feat(webui): add read-only console restart status and impact controls (Closes #667) #911

2026-07-25T16:24:03-05:00

jcwalker3 commented

2026-07-25 16:24:03 -05:00

Summary

Adds read-only Web Console restart status, impact preview, drain progress, restart class matrix, and approval/break-glass control panels (/runtime/restart and /api/v1/system/restart/status) consuming the #655 coordinator substrate.

Key capabilities implemented:

Impact Preview Panel: Renders blast radius, affected active sessions/leases, and verdict DTOs from restart_coordinator.evaluate_restart_impact. Fails closed if inventory is incomplete.
Drain & Reconcile Proof Views: Displays drain checklist validation (drain_proof.verify_drain_proof) and post-restart reconcile status (post_restart_reconcile).
Restart Class Matrix: Displays least-privilege restart classes (RESTART_CLASS_POLICIES) with role-scoped capability badges ("You may request" / "You may execute").
Action Authorization Probes: Probes approval controls with for_execution=True so phase-1 gating (phase_not_active) is honestly reported rather than showing misleading live controls.
Break-Glass UI Panel: Surfaced for operator-class roles with explicit availability status.
Read-Only Safety: Opens control-plane DB as mode=ro, never executes writes or process kills, and renders safe HTML.

Links

Closes #667
Extends #642
Parent #655
Vision #652
Roadmap #653
Console #631
Soft-depends #658 #659 #660 #661 #662 #663 #664 #633 #634

Verification

Ran pytest tests/test_webui*.py — 542 passed cleanly (including 30 tests in tests/test_webui_restart_console.py).

## Summary Adds read-only Web Console restart status, impact preview, drain progress, restart class matrix, and approval/break-glass control panels (`/runtime/restart` and `/api/v1/system/restart/status`) consuming the #655 coordinator substrate. Key capabilities implemented: 1. **Impact Preview Panel**: Renders blast radius, affected active sessions/leases, and verdict DTOs from `restart_coordinator.evaluate_restart_impact`. Fails closed if inventory is incomplete. 2. **Drain & Reconcile Proof Views**: Displays drain checklist validation (`drain_proof.verify_drain_proof`) and post-restart reconcile status (`post_restart_reconcile`). 3. **Restart Class Matrix**: Displays least-privilege restart classes (`RESTART_CLASS_POLICIES`) with role-scoped capability badges ("You may request" / "You may execute"). 4. **Action Authorization Probes**: Probes approval controls with `for_execution=True` so phase-1 gating (`phase_not_active`) is honestly reported rather than showing misleading live controls. 5. **Break-Glass UI Panel**: Surfaced for operator-class roles with explicit availability status. 6. **Read-Only Safety**: Opens control-plane DB as `mode=ro`, never executes writes or process kills, and renders safe HTML. ## Links Closes #667 Extends #642 Parent #655 Vision #652 Roadmap #653 Console #631 Soft-depends #658 #659 #660 #661 #662 #663 #664 #633 #634 ## Verification Ran `pytest tests/test_webui*.py` — 542 passed cleanly (including 30 tests in `tests/test_webui_restart_console.py`).

jcwalker3 added 1 commit 2026-07-25 16:24:03 -05:00

feat(webui): add read-only console restart status and impact controls (Closes #667 ) 9a01543477

jcwalker3 added 1 commit 2026-07-25 16:49:53 -05:00

docs(webui): document the read-only restart console surface (#667 ) 9b8e315b49

Records the two GET routes, what each panel consumes, and the three
properties the surface is held to: an unreadable source reports
unavailable rather than green, authorization is probed with
for_execution=True so a Phase 1 refusal is never shown as an allow, and
the control-plane database is opened mode=ro so reading status never
creates it.

Refs #655 #642 #658 #661 #662 #663 #633 #652 #653 #664

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

jcwalker3 commented

2026-07-25 16:52:46 -05:00

[THREAD STATE LEDGER]

what is true now

PR #911 remains in open state against master, with head 9b8e315b49. The head now carries both the implementation commit and the documentation commit for #667.

Server-side decision state: no review verdict of any kind is recorded on this PR at the current head.
Local verdict/state: implementation and documentation are both present on the remote head; the branch is a fast-forward of its prior remote head and of master at 9c69bfcd80.

what changed

Branch feat/issue-667-console-restart-controls advanced 9a01543477 -> 9b8e315b49 as a fast-forward, with no history rewrite.

9a01543 — webui/restart_console.py, webui/restart_views.py, webui/app.py, webui/nav.py, tests/test_webui_restart_console.py
9b8e315 — docs/webui-restart-console.md

The publish mutated no issue-lock record and touched no workflow lease. It verified the recorded issue-lock claimant, the clean worktree state, the fast-forward relationship, and the absence of a competing open PR before writing the remote head.

what is blocked

Blocker classification: no blocker

The earlier obstruction has cleared. Publication was previously withheld because the serving runtime had started at 76f293eb while master had advanced to 9c69bfcd, so the mutation gate fail-closed with blocker_kind=runtime_reconnect_required. The runtime is now in parity at 9c69bfcd80 with mutation_safe true.

who/what acts next

Next actor: reviewer
Required action: Review PR #911 at head 9b8e315b49 and record a verdict through the review API.
Do not do: Do not treat the head movement as a response to review feedback — no review feedback exists on this PR. Do not expect break-glass execution controls in this change; #664 has not landed and that panel deliberately renders an unavailable status.

Canonical Issue State

STATE: PR-open
WHO_IS_NEXT: reviewer
NEXT_ACTION: Review PR #911 at head 9b8e315b49, which carries both the implementation commit and the documentation commit.
NEXT_PROMPT:

Review PR #911 (Closes #667) on prgs / Scaled-Tech-Consulting / Gitea-Tools at head
9b8e315b49db41e81843a5779cc6e9707fb50e59.

Scope under review: the read-only restart console — routes /runtime/restart and
/api/v1/system/restart/status — plus docs/webui-restart-console.md. Five files,
1368 lines, 30 added tests in tests/test_webui_restart_console.py.

Focus areas:
1. Every approval-control authorization probe passes for_execution=True, so
   phase_not_active gating is reported rather than rendering a live-looking control.
2. Impact preview fails closed when the session/lease inventory is incomplete.
3. All interpolated values pass through _esc before reaching HTML.
4. The control-plane SQLite handle is opened mode=ro; no write path or process kill exists.
5. Break-glass panel state: #664 has not landed, so operator-class roles are shown an
   explicit unavailable status naming the blocking issue.

Full suite on this branch: 28 failed / 5292 passed, against a clean-master baseline at
76f293eb of 28 failed / 5262 passed — identical failure signatures, +30 passing tests.

WHAT_HAPPENED: The documentation commit for this PR existed locally with no remote head. The branch has now been advanced 9a01543477 -> 9b8e315b49 as a fast-forward, so docs/webui-restart-console.md is on the PR head alongside the implementation.
WHY: Publication was withheld earlier in the cycle because the serving runtime had started at 76f293eb while master had advanced to 9c69bfcd, so the mutation gate fail-closed with blocker_kind=runtime_reconnect_required. The runtime is now in parity at 9c69bfcd80 with mutation_safe true, and the publish verified against the recorded issue-lock claimant before writing the remote head.
RELATED_PRS: #911
BLOCKERS: none
VALIDATION: Full suite on this branch — 28 failed / 5292 passed / 6 skipped. Clean-master baseline at 76f293eb — 28 failed / 5262 passed / 6 skipped. Identical 28 failure signatures; the delta is the 30 tests this PR adds. Four safety properties were each mutation-tested by reverting the guard and observing the corresponding test fail before restoring it: (1) dropping for_execution=True from the authorization probes — 1 failed; (2) forcing inventory_complete True — 1 failed; (3) returning raw str(value) from _esc — 1 failed; (4) opening the control-plane DB read-write instead of mode=ro — 1 failed. The fourth case initially did not fail under mutation because the test pointed at a nested missing directory, so sqlite raised for path reasons rather than for the read-only mode; the fixture was corrected to a writable-parent path and the mutation then failed the test as intended. An earlier run on this branch reported 178 failures; that count is not attributable to this branch — --ignore and --deselect bisects and a clean re-run all returned the same 28-failure set, and the 178 was concurrent-workspace contamination during the run.
LAST_UPDATED_BY: jcwalker3 (prgs-author)

Scope statement

This PR delivers the status-view half of #667 only, matching that issue's own stated rollout order of status views first. Break-glass (#664) has not landed, so the break-glass panel renders to operator-class roles as an explicit unavailable status naming the blocking issue, rather than being hidden or simulated.

[THREAD STATE LEDGER] ### what is true now PR #911 remains in open state against master, with head 9b8e315b49db41e81843a5779cc6e9707fb50e59. The head now carries both the implementation commit and the documentation commit for #667. Server-side decision state: no review verdict of any kind is recorded on this PR at the current head. Local verdict/state: implementation and documentation are both present on the remote head; the branch is a fast-forward of its prior remote head and of master at 9c69bfcd80f62b112d89acc875ec13c0af714c49. ### what changed Branch `feat/issue-667-console-restart-controls` advanced 9a0154347771d1ca06202a8dfae52d9d57b77dd4 -> 9b8e315b49db41e81843a5779cc6e9707fb50e59 as a fast-forward, with no history rewrite. - 9a01543 — `webui/restart_console.py`, `webui/restart_views.py`, `webui/app.py`, `webui/nav.py`, `tests/test_webui_restart_console.py` - 9b8e315 — `docs/webui-restart-console.md` The publish mutated no issue-lock record and touched no workflow lease. It verified the recorded issue-lock claimant, the clean worktree state, the fast-forward relationship, and the absence of a competing open PR before writing the remote head. ### what is blocked Blocker classification: no blocker The earlier obstruction has cleared. Publication was previously withheld because the serving runtime had started at 76f293eb while master had advanced to 9c69bfcd, so the mutation gate fail-closed with blocker_kind=runtime_reconnect_required. The runtime is now in parity at 9c69bfcd80f62b112d89acc875ec13c0af714c49 with mutation_safe true. ### who/what acts next Next actor: reviewer Required action: Review PR #911 at head 9b8e315b49db41e81843a5779cc6e9707fb50e59 and record a verdict through the review API. Do not do: Do not treat the head movement as a response to review feedback — no review feedback exists on this PR. Do not expect break-glass execution controls in this change; #664 has not landed and that panel deliberately renders an unavailable status. ## Canonical Issue State STATE: PR-open WHO_IS_NEXT: reviewer NEXT_ACTION: Review PR #911 at head 9b8e315b49db41e81843a5779cc6e9707fb50e59, which carries both the implementation commit and the documentation commit. NEXT_PROMPT: ```text Review PR #911 (Closes #667) on prgs / Scaled-Tech-Consulting / Gitea-Tools at head 9b8e315b49db41e81843a5779cc6e9707fb50e59. Scope under review: the read-only restart console — routes /runtime/restart and /api/v1/system/restart/status — plus docs/webui-restart-console.md. Five files, 1368 lines, 30 added tests in tests/test_webui_restart_console.py. Focus areas: 1. Every approval-control authorization probe passes for_execution=True, so phase_not_active gating is reported rather than rendering a live-looking control. 2. Impact preview fails closed when the session/lease inventory is incomplete. 3. All interpolated values pass through _esc before reaching HTML. 4. The control-plane SQLite handle is opened mode=ro; no write path or process kill exists. 5. Break-glass panel state: #664 has not landed, so operator-class roles are shown an explicit unavailable status naming the blocking issue. Full suite on this branch: 28 failed / 5292 passed, against a clean-master baseline at 76f293eb of 28 failed / 5262 passed — identical failure signatures, +30 passing tests. ``` WHAT_HAPPENED: The documentation commit for this PR existed locally with no remote head. The branch has now been advanced 9a0154347771d1ca06202a8dfae52d9d57b77dd4 -> 9b8e315b49db41e81843a5779cc6e9707fb50e59 as a fast-forward, so `docs/webui-restart-console.md` is on the PR head alongside the implementation. WHY: Publication was withheld earlier in the cycle because the serving runtime had started at 76f293eb while master had advanced to 9c69bfcd, so the mutation gate fail-closed with blocker_kind=runtime_reconnect_required. The runtime is now in parity at 9c69bfcd80f62b112d89acc875ec13c0af714c49 with mutation_safe true, and the publish verified against the recorded issue-lock claimant before writing the remote head. RELATED_PRS: #911 BLOCKERS: none VALIDATION: Full suite on this branch — 28 failed / 5292 passed / 6 skipped. Clean-master baseline at 76f293eb — 28 failed / 5262 passed / 6 skipped. Identical 28 failure signatures; the delta is the 30 tests this PR adds. Four safety properties were each mutation-tested by reverting the guard and observing the corresponding test fail before restoring it: (1) dropping for_execution=True from the authorization probes — 1 failed; (2) forcing inventory_complete True — 1 failed; (3) returning raw str(value) from _esc — 1 failed; (4) opening the control-plane DB read-write instead of mode=ro — 1 failed. The fourth case initially did not fail under mutation because the test pointed at a nested missing directory, so sqlite raised for path reasons rather than for the read-only mode; the fixture was corrected to a writable-parent path and the mutation then failed the test as intended. An earlier run on this branch reported 178 failures; that count is not attributable to this branch — --ignore and --deselect bisects and a clean re-run all returned the same 28-failure set, and the 178 was concurrent-workspace contamination during the run. LAST_UPDATED_BY: jcwalker3 (prgs-author) ### Scope statement This PR delivers the status-view half of #667 only, matching that issue's own stated rollout order of status views first. Break-glass (#664) has not landed, so the break-glass panel renders to operator-class roles as an explicit unavailable status naming the blocking issue, rather than being hidden or simulated.

sysadmin commented

2026-07-25 17:26:19 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #911
issue: none
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 6699-02ac7ccebf5c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/feat-issue-667-console-restart
phase: claimed
candidate_head: 9b8e315b49
target_branch: master
target_branch_sha: none
last_activity: 2026-07-25T22:26:19Z
expires_at: 2026-07-25T22:36:19Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #911 issue: none reviewer_identity: sysadmin profile: prgs-reviewer session_id: 6699-02ac7ccebf5c worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/feat-issue-667-console-restart phase: claimed candidate_head: 9b8e315b49db41e81843a5779cc6e9707fb50e59 target_branch: master target_branch_sha: none last_activity: 2026-07-25T22:26:19Z expires_at: 2026-07-25T22:36:19Z blocker: none

sysadmin approved these changes 2026-07-25 17:26:31 -05:00

sysadmin commented

2026-07-25 17:34:05 -05:00

adopted_at: 2026-07-25T22:34:05Z
adopted_by_identity: sysadmin
adopted_by_profile: prgs-merger
adopted_from_session_id: 6699-02ac7ccebf5c
adopted_from_profile: prgs-reviewer
adopted_from_reviewer_identity: sysadmin
adopted_from_comment_id: 16938
adoption_reason: merger-handoff-approved-head

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #911
issue: none
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 6365-871556eabc81
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/feat-issue-667-console-restart
phase: adopted
candidate_head: 9b8e315b49
target_branch: master
target_branch_sha: none
last_activity: 2026-07-25T22:34:05Z
expires_at: 2026-07-25T22:44:05Z
blocker: none

adopted_at: 2026-07-25T22:34:05Z adopted_by_identity: sysadmin adopted_by_profile: prgs-merger adopted_from_session_id: 6699-02ac7ccebf5c adopted_from_profile: prgs-reviewer adopted_from_reviewer_identity: sysadmin adopted_from_comment_id: 16938 adoption_reason: merger-handoff-approved-head  repo: Scaled-Tech-Consulting/Gitea-Tools pr: #911 issue: none reviewer_identity: sysadmin profile: prgs-merger session_id: 6365-871556eabc81 worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/feat-issue-667-console-restart phase: adopted candidate_head: 9b8e315b49db41e81843a5779cc6e9707fb50e59 target_branch: master target_branch_sha: none last_activity: 2026-07-25T22:34:05Z expires_at: 2026-07-25T22:44:05Z blocker: none

sysadmin merged commit 3bbe6df6c7 into master

2026-07-25 17:34:12 -05:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#911