Skip to content

feat: add shared WebUI client state - #1864

Merged
inureyes merged 9 commits into
mainfrom
feature/issue-1842-typed-client
Sep 12, 2026
Merged

feat: add shared WebUI client state#1864
inureyes merged 9 commits into
mainfrom
feature/issue-1842-typed-client

Conversation

@inureyes

@inureyes inureyes commented Sep 12, 2026

Copy link
Copy Markdown
Member

Summary

  • Add one headless React state authority and typed API client for authentication, catalog, model actions, operations, runtime observation, and chat/Responses streaming. Credentials stay in memory; inference resolves the real model ID and explicitly disables autoload.
  • Validate complete merged catalog/security contracts, bound and cancel JSON/SSE readers, reject redirects, redact credentials, and fence stale asynchronous results. Successful-data freshness is separate from state-transition time.
  • Add atomic server replay using paired instance/sequence cursors, paginated snapshots, minimum resource fences, and evidence-based reconciliation without automatic POST retries.

Validation

  • Combined runtime 7497da98, based on merged catalog/security: CI-faithful make verify-test passed 11,226 tests, zero failures, 361 ignored; workspace/all-target Clippy and 41 strict contract fixtures passed.
  • Frontend typecheck, lint, 45 unit tests, one Chromium smoke test, deterministic two-build bundle, and shared static gates passed. Feature-off workspace check passed with 43 warnings.
  • The initial non-CI parallel test command failed one unchanged vision numeric assertion. The same binary passed that isolated test five times; the prescribed serialized CI command then passed without source or tolerance changes.
  • Independent correctness/security integration reviews found no remaining findings. Bilingual reports record exact validation boundaries and page-hook integration.
  • GB10 is down; unavailable required checks are waived by the maintainer for this epic. CUDA/OpenXLA execution, actual Safari, and production feature-page acceptance are not claimed.

Refs #1834; Closes #1842

@inureyes inureyes added status:review Under review type:enhancement New features, capabilities, or significant additions priority:high High priority area:architecture Architecture and code structure changes labels Sep 12, 2026
inureyes added a commit that referenced this pull request Sep 12, 2026
The WebUI client could compute replay cursors without an operations snapshot fence, dispatch runtime snapshots without their server sequence, and leave custom-fetch stream reads pending after logout when the fetch implementation ignored AbortSignal.

This tightens runtime and operations snapshot fencing, requires real inference model ids with autoload=false for streaming inference, makes reader loops signal-aware, clears stale login state on server-instance changes, and replaces the large cursor-parse error with a small typed error for Clippy.

Validation: pnpm typecheck/lint/unit, deterministic bundle verification, WebUI contract verification, targeted WebUI Rust tests, compatibility checks, and scoped Clippy pass locally.

Refs #1834; Refs #1842; Refs #1864
inureyes added a commit that referenced this pull request Sep 12, 2026
The public WebUI state used lastUpdatedAt for both reducer transitions and successful server data freshness, so error, stale, heartbeat, and logout paths could look like fresh data updates.

Add lastSuccessfulAt as a separate nullable timestamp that advances only when validated current-session data snapshots or data events are accepted, preserves the previous value across ordinary errors and gaps, and clears it on logout or server-instance replacement.

Validation: pnpm typecheck/lint/unit, deterministic bundle verification, and WebUI contract verification pass locally.

Refs #1834; Refs #1842; Refs #1864
inureyes added a commit that referenced this pull request Sep 12, 2026
Document the complete headless hook surface, same-origin API prefix and inference exceptions, acceptance versus readiness, and separate successful-data freshness from ordinary state updates.

Add bilingual PR 1864 reports with independent review outcomes, 44 frontend tests, 33 contract fixtures and the root frozen-Rust workspace gate. Keep downstream browser/hardware acceptance and the unavailable GB10 CI waiver explicit.

Refs #1842; Refs #1864; Refs #1834
@inureyes inureyes added status:done Completed and removed status:review Under review labels Sep 12, 2026
Add the headless WebUI API client, canonical schema-backed runtime validation, fetch-based SSE parsing, and the shared React state provider that downstream Models, Chat, Activity and Settings pages must compose instead of private transport or polling layers.

The state reducer uses per-resource sequence fences for catalog, operations, lifecycle and runtime snapshots, keeps bearer credentials memory-only, records unknown POST outcomes by idempotency key for reconciliation, and aborts in-flight work when authentication or model selection changes.

Refs #1834; Closes #1842
Start the UI event stream only after authoritative bootstrap, catalog and operation snapshots are reconciled, validate the full operations envelope, pass the last event cursor, and keep unknown POST outcomes pending until matching operation evidence or an explicit expiration error.

Revoke bearer state before parsing failed 401 bodies, keep abort controllers alive through response body consumption, fence delayed login results against logout, replace ambient Python fixture checks with JavaScript schema-bound fixture validation, and cover provider logout and deterministic HTTP-error races.

Refs #1834; Closes #1842
Use paired server-instance and sequence replay cursors for WebUI SSE synchronization, add server-side cursor validation with retained-ring replay checks, and keep legacy Last-Event-ID as an opaque compatibility path.

Tighten the shared frontend client around bounded HTTP bodies, redirect rejection, token redaction, paginated snapshots, selected-runtime refresh, reset resnapshot handling, and shared inference SSE transport for chat and responses.

Refresh the canonical WebUI schema, generated DTOs, fixtures, docs, unit coverage, router tests, and deterministic asset manifest.
The WebUI client could compute replay cursors without an operations snapshot fence, dispatch runtime snapshots without their server sequence, and leave custom-fetch stream reads pending after logout when the fetch implementation ignored AbortSignal.

This tightens runtime and operations snapshot fencing, requires real inference model ids with autoload=false for streaming inference, makes reader loops signal-aware, clears stale login state on server-instance changes, and replaces the large cursor-parse error with a small typed error for Clippy.

Validation: pnpm typecheck/lint/unit, deterministic bundle verification, WebUI contract verification, targeted WebUI Rust tests, compatibility checks, and scoped Clippy pass locally.

Refs #1834; Refs #1842; Refs #1864
The public WebUI state used lastUpdatedAt for both reducer transitions and successful server data freshness, so error, stale, heartbeat, and logout paths could look like fresh data updates.

Add lastSuccessfulAt as a separate nullable timestamp that advances only when validated current-session data snapshots or data events are accepted, preserves the previous value across ordinary errors and gaps, and clears it on logout or server-instance replacement.

Validation: pnpm typecheck/lint/unit, deterministic bundle verification, and WebUI contract verification pass locally.

Refs #1834; Refs #1842; Refs #1864
Settings and download notifications do not update the shared data projection yet, so they must not advance successful-data freshness. Add typed regressions for older and duplicate notifications and rebuild the source manifest.
Document the complete headless hook surface, same-origin API prefix and inference exceptions, acceptance versus readiness, and separate successful-data freshness from ordinary state updates.

Add bilingual PR 1864 reports with independent review outcomes, 44 frontend tests, 33 contract fixtures and the root frozen-Rust workspace gate. Keep downstream browser/hardware acceptance and the unavailable GB10 CI waiver explicit.

Refs #1842; Refs #1864; Refs #1834
Preserve numeric event replay beside the merged catalog and security adapters, and exercise their complete fixture corpus in the typed client. Build reducer inputs from validated catalog examples, normalize independently captured mock sessions explicitly, and cover raw versus resolved architecture identity and required metadata bounds. Rebuild the deterministic source manifest.
@inureyes
inureyes force-pushed the feature/issue-1842-typed-client branch from 00ece39 to 7497da9 Compare September 12, 2026 15:47
Document raw versus resolved catalog metadata and refresh bilingual PR reports after integrating the security and catalog contracts. Preserve the distinction between historical pre-integration evidence and the combined 7497da9 gate.

Record 45 frontend tests, 41 fixtures, 11,226 passing CI-faithful workspace tests, Clippy, Chromium shell and deterministic bundle checks. Include the initial parallel numerical failure, unchanged-binary serial diagnosis and feature-off warnings without claiming unavailable CUDA or actual Safari validation.

Refs #1842; Refs #1864; Refs #1834
@inureyes
inureyes merged commit 70386ac into main Sep 12, 2026
14 of 16 checks passed
@inureyes
inureyes deleted the feature/issue-1842-typed-client branch September 12, 2026 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:architecture Architecture and code structure changes priority:high High priority status:done Completed type:enhancement New features, capabilities, or significant additions

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(webui): add the shared typed client and state synchronization

1 participant