feat(console): localhost operator console over bundles, runs, and skill lineage

[abrichr]

What

openadapt-flow console — the thin operator console: a localhost-only web UI for the one operator who governs production workflows. It is a read-first projection of artifacts the engine already writes (bundle dirs, report.json run dirs, durable pause/approval records, skills.json libraries) plus governance actions wired only to existing verbs. No new engine semantics anywhere.

Surface decision (extend #1008 / revive openadapt-console / new module?)

New module in openadapt-flow (openadapt_flow/console/), for three reasons:

• OpenAdapt PR #1008 (openadapt panel) fronts the legacy record→train→eval pipeline in the OpenAdapt repo — none of flow's bundle/run/certification model exists there, and the PR is currently conflicting. Its pattern (FastAPI + loopback + a small SPA + a lazy CLI verb) is deliberately mirrored here; its code is the wrong substrate.
• openadapt-console is a 2-commit Next.js/Vercel MVP from March tied to the old trace schema — a Node toolchain and a deploy-oriented stack for what must be a zero-dependency localhost tool, and it cannot import flow's loaders.
• Flow already has every loader and gate the console needs (Workflow.load, RunReport, CheckpointStore, SkillLibrary, evaluate_policy, lint_workflow, the identity/effect policy helpers) and FastAPI is an established in-repo pattern (services/vlm_service). This ships in one PR with zero cloud coupling.

Screens (real capture from a live fixture session)

Workflow inventory — version, certification, PHI/encryption flags, last run:

Workflow detail — identity-armed coverage, effect-contract coverage over irreversible steps, live evaluate_policy violations, compiled steps, lint, diff picker, actions with exact commands:

Bundle-to-bundle diff:

Run history and a halted run with inline evidence (halt reason, PHI-scrubbed observed texts, step screenshots) plus the exact teach command to copy:

Durably paused run — escalation record, checkpoints, and confirm-gated approve/resume:

Skill-library lineage with governed promote / rollback:

Governance posture

• Loopback only: bind address is hardcoded 127.0.0.1 (no flag).
• Read-only by default: every mutating endpoint refuses with 403 plus the exact CLI command to copy; --allow-actions opts in, and the UI always shows the command before a confirm.
• Existing verbs only: approve/resume/certify shell out to the CLI (module-invoked, no shell); promote/rollback call the same SkillLibrary.promote/.quarantine entry points the teach pipeline uses; teach needs a fix demonstration, so it is render-only — never faked.
• Traversal-safe: URL ids resolve by re-scanning the roots and matching (never path-joined); run artifacts are served only after a containment check.
• Degrades gracefully: encrypted-without-key / corrupt bundles stay listed with a load_error; effect coverage reports honest n/a (not a fabricated 100%) when a bundle has no irreversible step; missing certification renders the certify command instead of a fake verdict.

Tests

tests/test_console.py: 28 tests over real Workflow.save / RunReport.save / CheckpointStore / SkillLibrary artifacts — projections, coverage numbers vs the policy helpers, diff, halt/pause evidence, artifact traversal refusal, read-only 403-with-command, teach-never-executes, approve subprocess argv, promote/rollback round-trip, and a loopback uvicorn boot smoke test. Local: full fast suite 1862 passed, 16 skipped; ruff check + format and mypy clean.

Packaging: new optional extra openadapt-flow[console] (fastapi + uvicorn); uvicorn added to dev for the smoke test; static UI force-included in the wheel.

Not in scope (deliberately)

• No auth layer (loopback binding is the boundary; do not expose).
• No bundle editing, no new run-launch semantics (run is rendered for the deployment terminal).
• Effect-verification coverage reads only declared Step.effects — when richer coverage fields land in reports (effect-kit work), the same cards can consume them.

🤖 Generated with Claude Code