Branch I — Prototype Plan (5 stages)

Five staged steps from static wireframe to a live WF-001 pilot. Each stage has an explicit acceptance gate; no stage starts until the prior passes. Gating prerequisite for stages 3–5: the human Điều-32 EXTEND commit (Phase 1 doc 02) and read-DOT registration.

---

Stage 1 — Static wireframe

• Scope: Claude Design produces the 8 components (doc 07 §8) as static, data-less wireframes (light theme locked; dark variant via token pairs). Resolve T1 label; design the reorder + comment/audio gaps.
• Owner: Claude Design.
• Acceptance:
  • All 4 surfaces + proposal overlay drawn; one-frame-six-tier honored (no per-tier layout).
  • Token sheet (light+dark) finalized; traffic-light triplet shown in both themes.
  • No "Sửa trực tiếp" button anywhere; "Đề xuất cải tiến" present on every card.
  • Task Card uses 4-level progressive disclosure.

Stage 2 — Interactive mock with mocked JSON

• Scope: Claude Code builds the render shell driven by mocked CanvasNode[]/CanvasContext JSON matching doc 03 exactly. Tier tabs, breadcrumb, drill, child-expand, proposal-mode toggle, filters all work against the mock. No backend.
• Owner: Claude Code (shell) + Design (polish).
• Acceptance:
  • Switching tier swaps only data, never layout.
  • Drill-down/up + breadcrumb consistent with CanvasContext.
  • Proposal mode opens add/edit/delete/reorder forms; "Gửi đề xuất" produces a mock proposal object with auto-captured context.
  • Virtualized grid renders a 10k-row mock without jank (keyset paging).
  • All empty/loading/error/large-guard states render the contract strings.

Stage 3 — Backend-connected read-only shell

• Prereq: EXTEND committed + read DOTs registered + canvas read DOTs (get_nodes/get_context/drill_down/get_task_card) implemented & catalog-registered with paired tests. Live-PG reuse-first survey done.
• Scope: swap mock JSON for live read DOTs via Directus. Read-only: list/get/health/validate/render_tree/audit + canvas nav. Permission chips from permission_actions.
• Owner: Claude Code.
• Acceptance:
  • Doc 08 test cases 1,2,4,6,7,9,10 pass against live read PG.
  • Pre-agg v_mow_design_workflow returns page-1 of large set under latency target.
  • A read-only role sees only view; no mutate chips; forged mutate rejected.
  • 🔴 dangling-ref rolls up correctly; no partial silent lists.

Stage 4 — DOT-action proposal mode

• Prereq: mutating DOT subset (propose_change at minimum) implemented + registered + governance spine wired; no activation without ≥2 human cross-signs.
• Scope: enable Proposal Mode end-to-end: dot_mow_design_propose_change writes workflow_change_requests (draft); cockpit shows the proposal + diff; binds (owner) where approved.
• Owner: Claude Code + council (approval).
• Acceptance:
  • Propose add/edit/delete/reorder creates a real draft row with auto-captured context; proposal_count increments after re-fetch (no optimistic stale).
  • Agent self-approval blocked (test case 3).
  • Approve/reject only by council writing apr_approvals; rejected proposal stays auditable.
  • No optimistic governance updates.

Stage 5 — Pilot with WF-001

• Prereq: Stages 1–4 green; binds + activate/rollback DOTs available; ≥2 human approvers staged.
• Scope: run the WF-001 "Quy trình duyệt công việc" pilot (10 steps, BPMN-rich) through the UI: bind design IU → bind 10 step IUs/guides → bind dot_ref/event refs → validate 🟢 → render tree → (council) activate → audit.
• Owner: Claude Code + designer + council.
• Acceptance (mirrors Phase 1 doc 09 §4):
  • v_mow_design_workflow id=1: owner_gov_code='GOV-MOW', bound_step_count=10=step_count, light 🟢.
  • v_mow_design_step: all 10 is_iu_bound=true; dot_ref/event refs resolve; dangling sweep all 0.
  • Governance: ≥2 apr_approvals for activation; audit shows propose→approve→activate.
  • UI Surfaces 1/3 render WF-001 🟢 with drill-down to IUs; Surface 2 opens its task card.
  • Full reversibility proven: pre-activation un-bind (set NULL) + soft-retire minted IUs; post-activation dot_mow_design_rollback(1, to_version=4) forward-only; legacy inline columns untouched until VALIDATE.

---

Stage gate summary

Stage	Backend dependency	Mutates?	Gate
1 Static wireframe	none	no	design review
2 Mocked JSON	none	no	shell == contract
3 Read-only shell	EXTEND commit + read DOTs	no	live read tests pass
4 Proposal mode	propose_change DOT + spine	yes (draft only)	proposal+approval works, agent blocked
5 WF-001 pilot	bind/activate/rollback + ≥2 approvers	yes (governed)	WF-001 🟢 + reversible

Prototype plan verdict

READY. Five stages (static wireframe → mocked JSON → read-only shell → DOT proposal mode → WF-001 pilot) each carry scope, owner, prerequisite, and explicit acceptance. The runtime/mutation boundary is respected: stages 1–3 mutate nothing; stage 4 only drafts; stage 5 is governed + reversible.