feat: add interactive VT and workspace command plane

docs/PRODUCT_SPEC.md

@@ -25,6 +25,10 @@ The product should feel faster and calmer as concurrency rises.
    user-owned machine reached through SSH or Tailscale.
 9. Follow a project's Buzz channel and intentionally share a redacted pane image
    without leaving the workspace.
+10. Inspect terminal, browser, tools, context, goal, and review views without
+    losing the pane's process identity or execution target.
+11. Ask a local or selected-provider analyst for a small set of next actions,
+    then choose, edit, dismiss, or explicitly authorize one.
 
 ## Local and remote workspaces
 
@@ -54,6 +58,39 @@ devices.
 
 An arbitrary command remains a supported harness through the generic PTY adapter.
 
+## Pane surfaces and decision shelf
+
+A pane is the durable unit of work; its surface is a view over that work. The
+first surface set is Terminal, Browser, Tools, Context, Goal, and Review. A
+surface change never silently launches a process, moves the pane to another
+host, or changes which agent owns the session. Unsupported surfaces are shown as
+unavailable rather than simulated.
+
+An optional decision shelf sits below the active work surface. It may show an
+answer draft, two or three concrete choices, why each was suggested, and the
+capability each choice would need. Suggestions are inert data. Choosing one may
+prepare a typed workspace plan, but any command, file mutation, credential use,
+or external message still passes through the normal approval and command plane.
+
+## Lumbridge Harness
+
+Lumbridge Harness is an optional orchestrator distributed as a separately
+versioned component. It can analyze explicitly shared workspace state, refine
+prompts, recommend next steps, and coordinate supported agents. It does not own
+the desktop shell and is not required for terminal multiplexing.
+
+Its model boundary is provider-neutral. Initial development targets an
+OpenAI-compatible API so the same contract can use a local Spark/Qwen endpoint,
+Cerebras, or another user-selected provider. Credentials stay in the OS
+credential store and are resolved by opaque handle. Endpoint profiles must not
+embed secrets in workspace layouts, command arguments, or traces.
+
+Trace analysis is off until the user enables it for a workspace and selects the
+fields or sessions to share. Local analysis remains local. Sending trace data to
+a hosted provider requires a destination preview and a separate consent. The
+Harness receives only the Observe, Configure, or Execute capability granted for
+that run; autopilot cannot manufacture a broader grant.
+
 ## Provider modes
 
 Subscription mode delegates authentication to the installed upstream harness.
@@ -95,6 +132,7 @@ in the operating-system credential store.
 - A new foundation-model training or inference service.
 - A hosted account or mandatory Lumbridge cloud.
 - Replacing every coding harness with one Lumbridge-owned agent loop.
+- Making Lumbridge Harness, trace analysis, or autopilot mandatory.
 - Windows support.
 - Mobile control or collaborative hosted sessions.
 - Arbitrary third-party remote compute provisioning; the first release connects