Canonical control plane
ECP Execution
The one production execution surface — every run flows through the phase2 /ecp integration surface to the canonical Gateway (127.0.0.1:8765), the Credential Gateway, fail-closed provider resolution and the canonical evidence/audit stack. No provider is reachable from this browser; only registered identifiers and credential references travel here.
1 · Gateway session
Pairing uses the owner-controlled ENV channel — the pairing code never crosses this browser.2 · Credential session
The credential is submitted once to the canonical Credential Gateway and held in-process there. Only its reference (credential_ref) is used afterwards — it is never stored, logged or persisted.No credential session open.
3 · Provider & model discovery
Provider resolution is canonical and fail-closed (NVIDIA → NVIDIA, OpenRouter → OpenRouter, ambiguous → BLOCKED before any transport). The UI cannot steer it.4 · Registered target
The selected model is onboarded by the gateway, which mints the canonical evaluation / system / test / adapter identifiers used by the run.No target selected — complete discovery and select a model.
Provider fabric
Universal provider registry: manifests, capability matrix and model lifecycle (DISCOVERED → REGISTERED → VALIDATED → EXECUTABLE). Read-only and secret-free; it works offline and never gates the canonical path. EXECUTABLE requires an evidence-backed canonical run.Not loaded — the registry plane is read-only metadata.
Registered evaluation catalog
Evaluations registered on the canonical gateway (configuration-driven and session-onboarded).5 · RUN
Executes the registered target through the canonical path. One attempt — no automatic retries. The terminal record is canonical.Canonical result
Rendered exactly as returned by the canonical path. Missing canonical values are displayed as missing — never filled.No execution yet.
Generic protocol surface
Registry-authoritative protocol catalog (GP-01). Readiness is checked with zero side effects. Dispatch verifies the contract commitment (GP-02) at the gateway and runs exactly once — no retries. The UI renders contract metadata only; inputs are generic JSON shaped by the contract's required_inputs.Execution history
Authoritative store browse — server-paginated and scope-projected. TENANT-scoped records are invisible under the reader-authorization boundary; that absence is real, not a UI filter. Collection exports carry server-stamped filenames (CSV / JSONL).MVCP service plane
MVCP status and registered readiness checks are read-only. Starting the local MVCP service is explicit and confirmed; it binds loopback (127.0.0.1) only.Not loaded.
Protocol registration
Metadata registration ONLY through the operator-authenticated registration route — no campaign is started, no dispatch is authorized, no credentials are read. The result is rendered verbatim; refusals stay refusals.Not registered in this session.
WC-EXP-002 pilot readiness
Frozen registration, limits, Runner/Gateway readiness and the owner-approval launch gate. Read-only and secret-free; values are rendered exactly as the server reports them — never filled. The launch gate stays closed until a separate explicit owner-signed launch order exists.Not loaded.