docs(spec): local fleet UX — cache-first render (F11.2) + per-pod table stakes (F11.5)

[gnanirahulnutakki]

What

Design/spec for the day-0 adoption surface — the sith CLI + TUI cache-first fleet render (F11.2 / #33) and per-pod table stakes (F11.5 / #35). Adds one doc:

• docs/specs/F11.2-F11.5-local-fleet-ux.md

Delivers as Slice 2 (render/search) + Slice 3 (per-pod) of BUILD-SEQUENCE.md; sits above the Slice-0 foundation and consumes Slice-1's local-kubeconfig adapter. Spec only — no product Go code.

Highlights

• IA (k9s-informed, fleet-native). Cluster is a filter dimension, not a mode; TUI default scope is the whole fleet. CLI is the scriptable peer with hard TUI/CLI parity. Cross-cluster-by-default is the thing k9s users asked for twice (#1006/#2730) and were told "not planned."
• Cache-first render model. Store is the single render source; <100 ms interactions, <250 ms first paint regardless of context count; cold/warming/warm/degraded/offline states; per-cell + per-cluster staleness; an honest coverage line (covered 9/11 · 1 stale · 1 unreachable) on every aggregate — never a false-complete answer.
• Resource lenses ordered to daily K8s ops — pods / deployments / events / nodes first (Tier 1), then the rest, then a generic lens for any kind.
• Per-pod actions mapped onto Architect A's 7-verb contract. describe/yaml-view compose from the read triad (discover/read/query); logs/exec/port-forward are streaming verbs; the live lens is watch. Local-identity, never-governed boundary asserted at code level.
• Cross-cluster search + correlation grammar (image:, status:, ctx:, …) and navigation, all cache-served.
• Screens/states catalog, full keybindings, testable acceptance criteria per Slice 2 / Slice 3.

Open decisions (in-doc §11 — flagged, not silently resolved)

• D1 (for Architect A): YAML-edit is the one F11.5 action that writes — it has no home in a read-only 7-verb (read+stream) contract. Recommendation: a named local-apply capability, local-mode + user-identity only, never wired to a PEP. Owner + A decide.
• D2: exact streaming verb names are A's to fix; the §6/§9 mapping updates mechanically.
• D3: Q12 hero surface locked TUI-first (per BUILD-SEQUENCE.md); ports to web unchanged if overridden.
• D4: TUI defaults to all-clusters, CLI requires explicit --all-clusters — confirm the asymmetry.
• D5–D7: merged-log cap, staleness thresholds, secret-reveal logging stance.

Invariants honored

Loopback-only · no account / no telemetry · credentials never leave the machine · per-pod ops use the user's own identity and are never governed intents · fail-safe never fail-open (CONVENTIONS.md §7). Product identity ArdurAI.

Coordination notes

• Branches off and targets dev (integration). Does not touch main. Do not merge — for review.
• References the parallel Architect A source-adapter contract (§6.0); does not redefine it. Authored concurrently in a shared checkout, so this PR was cut from an isolated worktree to keep the diff to exactly one file.
• Cross-references SLICE-0-foundation.md / BUILD-SEQUENCE.md / CONVENTIONS.md, which are in flight to dev on the build-plan track; forward references resolve once that lands.