# Dynamic UIs

> Publish, govern, update, and optionally persist an Agent-facing web interface.

A UI is a first-class, non-invokable Resource that gives one exact Channel and Agent revision a stable public URL. Use it when an Agent needs to publish a chat surface, dashboard, or small interactive application. The Console and Const Alpha create and operate the same `ui` Resource through the normal Constal API; the isolated serving runtime remains a private implementation detail.

## Identity and updates {#identity-and-updates}

The opaque `https://ui-….constal.dev/` URL is stable for the lifetime of the UI identity. Source, Channel, Agent, authentication, Policy, execution mode, and limits are immutable revision inputs. Editing any of them creates a new revision with an expected-current-hash check, then atomically moves the stable route to that revision. Requests already admitted remain pinned to their accepted revision.

The runtime gives every distinct code and configuration revision a distinct immutable execution identity. It never mutates cached code under an existing identity. This preserves auditability while allowing safe runtime reuse. Enable and disable use the ordinary Resource control path; disabling rejects new admissions without rewriting the current revision.

## Stateless and durable execution {#execution-modes}

Choose **Stateless** for chat templates and applications whose durable data already belongs to Agent Sessions, Memory, or another governed Resource. This is the default and has no durable coordination hop.

Choose **Durable SQLite** only when the presentation itself needs local coordination or state. Constal routes that UI through one deterministic, isolated instance with its own SQLite database. The authored handler receives a bounded synchronous `state.query` and `state.batch` interface, never a raw infrastructure namespace or storage authority.

Updating a durable UI stops the old code while preserving its database, then starts the same durable instance with the new immutable code version. A schema change requires a synchronous, state-only migration hook. The migration runs once inside the native SQLite transaction boundary; failure rolls back and fences that revision. A durable UI is consequently one coordination and throughput boundary. Applications needing horizontally distributed data should use their Agent's existing governed database Resource rather than expanding the UI serving adapter into a general database system.

## Access and capabilities {#access-and-capabilities}

A UI is either public or authenticated by one exact Auth Provider revision. Changing that shape creates a new UI revision. Every request still passes Resource control, authentication, `ui:access` Policy, billing admission, and bounded rate and byte checks before authored code runs.

Authored code receives only static assets, the exact UI identity and revision, and a narrow Channel capability fixed to the selected Channel and Agent. Durable code additionally receives the bounded state capability. It receives no tenant API key, Credential, Registry, billing authority, raw storage, infrastructure namespace, or unrestricted network access. Channel calls keep the authenticated tenant, customer, and subject scope and pass through the Channel's existing Policy, selector, Run, and billing paths.

## Operate a UI {#operate}

Open **UIs** in the Console to copy or open the live URL, inspect exact targets and access, publish a new revision, enable or disable admission, or delete the identity. Deletion tombstones the opaque route so it cannot be reassigned. For custom code, build a `constal.ui.v1` bundle in the existing Sandbox and CAS workflow, then publish its exact CAS and manifest hashes. Never place secrets in a UI bundle.

Const Alpha uses the same discovery, plan, approval, and apply operations as the Console. Ask it to create or change a UI only after the required Agent, Channel, Auth Provider, Policies, and custom bundle artifact exist as exact Resources.