feat(inspect): local prompts resolved like the server's

A file chosen on the Inspect page now shows the prompts and resolution
the server's inspector gives the same records: buildLocalPayload takes
its roles from the local resolver instead of the interim open roles, so
the legacy fill applies exactly where it does for Images.

The resolver reads the server's own node table. The page fetches
web/js/inspection-semantics.json once through the API client as it
mounts, before any selection; the static route serves that one JSON
file by exact path (every other JSON stays forbidden). A table that
cannot be fetched answers "The inspector's node table is unavailable."
as the server does, and a later selection asks again.

The Copy settings summary deviation is numbered D117.

tests/browser/full-inspector.spec.mjs

@@ -237,7 +237,7 @@ const viewerStructure=details=>details.evaluate(node=>{
 test('viewer details hold provenance, raw records and downloads',async({page,request})=>{
     await page.setViewportSize({width:1600,height:1100});const reads=await patchInspection(page);
     await fullFixture(page,request);let details=await viewerDetails(page,'complete.png');
-    // The panel content without the cover, D-NEW-1's Copy settings summary after the facts, then the two disclosures,
+    // The panel content without the cover, D117's Copy settings summary after the facts, then the two disclosures,
     // then the pair send and history buttons (D20).
     expect(await viewerStructure(details)).toEqual({outer:['div','button.send','button'],
         inner:['div.panel-heading','p.small','div.tags','section.prompt-section.positive','section.prompt-section.negative','div.tags','dl.meta-grid','button','details','details']});

tests/browser/inspect-concept.spec.mjs

@@ -159,7 +159,7 @@ async function withProductionCopy(page) {
 }
 
 /**
- * D66: the viewer of a local file is titled by its filename and has no tag chips and no Prompt history. D-NEW-1 (LI-4):
+ * D66: the viewer of a local file is titled by its filename and has no tag chips and no Prompt history. D117 (LI-4):
  * "Copy settings summary" follows the six facts.
  */
 function mapViewerConcept(reference) {
@@ -274,7 +274,7 @@ for (const [width, height] of SIZES) for (const theme of THEMES) {
         // The chooser names the chosen file after a real setInputFiles, as the concept's does.
         expect(production.initial.chosen).toEqual({ name: '', files: [] });
         expect(production.selected.chosen).toEqual({ name: FILE, files: [FILE] });
-        // D66 in the rail: no tag chips and no Prompt history; the title is the filename. D-NEW-1 follows the facts.
+        // D66 in the rail: no tag chips and no Prompt history; the title is the filename. D117 follows the facts.
         expect(production.viewer.sections).toEqual(['heading', 'filename', 'badges', 'positive', 'send positive', 'negative',
             'send negative', 'facts', 'settings summary', 'File & provenance', 'Workflow & raw metadata', 'send pair']);
     });

tests/browser/inspector-concept.spec.mjs

@@ -45,9 +45,9 @@ function withCategoryScope(inventory) {
 }
 
 /**
- * Recorded inspector deviations only (spec §8, TESTING.md D3, D20–D22, D34, D38 and D-NEW-1); everything else must
+ * Recorded inspector deviations only (spec §8, TESTING.md D3, D20–D22, D34, D38 and D117); everything else must
  * equal production. `reference.viewerPlain` is the concept's own full details
- * with its tag chips made plain (D20), D-NEW-1's summary button added and, under a coarse pointer, D34's targets, all at
+ * with its tag chips made plain (D20), D117's summary button added and, under a coarse pointer, D34's targets, all at
  * runtime: the browser lays out what follows them, as the Images spec's removed toolbar items do.
  */
 export function mapInspectorConcept(reference,{viewport}) {
@@ -106,7 +106,7 @@ async function openProductionPanel(page,theme) {
 }
 
 /**
- * The concept's tag chips in the open viewer as plain `span.chip`s (D20), D34's coarse targets and D-NEW-1's "Copy
+ * The concept's tag chips in the open viewer as plain `span.chip`s (D20), D34's coarse targets and D117's "Copy
  * settings summary" after the six facts (LI-4), drawn as the concept's own plain button (its "Download sample JSON",
  * without its action); returns an undo.
  */
@@ -351,7 +351,7 @@ for(const [width,height] of SIZES)test(`image tags saved on the concept image ke
 
 // The comparison is only worth something if it notices a change (spec §7 mutation check): on the panel one CSS
 // mutation (the role label's letter spacing) and one DOM mutation (the footer removed); in the viewer (final review m5)
-// its pair actions removed, D38's Show in folder removed and D-NEW-1's summary removed; each applied after an exact match.
+// its pair actions removed, D38's Show in folder removed and D117's summary removed; each applied after an exact match.
 test('inspector comparison detects mutations',async({page})=>{
     test.setTimeout(120_000);
     const viewport={width:1600,height:1100};
@@ -375,7 +375,7 @@ test('inspector comparison detects mutations',async({page})=>{
     expect(()=>assertInspectorMatch(reference,withoutActions,viewport)).toThrow(/viewerDetails\.actions/);
     const withoutReveal=await viewerMutated({remove:['#viewer-details button[aria-label$=" in folder"]']});
     expect(()=>assertInspectorMatch(reference,withoutReveal,viewport)).toThrow(/fileControls/);
-    // D-NEW-1: the summary action after the facts is part of the mapped concept, so losing it is a difference.
+    // D117: the summary action after the facts is part of the mapped concept, so losing it is a difference.
     const withoutSummary=await viewerMutated({remove:['#viewer-details > div > button']});
     expect(()=>assertInspectorMatch(reference,withoutSummary,viewport)).toThrow(/viewerDetails\.structure\.inner/);
     assertInspectorMatch(reference,await viewerMutated(),viewport);

tests/browser/workspace-history.spec.mjs

@@ -494,7 +494,7 @@ test('the inline current file names its prompts apart from the frozen run fields
     expect(await exact(dialog(page).getByRole('region',{name:'Positive prompt',exact:true}).locator('p.prompt-text'))).toBe(before);
 });
 
-// LI-4 (D-NEW-1): the recorded history's current-file viewer is the shared full inspector, so it copies the legacy summary.
+// LI-4 (D117): the recorded history's current-file viewer is the shared full inspector, so it copies the legacy summary.
 test('the current file viewer copies its settings summary',async({page})=>{
     await page.addInitScript(()=>{window.__copied=[];Object.defineProperty(navigator,'clipboard',{configurable:true,value:{writeText:async text=>{window.__copied.push(text);}}});});
     await page.route(url=>url.pathname.endsWith('/inspection'),async route=>{const response=await route.fetch();const body=await response.json();

tests/browser/workspace-inspect.spec.mjs

@@ -207,6 +207,40 @@ test('chooser opens the shared full inspector without a second read', async ({ p
     expect(await page.evaluate(() => window.__slices)).toBe(0);
 });
 
+// PR L3 Task 10: local roles are the server inspector's (local-resolver.mjs), so for every parity PNG the rail shows the
+// prompts, their status lines and the facts Images shows for the same bytes in the output folder.
+const PARITY_PNGS = ['f01b', 'f02', 'f03', 'f06a', 'f06b', 'f06c', 'f06d', 'f06e', 'f07a', 'f07b', 'f08', 'f09', 'f10', 'f11', 'f12',
+    'f14', 'f15', 'f16', 'f17', 'f19', 'f20', 'f21', 'f22', 'f23', 'f24'];
+const roleSections = locator => locator.evaluate(node => [...node.querySelectorAll('.prompt-section')].map(item => item.textContent));
+
+test('chooser shows the Images roles and resolution for every parity PNG', async ({ page, request }) => {
+    test.slow();
+    for (const name of PARITY_PNGS) {
+        await expect(await request.post('/__test__/add-local-inspect-file', { data: { name: `${name}.png` } })).toBeOK();
+    }
+    const served = {};
+    await page.goto(`${workspace}#/images`);
+    for (const name of PARITY_PNGS) {
+        await page.locator(`article[data-image-key="0:local-inspect/${name}.png"] .image-open`).click();
+        await expect(viewer(page).locator('#viewer-title')).toHaveText(`${name}.png`);
+        await expect(rail(page).locator('.panel-heading')).toBeVisible();
+        await expect(rail(page).locator('.prompt-section')).not.toHaveCount(0);
+        served[name] = { content: await railContent(rail(page)), roles: await roleSections(rail(page)) };
+        await page.keyboard.press('Escape');
+        await expect(viewer(page)).toHaveCount(0);
+    }
+    await openInspect(page);
+    for (const name of PARITY_PNGS) {
+        await choose(page, parityPng(`${name}.png`));
+        await openViewer(page);
+        await expect(viewer(page).locator('#viewer-title')).toHaveText(`${name}.png`);
+        await expect(rail(page).locator('.prompt-section')).not.toHaveCount(0);
+        expect({ content: await railContent(rail(page)), roles: await roleSections(rail(page)) }, name).toEqual(served[name]);
+        await page.keyboard.press('Escape');
+        await expect(viewer(page)).toHaveCount(0);
+    }
+});
+
 test('Import → Inspect a local image lands here', async ({ page }) => {
     await page.goto(`${workspace}#/images`);
     await page.getByRole('button', { name: 'Import', exact: true }).click();
@@ -652,13 +686,19 @@ test('local roles send exactly', async ({ page, context }) => {
 
 test('local inspection makes no content request or storage write', async ({ page }) => {
     await instrument(page);
-    await openInspect(page);
-    // The shell's own reads (counts, Activity) settle before the baseline.
-    await expect(page.locator('aside.sidebar nav [data-route="images"] .nav-count')).toBeAttached();
-    const baseline = (await urls(page)).writes.length;
     const requests = [];
     page.on('request', request => requests.push({ url: request.url(), method: request.method(), body: request.postData() }));
     page.on('websocket', socket => requests.push({ url: socket.url(), method: 'WS', body: null }));
+    const table = /\/prompt_manager\/js\/inspection-semantics\.json$/;
+    const tableRead = page.waitForResponse(response => table.test(response.url()));
+    await openInspect(page);
+    // The one static file Inspect reads, its node table, is fetched as the page mounts: before any selection.
+    expect((await tableRead).ok()).toBe(true);
+    // The shell's own reads (counts, Activity) settle before the baseline.
+    await expect(page.locator('aside.sidebar nav [data-route="images"] .nav-count')).toBeAttached();
+    const baseline = (await urls(page)).writes.length;
+    const before = requests.length;
+    expect(requests.filter(entry => table.test(entry.url))).toHaveLength(1);
     for (const file of [sendablePng('private-name.png'), localFixture('core-tags.webm', 'video/webm', 'private-clip.webm')]) {
         await choose(page, file);
         await openViewer(page);
@@ -666,7 +706,8 @@ test('local inspection makes no content request or storage write', async ({ page
         await page.keyboard.press('Escape');
         await expect(viewer(page)).toHaveCount(0);
     }
-    const network = requests.filter(entry => !entry.url.startsWith('blob:') && !entry.url.startsWith('data:'));
+    const network = requests.slice(before).filter(entry => !entry.url.startsWith('blob:') && !entry.url.startsWith('data:'));
+    expect(requests.filter(entry => table.test(entry.url)), 'the table is read once per page').toHaveLength(1);
     expect(network.filter(entry => /private|lighthouse|fox/.test(`${entry.url} ${entry.body ?? ''}`))).toEqual([]);
     expect(network.filter(entry => entry.method !== 'GET')).toEqual([]);
     expect(network.filter(entry => !/\/prompt_manager\/(activity|images\/output|library|vocabulary)/.test(entry.url))).toEqual([]);
@@ -686,7 +727,7 @@ test('touch layout at 390 has no horizontal overflow at 200% zoom', async ({ pag
     }
 });
 
-// LI-4 (D-NEW-1): "Copy settings summary" after the six facts is the legacy metadata page's COPY ALL, in the shared full
+// LI-4 (D117): "Copy settings summary" after the six facts is the legacy metadata page's COPY ALL, in the shared full
 // inspector, so a file served in Images and the same bytes chosen here copy the same summary of what the rail shows.
 /** Records clipboard writes in the page, or (`clipboard: false`) leaves the page without a clipboard. */
 async function stubClipboard(page, { clipboard = true } = {}) {

tests/js/support/local-inspect-oracle.mjs

@@ -42,11 +42,12 @@ const { extractGenerationFacts } = require(path.join(here, '..', '..', '..', 'we
 /** The local evidence for one set of record texts. */
 const resolved = records => ({ evidence: resolveLocalEvidence(records, semantics) });
 
-/** The six facts for one local read (no legacy fill here, as in the vectors' own harness). */
-function localFacts(read, file, classification, evidence) {
-    const payload = { ...buildLocalPayload({ read, file, classification }), prompts: evidence.prompts, resolution: evidence.resolution };
+/** The local wire's evidence and six facts for one read (no legacy fill, as in the vectors' own harness). */
+function localPayload(read, file, classification) {
+    const payload = buildLocalPayload({ read, file, classification, semantics });
     const record = projectInspectionPayload(payload, { kind: 'local-file', key: 'local:1', path: file.name }, null, extractGenerationFacts);
-    return Object.fromEntries(Object.entries(record.generation).map(([field, fact]) => [field, { status: fact.status, value: fact.value }]));
+    const facts = Object.fromEntries(Object.entries(record.generation).map(([field, fact]) => [field, { status: fact.status, value: fact.value }]));
+    return { evidence: { prompts: payload.prompts, resolution: payload.resolution }, facts };
 }
 
 const selectionRead = (selection) => selection.status === 'complete' ?
@@ -63,8 +64,11 @@ for (const entry of JSON.parse(Buffer.concat(chunks).toString('utf8'))) {
         const { classification, result } = await readLocalFile(blob, { pngMetadata });
         const read = classification === null ? null : toInspectionRead(classification, result).read;
         if (classification === null) { output[name] = { unreadable: true }; continue; }
-        const answer = read === null ? { unreadable: true, evidence: unreadableEvidence() } : resolved(read.records);
-        output[name] = { ...answer, facts: localFacts(result, { name: path.basename(entry.path), size: blob.size }, classification, answer.evidence) };
+        // The evidence is the local wire's own (buildLocalPayload), and it equals resolveLocalEvidence of the records.
+        const local = localPayload(result, { name: path.basename(entry.path), size: blob.size }, classification);
+        const direct = read === null ? unreadableEvidence() : resolved(read.records).evidence;
+        if (JSON.stringify(direct) !== JSON.stringify(local.evidence)) throw new Error(`${name}: the wire's roles are not the resolver's`);
+        output[name] = read === null ? { unreadable: true, ...local } : local;
         continue;
     }
     if (entry.records !== undefined) {

tests/js/workspace-file-inspector.test.js

@@ -216,7 +216,7 @@ test('none and unavailable render no image chips', async () => {
     }
 });
 
-// LI-4 (D-NEW-1): "Copy settings summary" after the six facts of the full inspector consolidates the legacy metadata
+// LI-4 (D117): "Copy settings summary" after the six facts of the full inspector consolidates the legacy metadata
 // page's COPY ALL (web/metadata.html copyAllData). The legacy template is read from that page itself and run on the
 // legacy parse, so the summary's text is the legacy page's, line for line, wherever the two agree on the values.
 const METADATA_PAGE = fs.readFileSync(new URL('../../web/metadata.html', import.meta.url), 'utf8');
@@ -228,7 +228,7 @@ const legacyParams = record => ComfyMetadata.extractGenerationParams({prompt:rec
     workflow:record.metadata.workflow_graph.status === 'parsed' ? record.metadata.workflow_graph.value : null});
 
 /**
- * Each summary line against the legacy page's, allowing only the recorded differences (D-NEW-1): a number keeps the
+ * Each summary line against the legacy page's, allowing only the recorded differences (D117): a number keeps the
  * inspector's (the server's) spelling ("8.0" where the legacy page wrote 8); a fact the legacy parse left "Unknown" may
  * be known; and a negative the #249 ZeroOut guard zeroed reads "No negative prompt found" where the legacy parse read
  * the positive's text through the zero-out.

tests/js/workspace-local-inspection.test.js

@@ -20,6 +20,13 @@ const { extractGenerationFacts } = ComfyMetadata;
 // The page loads both as scripts; the legacy fill and the PNG reader find them on the global.
 globalThis.PngMetadata = PngMetadata;
 globalThis.ComfyMetadata = ComfyMetadata;
+// The page's API client and the node table it serves (local-semantics.mjs fetches it once).
+const SEMANTICS = fs.readFileSync(path.join(here, "..", "..", "web", "js", "inspection-semantics.json"), "utf8");
+globalThis.window = { ApiClient: { resolveUrl: (value) => value } };
+globalThis.fetch = async (url) => {
+    if (url !== "/prompt_manager/js/inspection-semantics.json") throw new Error(`unexpected request ${url}`);
+    return new Response(SEMANTICS, { status: 200 });
+};
 const m = await import("../../web/js/workspace/local-inspection.mjs").catch((error) => {
     if (error.code !== "ERR_MODULE_NOT_FOUND") throw error;
     return {};
@@ -66,8 +73,12 @@ test("a PNG File becomes the server-shaped wire with local provenance", async ()
         size: file.size, width: 640, height: 480, modified_time: 1_700_000_000.123 });
     assert.equal(wire.success, true);
     assert.equal(wire.inspection_version, 1);
-    assert.deepEqual(wire.prompts, { positive: { status: "unresolved" }, negative: { status: "unresolved" } });
-    assert.deepEqual(wire.resolution, { state: "unresolved", sampler_id: null, reason: "Resolved in this browser from the workflow.", reason_code: null, node: null });
+    // The roles the server's inspector resolves for the same records (local-resolver.mjs).
+    assert.deepEqual(wire.prompts, {
+        positive: { status: "resolved", text: "a red fox in snow, detailed fur", source: "graph-inferred" },
+        negative: { status: "resolved", text: "blurry, lowres", source: "graph-inferred" },
+    });
+    assert.deepEqual(wire.resolution, { state: "resolved", sampler_id: "3", reason: "", reason_code: null, node: null });
     assert.deepEqual(wire.library, { status: "unavailable", scope: "saved-library", tags: [], category_scope: null, tags_scope: null });
     assert.equal(wire.metadata.status, "available");
     assert.deepEqual(wire.metadata.raw, { prompt: PROMPT, workflow: WORKFLOW });
@@ -96,6 +107,33 @@ test("a PNG File becomes the server-shaped wire with local provenance", async ()
     assert.equal(exported.file.source_label, "Selected local file");
 });
 
+test("roles answer as the server's inspector: unreadable, unavailable table, ambiguous", async () => {
+    const png = { media: "image", kind: "png" };
+    const unreadable = m.buildLocalPayload({ read: null, file: { name: "a.png" }, classification: png });
+    assert.deepEqual(unreadable.resolution, { state: "unresolved", sampler_id: null, reason: "Media metadata could not be read", reason_code: null, node: null });
+    assert.equal(unreadable.prompts.positive.message, "Metadata in this file could not be read.");
+    const records = { prompt: PROMPT };
+    const read = { status: "complete", records, limited: [], width: 2, height: 3 };
+    // Without a table (it could not be fetched) the roles stay open, with the server's own line.
+    const missing = m.buildLocalPayload({ read, file: { name: "a.png" }, classification: png });
+    assert.equal(missing.resolution.reason, "Inspection node semantics are unavailable");
+    assert.equal(missing.prompts.positive.message, "The inspector's node table is unavailable.");
+    const semantics = await (await import("../../web/js/workspace/local-semantics.mjs")).loadInspectionSemantics();
+    const graph = JSON.parse(PROMPT);
+    graph["9"] = { ...graph["3"], inputs: { ...graph["3"].inputs, positive: ["8", 0] } };
+    graph["8"] = { class_type: "CLIPTextEncode", inputs: { text: "a cat", clip: ["4", 1] } };
+    const several = m.buildLocalPayload({ read: { ...read, records: { prompt: JSON.stringify(graph) } }, file: { name: "a.png" }, classification: png, semantics });
+    assert.equal(several.resolution.reason, "Multiple sampler branches");
+    assert.deepEqual(several.prompts.positive, { status: "ambiguous", text: null, source: null });
+    // The legacy fill then applies exactly as it does to the server's answer for the same bytes in Images.
+    const handle = await handleFor(pngFile("grid.png", [tEXt("prompt", JSON.stringify(graph))]));
+    const local = m.localFileAdapter.toRecord(several, handle, extractGenerationFacts);
+    const asServed = { ...several, file: { ...several.file, observation: "current-file", source_label: "output" } };
+    const served = projectInspectionPayload(asServed, { kind: "rooted-file", key: "0:grid.png", root_index: 0, path: "grid.png", root_scope: null }, null, extractGenerationFacts);
+    assert.deepEqual(local.prompts, served.prompts);
+    assert.deepEqual(local.generation, served.generation);
+});
+
 test("file facts follow the server: extension like Path.suffix, null when unknown", async () => {
     const cases = [["a.b.PnG", ".png"], [".hidden", ""], ["noext", ""], ["dot.", ""], ["x.tar.gz", ".gz"]];
     for (const [name, extension] of cases) {

tests/js/workspace-local-semantics.test.js

@@ -0,0 +1,43 @@
+// web/js/workspace/local-semantics.mjs (#249 local Inspect, PR L3 Task 10): the node table local Inspect resolves
+// with is the server's own web/js/inspection-semantics.json, fetched once through the API client before a file is
+// chosen. A table that cannot be fetched or used answers as the server does when its table is unusable.
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+
+const TABLE = fs.readFileSync(new URL("../../web/js/inspection-semantics.json", import.meta.url), "utf8");
+let instance = 0;
+/** A fresh module instance (its cache is per page) with `fetch` and the API client stubbed. */
+async function load(respond) {
+    const calls = [];
+    globalThis.window = { ApiClient: { resolveUrl: (path) => `/proxy${path}` } };
+    globalThis.fetch = async (url, init) => { calls.push([url, init]); return respond(); };
+    const module = await import(`../../web/js/workspace/local-semantics.mjs?instance=${++instance}`);
+    return { module, calls };
+}
+test.after(() => { delete globalThis.window; delete globalThis.fetch; });
+
+test("the table is fetched once through the API client and compiled", async () => {
+    const { module, calls } = await load(() => new Response(TABLE, { status: 200 }));
+    const [first, second] = await Promise.all([module.loadInspectionSemantics(), module.loadInspectionSemantics()]);
+    assert.equal(first, second);
+    assert.ok(first.samplers.has("KSampler"));
+    assert.equal(await module.loadInspectionSemantics(), first);
+    assert.deepEqual(calls, [["/proxy/prompt_manager/js/inspection-semantics.json", { credentials: "same-origin" }]]);
+});
+
+test("a failed or unusable table is null, and a later selection asks again", async () => {
+    for (const respond of [() => new Response("nope", { status: 404 }), () => new Response("{\"schema\": 2}", { status: 200 }), () => { throw new TypeError("offline"); }]) {
+        const { module, calls } = await load(respond);
+        assert.equal(await module.loadInspectionSemantics(), null);
+        assert.equal(await module.loadInspectionSemantics(), null);
+        assert.equal(calls.length, 2);
+    }
+});
+
+test("without the API client nothing is fetched", async () => {
+    const { module, calls } = await load(() => new Response(TABLE));
+    delete globalThis.window;
+    assert.equal(await module.loadInspectionSemantics(), null);
+    assert.deepEqual(calls, []);
+});

tests/js/workspace-toolbar.test.js

@@ -521,7 +521,7 @@ test('copy fallback selects the text', async () => {
         assert.equal(note.className, 'small');
         assert.equal(note.textContent, 'Automatic clipboard access requires a secure browser context.');
         assert.throws(() => openCopyFallback(42, { scope }), TypeError);
-        // LI-4 (D-NEW-1): the settings summary names its own dialog; the select-to-copy body is the same.
+        // LI-4 (D117): the settings summary names its own dialog; the select-to-copy body is the same.
         openCopyFallback('Seed: 7', { scope, title: 'Copy settings summary' });
         assert.equal(byId(dom, 'modal-title').textContent, 'Copy settings summary');
         assert.equal(byId(dom, 'copy-text').value, 'Seed: 7');

tests/test_api_core.py

@@ -477,6 +477,30 @@ class TestStaticRoutes(CoreRoutesTestCase):
         self.assertEqual(resp.status, 200)
         self.assertIn("application/javascript", resp.headers["Content-Type"])
 
+    async def test_inspection_semantics_table_is_the_one_json_served(self):
+        """Local Inspect reads the node table the server resolves with (#249 PR L3).
+
+        Only that exact file is served; every other JSON stays forbidden.
+        """
+        resp = await self.client.request(
+            "GET", "/prompt_manager/js/inspection-semantics.json"
+        )
+        self.assertEqual(resp.status, 200)
+        self.assertIn("application/json", resp.headers["Content-Type"])
+        table = Path(__file__).resolve().parents[1] / "web" / "js"
+        self.assertEqual(
+            await resp.read(), (table / "inspection-semantics.json").read_bytes()
+        )
+        for path in (
+            "js/shared/toolkit/provenance.json",
+            "lib/viewerjs/provenance.json",
+            "lib/inspection-semantics.json",
+            "js/workspace/..%2Finspection-semantics.json",
+            "js/INSPECTION-SEMANTICS.json",
+        ):
+            resp = await self.client.request("GET", f"/prompt_manager/{path}")
+            self.assertIn(resp.status, (403, 404), path)
+
     async def test_lib_served(self):
         web_dir = self._fake_root()
         (web_dir / "lib" / "x.css").write_text("body{}")