[DO NOT MERGE] Workflow Activity vNext design baseline

[AbigailDeng]

Caution

DO NOT MERGE. This PR must remain a Draft. It is open only for product,
design, backend-contract, and user-path review. Do not mark it ready, enable
auto-merge, or merge it into dev.

Problem

The Workflow + Activity + Settings vNext design previously lived outside the
repository, so later implementation had no reviewable source of truth for the
visual design, route isolation, real backend capabilities, authentication,
localization, or end-to-end user journeys.

Solution

• Import the complete user-provided vNext design package into the frontend
  documentation tree, with the Excalidraw file as the primary visual and
  interaction baseline.
• Define a normative frontend-only contract against
  origin/feature/integrate commit
  72093afa4490adf6eb25d83c3db0b9c182cd6ff0.
• Define the complete user paths for all 17 Excalidraw frames, including
  loading, empty, failure, accepted, observing, delayed, recovery, desktop,
  tablet, and mobile behavior.
• Add scoped AGENTS.md instructions so future work must read this baseline
  before changing the isolated vNext namespace.
• Add a deterministic baseline verifier for the Excalidraw hash, generator
  output, and exact frame inventory.
• Document the real scoped draft creation contract:
  202 Accepted / projection_pending remains Observing until the exact draft
  GET becomes readable, and observation retry must not repeat the create POST.
• Document committed-only Workflow behavior: first Save creates a draft,
  waits for materialization, and adopts the API-returned draft ID.

Scope

This PR contains documentation, reference design assets, and a documentation
integrity verifier only.

• No frontend route, page, component, runtime, locale catalogue, or menu code
  is implemented in this PR.
• No backend file, endpoint, DTO, projection, persistence, or deployment is
  changed.
• Existing Workflow, Run, Settings, Studio, Team, member, Login, callback,
  redirect, and menu routes remain unchanged.
• The later implementation is isolated under
  /scopes/:scopeId/workflow-activity-vnext and is not authorized by this PR
  until the design package is approved.

Design Baseline

Design baseline:
  apps/aevatar-console-web/docs/design-baselines/workflow-activity-vnext/
Primary design:
  aevatar-workflow-activity-vnext.excalidraw
Design SHA-256:
  30e74d7b410ae72c4c91432355436679033679c54c10b1702908435b001577de
Contract specification:
  apps/aevatar-console-web/docs/superpowers/specs/
  2026-08-04-workflow-activity-vnext-design.md
User paths:
  apps/aevatar-console-web/docs/superpowers/specs/
  2026-08-04-workflow-activity-vnext-user-paths.md
Authentication and localization:
  Existing Aevatar login, callback, session, returnTo, and Umi locale logic;
  presentation may change, behavior may not.
Production data source:
  Real APIs and API-acknowledged user actions only; no mock fallback.
Baseline integrity:
  python3 apps/aevatar-console-web/docs/design-baselines/
  workflow-activity-vnext/verify-baseline.py

The HTML prototype intentionally contains hard-coded records, localStorage,
and timers for standalone interaction. They are reference behavior only and
must never become production API responses, persistence, or success fallback.

Authentication And Localization

The eventual implementation must reuse the existing
ProtectedRouteRedirectGate -> /login -> NyxIDAuthClient.loginWithRedirect -> /auth/callback -> original sanitized returnTo flow, session restoration,
sign-in/sign-out, and service-access review behavior.

It must also reuse the existing Umi locale state,
ConsoleLanguageSwitch, getLocale/setLocale, and synchronized en-US and
zh-CN catalogues. Login, callback, language, and account presentation may be
restyled to match vNext, but their behavior must not change.

Affected Paths

• apps/aevatar-console-web/AGENTS.md
• apps/aevatar-console-web/docs/design-baselines/workflow-activity-vnext/
• apps/aevatar-console-web/docs/superpowers/specs/2026-08-04-workflow-activity-vnext-design.md
• apps/aevatar-console-web/docs/superpowers/specs/2026-08-04-workflow-activity-vnext-user-paths.md

Review Results

• Scope check: clean after rebasing the five design commits directly onto the
  latest origin/dev; an unrelated historical Team Activity implementation is
  not part of this PR.
• Pre-landing review: five informational contract/reviewability findings were
  fixed; zero findings remain after incremental re-review.
• Security/performance specialist review: no findings.
• Independent adversarial re-review: no findings.
• The optional Codex CLI adversarial pass exceeded its five-minute limit and
  was stopped under the non-blocking review timeout policy.

Verification

• python3 apps/aevatar-console-web/docs/design-baselines/workflow-activity-vnext/verify-baseline.py
  • SHA-256 matched.
  • Frames: 17/17.
  • Generator output: byte-identical.
• bash tools/docs/lint.sh
  • 87 files checked, 0 errors.
• git diff --check origin/dev...HEAD
• Imported-source comparison
  • 22 non-README source assets checked, 0 byte mismatches.
• Tracked-scope check
  • Every changed tracked file is under apps/aevatar-console-web/.
  • No runtime source or backend path is changed.
• TypeScript, Biome, production build, frontend unit tests, integration
  tests, browser QA, and the full frontend test suite were not run because this
  PR contains no frontend implementation, route/config change, or runtime
  behavior.

Merge Guard

This PR is intentionally a GitHub Draft with [DO NOT MERGE] in its title.
Auto-merge must remain disabled. Approval of the design should lead to an
explicit implementation decision; it must not make this documentation-only PR
mergeable.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.56%. Comparing base (6da4bbe) to head (be74bab).

@@            Coverage Diff             @@
##              dev    #3187      +/-   ##
==========================================
- Coverage   84.57%   84.56%   -0.01%     
==========================================
  Files        1503     1503              
  Lines      140015   140015              
  Branches    17180    17180              
==========================================
- Hits       118412   118402      -10     
- Misses      13740    13748       +8     
- Partials     7863     7865       +2     

Flag	Coverage Δ
ci	84.56% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.