AutoFix missions and governed outbound integrations

[karlschriek]

Closes #3, closes #4, closes #5, closes #6

Summary

This PR lands four interrelated features: the AutoFix mission type, governed outbound integrations (Slack), the Assignment→Supply rename, and Dashboard UI consolidation. 307 files changed, ~43k insertions.

---

1. AutoFix mission type (#3)

Mission type

• Added AutoFix to the MissionType enum in SnapCd.Contracts.
• AutoFix missions are configured the same way as other mission types — per Organization, Stack, Namespace, or Module scope.

Dispatch

• ApplyJobFailedCompetingConsumer and DestroyModuleFailed handling: when a job fails, checks for an AutoFix mission first. If one exists, it dispatches AutoFix and suppresses AutoDiagnose as redundant. AutoDiagnose only fires when no AutoFix mission is configured.
• AutoFixMissionConsumer: receives AutoFixMissionRequested, locates the agent connection via the AgentHub, and invokes the AutoFix endpoint on the connected agent instance.

Agent-side

• Agent hub exposes an AutoFix endpoint that the agent's sidecar handles.
• The sidecar receives an AutoFixRequest with the job context, performs diagnosis, and either retries or opens a PR depending on the failure type.
• New auto_fix.md skill prompt added to AI/Skills/.

UI

• AutoFix appears in the Mission Type dropdowns across all scope-level mission management components.
• Mission results (diagnosis + PR link) displayed inline on the job view.
• AgentHarness.razor renamed to MissionTestBench.razor.

---

2. Governed outbound integrations (#3)

Integration entity

• Integration entity with IntegrationType enum (currently Slack).
• Connection credentials stored as encrypted blobs in the org's input vault via IntegrationSecretStore. API never exposes raw credentials.
• IntegrationService handles CRUD, test-connection endpoint, and credential encryption/decryption.
• IntegrationConnectionCache — per-instance in-memory cache (15-min TTL) for connection credentials, invalidated cross-instance via fanout consumer on integration CRUD.

Integration supply

• IntegrationStackSupply, IntegrationNamespaceSupply, IntegrationModuleSupply entities.
• is_supplied_to_all_modules flag on the Integration entity for org-wide supply.
• IntegrationSupplyResolver checks supply coverage before delivering events.
• IntegrationSupplyService handles CRUD for supply resources.

Integration events (demand)

• Per-scope event entities: OrganizationIntegrationEvent, StackIntegrationEvent, NamespaceIntegrationEvent, ModuleIntegrationEvent.
• IntegrationEventMatcher walks all scope levels to find matching subscriptions for a given module/trigger.
• IntegrationEventService handles CRUD with unified scope-based API.
• IntegrationTemplateRenderer — {{ token }} substitution engine. Built-in default templates per trigger. Tokens: trigger, moduleName, moduleId, jobId, organizationId, jobType, missionType, kind, message, stackName, namespaceName, jobUrl.

Delivery

• IntegrationDelivery audit entity records each attempt (status, error, sink message ID).
• IntegrationEventDispatcher competing consumer turns saga/mission events into deliveries; idempotent per (occurrence, subscription).
• Mission milestones threaded under one Slack message per mission.

Codecs

• IIntegrationCodec interface for type-specific send logic.
• SlackCodec — sends messages via Slack Web API using bot token. Supports threading for mission milestone grouping.

RBAC

• Organization roles: IntegrationCreator, IntegrationContributor, IntegrationReader.
• Per-integration roles: Owner, Contributor, Reader, IdentityAccessManager via IntegrationRoleAssignment.

API

• IntegrationController — CRUD + test-connection endpoint.
• IntegrationEventController — unified scope-based CRUD for events.
• IntegrationSupplyController — CRUD for supply resources (scope-based).
• IntegrationRoleAssignmentController — per-integration role management.

UI

• New /Integrations page with create/edit forms, connection configuration, test-connection button, supply management, and role assignment panel.
• Integration Event management embedded in Stack, Namespace, and Module Configure panels with inherited-event tabs showing "Manage these from here" links.
• Nav menu updated with Integrations link.

---

3. Mission run milestones (#6)

• ModuleJobMissionRunMilestone entity — records progress updates from a running mission (kind, message, timestamp).
• MissionMilestoneReported MassTransit event and consumer.
• AgentHub enhanced to receive milestone reports from connected agents and persist them.
• Milestones feed into integration event delivery (threaded Slack messages per mission).
• ModuleJobMissionRunReadDto and ModuleJobMissionRunMilestoneReadDto expose milestones via API.
• ModuleController gains a MissionHistory endpoint returning mission runs and milestones for a module.

---

4. Rename "Assignment" to "Supply" (#4)

Entities and database

• All *Assignment entities renamed to *Supply: AgentStackAssignment → AgentStackSupply, RunnerNamespaceAssignment → RunnerNamespaceSupply, etc.
• Database tables, columns, and foreign keys renamed via migration.
• Entity configurations updated in the EF Core model builder.

Repositories and services

• Repository interfaces and implementations renamed from *Assignment* to *Supply*.
• Secured repository factories renamed to match.
• Service classes that reference assignments updated throughout.

API surface

• REST endpoints changed from /assignments to /supply.
• Request/response DTOs in SnapCd.Contracts renamed: *AssignmentDto → *SupplyDto, *AssignmentCreateDto → *SupplyCreateDto.
• Controller classes renamed.

UI

• Dashboard components renamed: ManageAgentAssignments → ManageAgentSupply, AssignmentBadge → SupplyBadge, etc.
• Labels, headings, and navigation links updated from "Assignment" to "Supply".

Hub and messaging

• SignalR hub methods updated to use supply terminology.
• MassTransit message contracts and consumers renamed.

Breaking changes

• All /assignments API endpoints are now /supply.
• Terraform provider resources must be updated separately (tracked in terraform-provider-snapcd).

---

5. Dashboard UI improvements (#5)

Consolidate configuration into a single "Configure" panel

Replaced the individual top-level icons for Edit, Roles, Missions, Integration Events, Secrets, and Delete with a single Configure icon (Settings gear). Clicking it opens a panel with expansion sub-sections — one for each configuration area. Only one sub-section is open at a time.

Deep-linking via query parameters: ?action=configure&section=missions opens Configure with the Missions sub-section expanded.

Applied to:

• StackPage — new ConfigureStack.razor
• NamespacePage — new ConfigureNamespace.razor
• ModulePage — new ConfigureModule.razor (Variables and Outputs kept as separate top-level icons)

Redesign Module status area

Replaced four separate MudPaper cards (State, Queued, Runners, Revision) with a single panel using a CSS grid two-column layout (label | value). Ordered: State, Revision, Queued, Runners. Resource count shown only when ActualResourceCount is known. Revision and State both show "None" for the initial state.

Fix select-all checkbox on /Stacks page

Changed the "Select all Stacks" checkbox from @bind-Value to Value + ValueChanged with an OnSelectAllChanged handler.

Link and wrapper cleanup

• Updated stale ?action=missions, ?action=integrationevents query parameters across components to ?action=configure&section=... format.
• Fixed path bug in ManageModuleIntegrationEvents.razor (spurious /Namespaces/ segment).
• Removed outer <MudPaper> wrappers from components now hosted inside Configure expansion panels.

---

Migrations

• 20260608131719_AddMissionRunMilestones — adds ModuleJobMissionRunMilestone table.
• 20260615093401_AddIntegrations — adds Integration, IntegrationDelivery, IntegrationEvent (4 scope tables), IntegrationSupply (3 scope tables), IntegrationRoleAssignment tables.
• 20260620152254_RenameAssignmentsToSupplies — renames all *Assignment tables/columns/FKs to *Supply.

Tests

• AgentModuleAssignment_SmokeTests → AgentModuleSupply_SmokeTests
• RunnerModuleAssignment_SmokeTests → RunnerModuleSupply_SmokeTests
• AgentChain_RoleResolutionTests and RunnerChain_RoleResolutionTests updated for supply naming.
• Test fixture updated with integration setup.