I3191 — The UI reads any linked runtime the mesh names, and says which runtime every reading came from

✕BLOCKED wave 2 · p2 · implementation profile · parallel safe

Part of the-mesh-is-operated-from-one-page — The owner operates the mesh from one page: every runtime readable, one action authorised end to end.

Objective

Offer on /ui a target choice derived from mesh nodes (local, each trusted linked runtime), read the chosen runtime over HTTP from the endpoint on its signed RuntimeCard, through its declared ingress where one exists, stamp every panel with the runtime, the transport, that the read is unsigned and the observation time, and render an unreachable target as a state.

Why

On 2026-09-15 the owner wanted the Cockpit's default backend to be lundra, autodetected and never hard-coded; on 10-18 to see the whole mesh from one page. Reads beyond loopback are allowed by ADR 0126; writes are not. Critique 10-18: the link carries only the hello and sync exchanges (mesh/link.rs), so reads go over HTTP and the page says so. The owner's c296#0 also asked for a skill and a route. ADR 0209 leaves whether 'prismatic-lumen' becomes a route, CLI command, MCP namespace or skill to the owner, and that question is open until the owner answers it. Proposed in ADR 0201 (The persistent runtime is the authority; every operator surface, Lumen included, is a client of it) (proposed; it carries no authority until the owner accepts it). Sources: chatgpt-majordomus:c138#2.

Current state

Verified: /ui reads only the server that serves it (apps/majordomus-cli/src/ui); the link protocol has only the hello and sync exchanges, protocol range 1..1 (mesh/link.rs).

Desired state

?target=<node> on /ui screens; target list from mesh.peers; read-only for remote targets.

Scope

• docs/MAJORDOMUS_UI.md
• apps/majordomus-cli/src/mesh/testing.rs
• apps/majordomus-cli/src/ui/source.rs
• apps/majordomus-cli/src/ui/mesh.rs
• apps/majordomus-cli/src/ui/shell.rs
• apps/majordomus-cli/src/ui/mod.rs
• apps/majordomus-cli/src/cockpit/pages.rs
• site/content/docs/majordomus-ui.md
• docs/COCKPIT.md
• site/content/docs/cockpit.md

Out of scope

• Remote writes (I3192 after web-sign-in)
• A signed read domain in the link protocol; LINK_PROTOCOL_MAX stays 1 and a protocol bump is a later issue with its own mixed-version rule
• The per-figure source and age and reconnect recovery that I3138 already delivers

Dependencies

• I2414✓DONE mesh.state and mesh.peers answer a filtered summary that fits one tool answer
• I3138✕BLOCKED One page shows the whole mesh from the blackboard, peers and monitor with each figure's freshness, and recovers after a reconnect
• I3196✕BLOCKED A deployment's external URL, trusted hosts and forwarded headers are one typed fact read by every surface
• I3182✕BLOCKED One read says which work is progressing, waiting, stalled, failed or orphaned, and on what evidence

Acceptance criteria

• Switching target changes every reading and says so
• No address is typed in code; the target resolves by node identity
• A linked runtime is read over HTTP from the endpoint on its signed RuntimeCard, through its declared ingress where one exists, and every panel names the runtime, the transport and that the read is unsigned
• apps/majordomus-cli/tests/ui_linked_runtime.rs links two runtimes through apps/majordomus-cli/src/mesh/testing.rs and reads B's state from A's /ui
• The page shows what is blocked and why from I3182's classification, with its source and age
• The published Pages snapshot renders the target choice disabled with a 'live only' state
• The /cockpit mesh view and the site documentation show the same target choice and its live-only state in the snapshot

Validation

• majordomus plan validate
• cargo test --test ui_surface

Evidence required

• ui_linked_runtime_tests

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3191.yaml. Read it back with majordomus plan show I3191.