Add General Page Reader Web and Focus workspaces

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           cache: npm

.github/workflows/release-alpha.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           cache: npm
@@ -26,7 +26,7 @@ jobs:
         run: npm run release:alpha
 
       - name: Upload Alpha artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: truly-alpha-artifacts
           path: artifacts/alpha/*/

CONTEXT.md

@@ -0,0 +1,64 @@
+# Truly Reading Context
+
+Truly helps people inspect information quality in social feeds and ordinary web
+pages. This language keeps extraction, analysis scope, and Side Panel behavior
+consistent across product, runtime, tests, and review artifacts.
+
+## Language
+
+**Reading Surface**:
+The page- or post-level content Truly can inspect, together with its source,
+identity, extraction status, and warnings.
+_Avoid_: Document payload, scraped page
+
+**Page Reading Session**:
+The session-only state for one browser tab and one meaningful page identity. It
+owns the Reading Surface plus independent Web and Focus analysis scopes.
+_Avoid_: Page history, saved article
+
+**Web Workspace**:
+The Side Panel view that explains the current Reading Surface as a whole page.
+_Avoid_: Page mode, reader mode
+
+**Focus Workspace**:
+The Side Panel view that explains an explicitly selected Reading Target without
+showing whole-page context as if it were the analysis subject.
+_Avoid_: Selection mode, local mode
+
+**Reading Target**:
+An explicitly selected passage or current-region paragraph analyzed inside a
+Page Reading Session.
+_Avoid_: Highlight, snippet
+
+**Page Context**:
+The collapsible evidence Truly extracted from the whole Reading Surface,
+including user-impact guidance, page text, source links, and technical details.
+_Avoid_: Details, diagnostics card
+
+**Reading Context**:
+The concise model-assisted overview, checks, and follow-up questions presented
+for the active Web or Focus analysis scope.
+_Avoid_: AI summary, page brief
+
+**Analysis Scope**:
+The Web or Focus slot that owns advisor, analysis, screenshot, and target state
+for a Page Reading Session.
+_Avoid_: Mode state, active result
+
+**Meaningful Navigation**:
+A URL or document-identity change that makes the prior Reading Surface unsafe to
+reuse. Hash-only and tracking-only changes are not meaningful navigation.
+_Avoid_: Any URL change, refresh
+
+**Reading Command Envelope**:
+A consume-once, session-only instruction that identifies the tab, requested
+reading action, request identity, and creation time without storing page text or
+analysis output.
+_Avoid_: Reading result cache, event queue
+
+**Reading Analysis Coordinator**:
+The Side Panel Module that plans model analysis for an Analysis Scope, including
+eligibility, request identity, provider command, stale-result acceptance, and
+success or error settlement. Ordinary text analysis and confirmed screenshot
+analysis use the same Interface.
+_Avoid_: Model helper, request wrapper

Makefile

@@ -1,6 +1,6 @@
 .DEFAULT_GOAL := help
 
-.PHONY: help resume build build-dev verify check-public check-build release-preview release-review release-review-local-limited-context release-review-github release-review-local-repo-read release-review-local-read release-bump-cws-preview cws-review cws-review-local-limited-context cws-review-github cws-review-local-repo-read cws-review-local-read \
+.PHONY: help resume build build-dev verify check-public check-build gpr-check gpr-ui-check release-preview release-review release-review-local-limited-context release-review-github release-review-local-repo-read release-review-local-read release-bump-cws-preview cws-review cws-review-local-limited-context cws-review-github cws-review-local-repo-read cws-review-local-read \
 	dev dev-all dev-daemon dev-reload dev-status dev-check dev-stop sync-headsup-css \
 	test-watch smoke-ollama-vision
 
@@ -9,6 +9,8 @@ help:
 	@echo ""
 	@echo "  make resume              Show repo state and common next commands"
 	@echo "  make verify              Run the public gate"
+	@echo "  make gpr-check           Run the fast General Page Reader development gate"
+	@echo "  make gpr-ui-check        Run deterministic background-CDP General Page UI checks"
 	@echo "  make build               Build the clean extension"
 	@echo "  make build-dev           Build and patch local dev shortcut"
 	@echo "  make dev-all             Run watch build + reload server"
@@ -55,6 +57,13 @@ verify check-public:
 check-build:
 	npm run check:build
 
+gpr-check:
+	npm run check:gpr
+
+gpr-ui-check:
+	npm run dev:check:source
+	npm run audit:gpr-ui
+
 release-preview:
 	npm run release:preview
 

README.md

@@ -27,6 +27,8 @@ Signals first. Context when needed. Handoff only by choice.
 
 - Shows compact reading hints above supported posts.
 - Expands hints into a one-sentence summary and reading risk cues.
+- Reads the current web page from the side panel after a user action, using
+  `activeTab` or an explicit all-sites opt-in.
 - Opens a side panel with context analysis, claims to check, follow-up
   questions, and handoff tools.
 - Checks Traditional Chinese wording with bundled zhtw-mcp when
@@ -64,12 +66,14 @@ After installation:
 
 **Now**
 
-- Browser extension preview for supported social feed surfaces.
+- Browser extension preview for supported social feed surfaces and
+  user-triggered Page/Web reading.
 - Public feedback, bug fixes, and stability.
 
 **Next**
 
-- More supported social feed surfaces and regular web pages.
+- More supported social feed surfaces.
+- More Page/Web quality hardening across real websites.
 - Mobile reading workflows.
 - Desktop reading workflows.
 
@@ -81,7 +85,8 @@ After installation:
 
 - Chrome Manifest V3.
 - Browser-local, local, or private model sources.
-- UI support currently focuses on Facebook reading surfaces.
+- UI support currently focuses on Facebook reading surfaces and explicit
+  Page/Web reads from the side panel.
 - Public tests use synthetic fixtures.
 
 ## Model Sources
@@ -102,6 +107,8 @@ See [Model Setup](docs/model-setup.md).
 - Truly is not a fact-checking authority.
 - Model output can be wrong, incomplete, or biased.
 - Site support is limited.
+- Page/Web reading is user-triggered; Truly does not crawl pages in the
+  background or store full-page history.
 - Some features depend on model availability.
 
 ## Privacy At A Glance

docs/adr/0001-session-only-reading-command-envelope.md

@@ -0,0 +1,28 @@
+# Use a session-only command envelope for cold Side Panel handoff
+
+Status: accepted
+
+The MV3 service worker may stop before the Side Panel is ready, so a timed
+`runtime.sendMessage` retry is not a reliable handoff. Truly will store only a
+consume-once Reading Command Envelope in `chrome.storage.session`, then use a
+broadcast as an optional low-latency hint; the Side Panel consumes and removes
+the envelope before starting extraction. The envelope may contain request,
+tab, activation, and timestamp metadata, but never extracted page text, model
+input, analysis output, screenshots, or Page Reading Session history.
+
+## Considered Options
+
+- Repeated timer broadcasts were rejected because Side Panel readiness and MV3
+  service-worker lifetime are not timer contracts.
+- Persisting the latest reading result was rejected because it would violate
+  the current session-only privacy decision.
+- Keeping the service worker alive was rejected because service-worker
+  suspension is a platform lifecycle, not an error to bypass.
+
+## Consequences
+
+- Side Panel cold-open recovery replays an instruction, not user content.
+- Envelopes require request identity, a short expiry, consume-once removal, and
+  stale-tab validation.
+- Durable Page Reading Session history still requires a separate privacy and
+  storage decision.

docs/adr/0002-investigation-discovery-proof-boundary.md

@@ -0,0 +1,60 @@
+# ADR 0002: Separate discovery from proof
+
+- Status: accepted for development evaluation
+- Date: 2026-07-15
+- Scope: General Page Reader claim investigation contracts only
+
+## Context
+
+Small, precise verification questions are useful for proof, but poor search
+queries. Search must recover documents using entities, aliases, institutions,
+time and jurisdiction, while proof must remain bound to the exact proposition.
+Conflating the two creates two unsafe shortcuts: treating a good query as an
+answer, or treating search exhaustion as evidence that a claim is false.
+
+## Decision
+
+1. `InvestigationCase` owns a separate `DiscoveryContext` alongside the event
+   frame and verification requirements. Discovery terms may locate documents;
+   they never satisfy a proof obligation.
+2. Acquisition is planned as an obligation-driven `SourceFamilyPlan`. Every
+   mandatory obligation has a bounded non-fallback route. Canonical-record
+   obligations require a canonical route; independent-origin obligations
+   require lineage-diverse routes. Contextual routes are optional.
+3. No case is forced to use all route families. A plan may use at most three
+   families, with explicit fallback relationships and budgets.
+4. Every executed route produces an acquisition receipt. A receipt records the
+   attempted scope, covered source families and remaining blind spots, and is
+   permanently marked `evidenceProduced: false` and `verdictProduced: false`.
+5. Only immutable fetched artifacts with exact answer spans can become proof
+   witnesses. Search snippets, result titles, route hypotheses and receipts are
+   not evidence.
+6. Independent-origin proof is counted by lineage, not by URL, host or number of
+   excerpts. Multiple exact spans from the same lineage may jointly cover one
+   proposition; syndicated, translated or quoted derivatives still count as the
+   same origin. Every counted lineage must independently cover every required
+   facet, including modifiers, quantities, time and attribution.
+7. Missing facets, ambiguous lineage, conflicting relations or insufficient
+   independent origins fail closed. The compiler withholds a certificate; it
+   does not infer a verdict.
+8. This slice remains model-, transport- and UI-neutral. It adds no runtime
+   action, verdict, page-content persistence or analysis history.
+
+## Evaluation boundary
+
+- Planner development uses only the frozen 30-row private development split.
+- Cohort and selection rules are preregistered before inspecting Planner v2
+  output.
+- A matched paired audit uses the same cases, budgets and Proof Compiler for
+  baseline and candidate routes.
+- Raw inputs, URLs, queries, documents and per-sample outputs stay under the
+  gitignored private-data boundary. Only anonymous aggregates may be tracked.
+- Holdout data remains unopened until a candidate and gate are frozen.
+
+## Consequences
+
+Discovery may improve recall without weakening proof. The cost is more explicit
+contracts: discovery context, source-family plans, lineage graphs, route
+receipts and proof certificates must be validated independently. A completed
+search can legitimately end in `insufficient_evidence`; that is a safe product
+state, not a failed investigation and not a negative verdict.

docs/adr/0003-source-aware-acquisition-candidate.md

@@ -0,0 +1,84 @@
+# ADR 0003: Compile source-aware acquisition from proof responsibilities
+
+- Status: accepted for development evaluation
+- Date: 2026-07-15
+- Scope: non-runtime Claim Investigation acquisition candidate
+
+## Context
+
+Discovery Planner v2 separated search from proof and produced grounded route
+plans, but its one-query open-web candidate did not beat the atomic baseline on
+the frozen development cohort. Naming an authority in a query is not the same
+as knowing which registry, official index, filing system or source family can
+answer a verification question.
+
+## Decision
+
+1. Every mandatory proof obligation compiles into a question-specific
+   `SourceResponsibility`. Canonical answers, first-party answers, independent
+   corroboration and counterevidence remain distinct responsibilities even when
+   they belong to the same verification question.
+2. A `TrustedLocatorCatalog` is the only path that may upgrade a route from
+   open-web fallback to a registry, authoritative domain index or direct URL.
+   Catalog entries require human-reviewed provenance, a review timestamp and a
+   source reference. Model output cannot add trusted domains or registries.
+3. Catalog matching requires an exact normalized authority name already present
+   in the case, compatible language and jurisdiction, compatible document kind,
+   and the source family required by the responsibility.
+4. Query portfolios are selected per responsibility from grounded case targets.
+   Independent-origin responsibilities prefer independent-report targets and
+   never reuse an official registry as proof of independent corroboration.
+5. Missing or mismatched catalog coverage fails closed to an explicitly marked
+   open-web fallback. The planner does not guess an authority domain.
+6. The plan and its routes remain discovery artifacts with
+   `evidenceProduced=false` and `verdictProduced=false`. Evidence admission,
+   proof certificates and findings retain their existing boundaries.
+7. This candidate remains outside extension runtime and UI. Private-derived
+   queries are not sent to public search services by the evaluation workflow.
+
+## Evaluation boundary
+
+- Use a newly preregistered forward-development cohort that excludes all prior
+  v1 dev, v1 holdout, v2 holdout and Investigation Planner v2 rows.
+- The first forward slice provided 16 Facebook rows and no unused news rows.
+  A later, separately preregistered news-only slice closed that surface gap
+  without reusing either holdout.
+- Synthetic local fixtures may verify registry/domain execution semantics, but
+  cannot establish real-world acquisition lift.
+- Do not open another holdout or expose a product action until a safe local or
+  user-mediated matched acquisition audit passes a frozen gate.
+
+## Consequences
+
+The system can now explain whether a route is based on a reviewed locator or is
+still generic open-web discovery. This makes missing infrastructure visible and
+prevents model confidence from masquerading as source knowledge. The cost is a
+reviewed catalog lifecycle and separate cross-surface acquisition evidence.
+
+## Development evaluation update (2026-07-15)
+
+A human-reviewed Taiwan public-authority catalog and a query-free, frozen HTML
+snapshot were created before model output was inspected. A fresh 12-row news
+slice then produced 11 valid claim plans, 10 valid Investigation Case plans,
+and five matched catalog routes across three cases. One claim plan and one case
+plan failed the preregistered zero-invalid gate.
+
+The matched audit gave baseline and candidate the same frozen 23-document pool,
+one local query and at most two documents per arm. The candidate could restrict
+its pool to the reviewed authority; no private-derived query left the process.
+Automated passage selection returned eight candidates per arm. Single-reviewer
+answerability review rejected all of them: the baseline contained unrelated
+numeric matches, while the candidate reached the correct authority index but
+not a passage that answered the claim. There were zero candidate-only answer
+rescues and zero false closures.
+
+This result keeps the ADR accepted as an architectural boundary, but fails the
+candidate's development promotion gate. The next candidate must deepen
+authority-local acquisition from index pages to dated announcements, records,
+datasets or PDFs. It must not widen the reviewed catalog, relax passage
+admission, open a holdout or enable a product action merely because authority
+routing improved.
+
+The follow-up query-free traversal architecture and its rejected 48-row
+development candidate are recorded in
+[ADR 0004](./0004-query-free-authority-local-discovery.md).