From 8933148719528d17e6681e6ac9d7d31ae727c54d Mon Sep 17 00:00:00 2001
From: shad <shad@flow-master.ai>
Date: Sun, 14 Jun 2026 13:11:54 +0400
Subject: [PATCH] fix(curation): kill dev-artefact leak + rename agent honestly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Oracle remediation batch 1 — closing gaps #1 (agent overclaim), #4
(demo-data leak), #5 (raw-ID exposure):

- src/lib/flowCuration.ts: shared isDevArtefact + curatedPublishedFlows
  filter for the whole codebase. Patterns drop rv_/orphan/Atlas F1/MCP
  SDX/Codex Test/sidekick/process_<ts>/backfill/smoke/probe/fixture and
  the EA2_* internal source_contexts.
- src/scenes/Hub.tsx: loadPublishedFlows uses the shared curator
- src/lib/agentTools.ts: list_processes and start_process both use the
  shared curator; raw transaction_id no longer in start reply
- src/state/store.ts: snapshot + live merges curated; resolveDefaultStepId
  guards against scenarios whose defaultStepId references a stale step
- src/scenes/Wizard.tsx: 'Process definition <hex>' confirmation replaced
  with the user-facing process name
- src/scenes/Hub.tsx: start toast no longer shows transaction_id prefix
- src/scenes/Agent.tsx + App.tsx + Landing.tsx: rename Pi -> FlowMaster
  Command Assistant. Welcome message says explicitly that this is a
  deterministic router and the LLM agent + tenant memory are on the
  roadmap. Tab label, hub chip, turn author all rebranded.
- src/scenes/GeoAttendance.tsx: scene re-titled to 'Attendance map ·
  preview' with honest copy explaining the dataset is illustrative until
  the EA2 attendance feed is wired in.
- src/data/synthetic.ts: orphaned from runtime (kept in tree for tests).
  Snapshot now sources only the live-cached EA2 read (scenarios.json),
  filtered through the same curator.

29/29 tests green. No more 'rv test flow 0' / 'orphan' / 'Atlas F1' / raw
32-char hex IDs visible to a buyer.
---
 src/App.tsx                  |  2 +-
 src/lib/agentTools.ts        | 21 ++++++-------
 src/lib/flowCuration.ts      | 58 ++++++++++++++++++++++++++++++++++++
 src/scenes/Agent.tsx         | 11 +++----
 src/scenes/GeoAttendance.tsx |  6 ++--
 src/scenes/Hub.tsx           | 30 ++++++-------------
 src/scenes/Landing.tsx       |  2 +-
 src/scenes/Wizard.tsx        |  2 +-
 src/state/store.ts           | 25 ++++++++++++----
 9 files changed, 109 insertions(+), 48 deletions(-)
 create mode 100644 src/lib/flowCuration.ts

diff --git a/src/App.tsx b/src/App.tsx
index 486619c..de2c08d 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -80,7 +80,7 @@ export default function App() {
               <Bot size={13} /> Chat
             </button>
             <button role="tab" aria-selected={scene === "agent"} className={`tab${scene === "agent" ? " tab-sel" : ""}`} onClick={() => setScene("agent")}>
-              <Bot size={13} /> Pi
+              <Bot size={13} /> Assistant
             </button>
             <button role="tab" aria-selected={scene === "settings"} className={`tab${scene === "settings" ? " tab-sel" : ""}`} onClick={() => setScene("settings")}>
               <Cog size={13} /> Settings
diff --git a/src/lib/agentTools.ts b/src/lib/agentTools.ts
index 0d9c389..f3d037b 100644
--- a/src/lib/agentTools.ts
+++ b/src/lib/agentTools.ts
@@ -1,6 +1,7 @@
 import { api } from "./api";
 import { wizardApi } from "./wizardApi";
 import { chatApi } from "./chatApi";
+import { curatedPublishedFlows } from "./flowCuration";
 
 export interface ToolResult {
   ok: boolean;
@@ -72,19 +73,17 @@ const TOOLS: ToolDef[] = [
       const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=200`, {
         headers: { Authorization: `Bearer ${sessionStorage.getItem("fm.mc.token.v1")}` },
       }).then((r) => r.json());
-      const items: any[] = procs?.items || [];
+      const items = curatedPublishedFlows((procs?.items || []) as any[]);
       const norm = (s: string) => s.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
       const target = norm(processName);
-      const match = items
-        .filter((it) => it.status === "published" && it.kind === "definition")
-        .find((it) => norm(it.display_name || "").includes(target) || norm(it.name || "").includes(target));
+      const match = items.find((it) => norm(it.display_name || "").includes(target) || norm(it.name || "").includes(target));
 
       if (!match) return { ok: false, display: `Couldn't find a published process matching "${processName}". Try the Studio to create one.` };
       try {
         const res = await wizardApi.startInstance(match._key, subject);
         return {
           ok: true,
-          display: `Started ${match.display_name}${subject ? ` for ${subject}` : ""}. Transaction ${res.transaction_id?.slice(0, 8) || "ok"}.`,
+          display: `Started ${match.display_name}${subject ? ` for ${subject}` : ""}.`,
           data: res,
         };
       } catch (e: any) {
@@ -129,12 +128,14 @@ const TOOLS: ToolDef[] = [
     description: "List published processes for this tenant",
     matcher: /^(list|show|what)\s+(processes|workflows|flows)/i,
     async run() {
-      const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=20`, {
+      const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=200`, {
         headers: { Authorization: `Bearer ${sessionStorage.getItem("fm.mc.token.v1")}` },
-      }).then((r) => r.json());
-      const published = (procs?.items || []).filter((it: any) => it.status === "published" && it.kind === "definition").slice(0, 10);
-      if (!published.length) return { ok: true, display: "No published processes yet. Build one in the Studio." };
-      const lines = published.map((it: any) => `• ${it.display_name || it.name}`).join("\n");
+      })
+        .then((r) => r.json())
+        .catch(() => ({ items: [] }));
+      const published = curatedPublishedFlows((procs?.items || []) as any[]).slice(0, 10);
+      if (!published.length) return { ok: true, display: "No published processes yet. Open the Studio to design one." };
+      const lines = published.map((it) => `• ${it.display_name}`).join("\n");
       return { ok: true, display: `Here's what's published:\n${lines}` };
     },
   },
diff --git a/src/lib/flowCuration.ts b/src/lib/flowCuration.ts
new file mode 100644
index 0000000..80dd22e
--- /dev/null
+++ b/src/lib/flowCuration.ts
@@ -0,0 +1,58 @@
+export interface RawFlow {
+  _key: string;
+  display_name?: string;
+  name?: string;
+  description?: string;
+  source_context?: string;
+  status?: string;
+  kind?: string;
+}
+
+const DEV_ARTEFACT_PATTERNS = [
+  /^rv[_\s]/i,
+  /^orphan/i,
+  /^atlas[_\s]?f1/i,
+  /\batlas-f1-fresh\b/i,
+  /mcp[_\s]?sdx[_\s]?smoke/i,
+  /\bcodex[_\s]?test\b/i,
+  /\bsidekick\b/i,
+  /^process_\d{10,}$/i,
+  /\bbackfill\b/i,
+  /\bsmoke[_\s]?test\b/i,
+  /\bprobe\b/i,
+  /\bfixture\b/i,
+];
+
+const NON_BUSINESS_SOURCE_CONTEXTS = new Set([
+  "EA2_CHAT_THREAD",
+  "EA2_CHAT_MSG",
+  "EA2_WIZARD_STEP",
+  "EA2_DRAFT_PROCESS:process_creation",
+]);
+
+const HEX32 = /[a-f0-9]{32}/gi;
+const HEX_SUFFIX = /[_-][a-f0-9]{8,}$/i;
+
+export function isDevArtefact(f: RawFlow): boolean {
+  if (f.source_context && NON_BUSINESS_SOURCE_CONTEXTS.has(f.source_context)) return true;
+  const haystack = `${f.display_name || ""} ${f.name || ""} ${f.description || ""}`;
+  return DEV_ARTEFACT_PATTERNS.some((p) => p.test(haystack));
+}
+
+export function curatedPublishedFlows<T extends RawFlow>(items: T[]): T[] {
+  return items.filter(
+    (it) => it.status === "published" && it.kind === "definition" && !!it.display_name && !isDevArtefact(it)
+  );
+}
+
+export function friendlyShortId(id: string | undefined | null): string {
+  if (!id) return "";
+  const trimmed = id.replace(HEX_SUFFIX, "");
+  if (trimmed.length < id.length && trimmed.length > 0) return trimmed;
+  if (HEX32.test(id)) return `ref-${id.slice(0, 4)}`;
+  return id;
+}
+
+export function scrubIdsFromText(text: string): string {
+  return text.replace(HEX32, "");
+}
diff --git a/src/scenes/Agent.tsx b/src/scenes/Agent.tsx
index 85186ae..ffe8fbf 100644
--- a/src/scenes/Agent.tsx
+++ b/src/scenes/Agent.tsx
@@ -28,7 +28,7 @@ export default function Agent() {
       role: "agent",
       ok: true,
       text:
-        `Hi ${userEmail.split("@")[0]}. I'm Pi — your FlowMaster co-pilot. I can navigate the cockpit, start processes, message your team, and walk you through the Studio.`,
+        `Hi ${userEmail.split("@")[0]}. I'm the FlowMaster Command Assistant. I understand a fixed set of commands today and run them against the real EA2 backend — navigate, list processes, start a process, message a teammate, open the Studio. A natural-language LLM and per-tenant memory are on the roadmap.`,
     },
   ]);
   const [draft, setDraft] = useState("");
@@ -63,8 +63,9 @@ export default function Agent() {
     <div className="agent-scene">
       <aside className="agent-sidebar">
         <header className="agent-side-head">
-          <div className="mc-hero-eyebrow"><Bot size={12} /> Pi — FlowMaster Agent</div>
-          <h2 className="mc-hero-title">Talk to your cockpit</h2>
+          <div className="mc-hero-eyebrow"><Bot size={12} /> FlowMaster Command Assistant</div>
+          <h2 className="mc-hero-title">Tell the cockpit what to do</h2>
+          <p className="agent-side-sub">Deterministic command router today. An LLM-backed agent with per-tenant memory is the next milestone.</p>
         </header>
         <div className="agent-tool-list">
           <div className="agent-tool-label">CAPABILITIES</div>
@@ -84,11 +85,11 @@ export default function Agent() {
         <div className="agent-messages" ref={scrollRef}>
           {turns.map((t) => (
             <div key={t.id} className={`agent-turn agent-turn-${t.role}${t.ok === false ? " agent-turn-err" : ""}`}>
-              <div className="agent-turn-author">{t.role === "user" ? userEmail.split("@")[0] : "Pi"}</div>
+              <div className="agent-turn-author">{t.role === "user" ? userEmail.split("@")[0] : "Assistant"}</div>
               <div className="agent-turn-body">{t.text}</div>
             </div>
           ))}
-          {working && <div className="agent-turn agent-turn-agent agent-turn-thinking">Pi is thinking…</div>}
+          {working && <div className="agent-turn agent-turn-agent agent-turn-thinking">Working…</div>}
         </div>
 
         {turns.length <= 1 && (
diff --git a/src/scenes/GeoAttendance.tsx b/src/scenes/GeoAttendance.tsx
index 9578c44..f4b1701 100644
--- a/src/scenes/GeoAttendance.tsx
+++ b/src/scenes/GeoAttendance.tsx
@@ -69,10 +69,10 @@ export default function GeoAttendance() {
   return (
     <div className="geo-scene">
       <header className="geo-head">
-        <div className="mc-hero-eyebrow"><Pulse size={12} /> Real-time attendance</div>
-        <h2 className="mc-hero-title">Where your people are right now</h2>
+        <div className="mc-hero-eyebrow"><Pulse size={12} /> Attendance map · preview</div>
+        <h2 className="mc-hero-title">Where your people are</h2>
         <p className="geo-intro">
-          Live attendance for stores, offices, and warehouses. Click a marker to see who's checked in and when. Powered by OpenStreetMap tiles — no proprietary mapping key required.
+          Preview of the manager attendance view. Markers are illustrative until the attendance feed is wired up against the EA2 runtime; once connected, statuses come from real check-in events. Tiles are served by OpenStreetMap.
         </p>
         <div className="geo-stats">
           <span className="geo-stat geo-stat-ok">{stats.onSite} on-site</span>
diff --git a/src/scenes/Hub.tsx b/src/scenes/Hub.tsx
index bb1050d..f58c463 100644
--- a/src/scenes/Hub.tsx
+++ b/src/scenes/Hub.tsx
@@ -2,6 +2,7 @@ import { useEffect, useState } from "react";
 import { useApp } from "../state/store";
 import { api } from "../lib/api";
 import { wizardApi } from "../lib/wizardApi";
+import { curatedPublishedFlows } from "../lib/flowCuration";
 import { Branch, Layers, Pulse } from "../components/icons";
 
 export type HubKey = "procurement" | "hr" | "it";
@@ -57,32 +58,18 @@ interface PublishedFlow {
   name?: string;
 }
 
-const NON_BUSINESS_SOURCE_CONTEXTS = new Set([
-  "EA2_CHAT_THREAD",
-  "EA2_CHAT_MSG",
-  "EA2_WIZARD_STEP",
-]);
-
 async function loadPublishedFlows(): Promise<PublishedFlow[]> {
   const res = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=200`, {
     headers: { Authorization: `Bearer ${sessionStorage.getItem("fm.mc.token.v1")}` },
   });
   if (!res.ok) throw new Error(`processes ${res.status}`);
   const body = await res.json();
-  return ((body?.items || []) as any[])
-    .filter(
-      (it) =>
-        it.status === "published" &&
-        it.kind === "definition" &&
-        it.display_name &&
-        !NON_BUSINESS_SOURCE_CONTEXTS.has(it.source_context)
-    )
-    .map((it) => ({
-      _key: it._key,
-      display_name: it.display_name,
-      description: it.description,
-      name: it.name,
-    }));
+  return curatedPublishedFlows((body?.items || []) as any[]).map((it) => ({
+    _key: it._key,
+    display_name: it.display_name!,
+    description: it.description,
+    name: it.name,
+  }));
 }
 
 export default function Hub({ hub }: { hub: HubKey }) {
@@ -110,7 +97,8 @@ export default function Hub({ hub }: { hub: HubKey }) {
     setBusy(flowKey);
     try {
       const res = await wizardApi.startInstance(flowKey, subject);
-      pushToast("ok", `Started ${label}${subject ? ` for ${subject}` : ""} — ${res.transaction_id?.slice(0, 8) || "ok"}`);
+      void res;
+      pushToast("ok", `Started ${label}${subject ? ` for ${subject}` : ""}.`);
       setScene("mission");
     } catch (err: any) {
       pushToast("err", `Start failed: ${err.message}`);
diff --git a/src/scenes/Landing.tsx b/src/scenes/Landing.tsx
index ed2fc09..09d712b 100644
--- a/src/scenes/Landing.tsx
+++ b/src/scenes/Landing.tsx
@@ -80,7 +80,7 @@ export default function Landing() {
             <button className="hub-chip" onClick={() => setScene("hub-hr")}>People Hub</button>
             <button className="hub-chip" onClick={() => setScene("hub-it")}>IT Hub</button>
             <button className="hub-chip" onClick={() => setScene("geo-attendance")}>Attendance Map</button>
-            <button className="hub-chip" onClick={() => setScene("agent")}>Talk to Pi</button>
+            <button className="hub-chip" onClick={() => setScene("agent")}>Command Assistant</button>
             <button className="hub-chip" onClick={() => setScene("chat")}>Team Chat</button>
             <button className="hub-chip" onClick={() => setScene("explainer")}>What is FlowMaster?</button>
           </div>
diff --git a/src/scenes/Wizard.tsx b/src/scenes/Wizard.tsx
index a5ac3cc..707ed34 100644
--- a/src/scenes/Wizard.tsx
+++ b/src/scenes/Wizard.tsx
@@ -403,7 +403,7 @@ export default function Wizard() {
              <div className="wizard-panel success-panel">
                 <div className="success-icon"><Check size={32} /></div>
                 <h3 className="panel-h">Process Published!</h3>
-                <p>Process definition <code>{publishedKey}</code> is now active in EA2.</p>
+                <p>Your process <strong>{draft.name || "Untitled"}</strong> is now active and ready to run.</p>
                 <div className="actions-row">
                      <button className="btn btn-secondary" onClick={() => { setDraft({ step: "Intake", name: "", description: "", nodes: [], edges: [], fields: [], rules: [] }); setPublishedKey(null); }}>Create Another</button>
                      <button 
diff --git a/src/state/store.ts b/src/state/store.ts
index a413a8e..329de94 100644
--- a/src/state/store.ts
+++ b/src/state/store.ts
@@ -1,7 +1,19 @@
 // Global UI state for Mission Control.
 import { create } from "zustand";
 import { liveScenarios as snapshotLive } from "../data/live";
-import { syntheticScenarios } from "../data/synthetic";
+import { isDevArtefact } from "../lib/flowCuration";
+const syntheticScenarios: any[] = [];
+
+function curateScenarios(rows: ProcessScenario[]): ProcessScenario[] {
+  return rows.filter((s) => !isDevArtefact({ _key: s.defKey, display_name: s.defName, name: s.defKey }));
+}
+
+function resolveDefaultStepId(scenario: ProcessScenario | undefined): string | null {
+  if (!scenario) return null;
+  const ids = new Set(scenario.steps.map((s) => s.id));
+  if (scenario.defaultStepId && ids.has(scenario.defaultStepId)) return scenario.defaultStepId;
+  return scenario.steps[0]?.id ?? null;
+}
 import { buildLiveScenariosFromApi } from "../lib/buildScenarios";
 import { api, type ApiCall, type Actor } from "../lib/api";
 import type { ProcessScenario } from "../data/types";
@@ -110,7 +122,7 @@ interface AppState {
   startInstance: (defKey: string, businessSubject?: string) => Promise<string | null>;
 }
 
-const SNAPSHOT_SCENARIOS: ProcessScenario[] = [...snapshotLive, ...syntheticScenarios];
+const SNAPSHOT_SCENARIOS: ProcessScenario[] = curateScenarios([...snapshotLive, ...syntheticScenarios]);
 const initialScenario = SNAPSHOT_SCENARIOS[0];
 
 let toastSeq = 0;
@@ -132,7 +144,8 @@ async function runLiveFetch(
       });
     }
     const { scenarios, workItems, distinctDefs } = await buildLiveScenariosFromApi();
-    const merged = [...scenarios, ...syntheticScenarios];
+    const curatedLive = curateScenarios([...scenarios, ...syntheticScenarios]);
+    const merged = curatedLive.length > 0 ? curatedLive : SNAPSHOT_SCENARIOS;
     const first = merged[0];
     const currentId = get().scenarioId;
     const currentStepId = get().selectedStepId;
@@ -145,13 +158,13 @@ async function runLiveFetch(
       liveFetchedAt: Date.now(),
       liveLoading: false,
       scenarioId: nextScenario?.id ?? currentId,
-      selectedStepId: stepStillThere ? currentStepId : nextScenario?.defaultStepId ?? null,
+      selectedStepId: stepStillThere ? currentStepId : resolveDefaultStepId(nextScenario),
     });
     get().pushToast(
       "ok",
       prevMode === "live"
-        ? `Refreshed · ${scenarios.length} live + ${syntheticScenarios.length} blueprint scenarios`
-        : `Live mode · ${scenarios.length} live + ${syntheticScenarios.length} blueprint scenarios`,
+        ? `Refreshed · ${scenarios.length} live processes`
+        : `Live mode · ${scenarios.length} live processes`,
     );
   } catch (e) {
     set({ liveLoading: false, liveError: (e as Error).message, mode: "snapshot", scenarios: SNAPSHOT_SCENARIOS });