t278: fleet-wide engine view — verified transports, engine picker, honest default identity - #41
Conversation
…nest default identity Any seat can now read any fleet engine (goal t278: all workspaces on all engines, from any box; WHAT is visible stays the A3 access posture's call): - manifest: host_permissions widened to the three tailnet workstations (Z440 + twins, laptop, prodesk) alongside localhost. - surface-resolver: fleet transport tables; per-engine candidate pairs (localhost + tailnet) probed in preference order — the first engine that SELF-reports the expected kernel_urn wins, so the same build reads a Z440 twin over localhost on the Z440 seat and over the tailnet from any other seat. Canonical Z440 directory fallback so ?surface= windows resolve fleet-wide (the t266 channel batch lives in the Z440 primary fold). - adapter-factory: stored pilot.engine default-engine override (the new Settings "engine" picker; a read TARGET only — no write path exists or is added). A ?surface= window's own verified resolution still wins. - worker: storage.onChanged drops the adapter memo on override change, so the next GET_FRAME rebuilds against the new default. - streamable-http-adapter: a DEFAULTED engine urn no longer masquerades as hp-z440.primary in provenance — only an explicitly named engine carries an expectation, killing the spurious ENGINE MISMATCH strip on non-Z440 seats while keeping the honest one for named engines. - smokes: worker-smoke mocks storage.onChanged and adds B3 (pilot.engine override acceptance end-to-end); B2 + content assertions un-seat-locked (gate on fold content / verified candidates, SKIP with a line otherwise); live-smoke assertions updated to the t278 transport semantics. Gates (all run on hpprodesk): typecheck 0 · build 0 · live-smoke 84 ok · worker-smoke 53 ok — including ?surface=menno read via 100.82.243.13:8001 and the pilot.engine override reading the Z440 primary (seq 705), both from ProDesk, neither previously possible off the Z440 seat. authored-by: agent:vscode.hpprodesk.primary / session:sam.hpprodesk-setup / t278-fleet-engine-view Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Enables fleet-wide engine reads from any seat by widening extension host permissions, introducing verified transport resolution (localhost vs tailnet) per surface/engine, and adding a stored default-engine override selectable from Settings while keeping provenance/mismatch behavior “honest” for defaulted engines.
Changes:
- Expand engine transport resolution to probe ordered candidates (localhost/tailnet) and verify via
/healthzkernel_urn, including canonical directory fallback for?surface=resolution. - Add a Settings “engine” picker that persists
pilot.engineand updates worker adapter memoization on override changes. - Adjust provenance stamping so defaulted engine URNs don’t appear as an explicit expectation (reducing spurious mismatch warnings on non-Z440 seats), and update smoke tests accordingly.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/worker.ts | Clears memoized adapters when pilot.engine changes so new frames use the updated default engine. |
| src/mcp/surface-resolver.js | Adds fleet transport tables, candidate probing/verification, and canonical directory fallback for fleet-wide ?surface= resolution. |
| src/mcp/streamable-http-adapter.ts | Differentiates explicit vs defaulted engine URN for provenance/mismatch semantics. |
| src/mcp/adapter-factory.ts | Introduces pilot.engine persistence helpers and applies stored override prior to surface resolution. |
| src/components/SettingsPanel.tsx | Adds Settings UI section to select and persist the default engine override. |
| scripts/worker-smoke.mjs | Mocks storage.onChanged, adds override acceptance test (B3), and makes assertions seat-aware. |
| scripts/live-smoke.mjs | Updates resolution assertions to match new transport-candidate semantics. |
| public/manifest.json | Widens host_permissions to include tailnet workstation IPs/ports in addition to localhost. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| export async function savePilotEngine(cfg: PilotEngineConfig | null): Promise<void> { | ||
| try { | ||
| if (typeof chrome !== "undefined" && chrome.storage?.local) { | ||
| if (cfg && normalizeEngineConfig(cfg)) { | ||
| await chrome.storage.local.set({ [STORAGE_ENGINE_KEY]: cfg }); | ||
| } else { | ||
| await chrome.storage.local.remove(STORAGE_ENGINE_KEY); | ||
| } | ||
| } | ||
| } catch { | ||
| // storage unavailable (served harness) -> no-op | ||
| } | ||
| } |
There was a problem hiding this comment.
Fixed in 816387e — savePilotEngine now persists the normalized object, so storage always matches what loadPilotEngine/resolveAdapterConfig consume. typecheck 0 / build 0 / worker-smoke 53 ok.
|
UX acceptance run — the shipped
The One observation for review: Suggested follow-up (separate PR): track the acceptance drive as — agent:vscode.hpprodesk.primary · session:sam.hpprodesk-setup · convo: "Private repos access" · harness-session cc833891 |
Copilot inline catch on PR #41: the input was validated via normalizeEngineConfig but the RAW caller object was persisted, so extra fields or an invalid engineUrn could ride along in chrome.storage and diverge from what loadPilotEngine/resolveAdapterConfig consume. Store the normalized object. typecheck 0 / build 0 / worker-smoke 53 ok. authored-by: agent:vscode.hpprodesk.primary / session:sam.hpprodesk-setup / t278-fleet-engine-view Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
What
Any seat can now read any fleet engine — the t278 goal ("see all workspaces on all engines, from any box"). WHAT a user sees on any engine stays the A3 access posture's decision; this PR only makes the transports resolvable and picks them honestly.
host_permissionswidened to the three tailnet workstations (Z440100.82.243.13+ twin ports, laptop100.106.220.58, prodesk100.87.28.95) alongside localhost.kernel_urnwins (the same A6 authority the mismatch warning already reads). The same build therefore reads a Z440 twin over localhost on the Z440 seat and over the tailnet from hp-laptop / hpprodesk. Canonical Z440 directory fallback so?surface=windows resolve fleet-wide.pilot.enginedefault-engine override, set from the new Settings engine picker (This box / Z440 primary / menno / lola / moos / Laptop / ProDesk). A?surface=window's own verified resolution still wins.storage.onChangeddrops the adapter memo when the override changes.hp-z440.primaryin provenance — only an explicitly named engine carries an expectation. Kills the spurious ENGINE MISMATCH strip on non-Z440 seats; keeps the honest one for named engines.storage.onChanged, adds B3 (override acceptance end-to-end), and un-seat-locks B2/content assertions (gate on fold content / verified candidates, SKIP with a line otherwise); live-smoke assertions updated to the t278 transport semantics.Safety invariants (unchanged)
apply_rewrite/apply_programremain unnamed and uncallable).chrome.storage.local['pilot.access']; a page still cannot assert an identity or a workstation./healthzkernel_urn— a stale hint or a down engine degrades to the visible mismatch/default path, never to silently-wrong data.Gates (all run on hpprodesk — the seat that could previously read nothing but its own 9-node fold)
npm run typechecknpm run buildsmoke:live(vs Z440 over tailnet)smoke:worker(shippeddist/worker.js)Worker-smoke headline lines, from ProDesk:
Neither read was possible off the Z440 seat before this change.
Review focus
host_permissionswidening — tailnet IPs are the tracked topology's own addresses, but this is a privilege-posture change on a minimal-privilege seat; that is why this is a PR and not a trunk commit.streamable-http-adapter.ts— provenance honesty trade-off.authored-by: agent:vscode.hpprodesk.primary / session:sam.hpprodesk-setup / t278-fleet-engine-view
🤖 Generated with Claude Code