## 1. Platform Metrics Contracts

- [x] 1.1 Add domain contracts for platform resource usage snapshots and per-server metrics.
- [x] 1.2 Add DTO request/response contracts for `/metrics/platform` and `/metrics/server-instances`.
- [x] 1.3 Add repository/service interfaces for storing or deriving platform and server metrics.
- [x] 1.4 Add validators for metric ranges, timestamps, server IDs, and bounded list responses.

## 2. Server Config Read Contracts

- [x] 2.1 Add domain and DTO contracts for server config read responses.
- [x] 2.2 Add service method for reading server config metadata/content by server instance.
- [x] 2.3 Enforce role-scoped access for config reads using existing server ACL rules.
- [x] 2.4 Ensure config read responses never expose host paths, raw credentials, or direct run sockets.

## 3. Backend API Surface

- [x] 3.1 Implement `GET /api/v1/metrics/platform`.
- [x] 3.2 Implement `GET /api/v1/metrics/server-instances`.
- [x] 3.3 Implement `GET /api/v1/server-instances/{id}/config`.
- [x] 3.4 Update `platform/api/routes.md` and protocol docs to mark these routes implemented.

## 4. Frontend Integration

- [x] 4.1 Update HomePage to render platform metrics from API data instead of empty fallback states.
- [x] 4.2 Update ServerDetailPage config section to show API config content when available.
- [x] 4.3 Remove or clearly isolate hardcoded config fallback from production flow.
- [x] 4.4 Add UI tests for metrics/config loading, errors, and no-secret rendering.

## 5. Verification

- [x] 5.1 Add platform service/API tests for metrics and config read access control.
- [x] 5.2 Run `cd platform && go test ./...` and record evidence.
- [x] 5.3 Run `cd platform_web && npm run typecheck && npm test && npm run build` and record evidence.
- [x] 5.4 Run browser walkthrough for 首页 and server detail config view.
- [x] 5.5 Run `scripts/check-structure.sh` and record evidence.
- [x] 5.6 Run `openspec validate implement-platform-observability-and-config-read --strict` and record evidence.

## Evidence

- 2026-07-06: Added platform domain/DTO/service/validator/API implementation for platform metrics, server metrics, and safe server config reads.
- 2026-07-06: Added platform service/API tests for role-scoped metrics and config reads, unauthorized access denial, and no host path/raw credential/socket fragments.
- 2026-07-06: Updated frontend API contracts/client tests for platform metrics, server metrics, and server config responses; existing HomePage and ServerDetailPage API flows consume these methods with explicit local fallback labeling.
- 2026-07-06: `cd platform && go test ./domain ./dto ./validator ./service ./api` passed.
- 2026-07-06: `cd platform_web && npm test -- --run api/client.test.ts pages/ConsolePages.test.tsx` passed with 2 files / 9 tests.
- 2026-07-06: `cd platform && go test ./...` passed across api, cmd/platform, config, domain, dto, model, repo, service, and validator packages.
- 2026-07-06: `cd platform_web && npm run typecheck` passed.
- 2026-07-06: `cd platform_web && npm test` passed with 9 files / 31 tests.
- 2026-07-06: `cd platform_web && npm run build` passed and produced Vite production assets.
- 2026-07-06: Headless Chrome walkthrough against `http://127.0.0.1:5175/` passed: seeded platform API data, verified 首页 rendered API platform metrics/resource usage and server distribution, opened `#/servers/server-walkthrough`, verified config tab showed `配置版本 v1` with API textarea content `server.name=Walkthrough SCUM`, and confirmed rendered text/textarea excluded `/Users/`, `unix://`, `Bearer `, `sk-`, and `password=`.
- 2026-07-06: `scripts/check-structure.sh` passed with `structure check passed`.
- 2026-07-06: `openspec validate implement-platform-observability-and-config-read --strict` passed with `Change 'implement-platform-observability-and-config-read' is valid`.