[Feature] Surface deployment status, plans, and safe update controls in Ops #2

New Issue

2026-07-30T15:08:45+02:00

zemion commented

2026-07-30 15:08:45 +02:00

Problem

Ops reports health/profile assumptions but cannot expose an agent-managed
installation receipt, update plan, durable progress, or recovery state.

Parent: GovOPlaN/govoplan #13. Core dependency: govoplan-core #34.

Acceptance Criteria

Show management mode, image/release identities, components, receipt,
drift, and update availability without secrets.
Preview typed reconfigure/update plans, availability impact,
backup/migration gates, and recovery semantics.
Submit only allowlisted Core operations with authorization,
confirmation, expected receipt, and idempotency.
Show reconnectable persisted agent progress and terminal evidence.
Never expose Docker socket, command input, or host paths to browser/API.
External orchestrators are read-only and can export a reviewed recipe.

Blocker

Requires signed runtime artifacts and the Core request/agent contract before
mutation controls can be enabled. Read-only status can proceed earlier.

## Problem Ops reports health/profile assumptions but cannot expose an agent-managed installation receipt, update plan, durable progress, or recovery state. Parent: GovOPlaN/govoplan #13. Core dependency: govoplan-core #34. ## Acceptance Criteria - [ ] Show management mode, image/release identities, components, receipt, drift, and update availability without secrets. - [ ] Preview typed reconfigure/update plans, availability impact, backup/migration gates, and recovery semantics. - [ ] Submit only allowlisted Core operations with authorization, confirmation, expected receipt, and idempotency. - [ ] Show reconnectable persisted agent progress and terminal evidence. - [ ] Never expose Docker socket, command input, or host paths to browser/API. - [ ] External orchestrators are read-only and can export a reviewed recipe. ## Blocker Requires signed runtime artifacts and the Core request/agent contract before mutation controls can be enabled. Read-only status can proceed earlier.

zemion added the module/ops

status

blocked

area/webui area/release codex/ready area/security

module/core labels 2026-07-30 15:08:45 +02:00

zemion commented

2026-08-01 01:48:17 +02:00

Codex State: progress

Summary

Implemented the read-only/runtime-control slice locally: Ops now reports expected versus active runtime replicas, stale/composition data, shared-profile readiness failures, recovery states requiring attention, and audited API/worker drain/cancel controls.

Changed Files

src/govoplan_ops/backend/api/v1/routes.py
webui/src/features/ops/OpsPage.tsx
docs/SCALABILITY_PROFILES.md

Verification

Ops backend tests, Core WebUI TypeScript, docs-and-ops/full-product builds, and manifest documentation checks passed

Next / Blocked

Keep blocked for mutation controls until Core #34 supplies the typed request plus privileged deployment-agent contract and signed release artifacts exist.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Implemented the read-only/runtime-control slice locally: Ops now reports expected versus active runtime replicas, stale/composition data, shared-profile readiness failures, recovery states requiring attention, and audited API/worker drain/cancel controls. ### Changed Files - `src/govoplan_ops/backend/api/v1/routes.py` - `webui/src/features/ops/OpsPage.tsx` - `docs/SCALABILITY_PROFILES.md` ### Verification - `Ops backend tests, Core WebUI TypeScript, docs-and-ops/full-product builds, and manifest documentation checks passed` ### Next / Blocked - Keep blocked for mutation controls until Core #34 supplies the typed request plus privileged deployment-agent contract and signed release artifacts exist. Suggested status label: `status/in-progress`

zemion commented

2026-08-01 02:04:33 +02:00

Codex State: progress

Summary

Ops now reports runtime-node composition, stale/missing replicas, recovery states requiring attention, and audited drain/cancel controls.

Changed Files

src/govoplan_ops/backend/api/v1/routes.py
webui/src/features/ops/OpsPage.tsx

Verification

Ops backend tests and Core WebUI typecheck passed

Next / Blocked

Production backup-controller evidence and restore-drill history remain separate work.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Ops now reports runtime-node composition, stale/missing replicas, recovery states requiring attention, and audited drain/cancel controls. ### Changed Files - `src/govoplan_ops/backend/api/v1/routes.py` - `webui/src/features/ops/OpsPage.tsx` ### Verification - `Ops backend tests and Core WebUI typecheck passed` ### Next / Blocked - Production backup-controller evidence and restore-drill history remain separate work. Suggested status label: `status/in-progress`

zemion commented

2026-08-07 02:04:08 +02:00

Read-only deployment evidence progressed in GovOPlaN/govoplan-ops@d26a601. Ops now validates and presents the mounted infrastructure-capability receipt, source/state, sanitized endpoint, declared consumers, and resumable post-install tasks. Missing receipts remain non-blocking for local/dev profiles; malformed configured receipts surface as warnings.

The issue remains blocked for its privileged mutation scope: web-triggered host/container/Kubernetes lifecycle actions still require the separately authenticated local agent, authorization protocol, and recovery-safe command boundary. This commit does not weaken that boundary.

Read-only deployment evidence progressed in GovOPlaN/govoplan-ops@d26a601. Ops now validates and presents the mounted infrastructure-capability receipt, source/state, sanitized endpoint, declared consumers, and resumable post-install tasks. Missing receipts remain non-blocking for local/dev profiles; malformed configured receipts surface as warnings. The issue remains blocked for its privileged mutation scope: web-triggered host/container/Kubernetes lifecycle actions still require the separately authenticated local agent, authorization protocol, and recovery-safe command boundary. This commit does not weaken that boundary.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-ops#2