Operator Dashboard

Choose the correct surface

The dashboards are not interchangeable clients of one identical API. In particular, the Node trace-detail endpoint is /operator/api/trace?id=...; the parity endpoint is /operator/api/traces/:id. Do not point the parity dashboard at native ingress and expect operator routes to exist.

Sources: engine cloudflare-native/src/ingress.js:264-273, src/operator-dashboard.js:609-690; parity cloudflare/src/worker.js:115-157, cloudflare/src/review-state-api.js:876-899; UI worker/proxy-utils.js:15-56.

Parity dashboard views

The parity router provides /pull-requests, /analytics, /memory, /settings, /test-lab and /test-lab/:id. Its default route redirects to Pull Requests.

• Pull Requests: the PR drawer loads detail and recent trace details. Its Re-run review control submits an operator command and reports command status. Command acceptance is not proof that a review finished.
• Analytics: PR Reviews and Bugs Caught consume the reports API, including filters and ZIP export. They are not the older placeholder charts. Observability separately loads recent traces without requiring the analytics endpoint.
• Memory: the parity view supports persisted contexts, approval/activation, editing, deletion, repository clusters, knowledge documents and source-provider workflows. Do not confuse it with the Node snapshot's sample memory rows.
• Settings: the parity view has policy editing, repository scheduling controls and specialized settings sections. It is not read-only.
• Test Lab: reads experiment summaries and per-experiment metrics; the page does not create or enable experiments.

Sources: UI src/App.tsx:15-28; src/components/PrDrawer.tsx:94-108,129-131; src/lib/api.ts:149-180; src/views/Analytics.tsx:128-163; src/views/Memory.tsx:60-62,190-195,314-327; src/views/Settings.tsx:242-261; src/views/TestLab.tsx:69-73,239-243.

BFF configuration and sessions

The browser calls /api/*. The BFF maps known paths to backend routes and attaches a server-configured token. It does not pass through a browser-supplied bearer token.

Missing backend base returns 503 backend_not_configured. A privileged call without the admin backend token returns 503 admin_backend_not_configured. Authentication configuration failures are separate from backend failures.

The BFF accepts only its opaque __Host-anton-session cookie. The cookie is Secure, HttpOnly and SameSite=Lax; session lifetime is 12 hours. WorkOS access tokens are signature-, issuer-, expiry- and user-allowlist-checked. Auth routes are GET /api/auth/login, GET /api/auth/session and POST /api/auth/logout. Mutations require same-origin requests and JSON content type.

Backend operator tokens and WorkOS token responses are not forwarded as browser API credentials. Operator API-key creation is a distinct feature: its one-time anton_ secret is deliberately returned in the creation response. Do not claim that no secret can ever reach the dashboard.

Sources: UI worker/proxy-utils.js:1-5,15-56,95-100; worker/index.js:24-73; worker/workos-auth.js:11-18,43-79; worker/bff-sessions.js:4-6,24-25,69-75,117-156; parity src/operator-api-keys.js:65-78.

Known cross-tree token mismatch

The BFF chooses SON_OF_ANTON_ADMIN_TOKEN for all allowed mutations, including /api/commands/requeue and /api/commands/retry-publish. The parity backend requires its separate OPERATOR_COMMAND_TOKEN for command creation. These sources do not automatically route the command credential correctly.

Likewise, /api/queue maps to /queue/jobs, but ordinary BFF reads use the ordinary API token while that backend route requires QUEUE_ADMIN_TOKEN.

A visible button or route mapping is not evidence that those operations work with distinct credentials. Integration must resolve the route-specific token selection; do not weaken token separation to conceal the mismatch. Other API requests can still work while these calls return 401.

Sources: UI worker/index.js:7-16,42-46; worker/proxy-utils.js:19,36-37; parity cloudflare/src/worker.js:58-80.

Separate Node dashboard

For a Node server, set GILF_OPERATOR_UI_ENABLED=1 and a nonempty GILF_OPERATOR_UI_TOKEN in the server environment. Only GET requests are served; other methods return 405. With no token, GET requests fail with 401 operator_auth_required.

For a configured server URL in REVIEW_URL, a read request is:

curl --fail-with-body -sS \
  -H "Authorization: Bearer $GILF_OPERATOR_UI_TOKEN" \
  "$REVIEW_URL/operator/api/snapshot?view=pull-requests"

This is an API example, not a browser-login mechanism. The Node handler expects a bearer header on protected HTML, assets and data requests; the environment variables do not create a WorkOS session for it.

The Node memory snapshot contains hardcoded sample entries. It is not authoritative evidence of active memory rules or configured integrations. Trace-list errors are caught and returned as empty lists, so an empty view can also mean a store problem.

Sources: engine server.mjs:79-84; src/operator-dashboard.js:231-251,253-286,291-313,601-687.

See Operator API, Cost and traces, and Dashboard settings. Availability statements above are source-scoped; no live UI, session or backend was probed during this audit.