WorkpagePlan and Renderer Ownership
Why the model proposes structure while the deterministic renderer owns the page
The main WorkPage OS path is:
intent + sources
→ WorkpagePlan
→ schema validation
→ deterministic renderer
→ preview
→ standalone export
Plan ownership
The model may propose:
- page type;
- sections;
- cards;
- content;
- gates;
- evidence requirements;
- actions;
- completion contract.
It does not own arbitrary HTML, JavaScript, filesystem access, or provider secrets.
Renderer ownership
The renderer owns:
- semantic HTML;
- CSS and design tokens;
- responsive layout;
- focus and keyboard;
- accessibility;
- copy/check/progress runtime;
- escaping;
- print/PDF;
- static export.
Preview isolation
The app preview may request privileged host actions through a narrow bridge. The exported page cannot inherit those privileges. Export runtime remains inline, local, and non-networked.
Revision
A model returns a plan patch against an exact base version. The application validates and creates a new immutable revision.
This division makes generated interfaces portable and safer. It also lets design improve without retraining or prompting the model to reproduce presentation code.
Source register
- N13-S01 — Workpage OS Spec Pack v1.1.
Workpage_OS_Spec_Pack_v1_1.md - N13-S02 — Workpage OS Pressure Test.
Workpage_OS_Pressure_Test_v1_1.md - N13-S03 — SurfaceMind R0.
bohselecta/surfacemind