# Minimal admin panel — 14 October 2026

Implemented `/admin` with human administrator sign-in, paged credential metadata,
project-scoped issuance, one-time secret display, confirmed revocation and latest
50 credential-management events. The activity log excludes runtime/agent logs.

Baseline: application, tests, web and schema directories were already untracked;
the agent submodule and several architecture documents were already dirty. No commit
was made and unrelated changes were preserved. The shared operation catalog and
bundled agent contract/hash were refreshed for the four new HTTP operations.

PASS:

- `scripts/python-tool pytest -q`: 179 tests.
- `npm --prefix web run check`: TypeScript, ESLint, 17 frontend tests.
- `npm --prefix web run build`: production bundle.
- Ruff check and format check, mypy, module boundary checker.
- API tests: viewer/mixed-agent denial, no authentication, CSRF/origin, body limit,
  duplicate IDs, secret-free lists/events, self-revocation rejection, durable audit,
  revocation invalidates bearer authentication and existing browser sessions.
- Shared preview using disposable data: sign-in, credential/project/event reads,
  credential creation (201), one-time secret displayed. No operator keys modified.
- Live web `/admin` loads at `https://msi.tail0b014a.ts.net:10000/admin`; at a requested
  390×844 viewport the preview reported 391×845 and no document horizontal overflow.
- Local API restarted through PM2; health succeeds and unauthenticated admin reads
  return authentication errors.

LIMITED: the shared preview routed successive calls between multiple clients and
repeatedly lost the signed-in state or failed snapshot calls. Full browser revocation,
keyboard walkthrough and authenticated responsive screenshot inspection remain
unverified. Component/API tests cover creation, confirmation, CSRF and revocation;
component tests cover reconnect after session expiry. No screen-reader or axe audit
was performed. The temporary fixture server was stopped after verification.