first commit

2026-07-11 14:56:10 +08:00
commit 7e05d0a4e7
660 changed files with 78119 additions and 0 deletions
@@ -0,0 +1,53 @@
+## ADDED Requirements
+
+### Requirement: Platform exposes resource usage metrics
+The platform SHALL expose a bounded platform resource usage endpoint for the management console.
+
+#### Scenario: Platform metrics loaded
+- **WHEN** an authorized platform administrator requests platform resource usage
+- **THEN** the platform MUST return CPU, memory, disk, source, and timestamp metadata in a named DTO response
+
+#### Scenario: Platform metrics remain safe
+- **WHEN** the platform returns resource usage data
+- **THEN** the response MUST NOT include host paths, raw credentials, direct sockets, storage backend credentials, or raw AI provider keys
+
+### Requirement: Platform exposes per-server metrics
+The platform SHALL expose bounded per-server metrics for server management and overview pages.
+
+#### Scenario: Server metrics listed
+- **WHEN** an authorized user requests server metrics
+- **THEN** the platform MUST return only metrics for server instances visible to that user
+
+#### Scenario: Pending metrics are bounded
+- **WHEN** a server does not have current metrics
+- **THEN** the platform MUST return a bounded missing/pending representation rather than unsafe fallback internals
+
+### Requirement: Server config read is safe and role scoped
+The platform SHALL expose a server config read endpoint that returns logical config content for an authorized server instance.
+
+#### Scenario: Owner reads server config
+- **WHEN** a server owner requests config for their server instance
+- **THEN** the platform MUST return config content, config version, server instance ID, and bounded metadata
+
+#### Scenario: Unauthorized config read rejected
+- **WHEN** a user without access requests server config
+- **THEN** the platform MUST reject the request and MUST NOT return config content
+
+#### Scenario: Config response hides run internals
+- **WHEN** the platform returns server config
+- **THEN** the response MUST NOT expose run credentials, raw host paths, direct sockets, or raw secret values
+
+### Requirement: Console uses API-backed observability and config reads
+The frontend SHALL prefer API-backed platform metrics, server metrics, and server config content over hardcoded production data.
+
+#### Scenario: API config suppresses fallback
+- **WHEN** the server config API returns content
+- **THEN** ServerDetailPage MUST render that content and MUST NOT display the local sample config label
+
+#### Scenario: Metrics render from API
+- **WHEN** metrics APIs return data
+- **THEN** HomePage and server cards MUST render API metric values with safe loading/error states
+
+#### Scenario: Fallback is explicit
+- **WHEN** a development fallback is used because an API is unavailable
+- **THEN** the UI MUST label it as local/demo fallback and MUST NOT present it as persisted platform data