E8: Operator console (UI)

[gnanirahulnutakki]

Goal. a thin, unprivileged operator console — fleet view, a workspace/cluster/service picker, intent proposal with plan preview, multi-approver approval, and run/wave status — that is a client of the governed API with no privileged path.

Phase / depends. P1 (a thin read view) → P3 (proposal, approval, and wave status). Depends on: E2 (reads), E5 (proposal/approval flows), E6 (status and history). Per ADR-0002 the UI is deliberately minimal; the product's value is the governed API, and the UI has exactly the governance the MCP surface does.

Features

• F8.1 — fleet view
• F8.2 — workspace/cluster/service picker
• F8.3 — intent proposal UX
• F8.4 — multi-approver approval UX
• F8.5 — run/wave status view

Exit criteria

• A thin, unprivileged console renders tenant-scoped fleet view with freshness badges and a membership-bounded picker.
• Operators propose closed-vocabulary intents with a plan preview through the same governed API.
• Approval UX enforces distinct proposer/approver and arg-hash-bound, single-use approvals server-side.
• Run/wave status shows per-cluster outcomes, gates, rollback, and abstention truthfully.

---

Source: docs/EPICS.md, docs/SITH-NOTION.md · part of the Sith implementation backlog (see the master roadmap issue).

[gnanirahulnutakki]

Progress update: #175 is complete via #176, merged at 441dfb5d47b0e81001a565b8de887e2e86d749b8.

The Hub now has its bounded, server-side OIDC Authorization Code + PKCE browser-session broker, while the fleet API remains bearer-only. Exact post-merge CI and CodeQL passed. This completes F8.1a; it does not mark the broader E8 UI/read-rendering work complete.

[gnanirahulnutakki]

P1 follow-up filed as #218: a separate Hub-only, tenant-scoped read console over the existing fleet.Source/PEP path. It preserves the bearer API as bearer-only, keeps the session JWT HttpOnly/server-side, adds a session/workspace/expiry-bound CSRF token and strict CSP, renders coverage gaps explicitly, and imports no local operations or mutation capability. F8.2 service navigation and all proposal/approval/run UX remain separate dependency-gated slices.

[gnanirahulnutakki]

F8.1b is complete via #218 and PR #219, merged to dev as b9d5a933f29b900ad41bfa70090a968a698bff3c.

The first rendered Hub fleet slice now shows tenant-scoped cluster reachability, observation time, and visible current/stale/partial/unreachable/inconsistent/unaccounted coverage through a separate GET-only cookie/session + CSRF adapter over the existing PEP read. It does not mount the local capability-bearing UI, poll, refresh collectors, call connectors, or add writes.

Exact post-merge CI and CodeQL passed; security queues are 0/0/0.

E8 remains open. Inventory/correlation rendering, the membership-bounded workspace/cluster/service picker, and all proposal/approval/run-wave UX are still separate dependency-gated slices.

[gnanirahulnutakki]

Problem

#218 completed the first F8.1 Hub rendering slice at FleetResult altitude, but the E8 acceptance
criterion still requires one fleet-wide health correlation answer such as “where is payments not
Healthy?”. The bounded, tenant-scoped, PEP-governed hubfleet.Correlator already exists; it is not
yet composed into the Hub runtime or browser console.

Scope

• Construct the existing hubfleet.Correlator in the Hub runtime from the app database and PEP.
• Add one exact GET-only console correlation adapter for the signed workspace.
• Accept only one canonical resource kind, exact name, optional namespace, and the fixed
  health_not=Healthy condition; reject unknown, duplicate, malformed, oversized, Secret, method,
  path, fragment, and query inputs before the correlator.
• Gate correlation with its own short-lived process-key HMAC proof bound to the exact session,
  workspace, correlation-read purpose, and expiry. Do not reuse the fleet-snapshot proof.
• Project the result to only cluster scope, resource kind, namespace, name, normalized health,
  observation time, and stale/stale-for state plus coverage assessment. Do not return raw
  Observed, attributes, workspace, provenance/native IDs, deep links, or source payloads.
• Render one fleet-wide answer with named stale/unreachable/truncated/unaccounted/inconsistent gaps.
  Use text-only DOM construction, keyboard-accessible form controls, and the existing responsive
  visual language.
• Perform one bounded persisted query only on explicit submit. No automatic correlation request,
  polling, collector refresh, connector call, local operation, persistence, or write.
• Pin the new route, dependency, asset behavior, and absence of mutation capabilities structurally.

Acceptance criteria

• A signed member can ask where one exact non-Secret resource is not Healthy and receives one
  tenant-scoped, coverage-honest multi-spoke answer through the existing PEP verb.
• Foreign-workspace, missing/expired/replayed-after-restart proof, bearer fallback, cross-site
  metadata, duplicate cookie/header/query, and unsafe resource input fail before any database read.
• The browser response contains no raw observation, provenance/native identifier, credential,
  internal error, or unreviewed field.
• Empty, stale, partial, unreachable, inconsistent, and unaccounted results never claim fleet
  health or completeness.
• Focused race/adversarial coverage, full CI, forced-RLS isolation, real two-cluster kind, release
  reproducibility, desktop/mobile inspection, independent review, hosted CI/CodeQL, security queue
  check, and exact post-merge dev proof all pass.

Security, operability, and cost

Resource identity is untrusted input but not a credential. Query values may appear in standard HTTP
access logs, so the route accepts no Secret kind or arbitrary selector/payload. The response is a
minimal projection and all rendering uses textContent. The slice creates no cloud resources and
no spoke egress; each explicit submit adds one bounded Hub database read plus normal CPU, response,
and log volume.

Parent: #26
Depends on: #218

[gnanirahulnutakki]

F8.1c health correlation is complete in #220 / #221 and merged to dev as 12ea3978ebc2547be32f2c50582219bd18147c13.

The Hub console can now answer one exact “where is this resource not Healthy?” question through the existing tenant-scoped PEP correlator, with purpose-separated browser proof, minimal fact projection, a hard result bound, and adjacent named coverage gaps. Exact post-merge CI (29572831265) and CodeQL (29572831347) passed; security queues are 0 / 0 / 0.

E8 remains open. F8.1 still needs the inventory-record rendering slice, and F8.2-F8.5 (workspace/cluster/service picker, proposal, approval, and run/wave status) remain outstanding in their dependency order.