I2461 — majordomus ui is served at /ui as its own product, with screens composed from capabilities

Serve the UI, the primary human surface the owner names `majordomus ui`, as its own native surface on the shared server: its own mount, shell, delivery-vocabulary navigation and assets, with a first Dashboard composed only from capabilities, each value citing the capability and pointer it was read from.

DONE wave 0 · p1 · implementation profile · runs alone

Part of development-runtime — The runtime has a development surface.

Objective

Why

The owner's unified real-data UI pack (campaigns/majordomus-ui-unified-real-data-v2-20261011) asks for eleven screens. On 2026-10-11 the owner settled where they live: 'it is majordomus ui primary, not cockpit (low level)'. ADR 0135 records the decision. The M00 audit (tmp/owner-packs/majordomus-ui-unified-real-data-v2-20261011/AUDIT-M00.md) found that the data for most panels exists but the Cockpit's overview needed 13-18 s to paint, and that integration.queue alone takes 50 s, so the first screen must ask only fast sources and draw the queue as a panel of its own. Before this change `majordomus ui` was an unknown command and no surface of the server was the high-level one.

Current state

The shared server serves the Cockpit (/cockpit), the API, Swagger, MCP and the home page. There is no high-level surface.

Desired state

A native surface `ui` is mounted at /ui (topology, binding, router; Feature::Ui) and served by the shared server beside the Cockpit, which it refers to only as the technical view of a source. Its frame follows the owner's references: a sidebar of screens with the kit's icons (compiled from site/data/kit/icons.toml by majordomus generate) and a version card read from distribution.releases, a top bar with the search, the time the screen was read and the other surfaces, and a menu that opens without JavaScript. Seven screens — Dashboard, Roadmap, Issues & PRs, Mesh, CI/CD & Releases, Evidence, Governance — each a hero band with KPI tiles and a grid of panels, compose only capability answers asked at once. Every panel names its sources with the API route, CLI command and MCP tool capabilities.describe declares. Tiles, panels and rows lead to the screen holding the whole. Milestone dependencies are drawn as a graph with the vendored Cytoscape over a table fallback. Donuts, meters and timelines are drawn server-side from the counts they list, and a missing value reads none, unknown or not answered, never zero. The pull-request queue is the panel /ui/panels/pull-requests, pulled in after paint. A visible screen is read again every minute and says when. ui-integrity and the ADR 0012 index check cover src/ui (cases 389 and 547), and the CI class ui selects the asset check whenever share/ui or src/ui changes. Not done here: the majordomus ui command (I2231, to be amended), and the Command, Capabilities, Deployments, Documentation and Settings screens.

Scope

apps/majordomus-cli/src/ui
apps/majordomus-cli/src/generate.rs
scripts/ci/cockpit-projection-check
.ai/repo/ci/gates.yaml
.ai/repo/features/ui.md
test/cases/389_cockpit_projection.sh
test/cases/547_the_ui_says_only_what_is_derived.sh
docs/MAJORDOMUS_UI.md
docs/README.md
.gitignore
apps/majordomus-cli/src/cockpit/assets.rs
apps/majordomus-cli/src/lib.rs
apps/majordomus-cli/src/http/router.rs
apps/majordomus-cli/src/http/surfaces.rs
apps/majordomus-cli/src/shared.rs
apps/majordomus-cli/src/web/discover.rs
apps/majordomus-cli/src/web/model.rs
share/ui
scripts/cockpit-assets
.ai/repo/adrs/0135-majordomus-ui-is-the-primary-surface.md
.ai/repo/project/issues/I2461.yaml

Dependencies

None. This issue is a root of the graph.

What waits on this

Acceptance criteria

GET /ui on a shared server answers 200 text/html with the Cockpit's CSP, and with JavaScript disabled shows the six tiles and every panel or its link
Every tile and panel of the Dashboard cites the capability it read, and a source that fails makes its tile 'not answered', never 0
The Dashboard's first paint never asks integration.queue; /ui/panels/pull-requests answers the queue as a page, and with ?fragment as the panel alone
The rail lists exactly the screens the dispatcher answers, and a test fails when the two differ
scripts/cockpit-assets --check fails when share/ui/ui.css is stale
scripts/ci/cockpit-projection-check --ui-integrity fails on a registry read or a zero-count default in src/ui (case 547)
Every panel names its sources with the API route, CLI command and MCP tool capabilities.describe declares, and the Cockpit only as their technical view

Validation

bin/majordomus plan validate
cargo test --lib ui::
cargo test --lib cockpit::assets
scripts/cockpit-assets --check

Evidence required

ui_surface_served_test
ui_dashboard_cites_sources_test
ui_screenshots_1440_768_375

Evidence

covers	type	command	result	at commit
ui_surface_served_test	ci	cargo test --test ui_surface (validate run 38223440282 on 722228ef3c, the v0.21.0 top, job rust)	the_dashboard_is_served_at_ui_under_the_cockpits_policy, the_queue_panel_is_a_page_and_a_fragment, the_ui_is_a_public_surface_and_answers_only_reads: ok	722228e
ui_dashboard_cites_sources_test	ci	cargo test --lib ui::dashboard; cargo test --test ui_surface (validate run 38223440282 on 722228ef3c, the v0.21.0 top)	9 ui::dashboard tests ok, including every_source_is_named_and_the_queue_waits_for_its_own_route; the served dashboard cites six capabilities by their Cockpit pages	722228e
ui_screenshots_1440_768_375	artifact	node scratchpad/shots.mjs (Playwright Chromium, dark) against majordomus serve 0.21.0 built from perf/the-ui-answers-at-once d24107bd88	/ui at 1440x900, 768x1024 and 375x812: no horizontal overflow, no page errors	722228e

Timeline

started: 2026-10-12T10:58:53Z
verified: 2026-10-12T10:59:05Z
completed: 2026-10-12T10:59:30Z

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2461.yaml. Read it back with majordomus plan show I2461.