# FalseGreen UI Verification V1
This repository is a contract-first, deterministic UI evidence runtime for consequential Dioxus interfaces. It produces normalized UI evidence; it does not issue FalseGreen Core outcomes.
The implementation is intentionally usable without network access after locked dependencies are installed. The authoritative observation path mounts the transfer application in upstream Dioxus, dispatches events through its runtime, observes the current mounted `VirtualDom` plus renderer-facing mutations, and only then normalizes evidence. The local software rasterizer produces supplemental pixels. Vello and wgpu are neither dependencies nor qualification claims in V1.
## Quick start
```bash
# Prepare exact locked dependencies once.
cargo fetch --locked
# Run authoritative-path qualification without network access.
cargo test --workspace --offline
cargo run --locked --offline -p falsegreen-ui -- qualify
cargo run --locked --offline -p falsegreen-ui -- check \
--source-tree-sha256 <CORE_NORMALIZED_SOURCE_V5_SHA256> \
--cargo-lock Cargo.lock \
--matrix-out .falsegreen/ui-evidence-matrix
cargo run --locked --offline -p falsegreen-ui -- inspect --cargo-lock Cargo.lock
cargo run --locked --offline -p falsegreen-ui -- verify \
.falsegreen/ui-evidence-matrix/corrected/mobile-main
cargo run -p falsegreen-ui -- render --fixture account-normal --viewport mobile-main --out ./work/account-normal.png
```
`check` receives the one source identity computed by Core's `normalized-source-v5` implementation; the producer has no competing source-hash algorithm. The `--cargo-lock` compatibility spelling accepts only the canonical regular, non-symlink root `Cargo.lock` beside the source root's `Cargo.toml`. Cargo must accept that exact pair through `cargo metadata --locked --offline`; detached or pseudo lockfiles fail before evidence generation. The resolved Dioxus version must match the mounted `0.7.10` runtime. The matrix covers all four exact profiles and ten intentionally defective specimens.
`qualify` records real Dioxus rebuild, irrelevant rerender, event, state transition, and conditional-render evidence. `verify` checks the exact regular-file set, artifact index, digests, contract/source/runtime copies, tree identities, and recomputed producer diagnostics.
Evidence-producing CLI outputs must be normalized relative paths below `.falsegreen`; absolute, parent-traversing, and symlink-component paths fail closed. Core excludes `.falsegreen` from `normalized-source-v5`, freezes the artifact-index digest, and remains responsible for authoritative predicate evaluation and final Job status.
## Boundaries
- `falsegreen-ui-core` owns the versioned normalized tree and stable verification identities.
- `falsegreen-ui-dioxus` observes mounted VNodes and renderer mutations from the real Dioxus runtime and owns the narrow normalization adapter.
- `falsegreen-ui-layout` owns deterministic geometry observations.
- `falsegreen-ui-render` owns supplemental deterministic software capture.
- `falsegreen-ui-harness` owns the real Dioxus fixture, typed local action sink, and linked interaction record.
- `falsegreen-ui-evidence` owns obligations, normalized evidence, artifact digests, and diagnostic status.
- `falsegreen-ui` owns local diagnostics only.
No crate returns a Core `Accepted` result. The separate Core corrective candidate consumes the bundle and recomputes the frozen predicates through the normal verification-service lifecycle.
## Registry packages
The supported external producer is the complete seven-crate workspace. All workspace links use the Cargo `version` plus `path` pattern, so local development uses one source tree while published packages resolve only versioned registry dependencies. Publish in this order: `falsegreen-ui-core`; then `falsegreen-ui-dioxus`, `falsegreen-ui-layout`, and `falsegreen-ui-render`; then `falsegreen-ui-harness`; then `falsegreen-ui-evidence`; finally the `falsegreen-ui` CLI.
The render package contains the byte-identical DejaVu Sans fixture, manifest, and license notice needed by registry-installed qualification. No package depends on a parent workspace file at build time or runtime.
See [RUNTIME_CONTRACT.md](RUNTIME_CONTRACT.md), [SECURITY.md](SECURITY.md), and [docs/QUALIFICATION.md](docs/QUALIFICATION.md) for the frozen boundary and known qualification limitations.