S00 Nav Rendering Policy

Status: Frozen Date: 2026-03-29 Working directory: docs/modules/ui/v2-rewire Sprint: 20260218_005, task R0-03 (updated 2026-03-29 for 6-group restructure)

Policy statement

Capabilities may be rendered as direct shortcuts in the sidebar if and only if:

1. Ownership is labeled with the correct group name in breadcrumbs and page headers.
2. The canonical routes for those capabilities live under the group’s route prefix.
3. The sidebar shortcut links to the canonical route, not an alias.

This policy prevents mixed rendering where the same screen appears to be owned by two domains.

Canonical sidebar groups (6 groups)

The sidebar is organized into exactly 6 menu groups identified by menuGroupId:

Policy dissolution

The former policy group was dissolved in the 7-to-6 restructure. Policy is a toolset, not a persona – its items were distributed by audience:

• Security absorbed: VEX & Exceptions, Risk & Governance (including Simulation and Policy Audit). These are consumed by security practitioners during triage and risk assessment.
• Operations absorbed: Policy Packs. Pack authoring and management is an operational/admin workflow.

There is no standalone “Policy” group in the sidebar. The /ops/policy/* route prefix is retained for backward compatibility but items are surfaced under their new parent groups.

New items surfaced (2026-03-29)

• Readiness (/releases/readiness) – added to Release Control. Surfaces gate status and release readiness checks before promotion.
• Findings Explorer (/security/findings) – added as a child of Security Posture. Provides a filterable view of all security findings across the fleet.

Items removed from direct navigation

The following items are no longer direct sidebar entries but remain routable for deep links and contextual navigation:

• Runtime Drift, Notifications, Watchlist – accessible from Operations Hub landing page
• Replay & Verify, Bundles, Trust – accessible from Evidence Overview and Decision Capsules detail

Allowed rendering model

Desktop (expanded sidebar)

[Home]
  Dashboard
Release Control
  Deployments          [badge: failed runs + pending approvals]
  Releases             [badge: blocked gates]
  Environments
  Readiness
Security
  Vulnerabilities      [badge: critical findings]
  Security Posture     [sparkline: security trend]
    Supply-Chain Data
    Findings Explorer
    Reachability
    Unknowns
  Scan Image
  VEX & Exceptions
  Risk & Governance
    Simulation
    Policy Audit
Evidence
  Evidence Overview
  Decision Capsules
  Audit Log
  Export Center
Operations
  Operations Hub       [sparkline: platform trend]
  Policy Packs
  Scheduled Jobs
  Feeds & Airgap
  Agent Fleet
  Signals
  Scripts
  Diagnostics
Settings
  Integrations
  Identity & Access
  Certificates & Trust
  Theme & Branding
  User Preferences

Desktop (collapsed sidebar – icons only)

• Show icon for each group root only.
• Tooltip on hover shows the group label.
• Click navigates to the first item in the group or last active child.
• No separate child icons in collapsed mode.

Mobile (navigation drawer)

• All 6 groups appear as top-level items in the drawer.
• Groups expand in-place to show child nav items.
• No capabilities may appear as top-level drawer items separate from their group.

Breadcrumb rules

Canonical format: Group > Capability > [Sub-page]

Concrete counter-examples (forbidden)

Legacy label transition behavior

Where users know a surface by an old label, show a compact transition label during the migration window defined in S00_route_deprecation_map.md.

Rules:

• Transition labels appear only in page headers and sidebar items, not in breadcrumbs.
• Format: canonical label is primary; old label appears parenthetically – e.g., Certificates & Trust (formerly Certificates).
• Transition labels are removed at sprint 016 cutover unless traffic evidence requires extension.
• Canonical labels are always primary; old labels never replace canonical ones.

Planned transition labels:

Explicit do-not list

The following rendering patterns are forbidden in any sprint implementation:

1. Do not place any capability as a root-level sidebar item independent from its canonical group.
2. Do not display a breadcrumb that omits the canonical group prefix.
3. Do not show different ownership labels on desktop vs. mobile for the same screen.
4. Do not use legacy root-level nav paths (e.g., /approvals, /releases at root) as the canonical nav target – they must redirect to canonical targets.
5. Do not reintroduce a policy group – Policy items live under Security and Operations.
6. Do not label Policy Packs as owned by Security – Packs authoring is an Operations concern.
7. Do not introduce a new root domain that is not in the canonical 6: Home, Release Control, Security, Evidence, Operations, Settings.

Route alias requirements for migration

During the alias window, legacy paths must:

• Resolve to the canonical routes under the new group structure.
• Render the canonical breadcrumb (e.g., Security > VEX & Exceptions) – not an alias-derived breadcrumb.
• Not appear as primary nav items in the sidebar; the sidebar must link to canonical paths only.