same searchable launcher: one selector, one result model. It selects a scope, opens a Session of the current scope as a focused detail, or runs a command from the one command registry (decision); a leading > searches commands alone. Nothing it opens mutates without the command's own confirmation.

          +----------------------------------------+
          | Search Maia, Workspaces, Projects...   |
          +----------------------------------------+
          | RECENT                                 |
          | > Backend       Project / Company A    |
          |   Company A     Workspace              |
          |   Maia          Personal coordinator   |
          |                                        |
          | PROJECTS                               |
          |   Frontend      Project / Company A    |
          |   Website       Project / Company B    |
          +----------------------------------------+
          | Up/Down: move  Enter: open  Esc: close |
          +----------------------------------------+

• Search and recents hold only authorized, bounded results. A recent entry is not proof of access; stale or revoked entries cannot open a scope.
• Show the kind and parent Workspace so duplicate Project names are clear. Bind selection to exact Node and owner IDs, never display names.
• Selecting an entry switches both the coordinator chat and the scoped work. Loading or denial never shows one scope's chat beside another's controls.
• Arrow keys move, Enter selects, Escape closes without switching and restores focus. Support touch, keyboard and screen readers.
• Opening or searching the launcher, or reopening history, makes no model call, starts no worker and creates no Session. Missing owner or history support is visibly unavailable, never simulated with a synthetic Project or local chat store.

Mobile

The scope switcher stays at the top left. Chat is the main surface; Work opens the right panel as a sheet or focused overlay. No bottom navigation bar or separate mobile information architecture.

+--------------------------------+
| [Backend v] Company A   [Work] |
+--------------------------------+
| BACKEND COORDINATOR            |
|                                |
| You                            |
| Check the API and update docs. |
|                                |
| Backend                        |
| Both dispatched.               |
|                                |
+--------------------------------+
| [Message...        ] [Mic] [>] |
+--------------------------------+

+--------------------------------+
| WORK / BACKEND          [Close]|
+--------------------------------+
| API checks             Running |
| [Inspect] [Manage]             |
|                                |
| Documentation          Running |
| [Inspect] [Manage]             |
|                                |
| Release          Needs approval|
| [Review]                       |
+--------------------------------+

Tapping the switcher opens the same choices as a sheet. Closing Work returns to the same coordinator, history and draft. Never squeeze Desktop columns into a narrow viewport. Settings open on demand, not as a second navigation rail.

Scope, state and safety

• Each coordinator keeps its own Node-owned history. Keep a separate draft per exact scope on the current client; never move draft text to the new coordinator or persist it as shared memory without an admitted policy.
• Switching scope fences late messages, presentation updates and media from the old selection. Old capture and playback stop; the microphone for the new scope starts only on explicit activation. Submitted work keeps its identity and continues.
• Desktop and mobile can select different coordinators at once. They share permitted durable history, not selection, drafts, microphones or playback.
• The work panel shows the selected scope's authorized work. Selecting Maia or a Workspace grants no access to descendant workers, and human inspection rights never flow into the coordinator's context.
• Worker controls and approvals keep exact targets, revisions, trusted confirmation and receipts. Switching scope never retargets a pending action. Unknown outcomes stay recoverable under their original identity and are never replayed as new work.
• Show loading, empty, denied, offline, stale, AI-unavailable and error states honestly. Manual controls stay available during model outages where Node supports them; nothing optimistic replaces missing permission.
• Required approvals, failures and uncertain outcomes stay discoverable without forcing the work panel open. Useful updates may appear in chat; speech is opt-in and local to the initiating client (feedback policy).
• One exposed coordinator chat per scope deletes, merges or reparents no Session, history or worker, and removes no Node, SDK or CLI capability for ordinary Sessions.
• Reuse the json-render catalog, authored trusted controls, client-core Effect services and public SDK transports. No parallel chat backend, client-owned worker manager or model-driven navigation. Knowledge, Skill, rule or configuration inspection uses the right-side detail surface, not another menu or chat. The view-to-SDK inventory maps capabilities; it is not a menu.

Full Desktop app (planned, DP2)

DP2 is the complete Maia Desktop: every operation a person can run in the CLI, calm enough to forget it is there. It builds on D-091's routed pages, the cockpit and the client-core command registry, macOS first, then Linux and Windows. Each page and control ships only after its operation's CLI path passes; a missing operation is absent, never a decorative control.

Principles

• One place to ask. The command dock at the bottom does one thing per page, named by its placeholder: New Session on lists, an instruction on a Session page, and the person's personal agent in the selected scope once S67 ships. It never guesses intent: Return submits, Shift+Return adds a line, a leading > runs a command, and Cmd+K opens the launcher. One command registry serves the dock, launcher, menu bar and shortcuts.
• Outcomes first, machinery on request. Pages speak in Projects, tasks, Agents and what needs the person, never in harnesses, leases, revisions or IDs. Every item has Details (Cmd+I) with its exact IDs, revision, receipts, harness, model, cost and the equivalent CLI command to copy. Nothing is hidden from someone who asks; nothing technical shows by default. Home leads with what needs the person, or says nothing does.
• Minimal chrome. No sidebar, tab bar or toolbar rows: the scope pill top left, attention and account top right, content centered, the dock at the bottom; page actions (at most five, each with its key) show only while the dock has focus. One primary action per view. Native conventions: system font, light and dark, a menu bar listing every command with its shortcut.
• One window. Cmd+W hides it and Node work continues; relaunch restores size, route and scope. A second window needs per-window route and draft isolation first, so Cmd+N stays unbound.
• Calm and honest. Motion only explains a change, takes at most 200 ms and is off under reduced motion; the attention count is the only badge. Status comes from Node observations, and every page shows the nine failure and recovery states plainly.
• Enterprise without clutter. A role-gated command stays in the registry, menu and shortcut sheet, disabled with a one-line reason (role, grant, hold or pause); only organization pages (people, roles, audit search, ORG1–ORG6) leave navigation for people without the role. Audit uses the list template with Details and the copyable CLI command, never a client-only export.

Keyboard (mandatory)

• Every journey completes from the keyboard alone; no action is pointer-only.
• Shortcuts come from the one command registry, whose default keymap is conflict-tested; Settings lists and rebinds it under the same check. Keys: Cmd+K launcher, Cmd+L focus the dock, Cmd+[ and Cmd+] back and forward, Cmd+I details, Cmd+, settings, ? or Cmd+/ the shortcut sheet, Escape closes the top layer and returns focus, / filters the list, [ and ] turn pages, and the registry's single-letter keys act on the selected item (j and k move, Return opens), so lists have no type-to-select.
• In a text field only Cmd chords, Escape and Tab act, and no key acts during input-method composition. Every command is also in the menu and launcher, so none depends on one keyboard layout.
• The menu bar is generated from the registry and shows each chord as text; it registers no native accelerator. A menu choice sends one command ID to the renderer over one reviewed event, so the renderer's keymap stays the only resolver.
• A consequential change opens DP1's native confirmation sheet (D-076): no accelerator approves, Approve is disabled for 750 ms, then Tab reaches it and Space approves; Return never approves and Escape cancels.
• Cmd+=, Cmd+- and Cmd+0 scale text from 80% to 200% without clipping; Settings offers comfortable or compact rows. Focus is always visible, restored when a layer closes and never lost on a live update.

Performance (mandatory release gates)

DP2a adds these metrics to the M0 catalog and measures them in the real Tauri app on a named reference Mac (Apple silicon, base configuration, 60 Hz display) with the DF-20 fixture and a live local Node, one authorized scripted run per release; headless Chromium numbers are a labeled pre-gate, never Tauri evidence. A miss, or an M0 regression verdict of 10% or more against the previous release, fails the release. These tighten the qualification targets:

• One frame (17 ms) is the stretch target for input. Data that arrives after the shell is interactive reports its completion time without a gate.
• The local UI answers at once: a sent message shows as sending, and data already loaded in this run renders immediately, marked stale until the Node confirms; no domain data is written to disk. A prefetch of the focused item's next page uses at most one bridge slot and is cancelled by any user action. Nothing optimistic invents an outcome, permission or health.
• Lists page by the window's row count (D-091); only timelines and logs virtualize. The renderer's initial bundle has a recorded ceiling, raised only with a reason, as the CLI standalone's is.

Design source

The owner's Pencil canvas is the starting baseline, not the final design. Where a frame contradicts these principles, the principles win. Known gaps: placeholder icons, chips without keys, harness, model, run and token details shown by default, two primary buttons on one page, stat tiles repeating list counts, a chart without axes or accessible values, an empty Home, no role or permission context, no organization pages, and few empty, error and offline states. Agents improve it in reviewed revisions of a copy, as ordinary Maia tasks a person approves; DP2 implements each approved revision, and dogfooding drives the next one.

Acceptance

• A keyboard-only suite runs every DP2 journey (ask, switch scope, open a Session, send, stop, approve through the native sheet, review a diff, pause and resume, settings) with no pointer event; every command has a menu item and a shortcut-sheet entry, and a keymap conflict fails the check.
• The performance gates pass in the real Tauri app on the reference Mac in three consecutive authorized runs.
• A mechanical check finds no control whose operation lacks a passing CLI path in the protocol registry.
• Every page and the dock pass through the nine failure and recovery states; a denied, stale or offline state never shows a working control.
• VoiceOver names every control; contrast meets WCAG 2.2 AA in light and dark; reduced motion removes every animation; text at 200% clips nothing.
• Closing or reopening Desktop never stops Node work.

Acceptance for implementation

• Exactly one coordinator chat per Maia, Workspace and Project scope; launcher Session entries open the focused detail in the work panel, never a second chat.
• Top-left click and Cmd+K open the same selector. Test search, recents, duplicate names, zero results, keyboard and screen-reader use, and revoked access.
• Selecting a scope restores its exact history and matching work panel. Test rapid switching, denied or loading history, late results and independent client selections.
• Worker inspection and controls stay on the right or in the mobile Work sheet; they never replace the coordinator or create a worker chat.
• Drafts, old voice callbacks, pending confirmations and uncertain receipts never leak or move across scope switches. Reopening never duplicates submitted work.
• Compact layouts, the software keyboard, accessible overlays and focus return keep the same model without permanent sidebars or hidden required outcomes.
• Test AI outage, offline and stale state, reconnect and UI closure without inventing health, bypassing confirmation or stopping admitted Node work. Native and mobile claims need platform evidence.