Run Workflow
How one Tessera Agent question becomes verified evidence and a committed Generative UI surface.
The proof is complete only when governed analysis and Generative UI form one workflow:
question -> catalog -> semantic plan -> bounded read-only query
-> verification -> Resource/Evidence offers
-> present_ui proposal -> committed Revision
-> SurfaceEventStream -> SurfaceController
-> GenerativeSurface -> RendererRegistry| Step | User-visible result | Host responsibility |
|---|---|---|
| Discover | Relevant entities, fields, metrics, and relationships | Load the live semantic catalog and return a bounded slice |
| Clarify | Ambiguous terms become explicit choices | Describe inspected entities or run one bounded probe |
| Plan | A reviewable read-only analysis intent | Accept semantic IDs, never model-generated SQL |
| Execute | Progress and verified query status | Revalidate scope, compile SQL, execute, cancel, and enforce limits |
| Offer | Evidence and renderable data become available | Publish grant-bound Resource descriptors, schemas, versions, and evidence |
| Compose | A useful metric, chart, table, filter, or explanation layout | Freeze the Component Contract slice and accept only present_ui proposals |
| Commit | Last-good content changes atomically or through allowed preview | Validate identity, bindings, placement, authority, and canonical revision |
| Render | The answer becomes an inspectable, interactive surface | Publish trusted events and resolve exact node renderers |
Browser lifecycle
Private Data Agent tool payloads remain on the server. The browser receives the
redacted product-stage stream plus a trusted SurfaceEventStream. Query rows
enter the browser only as bounded, node-scoped Resource projections requested
under a committed binding; they never appear in model proposals, canonical
documents, revision history, or ordinary logs.
SurfaceController validates stream identity and sequence, replays commits,
preserves last-good, requests resource windows, and exposes resolved node
projections. GenerativeSurface renders those projections with the official
registry; it never consumes raw model or tool output.
Retry, interruption, and conflict
Every analysis is rebound to the current catalog and authority before execution. A stale capability, changed catalog, expired Resource grant, invalid proposal, interrupted stream, or revision conflict fails closed. The current committed Surface remains visible while the Host repairs, resumes, resynchronizes, or asks the user to resolve a conflict.
The golden suite must exercise this entire path, not isolated component JSON. See the data-agent proof gates.