amadan
spec: owner-facing per-app metrics in console
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+22
−6
docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md+22 −6
diff --git a/docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md b/docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md| index 0c074bbde..447e2996e 100644 |
| --- a/docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md |
| +++ b/docs/superpowers/specs/2026-08-02-host-process-monitoring-design.md |
| @@ -101,11 +101,15 @@ active alert, and is published to `alerts/boxes/<box>.json`. |
| Delivery failure never blocks sampling or state transitions; it is logged |
| and retried on the next tick while the alert remains active. |
| -## 4. Console — operator dashboard |
| +## 4. Console — operator dashboard and owner metrics |
| -A new console page behind the **existing operator role**, with the |
| -existing security gate ordering (session → CSRF → role; byte-identical |
| -404 for non-operators, `requireFreshAuth` last if used). |
| +Two audiences, two views, one data source. |
| + |
| +**Operator dashboard** — a new console page behind the **existing |
| +operator role**, with the existing security gate ordering (session → |
| +CSRF → role; byte-identical 404 for non-operators, `requireFreshAuth` |
| +last if used). Strictly more detail than the public fleet page: needles |
| +where it has band words, per-unit where it has aggregates. |
| - Per-box: current CPU / memory / disk as real numbers, 48-hour |
| sparklines from the raw chunks, longer trends from the daily rollups. |
| @@ -114,8 +118,20 @@ existing security gate ordering (session → CSRF → role; byte-identical |
| as zero. |
| - Active alerts render red at the top; a cleared alert disappears rather |
| than lingering. |
| -- House rendering rules: vendored assets only (Lucide-style in-code SVG, |
| - no CDN); sparklines drawn from inline data. |
| + |
| +**Owner metrics** — app owners see their own apps' metrics on the app |
| +pages they already have (owner gate unchanged): per app, per instance |
| +(each `carlos-app@<host>` unit, on whichever box runs it), current CPU / |
| +memory / io plus the same 48-hour sparklines and daily trends. The |
| +ownership mapping comes from the registry the console already uses for |
| +the owner gate. The boundary is strict: an owner sees **only their own |
| +units' cgroup readings** — never host-level totals, other tenants' |
| +units, box labels beyond what their app pages already show, or anything |
| +from `alerts/`. Host needles would leak cross-tenant information; they |
| +are operator-only. |
| + |
| +House rendering rules for both views: vendored assets only (Lucide-style |
| +in-code SVG, no CDN); sparklines drawn from inline data. |
| ## 5. Testing |