Console and panel: venues, doctor results, OpenShell runs and secrets shown truthfully #712

Goal

The web console and the /dispatch panel show what the OpenShell venue (#683, #684, #686) and the secrets features
(run.secrets, secret profiles, and #704's bundles) actually do. Nothing either surface says may be wrong for the
venue a job ran on.

Part of #650. Audited against main at 14e8f28, with #684 merged. None of the OpenShell PRs added a console or panel
feature. #700 only made the panel's sandbox pane refuse the venue.

What already works

• The venue name on a run: console panels.mjs:787, panel dashboard.ts:4075. run-api.mjs:69 accepts
  openshell.
• Choosing the venue on trigger add or edit, through the worker's own parseBackendList
  (write-plans.mjs:123-141).
• Venue-neutral features: sizing (cpu and memory), the host budget and MCP.
• Secret profiles: add and remove, with secrets maps masked in diffs (console/actions.mjs:229).
• Unknown refusal reasons are kept and shown raw. A sentence for each is Console: explain every outcome, a truthful overview, one vocabulary with the panel #710.

Wrong today

1. The console prints pi-dispatch sandbox <id> on every run (panels.mjs:745-752). openshell has no
   launcher. The panel already says "not reopenable" (admin/src/index.ts:2129-2154).
2. The panel's secrets disclosure says "the agent can read them" (dashboard.ts:3501-3503). On openshell
   (credentialCustody: layer) the agent holds placeholders for every value with an endpoint.
3. The "absent" sentences for live transcript, progress and chat blame PI_LIVE_TRANSCRIPTS=0, expiry or not
   started (console/transcript.mjs:105, panels.mjs:522). On openshell the cause is the venue (no live staging
   until OpenShell: steering and live transcripts over stdio, optional bind mode #686).
4. The panel offers its steer keys on any steer-armed run (dashboard.ts:1405), and the planner then refuses
   (job-actions.mjs:928). steerSkipped: "venue-copies" is read by nothing in admin/.
5. The setup wizard offers only docker or podman (setup-wizard.ts:691-698).
   • podmanPreferred ignores openshell.
   • With PI_OPENSHELL_ENGINE=podman on a host without docker, the podman answer stops at :711.
   • up and service install do not know the openshell venue #707 covers up and service install, not the wizard.
6. Profiles are listed from the overlay only (read-model.mjs:4673, secrets-command.ts:51). A profile
   declared in env PI_SECRET_PROFILES is missing, and the console then says "No secret profile is declared".
7. A trigger pairing run.recover with openshell is accepted when written, then refused before spend on every
   delivery (openshell-recover-unsupported).
8. admin/src/index.ts:1842-1844 says profile management lives on the operator command "and nowhere else". The
   console's secret-profile-add does it too.

Missing

A Venues view, in the console (Fleet or Config) and the panel

For each venue it shows:

• the hosts that offer it, whether it is blessed, and the default venue and PI_BACKEND_FLOOR;
• the declared properties in words, for example "Steering: no (copy mode) · Live transcript: no · Recovery: no ·
  Local folders: no · Credentials: held by the venue (placeholders in the agent)";
• the engine and gateway (PI_OPENSHELL_ENGINE, PI_OPENSHELL_GATEWAY, copy or bind mode once OpenShell: steering and live transcripts over stdio, optional bind mode #686 lands).

Also needed:

• a venue column on the hosts table and the runs lists, and a backend filter field in run-filter.mjs;
• each venue's sentences come from BACKENDS_TABLE, derived and never restated.

Doctor results

The latest pi-dispatch doctor (and --openshell) checks per host. Each worker publishes them, as names, levels and
fixed sentences, to Valkey, and the console and panel read them. Today the console says "run pi-dispatch doctor for
the reason" (panels.mjs:1173,1249).

The OpenShell run page

• the venue's policy summary: rule hosts and the count of placeholders, never values;
• the per-job providers;
• each MCP server's connection state that OpenShell policy layer: egress network policy, per-job credential providers, MCP #684 records.

Secrets, per profile and per bundle

• Each profile shows:
  • its source (env or overlay);
  • the resolver path, and whether it is inside PI_SECRET_RESOLVER_ROOTS (checked before the confirm, not after;
    this needs withinRoots exported from the worker package);
  • the triggers and projects using it;
  • the last resolve: when, whether it worked, and the reason sentence if not.
• Each bundle (Project secret bundles: grant a project's env once, shared by every job, any manager or none #704) shows: its project, profile, opt-outs, forkReviews, and the variable names of the last
  resolve. Never values.
• On each run: "Variables received: A, B, C (from bundle shop)", the shadowed names, bundleSkipped, and on
  openshell "placeholders: N, plain values: M".
• In the panel: /dispatch secrets add --bundle, operator-typed only as today.
• A project edit refused by Project secret bundles: grant a project's env once, shared by every job, any manager or none #704's rule shows that refusal's sentence.

Proposal

• The fixes: items 1 to 8 above.
• The views: the three Missing sections.
• The wording comes from the worker's own tables:
  • BACKENDS_TABLE, STEER_SKIPPED_REASONS, OPENSHELL_REFUSALS, credentialCustody;
  • bolted by tests, so a fourth venue or a new property shows up without an admin edit.
• The secrets disclosure is custody-aware: it resolves the trigger's venue (named, or PI_BACKENDS[0]).

Spec work

• DES-OPERATOR-CONSOLE and DES-ADMIN-VIA-PI-EXTENSION: the new views.
• INT-RUN-RECORD (or its current name): the variable names a run received, if the record gains them in Project secret bundles: grant a project's env once, shared by every job, any manager or none #704.
  • Names are operator-chosen config, not attacker text, so the record stays PII-free.
  • State this explicitly.
• Doctor publishing to Valkey: a new key under the existing namespace, an INT- row, a retention rule.
• REQ-CONSOLE-SECURITY: UNCHANGED, checked. Nothing shows a value, a reference or a resolver's stderr.

Done when

• An openshell run, refused and completed, renders on both surfaces with no wrong sentence. This is checked by
  fixtures:
  • no sandbox command;
  • a custody-aware secrets line;
  • live and steer absence blamed on the venue.
• The Venues view lists local, podman and openshell with their properties derived from BACKENDS_TABLE, and a
  test fails if a property has no sentence.
• Profiles:
  • Env and overlay profiles both list.
  • A resolver outside the roots is refused before the confirm.
• Wizard and triggers:
  • The wizard offers openshell or refuses it by name.
  • A run.recover + openshell trigger is refused when written.
• Doctor results from every host show in the console.
• Bundles show per project and per run once Project secret bundles: grant a project's env once, shared by every job, any manager or none #704 lands.