Five specification cycles have produced no shipped artifacts. The Trust essay and the Agentic Labs app foundations are what a hiring committee can actually look at right now. Everything built on top of them is still a plan.
This queue is meant to end that. Build the top two first. The bottom three can follow, or run in parallel if you have the hours. All five are ranked together under one question: at what point in an agent-driven workflow can the user safely leave, and what must the interface show when they return?
Each artifact maps to the Trust essay's five handoffs — the five moments where authority passes between a person and an agent — grounds its design decisions in TinyFish production infrastructure, and speaks to an active posting at OpenAI, Altana, or Gusto. The ranking weighs two things: likelihood of actually shipping (lower complexity, a clear extension point in an app that already exists) and how many of the three companies the artifact reaches.
Retail Velocity is out. Its scored account table and evidence drawer solve a different problem: prioritizing exceptions while the user is sitting there. No multi-stage external action, no irreversible gate, nothing worth designing a departure for.
1. Safe Departure and Bounded Re-Entry
Build this first.
Extends: CarrierIQ's parallel per-carrier execution stack — the repeated Session, Navigate, Fill, Extract, Verify stage chips, the per-run progress bars, and the inline trace expansion inside each carrier row.
Artifact type: Interaction model with state definitions.
CarrierIQ runs multiple carrier quotes at once. Each carrier row advances through five stages independently, carrying its own progress, elapsed time, and trace messages. The operator authorizes the run, watches carriers advance, reviews completed quotes in a slide-over drawer, and approves binding through a full-width button at the bottom of that drawer.
The interface as built assumes the operator never looks away. Carrier runs take minutes. The operator will leave to handle another client, take a call, open a different system. On return, the screen shows current state and says nothing about what changed while they were gone, what became irreversible, or what needs a decision before a deadline passes.
Trust essay mapping: Three of the five handoffs. Intent-Setting, where the operator's initial authorization sets the scope of the delegation. In-Progress, where the system detects that conditions have changed enough to warrant pulling the operator back. Decision Gate, the Approve Bind moment, which releases an external effect — a bound insurance policy — that no undo button reaches.
Three states
Active Supervision
The current interface, mostly as-is. Parallel carrier stack, stage chips, progress bars, inline traces. One addition: each carrier row gains a status classification, either "running (safe to leave)" or "approaching decision," derived from how close that run is to producing a bindable result. This replaces the existing muted/highlighted chip treatment with a two-state indicator that answers the question the operator is actually asking, which is whether they need to stay.
Safe Departure Conditions
A persistent summary bar above the carrier stack, present whenever at least one carrier is running. It takes its own vertical space rather than overlaying the rows beneath it. It reports how many carriers are still executing, the estimated time to the next decision point, and whether any carrier has already finished and is waiting on review.
The operator's question is binary: can I leave for ten minutes without missing something irreversible? The bar answers that and nothing else. If a carrier reaches Verify and produces a bindable quote during an absence, the system holds. It does not auto-bind. The bar's state changes to show a decision pending.
Re-Entry Surface
When the operator comes back, on browser tab focus or on session resume after an idle timeout, the interface inserts a bounded change summary in the same position the departure bar occupied, pushing the carrier stack down so the summary and the rows it refers to are visible at the same time. Three sections:
- What completed: Carrier rows that moved from running to a terminal state (Bindable, Normalize, Referral, Call review) during the absence. Each shows the result and how long it has been sitting unreviewed.
- What failed or changed: Carrier rows that errored, timed out, or had coverage parameters shift mid-execution. State the specific change, not the error label.
- What is irreversible next: If the operator's next action, approving a bind, triggers an external effect the system cannot reverse on its own, say so plainly. Unwinding an approved bind means contacting the carrier, which is a multi-party settlement, not a rollback. This is the cancellation-as-settlement principle surfaced at the one moment it changes behavior.
The summary is dismissible. Once reviewed it collapses, the carrier stack returns to position, and the departure-condition bar resumes above it if carriers are still running. It should not persist as a permanent log. The inline trace already does that job.
Production grounding: TinyFish's agent trace infrastructure, which is what CarrierIQ's per-carrier trace expansion is showing, already captures the event sequence the change summary needs. The design problem is compression: reducing a long trace into those three categories without losing the specific detail that changes what the operator does next.
Build complexity: Medium. Active supervision barely touches the existing stack. The departure bar is new but draws entirely on data the rows already expose. The re-entry surface is the hard part, because it requires diffing the stack's state at departure against its state at return and presenting that delta in a form faster to read than re-scanning every row.
Company relevance: OpenAI's Identity posting covers agents that carry a user's credentials and act with their authority across sessions. The departure problem is sharpest when the agent can commit you to something while wearing your identity, and the re-entry surface has to show what happened and what you are now obligated to as a result. Gusto's design leadership postings emphasize workflows where mistakes cost real money — payroll, tax filings — and "what is irreversible next" maps straight onto that. Altana's intelligence surfaces have analysts monitoring supply-chain signals across shifts; an analyst returning to their screen needs the same three-part summary of what resolved, what broke, and what committed their organization to an outside obligation while they were away. Of everything in this queue, this pattern travels furthest across the three companies.
2. Attention-Load Analysis
Build this second.
Domain: Inference-Aware UX. Extends: Brand Pulse's middle-column signal-card stream and its relationship to the aggregate Sentiment & Sources panel on the right.
Artifact type: Attention-load analysis with threshold definitions.
Brand Pulse renders every source finding as its own card in a scrolling stream: verbatim quote, source name, theme label, sentiment label. A five-source scan producing forty signals reads fine. A fifteen-source scan producing two hundred signals becomes a wall nobody reads card by card. The aggregate column compresses all of it into conclusions and per-platform sentiment distributions, but nothing in the interface tells the operator when to read individual cards and when to trust the aggregate.
Trust essay mapping: Output Review and In-Progress. Output Review is the handoff where the system presents evidence and the user decides whether it clears their bar; the question here is the volume at which per-item review becomes theater, the operator scrolling past cards without reading them and producing the appearance of review without any of the substance. In-Progress covers the conditional expansion rules below, which are mid-scan recall decisions: the system spotting a contradictory signal while the scan is still running and pulling attention back to one specific card.
Density mode toggle, two states
Evaluate mode is the default while signal count sits below a threshold. Start at 30 and tune from there. Every card renders in full. The stream scrolls as cards arrive. The operator is expected to read individual findings, because at that volume any one of them might move the aggregate conclusion.
Monitor mode triggers when the count crosses the threshold, or on manual selection. Cards collapse to single-line entries showing source, sentiment, and theme: enough to catch an outlier, not enough to demand a full read. Visual weight shifts to the aggregate column. Three conditions pull a card back to full rendering even in monitor mode:
- Its sentiment contradicts the current aggregate trend. A strongly negative finding while overall sentiment reads positive.
- It comes from a source that has produced fewer than three signals. Low-volume sources carry more novel information.
- It carries a theme that has not appeared yet in this scan.
Those three rules are the artifact. They decide which individual findings are worth the operator's attention once the volume is past comprehensive review, and the criterion is whether the finding could change the conclusion.
The Sentiment & Sources panel picks up a small annotation in monitor mode: the number of suppressed cards and one line on what was suppressed, along the lines of "47 signals consistent with current trend, collapsed." That lets the operator confirm the suppression isn't hiding anything without reading back through everything.
Production grounding: The per-card sentiment labels and theme classifications Brand Pulse already produces are the inputs the expansion rules need. Threshold and contradiction logic are tunable. Expose the threshold as an operator-adjustable setting in the first build, because the right number varies with the brand, the source mix, and how much risk the operator is carrying.
Build complexity: Low-medium. The toggle and the card collapse are ordinary UI work. The conditional expansion rules require comparing each incoming card against current aggregate state, which the architecture supports already, since the aggregate column updates as cards arrive. The harder problem is making the shift from evaluate to monitor feel like a change in where attention belongs, not like information being taken away.
Company relevance: Altana's posting describes intelligence surfaces where analysts work through large volumes of supply-chain signal. The evaluate/monitor distinction lands directly in that domain: an analyst tracking hundreds of entity signals needs contradictions and novelties surfaced, not every data point weighted the same. OpenAI's Identity work involves evidence streams with the same volume problem.
3. Contract-Variance State Diagram
Domain: Agent Infrastructure as UX. Artifact type: State diagram.
When the infrastructure layer routes a request to a different provider, because the primary is down or a cheaper option opened up or a policy changed, the operator's experience can shift in ways they never see. Latency moves, capability narrows, data handling rules differ. The capability/authority gap analysis established that users need notice when routing alters capability, cost, or data handling. This artifact specifies the states: normal operation, variance detected, variance disclosed, operator acknowledged, operator overridden. A state diagram rather than a flow, because the transitions can fire in any order and a single run may cycle through several variances. Each transition carries the operational consequence stated in the operator's terms, not infrastructure telemetry. Trust essay mapping: In-Progress. Build complexity: Low. Few states, well-defined transitions. The disclosure format is the only real design challenge. Company relevance: OpenAI, where model routing is the product and variance disclosure is an enterprise trust requirement. Build it third because it is small enough to finish alongside the first two.
4. Commitment Envelope
Domain: Intent-Based Interaction. Artifact type: Interaction model.
An operator sets constraints — a cost ceiling, a latency tolerance, a reliability minimum — and those constraints determine which inference provider the system reaches for. The operator speaks in their own terms ("don't spend more than $2 per run," "results within 30 seconds") while the system translates into routing behavior: use a smaller model, skip a verification step, batch the requests. That translation is currently invisible. The commitment envelope makes it visible: what the operator asked for, what the system will do differently to satisfy those constraints, and what capability was traded away. This extends the inference conflict surface concept, which named cost ceiling, acceptable delay, and minimum reliability as user-facing constraints rather than provider settings. Before a run launches, the operator sees a short summary of how their constraints change system behavior and can adjust before committing. Trust essay mapping: Intent-Setting. Build complexity: Medium, because mapping constraint inputs to behavioral outputs varies system by system. Company relevance: Gusto, where payroll accuracy constraints determine what can be automated and what has to reach a human.
5. Obligation-Transfer Mental Model
Domain: Human-Agent System Design. Artifact type: Mental model diagram.
When an agent acts for a user, obligations move with it. An agent that commits to a price commits the user. An agent that collects personal data hands the user's organization a compliance obligation. The Trust essay's five handoffs each carry a different obligation transfer, but the essay reads them as supervision moments rather than liability moments. This artifact maps each handoff to the obligation it creates: what the user becomes responsible for by authorizing, by declining to intervene, by approving, by accepting the output, and by adjusting the delegation for the next run. A mental model rather than a flow, because the reader has to internalize the pattern and carry it to cases the diagram never shows. Atlassian's machine-readable design system, where structured schemas govern both human and agent consumption of design rules, is the closest shipped precedent for governance spanning human and machine actors. Atlassian's version governs component usage. This one governs consequential actions. Trust essay mapping: All five handoffs, read as obligation-creation points. Build complexity: High. A conceptual artifact has to stay precise enough to ground specific interface decisions without drifting into framework diagram. Company relevance: Altana, whose posting uses the phrase "machine-readable semantic design system," language that implies governance consumed by humans and agents alike. Showing you have worked out what obligations transfer when an agent consumes a governance layer speaks straight to that.
Build order as a schedule
- Safe Departure and Bounded Re-Entry. First. The CarrierIQ extension points are specific, the three states are already defined above, and the pattern reaches all three companies.
- Attention-Load Analysis. Second. Brand Pulse's signal stream is the clearest existing case of the volume problem, and evaluate/monitor demos in thirty seconds.
- Contract-Variance State Diagram. Small enough to run alongside 1 and 2 rather than after them. Highest OpenAI relevance per hour spent.
- Commitment Envelope. Medium complexity, strongest Gusto relevance.
- Obligation-Transfer Mental Model. Highest complexity and the most conceptual risk. Build it once the concrete interaction artifacts have established that you ship.
The first two should fit inside a single focused cycle, and the specs above are detailed enough to open a file today. Five cycles of specification have already demonstrated what happens otherwise: a committee can only evaluate what it can look at. Start with #1.
- Astra's monitorability gap: OpenAI reports that GPT-6 Astra has lower chain-of-thought monitorability than GPT-5.6, which directly affects whether a re-entry surface can reconstruct what the agent actually did during the user's absence.
- Cooperative cancellation in MCP Tasks: The current MCP Tasks specification defines
tasks/cancelas an empty acknowledgment of intent where the server may leave the task inworking— the protocol gap that makes the cancellation-as-settlement design in Artifact #1 necessary rather than optional. - Anthropic's progress-without-reasoning pattern: Fable 5.1 can now emit user-readable progress messages between tool calls while keeping underlying reasoning hidden, creating a product-level precedent for the distinction between useful progress evidence and full chain-of-thought disclosure.
- Gartner's workflow cost prediction: Gartner forecasts that inference cost per agentic workflow will increase more than fivefold through 2028 even as unit prices fall, which strengthens the case for the Commitment Envelope artifact making per-run cost exposure a design requirement.