2.0 KiB
Minimal admin panel — 14 October 2026
Implemented /admin with human administrator sign-in, paged credential metadata,
project-scoped issuance, one-time secret display, confirmed revocation and latest
50 credential-management events. The activity log excludes runtime/agent logs.
Baseline: application, tests, web and schema directories were already untracked; the agent submodule and several architecture documents were already dirty. No commit was made and unrelated changes were preserved. The shared operation catalog and bundled agent contract/hash were refreshed for the four new HTTP operations.
PASS:
scripts/python-tool pytest -q: 179 tests.npm --prefix web run check: TypeScript, ESLint, 17 frontend tests.npm --prefix web run build: production bundle.- Ruff check and format check, mypy, module boundary checker.
- API tests: viewer/mixed-agent denial, no authentication, CSRF/origin, body limit, duplicate IDs, secret-free lists/events, self-revocation rejection, durable audit, revocation invalidates bearer authentication and existing browser sessions.
- Shared preview using disposable data: sign-in, credential/project/event reads, credential creation (201), one-time secret displayed. No operator keys modified.
- Live web
/adminloads athttps://msi.tail0b014a.ts.net:10000/admin; at a requested 390×844 viewport the preview reported 391×845 and no document horizontal overflow. - Local API restarted through PM2; health succeeds and unauthenticated admin reads return authentication errors.
LIMITED: the shared preview routed successive calls between multiple clients and repeatedly lost the signed-in state or failed snapshot calls. Full browser revocation, keyboard walkthrough and authenticated responsive screenshot inspection remain unverified. Component/API tests cover creation, confirmation, CSRF and revocation; component tests cover reconnect after session expiry. No screen-reader or axe audit was performed. The temporary fixture server was stopped after verification.