Self-contained static frontend for the Prospect Platform API. There is no bundler or runtime dependency: serve this directory with any static HTTP server. The UI supports a manual, tenant-scoped review workflow; it does not discover prospects, scan DNS/websites, or send outreach.

Configure and run

The API base is configurable before app.js runs:

<script>window.API_BASE = 'http://127.0.0.1:8000';</script>
<script src="app.js"></script>

If not set, the UI uses localStorage.prospect_api_base when present; otherwise it targets the same origin. The dashboard requires an authenticated API session and shows the login screen until /api/v1/auth/me succeeds.

Phase 3 UI contract

The explorer requests tenant-scoped business pages from GET /api/v1/businesses and sends bounded pagination plus supported search/score/status filters to the API. Filtering is not a substitute for server-side authorization.
Selecting a row loads the tenant-scoped detail view, including child intelligence/evidence records, provenance/source labels, confidence/freshness, current pipeline state, notes, and relevant audit/activity context when available.
Add prospect, add intelligence, change pipeline state, and add note are explicit manual actions. The API records the acting user and applies permission, tenant, validation, deduplication, and suppression rules server-side.
Evidence labels describe stored observations and their provenance. The UI must not present them as the result of automated discovery, DNS lookup, website crawling, or verification unless a future approved integration explicitly supplies that evidence.
Review and suppressed states remain safety states. The UI shows outreach as unavailable; there is no send button, message composer, sender, or outreach endpoint.
The CSV control is preview-only and local to the browser. Selecting a file does not persist rows or send them to the API.

The API remains the source of truth for tenant isolation, pagination bounds, filters, pipeline transitions, notes, audit records, and suppression. See apps/api/README.md for the route contract.

Browser verification

Start the API from apps/api with python3 app/main.py.
Serve this directory: python3 -m http.server 8080 --directory apps/web.
Open http://127.0.0.1:8080, with window.API_BASE set to http://127.0.0.1:8000 using a tiny pre-load edit or browser devtools.
Sign in and confirm the header changes to API connected, tenant metrics populate, and the explorer renders a bounded page with search, score, status, and pagination controls.
Select a row and confirm the detail view keeps the business, child intelligence, evidence provenance, confidence/freshness, pipeline, notes, and audit context associated with that tenant.
Add or update only through the explicit manual controls. Confirm the refreshed detail/list state reflects the API response and that a viewer cannot mutate records.
Confirm review and suppressed rows show Outreach unavailable with the appropriate reason. Confirm there is no outreach/send endpoint or button.
Select a CSV and confirm a local, preview-only table appears without a network request or persistence.
Resize below 700px to verify the collapsible nav, stacked panels, and horizontally scrollable explorer/detail content.

A zero-dependency static smoke page (smoke-test.html) checks the key DOM contract in an iframe and reports pass/fail. Browser smoke coverage should treat pagination, detail child records, provenance rendering, pipeline/notes actions, and the disabled outreach state as separate checks.

Remaining limitations

The static client has no background discovery, DNS/website scanner, enrichment scheduler, or outreach integration. It cannot make missing provenance authoritative and should display API-provided limitations rather than infer them. CSV preview is capped for display and is not an import workflow. Production deployment still requires the security and operations gates in docs/SECURITY.md and docs/OPERATIONS.md.