feat: open the project workspace with view

ADOPTION.md

@@ -321,6 +321,30 @@ requirement records or be rejected by the consuming repository's policy.
 
 ## Rendering And Browser Views
 
+After reviewing and applying the candidate project with `adopt materialize
+plan` and `adopt materialize apply`, inspect it without composing browser JSON:
+
+```sh
+agentic-proofkit status --repo-root .
+agentic-proofkit view --repo-root . --serve
+```
+
+Only `--open` opens the local browser. Without `--serve`, `view` returns a
+bounded JSON plan and opens no listener. For a single question use `--serve
+--open --session-mode one-shot-question`; the terminal packet follows server
+cleanup. `--session-timeout-seconds` is optional, bounded to 1..7200 and valid
+only in that one-shot mode. Serving does not accept `--json-layout`.
+
+`view` requires a complete, current, structurally admitted materialized
+project. Other states direct the caller to `next` with the same explicit root;
+they do not trigger repair or materialization. The single captured project
+provides specifications and declared proof relations, not native proof results.
+Coverage and semantic diff are unavailable without their own evidence inputs.
+The browser remains bound to that capture when live files change. Viewing does
+not change `verification_required` into verified. Existing
+`requirement-browser-server` routes remain available for explicitly composed
+source, proof, coverage, tree or comparison workspaces.
+
 Rendered HTML, Markdown, lookup graphs, and browser views are presentation
 products. They should be generated on demand from explicit caller-owned inputs
 unless a consumer explicitly admits a small tracked artifact with a freshness

docs/proofkit-contract-map.md

@@ -43,6 +43,7 @@ owner boundaries. It is not a second command-family inventory.
 |---|---|---|---|---|---|
 | Agent integrations | `integration source`, `integration check`, `integration plan`, `integration apply`, `integration recover` | explicit tool for source/check/plan/apply; root for filesystem operations; operation and both reviewed identities for apply; transaction/action for recovery | one bounded renderer, read-only freshness, canonical cooperative baseline, and managed file lifecycle through the native transaction owner | launcher admission, instruction ownership, host discovery/activation, permissions and native verification | generated source, freshness classification, reviewed transaction plan or historical transaction receipt; none proves host activation |
 | Project state navigation | `status`, `next` | explicit repository root | bounded transaction-first materialized-project inspection, normalized observation identity, deterministic project-state classification, and one non-executable next action; admitted in-bound records bind exact content digests, while unread out-of-bound records intentionally identify only their invalid class | repository policy, byte identity for unread out-of-bound records, witness execution, receipt trust/currentness/scope, merge, release, deployment, rollout, and production readiness | project-status report, next-action packet, or bounded text projection |
+| Project browser entry | `view --repo-root <caller-selected-root>` | one complete materialized project at an explicit root; optional bounded browser session flags | one closure-admitted capture, context schema 3 with composite source identities, existing workspace and declared-relation graph, source-bound Unicode handoff and owned server cleanup | source editing, native witness execution, proof coverage, baseline comparison, freshness after capture, owner approval, merge or release authority | bounded JSON plan, loopback browse session or compact one-shot terminal packet |
 | Agent workflow planning | `change plan`, `native-evidence-guidance` | explicit checkpoint, completed stage ids, bounded context refs, governing authority ref, and required context ref ids | optional built-in `proofkit.reviewed-change.v1` checkpoint relation, reference-closed next-stage context, deterministic agent prompts, bounded text/JSON/envelope projections, and repository-neutral native-evidence guidance with closed applicability classes | custom workflow topology, repository state discovery, stage execution, native witness semantics, evidence collection, review conclusions, merge, release, deployment, and rollout authority | next-action plan, terminal workflow report, bounded agent envelope, or guidance catalog |
 | Adoption and scaffolding | `adopt plan`, `adopt materialize plan`, `adopt materialize apply`, `adopt materialize recover`, `repository-inventory`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | explicit repository root, explicit fresh/code-baseline/audit-from-code intent, optional stack hint, owner-reviewed candidate packet, expected transaction and desired-state identities, recovery action, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, and pilot records | bounded fixed-catalog root inventory, candidate-only front-door tasks, owner-closed read-only materialization plans, confined transactional apply and recovery receipts, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, and pilot shape admission | stack selection, arbitrary source inspection, candidate review, final requirement meaning, proof adequacy, rollout policy, text extraction, code observation extraction, and pilot truth | inventory, candidate-only plan, transaction-bound materialization plan or receipt, selected child output, report, seed packet, or agent envelope |
 | Requirement source | `capability-map-admission`, `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned capability maps, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate seed admission, candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | capability map report, authoring packet, source report, spec-tree report, rendered view, or browser presentation |

docs/specs/proofkit-spec-proof-core/overview.md

@@ -223,6 +223,10 @@ execution receipts, and merge policy.
   server bytes, source identity, drafts and independent generation/lock state.
 - `REQ-PROOFKIT-SPEC-041`: diff summaries count only admitted page changes and
   retain distinct global counts, source identities and full disclosed values.
+- `REQ-PROOFKIT-SPEC-042`: the explicit-root project browser retains one
+  closure-admitted capture, replays a versioned role-preserving context and
+  reuses the existing workspace and terminal lifecycle without manufacturing
+  proof coverage, losing source restrictions or rereading live files.
 
 ## Non-Claims
 

docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -789,6 +789,33 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-042",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The explicit-root view command consumes one completed read-only project inspection and retains an opaque project only after child admission, exact manifest route currentness and cross-record closure. Context schema 3 binds the captured manifest bytes, closed canonical project origin, exact role/source/path partition and derived collection in one snapshot; re-admission replays the project owner and rejects contradictory or re-signed projections. Existing context v1/v2 wire identities and source fragments remain unchanged. The existing workspace renders that captured context and declared-relation graph without rescanning, creating coverage or baseline evidence, writing project records or executing witnesses. Unicode handoff preserves original source digests, resolving pointers, requirement identity and distinct source and requirement non-claims even after live files change. Flags and mode constraints are admitted before project I/O; paths are not reinterpreted as flags. The default output is a bounded JSON plan, serving preserves the existing browse and one-shot process contracts, and every terminal route closes and awaits its owned server without double consumption or disclosing caller input.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-SPEC-042"
+      ],
+      "nonClaims": [
+        "Viewing a captured project does not establish native witness execution, semantic proof adequacy, live source freshness after capture, owner approval, merge, release, deployment or production readiness. Coverage and semantic diff require their own admitted evidence and are unavailable in the project front door."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.spec-proof-core",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
     }
   ],
   "nonClaims": [

internal/app/app.go

@@ -29,6 +29,10 @@ func RunWithRenderer(ctx context.Context, args []string, stdin io.Reader, stdout
 }
 
 func RunWithRendererAndCapabilities(ctx context.Context, args []string, stdin io.Reader, stdout io.Writer, stderr io.Writer, renderer cliexec.Renderer, capabilities PresentationCapabilities) int {
+	return runWithProjectView(ctx, args, stdin, stdout, stderr, renderer, capabilities, runProjectView)
+}
+
+func runWithProjectView(ctx context.Context, args []string, stdin io.Reader, stdout io.Writer, stderr io.Writer, renderer cliexec.Renderer, capabilities PresentationCapabilities, projectView projectViewRunner) int {
 	args, layout, layoutExplicit, err := parseProcessOptions(args)
 	if err != nil {
 		writeDiagnostic(stderr, err)
@@ -164,6 +168,8 @@ func RunWithRendererAndCapabilities(ctx context.Context, args []string, stdin io
 		return runPilotAdmission(args[1:], stdin, stdout, stderr)
 	case commandRunnerProjectStatus:
 		return runProjectStatus(ctx, args[0], args[1:], stdout, stderr, capabilities)
+	case commandRunnerProjectView:
+		return projectView(ctx, parsedArguments, stdout, stderr)
 	case commandRunnerProjectStructure:
 		return runProjectStructure(args[1:], stdin, stdout, stderr, renderer)
 	case commandRunnerTypeScriptPublicAPISurfaces:

internal/app/cli_contract_test.go

@@ -24,7 +24,7 @@ import (
 )
 
 const (
-	cliContractPublicABISHA256               = "3fea991fd7ef956c6e2252e909aa4a01ffaf453c8cf3ae1c6ba8df4fe9521cb1"
+	cliContractPublicABISHA256               = "ea558a436e8f4302da57a94695ccb4dbf8132e70a3a836e130a117d7d6a193c2"
 	maxAggregateFileReadBytesForContractTest = 64 << 20
 	maxPackageManifestBytesForContractTest   = 256 << 10
 	maxSourceFileBytesForContractTest        = 8 << 20
@@ -1539,6 +1539,7 @@ func TestDescriptorFlagConstraintsAreRenderedTruthfully(t *testing.T) {
 		"stack-preset":                   "agentic-proofkit stack-preset --preset <agentic_runtime_repo|generated_docs_contract_repo|python_service|python_typescript_service|typescript_monorepo|typescript_workspace>",
 		"status":                         "agentic-proofkit status [--color <auto|never>] [--format <json|text>] --repo-root <path>",
 		"typescript-public-api-surfaces": "agentic-proofkit typescript-public-api-surfaces --input <path|-> [--input-pointer <pointer>] --repo-root <path>",
+		"view":                           "agentic-proofkit view [--host <127.0.0.1|::1>] [--open] [--port <port>] --repo-root <path> [--serve] [--session-mode <browse|one-shot-question>] [--session-timeout-seconds <1..7200>]",
 	}
 	constrainedCount := 0
 	for _, descriptor := range commandDescriptors {