// The negotiation surfaces (NG-1 … NG-4).
//
// FOUR ROLES, ONE SET OF COMPONENTS, THREE COMPOSITIONS. The requester works
// their own deals, the Legal reviewer and the Legal admin work every deal from
// the same desk, and the auditor reads a negotiation inside the record and acts
// on nothing. What differs between them is the ORDER things appear in and which
// acts are offered — never the shape of a position row, because this product
// has already paid once for four near-identical status tiles drifting apart.
//
// WHAT THE SCREEN DOES NOT DO, and this is the load-bearing half:
//
// · It never checks a permission. The round sequence (cw.round_is_next), the
// concession floor, who may approve a concession, and who may write against
// which deal are all the schema's sentences. This offers the act and shows
// the refusal in the database's own words — a pre-flight in JavaScript is a
// second copy of a rule, and two copies stop agreeing.
//
// · It never fetches broadly and filters for permission. Every read here
// takes no parameter: the scoping is "these deals, this person" and it
// arrives on the connection. Filtering by negotiation_id on screen is
// narrowing what the rule ALREADY returned, which is a different act
// entirely from asking for somebody else's rows and hiding them.
//
// · It never dresses a position state as a status mark. A position is
// opened, held, conceded, withdrawn, escalated or settled — six domain
// states, not the five in common.jsx's vocabulary. They render as plain
// words with the rung beside them. The one thing here that IS a status
// mark is a concession's approval state, because that is a thing being in
// force or not yet in force.
const { useState } = React;
// ── Reading the record ────────────────────────────────────────────────────
// Every negotiation surface needs the same six answers, so they are fetched
// once, here, and handed down. Six calls rather than one wide one: each is its
// own rule, and an endpoint that returned "everything about a negotiation"
// would be one rule standing in for six.
function useNegotiationRecord() {
const negotiations = usePane(() => API.negotiations());
const rounds = usePane(() => API.negotiationRounds());
const positions = usePane(() => API.positions());
const movements = usePane(() => API.positionMovements());
const revivals = usePane(() => API.revivals());
const drift = usePane(() => API.renewalDrift());
const concessions = usePane(() => API.concessions());
// The deal list, for counterparty names. Fetched HERE rather than in each
// pane so the two compositions cannot end up asking different questions
// about the same deals.
const deals = usePane(() => API.deals());
// The authored playbook beside each open position (0081). Fetched once
// like everything above, and DELIBERATELY kept out of the loading and
// failure aggregation below: these moves are advice — they gate nothing —
// and a refusal to show advice must not take the record down with it. The
// components that render them say what happened instead.
const positionMoves = usePane(() => API.positionMoves());
// THE BUILDS, so an issued round can name the one that produced the paper.
// `0011` carries a constraint written for exactly this — `only_our_rounds
// _have_a_run` — and nothing has ever been able to set the column it
// protects. Kept OUT of the loading and failure aggregation below, for the
// same reason the playbook is: naming the build is optional on the record,
// so a refusal to list builds must not take the whole negotiation down. The
// form says what happened instead and still records the round.
const runs = usePane(() => API.runs());
// THE LADDERS, so a concession can be recorded against the retreat path
// rather than against a number somebody typed. Kept OUT of the loading and
// failure aggregation for the same reason the builds are: naming a rung is
// optional on the record, so a refusal to list ladders must not take the
// whole negotiation down. The form says what happened instead.
const ladders = usePane(() => API.ladders());
const panes = [negotiations, rounds, positions, movements, revivals, drift,
concessions, deals];
return {
negotiations, rounds, positions, movements, revivals, drift, concessions,
deals, positionMoves, runs, ladders,
loading: panes.some((p) => p.status === 'loading'),
// The FIRST failure, with its sentence. A screen that renders half a
// negotiation because one read refused is a screen quietly deciding which
// half of a record is worth showing.
failed: panes.find((p) => p.status === 'failed') || null,
reloadAll: () => { panes.forEach((p) => p.reload()); positionMoves.reload(); runs.reload(); ladders.reload(); },
};
}
// ── One negotiation, in a list ────────────────────────────────────────────
function NegotiationRow({ negotiation, deals, positions, rounds }) {
const deal = deals.find((d) => d.agreement_id === negotiation.agreement_id);
const mine = positions.filter((p) => p.negotiation_id === negotiation.negotiation_id);
const open = mine.filter((p) => !['settled', 'withdrawn'].includes(p.state));
const escalated = mine.filter((p) => p.state === 'escalated');
const lastRound = rounds
.filter((r) => r.negotiation_id === negotiation.negotiation_id)
.reduce((n, r) => Math.max(n, r.round_no), 0);
return {
key: String(negotiation.negotiation_id),
title: deal ? deal.counterparty : negotiation.agreement_id,
sub: `${negotiation.agreement_id} · ${negotiation.paper === 'ours' ? 'our paper' : 'their paper'}`
+ ` · round ${lastRound || 'none yet'}`,
// Oldest first is the desk's rule, and the date a negotiation opened is
// the honest thing to age it by until something is waiting on somebody.
at: negotiation.opened_on,
chips: (
{negotiation.renews_agreement_id && (
renewal
)}
{escalated.length > 0 && (
{escalated.length} with Legal
)}
{/* WHETHER THE NEGOTIATION ITSELF IS STILL RUNNING. Thirty-six rows,
TWENTY-FOUR of them closed, and not one said so — a requester could
not tell a live negotiation from one that finished, and the age
beside it ("43d") reads as a wait either way.
Named from the row rather than derived from "not open", so a third
state added to cw.negotiation.state shows up here as itself instead
of being folded silently into one of these two. The vocabulary is
two today; that is a fact about today. */}
{negotiation.state === 'open'
? open
: {negotiation.state}}
{/* SAYS WHAT IT COUNTS. This read "0 open" directly beside the chip
above, so one row carried two different senses of the same word:
the negotiation's state, and how many POINTS are still contested. */}
{open.length} points open
),
};
}
// ── Recording a round whose document we do not hold ───────────────────────
//
// WHAT WAS MISSING, AND IT WAS HALF THE CONVERSATION. `cw.negotiation_round`
// (`0011`) has always allowed two directions — `issued`, the paper WE sent
// them, and `received`, what came back. The only path any person could drive
// is the redline upload, and `doorway/redlines.py` hardcodes `'received'` and
// a null run. `recordRound` — which takes the direction as a field — sat on
// the `REACHED_BY_NO_SCREEN` ledger with no caller. The only other writers
// were a seed script and two tests, which is the shape that hid
// `cw.agreement_attorney` for a month.
//
// So Clausewerk recorded what the supplier sent us and had no way to record
// what we sent them. The strip below already draws `out, to them` for a state
// nothing could produce.
//
// AND THE PROVENANCE CHAIN WAS BROKEN AT ITS LAST LINK. `0011` carries a
// constraint written for this and nothing else —
// `only_our_rounds_have_a_run check (direction = 'issued' or run_id is null)`
// — so an issued round MAY name the assembly run that built the paper. With
// no way to write an issued round at all, "which build did we actually send
// them" had no answer, in a product whose promise is that the origin of every
// clause is recorded permanently.
//
// ── THE FINGERPRINT IS COMPUTED HERE, FROM THE REAL BYTES ─────────────────
//
// A round is EVIDENCE rather than a note because of `document_sha256`, and
// `0011` requires 64 hex characters. There were two honest ways to get one for
// a document this system does not hold, and only one of them is evidence:
//
// · TYPED IN BY HAND. Rejected. A person pasting a fingerprint can paste the
// wrong one, or a plausible one, and nothing anywhere could tell. That
// turns the one column that makes a round evidence into a claim.
//
// · COMPUTED FROM THE FILE ITSELF, in the browser, with the bytes never
// leaving it. This is what happens: the person points at the document
// wherever it lives, `crypto.subtle` reads it and produces the digest, and
// the file is discarded. The record gets a fingerprint that is true of a
// real document, and this system still does not hold a copy — which is the
// whole point of "held elsewhere".
//
// `crypto.subtle` EXISTS ONLY IN A SECURE CONTEXT (https, or localhost). On a
// deployment served over plain http it is absent, and the form says so and
// refuses rather than falling back to a typed fingerprint — a fabricated
// digest is worse than a missing round.
async function fingerprintOf(file) {
const digest = await crypto.subtle.digest('SHA-256', await file.arrayBuffer());
return [...new Uint8Array(digest)]
.map((b) => b.toString(16).padStart(2, '0')).join('');
}
// The `cw://received-document/` scheme IS NOT A POINTER SOMEBODY MAY TYPE. The
// strip below reads that exact prefix to decide whether to offer the document
// back, so a hand-recorded round carrying one would draw a download button for
// bytes this system does not have. The scheme belongs to the upload path;
// anything recorded here is held somewhere else by definition.
const CW_HELD = 'cw://received-document/';
function RecordRoundByHand({ negotiation, nextRound, runs, onError, onRecorded }) {
const [open, setOpen] = useState(false);
const [direction, setDirection] = useState('issued');
const [sentOn, setSentOn] = useState('');
const [where, setWhere] = useState('');
const [runId, setRunId] = useState('');
const [file, setFile] = useState(null);
const [sha, setSha] = useState('');
const [hashing, setHashing] = useState(false);
const [busy, setBusy] = useState(false);
// THE BUILDS OF THIS DEAL, and only this deal's. A run belongs to an
// agreement; offering another deal's would let somebody attach the wrong
// provenance to the right round.
const mine = (runs.rows || [])
.filter((r) => r.agreement_id === negotiation.agreement_id);
const canHash = typeof crypto !== 'undefined' && crypto.subtle;
const ready = sha && where.trim() && sentOn && !hashing
&& !where.trim().startsWith(CW_HELD);
const take = async (chosen) => {
setFile(chosen); setSha(''); onError(null);
if (!chosen) return;
setHashing(true);
try { setSha(await fingerprintOf(chosen)); }
catch (e) { onError('the document could not be read: ' + e.message); }
finally { setHashing(false); }
};
if (!open) {
return (
);
}
return (
Record round {nextRound}
For paper this system does not hold — what we sent them, or something
that arrived outside the upload. The document stays where it is; only
its fingerprint is recorded, and it is computed here from the file
itself rather than typed.
{!canHash && (
cannot record
This browser will not fingerprint a file on this connection — it
needs https, or localhost. A round can only be recorded with a
fingerprint taken from the real bytes, and a typed one would not be
evidence of anything.
{hashing ? 'reading…'
: sha
? <>fingerprinted {sha.slice(0, 16)}…
{file ? ' · ' + file.name : ''} · not uploaded
: 'The file is read in this browser and discarded. Nothing is sent.'}
The builds could not be read, so this round cannot name one.
It can still be recorded — naming the build is optional on the
record.
) : mine.length === 0 ? (
This deal has no recorded build to name.
) : (
)}
This is the link that says which assembled contract the
counterparty was actually sent. Optional, and only an issued
round may carry one.
)}
{
setBusy(true); onError(null);
const body = {
negotiation_id: negotiation.negotiation_id,
round_no: nextRound,
direction,
document_sha256: sha,
storage_uri: where.trim(),
sent_on: sentOn,
};
// OMITTED RATHER THAN SENT EMPTY when nothing was chosen: the
// column is a foreign key to cw.run and an empty string is not
// a run. And never on a received round, which `0011` refuses.
if (direction === 'issued' && runId) body.run_id = runId;
const r = await API.recordRound(body);
setBusy(false);
if (!r.ok) { onError(r.reason); return; }
setOpen(false); setSha(''); setFile(null);
setWhere(''); setSentOn(''); setRunId('');
onRecorded();
}}>
{busy ? 'recording…' : '✓ record round ' + nextRound}
)}
);
}
// ── The rounds strip ──────────────────────────────────────────────────────
// What was exchanged, in order, with the fingerprint of each document. The
// fingerprint is shown because it is the only thing that makes the round
// EVIDENCE rather than a note that something was sent.
function Rounds({ negotiation, rounds, runs, onError, onRecorded, canAct }) {
const [busy, setBusy] = useState(false);
const mine = rounds
.filter((r) => r.negotiation_id === negotiation.negotiation_id)
.sort((a, b) => a.round_no - b.round_no);
const next = mine.reduce((n, r) => Math.max(n, r.round_no), 0) + 1;
const take = async (file) => {
setBusy(true); onError(null);
const r = await API.recordRedline(negotiation.agreement_id, file);
setBusy(false);
if (!r.ok) { onError(r.reason); return; }
onRecorded();
};
return (
{mine.length === 0
?
: mine.map((r) => (
round {r.round_no}
{r.direction === 'received' ? 'in, from them' : 'out, to them'}
{r.sent_on && ` · ${r.sent_on}`}
{r.document_sha256}
{/* THE DOCUMENT, BACK OUT (owner decision NI-4). Offered only for
a round whose bytes this system actually holds — a round
recorded for a document kept elsewhere says so instead of
offering a button that will refuse. */}
{String(r.storage_uri || '').startsWith('cw://received-document/')
?
: held elsewhere}
))}
{canAct && (
Record what they sent back
{/* WRAPS AT A NARROW WIDTH. Measured at 375px: the caption beside
this control could not shrink and hung 56px outside the panel,
taking the strip 51px over. It is a flex row of a file input with
its own intrinsic width and a two-sentence caption, and neither
could give. This was true before a second control was added to
this strip — a repair, not a precaution. */}
{
const file = e.target.files && e.target.files[0];
e.target.value = '';
if (file) take(file);
}} />
It lands as round {next}. The fingerprint is the database's own
arithmetic over the bytes — nothing here can supply one.
{/* THE OTHER HALF OF THE RECORD. The upload above takes the bytes and
can only ever produce a `received` round; this records a round
whose document lives somewhere else, in either direction — which
is the only way an `issued` round has ever been recordable. */}
)}
);
}
// ── One authored move, as advice ──────────────────────────────────────────
// The playbook's row, wherever it appears. Kind, title, guidance, the
// fallback as a REFERENCE, and U14d's estimate — or its honest absence,
// because an estimate nobody computed is not zero and must not read as one.
function MoveAdvice({ move }) {
return (
{move.seq}{move.kind}{move.title}
{move.guidance}
{move.fallback_clause_id
? `falls back to ${move.fallback_clause_id}@v${move.fallback_version} — approved wording, by reference`
: 'proposes no wording'}
{' · '}
{move.risk_transfer_estimate !== null && move.risk_transfer_estimate !== undefined
? `risk transfer est. ${move.risk_transfer_estimate}${move.model
? ` (${move.model}${move.model_version ? ' ' + move.model_version : ''})` : ''}`
: 'no risk estimate was asked'}
);
}
// ── One position ──────────────────────────────────────────────────────────
// The same component wherever a position appears. `acts` decides what is
// offered; it never decides what is permitted.
function Position({ position, movements, roundNow, onError, onMoved, acts,
positionMoves }) {
const [note, setNote] = useState('');
const [rung, setRung] = useState('');
const [busy, setBusy] = useState(false);
const [showing, setShowing] = useState(false);
const history = movements
.filter((m) => m.position_id === position.position_id)
.sort((a, b) => a.movement_id - b.movement_id);
// The SECOND advisory stream, narrowed from what cw.position_move already
// returned for this connection — never fetched wider. Live moves only; the
// view leaves retired ones out because this is the playbook a negotiator
// may act on today, not the history.
const advice = positionMoves && positionMoves.status === 'loaded'
? positionMoves.rows.filter((m) => m.position_id === position.position_id)
: [];
const act = async (call) => {
setBusy(true); onError(null);
const r = await call();
setBusy(false);
if (!r.ok) { onError(r.reason); return; }
setNote(''); setRung('');
onMoved();
};
return (
{position.category_key}
{/* A DOMAIN STATE, AS A WORD. Not a Status chip: these six are not
the five-state vocabulary, and borrowing its inks would make
"held" look like a governance state it is not. */}
{position.state}
{position.current_rung !== null && position.current_rung !== undefined && (
at rung {position.current_rung}
)}
raised round {position.round_raised} · from {position.opened_from.replace('_', ' ')}
{['held', 'conceded', 'withdrawn', 'settled'].map((to) => (
act(() => API.movePosition({
position_id: position.position_id,
round_no: roundNow,
to_state: to,
current_rung: rung.trim() === '' ? null : Number(rung),
note: note.trim() || null,
}))}>
{to}
))}
{/* ESCALATION IS ITS OWN BUTTON, and it is not in the row above.
Nobody should reach Legal by typing a string into a state
field — the endpoint agrees, which is why 'escalated' is not
the caller's to choose there either. */}
act(() => API.escalatePosition({
position_id: position.position_id,
round_no: roundNow,
current_rung: rung.trim() === '' ? null : Number(rung),
note: note.trim() || null,
}))}>
hand to Legal
{/* TWO ACTS, TWO BUTTONS — owner decision NI-3. Escalating records
the movement. Opening a ticket is a second governed act with its
own reason, and it is performed knowingly or not at all. */}
{position.state === 'escalated' && (
This is with Legal. Opening a review ticket for the wording is a
separate act, on the review desk — escalating does not open one,
deliberately.
Naming the exact version records the position being negotiated; it does not change the contract.
A concession can then name this position as its starting point.
)}
{mine.length === 0
?
: mine.map((p) => (
))}
);
}
// ── The same argument, reopening ──────────────────────────────────────────
function Revivals({ negotiation, revivals }) {
const mine = revivals.filter((r) => r.negotiation_id === negotiation.negotiation_id);
return (
{/* EMPTY IS GOOD NEWS AND MUST SAY SO. A blank area here reads as a
screen that failed to load, and the two facts are opposites. */}
{mine.length === 0
?
None. No settled point is being renegotiated.
: mine.map((r) => (
{r.category_key}
held {r.times_held} times · first round {r.first_held_round} ·
last round {r.last_round}
))}
);
}
// ── What a renewal is carrying ────────────────────────────────────────────
// U1's control. It stays in front of whoever opened the renewal rather than
// behind a link, because the whole hazard is starting from stale language
// without noticing.
function Drift({ negotiation, drift }) {
if (!negotiation.renews_agreement_id) return null;
const mine = drift.filter((d) => d.negotiation_id === negotiation.negotiation_id);
return (
{mine.length === 0
?
Nothing has moved in the library since the positions this renewal
opened from.
: mine.map((d) => (
{d.clause_id}
in force v{d.executed_version}
{d.successor_version && ` · library is now v${d.successor_version}`}
{d.current_state}
))}
);
}
// ── Concessions on this deal ──────────────────────────────────────────────
// Settling at a fallback needs BOTH the requester and the assigned attorney.
// The screen offers the half the person in front of it can perform; the
// database decides whether they are one of the two named.
// ── Recording a concession, which nothing could create ────────────────────
//
// THE GATE WAS REAL AND THE DOOR DID NOT EXIST, for the second time in this
// same family. `POST /concessions` has been served since `0003` with a policy,
// an authority trigger and a floor lookup, and `api.jsx` has offered `concede`
// for months. No pane ever called it: it sat on `REACHED_BY_NO_SCREEN`. The
// only other writers are `seed_library.py` and one test.
//
// So FOUR ACTS OPERATED ON A RECORD NOBODY COULD CREATE — approve, settle,
// withdraw and promote-into-the-library are all reached from a control, and
// the thing they act on could only arrive by seed. The panel above this form
// has said "Nothing has been conceded on this deal" on every real deal since
// the beginning, and it was telling the truth about a table only a seed could
// fill.
//
// AND MARKING A POSITION `conceded` IS NOT THIS. That writes
// `cw.position_movement` — the negotiation's blow-by-blow, one row per move.
// A concession is the GOVERNED RECORD of what the company gave up: it carries
// the ladder and its floor, needs a second person to approve it, can be put in
// force or withdrawn, and is what the Library Builder reads (`cw.concession_
// rate`) when it drafts proposed language out of what negotiation taught us.
// A person could mark every point on a deal conceded and leave that record
// empty, which is exactly what has been happening.
//
// ── WHY THIS FORM SHOWS THE LADDER ────────────────────────────────────────
//
// Match 0154's live, floored ladder by the actual source clause's severity,
// not merely a ladder that happens to contain that clause. Several ladders
// may contain it, including retired history. Preserve the database's lowest-ID
// tie break. A below-floor proposal is recordable, but needs its own override
// before settlement; a number with no published rung remains unavailable.
function laddersFor(ladders, position, library) {
const source = (library.rows || []).find(r => r.clause_id === position.our_clause_id
&& r.version === position.our_version);
if (!source) return null;
const rows = (ladders.rows || []).filter(
(r) => r.category_key === position.category_key
&& r.severity === source.severity && !r.retired_on && r.is_floor)
.sort((a, b) => Number(a.ladder_id) - Number(b.ladder_id));
if (rows.length === 0) return null;
const id = rows[0].ladder_id;
const rungs = (ladders.rows || [])
.filter((r) => r.ladder_id === id && r.rung !== null && r.rung !== undefined)
.sort((a, b) => a.rung - b.rung);
const floor = rungs.find((r) => r.is_floor);
return { ladder_id: id, rungs, floor: floor ? floor.rung : null,
status: rows[0].ladder_status };
}
function concessionFallbackRead(ladders, library) {
const failure = [ladders, library].find(read => read.status === 'failed');
if (failure) return failure;
return {status: ladders.status === 'loaded' && library.status === 'loaded' ? 'loaded' : 'loading'};
}
function RecordConcession({ negotiation, positions, ladders, onError, onChanged }) {
const library = usePane(() => API.library());
const fallbackRead = concessionFallbackRead(ladders, library);
const [open, setOpen] = useState(false);
const [positionId, setPositionId] = useRetainedState(
'concession-position:' + negotiation.negotiation_id, '');
const [busy, setBusy] = useState(false);
const usable = positions
.filter(p => p.negotiation_id === negotiation.negotiation_id && p.our_clause_id && p.our_version)
.sort((a, b) => a.position_id - b.position_id);
const chosen = usable.find(p => String(p.position_id) === String(positionId)) || null;
if (!open) return (
);
return (
Propose a different position
Record what is proposed, not what has been approved. The buyer, assigned attorney
and any required approvers must approve before it can take effect.
{usable.length === 0 ? (
First record a negotiation point that names the library clause this proposal would replace.