browser/openspec/changes/implement-platform-observability-and-config-read/tasks.md

1. Platform Metrics Contracts

• 1.1 Add domain contracts for platform resource usage snapshots and per-server metrics.
• 1.2 Add DTO request/response contracts for /metrics/platform and /metrics/server-instances.
• 1.3 Add repository/service interfaces for storing or deriving platform and server metrics.
• 1.4 Add validators for metric ranges, timestamps, server IDs, and bounded list responses.

2. Server Config Read Contracts

• 2.1 Add domain and DTO contracts for server config read responses.
• 2.2 Add service method for reading server config metadata/content by server instance.
• 2.3 Enforce role-scoped access for config reads using existing server ACL rules.
• 2.4 Ensure config read responses never expose host paths, raw credentials, or direct run sockets.

3. Backend API Surface

• 3.1 Implement GET /api/v1/metrics/platform.
• 3.2 Implement GET /api/v1/metrics/server-instances.
• 3.3 Implement GET /api/v1/server-instances/{id}/config.
• 3.4 Update platform/api/routes.md and protocol docs to mark these routes implemented.

4. Frontend Integration

• 4.1 Update HomePage to render platform metrics from API data instead of empty fallback states.
• 4.2 Update ServerDetailPage config section to show API config content when available.
• 4.3 Remove or clearly isolate hardcoded config fallback from production flow.
• 4.4 Add UI tests for metrics/config loading, errors, and no-secret rendering.

5. Verification

• 5.1 Add platform service/API tests for metrics and config read access control.
• 5.2 Run cd platform && go test ./... and record evidence.
• 5.3 Run cd platform_web && npm run typecheck && npm test && npm run build and record evidence.
• 5.4 Run browser walkthrough for 首页 and server detail config view.
• 5.5 Run scripts/check-structure.sh and record evidence.
• 5.6 Run openspec validate implement-platform-observability-and-config-read --strict and record evidence.

Evidence

• 2026-07-06: Added platform domain/DTO/service/validator/API implementation for platform metrics, server metrics, and safe server config reads.
• 2026-07-06: Added platform service/API tests for role-scoped metrics and config reads, unauthorized access denial, and no host path/raw credential/socket fragments.
• 2026-07-06: Updated frontend API contracts/client tests for platform metrics, server metrics, and server config responses; existing HomePage and ServerDetailPage API flows consume these methods with explicit local fallback labeling.
• 2026-07-06: cd platform && go test ./domain ./dto ./validator ./service ./api passed.
• 2026-07-06: cd platform_web && npm test -- --run api/client.test.ts pages/ConsolePages.test.tsx passed with 2 files / 9 tests.
• 2026-07-06: cd platform && go test ./... passed across api, cmd/platform, config, domain, dto, model, repo, service, and validator packages.
• 2026-07-06: cd platform_web && npm run typecheck passed.
• 2026-07-06: cd platform_web && npm test passed with 9 files / 31 tests.
• 2026-07-06: cd platform_web && npm run build passed and produced Vite production assets.
• 2026-07-06: Headless Chrome walkthrough against http://127.0.0.1:5175/ passed: seeded platform API data, verified 首页 rendered API platform metrics/resource usage and server distribution, opened #/servers/server-walkthrough, verified config tab showed 配置版本 v1 with API textarea content server.name=Walkthrough SCUM, and confirmed rendered text/textarea excluded /Users/, unix://, Bearer , sk-, and password=.
• 2026-07-06: scripts/check-structure.sh passed with structure check passed.
• 2026-07-06: openspec validate implement-platform-observability-and-config-read --strict passed with Change 'implement-platform-observability-and-config-read' is valid.