Keep both policy-visibility and inventory-api imports/routes after master
landed #838. Conflict was import-only in webui/app.py.
Closes conflict remediation for PR #856 / issue #646.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Clarify that Policy is live (not a Phase 1 placeholder) in shell docs and
nav module docstring. Strengthen the Policy nav graduation test to assert
status=live and absence of the nav-stub CSS class.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Address review blockers (review #555):
- Graduate /policy nav item out of STUB_PAGES to live nav in webui/nav.py
- Update docs/webui-local-dev.md to list /policy as a live surface and remove stub copy
- Run console_redaction on HTML emit path in webui/policy_views.py before rendering HTML
- Add planted-secret HTML redaction test and nav graduation test in tests/test_webui_policy_visibility.py
Phase 3 child of the Web Console epic #631. Operators can now see the active
workflow policy/guardrail configuration from the console instead of reading the
repo tree.
- webui/policy_inventory.py (new): redacted, machine-readable guardrail
inventory. One row per major guardrail (role separation/RBAC, lease rules,
worktree binding, merge confirmation, redaction, contamination, allocator
policy, audit logging, mutation gating) with source pointers (file/module/doc)
and a compact active projection from the existing safe policy accessors.
Fail-soft per entry; whole payload run through console_redaction before emit;
diff vs documented default where feasible.
- webui/policy_views.py (new): HTML cards with source pointers, active config,
and the documented-default diff; read-only page copy, no forms.
- webui/app.py: register GET /policy and GET /api/v1/policy (additive).
- webui/layout.py: add Policy nav item.
- tests/test_webui_policy_visibility.py (new): guardrail presence + source
pointers (AC1), redaction incl. planted-secret masking and scan_for_secrets
(AC2/AC3), read-only page + no-mutation routes (AC4), fail-soft rendering.
- docs/webui-local-dev.md: route table + read-only policy-visibility section.
Read-only throughout; no policy editing, no gate-weakening toggle, secrets
redacted.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
jcwalker3
sysadminandClaude Opus 4.8