S14Code

S14Code is the Session 14 runtime. It is the entire Session 13 agent runtime — a live task graph, scoped and provenance-bearing memory, Rohan's semantic chunking V2, and Agent2Agent interoperability — with the Session 14 generative-UI layer folded in as one service. There is no separate UI process: the same FastAPI app that serves the agent API also serves the catalog, validator, surface builder, AG-UI stream, and render client, reading the runtime's graph in-process. It asks glc_v3 for model completions over HTTP and never owns provider credentials.

The load-bearing claim of Session 14, enforced by s13code/ui/validator.py:

A surface is declarative data, checked against a catalog the client already trusts. Three invariants hold:

• catalog — every component type is in the trusted catalog;
• data-not-code — no property is ever evaluated as script, markup, or a URL;
• event — the surface changes the world only by emitting a registered action.

The UI layer holds no provider credentials. It reads the graph the agent already produced and calls no model directly; the generative path (the compose_surface skill inside a live run) routes through the glc_v3 gateway, exactly as the rest of the runtime does.

What runs where

Two services, not three. The Session 14 UI is part of the runtime on 8113.

Service	Default address	Responsibility
glc_v3	http://127.0.0.1:8111	Models, keys, routing and channels (owns every credential)
S14Code HTTP	http://127.0.0.1:8113	Agent API (graph, memory, documents, JSON-RPC A2A) and the UI (catalog, validator, surface, AG-UI stream, render client)
S14Code gRPC	127.0.0.1:8114	Official A2A gRPC service
Ollama	http://127.0.0.1:11434	Phi-4 segmentation and Nomic embeddings

Requirements

• Python 3.11 or newer
• uv
• A running glc_v3 (for live runs and the generative UI loop)
• A running Ollama with phi4 and nomic-embed-text (for live semantic chunking)

ollama pull phi4
ollama pull nomic-embed-text
ollama serve

The recorded proofs, invariant tests, and /v1/harness/surface need none of the above — they replay real captured output.

Install and run

uv sync

export GLC_BASE_URL=http://127.0.0.1:8111
export S13_GATEWAY_PROVIDER=gemini
export S13_SANDBOX_ROOT="$PWD/sandbox"
export S13_CHUNK_MODEL=phi4:latest
export S13_LIVE_SEMANTIC_CHUNKING=1

uv run s14code serve            # http://127.0.0.1:8113  (agent API + UI)

State is written under ~/.s13code by default. Set S13_DATA_DIR to use another directory.

Health, the trusted catalog, and the real harness-composed surface:

curl http://127.0.0.1:8113/healthz
curl http://127.0.0.1:8113/v1/catalog
open  http://127.0.0.1:8113/s/harness      # the render client, which executes nothing
open  http://127.0.0.1:8113/app            # generic UI-only app loop
open  http://127.0.0.1:8113/app/trip       # Trip Planner (every turn is a composed interface)

Trip Planner (UI-only application)

GET /app/trip forks the bare /app shell for a multi-turn trip planner. Synthetic identities only (tenant_id=course, project_id=s14-trip, user_id=traveler-01). Each turn posts respond_as:"ui", reads /v1/runs/{id}/composed, and renders the validated surface. A button tap becomes the next turn. The catalog includes a custom CodeDiff and Map components so itinerary revisions and place markers can render as before/after plain-text plans and an SVG marker map — drawn with text nodes only, never innerHTML from bound values.

Run a prompt

curl -s http://127.0.0.1:8113/v1/agent/runs \
  -H 'Content-Type: application/json' \
  -d '{
    "tenant_id": "course",
    "project_id": "s14",
    "user_id": "student-01",
    "agent_id": "assistant",
    "prompt": "Say hello."
  }'

The response contains the final answer, graph nodes and edges, ordered graph events, and provider/agent assignments. Once a run exists, the UI routes render it straight from the in-process graph:

curl http://127.0.0.1:8113/v1/agent/runs/<run-id>       # the raw journal
curl http://127.0.0.1:8113/v1/runs/<run-id>/surface     # validated A2UI surface
curl http://127.0.0.1:8113/v1/runs/<run-id>/dashboard   # the rich showcase dashboard
curl http://127.0.0.1:8113/v1/runs/<run-id>/events      # AG-UI events over SSE
open  http://127.0.0.1:8113/s/<run-id>                   # render it in a browser

The UI routes

All served by the runtime on 8113, defined in s13code/ui/routes.py:

Route	Serves
GET /v1/catalog	the trusted component catalog
GET /v1/runs/{id}/surface	a validated declarative surface built from the in-process graph
GET /v1/runs/{id}/dashboard	the rich showcase dashboard, validated
GET /v1/runs/{id}/composed	the compose_surface result for a UI-mode run
GET /v1/runs/{id}/events	the S13 journal mapped to AG-UI events over SSE
GET /v1/harness/surface	the real surface a recorded S13 harness run composed (re-validated on serve)
POST /v1/validate	run any surface through the injection wall
POST /v1/action	a validated user action (approve/reject), bound to final params
GET /s/{id}	the render client, pointed at a run
GET /app	bare-minimal UI-only conversation shell
GET /app/trip	Trip Planner shell (destination → days+map → revision with CodeDiff)
GET /jobhunt	Career Pipeline shell with KanbanBoard and adversarial proof flow

The generative loop (UI composed by the harness)

The surface is composed by a skill node inside a real live-graph run, not by a standalone prompt. The compose_surface skill lives in s13code/runtime.py (grep # --- S14 additive and # --- S14 outcome-aware) and imports the catalog and validator from s13code.ui. A real run researches, distills, then composes the A2UI surface via the gateway; the validator checks the model's own output.

# gateway on 8111 (provider=gemini); Ollama with nomic-embed-text for episode embedding
S13_GATEWAY_PROVIDER=gemini GLC_BASE_URL=http://127.0.0.1:8111 \
  uv run python proofs/harness_run.py          # -> proofs/harness_run.json

# the outcome-aware planner: weak evidence earns a corrective node before compose
S14_SELFCORRECT_CITY=Berlin GLC_BASE_URL=http://127.0.0.1:8111 \
  uv run python proofs/harness_selfcorrect.py  # -> proofs/harness_selfcorrect.json

Proofs and tests

Everything the Session 14 widgets replay is real captured output under proofs/:

File	Produced by	Shows
proof.json	run_surface_proof.py	injection wall (4 rejections), HITL, catalog/validator
harness_run.json	harness_run.py	a real live-graph run → the model composes a 19-component surface
harness_selfcorrect.json	harness_selfcorrect.py	the planner catches weak Berlin evidence and re-researches
harness_codediff.json	harness_codediff.py	live compose includes CodeDiff without naming it in the user prompt
adversarial_trip.json	adversarial_trip.py	RawHtml / markup / unregistered action refused; safe heading survives
generated_surface.json	generate_live.py	a local model's output caught by the validator
gemini_surface.json	generate_gemini.py	Gemini's raw output via the gateway

uv run python proofs/run_surface_proof.py    # writes proof.json, prints the table
uv run python proofs/adversarial_trip.py     # three invariants against a hostile surface
# gateway on 8111 required:
S13_GATEWAY_PROVIDER=gemini GLC_BASE_URL=http://127.0.0.1:8111 \
  uv run python proofs/harness_codediff.py   # -> proofs/harness_codediff.json
uv run pytest -q                             # S13 core + regression tests + the S14 invariant tests

Architecture

• s13code/core/live_graph/: durable graph state, patches, event replay and bounded parallel execution
• s13code/core/memory/: scope checks, provenance, contradiction history, semantic chunking and FAISS retrieval
• s13code/core/a2a_adapter/: Agent Cards, JSON-RPC, SSE/push, official gRPC and trust checks
• s13code/gateway.py: the only S14Code → glc_v3 seam
• s13code/runtime.py: joins graph, memory, tools and model calls into an inspectable run; hosts the compose_surface skill
• s13code/ui/: the Session 14 layer — catalog, validator, surface, showcase, agui, hitl, routes, recorded fixtures/, and the client/ render page
• tests/: executable invariants and regression cases

Sharing / security

• Contains no secrets. The UI layer never reads .env and holds no credentials.
• .venv/, __pycache__/, any .env, and generated databases are git-ignored.
• Use synthetic identities in every proof.

License

MIT. See LICENSE.