Surfaces Are Typed, Not HTML

Generated from a prompt, validated before it ever renders

An App surface is authored from a natural-language prompt plus the App's own collection schemas: a structured-completion model is asked to produce a typed ViewNode tree — the exact same grammar the renderer and the agentis.ui.render chat tool both speak — which is then validated against the view schema. The generator is model-agnostic by construction, speaking only a plain structured-completion contract with no per-model temperature or response-format negotiation, so any configured model works identically.

Never left empty, never left broken

If the model's output fails to parse, generation falls back to a deterministic starter scaffold built directly from the collection shapes — an agent-authored surface is never just blank. And regardless of whether a surface came from the model or the fallback, every result passes through a separate deterministic repair pass before it's ever returned, which is where a surface actually gets made safe to render (see Bounded Styling & Operability).

Inspect and change a surface by identity

Agents should inspect the live surface before editing it. agentis.ui.inspect returns a compact outline of named nodes, stable semantic nodeIds, bound collections, and declared actions; full:true is available when the complete tree is genuinely needed. This keeps repair turns small and prevents a model from guessing at a stale canvas.

agentis.ui.remove deletes one component by its stable nodeId and re-runs validation, revisioning, and realtime publication. Removing an entire surface is a separate, explicitly confirmed operation. A safe authoring loop is therefore inspect → patch the smallest valid subtree → lint/compile → verify, not repeated whole-surface rewrites.

Apply a verified interface revision

Run agentis.ui.inspect before editing. It returns the active interface revision, exact App/page target, compact node outline, stable nodeIds, bindings, and actions. Pass includeTree:true only when the complete tree is needed.

For a coordinated rebuild, use agentis.ui.apply with one or more page changes. Agentis creates an isolated candidate, verifies schema, operability, navigation, and runtime compatibility, then publishes every page atomically. If a gate fails, the live interface is unchanged. Use agentis.ui.patch or agentis.ui.remove for a focused single-page change.

Operate the interface editor

The Interface editor has three working modes: Live runs the published App, Edit provides direct visual editing, and History lists immutable interface revisions. Ask agent in a page’s menu opens the shared chat with that App and page locked as context. Restoring history creates and verifies a new revision; it never rewrites old history.

The current page, mode, and selected component are included in the viewing context. UI tools are locked to that App and default to the exact page being viewed.

Choose typed blocks, UI packs, or sandboxed code

Use typed blocks for standard product behavior and data binding. An installed UI pack may expose trusted ExtensionBlock components by pack and block id; interface specifications cannot import arbitrary packages. Use CodeSurface for bespoke visuals: it runs in a null-origin, zero-network sandbox and can access only the collections and actions declared by the surface.

Interactions are state-aware contracts

Record-facing actions are typed contracts, not decorative buttons. Tables, RecordMaster, drawers, and Kanban cards can declare visibleWhen, disabledWhen, a human-readable disabledReason, confirmation requirements, and recursively bound arguments. Kanban additionally declares allowed transitions, cardActions, and contextActions; drag-and-drop is accepted only when the transition is governed by that contract. This makes the same ViewNode grammar useful for CRMs, queues, approvals, project boards, and any other stateful domain.

Continue