feat(workspace): ship the local research browser preview

.github/workflows/checks.yml

@@ -33,6 +33,23 @@ jobs:
       - run: npm run check
         env:
           PR_TITLE: ${{ github.event.pull_request.title }}
+      - run: npm run build
+
+  browser:
+    name: browser acceptance
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - run: npm run build
+      - run: npm run test:browser
 
   actions:
     name: actionlint
@@ -64,16 +81,18 @@ jobs:
   required-checks:
     name: required-checks
     if: ${{ always() }}
-    needs: [repository, actions, secrets]
+    needs: [repository, browser, actions, secrets]
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
       - name: Require every check to succeed
         env:
           REPOSITORY_RESULT: ${{ needs.repository.result }}
+          BROWSER_RESULT: ${{ needs.browser.result }}
           ACTIONS_RESULT: ${{ needs.actions.result }}
           SECRETS_RESULT: ${{ needs.secrets.result }}
         run: |
           test "$REPOSITORY_RESULT" = success
+          test "$BROWSER_RESULT" = success
           test "$ACTIONS_RESULT" = success
           test "$SECRETS_RESULT" = success

.gitignore

@@ -10,3 +10,5 @@ dist/
 Thumbs.db
 .openlab/
 *.diagnostics.zip
+test-results/
+playwright-report/

.gitleaks.toml

@@ -4,5 +4,5 @@ title = "OpenLab repository secret scanning"
 useDefault = true
 
 [[allowlists]]
-description = "Generated dependencies and verified tool caches"
-paths = ['''(^|/)node_modules/''', '''(^|/)\.cache/''', '''(^|/)\.git/''']
+description = "Generated dependencies, verified caches and untracked local application/test data"
+paths = ['''(^|/)node_modules/''', '''(^|/)\.cache/''', '''(^|/)\.git/''', '''(^|/)\.openlab/''', '''(^|/)dist/''', '''(^|/)test-results/''', '''(^|/)playwright-report/''']

.markdownlint-cli2.jsonc

@@ -1,6 +1,6 @@
 {
   "globs": ["**/*.md"],
-  "ignores": ["node_modules/**", ".cache/**", "docs/vision.zh-CN.md"],
+  "ignores": ["node_modules/**", ".cache/**", ".openlab/**", "dist/**", "test-results/**", "playwright-report/**", "docs/vision.zh-CN.md"],
   "config": {
     "default": true,
     "MD013": false,

CHANGELOG.md

@@ -6,6 +6,8 @@ Delivered changes are recorded here. Version tags use `v` followed by a semantic
 
 ### Added
 
+- Runnable bilingual React/assistant-ui workspace with official AG-UI adapter, projects/history, human decisions, live report revisions, source/step navigation, protected settings, material previews and keyboard-accessible drawers/divider.
+- Native Chrome desktop/mobile acceptance and axe checks, a real browser DeepSeek/Crossref metadata research/export record, and native Windows credential module isolation checks.
 - Authenticated loopback research API and OpenAPI definition, protected provider settings/capability tests, pinned inert skill installation, Crossref metadata/source tools, scoped public-page permissions and persisted AG-UI replay.
 - Economics/English and humanities/Chinese live DeepSeek/Crossref metadata research, report revision and archive round-trip smoke tests; full-text and browser acceptance remain pending.
 - Initial TypeScript platform archive, generic single-agent Harness, supervised IPC worker and streaming model adapter, with confirmation, interaction validation, cancellation, restart reconciliation and immutable report archives.

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 [简体中文](CONTRIBUTING.zh-CN.md)
 
-OpenLab currently contains governance, documentation, and repository tooling. The [product specification](docs/product.md) identifies planned application behavior. Contributions should distinguish working functionality from design proposals.
+OpenLab contains governance, documentation, repository tooling and a local research preview. The [product specification](docs/product.md) defines the application target; [development](docs/development.md) records implemented scope. Contributions should distinguish working functionality from design proposals.
 
 ## Start a contribution
 
@@ -19,12 +19,16 @@ npm ci
 npm run check
 npm run check:actions
 npm run check:secrets
+npm run build
+npm run test:browser
 ```
 
 On Windows PowerShell, use `npm.cmd` if script execution policy blocks `npm.ps1`. The workflow and secret checks support Windows x64 and Linux x64 and download fixed, checksum-verified binaries into `.cache/`. They need network access on first use. Windows downloads use the built-in curl, with GitHub CLI as a fallback for networks that block direct release downloads. Other platforms can run the documentation checks and rely on CI for these two binaries until tool manifests add their platform.
 
 `npm run check` runs Markdown lint, local-link and repository configuration validation, and automation tests. The original Chinese vision is preserved verbatim and excluded from style lint. External sites are not queried by the link checker because network availability must not block a documentation PR.
 
+Application checks include strict server/browser TypeScript and controlled runtime/storage/API tests. Browser acceptance uses installed Chrome through Playwright against a separate synthetic local service, including desktop/mobile and axe checks. It never needs your model key. Live model/retrieval smoke tests are separate opt-in commands documented in [development](docs/development.md). Build the browser bundle before `npm start`.
+
 ## Pull requests
 
 - Use a Conventional Commit PR title, for example `docs: clarify research evidence levels` or `fix(ci): validate release targets`.

CONTRIBUTING.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](CONTRIBUTING.md)
 
-当前仓库提供项目治理、文档和维护工具，科研应用尚未实现。贡献内容需要清楚区分已经可用的功能与设计方案。
+当前仓库提供项目治理、文档、维护工具和本地科研预览。[产品规格](docs/product.md)定义目标行为，[开发说明](docs/development.md)记录已实现范围。贡献内容需要清楚区分已经可用的功能与设计方案。
 
 ## 开始贡献
 
@@ -19,12 +19,16 @@ npm.cmd ci
 npm.cmd run check
 npm.cmd run check:actions
 npm.cmd run check:secrets
+npm.cmd run build
+npm.cmd run test:browser
 ```
 
 PowerShell 执行策略可能阻止 `npm.ps1`，使用 `npm.cmd` 即可。工作流检查和密钥扫描支持 Windows x64、Linux x64，首次运行需要联网，固定版本工具经 SHA-256 校验后存入 `.cache/`。Windows 使用系统自带的 curl 下载；网络阻止直接下载时回退到 GitHub CLI。其他系统可执行文档检查，暂由 CI 执行这两项工具检查。
 
 `npm run check` 包括 Markdown 格式、内部链接、仓库配置与自动化测试。原始中文愿景逐字保留，不参与风格检查。外部网址不参与本地链接检查，避免网络波动阻塞 PR。
 
+应用检查包括服务端与浏览器 TypeScript，以及受控运行时、存储和 API 测试。浏览器验收通过 Playwright 使用已安装的 Chrome，连接独立的合成本地服务，覆盖桌面、窄屏和 axe 检查，不使用你的模型凭据。真实模型和检索测试需要单独执行，见[开发说明](docs/development.md)。运行 `npm start` 前先构建浏览器产物。
+
 ## 提交与审查
 
 - PR 标题采用 Conventional Commits，例如 `docs: clarify research evidence levels`。

README.md

@@ -21,20 +21,36 @@ OpenLab is a local-first research workspace being designed to connect open resea
 
 ## Current status
 
-**v0.0.1 establishes repository governance and design documents. There is no runnable research application or installer in this release.** The commands below validate this repository; they do not launch OpenLab. Screenshots and research demonstrations will be added when the corresponding functionality is available.
+**The published v0.0.1 release is foundation-only.** Current development source includes a runnable local research preview; no installer is provided.
 
-Current development source adds the platform archive, generic Harness and supervised worker. See [development](docs/development.md) and the [implementation plan](docs/implementation-plan.md) for implemented scope and remaining application gates.
+The preview combines projects, a supervised Harness, DeepSeek-tested model configuration, Crossref metadata retrieval, plan confirmation, source-linked Markdown reports and portable research archives. See [development](docs/development.md) and the [implementation plan](docs/implementation-plan.md) for tested scope and remaining gates.
 
 | Capability | Status |
 | --- | --- |
 | Contribution, issue, review, and release processes | Available in this repository |
 | Automated documentation, workflow, and secret checks | Available in GitHub Actions and local tooling |
-| Local service with browser UI, Windows first | Planned |
-| Projects, skill installation, model configuration, and literature research | Planned |
-| OpenLab Harness: default single-agent literature runtime | Specified; implementation and native Windows validation planned |
+| Local service with browser UI, Windows first | Implemented in development source; desktop/mobile Chrome checked |
+| Projects, pinned inert skill installation, model configuration, and metadata research | Implemented; two live DeepSeek/Crossref tasks checked |
+| OpenLab Harness: default single-agent literature runtime | Implemented with supervised native Windows worker and replaceable interfaces |
 | Supervisor-Skills execution through the platform runtime adapter | Planned; not an endorsed or verified integration yet |
-| Conversation, execution state, and live artifacts workspace | Specified with assistant-ui and AG-UI; no runnable UI yet |
-| Source tracking, execution history, and artifact export | Specified; implementation planned |
+| Conversation, execution state, and live artifacts workspace | React/assistant-ui with AG-UI; plan, input, denial and replay checked |
+| Source tracking, execution history, and artifact export | Immutable revisions, material copies and verified archive round trips |
+
+## Run the development preview
+
+Use Node.js 24 on Windows:
+
+```sh
+npm ci
+npm run build
+npm start
+```
+
+Open the launch link printed in the terminal. Add and test your model provider in settings, create a project, and submit a question. Review the plan before research starts. Model planning and execution use your provider account. Windows protects credentials under the current user; saved projects remain readable without provider access. Crossref retrieval needs a network connection. Public-page reading asks for scoped access and can be unavailable; metadata alone does not verify a paper's conclusions. DeepSeek currently uses non-thinking mode.
+
+![Native Windows preview with a real DeepSeek/Crossref metadata research record](assets/docs/workspace-preview.png)
+
+This screenshot shows a real metadata-only task, not a full-text or scientific claim-verification result. [Verification details](docs/verification.md) distinguish live probes from synthetic browser fixtures.
 
 ## First research release
 

README.zh-CN.md

@@ -1,6 +1,6 @@
 # OpenLab
 
-当前开发源码已加入平台档案、通用 Harness 和受监督的 worker。已实现范围、验证结果与剩余应用验收项见[开发说明](docs/development.md)和[实施计划](docs/implementation-plan.md)。v0.0.1 发布范围仍为仓库基础设施。
+当前开发源码已提供可运行的本地科研预览，包括平台档案、通用 Harness、受监督的 worker 和浏览器工作区。已实现范围、验证结果与剩余验收项见[开发说明](docs/development.md)和[实施计划](docs/implementation-plan.md)。已发布的 v0.0.1 仍为仓库基础设施。
 
 <div align="center">
 
@@ -23,18 +23,34 @@ OpenLab 致力于建立本地优先的科研工作空间，将已有的开源科
 
 ## 当前状态
 
-**v0.0.1 交付仓库规范、协作流程和设计文档，目前没有可运行的科研应用或安装包。** 仓库中的 npm 命令用于校验文档和自动化配置。截图与科研演示会在对应能力实际可用后补充。
+**已发布的 v0.0.1 仅交付仓库规范、协作流程和设计文档。** 当前开发源码已提供本地科研应用预览，尚不提供安装包。
 
 | 能力 | 状态 |
 | --- | --- |
 | 贡献指南、Issue/PR 模板与发布流程 | 本仓库提供 |
 | 文档、工作流与密钥扫描 | GitHub Actions 与本地工具提供 |
-| Windows 优先、本地启动、浏览器交互 | 计划实现 |
-| 项目管理、技能安装、模型配置与文献研究 | 计划实现 |
-| OpenLab Harness：默认单 Agent 文献研究运行时 | 已定义规格，待实现及原生 Windows 验证 |
+| Windows 优先、本地启动、浏览器交互 | 已实现，已检查桌面与窄屏 Chrome |
+| 项目管理、固定版本技能安装、模型配置与元数据研究 | 已实现，已验证两条 DeepSeek/Crossref 真实研究任务 |
+| OpenLab Harness：默认单 Agent 文献研究运行时 | 已实现原生 Windows worker 与可替换接口 |
 | 通过平台运行时适配器执行 Supervisor-Skills | 计划集成，尚未通过执行验证 |
-| 对话、执行状态与实时研究产物工作台 | 已确定 assistant-ui 与 AG-UI 方向，目前没有可运行界面 |
-| 来源追踪、运行历史与成果导出 | 已定义规格，待实现 |
+| 对话、执行状态与实时研究产物工作台 | React/assistant-ui 与 AG-UI，已验证确认、回答、拒绝与重放 |
+| 来源追踪、运行历史与成果导出 | 不可变修订、附件副本与校验后的档案导入导出 |
+
+## 运行开发预览
+
+在 Windows 上安装 Node.js 24，然后执行：
+
+```sh
+npm ci
+npm run build
+npm start
+```
+
+打开终端输出的启动链接，在设置中添加并测试模型服务，新建项目后提交研究问题。研究工具会等待你确认计划；生成计划和执行研究会使用你的模型账户。Windows 使用当前用户保护凭据，已保存项目不依赖模型服务即可查看。Crossref 检索需要网络。公开页面读取会请求具体授权，也可能不可用；仅有元数据不能证明论文支持某个结论。当前 DeepSeek 使用非思考模式。
+
+![原生 Windows 上真实 DeepSeek/Crossref 元数据研究预览](assets/docs/workspace-preview.png)
+
+截图展示真实的元数据研究任务，不代表全文或科学论点已经核实。[验证记录](docs/verification.md)分别说明真实测试与合成浏览器夹具。
 
 ## 首个科研版本
 

THIRD_PARTY_NOTICES.md

@@ -21,11 +21,17 @@ GitHub Actions used by the workflows retain their upstream licenses and are pinn
 
 ## Planned application components and design references
 
+### Implemented development dependencies
+
+Current development pins React/React DOM 19.3.1 (MIT), assistant-ui React 0.15.31 (MIT), its AG-UI adapter 0.1.0 (MIT), AG-UI client/core 1.0.3 (MIT), react-markdown 10.1.0 (MIT), and YAML 2.9.1 (ISC). Build/test tooling adds Vite 8.3.5 (MIT), its React plugin 6.1.2 (MIT), Playwright 1.64.1 (Apache-2.0), and axe-core Playwright 4.14.0 (MPL-2.0). Package license metadata was inspected on 2026-10-24. Transitive versions, integrity hashes and license metadata remain in package-lock.json; installed packages retain their license files. OpenLab's supporting UI components are original code; no shadcn or AI Elements source has been copied.
+
+Zod is overridden to 4.6.7 to avoid [GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5). The AG-UI client already imports Zod's v4 API despite a v3 package range. Type checks, the official client and browser flows pass with the override; npm audit reports zero vulnerabilities in the verified lockfile. Review this override with future upstream upgrades.
+
 - [assistant-ui](https://github.com/assistant-ui/assistant-ui) is the planned conversation foundation, with its [official AG-UI adapter](https://www.assistant-ui.com/docs/runtimes/ag-ui/overview).
 - [AG-UI](https://docs.ag-ui.com/introduction) is the selected frontend interaction protocol. OpenLab retains its own research archive and runtime contracts.
 - [shadcn/ui AI Elements](https://ui.shadcn.com/docs/ai-elements) provides supporting UI composition patterns; copied component code must retain applicable source and license records.
 - [CopilotKit](https://github.com/CopilotKit/CopilotKit) is an interaction-pattern reference; no SDK or hosted service is selected for the first release.
 - OpenCode was the original first-runtime selection in ADR 0001. [ADR 0002](docs/decisions/0002-workspace-and-harness.md) selects self-developed OpenLab Harness and retains OpenCode as an optional future adapter.
 - DeepSeek Harness is named in the supplied planning material as architectural inspiration. No upstream implementation or license has been independently established in this revision; no code is copied or bundled on that basis.
 
-These application components are not installed or bundled in v0.0.1. The referenced documentation was reviewed on 2026-10-24; exact dependency/component revisions, license terms and compatibility must be recorded before implementation distribution. A design reference does not imply upstream endorsement.
+These application components are not installed or bundled in the historical v0.0.1 release. Current development's pinned dependencies and verification are recorded above. A design reference does not imply upstream endorsement.