// The intake walk (AI-2): plain questions in, a proposed manifest out.
//
// WHAT THIS SCREEN IS
//
// The requester answers a fixed checklist in their own words. A model reads
// those answers and proposes a set of risks — or, when it cannot, a keyword
// classifier does. The requester sees the proposal, changes whatever they
// disagree with, confirms it, and the confirmed manifest goes through the same
// pre-flight and the same recorded act as one typed by hand. Nothing proceeds
// on a manifest the requester has not seen and submitted themselves —
// intake.py's own words.
//
// FOUR RULES, and every one of them is a promise the screen keeps rather than
// a decoration:
//
// 1. NOTHING PROPOSED LOOKS CONFIRMED. Every risk the classifier proposes is
// drawn PENDING — amber, hatched, carrying the word — until a named person
// confirms it. The moment they do, it stamps. That difference is the whole
// reason a proposal is safe to show at all.
//
// 2. WHOSE WORDS ARE ON THE SCREEN IS NEVER AMBIGUOUS. The oversized serif
// quotation mark in this product means A PERSON SAID THIS. On the word-list
// path the justification IS the requester's own sentence, quoted, and gets
// the mark. On the model path it is the model's reasoning, and it does not
// — it is set plainly and labelled. Wrapping a machine's sentence in the
// idiom that means a human wrote it would be the exact failure this
// product sells against, on its own screen.
//
// 3. THE DISCLOSURE TELLS THE TRUTH ABOUT WHICH PATH RAN. Two paths reach
// this screen. A model reads the answers and proposes the risks (AI-3);
// when it cannot — no key, no network, the day's budget spent — a keyword
// classifier does it instead, and the requester is told so, with the
// reason.
//
// Both labels are permanent, plain, and in the reading order: not a
// tooltip, not an icon, not a footer (NC-14). And the label MATCHES what
// happened, every time. An "AI proposed this" badge over a word-list
// result is the same defect as no badge at all — it teaches people the
// badge means nothing.
//
// 4. THE SOURCE COMES FROM THE ENDPOINT, and is 'llm' or 'fallback'. It is
// not decided here. Both are values cw.run.manifest_source accepts, and
// the difference survives into the run record permanently: "a model
// proposed this and a named person confirmed it" and "a word list matched
// it and a named person confirmed it" are different answers to the
// question somebody asks six months later.
//
// 5. A PROPOSAL IS REUSED UNTIL ITS SOURCE CHANGES. The server retains the
// exact answer and exact inputs privately for the requester. Revisiting
// this pane reads that record; it never asks the model merely because the
// component mounted. Editing an answer clears the visible proposal at
// once, and the server also invalidates it when the deal, category
// library, or intake-walk file changes.
const { useState, useEffect } = React;
// One answer per probe, held by probe id. Blank answers are dropped on the way
// out: the endpoint refuses an intake that is entirely blank, and sending
// empty strings would spend that refusal on an accident.
function answersFrom(text) {
return Object.entries(text)
.map(([probe, value]) => ({ probe, text: String(value || '').trim() }))
.filter((a) => a.text);
}
function textFromAnswers(answers) {
return Object.fromEntries((answers || []).map((answer) => [answer.probe, answer.text]));
}
// ── The disclosure, before anybody writes anything ────────────────────────
// Permanent, plain, and in the reading order — not a tooltip, not an icon, not
// a footer (NC-14). It sits above the questions because that is where somebody
// decides how much to write, and knowing a model will read it changes that.
function HowThisWorks({ version }) {
return (
how your answers are read
An AI model reads what you write here and proposes which risks the
purchase raises. It chooses only from the risk categories your library
already defines — it cannot invent one, and anything it proposes that
your library does not define is listed rather than used. It proposes;
it decides nothing. Its proposal is saved privately so returning to
this page does not ask again; nothing becomes a manifest or moves the
deal forward until you confirm it below.
{version && <> The question set is version {version}.}
);
}
// ── And afterwards: which path actually ran ───────────────────────────────
// THE LABEL MATCHES WHAT HAPPENED. The endpoint says whether the model
// answered or the word lists did, and says why when it was the word lists.
// A proposal from a keyword match wearing an "AI" label would be worse than
// no label, because the next one people see would mean nothing either.
function WhatProposedThis({ source, absence }) {
const byModel = source === 'llm';
return (
{byModel ? 'proposed by the model' : 'proposed by word lists'}
{byModel ? 'model answered' : 'model not used'}
{byModel
? <>A model read your answers and proposed the risks below, with its
reasoning beside each. Read them: it is proposing, and you are
deciding.
: <>The model did not answer, so your words were matched against
Legal's word lists instead — a simpler method that only spots
phrases somebody thought of in advance. Check the list below more
carefully than usual, and add anything it missed.
{absence && <> {absence}}}
);
}
// ── One proposed risk ─────────────────────────────────────────────────────
// PENDING until confirmed, and the word says so beside the ink. The
// requester's own quoted words are the justification — quoted, not summarised,
// which is why they are in the serif quotation marks the rest of the product
// uses for a person speaking.
function ProposedRisk({ risk, confirmed, byModel, onChange, onDrop }) {
return (
{/* WHOSE SENTENCE THIS IS, drawn differently because it IS different.
On the word-list path the justification is the requester's own answer,
quoted — so it gets the oversized teal quotation mark, which in this
product means A PERSON SAID THIS.
On the model path it is the model's reasoning about what the requester
wrote. It is set plainly and labelled. Putting a machine's sentence
inside the human-voice idiom would be the precise failure this product
exists to prevent, committed on its own screen. */}
{byModel ? (
the model's reasoning
{risk.justification || 'No reasoning was given.'}
) : (
“
{risk.justification}
)}
);
}
// ── The pane ──────────────────────────────────────────────────────────────
function IntakePane({ me }) {
const deals = usePane(() => API.deals());
const walk = usePane(() => API.intakeProbes());
const library = usePane(() => API.library());
const classifications = usePane(() => API.intakeClassifications());
// The person's writing survives a tab change locally. The classifier's
// reply survives a later signed-in session in PostgreSQL and is restored
// only when every source input still matches.
const [dealId, setDealId] = useRetainedState('intake:deal', '');
const [text, setText] = useRetainedState('intake:answers', {});
const [proposal, setProposal] = useState(null); // the classifier's reply
const [risks, setRisks] = useState([]); // what the person will submit
const [confirmed, setConfirmed] = useState(false);
const [assembled, setAssembled] = useState(null);
const [dismissedId, setDismissedId] = useState(null);
// ONE CLASSIFICATION AT A TIME, GUARDED BY A REF. `disabled={busy}` reads as
// a guard and is not one: React state does not take effect until the next
// render, and two clicks land in the same tick — which is what a double-click
// IS. Measured with the network stubbed: one double-click sent TWO
// POST /api/intake/classify.
//
// WORSE HERE THAN ANYWHERE ELSE ON THIS SCREEN, because a classification is
// not only recorded — it ASKS A MODEL, and S299 made the daily cap something
// COUNTED over the cw.model_call ledger. A double-click therefore spends the
// day's budget twice for one intake, and the doors that behave run out early.
const acts = useActs();
const busy = acts.busy !== null;
const [error, setError] = useState(null);
const saved = classifications.rows.find(
(row) => row.agreement_id === dealId) || null;
useEffect(() => {
if (!saved || proposal || saved.classification_id === dismissedId) return;
const savedAnswers = saved.answers || [];
const currentAnswers = answersFrom(text);
if (currentAnswers.length > 0
&& JSON.stringify(currentAnswers) !== JSON.stringify(savedAnswers)) return;
setText(textFromAnswers(savedAnswers));
setProposal(saved.result);
setRisks((saved.result?.risks || []).map((risk) => ({ ...risk })));
setConfirmed(false);
}, [saved?.classification_id, dismissedId, proposal, JSON.stringify(text)]);
if (deals.status === 'loading' || walk.status === 'loading'
|| classifications.status === 'loading') return ;
// The walk is a FILE on the server (intake_walk.json). A deployment fault
// reading it answers 500, and this says so rather than showing an empty
// checklist that looks like a system with no questions.
if (walk.status === 'failed') return ;
if (deals.status === 'failed') return ;
if (classifications.status === 'failed') {
return ;
}
const probes = walk.body?.probes ?? [];
const deal = deals.rows.find((d) => d.agreement_id === dealId) || null;
const categories = [...new Set((library.rows ?? []).map((c) => c.category_label))]
.filter(Boolean).sort();
// A probe list with nothing in it is not an error and not an empty screen:
// /intake/probes withholds any probe whose category the library does not
// define, so an empty walk means the library has no categories yet. Saying
// which of those it is, is the difference between a bug report and a task.
if (!probes.length) {
return ;
}
return (
{/* THE PAGE TITLE, above the panels rather than inside the first one.
This pane opened on the section head "What is this for", so it had no
page title at all — and promoting that section would have named the
whole page after its first question. */}
{error && (
refused
{error}
)}
{/* ── 1 · Which deal ────────────────────────────────────────────── */}