Layer 2: Intake + API Gateway UI and Read-Only Run Wording

[d3v07]

using opus 4.8 on extra high effort

Before starting this issue, confirm you are using Opus 4.8 on extra high effort. Ask this every time you start a new work item.

Shared execution rules:

• Work on branch: feature/frex22-layers-1-4-operator-control
• Submit Layers 1 to 4 as one PR only.
• PR title: Build Layers 1-4 Operator, Intake, Control Plane, and Oversight UI
• d3v07 reviews that PR before any work starts on Layers 5 to 8.
• Do not change EvidencePack v1.
• Do not add API endpoints.
• Do not rename tools.
• Do not modify backend verification logic unless a frontend build cannot compile without a tiny type-safe adapter. If a backend change seems necessary, stop and ask d3v07.
• All agents remain read-only. Mutation remains backend-only after matching hash-bound approval.

Title:
Layer 2: Intake + API Gateway UI and Read-Only Run Wording

Assignee:
frex22

Branch:
feature/frex22-layers-1-4-operator-control

Context:
Use the Layer 2 architecture image as the visual spec. This layer explains how runs enter the system and how the dashboard talks to the FastAPI Cloud Run API.

Goal:
Implement the Layer 2 UI/UX representation without expanding the API contract.

The UI must clearly show these intake sources:

• Atlas Performance Advisor
• Profiler / Slow Query Logs
• Manual Query Paste
• Scheduled Scan

These sources feed into:

• Run Intake API
• FastAPI Cloud Run API

FastAPI routes shown in the UI:

• /packs
• /run
• /packs/:id/decision

Required wording:
Use this exact wording everywhere relevant:

/run creates a gated read-only run. Mutation remains impossible until the operator approves a matching EvidencePack hash.

Do not say:
/run opens approval before diagnosis

Do not imply:
/run makes mutation possible immediately

Required UI sections:

1. Intake sources
   Show each source with a short explanation:

• Atlas Performance Advisor: recommended slow-query candidates
• Profiler / Slow Query Logs: observed real workload behavior
• Manual Query Paste: operator-driven investigation
• Scheduled Scan: periodic automated intake

2. Run Intake API
   Show:

• creates gated read-only runs
• normalizes query metadata
• creates run record
• binds pending approval gate
• writes initial ledger event

3. FastAPI Cloud Run API
   Show existing routes only:

• /packs: list available EvidencePacks
• /run: create a gated read-only run
• /packs/:id/decision: record decision for a pack

4. Run state after intake
   Show:

• State: PENDING_APPROVAL or equivalent existing state
• Mode: READ-ONLY
• Mutations: BLOCKED
• Approval Gate: UNMATCHED until matching evidence hash approval exists

5. Downstream handoff
   Show:

• run_id
• intake context
• source metadata
• pending state

Strict constraints:

• Do not add backend endpoints.
• Do not change route names.
• Do not change EvidencePack v1.
• Do not change controller behavior.
• Do not add mutation to intake.
• Do not make fake claims if the backend does not currently support a source.
• If a source is not wired yet, label it as available intake path or planned intake path, depending on current repo reality.

Acceptance criteria:

• The UI explains intake clearly.
• The approved /run wording appears exactly.
• Existing API routes are displayed accurately.
• Run state after intake is clearly read-only.
• No UI copy implies mutation can happen before approval.
• Empty or mocked source states are clearly labeled and do not pretend to be live.

Tests:
Run:
cd dashboard && npm run lint
cd dashboard && ./node_modules/.bin/tsc --noEmit
cd dashboard && npm run build

Manual QA:

• desktop 1440x1100
• mobile 390x1000
• verify route text does not overflow
• verify /packs/:id/decision is readable on mobile
• verify the read-only run wording is visible