[Gkrumbach07]

Hold: do not merge before 2026-10-23.

The UI redesign @Daniel-Warner-X prototyped on his fork (Daniel-Warner-X/dw-openshell-dashboard, feat/ui-cohesive-redesign at 5979b03), brought onto current main with a review's fixes. The design and the first commit are his. The branch is rebased on main 61e2590 (server-side pagination #122, live logs #124, OpenShell 0.1.5).

The idea. The dashboard is for admins managing sandboxes, and three of their flows were buried: acting on policy proposals, finding out why a sandbox failed, and getting a provider onto a sandbox. Each is now one click from the landing page.

What changes

• Gateway becomes a dashboard. A Needs attention card leads. It lists pending proposals (with the newest chunk's rationale) and sandboxes in ERROR (with the gateway's condition message, newest first), filterable by kind. A proposal row opens the sandbox's Proposals tab; an error row opens its Logs tab. The gateway's own status, its version, the line this build is for and the compatibility verdict sit under the title. Compute drivers and extensions stay below.
• Two pages across every workspace.
  • Sandboxes: the paged list from feat(pagination): add server-side pagination and label filters (RHOAIENG-98858) #122 (AllSandboxList), with its label and type filters. The name now leads and the name and workspace are links. It was the first tab of All workspaces, which is now Resources (providers, templates and services).
  • Proposals: every sandbox with rules waiting for a decision. A platform admin reads it in one request. Anyone else reads it one workspace at a time, for the workspaces they are a member of.
• A calmer Proposals tab. The count banner is info rather than a warning, the bulk actions are outline buttons, the status filter is a dropdown, and the security flag keeps its warning colour on the collapsed row.
• Nav counts. The nav shows counts for workspaces, sandboxes and pending proposals. The shell reads them every two minutes (NAV_COUNT_POLL_MS), and a decision on a proposal refreshes them at once.
• BFF. GET /api/v1/draft-summary?allWorkspaces=true answers the summary for every workspace. The gateway refuses the all-workspaces sandbox list to anyone but a platform admin, and that refusal is relayed as it is. Each sandbox's summary carries latestRationale. The route without a scope still answers empty, and a sandbox's drafts are never read with an empty workspace.
• A mock API for UI work with no gateway: make dev-mock, and make dev-mock-empty for a gateway nobody has used yet (docs/mock-api.md). It answers the paged lists a page at a time, as the BFF does.

Changed from the prototype

• Polling sized for a landing page. The prototype read the cross-workspace proposal summary every 15 s on every page: one request to the BFF, but one GetDraftPolicy per sandbox on the gateway. It also read every sandbox every 5 s on the Gateway page. Now:
  • The shell's counts refresh every 2 min.
  • The Gateway page reads sandboxes and the summary every 30 s, and providers every 60 s.
  • The Sandboxes and Proposals pages keep their own pace.
  • Against a real gateway, the Gateway page dropped from 28 requests a minute to 13.
• Bugs fixed in review.
  • The Gateway page said "Nothing needs attention" while its lists were still loading or had failed.
  • The gateway's own status (for example DEGRADED) was shown nowhere.
  • Proposal counts stayed stale after an approve or a reject.
  • The Proposals page showed its empty state before every workspace had answered.
  • Flagged proposals had lost their warning colour.
  • The shell polled workspaces for users with no role.
  • Error rows were unsorted, and timed by creation instead of by the error.
• The repo's rules.
  • About 100 inline strings moved to the gateway, crossWorkspace and sandboxes i18n namespaces.
  • "Agent" wording removed (ADR 0003).
  • A style override of private PatternFly variables dropped (ADR 0004).
  • Links instead of useNavigate for navigation.
  • Shared helpers, one copy each.
  • The mock is typed, linted and loaded only with MOCK_API.
• Kept from main.
  • Provider profiles keeps its name. The prototype renamed it Providers, which clashed with the Providers tab of Resources.
  • The About dialog stays. It reads /gateway/compatibility, so the shell never calls GET /gateway, which the gateway refuses to non-admins.
  • The Logs tab streams (Add live logs streaming #124) and its viewer follows the app's theme.
• Left out: the prototype's toolchain (skill submodules and links, .mcp.json).

For reviewers

• Dan Reed: AllSandboxList from feat(pagination): add server-side pagination and label filters (RHOAIENG-98858) #122 has one user now, the Sandboxes page. It lost its navigation callbacks: the name column leads and both cells are links. The type-label tests moved with it, from the All workspaces spec to the Sandboxes page's.
• Daniel: whether the built pages still match the design.
• Regular members: the Proposals page and the Proposals tab show regular members the rules, but on main only a workspace admin gets Approve, Edit and Reject. The page's description ("review, edit, approve or reject") reads as though anyone can. Either the copy or the gating should change; that is a product call, left out of this PR.

Not in this PR

• Prompting to attach a provider to a sandbox once the provider is created.
• A Needs attention view for users who are not platform admins.

Checked

• CI is green on 22bbd92: build, check-frontend, check-backend, compat, e2e and helm.
• Locally:
  • Jest, 2176 tests
  • Cypress, 47 tests
  • tsc (including the mock), ESLint, the Prettier check and the build
  • go test -race and golangci-lint v2.12.2, 0 issues
• make dev-full against gateway 0.1.5, behind Keycloak sign-in:
  • As admin1 (platform admin).
    • A sandbox created from the dashboard, then run with curl to npm and GitHub from its Terminal tab, drafted two rules.
    • Both appeared in Needs attention with the gateway's rationale, and the row opened the Proposals tab.
    • Approving one moved the nav badge from 3 to 2 at once and the sandbox to policy v2.
    • The Logs tab streamed the deny and approve lines, and its viewer followed the theme toggle.
    • The Sandboxes page paged through the gateway (pageSize=10), and a label selector came back filtered by the gateway.
    • The Workspaces page paged, and Resources, Provider profiles and About (built for 0.1.x, gateway 0.1.5) showed as expected.
  • As user1 (member of one workspace).
    • The nav showed only Workspaces and Proposals.
    • /gateway, /sandboxes, /all-workspaces, /provider-profiles and /settings each sent the user to Workspaces.
    • The Proposals page read only that workspace's summary, and no request was refused.
    • The Proposals tab was read-only, as main gates it.
    • Log out returned to the sign-in page.
• One aside from that run: a sandbox created on gateway 0.1.4 does not start after the gateway moves to 0.1.5 (unknown field outer_fence in its bootstrap). That is the gateway's upgrade, not this PR; Needs attention shows it as a sandbox error.

🤖 Generated with Claude Code