The grey clickable prototype. Every screen at full viewport with every state it really has, linked along the flows, so the product can be walked with clicks rather than described. Nothing here is invented: structure comes from the forty six nodes of stage 03b, and a gap is fixed upward in the IA before it is drawn.
01 · Read this first
What the product is, who Clerk is, and one case end to end
Every section below this one assumes it. If a screen in the prototype reads as unexplained, the explanation is here rather than on the screen, because at this stage the wording is still a draft.
Harrier is an adjudication console for the queue that is left after an AI agent has closed everything it could close. It is not an alert triage tool, not a hunting tool, and not the page where the agent is configured. It is where a human rules on work the agent has already done.
An MDR provider sells detection and response as a service to many client tenants at once, and its margin is set by how many tenants one analyst can carry PREMISE. The category answers that unanimously, and this part is verified on live pages: let the agent close most of the work. Simbian sells it as “your analysts review the 8% that need judgment, not the 92% that don’t”. Liability does not follow the work. The provider signed the contract, so when a closed case turns out to have been an incident, the provider answers for it PREMISE.
So what remains after auto resolution is a residual queue holding every hard decision, and it is where the analyst spends the whole shift. None of the thirteen products examined at stage 01 publishes a view of it. Every one of them sells the number of cases the human no longer sees. That gap is the product.
Clerk, and why the name is the contract
A clerk prepares the case file and drafts the opinion. The judge rules. Clerk never issues a verdict in the analyst’s name, and the interface is built so that the difference stays visible.
Before the analyst has seen anything, Clerk has already collected the signals across the tenant’s connected sources, correlated them into one case rather than seven alerts, run the first pass of the investigation, and filed a written verdict with its evidence. Sometimes it has also acted, when the action was inside that client’s earned latitude. That is why a case can arrive in three structurally different conditions: waiting for a decision, already contained and waiting for confirmation, or held at the ceiling because the action it wanted is above what this tenant has granted.
One case, walked end to end
Every number below is a fixture, chosen to make the layout decidable. It is never quotable as evidence about the market, and it is identical on every surface that shows it. The canon is in ia/docs/pages/reading-conventions.md.
The caseLarkfield Logistics, token replay from a new ASN. 9 signals correlated from 6 sources over 24h: Entra ID, Exchange audit, EDR, proxy, threat intel, tenant baseline
What Clerk concludedReal, and it wants to contain the identity. One sentence, before the evidence, because more explanation is not more trust
What happened04:08 sign in from the corporate range, token issued. 04:12 the same token presented from ASN 41xxx, no MFA prompt. 04:13 an inbox rule created, forwarding to an external address
What Clerk looked for and did not findNo password change, and no new device enrolment. Rendered with the same weight as what it found. This is the half no reference product has
What points the other wayThis user has travelled to this region twice in 90 days. The disagreeing signal stays visible rather than being resolved away
Normal at this clientTwo token replays at Larkfield in 90 days, both real. The same signal is a Tuesday at one client and an incident at another
What Clerk may do hereSix action classes, two permitted and four shown disabled with the ceiling written on them: above this tenant’s latitude, so it waited for you. A hidden control teaches nothing; a disabled one with its ceiling stated teaches the ceiling
That last block is the differentiator. Earned autonomy per tenant is not ours: Prophet sells earned autonomy and Simbian sells it per tenant and per action class, in those words. What nothing published does is make every client’s current latitude legible where the analyst is about to act rather than on a configuration page.
What the analyst is asked to do
Not to investigate. The screen asks one question as early as it can: does this verdict hold? Four answers, each one key, each key printed on its own control: a accept, m amend, r reject, e escalate. Rejecting is a first class action rather than a fallback path, and the reason goes straight to tuning.
One measured failure is recorded rather than hidden. The principle says override costs one key. Measured at the close of stage 03b it does not yet hold: reject costs four taps against accept’s two, and stage 04 drew the reject screen against that number rather than around it.
The route, seven steps
Click straight through. The activation node is the case file, and it is two clicks from landing, which was measured at step 7 rather than asserted.
- Sign inThe requested address survives the round trip through the identity provider, because a case opened from a pager at 03:00 must not land in the queue
- Shift briefWhat happened while she was away, and a pointer straight into a waiting case
- Case queueRows on the left, detail pane on the right. Every row is a decision, not a record
- Case fileThe same screen in its second state. This is the node the product exists for
- Reject or EscalateThe two paths that are not agreement. Accept and amend file from the case file itself
- Decision logAppend only. Every Clerk action and every human override lands here
- Log entryThe full evidence snapshot as it stood at decision time, addressable with
?as-of
The resting state of the detail pane is the fleet, every tenant with its current latitude and accuracy trend. That is why the fleet has no item in the global navigation, which carries three: Queue, Shift, Log. It costs zero taps. Press ? on any screen for the keyboard map.
What gets filed at the end
Not a closed alert. A verdict record composed from structured parts, never from free text: what was decided, on what grounds, against which evidence snapshot, by whom, when, and if rejected, the reason on both axes. Free text stays optional and nothing downstream ever depends on it, because stage 02 found that handover quality varies widely between individuals and that no organisation trains it. Structure is what removes the variation.
Underneath it is the one compliance requirement that shapes the design: an append only log carrying the evidence snapshot as it stood at decision time. The question arrives eight months later, and the file answers it, not the analyst’s memory.
Two things this prototype deliberately is not. Interface strings here are drafts: wording is owned by stage 05, and a label that reads flat is not yet a defect. And there is no colour, no type family and no icons, because the visual language is invented at stage 06 on copies under design/. What is being judged at this stage is structure, state coverage and the route.
06 · Conventions
The contract every screen and every subagent works to. Full text in wireframes/docs/conventions.md
The palette, inherited verbatim
Four values, lifted unchanged from the .wf block of the stage 03b mockups so that these screens read as a continuation rather than a second visual language. The type scale is deliberately not inherited: those were miniatures inside a document at 10.5px mono, these are live screens at 1440.
--ink#16181a
text, structural borders
--soft#9aa0a6
secondary, disabled, placeholder
--hair#d4d6d8
hairlines inside a component
--fill#f2f3f3
table head, resting pane, selection
--paper#ffffff
the surface a component sits on
--bg#fbfbfa
the page behind everything
Six, not the five that stood here until the step 9 critique. --bg was declared in _wf.css and published nowhere, so the contract a subagent works to was missing the one value that decides what a screen sits on. A token that exists and is not in the contract is a token the next stage re-derives.
The four rules that decide arguments
Always
- A live screen, not a schematic. A real page filling the viewport that clicks and scrolls. The node anatomies of 03b are finished
- One live responsive screen per state, and the narrow rendering checked by narrowing the browser
- Every state is its own page, with a visible exit checked against the flow diagram
- Every zone answers why it is here, and there is exactly one primary action per screen
Never
- Colour, type family, icons, shadows, images. Stages 06 to 08, and they arrive on copies under
design/
- Two frames on one page, desktop beside mobile, or a caption annotating a zone
- A skeleton standing in for the screen, or a spinner where a duration is the information
- A token value inline. Not once, not on one screen. It is already a variable
The first of those Never rules was broken on 27 of 62 screens from day one, and no instrument could see it. _wf.css says no colour and never declared a rule for a, so 151 links rendered in the browser’s default blue. The grep instrument reads rules that exist; the source review reads source; the clean context reader reads meaning. A defect whose cause is an absent rule is invisible to all three. It took asking the live browser for a computed color and testing it for saturation. Fixed with one rule at the lowest specificity in the file, and re-measured at zero on all 62.
Inline CSS is transport, not a home, and this is where the stage breaks quietly. At step 8 parallel agents cannot all write to _wf.css, so each puts its screen’s rules inline behind the marker /* INLINE: <screen> :: for reconcile into _wf.css */. Reconcile brings them back the same step. Skipping it is not cosmetic: stage 07 derives the kit’s component classes from these screens, and structure living in twenty inline blocks makes the extraction honestly collect the disagreements. The defect becomes visible at the token audit of stage 08, three stages after it was made.
One declared substitution. The stage pack says mobile-first and reasons block priority from the phone. CLAUDE.md says the opposite in its own words, and forty nodes were specified under it: the stance is desktop first, priority is reasoned from the desk at 1440, and 360 is then proved for one scenario. The project rule wins. What survives from the pack unchanged is the part that matters: one live responsive screen, never a second file.
