The Autonomy Layer — Watches, Proposals, Trust Evals & Analyst Studio

Routes: /watches · /watches/:id · /proposals · /evals · /evals/:id · /studio · /studio/:id Files: app-data-layer.jsx (the backend seam) · app-watches.jsx · app-proposals.jsx · app-evals.jsx · app-analyst-studio.jsx Doctrine: Q10 — bounded, reversible autonomy (extends Q8/Q9)

The Autonomy Layer turns insigz from a platform you query into one that watches for you — without crossing into autonomous action. The deliberate position: insigz automates detection and drafting, never acting. An agent may surface and draft; a human commits. That is what keeps output defensible for the compliance, journalism, insurance and policy buyers where "the AI did it on its own" is a liability.

The loop — one shape, three capabilities

  ANALYST STUDIO          STANDING WATCH              PROPOSAL INBOX
  define a grounded   →   runs the agent on the   →   stages a draft   →   human ACCEPT
  agent (no code)         live feed (trigger/cron)    (event/case/alert)    / MODIFY / REJECT
       ↑                                                   │                       │
       └──────────── TRUST EVALS prove the agent ←─────────┘     committed to the canonical
                     (scorecard) is reliable                      model + audit log

A committed proposal becomes an ordinary Event / Case-update / Alert — nothing here invents a parallel data world. The new objects (Watch, Proposal, AgentDef, EvalSuite/Run/Scorecard) are operational metadata around the canonical chain, not a new fact layer.

A · Standing Watches & the Proposal Inbox

• /watches — per-project list: name · agent · scope · status · gen / auto / review stat chips · INSPECT. + NEW WATCH wizard (agent → scope → trigger → output kind → autonomy band).
• /watches/:id — config summary, lifetime stats, RUN NOW (manual trigger), PAUSE/ACTIVATE, and the proposals it generated.
• /proposals — the command queue: a stat band (Generated · Auto-applied · Needs review), filters, a list, and a Review panel with four first-class actions:
  • Accept — commits the draft to the canonical model (logged who/when).
  • Modify — edit the draft payload, then accept.
  • Explain — plain-language agent rationale.
  • Show Logic — the cited [OBS-####] observations, the tool-use trace, and the reasoning chain (the audit substrate, reused).

Autonomy bands (reuse the entity-resolution thresholds)

confidence ≥ AUTO (0.92)  AND  output ∈ auto_allowed_kinds  → auto-apply + audit
REVIEW (0.65) ≤ confidence < AUTO                            → stage for review (alert)
confidence < REVIEW                                          → stage for review, flagged low

Q10 hard guardrail: auto_allowed_kinds is restricted to internal, reversible outputs (attach an observation, flag an entity, open a WATCH-status case, raise an alert). Anything customer-facing or irreversible (report drafts, published artifacts, external notifications) never auto-applies — it always stages for review. Enforced in the band function (prototype) and again server-side (backend).

Alert integration

A new alert type watch-review (⊛) flows into the existing 🔔 inbox — no standalone queue (Q6 discipline). Each needs-review proposal emits one, deep-linking to /proposals.

B · Trust Evals & the Defensibility Scorecard

• /evals — suites list: suite · target agent · cases · pass-rate.
• /evals/:id — Results / Cases / Evaluators tabs, metric bars vs threshold with baseline-vs-comparison deltas, and the Scorecard.

Evaluators that matter to regulated buyers: citation-accuracy (fraction of claims citing a real [OBS-####] — the defensibility number), refusal-correctness (does it emit the literal refusal when unsupported?), answer-fidelity (semantic similarity vs. an expert ground-truth), plus contains-key-details and rouge.

The Scorecard is the customer-facing payoff: a compact, signed summary ("Every claim cited · citation-accuracy 0.98 · refusal-correctness 1.0 · n=120 · model X · date") that attaches to a Report's CITATIONS row or a Case header. For sanctions/journalism/insurance, this is the buy reason.

C · Analyst Studio (no-code grounded-agent builder)

• /studio — agent list: the four curated defaults (analyst chat, Ontology Agent, Adjudicator, After-Action) read-only, plus custom agents.
• /studio/:id — two-pane editor (mirrors the Ontology Agent layout): config left (instructions · tool scope · grounding rules · model), live test panel right. Actions: TEST · SAVE · PUBLISH · EVALUATE.

Every published agent inherits the grounding contract automatically (citation-required + the literal refusal string + an observation scope) — you cannot accidentally build an ungrounded agent. Publishing makes the agent selectable in the + New Watch picker and as an Eval target.

The DataLayer seam (why this works after the backend lands)

The UI never touches localStorage or fetch directly — it calls a single DataLayer via useData() (app-data-layer.jsx). Today a LocalDataLayer fulfils it (localStorage + simulated runs via window.claude.complete + MOCK_OBSERVATIONS); later an ApiDataLayer("/api/v1") with identical method signatures fulfils it. Swapping is one provider injection. Project-keyed storage (insigz-watches-v1, insigz-proposals-v1, insigz-agents-v1, insigz-evals-v1) inherits the existing project-isolation model. <DataProvider> mounts alongside ProjectProvider/CaseStoreProvider.

Method contract: listWatches/getWatch/saveWatch/setWatchStatus/runWatch · listProposals/getProposal/decideProposal · listAgents/getAgent/saveAgent/publishAgent · listEvalSuites/getEvalSuite. The REST routes the backend implements are the mirror of these (GET/POST/PATCH /api/v1/...).

Access & gating

• Watches + Proposals are per-project surfaces (in activeProject.surfaces, in the OverflowNav) — enabled where logical, including research projects (they run WHO/ECDC-threshold watches). They appear on the Overview as widgets too, gated the same way.
• Analyst Studio + Trust Evals are org-layer builder tools, reachable from Settings (and surfaced on the Overview's Autonomy widget).

Seed examples per project (the inbox loads populated)

Aviation — emergency squawk 7700 (0.99), unscheduled-flight surge ≥2σ (0.68), ADS-B spoofing (0.60). Baltic — dark-loiter near a cable (0.71, ties to the Estlink-2 case), STS-transfer candidate (0.78). Shadow Fleet — new OFAC designation match (0.94, the one auto-applied exposure flag demonstrating bounded autonomy), identity-laundering (0.66). AMR — resistance spike ≥2σ, pan-resistant single case (ECDC rule). Ebola/Cholera — space-time case clusters + WHO DON match. Each proposal's grounding points at real seed [OBS-####] so Show Logic opens to actual provenance.

Prototype boundary

Real now: every surface; the Watch/Proposal/AgentDef/Eval objects + contracts; the run-loop simulation; autonomy bands + the Q10 guardrail; the inbox decision flow; the scorecard render; the DataLayer abstraction; localStorage persistence; project/rights gating. Deferred: real triggers (ingestion/scheduler), production grounded tool-use + the resolution scoring that yields real confidence, server-side eval execution + signing, and the REST implementation behind ApiDataLayer.