WebMCP discovery
Open /workspace and verify document.modelContext exposes seven tools.
Architecture
Agent reasoning, human authority, database enforcement.
LoadGuard separates what an agent can reason about from what the system is allowed to execute. The WebMCP path creates and stages proposals; the human UI grants exact approval; the database validates authority before active state changes.
Judge verification
How to verify LoadGuard
Authority boundary
Stage a proposal and attempt commit before approval: APPROVAL_REQUIRED.
Human authorization
Approve through the UI only and verify approved hash equals staged hash.
Execution
Commit after approval: EXECUTED and active revision advances.
Idempotency
Repeat commit: ALREADY_EXECUTED and no duplicate mutation.
Ledger
Inspect human approval, agent commit, and refused duplicate events.
System layers
The implementation stack
| Layer | Technology | Purpose |
|---|---|---|
| Presentation | React 19 + TanStack Start | Landing, technical proof pages, and workspace shell |
| Spatial | React Three Fiber + Three.js | 3D active/candidate truck-load visualization |
| Agent interface | WebMCP document.modelContext | Page-defined tool contract for browser agents |
| Planning | Deterministic TypeScript planner | Complete candidate load plan generation |
| Validation | Independent deterministic validator | Hard-rule and warning evaluation |
| Server authority | TanStack server functions | Server-side operation boundary |
| Data / authority | Supabase Postgres + RPC + RLS | Proposal status, hashes, revisions, ledger |
| Deployment | Cloudflare Workers | Production runtime for the verified demo |
Data and control flow
Two paths converge at authority
WebMCP agent
Tool calls inspect, plan, validate, stage, and request commit.
Candidate proposal
Plans remain separate from active truck state until approval and commit.
Database authority
Status, hash, expiry, session, revision, coverage, and idempotency are checked.
Human UI approval
The operator approves the exact staged proposal. Approval is not a WebMCP tool.
Active load
Only a verified approved commit updates the real truck load and action ledger.
Authority model
Active and candidate state stay separate
Active state
The real truck operational load that is visible in the workspace.
Candidate
An agent-generated proposal snapshot that can be validated and staged.
Approved proposal
The exact staged candidate after human approval, still not yet active.
Commit
Database authority changes active state only after every guard passes.