# UX SPEC — DESIGN ROUND 7
**Kiduna Studio, whole · renders canon v5.3 (2026-07-11 delta) · R2–R6 remain in force except as amended here · July 11, 2026**
Pairs with: `01 The Project R7.dc.html` · `02 Field and Chat R7.dc.html` · `03 Collaboration R7.dc.html` · `04 The Coding-Agent Seam R7.dc.html` · `05 Ally and Scenes R7.dc.html` · `06 The Cut R7.dc.html` · `07 Studio on the Phone R7.dc.html` · `MOTION-ADDENDUM-R7.md` · `OPEN-QUESTIONS-R7.md`.

---

## 0. The sentence

R3's sentence still governs (one dialogue with your ally; everything else is a card that gets bigger for a minute). R7 adds its own on top: **the Project is the room the work lives in, and everything that enters the room says where it came from.** Studio is that room's workshop rendering — not a vibe-coding tool, not an IDE: the workshop of an organization. Every screen this round is that one sentence at a different moment: creation, narration, handoff, return, acceptance.

## 1. Canon absorbed (2026-07-11 delta)

- **The Field** is the entire range of play; **Scenes** are its bounded environments; **ACTIONS** are first-class and appear in Field or Chat; Field-only / Chat-only / overlay / side-by-side are all legal. Studio has both Field and Chat.
- **Projects** are a new first-class primitive within Organizations — connecting tools, agents, and software systems, interacting with Claude Code and Codex — and are Studio's central organizing principle.
- Servers form a **mesh**; a server is an **ecosystem**; trusted collaboration runs **through the server** — files, sync, working on each other's machines.
- The **trust matrix**: relationships trusted/untrusted; resources registered/unregistered; four quadrants, all legal, described as distance never danger.

## 2. The Project (Deliverable 1)

1. **Creation is a duna command with a receipt** (01 · 1a). Said to the ally inside the Organization; the command stated verbatim before it runs; the receipt a machine-generated sentence over it. **Not a signed act** — the three launch signatures stand; R7 proposes exactly one addition (§5).
2. **Anatomy is five things** (01 · 1b): purpose (member-authored, verbatim) · members with grants (stated, scoped, revocable in a sentence) · connected tools/agents/systems (each registered or unregistered, said plainly) · Records (all cited) · **state, which is derived from the graph, never declared.**
3. **A Scene per Project** (01 · 1c, decided, OQ-1). Born at the on-the-fly grade; climbs the ladder only if someone inside raises it. The room being rough while the work is young is signal.
4. **The ally narrates; the Field is** (01 · 1c). Two renderings of one graph. Every narrated event cites the Record it narrates.
5. **ACTIONS are the Project waiting for a person** (01 · 1d): addressed to one member, two sentences of what and why, the access consequence in the label, the act plus "not now." At the object in the Field, through the member's own ally in Chat. No queue, no inbox, no badges — "what's waiting on me" is a question your ally answers.

## 3. Field + Chat on desktop (Deliverable 2)

1. **Four postures, one surface** (02 · 2a): Field-only (spatial work) · Chat-only (language work) · overlay (narration during spatial work) · side-by-side (**Studio's default** — the width exists, so both renderings stand whole).
2. **The HUD stays four elements** (02 · 2b): container chip · ≤3 contextual chips (desktop buys longer labels, never more chips) · ally band · sky rims. Desktop's one addition is **Chat standing whole beside the Field** — borrowed whole with its own grammar, not a fifth HUD element.
3. **The HUD refuses** (02 · 2b): file trees (the graph is asked, not browsed) · tabs/docks/panels · notification trays · meters of any kind · a second primary action.
4. **The fidelity ladder is legible** (02 · 2c): the same Scene at on-the-fly, generated, and crafted grades — same objects, same HUD, same grants. **Grade never gates capability.** Provenance chips are the constant.
5. **Moving is chrome** (02 · 2d): the two standing words; the surface may propose a posture, never seize it; continuity is the unbroken ally band (1400ms crossing, MOTION-ADDENDUM-R7).

## 4. Collaboration through the server (Deliverable 3)

1. **Presence is position** (03 · 3a) — where someone is and what they're near, never a green dot with a timer. "Working on his machine" is stated where he stands.
2. **Nothing moves member-to-member directly.** Files, sync, commands — all pass through the server, scoped by grants, leaving Records. A sent file lands when taken, not before.
3. **Machine access is a grant card** (03 · 3b): scope (Project · workspace · commands) · path (Studio → server → machine and back) · trace (shared, as sentences, the owner's copy verbatim) · end (Project close or either's one sentence). No remote desktop, no file browser into someone's life. **The ally coordinates, it doesn't colonize.**
4. **What trusted unlocks** that untrusted doesn't: files that land, state that syncs, commands on each other's machines, allies with standing context. Untrusted still converses and exchanges — server-held, at arm's length. There is no "request access" escalation; trust is established between people, then stated to allies.
5. **The four quadrants render without fear** (03 · 3c): trusted/registered (full standing) · trusted/unregistered (works here, known here — dashed camel border, plain words) · untrusted/registered (known everywhere, close to no one) · untrusted/unregistered (a visitor at the counter). Line quality and geometry, never warning color. The axes never blur (law).
6. **The Sentinel appears once, as an effect** (03 · 3d): a pacing nudge folded into the ally's ordinary helpfulness — a true reason, a real pause the work already contained. Underneath: `adjust_pacing`, agent-side, logged, inspectable in the Vigil. No meter, no reading, no acronym reaches a member, ever.

## 5. The coding-agent seam (Deliverable 4)

1. **The package is four parts, read back whole before it leaves** (04 · 4a): context (all cited, nothing the Project doesn't hold) · ask (the member's sentence verbatim) · constraints · return address. Self-describing: an agent that has never seen the Kidunaverse can work it and send it home. Sending is a recorded act, not a signature.
2. **In flight, the Field tells the truth about elsewhere** (04 · 4b): the package waits at the room's edge, gold-rimmed, breathing slowly (3.2s), facing the machine it went to. Progress is the agent's own sentences relayed through the band; elapsed time is stated; silence is stated as silence. Nothing locks.
3. **Return unpacks as draft Records** (04 · 4c), each cited "via [agent] · pkg #N" — forever. Machine work is never laundered into member work. Both directions share the grammar: an agent-initiated package lands the same way (out of the launch cut).
4. **Failure is a returned package whose contents are a reason** (04 · 4d). Three shapes: constraint met honestly · agent silent (stated, with recall) · return refused by the server (outside the package's own declared scope — the one refusal, stated as which constraint). Retry is always a new package citing the old; the package thread reads like correspondence.
5. **Acceptance is built as the fourth signed act** (04 · 4e, flagged OQ-2): press-and-hold, gold ceremony. The argument: acceptance is the moment machine output becomes the organization's record under a member's name — the vouching, not the work, is what's signed. The counter-argument (frequency devalues the ring) is stated on the canvas; the recommendation is to watch frequency in practice. Who signs is named by grant: Elias for work-in-progress; Moto where the duna's own record is touched.

## 6. Ally maintenance and the making of Scenes (Deliverable 5)

1. **Maintenance is conversation; state is cards** (05 · 5a): the Contract (every sentence timestamped with who said it) · grounding (weighted by source) · what it knows (counted by access level; answers cite; forgetting is a said thing — removal, not hiding). Cards are read-only renderings of conversation's outcomes. No settings forms; instruction only from the Source; no gold (stated trust, R6 rule).
2. **Words to a bounded Scene** (05 · 5b): the sentence is the floor plan; nothing renders the sentence didn't state; ambiguity returns as questions; the sentence is kept as the Scene's citable source. Bounded means owned — edges are grants made visible.
3. **The middle and crafted paths** (05 · 5c): generation dresses the room from its own words, versioned, chosen by walking; crafted art uploads and lands where dropped — but **must still enter the closed vocabulary**; out-of-grammar sprites become a proposal to grow the set (versioned, named, everywhere at once — R6 law) or stay out. The paths compose: words make the room, generation dresses it, craft replaces the dressing where it matters.
4. **The sim flag is structural** (05 · 5d), set in conversation at authoring, hard to unset (removal is a redesign). It disables: real gold (hollow press-and-hold, no embers, no haptic) · real money (in-fiction currency named before any wallet renders) · real Records (outcomes stay inside the Move) · real grants. It keeps everything else. Numbers may live inside the fiction; they never rank people and never leave.

## 7. The mobile decision

**Studio does not exist on the phone** (07, decided, OQ-4). The phone gets the Project's pulse through Kiduna Live — walk the room, hear the narration, receive ACTIONS, answer the ones that are words, be told when packages move. Five acts stay at the desk: composing packages, wiring systems, granting machine access, accepting returned work, uploading art. "At my desk later" is the phone's honest verb — the ACTION holds the intention without performing the act.

## 8. The invariants, restated

Citations and consequence-ordering · gold = signature (three signed acts at launch + the proposed fourth, OQ-2) · sky = touchable · card anatomy (front consequence, back context) · four access levels · the Contract · one ally voice · members never users · handle never username · relationship never connection · registered/unregistered for resources, trusted/untrusted for relationships, never blurred · Compute is prepaid usage credits that power intelligent agents · the Sentinel visible only as effects and plain sentences · receipts are machine-generated sentences over exact commands · press-and-hold is the signature · light announces what happens to you; gold marks what you sign · no HEARTS, meters, scores, or leaderboards · all money authorization on the web · state is derived, never declared · provenance never falls off.

## 9. The cut

Canvas 06 is normative: thirteen screen-groups in, ten out, and the test is production — **Moto and one trusted collaborator run the Lightbrush integration end to end (upload, connect, hand off to Claude Code, get work back, record it, show it in the Field) before anything else ships.** R6's test was recursion; R7's is a real day's work for a real duna with real tools.