Jarvis company overview and temp views

## Epic 11717 — Executive AI command center Original requirement (verbatim): > Implement Something like this. Share code with Operator Dashboard. > 10. Executive AI command center — Major differentiator > Create one dashboard where a founder or CTO can see: All active projects. All AI employees. Development progress. Project health. Bugs and risks. Development expenses. Deployment status. Productivity and quality metrics. > The owner should be able to ask: "What's happening with my company today?" and receive an accurate answer. Settled inputs: PRD (task 11718, R12, R13, OD-3, OD-5, A-2, A-5, A-6, A-8) and Architecture (task 11719, §2.4 is this child's spec; AD-1, AD-2). Builds on the merged API core, deployments and page children (`WIDGETS`, panels, header slot). ## This child (Architecture C4) - **Tools** `apps/api/app/support_agent/exec_tools.py`, registered in `tools.TOOLS` as **base** tools (AD-1: always on, not behind `support_tools_enabled`), `writes=False`, `kind="console"`. `company_overview` offered to every seat; `open_dashboard_view` offered only when `principal.is_org_admin` (`authz/principal.py:122-130`). Test both offer sets. - `company_overview({range?})` — `ConsoleReader` sub-requests to `/api/exec/dashboard/overview`, `/risks`, `/deployments`, `/productivity`, `/projects`; returns their numbers verbatim with `url`s. Member: those 403, fall back to `/api/tasks/counts`, say "org-wide spend and health need an Owner or Admin". - `open_dashboard_view({widgets: WidgetKey[] 1–6 enum-checked, project_ids?: int[] ≤5, range?})` — validates each project id by a `ConsoleReader` read of `/api/projects/<id>`; returns `{url}` = `/command-center/view?c=<conversation_id>&w=<keys>&project=<ids>&range=<r>`. - **Prompt** (`prompt.py`): company-questions rule — call `company_overview`, state only its numbers, link each claim; requests outside the widget enum are answered plainly without a tool call. Update the support-agent docstring with both tools. - **Eval** (`apps/api/tests/support_agent/eval_sets.py`): `COMPANY` set pinning "What's happening with my company today?" — scripted tier asserts the answer's numbers equal the tool's; SCOPE entry for an org-B project name → "cannot find it"; "show me revenue by customer" → plain refusal. - **Links:** `links.py` and `supportLinks.ts` allow `/command-center`, `/command-center/view?...` and `/tasks?…&persona=…&after=…&before=…`; update the shared `supportLinks.fixture.json`. - **Temp-view validity (AD-2):** `GET /api/support/conversations/{id}/view-status` in `routes/support_chat.py`, `ORG_SCOPED`, lookup `WHERE id = :id AND user_id = :caller_user_id` for every caller (operator included); miss → 404; `{live: true}` when the row is the caller's latest conversation AND `updated_at` within 24h, else `{live: false, reason: "expired"}`. No new column. - **Temp page** `apps/web/src/pages/command-center/TempView.tsx` at `/command-center/view`: checks view-status first; not found → console not-found; expired → "Expired" empty state linking to `/`; live → requested widgets from `WIDGETS` with the URL's project + range (reuses the panels, so numbers equal the command center's). No save/pin control. - **Ask Jarvis:** a button in the command center header slot opens the Help drawer prefilled with the question; when Jarvis is unavailable (edition `support_assistant` off, or the Help chat's availability check fails) it stays visible but disabled with a one-line reason on hover (e.g. "Jarvis is off for this workspace"). The page never depends on Jarvis. Requirements this child owns (verbatim): - **AC12.1** An Owner opens Jarvis (the console Help assistant) from any page and asks exactly "What's happening with my company today?". Jarvis answers in a short brief covering what moved (done/merged), what is in flight, what is failing or stuck, spend, deployment state and the worst project health. Every claim carries a link to the console page it came from. Verify on dev. - **AC12.2 Accurate.** Every number in the answer equals the command center's number for the same window (A-2) and org. Verify: on dev, ask the question, open `/` with range 24h, and compare at least five numbers. All match. An eval set entry in `apps/api/tests/support_agent/eval_sets.py` pins this question. - **AC12.3** Jarvis never states data from another org or a project the user cannot see (A-6). Verify with an isolation test, and on dev as org A ask about a project name of org B: Jarvis says it cannot find it. - **AC12.4** The company-overview capability is ON by default for tenant Owners and Admins on dev, with no setting to enable. If Jarvis has an org/operator toggle that is off, the command center still works and the ask entry explains why Jarvis is unavailable. Verify on dev. - **AC12.5** A Member asking Jarvis the same question gets an answer limited to what a Member may see, with no org-wide spend. Verify on dev as a Member. - **AC13.1** An Owner asks Jarvis for a view, e.g. "show me spend and failures for project X this week". Jarvis opens a temp full page built only from command-center widgets (tiles, charts, lists of R4–R11) and filtered as asked, and links to it in the chat. Verify on dev: the page opens, shows the requested widgets with the requested project/range, and its numbers equal the command center's for the same filter. - **AC13.2** The temp page lives only for that chat. After the chat ends, opening its URL shows an "expired" state with a link to `/`. There is no save or pin control. Verify on dev. - **AC13.3** Only the creating user in that org can open it. Another user, even in the same org, gets "not found". Verify on dev with a second Owner. - **AC13.4** A request Jarvis cannot build from the widget set gets a plain answer saying so. Jarvis never invents a widget or a number. Verify on dev with "show me revenue by customer". Credentials & reach: - AC12.x / AC13.x Jarvis answers — Gate tier: the scripted eval model in `tests/support_agent/test_support_agent_evals.py`, which needs no credential. Live tier: `SUPPORT_EVAL_LIVE=1` with `me/jaah/system/anthropic_api_key` — Scripted tier **verified** (worktree only). Live tier credential **verified** (credential_get OK, field `api_key`). The C4 coder runs the live tier once for the COMPANY set and cites it. - Every dev.jaah.ai browser oracle (AC1.1–13.4 "Verify on dev") — dev.jaah.ai from h5-3-gmind: DNS resolves 10.60.x, HTTPS and browser time out — **deferred**: operator answer AD-5. Local `./dc` e2e + API tests are the oracles. The dev re-check is done by a node with dev reach in the Finish stage. - Owner / Member / org-B seats — `org/console/dev-login`, `org/console/dev-tpl-member-login`, `org/console/dev-tpl-viewer-login`, `org/console/dev-orgb-login`, `me/jaah/debug/main/operator-login` — **verified**; use on dev **deferred** (AD-5, AD-6). - Local gates — worktree only — **verified**. Out of scope: MUST NOT add a saved/pinned custom-dashboard feature or a `support_views` table (OD-5); no new column on `support_conversations`. MUST NOT show cross-org data in Jarvis answers or temp dashboards. Jarvis MUST NOT compute its own figures — only the exec endpoints' numbers. Do NOT gate the new tools behind `support_tools_enabled` (AD-1); do NOT change how that switch governs the per-entity lookups. MUST NOT change the Operator dashboard. MUST NOT expose the command center to Members or the community edition. Do NOT ingest forge issues or Jira bugs (OD-12). Done means (dev browser oracles deferred — AD-5; scripted eval + API/vitest/e2e are the oracle. Tightened: an answer that is accurate but unlinked, long-winded, or states any number not in the tool output FAILS): - AC12.1 — scripted eval: the COMPANY answer covers moved, in flight, failing/stuck, spend, deployments, worst health, each claim with a console link; short (a brief, not a dump). Live tier run once with `SUPPORT_EVAL_LIVE=1` and cited. - AC12.2 — eval asserts every number in the answer equals `company_overview`'s numbers, which are the exec endpoints' payload values for range 24h. - AC12.3 — isolation test: org A's tools never return org B data; SCOPE eval for an org-B project name → "cannot find it". - AC12.4 — test: tools offered with `support_tools_enabled` off; vitest: Ask-Jarvis button disabled with one-line reason when Jarvis is unavailable, page renders regardless. - AC12.5 — test: Member's `company_overview` falls back to `/api/tasks/counts` and the answer says org-wide spend and health need an Owner or Admin; `open_dashboard_view` not offered to Members. - AC13.1 — test: `open_dashboard_view` returns the pinned URL; foreign project id refused; vitest/e2e: TempView renders requested widgets with the same numbers as the command center for that filter. - AC13.2 — view-status test: newer conversation or >24h idle → expired; TempView shows "Expired" linking to `/`; no save/pin control. - AC13.3 — view-status test: another user in the same org (and an operator) → 404 → not-found page. - AC13.4 — eval: "show me revenue by customer" → plain refusal, no tool call, no invented widget. - Links fixture updated and both TS and Python link tests pass. - `./dc check quick` green; merge lane `./dc check full` green.