feat: establish Amnion projection-first terminal slice

[alexhraber]

Problem

Amnion needs to establish its role as the calm human-facing projection surface for governed work. A generic TUI would risk making Amnion a second execution or governance authority.

What this PR proves

• A foreground Rust + Ratatui/Crossterm application starts with governed intents as the primary unit.
• Twelve fixture/replay scenarios can be navigated with quiet default attention, progressive detail, and adjustable verbosity.
• The typed projection preserves custody identifiers, evidence references, source provenance/freshness, unknown events, malformed input diagnostics, and conflicting evidence.
• Pincher-local ready remains WaitingForEvidence; only explicit Decapod validation and proof evidence can produce ReadyForReview.
• UI controls change only ephemeral selection/detail/verbosity state. There are no local approval, promotion, proof, validation, or agent-control actions.

Ownership boundary

Amnion projects and routes attention. Pincher owns agent/provider/tool execution and runtime events. Decapod owns sessions, todos, workspaces, approvals, validation, proofs, and promotion truth. The current adapter is fixture/replay only because Pincher’s current open event payloads are not yet a published host protocol.

Implementation

• src/events.rs: provisional transport-neutral event envelope with strict parse checks.
• src/projection.rs: deterministic timestamp/event-ID ordering, duplicate idempotency, custody/evidence projection, stale/unavailable/conflict handling, unknown-event preservation.
• src/sources.rs and src/fixtures.rs: replaceable adapter boundary and twelve representative scenarios.
• src/app.rs and src/ui.rs: calm intent navigator, custody spine, meaningful activity, progressive detail, Quiet/Summary/Detailed/Debug.
• docs/adr/001-projection-first.md: architecture decision record.
• README.md: role, controls, fixture run path, limitations, and authority semantics.

Fixture scenarios

Active healthy; awaiting approval; blocked; validation failure; proof pending; authoritative ready; failed with cause; handed-off; stale; unavailable; unknown future event; conflicting/incomplete evidence.

Verification

Passed locally:

cargo fmt --check
cargo test                 # 17 tests: 15 unit + 2 integration
cargo clippy --all-targets --all-features -- -D warnings
git diff --check

Decapod orientation, session, todo claim, isolated workspace, context resolution, generated-spec refresh, and proof recording were run. The committed branch includes the 0.72.17 generated entrypoint/spec refresh. Local decapod validate --format json reaches 159 passing gates but remains blocked by the installed validator resolving root entrypoints/.decapod/README.md from the canonical checkout rather than this recognized isolated worktree, plus the expected host-side container proof gate. decapod agent.init and decapod workspace status confirm the branch/worktree and no local modifications. CI runs decapod init --proof and decapod validate from a clean checkout.

The final post-reconciliation workflow run passed both jobs: Rust checks and Decapod validation. The workflow uses decapod init --proof followed by decapod validate.

Explicit non-goals

No provider integration, agent loop, shell/tool execution, patch application, daemon, HTTP/WebSocket service, persistent Amnion governance store, local approval/promotion authority, chat product, editor, remote multi-user mode, plugin system, or speculative Pincher protocol.

Follow-on issues

• Pincher: publish the Pincher → Amnion host event contract
• Implement the real Pincher source adapter
• Enrich projections from authoritative Decapod evidence
• Add governed human-action routing
• Add conversation, workspace, and evidence drill-down views
• Add restart, recovery, and source reconciliation
• Establish Amnion’s visual language and accessibility contract

Commits

• 3275f98 feat: establish projection-first terminal slice
• 514ed47 chore: record Decapod workspace proof
• 0fb2f78 docs: clarify provisional projection adapter
• d1072cf ci: validate Rust and Decapod surfaces
• a030f1b chore: keep Decapod runtime state out of source tree
• cd8ab70 chore: exclude generated Decapod bookkeeping
• 03f6e15 chore: refresh Decapod generated specs
• 6250e36 chore: reconcile main into projection slice

[alexhraber]

Follow-on issues are now created and linked in this PR body:

• [Amnion] Publish the Pincher → Amnion host event contract pincher#3
• Add restart, recovery, and source reconciliation #3
• Implement the real Pincher source adapter #4
• Establish Amnion’s visual language and accessibility contract #5
• Add governed human-action routing #6
• Enrich Amnion projections from authoritative Decapod evidence #7
• Add conversation, workspace, and evidence drill-down views #8