Dashboard redesign — full-screen, tabbed, gate-first

Overview

The dashboard was an 820px-wide single-column scroll of ~13 table sections, each with a foldable 'why' essay — a word-bomb that buried the thesis. This redesign makes it full-screen and tabbed, and puts the gate first: each loop's hero is the four trust bearings flowing into the earned/hold decision. Two parts: a per-loop data layer, then a rewritten renderer.

Per-loop views — each trust class its own standing

dependency-patch and security-patch are distinct trust classes that never share a record (§3.9), so each earns its own tab. LoopView holds one loop's complete standing — the same shape the combined view has, scoped to one loop.

src/froot/dashboard/model.py · 479 lines

src/froot/dashboard/model.py479 lines · Python

⋯ 391 lines hidden (lines 1–391)1"""The dashboard's view model — pure, frozen, fully derived.
2 
3These types are the shape the renderer projects to HTML. They carry *already
4computed* numbers (the aggregates live in :mod:`~froot.dashboard.read_model`),
5so the renderer is a dumb projection and every figure on the page is
6unit-tested apart from any I/O. Nothing here is persisted: a
class:`DashboardModel` is built fresh per request and discarded after the
8response (derive, never store).
9"""
10 
11from __future__ import annotations
12 
13from datetime import datetime
14 
15from froot.domain.base import Frozen
16 
17 
18class SourceHealth(Frozen):
  """Whether one external truth answered this request.
20 
  Attributes:
      name: The source label (``github`` / ``temporal`` / ``clickhouse``).
      ok: True when the source returned data; False when it errored or is off.
      detail: A short human note — the row count, ``off``, or the error.
  """
26 
  name: str
  ok: bool
  detail: str
30 
31 
32class ScanLoop(Frozen):
  """The liveness of one repo's durable scan schedule (the signal stage).
34 
  Attributes:
      repo: The ``owner/name`` slug this loop watches.
      loop: Which maintenance loop this row is for (``dependency-patch`` /
          ``security-patch``), so the two loops' scans show distinctly.
      status: The current scan workflow status (``running`` /
          ``continued_as_new`` / ``terminated`` / ``none`` / ...), lowercased.
      live: True when the loop is actively self-scheduling (running / CAN).
      last_tick: When the current scan execution started (≈ the last tick),
          or ``None`` if no scan workflow exists for the repo.
  """
45 
  repo: str
  loop: str = "dependency-patch"
  status: str
  live: bool
  last_tick: datetime | None
51 
52 
53class BumpRow(Frozen):
  """One proposed dependency bump, joined across GitHub and Temporal.
55 
  GitHub is authoritative for the outcome (state / timestamps / PR); Temporal
  enriches with the model verdict and the CI reading while it is still in the
  7-day window, with the PR body as the durable fallback for the verdict.
59 
  Attributes:
      repo: The ``owner/name`` slug.
      loop: Which loop proposed it (``dependency-patch`` /
          ``security-patch``), from the PR's loop label — so the two loops'
          records never mix.
      package: The bumped dependency.
      from_version: The version bumped from, if known.
      to_version: The version bumped to.
      state: The GitHub PR state — ``open`` / ``merged`` / ``closed``.
      verdict: The changelog verdict (``clean`` / ``risky`` / ``unknown``), or
          ``None`` when neither Temporal nor the PR body yields one.
      ci: The terminal CI reading (``passed`` / ``failed`` / ``absent`` /
          ``timed_out``), or ``None`` when only durable GitHub data remains.
      pr_number: The PR number, if a PR exists.
      pr_url: The PR URL, if a PR exists.
      opened_at: When the PR was opened.
      merged_at: When the PR was merged, if it was.
      ttm_minutes: Time-to-merge in minutes (merged - opened), if merged.
      age_hours: Age in hours for a still-open PR (now - opened), or ``None``.
      would_auto_merge: For an open PR, whether it meets the earned-autonomy
          grant — the loop's actual merge decision on an allowlisted repo, the
          advisory shadow-gate verdict everywhere else (the default).
      held_reason: Why an open PR would *not* auto-merge, the first blocker.
      post_merge: For a merged PR, whether the merge *held* — ``held`` (the
          branch's CI stayed green after the merge), ``broke`` (it went red),
          ``reverted`` (a later commit reverted it), or ``None`` when no
          post-merge signal is recoverable (the outcome leg, coarse).
  """
88 
  repo: str
  loop: str = "dependency-patch"
  package: str
  from_version: str | None
  to_version: str
  state: str
  verdict: str | None
  ci: str | None
  pr_number: int | None
  pr_url: str | None
  opened_at: datetime | None
  merged_at: datetime | None
  ttm_minutes: float | None
  age_hours: float | None
  would_auto_merge: bool = False
  held_reason: str | None = None
  post_merge: str | None = None
  # The judgment environment (judge-model slug) the PR was opened under, or
  # ``None`` if unstamped; the gate counts only the current env (§3.7).
  env: str | None = None
109 
110 
111class ClassGate(Frozen):
  """The earned-autonomy standing of one (repo, loop) class.
113 
  The MHE economics of approval (§3.6) made legible: a class earns its gate
  move with a high enough approval rate over enough recently-decided PRs,
  and the budget framing shows what moving the gate would reclaim.
117 
  Attributes:
      repo: The ``owner/name`` slug.
      loop: The loop this class is for.
      decided: PRs decided (merged or closed) in the recent window.
      merged: How many of those were merged.
      merge_rate: ``merged / decided``, or ``None`` if none decided.
      determined: Merges with a confirmed post-merge outcome in the window
          (held / broke / reverted) — the defect bearing's evidence.
      defects: Of those, how many broke the branch or were reverted.
      defect_rate: ``defects / determined``, or ``None`` if none determined —
          the second, independent bearing the gate triangulates against.
      prior_env_decided: Decided PRs in the window earned under a *different*
          (or no) environment — they no longer count, so this figure makes a
          model-change reset legible rather than a mysterious drop to zero.
      earned: Whether the class has earned its gate move under the policy.
      blocker: Why it has not, if it has not (else ``None``).
      approvals_per_week: The steward approvals this class costs now
          (merges per week over the window) — the current budget draw.
      reclaim_per_week: How many of those a gate move would auto-merge
          (the clean-and-green ones), i.e. the budget reclaimed — ``0`` until
          the class is ``earned``, since an un-earned class reclaims nothing.
      window_days: The look-back window the figures cover.
  """
141 
  repo: str
  loop: str
  decided: int
  merged: int
  merge_rate: float | None
  determined: int
  defects: int
  defect_rate: float | None
  prior_env_decided: int
  earned: bool
  blocker: str | None
  approvals_per_week: float
  reclaim_per_week: float
  window_days: int
156 
157 
158class Failure(Frozen):
  """A bump loop that did not close — the honest friction signal.
160 
  Attributes:
      workflow_id: The Temporal workflow id (encodes repo/package/target).
      kind: ``terminated`` or ``failed``.
      reason: The human-readable termination/failure reason, if recovered.
      when: When the workflow closed, if known.
  """
167 
  workflow_id: str
  kind: str
  reason: str | None
  when: datetime | None
172 
173 
174class ActivityStat(Frozen):
  """Latency of one activity stage, from traces (run-telemetry enrichment).
176 
  Attributes:
      name: The activity name (``scan_candidates``, ``open_pull_request``).
      count: How many executions in the window.
      avg_ms: Mean duration in milliseconds.
      max_ms: Max duration in milliseconds.
  """
183 
  name: str
  count: int
  avg_ms: float
  max_ms: float
188 
189 
190class RunTelemetry(Frozen):
  """Trace-derived run telemetry from ClickHouse, or an unavailable marker.
192 
  Attributes:
      available: True when ClickHouse answered with froot traces.
      total_spans: Total froot spans in the window.
      error_spans: Spans that ended in an error.
      last_activity: The most recent froot span timestamp.
      window_days: The look-back window the figures cover.
      activities: Per-stage latency rows.
  """
201 
  available: bool
  total_spans: int
  error_spans: int
  last_activity: datetime | None
  window_days: int
  activities: tuple[ActivityStat, ...]
208 
209 
210class TrackRecord(Frozen):
  """The reputation headline, derived from GitHub PR outcomes.
212 
  Attributes:
      opened: Total bumps froot has proposed.
      merged: How many a human merged.
      closed_unmerged: How many were closed without merging.
      open_now: How many are still awaiting a decision.
      merge_rate: ``merged / (merged + closed_unmerged)``, or ``None`` if none
          have been decided yet.
      median_ttm_minutes: Median time-to-merge across merged PRs, or ``None``.
  """
222 
  opened: int
  merged: int
  closed_unmerged: int
  open_now: int
  merge_rate: float | None
  median_ttm_minutes: float | None
229 
230 
231class Verification(Frozen):
  """The CI-oracle breakdown — kept honest about whether an oracle existed.
233 
  Attributes:
      passed: Bumps whose CI went green.
      failed: Bumps whose CI went red.
      absent: Bumps where no CI check existed (no oracle).
      timed_out: Bumps where froot stopped waiting on CI.
      unknown: Bumps with no recoverable CI reading (aged out of Temporal).
      oracle_existed: Bumps where a real oracle reported (passed + failed).
      with_reading: Bumps with any CI reading at all (excludes ``unknown``).
  """
243 
  passed: int
  failed: int
  absent: int
  timed_out: int
  unknown: int
  oracle_existed: int
  with_reading: int
251 
252 
253class Reliability(Frozen):
  """Did the merges *hold*? — the post-merge outcome leg (coarse, low-recall).
255 
  A merge is not the same as a success: the success leg is whether the merge
  *held* once it landed. This breaks recent merges into held / broke /
  reverted, with the honest caveat that it sees only what the default branch's
  CI and git-reverts reveal — a manual or bundled revert is invisible, so the
  defect rate is a *floor*, not the truth. It is the natural-traffic bearing
  the adversarial canary leg exercises.
262 
  Attributes:
      held: Merges whose branch CI stayed green after the merge.
      broke: Merges whose branch CI went red after the merge.
      reverted: Merges a later commit git-reverted (the minority that are).
      unverified: Merges with no recoverable post-merge signal (no branch
          oracle, or aged past the commit window) — never counted as held.
      determined: ``held + broke + reverted`` — merges actually classified.
      defect_rate: ``(broke + reverted) / determined``, or ``None`` if none
          were determined. A floor on the true defect rate, by construction.
      window_days: The look-back window over merges considered.
  """
274 
  held: int
  broke: int
  reverted: int
  unverified: int
  determined: int
  defect_rate: float | None
  window_days: int
282 
283 
284class Probes(Frozen):
  """Adversarial canary probes — does the guardrail still bite? (§2.11).
286 
  A canary is a deliberately-bad bump planted to test the guardrail; a healthy
  loop must refuse to merge it. These counts are kept **strictly apart** from
  the genuine track record and defect rate — a synthetic failure must never
  pollute the real bearings — and shown on their own. ``escaped > 0`` is the
  alarm: a known-bad bump that landed means the guardrail has a hole.
292 
  Attributes:
      caught: Probes the guardrail refused (closed, or never landed).
      escaped: Probes that merged anyway — a guardrail hole (should be 0).
      pending: Probes still in flight (open, no verdict yet).
      total: All canary probes seen.
  """
299 
  caught: int
  escaped: int
  pending: int
  total: int
304 
305 
306class Judgment(Frozen):
  """The model's changelog-verdict mix and its calibration against CI.
308 
  Attributes:
      clean: Verdicts of ``clean``.
      risky: Verdicts of ``risky``.
      unknown: Verdicts of ``unknown``.
      none: Bumps with no recoverable verdict.
      clean_but_failed: ``clean`` verdicts whose CI failed (mis-judged).
      flagged_but_passed: ``risky``/``unknown`` verdicts whose CI passed.
  """
317 
  clean: int
  risky: int
  unknown: int
  none: int
  clean_but_failed: int
  flagged_but_passed: int
324 
325 
326class ReviewLoop(Frozen):
  """Liveness of one repo's determinism-review loop (the transitive ring).
328 
  Attributes:
      repo: The ``owner/name`` slug this loop reviews.
      status: The review workflow status (``running`` /
          ``continued_as_new`` / ``terminated`` / ...), lowercased.
      live: True when the loop is actively self-scheduling.
      last_tick: When the current review execution started (≈ the last tick),
          or ``None`` if no review workflow exists for the repo.
  """
337 
  repo: str
  status: str
  live: bool
  last_tick: datetime | None
342 
343 
344class ReviewRow(Frozen):
  """One per-PR determinism review, from its ``PrReviewWorkflow`` result.
346 
  Attributes:
      repo: The ``owner/name`` slug the PR belongs to.
      pr_number: The reviewed PR number, if known.
      pr_url: The PR's web URL, if it can be formed.
      head_sha: The head commit the review ran against.
      findings: How many transitive hazards the review surfaced.
      rules: The distinct banned calls flagged (``datetime.datetime.now``…).
      comment_url: The advisory comment's URL, if one was posted.
      status: The review workflow status (``completed`` / ``running`` / ...).
      reviewed_at: When the review closed, or started if still running.
  """
358 
  repo: str
  pr_number: int | None
  pr_url: str | None
  head_sha: str | None
  findings: int
  rules: tuple[str, ...]
  comment_url: str | None
  status: str
  reviewed_at: datetime | None
368 
369 
370class ReviewRecord(Frozen):
  """The determinism reviewer's headline, derived from completed reviews.
372 
  The hazard-resolved rate (was a flagged hazard gone on a later commit?) is
  a later addition — it needs accumulated cross-commit history, so it is not
  here yet.
376 
  Attributes:
      reviewed: Completed per-PR reviews in the recent window.
      flagged: Reviews that surfaced at least one hazard.
      clean: Reviews that surfaced none.
      hazards: Total hazards surfaced across all reviews.
      repos_covered: Distinct repos with a live review loop.
  """
384 
  reviewed: int
  flagged: int
  clean: int
  hazards: int
  repos_covered: int
390 
391 
392class LoopView(Frozen):
  """One bump loop's complete standing — the same treatment for every loop.
394 
  dependency-patch and security-patch are distinct trust classes (§3.9) that
  never share a record, so each gets its own self-contained view: its gate and
  four bearings, its queue, its detail. Built by partitioning the bump rows by
  loop and running the same aggregates the combined view uses, so a loop's tab
  is exactly the combined dashboard scoped to that one loop.
400 
  Attributes:
      loop: The loop key (``dependency-patch`` / ``security-patch``).
      title: The human title for the tab.
      scan_loops: Liveness of this loop's per-repo scan schedules.
      scan_interval_seconds: This loop's scan cadence (telemetry-in-context).
      track_record: This loop's reputation headline.
      class_gates: This loop's per-repo earned-autonomy standing (the gate).
      verification: This loop's CI-oracle breakdown.
      reliability: This loop's post-merge outcome leg.
      probes: This loop's adversarial canary tally.
      judgment: This loop's model-verdict mix and calibration.
      gate: This loop's open PRs awaiting a human, freshest last.
      bumps: This loop's proposed bumps, newest first.
      failures: This loop's bump loops that did not close.
  """
416 
  loop: str
  title: str
  scan_loops: tuple[ScanLoop, ...]
  scan_interval_seconds: int
  track_record: TrackRecord
  class_gates: tuple[ClassGate, ...]
  verification: Verification
  reliability: Reliability
  probes: Probes
  judgment: Judgment
  gate: tuple[BumpRow, ...]
  bumps: tuple[BumpRow, ...]
  failures: tuple[Failure, ...]
430 
431 
⋯ 48 lines hidden (lines 432–479)432class DashboardModel(Frozen):
  """The whole 10,000ft view, fully derived and ready to render.
434 
  Attributes:
      generated_at: When this view was assembled (UTC).
      repos_configured: The repos froot is pointed at (``FROOT_REPOS``).
      scan_interval_seconds: The configured gap between scan ticks.
      sources: Per-source health for this request.
      scan_loops: Liveness of each repo's scan schedule.
      track_record: The reputation headline.
      class_gates: The earned-autonomy standing per (repo, loop) — the gate.
      verification: The CI-oracle breakdown.
      reliability: Did the merges hold post-merge (the outcome leg, coarse).
      probes: Adversarial canary results, kept apart from the real bearings.
      judgment: The model-verdict mix and calibration.
      gate: Open PRs awaiting a human, the freshest last.
      bumps: Every proposed bump, newest first (the detail behind the stats).
      failures: Bump loops that did not close.
      review_interval_seconds: The configured gap between review poll ticks.
      review_loops: Liveness of each Temporal repo's determinism-review loop.
      review_record: The determinism reviewer's headline.
      reviews: Every per-PR determinism review, newest first.
      telemetry: Trace-derived run telemetry (best-effort).
      bump_loops: One self-contained view per bump loop — the per-loop tabs.
          The top-level bump aggregates above are the combined ("all loops")
          view; these split it per trust class.
  """
459 
  generated_at: datetime
  repos_configured: tuple[str, ...]
  scan_interval_seconds: int
  sources: tuple[SourceHealth, ...]
  scan_loops: tuple[ScanLoop, ...]
  track_record: TrackRecord
  class_gates: tuple[ClassGate, ...]
  verification: Verification
  reliability: Reliability
  probes: Probes
  judgment: Judgment
  gate: tuple[BumpRow, ...]
  bumps: tuple[BumpRow, ...]
  failures: tuple[Failure, ...]
  review_interval_seconds: int
  review_loops: tuple[ReviewLoop, ...]
  review_record: ReviewRecord
  reviews: tuple[ReviewRow, ...]
  telemetry: RunTelemetry
  bump_loops: tuple[LoopView, ...] = ()

The read-model partitions the already-computed bump rows by loop and runs the same aggregates per loop, so a loop's tab is the whole dashboard scoped to one loop. Failures live in Temporal, not the PR rows, so they are attributed by workflow id — the segmentless ids are dependency-patch, the security-patch-segmented ones are security-patch.

src/froot/dashboard/read_model.py · 792 lines

src/froot/dashboard/read_model.py792 lines · Python

⋯ 494 lines hidden (lines 1–494)1"""Assemble the dashboard view — pure, from the three readers' output.
2 
3This is the reputation read-model proper: it joins GitHub (authoritative
4outcomes) to Temporal (recent verdict + CI reading) by PR number, derives the
5MHE-framed aggregates (track record, verification, judgment, the approval
6queue), and returns a fully-computed
class:`~froot.dashboard.model.DashboardModel` the renderer just projects. No
8I/O and no clock of its own — ``now`` is passed in — so every figure on the
9page is unit-tested apart from the network.
10"""
11 
12from __future__ import annotations
13 
14from typing import TYPE_CHECKING
15 
16from froot.dashboard.model import (
  BumpRow,
  ClassGate,
  DashboardModel,
  Failure,
  Judgment,
  LoopView,
  Probes,
  Reliability,
  ReviewLoop,
  ReviewRecord,
  ReviewRow,
  RunTelemetry,
  ScanLoop,
  SourceHealth,
  TrackRecord,
  Verification,
33)
34from froot.domain.loop import Loop
35from froot.domain.repo import RepoRef, TargetRepo
36from froot.policy.autonomy import AutonomyPolicy, class_earned, pr_autonomy
37from froot.policy.canary import is_canary, score_probe
38from froot.policy.naming import review_workflow_id, scan_workflow_id
39from froot.result import Ok
40 
41if TYPE_CHECKING:
  from datetime import datetime
43 
  from froot.dashboard.github_source import GithubPr
  from froot.dashboard.temporal_source import (
      BumpExecution,
      PrReviewExecution,
      ReviewExecution,
      ScanExecution,
  )
51 
52# The conservative fallback policy: empty allowlist, so the shadow gate holds
53# everything until a caller passes a real one (built from FROOT_AUTOMERGE_*).
54_DEFAULT_POLICY = AutonomyPolicy()
55 
56_LIVE_STATUSES = frozenset({"running", "continued_as_new"})
57# Every way a bump can end without closing cleanly — all belong in the honest
58# Failures panel, not silently dropped.
59_FAILURE_STATUSES = frozenset({"terminated", "failed", "canceled", "timed_out"})
60 
61 
62def _median(values: list[float]) -> float | None:
  """The median of ``values``, or ``None`` if empty (pure)."""
  if not values:
      return None
  ordered = sorted(values)
  mid = len(ordered) // 2
  if len(ordered) % 2 == 1:
      return ordered[mid]
  return (ordered[mid - 1] + ordered[mid]) / 2
71 
72 
73def _scan_id(repo: str, loop: Loop) -> str | None:
  """The deterministic scan-loop id for an ``owner/name`` slug + loop."""
  match RepoRef.parse(repo):
      case Ok(ref):
          return scan_workflow_id(TargetRepo(repo=ref), loop)
      case _:
          return None
80 
81 
82def _scan_loops(
  repos: tuple[str, ...],
  loops: tuple[Loop, ...],
  scans: tuple[ScanExecution, ...],
86) -> tuple[ScanLoop, ...]:
  """One liveness row per configured (repo, loop) (latest execution wins)."""
  by_id: dict[str, ScanExecution] = {}
  for scan in scans:
      current = by_id.get(scan.workflow_id)
      if current is None or _newer(scan.start, current.start):
          by_id[scan.workflow_id] = scan
  rows: list[ScanLoop] = []
  for loop in loops:
      for repo in repos:
          scan_id = _scan_id(repo, loop)
          execution = by_id.get(scan_id) if scan_id is not None else None
          if execution is None:
              rows.append(
                  ScanLoop(
                      repo=repo,
                      loop=loop.value,
                      status="none",
                      live=False,
                      last_tick=None,
                  )
              )
          else:
              rows.append(
                  ScanLoop(
                      repo=repo,
                      loop=loop.value,
                      status=execution.status,
                      live=execution.status in _LIVE_STATUSES,
                      last_tick=execution.start,
                  )
              )
  return tuple(rows)
119 
120 
121def _newer(a: datetime | None, b: datetime | None) -> bool:
  """True if ``a`` is a later instant than ``b`` (``None`` is oldest)."""
  if a is None:
      return False
  if b is None:
      return True
  return a > b
128 
129 
130def _bump_rows(
  now: datetime,
  prs: tuple[GithubPr, ...],
  bumps: tuple[BumpExecution, ...],
  outcomes: dict[tuple[str, int], str],
135) -> tuple[BumpRow, ...]:
  """Join GitHub PRs (authoritative) to Temporal outcomes by PR number.
137 
  ``outcomes`` carries the post-merge signal (``held`` / ``broke`` /
  ``reverted`` / ``unknown``) per recently-merged ``(repo, number)``; it is
  absent for older or non-merged PRs, which leaves ``post_merge`` ``None``.
  """
  # Keyed on (repo, PR number), not the bare number: Temporal lists every
  # repo's bumps in the namespace, so two repos that each have a PR #N would
  # otherwise cross-attribute one's verdict/CI onto the other's row.
  by_pr: dict[tuple[str, int], BumpExecution] = {
      (bump.repo, bump.pr_number): bump
      for bump in bumps
      if bump.repo is not None and bump.pr_number is not None
  }
  rows: list[BumpRow] = []
  for pr in prs:
      execution = by_pr.get((pr.repo, pr.number))
      verdict = (execution.verdict if execution else None) or pr.verdict
      ci = execution.ci if execution else None
      ttm = _minutes_between(pr.opened_at, pr.merged_at)
      age = _hours_between(pr.opened_at, now) if pr.state == "open" else None
      rows.append(
          BumpRow(
              repo=pr.repo,
              loop=pr.loop,
              package=pr.package or "?",
              from_version=pr.from_version,
              to_version=pr.to_version or "?",
              state=pr.state,
              verdict=verdict,
              ci=ci,
              pr_number=pr.number,
              pr_url=pr.url,
              opened_at=pr.opened_at,
              merged_at=pr.merged_at,
              ttm_minutes=ttm,
              age_hours=age,
              post_merge=outcomes.get((pr.repo, pr.number)),
              env=pr.env,
          )
      )
  rows.sort(key=_opened_sort_key, reverse=True)
  return tuple(rows)
179 
180 
181def _opened_sort_key(row: BumpRow) -> float:
  """Sort key putting the most recently opened PR first (unknown last)."""
  return row.opened_at.timestamp() if row.opened_at is not None else 0.0
184 
185 
186def _minutes_between(
  start: datetime | None, end: datetime | None
188) -> float | None:
  """Whole-ish minutes from ``start`` to ``end``, or ``None``."""
  if start is None or end is None:
      return None
  return round((end - start).total_seconds() / 60, 1)
193 
194 
195def _hours_between(
  start: datetime | None, end: datetime | None
197) -> float | None:
  """Hours from ``start`` to ``end``, or ``None``."""
  if start is None or end is None:
      return None
  return round((end - start).total_seconds() / 3600, 1)
202 
203 
204def _track_record(rows: tuple[BumpRow, ...]) -> TrackRecord:
  """Counts, merge rate, and median time-to-merge from the bump rows."""
  merged = [r for r in rows if r.state == "merged"]
  closed = sum(1 for r in rows if r.state == "closed")
  open_now = sum(1 for r in rows if r.state == "open")
  decided = len(merged) + closed
  ttms = [r.ttm_minutes for r in merged if r.ttm_minutes is not None]
  return TrackRecord(
      opened=len(rows),
      merged=len(merged),
      closed_unmerged=closed,
      open_now=open_now,
      merge_rate=(len(merged) / decided) if decided else None,
      median_ttm_minutes=_median(ttms),
  )
219 
220 
221def _verification(rows: tuple[BumpRow, ...]) -> Verification:
  """The CI-oracle breakdown, keeping ``absent`` distinct from a failure."""
  passed = sum(1 for r in rows if r.ci == "passed")
  failed = sum(1 for r in rows if r.ci == "failed")
  absent = sum(1 for r in rows if r.ci == "absent")
  timed_out = sum(1 for r in rows if r.ci == "timed_out")
  unknown = sum(1 for r in rows if r.ci is None)
  return Verification(
      passed=passed,
      failed=failed,
      absent=absent,
      timed_out=timed_out,
      unknown=unknown,
      oracle_existed=passed + failed,
      with_reading=passed + failed + absent + timed_out,
  )
237 
238 
239def _reliability(rows: tuple[BumpRow, ...], window_days: int) -> Reliability:
  """The post-merge outcome breakdown — did the merges hold? (coarse).
241 
  Reads only the ``post_merge`` tag the outcome reader set: ``unknown`` means
  an in-window merge we could not classify (no branch oracle / aged out), kept
  distinct from a held one; ``None`` (older / non-merged) is not counted here.
  The defect rate is a floor — manual and bundled reverts are invisible.
  """
  held = sum(1 for r in rows if r.post_merge == "held")
  broke = sum(1 for r in rows if r.post_merge == "broke")
  reverted = sum(1 for r in rows if r.post_merge == "reverted")
  unverified = sum(1 for r in rows if r.post_merge == "unknown")
  determined = held + broke + reverted
  return Reliability(
      held=held,
      broke=broke,
      reverted=reverted,
      unverified=unverified,
      determined=determined,
      defect_rate=((broke + reverted) / determined) if determined else None,
      window_days=window_days,
  )
261 
262 
263def _probes(canary_rows: tuple[BumpRow, ...]) -> Probes:
  """Tally the adversarial canary probes — caught / escaped / pending.
265 
  These rows are the synthetic bad bumps; they are scored on the strict bar
  (a canary must never merge) and kept out of every genuine bearing.
  """
  scored = [score_probe(r.state) for r in canary_rows]
  return Probes(
      caught=sum(1 for s in scored if s == "caught"),
      escaped=sum(1 for s in scored if s == "escaped"),
      pending=sum(1 for s in scored if s == "pending"),
      total=len(scored),
  )
276 
277 
278def _judgment(rows: tuple[BumpRow, ...]) -> Judgment:
  """The verdict mix plus the two calibration cells worth flagging."""
  clean = sum(1 for r in rows if r.verdict == "clean")
  risky = sum(1 for r in rows if r.verdict == "risky")
  unknown = sum(1 for r in rows if r.verdict == "unknown")
  none = sum(1 for r in rows if r.verdict is None)
  clean_but_failed = sum(
      1 for r in rows if r.verdict == "clean" and r.ci == "failed"
  )
  flagged_but_passed = sum(
      1
      for r in rows
      if r.verdict in ("risky", "unknown") and r.ci == "passed"
  )
  return Judgment(
      clean=clean,
      risky=risky,
      unknown=unknown,
      none=none,
      clean_but_failed=clean_but_failed,
      flagged_but_passed=flagged_but_passed,
  )
300 
301 
302def _decided_at(row: BumpRow) -> datetime | None:
  """When a decided PR was decided — merge time, else open time as a proxy.
304 
  A merged PR has an exact merge instant; a closed-unmerged one does not (the
  issues list froot reads carries no close timestamp), so it is windowed by
  when it opened. The proxy only nudges a closed PR's window membership by its
  own lifetime — close enough for a recency window measured in months.
  """
  return row.merged_at or row.opened_at
311 
312 
313def _within(when: datetime | None, now: datetime, window_days: int) -> bool:
  """Whether ``when`` falls within ``window_days`` before ``now`` (pure)."""
  if when is None:
      return False
  return (now - when).total_seconds() <= window_days * 86400.0
318 
319 
320def _class_gates(
  now: datetime,
  rows: tuple[BumpRow, ...],
  repos: tuple[str, ...],
  loops: tuple[Loop, ...],
  policy: AutonomyPolicy,
  environment: str,
327) -> tuple[ClassGate, ...]:
  """The earned-autonomy standing of each (repo, loop) class.
329 
  Counts only PRs *decided within the window* — trust is recent, not lifetime
  (§2.11) — *and* earned under the current ``environment`` (§3.7's conditional
  property): a PR opened under a different judge model no longer counts, so a
  model swap resets the class. ``prior_env_decided`` keeps that reset legible.
  The budget figures (approvals / reclaim per week) translate the record into
  the steward-time MHE meters (§3.6): what the class costs now, and what
  moving its gate would hand back.
  """
  weeks = max(policy.window_days / 7.0, 1.0)
  gates: list[ClassGate] = []
  for loop in loops:
      for repo in repos:
          in_window = [
              r
              for r in rows
              if r.repo == repo
              and r.loop == loop.value
              and r.state in ("merged", "closed")
              and _within(_decided_at(r), now, policy.window_days)
          ]
          # An empty ``environment`` means "don't filter" (none configured);
          # otherwise only PRs stamped with the current one count.
          decided_rows = [
              r for r in in_window if not environment or r.env == environment
          ]
          prior_env_decided = len(in_window) - len(decided_rows)
          merged_rows = [r for r in decided_rows if r.state == "merged"]
          decided = len(decided_rows)
          merged = len(merged_rows)
          # The post-merge defect bearing, per class (§3.8): confirmed-held
          # outcomes and how many of those went bad. Independent of the rate.
          determined = sum(
              1
              for r in merged_rows
              if r.post_merge in ("held", "broke", "reverted")
          )
          defects = sum(
              1 for r in merged_rows if r.post_merge in ("broke", "reverted")
          )
          earned, blocker = class_earned(
              decided=decided,
              merged=merged,
              determined=determined,
              defects=defects,
              policy=policy,
          )
          # Reclaim is the budget a gate *move* hands back — so it is zero
          # until the class has actually earned the move. Counting the
          # clean-and-green merges of an un-earned class would imply savings
          # the gate would refuse (every PR stays held at "class not earned").
          reclaimable = (
              sum(
                  1
                  for r in merged_rows
                  if r.verdict == "clean" and r.ci == "passed"
              )
              if earned
              else 0
          )
          gates.append(
              ClassGate(
                  repo=repo,
                  loop=loop.value,
                  decided=decided,
                  merged=merged,
                  merge_rate=(merged / decided) if decided else None,
                  determined=determined,
                  defects=defects,
                  defect_rate=(
                      (defects / determined) if determined else None
                  ),
                  prior_env_decided=prior_env_decided,
                  earned=earned,
                  blocker=blocker,
                  approvals_per_week=round(merged / weeks, 2),
                  reclaim_per_week=round(reclaimable / weeks, 2),
                  window_days=policy.window_days,
              )
          )
  return tuple(gates)
410 
411 
412def earned_now(
  now: datetime,
  prs: tuple[GithubPr, ...],
  outcomes: dict[tuple[str, int], str],
  repo: str,
  loop: Loop,
  policy: AutonomyPolicy,
  environment: str,
420) -> bool:
  """Whether one (repo, loop) class has earned its gate, from live data.
422 
  The exact computation the dashboard's class-gate panel shows, exposed so the
  acting gate (the loop) reuses it rather than duplicating the windowing,
  environment filter, and triangulation. Pure over already-fetched data.
  """
  rows = _bump_rows(now, prs, (), outcomes)
  gates = _class_gates(now, rows, (repo,), (loop,), policy, environment)
  return any(g.earned for g in gates)
430 
431 
432def _gate(
  rows: tuple[BumpRow, ...],
  gates: tuple[ClassGate, ...],
  policy: AutonomyPolicy,
436) -> tuple[BumpRow, ...]:
  """Open PRs awaiting a human, most-aged first, each carrying a verdict.
438 
  The verdict is the gate's: would this PR auto-merge under its class's grant
  — the loop's real decision where the repo is allowlisted, advisory (the
  shadow gate) where it is not. The reason is the grant met, or the first
  blocker to fix.
  """
  earned_by_class = {(g.repo, g.loop): (g.earned, g.blocker) for g in gates}
  open_rows = [r for r in rows if r.state == "open"]
  open_rows.sort(
      key=lambda r: r.age_hours if r.age_hours is not None else 0.0,
      reverse=True,
  )
  annotated: list[BumpRow] = []
  for row in open_rows:
      earned, blocker = earned_by_class.get(
          (row.repo, row.loop), (False, "no record for this class")
      )
      verdict = pr_autonomy(
          repo=row.repo,
          verdict=row.verdict,
          ci=row.ci,
          earned=earned,
          blocker=blocker,
          policy=policy,
      )
      annotated.append(
          row.model_copy(
              update={
                  "would_auto_merge": verdict.would_merge,
                  "held_reason": (
                      None if verdict.would_merge else verdict.reason
                  ),
              }
          )
      )
  return tuple(annotated)
474 
475 
476def _failures(bumps: tuple[BumpExecution, ...]) -> tuple[Failure, ...]:
  """Bump loops that did not close, newest first."""
  failures = [
      Failure(
          workflow_id=bump.workflow_id,
          kind=bump.status,
          reason=bump.reason,
          when=bump.close,
      )
      for bump in bumps
      if bump.status in _FAILURE_STATUSES
  ]
  failures.sort(
      key=lambda f: f.when.timestamp() if f.when is not None else 0.0,
      reverse=True,
  )
  return tuple(failures)
493 
494 
495def _loop_title(loop: Loop) -> str:
  """The human tab title for a loop key (``dependency-patch`` -> ...)."""
  return loop.value.capitalize()
498 
499 
500def _failure_loop(workflow_id: str, loops: tuple[Loop, ...]) -> Loop | None:
  """Which loop a failed bump belongs to, from its workflow id.
502 
  Non-default loops carry their name as an id segment
  (``froot-bump-security-patch-…``); dependency-patch is segmentless
  (``froot-bump-…``), so it is the fallback once the specific loops miss.
  """
  for loop in loops:
      if loop is not Loop.DEPENDENCY_PATCH and workflow_id.startswith(
          f"froot-bump-{loop.value}-"
      ):
          return loop
  if workflow_id.startswith("froot-bump-"):
      return next(
          (loop for loop in loops if loop is Loop.DEPENDENCY_PATCH), None
      )
  return None
517 
518 
519def _bump_loops(
  now: datetime,
  rows: tuple[BumpRow, ...],
  canary_rows: tuple[BumpRow, ...],
  failures: tuple[Failure, ...],
  scans: tuple[ScanExecution, ...],
  repos: tuple[str, ...],
  loops: tuple[Loop, ...],
  policy: AutonomyPolicy,
  environment: str,
  scan_interval_seconds: int,
  reliability_window_days: int,
531) -> tuple[LoopView, ...]:
  """One self-contained :class:`LoopView` per loop — the per-loop tabs.
533 
  Partitions the already-computed bump rows by loop and runs the very same
  aggregates the combined view uses, so each loop's tab is the whole dashboard
  scoped to one trust class (§3.9). Failures are attributed by workflow id.
  """
  views: list[LoopView] = []
  for loop in loops:
      loop_rows = tuple(r for r in rows if r.loop == loop.value)
      loop_canary = tuple(r for r in canary_rows if r.loop == loop.value)
      loop_gates = _class_gates(
          now, loop_rows, repos, (loop,), policy, environment
      )
      loop_failures = tuple(
          f for f in failures if _failure_loop(f.workflow_id, loops) is loop
      )
      views.append(
          LoopView(
              loop=loop.value,
              title=_loop_title(loop),
              scan_loops=_scan_loops(repos, (loop,), scans),
              scan_interval_seconds=scan_interval_seconds,
              track_record=_track_record(loop_rows),
              class_gates=loop_gates,
              verification=_verification(loop_rows),
              reliability=_reliability(loop_rows, reliability_window_days),
              probes=_probes(loop_canary),
              judgment=_judgment(loop_rows),
              gate=_gate(loop_rows, loop_gates, policy),
              bumps=loop_rows,
              failures=loop_failures,
          )
      )
  return tuple(views)
566 
567 
⋯ 225 lines hidden (lines 568–792)568def _review_id(repo: str) -> str | None:
  """The deterministic review-loop id for an ``owner/name`` slug, if valid."""
  match RepoRef.parse(repo):
      case Ok(ref):
          return review_workflow_id(TargetRepo(repo=ref))
      case _:
          return None
575 
576 
577def _pr_review_prefix(repo: str) -> str | None:
  """The id prefix every per-PR review of ``repo`` shares (the join key)."""
  review_id = _review_id(repo)
  if review_id is None:
      return None
  # froot-review-<slug> -> froot-pr-review-<slug>- ; the pr/sha tail follows.
  return "froot-pr-review-" + review_id.removeprefix("froot-review-") + "-"
584 
585 
586def _attribute_repo(workflow_id: str, repos: tuple[str, ...]) -> str | None:
  """The configured repo a per-PR-review id belongs to (longest prefix)."""
  best: str | None = None
  best_len = -1
  for repo in repos:
      prefix = _pr_review_prefix(repo)
      if prefix and workflow_id.startswith(prefix) and len(prefix) > best_len:
          best, best_len = repo, len(prefix)
  return best
595 
596 
597def _review_loops(
  repos: tuple[str, ...], reviews: tuple[ReviewExecution, ...]
599) -> tuple[ReviewLoop, ...]:
  """One liveness row per repo that actually has a review loop.
601 
  Reviews are scoped to the Temporal repos, so a configured npm repo with no
  review loop is omitted rather than shown as a dead one.
  """
  by_id: dict[str, ReviewExecution] = {}
  for review in reviews:
      current = by_id.get(review.workflow_id)
      if current is None or _newer(review.start, current.start):
          by_id[review.workflow_id] = review
  loops: list[ReviewLoop] = []
  for repo in repos:
      review_id = _review_id(repo)
      execution = by_id.get(review_id) if review_id is not None else None
      if execution is None:
          continue
      loops.append(
          ReviewLoop(
              repo=repo,
              status=execution.status,
              live=execution.status in _LIVE_STATUSES,
              last_tick=execution.start,
          )
      )
  return tuple(loops)
625 
626 
627def _review_rows(
  pr_reviews: tuple[PrReviewExecution, ...], repos: tuple[str, ...]
629) -> tuple[ReviewRow, ...]:
  """Project each per-PR review into a row, newest review first."""
  rows: list[ReviewRow] = []
  for execution in pr_reviews:
      repo = _attribute_repo(execution.workflow_id, repos)
      pr_url = (
          f"https://github.com/{repo}/pull/{execution.pr_number}"
          if repo is not None and execution.pr_number is not None
          else None
      )
      rows.append(
          ReviewRow(
              repo=repo or "?",
              pr_number=execution.pr_number,
              pr_url=pr_url,
              head_sha=execution.head_sha,
              findings=execution.findings,
              rules=execution.rules,
              comment_url=execution.comment_url,
              status=execution.status,
              reviewed_at=execution.close or execution.start,
          )
      )
  rows.sort(
      key=lambda r: r.reviewed_at.timestamp() if r.reviewed_at else 0.0,
      reverse=True,
  )
  return tuple(rows)
657 
658 
659def _review_record(
  loops: tuple[ReviewLoop, ...], rows: tuple[ReviewRow, ...]
661) -> ReviewRecord:
  """Counts over the completed reviews (resolved-rate is a later loop)."""
  completed = [r for r in rows if r.status == "completed"]
  flagged = sum(1 for r in completed if r.findings > 0)
  hazards = sum(r.findings for r in completed)
  return ReviewRecord(
      reviewed=len(completed),
      flagged=flagged,
      clean=len(completed) - flagged,
      hazards=hazards,
      repos_covered=len(loops),
  )
673 
674 
675def _sources(
  github_error: str | None,
  github_count: int,
  temporal_error: str | None,
  temporal_count: int,
  telemetry: RunTelemetry,
  clickhouse_error: str | None,
682) -> tuple[SourceHealth, ...]:
  """Per-source health for the header strip."""
  clickhouse_ok = clickhouse_error is None
  if clickhouse_error == "off":
      clickhouse_detail = "off"
  elif clickhouse_error is not None:
      clickhouse_detail = clickhouse_error
  else:
      spans = telemetry.total_spans
      clickhouse_detail = f"{spans} spans / {telemetry.window_days}d"
  return (
      SourceHealth(
          name="github",
          ok=github_error is None,
          detail=github_error or f"{github_count} PRs",
      ),
      SourceHealth(
          name="temporal",
          ok=temporal_error is None,
          detail=temporal_error or f"{temporal_count} workflows",
      ),
      SourceHealth(
          name="clickhouse", ok=clickhouse_ok, detail=clickhouse_detail
      ),
  )
707 
708 
709def assemble(
  *,
  now: datetime,
  repos: tuple[str, ...],
  loops: tuple[Loop, ...] = (Loop.DEPENDENCY_PATCH,),
  policy: AutonomyPolicy = _DEFAULT_POLICY,
  scan_interval_seconds: int,
  review_interval_seconds: int,
  github: tuple[tuple[GithubPr, ...], str | None],
  temporal: tuple[
      tuple[
          tuple[ScanExecution, ...],
          tuple[BumpExecution, ...],
          tuple[ReviewExecution, ...],
          tuple[PrReviewExecution, ...],
      ],
      str | None,
  ],
  telemetry: tuple[RunTelemetry, str | None],
  outcomes: dict[tuple[str, int], str] | None = None,
  reliability_window_days: int = 90,
  environment: str = "",
731) -> DashboardModel:
  """Build the whole view from the readers' ``(data, error)`` outputs.
733 
  ``outcomes`` is the post-merge signal per ``(repo, number)`` from the
  outcome reader (best-effort); absent for a merge older than the window.
  """
  prs, github_error = github
  (scans, bumps, reviews, pr_reviews), temporal_error = temporal
  run_telemetry, clickhouse_error = telemetry
740 
  all_rows = _bump_rows(now, prs, bumps, outcomes or {})
  # Canary probes are synthetic bad bumps — keep them out of every genuine
  # bearing (track record, defect rate, gates) so a planted failure can never
  # pollute the real reputation; they get their own tally.
  canary_rows = tuple(r for r in all_rows if is_canary(r.to_version))
  rows = tuple(r for r in all_rows if not is_canary(r.to_version))
  class_gates = _class_gates(now, rows, repos, loops, policy, environment)
  all_failures = _failures(bumps)
  bump_loops = _bump_loops(
      now,
      rows,
      canary_rows,
      all_failures,
      scans,
      repos,
      loops,
      policy,
      environment,
      scan_interval_seconds,
      reliability_window_days,
  )
  review_loops = _review_loops(repos, reviews)
  review_rows = _review_rows(pr_reviews, repos)
  return DashboardModel(
      generated_at=now,
      repos_configured=repos,
      scan_interval_seconds=scan_interval_seconds,
      sources=_sources(
          github_error,
          len(prs),
          temporal_error,
          len(scans) + len(bumps) + len(reviews) + len(pr_reviews),
          run_telemetry,
          clickhouse_error,
      ),
      scan_loops=_scan_loops(repos, loops, scans),
      track_record=_track_record(rows),
      class_gates=class_gates,
      verification=_verification(rows),
      reliability=_reliability(rows, reliability_window_days),
      probes=_probes(canary_rows),
      judgment=_judgment(rows),
      gate=_gate(rows, class_gates, policy),
      bumps=rows,
      failures=all_failures,
      review_interval_seconds=review_interval_seconds,
      review_loops=review_loops,
      review_record=_review_record(review_loops, review_rows),
      reviews=review_rows,
      telemetry=run_telemetry,
      bump_loops=bump_loops,
  )

The gate hero — four bearings into one decision

The hero of every loop tab. The four bearings: approval rate and defect rate come from the record; the adversarial probe is the loop's escaped-canary count; the deep review runs per-PR at the merge, so it shows 'armed' (always-on) rather than a record figure. They flow into the gate node (classes earned) and the outcome — HOLD / EARNED / AUTO-MERGE.

src/froot/dashboard/render.py · 763 lines

src/froot/dashboard/render.py763 lines · Python

⋯ 266 lines hidden (lines 1–266)1"""Render the view model to one self-contained HTML page (pure).
2 
3All CSS is inline, there is no JavaScript (tabs are CSS-only, via hidden radio
4inputs), and the page makes no network request of its own — it is a static,
5full-screen projection of an already-computed
class:`~froot.dashboard.model.DashboardModel`. Every dynamic value is
7HTML-escaped at the boundary.
8 
9The shape is gate-first: each loop is a tab whose hero is the *gate* — a small
10flow of the four trust bearings into the earned/hold decision — over a compact
11metric grid and foldable detail. Each loop is a distinct trust class (§3.9), so
12each tab is the whole dashboard scoped to one loop; determinism-review and the
13cross-cutting run-telemetry get their own tabs.
14"""
15 
16from __future__ import annotations
17 
18from datetime import UTC, datetime, timedelta
19from html import escape
20from typing import TYPE_CHECKING
21 
22if TYPE_CHECKING:
  from froot.dashboard.model import (
      BumpRow,
      ClassGate,
      DashboardModel,
      LoopView,
      ReviewRow,
      RunTelemetry,
  )
31 
32_CSS = """
root{--fg:#13151a;--mut:#6b7280;--faint:#9aa1ac;--line:#e7e9ee;--bg:#fbfbfc;
34--panel:#fff;--ok:#1a7f37;--warn:#9a6700;--bad:#cf222e;--accent:#0969da;
35--accentbg:#ddf0ff;--chip:#f2f4f7;--node:#eef6ff}
36@media(prefers-color-scheme:dark){:root{--fg:#e8eaed;--mut:#9aa1ac;
37--faint:#6b7280;--line:#23262d;--bg:#0a0b0d;--panel:#121419;--ok:#3fb950;
38--warn:#d29922;--bad:#f85149;--accent:#58a6ff;--accentbg:#10263f;
39--chip:#1a1d24;--node:#10263f}}
40*{box-sizing:border-box}
41body{margin:0;background:var(--bg);color:var(--fg);
42font:14px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
43-webkit-font-smoothing:antialiased}
44main{padding:0 clamp(16px,3vw,44px) 64px}
45a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
mono{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.92em}
mut{color:var(--mut)}.ok{color:var(--ok)}.warn{color:var(--warn)}
bad{color:var(--bad)}
49/* header */
50header{display:flex;align-items:baseline;flex-wrap:wrap;gap:8px 20px;
51padding:22px 0 16px;border-bottom:1px solid var(--line)}
52h1{font-size:19px;margin:0;letter-spacing:-.02em;font-weight:700}
53h1 .v{color:var(--faint);font-weight:400;font-size:13px;margin-left:8px}
hstatus{display:flex;align-items:center;gap:7px;font-size:13px}
hmeta{margin-left:auto;display:flex;flex-wrap:wrap;gap:6px 16px;
56color:var(--mut);font-size:12px}
dot{display:inline-block;width:8px;height:8px;border-radius:50%}
dot.ok{background:var(--ok)}.dot.warn{background:var(--warn)}
dot.bad{background:var(--bad)}.dot.mute{background:var(--faint)}
60/* tabs (CSS-only) */
tabin{position:absolute;opacity:0;pointer-events:none}
62nav.tabbar{display:flex;flex-wrap:wrap;gap:4px;margin:14px 0 0;
63border-bottom:1px solid var(--line)}
64nav.tabbar label{display:inline-flex;align-items:center;gap:8px;cursor:pointer;
65padding:9px 15px;font-size:13px;font-weight:600;color:var(--mut);
66border-bottom:2px solid transparent;margin-bottom:-1px;white-space:nowrap}
67nav.tabbar label:hover{color:var(--fg)}
68nav.tabbar label .badge{font-weight:600;font-size:11px;color:var(--faint);
69background:var(--chip);border-radius:9px;padding:1px 7px}
panel{display:none;padding:22px 0 0;animation:fade .15s ease}
71@keyframes fade{from{opacity:.4}to{opacity:1}}
72/* gate hero */
hero{display:grid;grid-template-columns:minmax(320px,1.1fr) minmax(280px,1fr);
74gap:18px 26px;align-items:start;margin:0 0 6px}
75@media(max-width:760px){.hero{grid-template-columns:1fr}}
heroh{font-size:11px;text-transform:uppercase;letter-spacing:.09em;
77color:var(--mut);font-weight:700;margin:0 0 12px}
gateflow{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
bearings{display:flex;flex-direction:column;gap:6px;min-width:150px}
bearing{display:flex;align-items:center;justify-content:space-between;gap:10px;
81background:var(--chip);border-radius:7px;padding:6px 10px;font-size:12px}
bearing .bl{color:var(--mut)}
bearing .bv{font-weight:600;font-variant-numeric:tabular-nums}
bearing.armed .bv{color:var(--faint);font-weight:500}
flowarrow{color:var(--faint);font-size:18px;line-height:1}
gatenode{flex:0 0 auto;text-align:center;border:2px solid var(--accent);
87background:var(--node);border-radius:12px;padding:12px 16px;min-width:96px}
gatenode .gl{font-size:10px;text-transform:uppercase;letter-spacing:.08em;
89color:var(--accent);font-weight:700}
gatenode .gv{font-size:22px;font-weight:700;line-height:1.15;
91font-variant-numeric:tabular-nums}
gatenode .gs{font-size:11px;color:var(--mut)}
outcome{flex:0 0 auto;border-radius:10px;padding:11px 15px;text-align:center;
94border:1px solid var(--line)}
outcome .ot{font-size:15px;font-weight:700;letter-spacing:.01em}
outcome .os{font-size:11px;color:var(--mut);margin-top:1px}
outcome.act{background:color-mix(in srgb,var(--ok) 12%,transparent);
98border-color:color-mix(in srgb,var(--ok) 40%,transparent)}
outcome.act .ot{color:var(--ok)}
outcome.hold .ot{color:var(--mut)}
caption{color:var(--mut);font-size:12px;margin:8px 0 0;line-height:1.45}
102/* class table inside the hero */
classes{width:100%;border-collapse:collapse;font-size:12.5px}
classes th,.classes td{text-align:left;padding:6px 10px 6px 0;
105border-bottom:1px solid var(--line);vertical-align:baseline}
classes th{color:var(--mut);font-weight:600;font-size:10.5px;
107text-transform:uppercase;letter-spacing:.05em}
classes td.r{font-variant-numeric:tabular-nums}
pill{display:inline-block;font-size:11px;font-weight:600;border-radius:20px;
110padding:1px 9px}
pill.ok{color:var(--ok);
112background:color-mix(in srgb,var(--ok) 14%,transparent)}
pill.hold{color:var(--mut);background:var(--chip)}
114/* metric cards */
cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));
116gap:10px;margin:22px 0 0}
card{background:var(--panel);border:1px solid var(--line);border-radius:10px;
118padding:13px 15px}
card .n{font-size:24px;font-weight:700;line-height:1.05;
120font-variant-numeric:tabular-nums}
card .l{color:var(--mut);font-size:11.5px;margin-top:3px}
card .x{color:var(--faint);font-size:11px;margin-top:5px}
123/* section + detail */
sec{margin:26px 0 0}
sech{font-size:11px;text-transform:uppercase;letter-spacing:.08em;
126color:var(--mut);font-weight:700;margin:0 0 10px;display:flex;
127align-items:baseline;gap:10px}
sech .n{color:var(--faint);font-weight:600;letter-spacing:0}
129details.fold{margin:18px 0 0;border:1px solid var(--line);border-radius:10px;
130background:var(--panel)}
131details.fold>summary{cursor:pointer;list-style:none;padding:11px 15px;
132font-size:12px;font-weight:600;color:var(--fg);display:flex;
133align-items:center;gap:9px}
134details.fold>summary::-webkit-details-marker{display:none}
135details.fold>summary::before{content:"\\25B8";color:var(--faint);font-size:10px}
136details.fold[open]>summary::before{content:"\\25BE"}
137details.fold>summary .c{color:var(--faint);font-weight:600}
138details.fold .body{padding:0 15px 14px}
139table.data{width:100%;border-collapse:collapse;font-size:12.5px}
140table.data th,table.data td{text-align:left;padding:6px 12px 6px 0;
141border-bottom:1px solid var(--line);vertical-align:top}
142table.data th{color:var(--mut);font-weight:600;font-size:10.5px;
143text-transform:uppercase;letter-spacing:.04em}
144table.data td.r{font-variant-numeric:tabular-nums;white-space:nowrap}
empty{color:var(--mut);font-size:13px;padding:14px 0;border:1px dashed
146var(--line);border-radius:9px;text-align:center;background:var(--panel)}
tags{display:flex;flex-wrap:wrap;gap:6px}
t{font-size:11px;border-radius:6px;padding:1px 7px;background:var(--chip);
149color:var(--mut)}
t.ok{color:var(--ok)}.t.warn{color:var(--warn)}.t.bad{color:var(--bad)}
cad{color:var(--mut);font-size:12px;margin:14px 0 0}
cad b{color:var(--fg);font-weight:600}
153footer{margin:40px 0 0;padding-top:16px;border-top:1px solid var(--line);
154color:var(--mut);font-size:12px;line-height:1.65}
155footer b{color:var(--fg);font-weight:600}
156"""
157 
158_CI_CLASS = {
  "passed": "ok",
  "failed": "bad",
  "absent": "mut",
  "timed_out": "warn",
163}
164_VERDICT_CLASS = {"clean": "ok", "risky": "warn", "unknown": "mut"}
165_POST_MERGE_CLASS = {
  "held": "ok",
  "broke": "bad",
  "reverted": "bad",
  "unknown": "mut",
170}
171_STATE_CLASS = {"merged": "ok", "closed": "mut", "open": "warn"}
172_FAIL_CLASS = {"failed": "bad", "terminated": "warn"}
173 
174 
175# ── small formatters ─────────────────────────────────────────────────────────
176def _aware(when: datetime) -> datetime:
  return when if when.tzinfo else when.replace(tzinfo=UTC)
178 
179 
180def _ago(when: datetime | None, now: datetime) -> str:
  if when is None:
      return "—"
  secs = (now - _aware(when)).total_seconds()
  if secs < 90:
      return "just now"
  mins = secs / 60
  if mins < 90:
      return f"{round(mins)}m ago"
  hours = mins / 60
  if hours < 36:
      return f"{round(hours)}h ago"
  return f"{round(hours / 24)}d ago"
193 
194 
195def _until(when: datetime | None, now: datetime) -> str:
  if when is None:
      return "—"
  secs = (_aware(when) - now).total_seconds()
  if secs <= 0:
      return "due"
  mins = secs / 60
  if mins < 90:
      return f"~{round(mins)}m"
  hours = mins / 60
  if hours < 36:
      return f"~{round(hours)}h"
  return f"~{round(hours / 24)}d"
208 
209 
210def _pct(rate: float | None) -> str:
  return "—" if rate is None else f"{rate * 100:.0f}%"
212 
213 
214def _dot(kind: str) -> str:
  return f'<span class="dot {kind}"></span>'
216 
217 
218def _tag(value: str | None, classes: dict[str, str]) -> str:
  if value is None:
      return '<span class="t">—</span>'
  cls = classes.get(value, "")
  return f'<span class="t {cls}">{escape(value)}</span>'
223 
224 
225def _pr_link(row: BumpRow) -> str:
  if row.pr_url is None or row.pr_number is None:
      return '<span class="mut">—</span>'
  return f'<a href="{escape(row.pr_url, quote=True)}">#{row.pr_number}</a>'
229 
230 
231def _short_id(workflow_id: str) -> str:
  return escape(workflow_id.removeprefix("froot-bump-"))
233 
234 
235# ── header ───────────────────────────────────────────────────────────────────
236def _alive(model: DashboardModel) -> tuple[str, str]:
  """Global liveness dot + label across every loop."""
  live = sum(1 for x in model.scan_loops if x.live) + sum(
      1 for x in model.review_loops if x.live
  )
  total = len(model.scan_loops) + len(model.review_loops)
  if total == 0:
      return "mute", "no loops configured"
  kind = "ok" if live == total else ("warn" if live else "bad")
  return kind, f"{live}/{total} loops live"
246 
247 
248def _header(model: DashboardModel) -> str:
  kind, label = _alive(model)
  sources = " ".join(
      f"{_dot('ok' if s.ok else 'bad')}{escape(s.name)}"
      for s in model.sources
  )
  return (
      "<header>"
      '<h1>froot<span class="v mono">gemma4:12b</span></h1>'
      f'<span class="hstatus">{_dot(kind)}{escape(label)}</span>'
      f'<span class="hmeta"><span>{sources}</span>'
      f"<span>{len(model.repos_configured)} repos</span>"
      f"<span>built {_ago(model.generated_at, model.generated_at)}"
      " · reload to recompute</span></span>"
      "</header>"
  )
264 
265 
266# ── the gate hero (per loop) ─────────────────────────────────────────────────
267def _bearing(label: str, value: str, kind: str, *, armed: bool = False) -> str:
  cls = "bearing armed" if armed else "bearing"
  return (
      f'<div class="{cls}"><span class="bl">{escape(label)}</span>'
      f'<span class="bv {kind}">{escape(value)}</span></div>'
  )
273 
274 
275def _gate_hero(view: LoopView) -> str:
  t, rel, pr = view.track_record, view.reliability, view.probes
  earned = sum(1 for g in view.class_gates if g.earned)
  total = len(view.class_gates)
  acting = any(r.would_auto_merge for r in view.gate)
  # The four bearings: rate + defect come from the record; the adversarial
  # probe (canary) is the loop's escaped-count; the deep review runs per-PR at
  # the merge, so it is shown armed (always-on), not a record figure.
  rate_ok = "ok" if (t.merge_rate or 0) >= 0.95 else "warn"
  defect_ok = "ok" if not rel.defect_rate else "bad"
  probe_ok = "ok" if pr.escaped == 0 else "bad"
  bearings = "".join(
      (
          _bearing(
              "approval rate",
              _pct(t.merge_rate),
              rate_ok if t.merge_rate is not None else "mut",
          ),
          _bearing(
              "defect rate",
              _pct(rel.defect_rate),
              defect_ok if rel.defect_rate is not None else "mut",
          ),
          _bearing(
              "probe",
              f"{pr.escaped} escaped" if pr.total else "none",
              probe_ok if pr.total else "mut",
          ),
          _bearing("deep review", "armed", "mut", armed=True),
      )
  )
  if total == 0:
      node = (
          '<div class="gatenode"><div class="gl">gate</div>'
          '<div class="gv">—</div><div class="gs">no class yet</div></div>'
      )
  else:
      node = (
          f'<div class="gatenode"><div class="gl">earned</div>'
          f'<div class="gv">{earned}/{total}</div>'
          '<div class="gs">classes</div></div>'
      )
  if acting:
      out = (
          '<div class="outcome act"><div class="ot">AUTO-MERGE</div>'
          '<div class="os">a class is acting now</div></div>'
      )
  elif earned:
      out = (
          '<div class="outcome act"><div class="ot">EARNED</div>'
          '<div class="os">acts where allowlisted</div></div>'
      )
  else:
      out = (
          '<div class="outcome hold"><div class="ot">HOLD</div>'
          '<div class="os">building the record</div></div>'
      )
  flow = (
      '<div class="gateflow">'
      f'<div class="bearings">{bearings}</div>'
      '<div class="flowarrow">&rarr;</div>'
      f"{node}"
      '<div class="flowarrow">&rarr;</div>'
      f"{out}</div>"
  )
  caption = (
      '<p class="caption">A class earns the gate by triangulation: a high '
      "<b>approval rate</b> and a low <b>defect rate</b>, over enough "
      "evidence. Two further legs guard the live merge — an adversarial "
      "<b>probe</b> and an independent <b>deep review</b> at merge. "
      "Auto-merge is allowlist-gated (off by default).</p>"
  )
  return (
      '<div><div class="heroh">Earned autonomy &middot; the gate</div>'
      f"{flow}{caption}</div>"
  )
351 
352 
⋯ 411 lines hidden (lines 353–763)353def _class_table(view: LoopView) -> str:
  if not view.class_gates:
      return (
          '<div><div class="heroh">Classes</div>'
          '<div class="empty">No classes yet &mdash; a (repo, loop) '
          "earns the gate from its own track record.</div></div>"
      )
  rows = "".join(_class_row(g) for g in view.class_gates)
  return (
      '<div><div class="heroh">Per-class standing</div>'
      '<table class="classes"><thead><tr><th>repo</th><th>rate</th>'
      "<th>defect</th><th>gate</th><th>budget/wk</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div>"
  )
367 
368 
369def _class_row(g: ClassGate) -> str:
  if g.earned:
      gate = '<span class="pill ok">earned</span>'
  else:
      gate = (
          f'<span class="pill hold">hold</span> '
          f'<span class="mut">{escape(g.blocker or "")}</span>'
      )
  defect = "—" if g.defect_rate is None else _pct(g.defect_rate)
  budget = (
      f"{g.reclaim_per_week:.1f}/{g.approvals_per_week:.1f}"
      if g.approvals_per_week
      else "—"
  )
  return (
      f'<tr><td class="mono">{escape(g.repo)}</td>'
      f'<td class="r">{_pct(g.merge_rate)}</td>'
      f'<td class="r">{escape(defect)}</td>'
      f"<td>{gate}</td>"
      f'<td class="r mut">{escape(budget)}</td></tr>'
  )
390 
391 
392# ── metric cards (per loop) ──────────────────────────────────────────────────
393def _card(n: object, label: str, extra: str = "", kind: str = "") -> str:
  x = f'<div class="x">{extra}</div>' if extra else ""
  return (
      f'<div class="card"><div class="n {kind}">{escape(str(n))}</div>'
      f'<div class="l">{escape(label)}</div>{x}</div>'
  )
399 
400 
401def _loop_cards(view: LoopView) -> str:
  t, v, rel, j, pr = (
      view.track_record,
      view.verification,
      view.reliability,
      view.judgment,
      view.probes,
  )
  defects = rel.broke + rel.reverted
  cards = [
      _card(
          t.opened,
          "proposed",
          f"{t.merged} merged · {t.closed_unmerged} closed",
      ),
      _card(_pct(t.merge_rate), "approval rate", "the first bearing"),
      _card(
          t.open_now,
          "awaiting you",
          "open, needs a human",
          "warn" if t.open_now else "",
      ),
      _card(
          _pct(rel.defect_rate) if rel.determined else "—",
          "defect rate",
          f"{rel.held} held · {defects} broke",
          "bad" if defects else "",
      ),
      _card(
          f"{v.passed}/{v.oracle_existed}" if v.oracle_existed else "—",
          "CI passed",
          "the oracle",
      ),
      _card(
          pr.escaped if pr.total else "0",
          "probes escaped",
          f"{pr.caught} caught" if pr.total else "no probes yet",
          "bad" if pr.escaped else "",
      ),
      _card(
          j.clean,
          "clean verdicts",
          f"{j.clean_but_failed} mis-judged"
          if j.clean_but_failed
          else "judge calibrated",
      ),
      _card(rel.held, "merges held", "post-merge, stayed green"),
  ]
  return f'<div class="cards">{"".join(cards)}</div>'
450 
451 
452# ── detail tables ────────────────────────────────────────────────────────────
453def _cadence(view: LoopView, now: datetime) -> str:
  live = sum(1 for s in view.scan_loops if s.live)
  total = len(view.scan_loops)
  nxt = ""
  last = max(
      (s.last_tick for s in view.scan_loops if s.last_tick is not None),
      default=None,
  )
  if last is not None:
      due = last + timedelta(seconds=view.scan_interval_seconds)
      nxt = f" &middot; next {escape(_until(due, now))}"
  every = round(view.scan_interval_seconds / 3600, 1)
  return (
      f'<p class="cad">Scan loop &middot; <b>{live}/{total}</b> live '
      f"&middot; every <b>{every}h</b>{nxt}</p>"
  )
469 
470 
471def _bumps_fold(view: LoopView) -> str:
  if not view.bumps:
      return ""
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(r.package)}</td>'
      f'<td class="mono mut">{escape(r.to_version)}</td>'
      f"<td>{_tag(r.state, _STATE_CLASS)}</td>"
      f"<td>{_tag(r.verdict, _VERDICT_CLASS)}</td>"
      f"<td>{_tag(r.ci, _CI_CLASS)}</td>"
      f"<td>{_tag(r.post_merge, _POST_MERGE_CLASS)}</td>"
      f"<td>{_pr_link(r)}</td>"
      "</tr>"
      for r in view.bumps
  )
  return (
      '<details class="fold"><summary>Bumps '
      f'<span class="c">{len(view.bumps)}</span></summary><div class="body">'
      '<table class="data"><thead><tr><th>package</th><th>&rarr;</th>'
      "<th>state</th><th>verdict</th><th>ci</th><th>post-merge</th>"
      "<th>pr</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div></details>"
  )
494 
495 
496def _failures_fold(view: LoopView) -> str:
  if not view.failures:
      return ""
  rows = "".join(
      "<tr>"
      f'<td class="mono">{_short_id(f.workflow_id)}</td>'
      f"<td>{_tag(f.kind, _FAIL_CLASS)}</td>"
      f'<td class="mut">{escape(f.reason or "—")}</td>'
      "</tr>"
      for f in view.failures
  )
  return (
      '<details class="fold"><summary class="bad">Failures '
      f'<span class="c">{len(view.failures)}</span></summary>'
      '<div class="body"><table class="data"><thead><tr><th>bump</th>'
      "<th>kind</th><th>reason</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div></details>"
  )
514 
515 
516# ── panels ───────────────────────────────────────────────────────────────────
517def _loop_panel(view: LoopView, pid: str, now: datetime) -> str:
  queue = _queue_sec(view)
  return (
      f'<section class="panel" id="{pid}">'
      f'<div class="hero">{_gate_hero(view)}{_class_table(view)}</div>'
      f"{_loop_cards(view)}"
      f"{queue}"
      f"{_cadence(view, now)}"
      f"{_bumps_fold(view)}{_failures_fold(view)}"
      "</section>"
  )
528 
529 
530def _queue_sec(view: LoopView) -> str:
  if not view.gate:
      return (
          '<div class="sec"><div class="sech">Approval queue '
          '<span class="n">empty</span></div>'
          '<div class="empty">Nothing awaiting you.</div></div>'
      )
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(r.package)}</td>'
      f'<td class="mono mut">{escape(r.to_version)}</td>'
      f"<td>{_queue_badge(r)}</td>"
      f"<td>{_pr_link(r)}</td>"
      "</tr>"
      for r in view.gate
  )
  return (
      '<div class="sec"><div class="sech">Approval queue '
      f'<span class="n">{len(view.gate)} yours</span></div>'
      '<table class="data"><thead><tr><th>package</th><th>&rarr;</th>'
      "<th>gate</th><th>pr</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div>"
  )
553 
554 
555def _queue_badge(row: BumpRow) -> str:
  if row.would_auto_merge:
      return '<span class="pill ok">would auto-merge</span>'
  reason = row.held_reason or "held"
  return f'<span class="mut">held &middot; {escape(reason)}</span>'
560 
561 
562def _review_panel(model: DashboardModel, pid: str) -> str:
  r = model.review_record
  live = sum(1 for x in model.review_loops if x.live)
  haz = "bad" if r.hazards else ""
  cards = (
      '<div class="cards">'
      f"{_card(r.repos_covered, 'repos covered')}"
      f"{_card(f'{live}/{len(model.review_loops)}', 'loops live')}"
      f"{_card(r.reviewed, 'reviewed', f'{r.flagged} flagged')}"
      f"{_card(r.hazards, 'hazards', 'transitive', haz)}"
      "</div>"
  )
  body = (
      '<div class="empty">No PRs reviewed yet.</div>'
      if not model.reviews
      else _reviews_table(model.reviews)
  )
  note = (
      '<p class="caption">The transitive ring — advisory. It '
      "re-derives each open PR's reachable determinism hazards and "
      "comments; it never blocks a merge.</p>"
  )
  every = round(model.review_interval_seconds / 60, 1)
  cad = (
      f'<p class="cad">Review loop &middot; <b>{live}</b> live &middot; '
      f"every <b>{every}m</b></p>"
  )
  return (
      f'<section class="panel" id="{pid}">'
      '<div class="heroh">Determinism review &middot; the transitive ring'
      f"</div>{note}{cards}{cad}"
      f'<div class="sec"><div class="sech">Reviews '
      f'<span class="n">{len(model.reviews)}</span></div>{body}</div>'
      "</section>"
  )
597 
598 
599def _reviews_table(reviews: tuple[ReviewRow, ...]) -> str:
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(row.repo)}</td>'
      f"<td>{_review_pr_link(row)}</td>"
      f"<td>{_findings_cell(row)}</td>"
      f'<td class="mono mut">{escape(", ".join(row.rules) or "—")}</td>'
      "</tr>"
      for row in reviews
  )
  return (
      '<table class="data"><thead><tr><th>repo</th><th>pr</th>'
      "<th>findings</th><th>rules</th></tr></thead>"
      f"<tbody>{rows}</tbody></table>"
  )
614 
615 
616def _review_pr_link(row: ReviewRow) -> str:
  if row.pr_url is None or row.pr_number is None:
      return '<span class="mut">—</span>'
  return f'<a href="{escape(row.pr_url, quote=True)}">#{row.pr_number}</a>'
620 
621 
622def _findings_cell(row: ReviewRow) -> str:
  if row.findings == 0:
      return '<span class="ok">clean</span>'
  label = "hazard" if row.findings == 1 else "hazards"
  link = ""
  if row.comment_url:
      link = f' <a href="{escape(row.comment_url, quote=True)}">comment</a>'
  return f'<span class="bad">{row.findings} {label}</span>{link}'
630 
631 
632def _telemetry_panel(model: DashboardModel, pid: str, now: datetime) -> str:
  tel: RunTelemetry = model.telemetry
  if not tel.available:
      body = (
          '<div class="empty">Unavailable &mdash; ClickHouse off or no '
          "froot traces in the window.</div>"
      )
  else:
      rows = "".join(
          "<tr>"
          f'<td class="mono">{escape(a.name)}</td>'
          f'<td class="r">{a.count}</td>'
          f'<td class="r">{a.avg_ms:.0f} ms</td>'
          f'<td class="r mut">{a.max_ms:.0f} ms</td>'
          "</tr>"
          for a in tel.activities
      )
      last = f"last {_ago(tel.last_activity, now)}"
      err = "bad" if tel.error_spans else ""
      head = (
          '<div class="cards">'
          f"{_card(tel.total_spans, 'spans', last)}"
          f"{_card(tel.error_spans, 'errors', 'in the window', err)}"
          f"{_card(f'{tel.window_days}d', 'window')}</div>"
      )
      table = (
          '<div class="sec"><div class="sech">Activity latency</div>'
          '<table class="data"><thead><tr><th>activity</th><th>runs</th>'
          "<th>avg</th><th>max</th></tr></thead>"
          f"<tbody>{rows}</tbody></table></div>"
      )
      body = head + table
  note = (
      '<p class="caption">Cross-cutting run telemetry from ClickHouse '
      "(trace-derived, best-effort) — latency per activity across "
      "every loop.</p>"
  )
  return (
      f'<section class="panel" id="{pid}">'
      '<div class="heroh">Run telemetry &middot; ClickHouse</div>'
      f"{note}{body}</section>"
  )
674 
675 
676# ── tabs + page ──────────────────────────────────────────────────────────────
677def _loop_badge(view: LoopView) -> str:
  earned = sum(1 for g in view.class_gates if g.earned)
  if view.class_gates and earned:
      return f"{earned}/{len(view.class_gates)} earned"
  if view.track_record.open_now:
      return f"{view.track_record.open_now} open"
  return str(view.track_record.opened)
684 
685 
686def page(model: DashboardModel) -> str:
  """Render the whole dashboard as one self-contained HTML document."""
  now = model.generated_at
  # (tab-id, panel-id, label, badge, panel-html)
  tabs: list[tuple[str, str, str, str, str]] = []
  for i, view in enumerate(model.bump_loops):
      pid, tid = f"panel-{i}", f"tab-{i}"
      tabs.append(
          (
              tid,
              pid,
              view.title,
              _loop_badge(view),
              _loop_panel(view, pid, now),
          )
      )
  tabs.append(
      (
          "tab-det",
          "panel-det",
          "Determinism review",
          str(model.review_record.reviewed),
          _review_panel(model, "panel-det"),
      )
  )
  tabs.append(
      (
          "tab-tel",
          "panel-tel",
          "Telemetry",
          "live" if model.telemetry.available else "off",
          _telemetry_panel(model, "panel-tel", now),
      )
  )
720 
  inputs, labels, panels, rules = [], [], [], []
  for idx, (tid, pid, label, badge, panel) in enumerate(tabs):
      checked = " checked" if idx == 0 else ""
      inputs.append(
          f'<input class="tabin" type="radio" name="tab" id="{tid}"{checked}>'
      )
      labels.append(
          f'<label for="{tid}">{escape(label)}'
          f'<span class="badge">{escape(badge)}</span></label>'
      )
      panels.append(panel)
      rules.append(f"#{tid}:checked~main #{pid}{{display:block}}")
      rules.append(
          f"#{tid}:checked~main nav.tabbar label[for={tid}]"
          "{color:var(--fg);border-bottom-color:var(--accent)}"
      )
  tabcss = "".join(rules)
  return (
      '<!doctype html><html lang="en"><head><meta charset="utf-8">'
      '<meta name="viewport" content="width=device-width,initial-scale=1">'
      "<title>froot &middot; read-model</title>"
      f"<style>{_CSS}{tabcss}</style></head><body>"
      + "".join(inputs)
      + "<main>"
      + _header(model)
      + f'<nav class="tabbar">{"".join(labels)}</nav>'
      + "".join(panels)
      + _footer()
      + "</main></body></html>"
  )
751 
752 
753def _footer() -> str:
  return (
      "<footer><b>Authority envelope.</b> froot opens PRs everywhere and "
      "auto-merges only on an allowlisted repo where a class has earned its "
      "gate (the allowlist is empty by default, so commit authority is none "
      "until a steward opts in). Trust is earned, narrow to one loop on one "
      "repo, conditional on its environment "
      '(<span class="mono">gemma4:12b</span>), revocable, and time-expiring. '
      "Everything here is derived per request from GitHub + Temporal + "
      "ClickHouse; froot keeps no database.</footer>"
  )

The per-class table beside it is the authoritative detail: each repo's rate, defect rate, earned/blocker, and the steward budget. The hero bearings are the loop-level indicators; this table is the truth per class.

src/froot/dashboard/render.py · 763 lines

src/froot/dashboard/render.py763 lines · Python

⋯ 352 lines hidden (lines 1–352)1"""Render the view model to one self-contained HTML page (pure).
2 
3All CSS is inline, there is no JavaScript (tabs are CSS-only, via hidden radio
4inputs), and the page makes no network request of its own — it is a static,
5full-screen projection of an already-computed
class:`~froot.dashboard.model.DashboardModel`. Every dynamic value is
7HTML-escaped at the boundary.
8 
9The shape is gate-first: each loop is a tab whose hero is the *gate* — a small
10flow of the four trust bearings into the earned/hold decision — over a compact
11metric grid and foldable detail. Each loop is a distinct trust class (§3.9), so
12each tab is the whole dashboard scoped to one loop; determinism-review and the
13cross-cutting run-telemetry get their own tabs.
14"""
15 
16from __future__ import annotations
17 
18from datetime import UTC, datetime, timedelta
19from html import escape
20from typing import TYPE_CHECKING
21 
22if TYPE_CHECKING:
  from froot.dashboard.model import (
      BumpRow,
      ClassGate,
      DashboardModel,
      LoopView,
      ReviewRow,
      RunTelemetry,
  )
31 
32_CSS = """
root{--fg:#13151a;--mut:#6b7280;--faint:#9aa1ac;--line:#e7e9ee;--bg:#fbfbfc;
34--panel:#fff;--ok:#1a7f37;--warn:#9a6700;--bad:#cf222e;--accent:#0969da;
35--accentbg:#ddf0ff;--chip:#f2f4f7;--node:#eef6ff}
36@media(prefers-color-scheme:dark){:root{--fg:#e8eaed;--mut:#9aa1ac;
37--faint:#6b7280;--line:#23262d;--bg:#0a0b0d;--panel:#121419;--ok:#3fb950;
38--warn:#d29922;--bad:#f85149;--accent:#58a6ff;--accentbg:#10263f;
39--chip:#1a1d24;--node:#10263f}}
40*{box-sizing:border-box}
41body{margin:0;background:var(--bg);color:var(--fg);
42font:14px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
43-webkit-font-smoothing:antialiased}
44main{padding:0 clamp(16px,3vw,44px) 64px}
45a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
mono{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.92em}
mut{color:var(--mut)}.ok{color:var(--ok)}.warn{color:var(--warn)}
bad{color:var(--bad)}
49/* header */
50header{display:flex;align-items:baseline;flex-wrap:wrap;gap:8px 20px;
51padding:22px 0 16px;border-bottom:1px solid var(--line)}
52h1{font-size:19px;margin:0;letter-spacing:-.02em;font-weight:700}
53h1 .v{color:var(--faint);font-weight:400;font-size:13px;margin-left:8px}
hstatus{display:flex;align-items:center;gap:7px;font-size:13px}
hmeta{margin-left:auto;display:flex;flex-wrap:wrap;gap:6px 16px;
56color:var(--mut);font-size:12px}
dot{display:inline-block;width:8px;height:8px;border-radius:50%}
dot.ok{background:var(--ok)}.dot.warn{background:var(--warn)}
dot.bad{background:var(--bad)}.dot.mute{background:var(--faint)}
60/* tabs (CSS-only) */
tabin{position:absolute;opacity:0;pointer-events:none}
62nav.tabbar{display:flex;flex-wrap:wrap;gap:4px;margin:14px 0 0;
63border-bottom:1px solid var(--line)}
64nav.tabbar label{display:inline-flex;align-items:center;gap:8px;cursor:pointer;
65padding:9px 15px;font-size:13px;font-weight:600;color:var(--mut);
66border-bottom:2px solid transparent;margin-bottom:-1px;white-space:nowrap}
67nav.tabbar label:hover{color:var(--fg)}
68nav.tabbar label .badge{font-weight:600;font-size:11px;color:var(--faint);
69background:var(--chip);border-radius:9px;padding:1px 7px}
panel{display:none;padding:22px 0 0;animation:fade .15s ease}
71@keyframes fade{from{opacity:.4}to{opacity:1}}
72/* gate hero */
hero{display:grid;grid-template-columns:minmax(320px,1.1fr) minmax(280px,1fr);
74gap:18px 26px;align-items:start;margin:0 0 6px}
75@media(max-width:760px){.hero{grid-template-columns:1fr}}
heroh{font-size:11px;text-transform:uppercase;letter-spacing:.09em;
77color:var(--mut);font-weight:700;margin:0 0 12px}
gateflow{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
bearings{display:flex;flex-direction:column;gap:6px;min-width:150px}
bearing{display:flex;align-items:center;justify-content:space-between;gap:10px;
81background:var(--chip);border-radius:7px;padding:6px 10px;font-size:12px}
bearing .bl{color:var(--mut)}
bearing .bv{font-weight:600;font-variant-numeric:tabular-nums}
bearing.armed .bv{color:var(--faint);font-weight:500}
flowarrow{color:var(--faint);font-size:18px;line-height:1}
gatenode{flex:0 0 auto;text-align:center;border:2px solid var(--accent);
87background:var(--node);border-radius:12px;padding:12px 16px;min-width:96px}
gatenode .gl{font-size:10px;text-transform:uppercase;letter-spacing:.08em;
89color:var(--accent);font-weight:700}
gatenode .gv{font-size:22px;font-weight:700;line-height:1.15;
91font-variant-numeric:tabular-nums}
gatenode .gs{font-size:11px;color:var(--mut)}
outcome{flex:0 0 auto;border-radius:10px;padding:11px 15px;text-align:center;
94border:1px solid var(--line)}
outcome .ot{font-size:15px;font-weight:700;letter-spacing:.01em}
outcome .os{font-size:11px;color:var(--mut);margin-top:1px}
outcome.act{background:color-mix(in srgb,var(--ok) 12%,transparent);
98border-color:color-mix(in srgb,var(--ok) 40%,transparent)}
outcome.act .ot{color:var(--ok)}
outcome.hold .ot{color:var(--mut)}
caption{color:var(--mut);font-size:12px;margin:8px 0 0;line-height:1.45}
102/* class table inside the hero */
classes{width:100%;border-collapse:collapse;font-size:12.5px}
classes th,.classes td{text-align:left;padding:6px 10px 6px 0;
105border-bottom:1px solid var(--line);vertical-align:baseline}
classes th{color:var(--mut);font-weight:600;font-size:10.5px;
107text-transform:uppercase;letter-spacing:.05em}
classes td.r{font-variant-numeric:tabular-nums}
pill{display:inline-block;font-size:11px;font-weight:600;border-radius:20px;
110padding:1px 9px}
pill.ok{color:var(--ok);
112background:color-mix(in srgb,var(--ok) 14%,transparent)}
pill.hold{color:var(--mut);background:var(--chip)}
114/* metric cards */
cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));
116gap:10px;margin:22px 0 0}
card{background:var(--panel);border:1px solid var(--line);border-radius:10px;
118padding:13px 15px}
card .n{font-size:24px;font-weight:700;line-height:1.05;
120font-variant-numeric:tabular-nums}
card .l{color:var(--mut);font-size:11.5px;margin-top:3px}
card .x{color:var(--faint);font-size:11px;margin-top:5px}
123/* section + detail */
sec{margin:26px 0 0}
sech{font-size:11px;text-transform:uppercase;letter-spacing:.08em;
126color:var(--mut);font-weight:700;margin:0 0 10px;display:flex;
127align-items:baseline;gap:10px}
sech .n{color:var(--faint);font-weight:600;letter-spacing:0}
129details.fold{margin:18px 0 0;border:1px solid var(--line);border-radius:10px;
130background:var(--panel)}
131details.fold>summary{cursor:pointer;list-style:none;padding:11px 15px;
132font-size:12px;font-weight:600;color:var(--fg);display:flex;
133align-items:center;gap:9px}
134details.fold>summary::-webkit-details-marker{display:none}
135details.fold>summary::before{content:"\\25B8";color:var(--faint);font-size:10px}
136details.fold[open]>summary::before{content:"\\25BE"}
137details.fold>summary .c{color:var(--faint);font-weight:600}
138details.fold .body{padding:0 15px 14px}
139table.data{width:100%;border-collapse:collapse;font-size:12.5px}
140table.data th,table.data td{text-align:left;padding:6px 12px 6px 0;
141border-bottom:1px solid var(--line);vertical-align:top}
142table.data th{color:var(--mut);font-weight:600;font-size:10.5px;
143text-transform:uppercase;letter-spacing:.04em}
144table.data td.r{font-variant-numeric:tabular-nums;white-space:nowrap}
empty{color:var(--mut);font-size:13px;padding:14px 0;border:1px dashed
146var(--line);border-radius:9px;text-align:center;background:var(--panel)}
tags{display:flex;flex-wrap:wrap;gap:6px}
t{font-size:11px;border-radius:6px;padding:1px 7px;background:var(--chip);
149color:var(--mut)}
t.ok{color:var(--ok)}.t.warn{color:var(--warn)}.t.bad{color:var(--bad)}
cad{color:var(--mut);font-size:12px;margin:14px 0 0}
cad b{color:var(--fg);font-weight:600}
153footer{margin:40px 0 0;padding-top:16px;border-top:1px solid var(--line);
154color:var(--mut);font-size:12px;line-height:1.65}
155footer b{color:var(--fg);font-weight:600}
156"""
157 
158_CI_CLASS = {
  "passed": "ok",
  "failed": "bad",
  "absent": "mut",
  "timed_out": "warn",
163}
164_VERDICT_CLASS = {"clean": "ok", "risky": "warn", "unknown": "mut"}
165_POST_MERGE_CLASS = {
  "held": "ok",
  "broke": "bad",
  "reverted": "bad",
  "unknown": "mut",
170}
171_STATE_CLASS = {"merged": "ok", "closed": "mut", "open": "warn"}
172_FAIL_CLASS = {"failed": "bad", "terminated": "warn"}
173 
174 
175# ── small formatters ─────────────────────────────────────────────────────────
176def _aware(when: datetime) -> datetime:
  return when if when.tzinfo else when.replace(tzinfo=UTC)
178 
179 
180def _ago(when: datetime | None, now: datetime) -> str:
  if when is None:
      return "—"
  secs = (now - _aware(when)).total_seconds()
  if secs < 90:
      return "just now"
  mins = secs / 60
  if mins < 90:
      return f"{round(mins)}m ago"
  hours = mins / 60
  if hours < 36:
      return f"{round(hours)}h ago"
  return f"{round(hours / 24)}d ago"
193 
194 
195def _until(when: datetime | None, now: datetime) -> str:
  if when is None:
      return "—"
  secs = (_aware(when) - now).total_seconds()
  if secs <= 0:
      return "due"
  mins = secs / 60
  if mins < 90:
      return f"~{round(mins)}m"
  hours = mins / 60
  if hours < 36:
      return f"~{round(hours)}h"
  return f"~{round(hours / 24)}d"
208 
209 
210def _pct(rate: float | None) -> str:
  return "—" if rate is None else f"{rate * 100:.0f}%"
212 
213 
214def _dot(kind: str) -> str:
  return f'<span class="dot {kind}"></span>'
216 
217 
218def _tag(value: str | None, classes: dict[str, str]) -> str:
  if value is None:
      return '<span class="t">—</span>'
  cls = classes.get(value, "")
  return f'<span class="t {cls}">{escape(value)}</span>'
223 
224 
225def _pr_link(row: BumpRow) -> str:
  if row.pr_url is None or row.pr_number is None:
      return '<span class="mut">—</span>'
  return f'<a href="{escape(row.pr_url, quote=True)}">#{row.pr_number}</a>'
229 
230 
231def _short_id(workflow_id: str) -> str:
  return escape(workflow_id.removeprefix("froot-bump-"))
233 
234 
235# ── header ───────────────────────────────────────────────────────────────────
236def _alive(model: DashboardModel) -> tuple[str, str]:
  """Global liveness dot + label across every loop."""
  live = sum(1 for x in model.scan_loops if x.live) + sum(
      1 for x in model.review_loops if x.live
  )
  total = len(model.scan_loops) + len(model.review_loops)
  if total == 0:
      return "mute", "no loops configured"
  kind = "ok" if live == total else ("warn" if live else "bad")
  return kind, f"{live}/{total} loops live"
246 
247 
248def _header(model: DashboardModel) -> str:
  kind, label = _alive(model)
  sources = " ".join(
      f"{_dot('ok' if s.ok else 'bad')}{escape(s.name)}"
      for s in model.sources
  )
  return (
      "<header>"
      '<h1>froot<span class="v mono">gemma4:12b</span></h1>'
      f'<span class="hstatus">{_dot(kind)}{escape(label)}</span>'
      f'<span class="hmeta"><span>{sources}</span>'
      f"<span>{len(model.repos_configured)} repos</span>"
      f"<span>built {_ago(model.generated_at, model.generated_at)}"
      " · reload to recompute</span></span>"
      "</header>"
  )
264 
265 
266# ── the gate hero (per loop) ─────────────────────────────────────────────────
267def _bearing(label: str, value: str, kind: str, *, armed: bool = False) -> str:
  cls = "bearing armed" if armed else "bearing"
  return (
      f'<div class="{cls}"><span class="bl">{escape(label)}</span>'
      f'<span class="bv {kind}">{escape(value)}</span></div>'
  )
273 
274 
275def _gate_hero(view: LoopView) -> str:
  t, rel, pr = view.track_record, view.reliability, view.probes
  earned = sum(1 for g in view.class_gates if g.earned)
  total = len(view.class_gates)
  acting = any(r.would_auto_merge for r in view.gate)
  # The four bearings: rate + defect come from the record; the adversarial
  # probe (canary) is the loop's escaped-count; the deep review runs per-PR at
  # the merge, so it is shown armed (always-on), not a record figure.
  rate_ok = "ok" if (t.merge_rate or 0) >= 0.95 else "warn"
  defect_ok = "ok" if not rel.defect_rate else "bad"
  probe_ok = "ok" if pr.escaped == 0 else "bad"
  bearings = "".join(
      (
          _bearing(
              "approval rate",
              _pct(t.merge_rate),
              rate_ok if t.merge_rate is not None else "mut",
          ),
          _bearing(
              "defect rate",
              _pct(rel.defect_rate),
              defect_ok if rel.defect_rate is not None else "mut",
          ),
          _bearing(
              "probe",
              f"{pr.escaped} escaped" if pr.total else "none",
              probe_ok if pr.total else "mut",
          ),
          _bearing("deep review", "armed", "mut", armed=True),
      )
  )
  if total == 0:
      node = (
          '<div class="gatenode"><div class="gl">gate</div>'
          '<div class="gv">—</div><div class="gs">no class yet</div></div>'
      )
  else:
      node = (
          f'<div class="gatenode"><div class="gl">earned</div>'
          f'<div class="gv">{earned}/{total}</div>'
          '<div class="gs">classes</div></div>'
      )
  if acting:
      out = (
          '<div class="outcome act"><div class="ot">AUTO-MERGE</div>'
          '<div class="os">a class is acting now</div></div>'
      )
  elif earned:
      out = (
          '<div class="outcome act"><div class="ot">EARNED</div>'
          '<div class="os">acts where allowlisted</div></div>'
      )
  else:
      out = (
          '<div class="outcome hold"><div class="ot">HOLD</div>'
          '<div class="os">building the record</div></div>'
      )
  flow = (
      '<div class="gateflow">'
      f'<div class="bearings">{bearings}</div>'
      '<div class="flowarrow">&rarr;</div>'
      f"{node}"
      '<div class="flowarrow">&rarr;</div>'
      f"{out}</div>"
  )
  caption = (
      '<p class="caption">A class earns the gate by triangulation: a high '
      "<b>approval rate</b> and a low <b>defect rate</b>, over enough "
      "evidence. Two further legs guard the live merge — an adversarial "
      "<b>probe</b> and an independent <b>deep review</b> at merge. "
      "Auto-merge is allowlist-gated (off by default).</p>"
  )
  return (
      '<div><div class="heroh">Earned autonomy &middot; the gate</div>'
      f"{flow}{caption}</div>"
  )
351 
352 
353def _class_table(view: LoopView) -> str:
  if not view.class_gates:
      return (
          '<div><div class="heroh">Classes</div>'
          '<div class="empty">No classes yet &mdash; a (repo, loop) '
          "earns the gate from its own track record.</div></div>"
      )
  rows = "".join(_class_row(g) for g in view.class_gates)
  return (
      '<div><div class="heroh">Per-class standing</div>'
      '<table class="classes"><thead><tr><th>repo</th><th>rate</th>'
      "<th>defect</th><th>gate</th><th>budget/wk</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div>"
  )
367 
368 
369def _class_row(g: ClassGate) -> str:
  if g.earned:
      gate = '<span class="pill ok">earned</span>'
  else:
      gate = (
          f'<span class="pill hold">hold</span> '
          f'<span class="mut">{escape(g.blocker or "")}</span>'
      )
  defect = "—" if g.defect_rate is None else _pct(g.defect_rate)
  budget = (
      f"{g.reclaim_per_week:.1f}/{g.approvals_per_week:.1f}"
      if g.approvals_per_week
      else "—"
  )
  return (
      f'<tr><td class="mono">{escape(g.repo)}</td>'
      f'<td class="r">{_pct(g.merge_rate)}</td>'
      f'<td class="r">{escape(defect)}</td>'
      f"<td>{gate}</td>"
      f'<td class="r mut">{escape(budget)}</td></tr>'
  )
390 
391 
392# ── metric cards (per loop) ──────────────────────────────────────────────────
393def _card(n: object, label: str, extra: str = "", kind: str = "") -> str:
  x = f'<div class="x">{extra}</div>' if extra else ""
  return (
      f'<div class="card"><div class="n {kind}">{escape(str(n))}</div>'
      f'<div class="l">{escape(label)}</div>{x}</div>'
  )
399 
⋯ 364 lines hidden (lines 400–763)400 
401def _loop_cards(view: LoopView) -> str:
  t, v, rel, j, pr = (
      view.track_record,
      view.verification,
      view.reliability,
      view.judgment,
      view.probes,
  )
  defects = rel.broke + rel.reverted
  cards = [
      _card(
          t.opened,
          "proposed",
          f"{t.merged} merged · {t.closed_unmerged} closed",
      ),
      _card(_pct(t.merge_rate), "approval rate", "the first bearing"),
      _card(
          t.open_now,
          "awaiting you",
          "open, needs a human",
          "warn" if t.open_now else "",
      ),
      _card(
          _pct(rel.defect_rate) if rel.determined else "—",
          "defect rate",
          f"{rel.held} held · {defects} broke",
          "bad" if defects else "",
      ),
      _card(
          f"{v.passed}/{v.oracle_existed}" if v.oracle_existed else "—",
          "CI passed",
          "the oracle",
      ),
      _card(
          pr.escaped if pr.total else "0",
          "probes escaped",
          f"{pr.caught} caught" if pr.total else "no probes yet",
          "bad" if pr.escaped else "",
      ),
      _card(
          j.clean,
          "clean verdicts",
          f"{j.clean_but_failed} mis-judged"
          if j.clean_but_failed
          else "judge calibrated",
      ),
      _card(rel.held, "merges held", "post-merge, stayed green"),
  ]
  return f'<div class="cards">{"".join(cards)}</div>'
450 
451 
452# ── detail tables ────────────────────────────────────────────────────────────
453def _cadence(view: LoopView, now: datetime) -> str:
  live = sum(1 for s in view.scan_loops if s.live)
  total = len(view.scan_loops)
  nxt = ""
  last = max(
      (s.last_tick for s in view.scan_loops if s.last_tick is not None),
      default=None,
  )
  if last is not None:
      due = last + timedelta(seconds=view.scan_interval_seconds)
      nxt = f" &middot; next {escape(_until(due, now))}"
  every = round(view.scan_interval_seconds / 3600, 1)
  return (
      f'<p class="cad">Scan loop &middot; <b>{live}/{total}</b> live '
      f"&middot; every <b>{every}h</b>{nxt}</p>"
  )
469 
470 
471def _bumps_fold(view: LoopView) -> str:
  if not view.bumps:
      return ""
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(r.package)}</td>'
      f'<td class="mono mut">{escape(r.to_version)}</td>'
      f"<td>{_tag(r.state, _STATE_CLASS)}</td>"
      f"<td>{_tag(r.verdict, _VERDICT_CLASS)}</td>"
      f"<td>{_tag(r.ci, _CI_CLASS)}</td>"
      f"<td>{_tag(r.post_merge, _POST_MERGE_CLASS)}</td>"
      f"<td>{_pr_link(r)}</td>"
      "</tr>"
      for r in view.bumps
  )
  return (
      '<details class="fold"><summary>Bumps '
      f'<span class="c">{len(view.bumps)}</span></summary><div class="body">'
      '<table class="data"><thead><tr><th>package</th><th>&rarr;</th>'
      "<th>state</th><th>verdict</th><th>ci</th><th>post-merge</th>"
      "<th>pr</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div></details>"
  )
494 
495 
496def _failures_fold(view: LoopView) -> str:
  if not view.failures:
      return ""
  rows = "".join(
      "<tr>"
      f'<td class="mono">{_short_id(f.workflow_id)}</td>'
      f"<td>{_tag(f.kind, _FAIL_CLASS)}</td>"
      f'<td class="mut">{escape(f.reason or "—")}</td>'
      "</tr>"
      for f in view.failures
  )
  return (
      '<details class="fold"><summary class="bad">Failures '
      f'<span class="c">{len(view.failures)}</span></summary>'
      '<div class="body"><table class="data"><thead><tr><th>bump</th>'
      "<th>kind</th><th>reason</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div></details>"
  )
514 
515 
516# ── panels ───────────────────────────────────────────────────────────────────
517def _loop_panel(view: LoopView, pid: str, now: datetime) -> str:
  queue = _queue_sec(view)
  return (
      f'<section class="panel" id="{pid}">'
      f'<div class="hero">{_gate_hero(view)}{_class_table(view)}</div>'
      f"{_loop_cards(view)}"
      f"{queue}"
      f"{_cadence(view, now)}"
      f"{_bumps_fold(view)}{_failures_fold(view)}"
      "</section>"
  )
528 
529 
530def _queue_sec(view: LoopView) -> str:
  if not view.gate:
      return (
          '<div class="sec"><div class="sech">Approval queue '
          '<span class="n">empty</span></div>'
          '<div class="empty">Nothing awaiting you.</div></div>'
      )
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(r.package)}</td>'
      f'<td class="mono mut">{escape(r.to_version)}</td>'
      f"<td>{_queue_badge(r)}</td>"
      f"<td>{_pr_link(r)}</td>"
      "</tr>"
      for r in view.gate
  )
  return (
      '<div class="sec"><div class="sech">Approval queue '
      f'<span class="n">{len(view.gate)} yours</span></div>'
      '<table class="data"><thead><tr><th>package</th><th>&rarr;</th>'
      "<th>gate</th><th>pr</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div>"
  )
553 
554 
555def _queue_badge(row: BumpRow) -> str:
  if row.would_auto_merge:
      return '<span class="pill ok">would auto-merge</span>'
  reason = row.held_reason or "held"
  return f'<span class="mut">held &middot; {escape(reason)}</span>'
560 
561 
562def _review_panel(model: DashboardModel, pid: str) -> str:
  r = model.review_record
  live = sum(1 for x in model.review_loops if x.live)
  haz = "bad" if r.hazards else ""
  cards = (
      '<div class="cards">'
      f"{_card(r.repos_covered, 'repos covered')}"
      f"{_card(f'{live}/{len(model.review_loops)}', 'loops live')}"
      f"{_card(r.reviewed, 'reviewed', f'{r.flagged} flagged')}"
      f"{_card(r.hazards, 'hazards', 'transitive', haz)}"
      "</div>"
  )
  body = (
      '<div class="empty">No PRs reviewed yet.</div>'
      if not model.reviews
      else _reviews_table(model.reviews)
  )
  note = (
      '<p class="caption">The transitive ring — advisory. It '
      "re-derives each open PR's reachable determinism hazards and "
      "comments; it never blocks a merge.</p>"
  )
  every = round(model.review_interval_seconds / 60, 1)
  cad = (
      f'<p class="cad">Review loop &middot; <b>{live}</b> live &middot; '
      f"every <b>{every}m</b></p>"
  )
  return (
      f'<section class="panel" id="{pid}">'
      '<div class="heroh">Determinism review &middot; the transitive ring'
      f"</div>{note}{cards}{cad}"
      f'<div class="sec"><div class="sech">Reviews '
      f'<span class="n">{len(model.reviews)}</span></div>{body}</div>'
      "</section>"
  )
597 
598 
599def _reviews_table(reviews: tuple[ReviewRow, ...]) -> str:
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(row.repo)}</td>'
      f"<td>{_review_pr_link(row)}</td>"
      f"<td>{_findings_cell(row)}</td>"
      f'<td class="mono mut">{escape(", ".join(row.rules) or "—")}</td>'
      "</tr>"
      for row in reviews
  )
  return (
      '<table class="data"><thead><tr><th>repo</th><th>pr</th>'
      "<th>findings</th><th>rules</th></tr></thead>"
      f"<tbody>{rows}</tbody></table>"
  )
614 
615 
616def _review_pr_link(row: ReviewRow) -> str:
  if row.pr_url is None or row.pr_number is None:
      return '<span class="mut">—</span>'
  return f'<a href="{escape(row.pr_url, quote=True)}">#{row.pr_number}</a>'
620 
621 
622def _findings_cell(row: ReviewRow) -> str:
  if row.findings == 0:
      return '<span class="ok">clean</span>'
  label = "hazard" if row.findings == 1 else "hazards"
  link = ""
  if row.comment_url:
      link = f' <a href="{escape(row.comment_url, quote=True)}">comment</a>'
  return f'<span class="bad">{row.findings} {label}</span>{link}'
630 
631 
632def _telemetry_panel(model: DashboardModel, pid: str, now: datetime) -> str:
  tel: RunTelemetry = model.telemetry
  if not tel.available:
      body = (
          '<div class="empty">Unavailable &mdash; ClickHouse off or no '
          "froot traces in the window.</div>"
      )
  else:
      rows = "".join(
          "<tr>"
          f'<td class="mono">{escape(a.name)}</td>'
          f'<td class="r">{a.count}</td>'
          f'<td class="r">{a.avg_ms:.0f} ms</td>'
          f'<td class="r mut">{a.max_ms:.0f} ms</td>'
          "</tr>"
          for a in tel.activities
      )
      last = f"last {_ago(tel.last_activity, now)}"
      err = "bad" if tel.error_spans else ""
      head = (
          '<div class="cards">'
          f"{_card(tel.total_spans, 'spans', last)}"
          f"{_card(tel.error_spans, 'errors', 'in the window', err)}"
          f"{_card(f'{tel.window_days}d', 'window')}</div>"
      )
      table = (
          '<div class="sec"><div class="sech">Activity latency</div>'
          '<table class="data"><thead><tr><th>activity</th><th>runs</th>'
          "<th>avg</th><th>max</th></tr></thead>"
          f"<tbody>{rows}</tbody></table></div>"
      )
      body = head + table
  note = (
      '<p class="caption">Cross-cutting run telemetry from ClickHouse '
      "(trace-derived, best-effort) — latency per activity across "
      "every loop.</p>"
  )
  return (
      f'<section class="panel" id="{pid}">'
      '<div class="heroh">Run telemetry &middot; ClickHouse</div>'
      f"{note}{body}</section>"
  )
674 
675 
676# ── tabs + page ──────────────────────────────────────────────────────────────
677def _loop_badge(view: LoopView) -> str:
  earned = sum(1 for g in view.class_gates if g.earned)
  if view.class_gates and earned:
      return f"{earned}/{len(view.class_gates)} earned"
  if view.track_record.open_now:
      return f"{view.track_record.open_now} open"
  return str(view.track_record.opened)
684 
685 
686def page(model: DashboardModel) -> str:
  """Render the whole dashboard as one self-contained HTML document."""
  now = model.generated_at
  # (tab-id, panel-id, label, badge, panel-html)
  tabs: list[tuple[str, str, str, str, str]] = []
  for i, view in enumerate(model.bump_loops):
      pid, tid = f"panel-{i}", f"tab-{i}"
      tabs.append(
          (
              tid,
              pid,
              view.title,
              _loop_badge(view),
              _loop_panel(view, pid, now),
          )
      )
  tabs.append(
      (
          "tab-det",
          "panel-det",
          "Determinism review",
          str(model.review_record.reviewed),
          _review_panel(model, "panel-det"),
      )
  )
  tabs.append(
      (
          "tab-tel",
          "panel-tel",
          "Telemetry",
          "live" if model.telemetry.available else "off",
          _telemetry_panel(model, "panel-tel", now),
      )
  )
720 
  inputs, labels, panels, rules = [], [], [], []
  for idx, (tid, pid, label, badge, panel) in enumerate(tabs):
      checked = " checked" if idx == 0 else ""
      inputs.append(
          f'<input class="tabin" type="radio" name="tab" id="{tid}"{checked}>'
      )
      labels.append(
          f'<label for="{tid}">{escape(label)}'
          f'<span class="badge">{escape(badge)}</span></label>'
      )
      panels.append(panel)
      rules.append(f"#{tid}:checked~main #{pid}{{display:block}}")
      rules.append(
          f"#{tid}:checked~main nav.tabbar label[for={tid}]"
          "{color:var(--fg);border-bottom-color:var(--accent)}"
      )
  tabcss = "".join(rules)
  return (
      '<!doctype html><html lang="en"><head><meta charset="utf-8">'
      '<meta name="viewport" content="width=device-width,initial-scale=1">'
      "<title>froot &middot; read-model</title>"
      f"<style>{_CSS}{tabcss}</style></head><body>"
      + "".join(inputs)
      + "<main>"
      + _header(model)
      + f'<nav class="tabbar">{"".join(labels)}</nav>'
      + "".join(panels)
      + _footer()
      + "</main></body></html>"
  )
751 
752 
753def _footer() -> str:
  return (
      "<footer><b>Authority envelope.</b> froot opens PRs everywhere and "
      "auto-merges only on an allowlisted repo where a class has earned its "
      "gate (the allowlist is empty by default, so commit authority is none "
      "until a steward opts in). Trust is earned, narrow to one loop on one "
      "repo, conditional on its environment "
      '(<span class="mono">gemma4:12b</span>), revocable, and time-expiring. '
      "Everything here is derived per request from GitHub + Temporal + "
      "ClickHouse; froot keeps no database.</footer>"
  )

Tabs + the page shell (no JavaScript)

Tabs are CSS-only: one hidden radio input per tab, and a generated rule #tab:checked ~ main #panel{display:block} shows the active panel. One tab per loop, plus determinism-review and the cross-cutting run-telemetry. The first tab is checked by default.

src/froot/dashboard/render.py · 763 lines

src/froot/dashboard/render.py763 lines · Python

⋯ 685 lines hidden (lines 1–685)1"""Render the view model to one self-contained HTML page (pure).
2 
3All CSS is inline, there is no JavaScript (tabs are CSS-only, via hidden radio
4inputs), and the page makes no network request of its own — it is a static,
5full-screen projection of an already-computed
class:`~froot.dashboard.model.DashboardModel`. Every dynamic value is
7HTML-escaped at the boundary.
8 
9The shape is gate-first: each loop is a tab whose hero is the *gate* — a small
10flow of the four trust bearings into the earned/hold decision — over a compact
11metric grid and foldable detail. Each loop is a distinct trust class (§3.9), so
12each tab is the whole dashboard scoped to one loop; determinism-review and the
13cross-cutting run-telemetry get their own tabs.
14"""
15 
16from __future__ import annotations
17 
18from datetime import UTC, datetime, timedelta
19from html import escape
20from typing import TYPE_CHECKING
21 
22if TYPE_CHECKING:
  from froot.dashboard.model import (
      BumpRow,
      ClassGate,
      DashboardModel,
      LoopView,
      ReviewRow,
      RunTelemetry,
  )
31 
32_CSS = """
root{--fg:#13151a;--mut:#6b7280;--faint:#9aa1ac;--line:#e7e9ee;--bg:#fbfbfc;
34--panel:#fff;--ok:#1a7f37;--warn:#9a6700;--bad:#cf222e;--accent:#0969da;
35--accentbg:#ddf0ff;--chip:#f2f4f7;--node:#eef6ff}
36@media(prefers-color-scheme:dark){:root{--fg:#e8eaed;--mut:#9aa1ac;
37--faint:#6b7280;--line:#23262d;--bg:#0a0b0d;--panel:#121419;--ok:#3fb950;
38--warn:#d29922;--bad:#f85149;--accent:#58a6ff;--accentbg:#10263f;
39--chip:#1a1d24;--node:#10263f}}
40*{box-sizing:border-box}
41body{margin:0;background:var(--bg);color:var(--fg);
42font:14px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
43-webkit-font-smoothing:antialiased}
44main{padding:0 clamp(16px,3vw,44px) 64px}
45a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
mono{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.92em}
mut{color:var(--mut)}.ok{color:var(--ok)}.warn{color:var(--warn)}
bad{color:var(--bad)}
49/* header */
50header{display:flex;align-items:baseline;flex-wrap:wrap;gap:8px 20px;
51padding:22px 0 16px;border-bottom:1px solid var(--line)}
52h1{font-size:19px;margin:0;letter-spacing:-.02em;font-weight:700}
53h1 .v{color:var(--faint);font-weight:400;font-size:13px;margin-left:8px}
hstatus{display:flex;align-items:center;gap:7px;font-size:13px}
hmeta{margin-left:auto;display:flex;flex-wrap:wrap;gap:6px 16px;
56color:var(--mut);font-size:12px}
dot{display:inline-block;width:8px;height:8px;border-radius:50%}
dot.ok{background:var(--ok)}.dot.warn{background:var(--warn)}
dot.bad{background:var(--bad)}.dot.mute{background:var(--faint)}
60/* tabs (CSS-only) */
tabin{position:absolute;opacity:0;pointer-events:none}
62nav.tabbar{display:flex;flex-wrap:wrap;gap:4px;margin:14px 0 0;
63border-bottom:1px solid var(--line)}
64nav.tabbar label{display:inline-flex;align-items:center;gap:8px;cursor:pointer;
65padding:9px 15px;font-size:13px;font-weight:600;color:var(--mut);
66border-bottom:2px solid transparent;margin-bottom:-1px;white-space:nowrap}
67nav.tabbar label:hover{color:var(--fg)}
68nav.tabbar label .badge{font-weight:600;font-size:11px;color:var(--faint);
69background:var(--chip);border-radius:9px;padding:1px 7px}
panel{display:none;padding:22px 0 0;animation:fade .15s ease}
71@keyframes fade{from{opacity:.4}to{opacity:1}}
72/* gate hero */
hero{display:grid;grid-template-columns:minmax(320px,1.1fr) minmax(280px,1fr);
74gap:18px 26px;align-items:start;margin:0 0 6px}
75@media(max-width:760px){.hero{grid-template-columns:1fr}}
heroh{font-size:11px;text-transform:uppercase;letter-spacing:.09em;
77color:var(--mut);font-weight:700;margin:0 0 12px}
gateflow{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
bearings{display:flex;flex-direction:column;gap:6px;min-width:150px}
bearing{display:flex;align-items:center;justify-content:space-between;gap:10px;
81background:var(--chip);border-radius:7px;padding:6px 10px;font-size:12px}
bearing .bl{color:var(--mut)}
bearing .bv{font-weight:600;font-variant-numeric:tabular-nums}
bearing.armed .bv{color:var(--faint);font-weight:500}
flowarrow{color:var(--faint);font-size:18px;line-height:1}
gatenode{flex:0 0 auto;text-align:center;border:2px solid var(--accent);
87background:var(--node);border-radius:12px;padding:12px 16px;min-width:96px}
gatenode .gl{font-size:10px;text-transform:uppercase;letter-spacing:.08em;
89color:var(--accent);font-weight:700}
gatenode .gv{font-size:22px;font-weight:700;line-height:1.15;
91font-variant-numeric:tabular-nums}
gatenode .gs{font-size:11px;color:var(--mut)}
outcome{flex:0 0 auto;border-radius:10px;padding:11px 15px;text-align:center;
94border:1px solid var(--line)}
outcome .ot{font-size:15px;font-weight:700;letter-spacing:.01em}
outcome .os{font-size:11px;color:var(--mut);margin-top:1px}
outcome.act{background:color-mix(in srgb,var(--ok) 12%,transparent);
98border-color:color-mix(in srgb,var(--ok) 40%,transparent)}
outcome.act .ot{color:var(--ok)}
outcome.hold .ot{color:var(--mut)}
caption{color:var(--mut);font-size:12px;margin:8px 0 0;line-height:1.45}
102/* class table inside the hero */
classes{width:100%;border-collapse:collapse;font-size:12.5px}
classes th,.classes td{text-align:left;padding:6px 10px 6px 0;
105border-bottom:1px solid var(--line);vertical-align:baseline}
classes th{color:var(--mut);font-weight:600;font-size:10.5px;
107text-transform:uppercase;letter-spacing:.05em}
classes td.r{font-variant-numeric:tabular-nums}
pill{display:inline-block;font-size:11px;font-weight:600;border-radius:20px;
110padding:1px 9px}
pill.ok{color:var(--ok);
112background:color-mix(in srgb,var(--ok) 14%,transparent)}
pill.hold{color:var(--mut);background:var(--chip)}
114/* metric cards */
cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));
116gap:10px;margin:22px 0 0}
card{background:var(--panel);border:1px solid var(--line);border-radius:10px;
118padding:13px 15px}
card .n{font-size:24px;font-weight:700;line-height:1.05;
120font-variant-numeric:tabular-nums}
card .l{color:var(--mut);font-size:11.5px;margin-top:3px}
card .x{color:var(--faint);font-size:11px;margin-top:5px}
123/* section + detail */
sec{margin:26px 0 0}
sech{font-size:11px;text-transform:uppercase;letter-spacing:.08em;
126color:var(--mut);font-weight:700;margin:0 0 10px;display:flex;
127align-items:baseline;gap:10px}
sech .n{color:var(--faint);font-weight:600;letter-spacing:0}
129details.fold{margin:18px 0 0;border:1px solid var(--line);border-radius:10px;
130background:var(--panel)}
131details.fold>summary{cursor:pointer;list-style:none;padding:11px 15px;
132font-size:12px;font-weight:600;color:var(--fg);display:flex;
133align-items:center;gap:9px}
134details.fold>summary::-webkit-details-marker{display:none}
135details.fold>summary::before{content:"\\25B8";color:var(--faint);font-size:10px}
136details.fold[open]>summary::before{content:"\\25BE"}
137details.fold>summary .c{color:var(--faint);font-weight:600}
138details.fold .body{padding:0 15px 14px}
139table.data{width:100%;border-collapse:collapse;font-size:12.5px}
140table.data th,table.data td{text-align:left;padding:6px 12px 6px 0;
141border-bottom:1px solid var(--line);vertical-align:top}
142table.data th{color:var(--mut);font-weight:600;font-size:10.5px;
143text-transform:uppercase;letter-spacing:.04em}
144table.data td.r{font-variant-numeric:tabular-nums;white-space:nowrap}
empty{color:var(--mut);font-size:13px;padding:14px 0;border:1px dashed
146var(--line);border-radius:9px;text-align:center;background:var(--panel)}
tags{display:flex;flex-wrap:wrap;gap:6px}
t{font-size:11px;border-radius:6px;padding:1px 7px;background:var(--chip);
149color:var(--mut)}
t.ok{color:var(--ok)}.t.warn{color:var(--warn)}.t.bad{color:var(--bad)}
cad{color:var(--mut);font-size:12px;margin:14px 0 0}
cad b{color:var(--fg);font-weight:600}
153footer{margin:40px 0 0;padding-top:16px;border-top:1px solid var(--line);
154color:var(--mut);font-size:12px;line-height:1.65}
155footer b{color:var(--fg);font-weight:600}
156"""
157 
158_CI_CLASS = {
  "passed": "ok",
  "failed": "bad",
  "absent": "mut",
  "timed_out": "warn",
163}
164_VERDICT_CLASS = {"clean": "ok", "risky": "warn", "unknown": "mut"}
165_POST_MERGE_CLASS = {
  "held": "ok",
  "broke": "bad",
  "reverted": "bad",
  "unknown": "mut",
170}
171_STATE_CLASS = {"merged": "ok", "closed": "mut", "open": "warn"}
172_FAIL_CLASS = {"failed": "bad", "terminated": "warn"}
173 
174 
175# ── small formatters ─────────────────────────────────────────────────────────
176def _aware(when: datetime) -> datetime:
  return when if when.tzinfo else when.replace(tzinfo=UTC)
178 
179 
180def _ago(when: datetime | None, now: datetime) -> str:
  if when is None:
      return "—"
  secs = (now - _aware(when)).total_seconds()
  if secs < 90:
      return "just now"
  mins = secs / 60
  if mins < 90:
      return f"{round(mins)}m ago"
  hours = mins / 60
  if hours < 36:
      return f"{round(hours)}h ago"
  return f"{round(hours / 24)}d ago"
193 
194 
195def _until(when: datetime | None, now: datetime) -> str:
  if when is None:
      return "—"
  secs = (_aware(when) - now).total_seconds()
  if secs <= 0:
      return "due"
  mins = secs / 60
  if mins < 90:
      return f"~{round(mins)}m"
  hours = mins / 60
  if hours < 36:
      return f"~{round(hours)}h"
  return f"~{round(hours / 24)}d"
208 
209 
210def _pct(rate: float | None) -> str:
  return "—" if rate is None else f"{rate * 100:.0f}%"
212 
213 
214def _dot(kind: str) -> str:
  return f'<span class="dot {kind}"></span>'
216 
217 
218def _tag(value: str | None, classes: dict[str, str]) -> str:
  if value is None:
      return '<span class="t">—</span>'
  cls = classes.get(value, "")
  return f'<span class="t {cls}">{escape(value)}</span>'
223 
224 
225def _pr_link(row: BumpRow) -> str:
  if row.pr_url is None or row.pr_number is None:
      return '<span class="mut">—</span>'
  return f'<a href="{escape(row.pr_url, quote=True)}">#{row.pr_number}</a>'
229 
230 
231def _short_id(workflow_id: str) -> str:
  return escape(workflow_id.removeprefix("froot-bump-"))
233 
234 
235# ── header ───────────────────────────────────────────────────────────────────
236def _alive(model: DashboardModel) -> tuple[str, str]:
  """Global liveness dot + label across every loop."""
  live = sum(1 for x in model.scan_loops if x.live) + sum(
      1 for x in model.review_loops if x.live
  )
  total = len(model.scan_loops) + len(model.review_loops)
  if total == 0:
      return "mute", "no loops configured"
  kind = "ok" if live == total else ("warn" if live else "bad")
  return kind, f"{live}/{total} loops live"
246 
247 
248def _header(model: DashboardModel) -> str:
  kind, label = _alive(model)
  sources = " ".join(
      f"{_dot('ok' if s.ok else 'bad')}{escape(s.name)}"
      for s in model.sources
  )
  return (
      "<header>"
      '<h1>froot<span class="v mono">gemma4:12b</span></h1>'
      f'<span class="hstatus">{_dot(kind)}{escape(label)}</span>'
      f'<span class="hmeta"><span>{sources}</span>'
      f"<span>{len(model.repos_configured)} repos</span>"
      f"<span>built {_ago(model.generated_at, model.generated_at)}"
      " · reload to recompute</span></span>"
      "</header>"
  )
264 
265 
266# ── the gate hero (per loop) ─────────────────────────────────────────────────
267def _bearing(label: str, value: str, kind: str, *, armed: bool = False) -> str:
  cls = "bearing armed" if armed else "bearing"
  return (
      f'<div class="{cls}"><span class="bl">{escape(label)}</span>'
      f'<span class="bv {kind}">{escape(value)}</span></div>'
  )
273 
274 
275def _gate_hero(view: LoopView) -> str:
  t, rel, pr = view.track_record, view.reliability, view.probes
  earned = sum(1 for g in view.class_gates if g.earned)
  total = len(view.class_gates)
  acting = any(r.would_auto_merge for r in view.gate)
  # The four bearings: rate + defect come from the record; the adversarial
  # probe (canary) is the loop's escaped-count; the deep review runs per-PR at
  # the merge, so it is shown armed (always-on), not a record figure.
  rate_ok = "ok" if (t.merge_rate or 0) >= 0.95 else "warn"
  defect_ok = "ok" if not rel.defect_rate else "bad"
  probe_ok = "ok" if pr.escaped == 0 else "bad"
  bearings = "".join(
      (
          _bearing(
              "approval rate",
              _pct(t.merge_rate),
              rate_ok if t.merge_rate is not None else "mut",
          ),
          _bearing(
              "defect rate",
              _pct(rel.defect_rate),
              defect_ok if rel.defect_rate is not None else "mut",
          ),
          _bearing(
              "probe",
              f"{pr.escaped} escaped" if pr.total else "none",
              probe_ok if pr.total else "mut",
          ),
          _bearing("deep review", "armed", "mut", armed=True),
      )
  )
  if total == 0:
      node = (
          '<div class="gatenode"><div class="gl">gate</div>'
          '<div class="gv">—</div><div class="gs">no class yet</div></div>'
      )
  else:
      node = (
          f'<div class="gatenode"><div class="gl">earned</div>'
          f'<div class="gv">{earned}/{total}</div>'
          '<div class="gs">classes</div></div>'
      )
  if acting:
      out = (
          '<div class="outcome act"><div class="ot">AUTO-MERGE</div>'
          '<div class="os">a class is acting now</div></div>'
      )
  elif earned:
      out = (
          '<div class="outcome act"><div class="ot">EARNED</div>'
          '<div class="os">acts where allowlisted</div></div>'
      )
  else:
      out = (
          '<div class="outcome hold"><div class="ot">HOLD</div>'
          '<div class="os">building the record</div></div>'
      )
  flow = (
      '<div class="gateflow">'
      f'<div class="bearings">{bearings}</div>'
      '<div class="flowarrow">&rarr;</div>'
      f"{node}"
      '<div class="flowarrow">&rarr;</div>'
      f"{out}</div>"
  )
  caption = (
      '<p class="caption">A class earns the gate by triangulation: a high '
      "<b>approval rate</b> and a low <b>defect rate</b>, over enough "
      "evidence. Two further legs guard the live merge — an adversarial "
      "<b>probe</b> and an independent <b>deep review</b> at merge. "
      "Auto-merge is allowlist-gated (off by default).</p>"
  )
  return (
      '<div><div class="heroh">Earned autonomy &middot; the gate</div>'
      f"{flow}{caption}</div>"
  )
351 
352 
353def _class_table(view: LoopView) -> str:
  if not view.class_gates:
      return (
          '<div><div class="heroh">Classes</div>'
          '<div class="empty">No classes yet &mdash; a (repo, loop) '
          "earns the gate from its own track record.</div></div>"
      )
  rows = "".join(_class_row(g) for g in view.class_gates)
  return (
      '<div><div class="heroh">Per-class standing</div>'
      '<table class="classes"><thead><tr><th>repo</th><th>rate</th>'
      "<th>defect</th><th>gate</th><th>budget/wk</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div>"
  )
367 
368 
369def _class_row(g: ClassGate) -> str:
  if g.earned:
      gate = '<span class="pill ok">earned</span>'
  else:
      gate = (
          f'<span class="pill hold">hold</span> '
          f'<span class="mut">{escape(g.blocker or "")}</span>'
      )
  defect = "—" if g.defect_rate is None else _pct(g.defect_rate)
  budget = (
      f"{g.reclaim_per_week:.1f}/{g.approvals_per_week:.1f}"
      if g.approvals_per_week
      else "—"
  )
  return (
      f'<tr><td class="mono">{escape(g.repo)}</td>'
      f'<td class="r">{_pct(g.merge_rate)}</td>'
      f'<td class="r">{escape(defect)}</td>'
      f"<td>{gate}</td>"
      f'<td class="r mut">{escape(budget)}</td></tr>'
  )
390 
391 
392# ── metric cards (per loop) ──────────────────────────────────────────────────
393def _card(n: object, label: str, extra: str = "", kind: str = "") -> str:
  x = f'<div class="x">{extra}</div>' if extra else ""
  return (
      f'<div class="card"><div class="n {kind}">{escape(str(n))}</div>'
      f'<div class="l">{escape(label)}</div>{x}</div>'
  )
399 
400 
401def _loop_cards(view: LoopView) -> str:
  t, v, rel, j, pr = (
      view.track_record,
      view.verification,
      view.reliability,
      view.judgment,
      view.probes,
  )
  defects = rel.broke + rel.reverted
  cards = [
      _card(
          t.opened,
          "proposed",
          f"{t.merged} merged · {t.closed_unmerged} closed",
      ),
      _card(_pct(t.merge_rate), "approval rate", "the first bearing"),
      _card(
          t.open_now,
          "awaiting you",
          "open, needs a human",
          "warn" if t.open_now else "",
      ),
      _card(
          _pct(rel.defect_rate) if rel.determined else "—",
          "defect rate",
          f"{rel.held} held · {defects} broke",
          "bad" if defects else "",
      ),
      _card(
          f"{v.passed}/{v.oracle_existed}" if v.oracle_existed else "—",
          "CI passed",
          "the oracle",
      ),
      _card(
          pr.escaped if pr.total else "0",
          "probes escaped",
          f"{pr.caught} caught" if pr.total else "no probes yet",
          "bad" if pr.escaped else "",
      ),
      _card(
          j.clean,
          "clean verdicts",
          f"{j.clean_but_failed} mis-judged"
          if j.clean_but_failed
          else "judge calibrated",
      ),
      _card(rel.held, "merges held", "post-merge, stayed green"),
  ]
  return f'<div class="cards">{"".join(cards)}</div>'
450 
451 
452# ── detail tables ────────────────────────────────────────────────────────────
453def _cadence(view: LoopView, now: datetime) -> str:
  live = sum(1 for s in view.scan_loops if s.live)
  total = len(view.scan_loops)
  nxt = ""
  last = max(
      (s.last_tick for s in view.scan_loops if s.last_tick is not None),
      default=None,
  )
  if last is not None:
      due = last + timedelta(seconds=view.scan_interval_seconds)
      nxt = f" &middot; next {escape(_until(due, now))}"
  every = round(view.scan_interval_seconds / 3600, 1)
  return (
      f'<p class="cad">Scan loop &middot; <b>{live}/{total}</b> live '
      f"&middot; every <b>{every}h</b>{nxt}</p>"
  )
469 
470 
471def _bumps_fold(view: LoopView) -> str:
  if not view.bumps:
      return ""
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(r.package)}</td>'
      f'<td class="mono mut">{escape(r.to_version)}</td>'
      f"<td>{_tag(r.state, _STATE_CLASS)}</td>"
      f"<td>{_tag(r.verdict, _VERDICT_CLASS)}</td>"
      f"<td>{_tag(r.ci, _CI_CLASS)}</td>"
      f"<td>{_tag(r.post_merge, _POST_MERGE_CLASS)}</td>"
      f"<td>{_pr_link(r)}</td>"
      "</tr>"
      for r in view.bumps
  )
  return (
      '<details class="fold"><summary>Bumps '
      f'<span class="c">{len(view.bumps)}</span></summary><div class="body">'
      '<table class="data"><thead><tr><th>package</th><th>&rarr;</th>'
      "<th>state</th><th>verdict</th><th>ci</th><th>post-merge</th>"
      "<th>pr</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div></details>"
  )
494 
495 
496def _failures_fold(view: LoopView) -> str:
  if not view.failures:
      return ""
  rows = "".join(
      "<tr>"
      f'<td class="mono">{_short_id(f.workflow_id)}</td>'
      f"<td>{_tag(f.kind, _FAIL_CLASS)}</td>"
      f'<td class="mut">{escape(f.reason or "—")}</td>'
      "</tr>"
      for f in view.failures
  )
  return (
      '<details class="fold"><summary class="bad">Failures '
      f'<span class="c">{len(view.failures)}</span></summary>'
      '<div class="body"><table class="data"><thead><tr><th>bump</th>'
      "<th>kind</th><th>reason</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div></details>"
  )
514 
515 
516# ── panels ───────────────────────────────────────────────────────────────────
517def _loop_panel(view: LoopView, pid: str, now: datetime) -> str:
  queue = _queue_sec(view)
  return (
      f'<section class="panel" id="{pid}">'
      f'<div class="hero">{_gate_hero(view)}{_class_table(view)}</div>'
      f"{_loop_cards(view)}"
      f"{queue}"
      f"{_cadence(view, now)}"
      f"{_bumps_fold(view)}{_failures_fold(view)}"
      "</section>"
  )
528 
529 
530def _queue_sec(view: LoopView) -> str:
  if not view.gate:
      return (
          '<div class="sec"><div class="sech">Approval queue '
          '<span class="n">empty</span></div>'
          '<div class="empty">Nothing awaiting you.</div></div>'
      )
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(r.package)}</td>'
      f'<td class="mono mut">{escape(r.to_version)}</td>'
      f"<td>{_queue_badge(r)}</td>"
      f"<td>{_pr_link(r)}</td>"
      "</tr>"
      for r in view.gate
  )
  return (
      '<div class="sec"><div class="sech">Approval queue '
      f'<span class="n">{len(view.gate)} yours</span></div>'
      '<table class="data"><thead><tr><th>package</th><th>&rarr;</th>'
      "<th>gate</th><th>pr</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div>"
  )
553 
554 
555def _queue_badge(row: BumpRow) -> str:
  if row.would_auto_merge:
      return '<span class="pill ok">would auto-merge</span>'
  reason = row.held_reason or "held"
  return f'<span class="mut">held &middot; {escape(reason)}</span>'
560 
561 
562def _review_panel(model: DashboardModel, pid: str) -> str:
  r = model.review_record
  live = sum(1 for x in model.review_loops if x.live)
  haz = "bad" if r.hazards else ""
  cards = (
      '<div class="cards">'
      f"{_card(r.repos_covered, 'repos covered')}"
      f"{_card(f'{live}/{len(model.review_loops)}', 'loops live')}"
      f"{_card(r.reviewed, 'reviewed', f'{r.flagged} flagged')}"
      f"{_card(r.hazards, 'hazards', 'transitive', haz)}"
      "</div>"
  )
  body = (
      '<div class="empty">No PRs reviewed yet.</div>'
      if not model.reviews
      else _reviews_table(model.reviews)
  )
  note = (
      '<p class="caption">The transitive ring — advisory. It '
      "re-derives each open PR's reachable determinism hazards and "
      "comments; it never blocks a merge.</p>"
  )
  every = round(model.review_interval_seconds / 60, 1)
  cad = (
      f'<p class="cad">Review loop &middot; <b>{live}</b> live &middot; '
      f"every <b>{every}m</b></p>"
  )
  return (
      f'<section class="panel" id="{pid}">'
      '<div class="heroh">Determinism review &middot; the transitive ring'
      f"</div>{note}{cards}{cad}"
      f'<div class="sec"><div class="sech">Reviews '
      f'<span class="n">{len(model.reviews)}</span></div>{body}</div>'
      "</section>"
  )
597 
598 
599def _reviews_table(reviews: tuple[ReviewRow, ...]) -> str:
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(row.repo)}</td>'
      f"<td>{_review_pr_link(row)}</td>"
      f"<td>{_findings_cell(row)}</td>"
      f'<td class="mono mut">{escape(", ".join(row.rules) or "—")}</td>'
      "</tr>"
      for row in reviews
  )
  return (
      '<table class="data"><thead><tr><th>repo</th><th>pr</th>'
      "<th>findings</th><th>rules</th></tr></thead>"
      f"<tbody>{rows}</tbody></table>"
  )
614 
615 
616def _review_pr_link(row: ReviewRow) -> str:
  if row.pr_url is None or row.pr_number is None:
      return '<span class="mut">—</span>'
  return f'<a href="{escape(row.pr_url, quote=True)}">#{row.pr_number}</a>'
620 
621 
622def _findings_cell(row: ReviewRow) -> str:
  if row.findings == 0:
      return '<span class="ok">clean</span>'
  label = "hazard" if row.findings == 1 else "hazards"
  link = ""
  if row.comment_url:
      link = f' <a href="{escape(row.comment_url, quote=True)}">comment</a>'
  return f'<span class="bad">{row.findings} {label}</span>{link}'
630 
631 
632def _telemetry_panel(model: DashboardModel, pid: str, now: datetime) -> str:
  tel: RunTelemetry = model.telemetry
  if not tel.available:
      body = (
          '<div class="empty">Unavailable &mdash; ClickHouse off or no '
          "froot traces in the window.</div>"
      )
  else:
      rows = "".join(
          "<tr>"
          f'<td class="mono">{escape(a.name)}</td>'
          f'<td class="r">{a.count}</td>'
          f'<td class="r">{a.avg_ms:.0f} ms</td>'
          f'<td class="r mut">{a.max_ms:.0f} ms</td>'
          "</tr>"
          for a in tel.activities
      )
      last = f"last {_ago(tel.last_activity, now)}"
      err = "bad" if tel.error_spans else ""
      head = (
          '<div class="cards">'
          f"{_card(tel.total_spans, 'spans', last)}"
          f"{_card(tel.error_spans, 'errors', 'in the window', err)}"
          f"{_card(f'{tel.window_days}d', 'window')}</div>"
      )
      table = (
          '<div class="sec"><div class="sech">Activity latency</div>'
          '<table class="data"><thead><tr><th>activity</th><th>runs</th>'
          "<th>avg</th><th>max</th></tr></thead>"
          f"<tbody>{rows}</tbody></table></div>"
      )
      body = head + table
  note = (
      '<p class="caption">Cross-cutting run telemetry from ClickHouse '
      "(trace-derived, best-effort) — latency per activity across "
      "every loop.</p>"
  )
  return (
      f'<section class="panel" id="{pid}">'
      '<div class="heroh">Run telemetry &middot; ClickHouse</div>'
      f"{note}{body}</section>"
  )
674 
675 
676# ── tabs + page ──────────────────────────────────────────────────────────────
677def _loop_badge(view: LoopView) -> str:
  earned = sum(1 for g in view.class_gates if g.earned)
  if view.class_gates and earned:
      return f"{earned}/{len(view.class_gates)} earned"
  if view.track_record.open_now:
      return f"{view.track_record.open_now} open"
  return str(view.track_record.opened)
684 
685 
686def page(model: DashboardModel) -> str:
  """Render the whole dashboard as one self-contained HTML document."""
  now = model.generated_at
  # (tab-id, panel-id, label, badge, panel-html)
  tabs: list[tuple[str, str, str, str, str]] = []
  for i, view in enumerate(model.bump_loops):
      pid, tid = f"panel-{i}", f"tab-{i}"
      tabs.append(
          (
              tid,
              pid,
              view.title,
              _loop_badge(view),
              _loop_panel(view, pid, now),
          )
      )
  tabs.append(
      (
          "tab-det",
          "panel-det",
          "Determinism review",
          str(model.review_record.reviewed),
          _review_panel(model, "panel-det"),
      )
  )
  tabs.append(
      (
          "tab-tel",
          "panel-tel",
          "Telemetry",
          "live" if model.telemetry.available else "off",
          _telemetry_panel(model, "panel-tel", now),
      )
  )
720 
  inputs, labels, panels, rules = [], [], [], []
  for idx, (tid, pid, label, badge, panel) in enumerate(tabs):
      checked = " checked" if idx == 0 else ""
      inputs.append(
          f'<input class="tabin" type="radio" name="tab" id="{tid}"{checked}>'
      )
      labels.append(
          f'<label for="{tid}">{escape(label)}'
          f'<span class="badge">{escape(badge)}</span></label>'
      )
      panels.append(panel)
      rules.append(f"#{tid}:checked~main #{pid}{{display:block}}")
      rules.append(
          f"#{tid}:checked~main nav.tabbar label[for={tid}]"
          "{color:var(--fg);border-bottom-color:var(--accent)}"
      )
  tabcss = "".join(rules)
  return (
      '<!doctype html><html lang="en"><head><meta charset="utf-8">'
      '<meta name="viewport" content="width=device-width,initial-scale=1">'
      "<title>froot &middot; read-model</title>"
      f"<style>{_CSS}{tabcss}</style></head><body>"
      + "".join(inputs)
      + "<main>"
      + _header(model)
⋯ 18 lines hidden (lines 746–763)746        + f'<nav class="tabbar">{"".join(labels)}</nav>'
      + "".join(panels)
      + _footer()
      + "</main></body></html>"
  )
751 
752 
753def _footer() -> str:
  return (
      "<footer><b>Authority envelope.</b> froot opens PRs everywhere and "
      "auto-merges only on an allowlisted repo where a class has earned its "
      "gate (the allowlist is empty by default, so commit authority is none "
      "until a steward opts in). Trust is earned, narrow to one loop on one "
      "repo, conditional on its environment "
      '(<span class="mono">gemma4:12b</span>), revocable, and time-expiring. '
      "Everything here is derived per request from GitHub + Temporal + "
      "ClickHouse; froot keeps no database.</footer>"
  )

Each loop panel stacks the hero, a compact metric-card grid, the approval queue, the loop's own scan cadence (telemetry-in-context), and foldable bump/failure detail.

src/froot/dashboard/render.py · 763 lines

src/froot/dashboard/render.py763 lines · Python

⋯ 516 lines hidden (lines 1–516)1"""Render the view model to one self-contained HTML page (pure).
2 
3All CSS is inline, there is no JavaScript (tabs are CSS-only, via hidden radio
4inputs), and the page makes no network request of its own — it is a static,
5full-screen projection of an already-computed
class:`~froot.dashboard.model.DashboardModel`. Every dynamic value is
7HTML-escaped at the boundary.
8 
9The shape is gate-first: each loop is a tab whose hero is the *gate* — a small
10flow of the four trust bearings into the earned/hold decision — over a compact
11metric grid and foldable detail. Each loop is a distinct trust class (§3.9), so
12each tab is the whole dashboard scoped to one loop; determinism-review and the
13cross-cutting run-telemetry get their own tabs.
14"""
15 
16from __future__ import annotations
17 
18from datetime import UTC, datetime, timedelta
19from html import escape
20from typing import TYPE_CHECKING
21 
22if TYPE_CHECKING:
  from froot.dashboard.model import (
      BumpRow,
      ClassGate,
      DashboardModel,
      LoopView,
      ReviewRow,
      RunTelemetry,
  )
31 
32_CSS = """
root{--fg:#13151a;--mut:#6b7280;--faint:#9aa1ac;--line:#e7e9ee;--bg:#fbfbfc;
34--panel:#fff;--ok:#1a7f37;--warn:#9a6700;--bad:#cf222e;--accent:#0969da;
35--accentbg:#ddf0ff;--chip:#f2f4f7;--node:#eef6ff}
36@media(prefers-color-scheme:dark){:root{--fg:#e8eaed;--mut:#9aa1ac;
37--faint:#6b7280;--line:#23262d;--bg:#0a0b0d;--panel:#121419;--ok:#3fb950;
38--warn:#d29922;--bad:#f85149;--accent:#58a6ff;--accentbg:#10263f;
39--chip:#1a1d24;--node:#10263f}}
40*{box-sizing:border-box}
41body{margin:0;background:var(--bg);color:var(--fg);
42font:14px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
43-webkit-font-smoothing:antialiased}
44main{padding:0 clamp(16px,3vw,44px) 64px}
45a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
mono{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.92em}
mut{color:var(--mut)}.ok{color:var(--ok)}.warn{color:var(--warn)}
bad{color:var(--bad)}
49/* header */
50header{display:flex;align-items:baseline;flex-wrap:wrap;gap:8px 20px;
51padding:22px 0 16px;border-bottom:1px solid var(--line)}
52h1{font-size:19px;margin:0;letter-spacing:-.02em;font-weight:700}
53h1 .v{color:var(--faint);font-weight:400;font-size:13px;margin-left:8px}
hstatus{display:flex;align-items:center;gap:7px;font-size:13px}
hmeta{margin-left:auto;display:flex;flex-wrap:wrap;gap:6px 16px;
56color:var(--mut);font-size:12px}
dot{display:inline-block;width:8px;height:8px;border-radius:50%}
dot.ok{background:var(--ok)}.dot.warn{background:var(--warn)}
dot.bad{background:var(--bad)}.dot.mute{background:var(--faint)}
60/* tabs (CSS-only) */
tabin{position:absolute;opacity:0;pointer-events:none}
62nav.tabbar{display:flex;flex-wrap:wrap;gap:4px;margin:14px 0 0;
63border-bottom:1px solid var(--line)}
64nav.tabbar label{display:inline-flex;align-items:center;gap:8px;cursor:pointer;
65padding:9px 15px;font-size:13px;font-weight:600;color:var(--mut);
66border-bottom:2px solid transparent;margin-bottom:-1px;white-space:nowrap}
67nav.tabbar label:hover{color:var(--fg)}
68nav.tabbar label .badge{font-weight:600;font-size:11px;color:var(--faint);
69background:var(--chip);border-radius:9px;padding:1px 7px}
panel{display:none;padding:22px 0 0;animation:fade .15s ease}
71@keyframes fade{from{opacity:.4}to{opacity:1}}
72/* gate hero */
hero{display:grid;grid-template-columns:minmax(320px,1.1fr) minmax(280px,1fr);
74gap:18px 26px;align-items:start;margin:0 0 6px}
75@media(max-width:760px){.hero{grid-template-columns:1fr}}
heroh{font-size:11px;text-transform:uppercase;letter-spacing:.09em;
77color:var(--mut);font-weight:700;margin:0 0 12px}
gateflow{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
bearings{display:flex;flex-direction:column;gap:6px;min-width:150px}
bearing{display:flex;align-items:center;justify-content:space-between;gap:10px;
81background:var(--chip);border-radius:7px;padding:6px 10px;font-size:12px}
bearing .bl{color:var(--mut)}
bearing .bv{font-weight:600;font-variant-numeric:tabular-nums}
bearing.armed .bv{color:var(--faint);font-weight:500}
flowarrow{color:var(--faint);font-size:18px;line-height:1}
gatenode{flex:0 0 auto;text-align:center;border:2px solid var(--accent);
87background:var(--node);border-radius:12px;padding:12px 16px;min-width:96px}
gatenode .gl{font-size:10px;text-transform:uppercase;letter-spacing:.08em;
89color:var(--accent);font-weight:700}
gatenode .gv{font-size:22px;font-weight:700;line-height:1.15;
91font-variant-numeric:tabular-nums}
gatenode .gs{font-size:11px;color:var(--mut)}
outcome{flex:0 0 auto;border-radius:10px;padding:11px 15px;text-align:center;
94border:1px solid var(--line)}
outcome .ot{font-size:15px;font-weight:700;letter-spacing:.01em}
outcome .os{font-size:11px;color:var(--mut);margin-top:1px}
outcome.act{background:color-mix(in srgb,var(--ok) 12%,transparent);
98border-color:color-mix(in srgb,var(--ok) 40%,transparent)}
outcome.act .ot{color:var(--ok)}
outcome.hold .ot{color:var(--mut)}
caption{color:var(--mut);font-size:12px;margin:8px 0 0;line-height:1.45}
102/* class table inside the hero */
classes{width:100%;border-collapse:collapse;font-size:12.5px}
classes th,.classes td{text-align:left;padding:6px 10px 6px 0;
105border-bottom:1px solid var(--line);vertical-align:baseline}
classes th{color:var(--mut);font-weight:600;font-size:10.5px;
107text-transform:uppercase;letter-spacing:.05em}
classes td.r{font-variant-numeric:tabular-nums}
pill{display:inline-block;font-size:11px;font-weight:600;border-radius:20px;
110padding:1px 9px}
pill.ok{color:var(--ok);
112background:color-mix(in srgb,var(--ok) 14%,transparent)}
pill.hold{color:var(--mut);background:var(--chip)}
114/* metric cards */
cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));
116gap:10px;margin:22px 0 0}
card{background:var(--panel);border:1px solid var(--line);border-radius:10px;
118padding:13px 15px}
card .n{font-size:24px;font-weight:700;line-height:1.05;
120font-variant-numeric:tabular-nums}
card .l{color:var(--mut);font-size:11.5px;margin-top:3px}
card .x{color:var(--faint);font-size:11px;margin-top:5px}
123/* section + detail */
sec{margin:26px 0 0}
sech{font-size:11px;text-transform:uppercase;letter-spacing:.08em;
126color:var(--mut);font-weight:700;margin:0 0 10px;display:flex;
127align-items:baseline;gap:10px}
sech .n{color:var(--faint);font-weight:600;letter-spacing:0}
129details.fold{margin:18px 0 0;border:1px solid var(--line);border-radius:10px;
130background:var(--panel)}
131details.fold>summary{cursor:pointer;list-style:none;padding:11px 15px;
132font-size:12px;font-weight:600;color:var(--fg);display:flex;
133align-items:center;gap:9px}
134details.fold>summary::-webkit-details-marker{display:none}
135details.fold>summary::before{content:"\\25B8";color:var(--faint);font-size:10px}
136details.fold[open]>summary::before{content:"\\25BE"}
137details.fold>summary .c{color:var(--faint);font-weight:600}
138details.fold .body{padding:0 15px 14px}
139table.data{width:100%;border-collapse:collapse;font-size:12.5px}
140table.data th,table.data td{text-align:left;padding:6px 12px 6px 0;
141border-bottom:1px solid var(--line);vertical-align:top}
142table.data th{color:var(--mut);font-weight:600;font-size:10.5px;
143text-transform:uppercase;letter-spacing:.04em}
144table.data td.r{font-variant-numeric:tabular-nums;white-space:nowrap}
empty{color:var(--mut);font-size:13px;padding:14px 0;border:1px dashed
146var(--line);border-radius:9px;text-align:center;background:var(--panel)}
tags{display:flex;flex-wrap:wrap;gap:6px}
t{font-size:11px;border-radius:6px;padding:1px 7px;background:var(--chip);
149color:var(--mut)}
t.ok{color:var(--ok)}.t.warn{color:var(--warn)}.t.bad{color:var(--bad)}
cad{color:var(--mut);font-size:12px;margin:14px 0 0}
cad b{color:var(--fg);font-weight:600}
153footer{margin:40px 0 0;padding-top:16px;border-top:1px solid var(--line);
154color:var(--mut);font-size:12px;line-height:1.65}
155footer b{color:var(--fg);font-weight:600}
156"""
157 
158_CI_CLASS = {
  "passed": "ok",
  "failed": "bad",
  "absent": "mut",
  "timed_out": "warn",
163}
164_VERDICT_CLASS = {"clean": "ok", "risky": "warn", "unknown": "mut"}
165_POST_MERGE_CLASS = {
  "held": "ok",
  "broke": "bad",
  "reverted": "bad",
  "unknown": "mut",
170}
171_STATE_CLASS = {"merged": "ok", "closed": "mut", "open": "warn"}
172_FAIL_CLASS = {"failed": "bad", "terminated": "warn"}
173 
174 
175# ── small formatters ─────────────────────────────────────────────────────────
176def _aware(when: datetime) -> datetime:
  return when if when.tzinfo else when.replace(tzinfo=UTC)
178 
179 
180def _ago(when: datetime | None, now: datetime) -> str:
  if when is None:
      return "—"
  secs = (now - _aware(when)).total_seconds()
  if secs < 90:
      return "just now"
  mins = secs / 60
  if mins < 90:
      return f"{round(mins)}m ago"
  hours = mins / 60
  if hours < 36:
      return f"{round(hours)}h ago"
  return f"{round(hours / 24)}d ago"
193 
194 
195def _until(when: datetime | None, now: datetime) -> str:
  if when is None:
      return "—"
  secs = (_aware(when) - now).total_seconds()
  if secs <= 0:
      return "due"
  mins = secs / 60
  if mins < 90:
      return f"~{round(mins)}m"
  hours = mins / 60
  if hours < 36:
      return f"~{round(hours)}h"
  return f"~{round(hours / 24)}d"
208 
209 
210def _pct(rate: float | None) -> str:
  return "—" if rate is None else f"{rate * 100:.0f}%"
212 
213 
214def _dot(kind: str) -> str:
  return f'<span class="dot {kind}"></span>'
216 
217 
218def _tag(value: str | None, classes: dict[str, str]) -> str:
  if value is None:
      return '<span class="t">—</span>'
  cls = classes.get(value, "")
  return f'<span class="t {cls}">{escape(value)}</span>'
223 
224 
225def _pr_link(row: BumpRow) -> str:
  if row.pr_url is None or row.pr_number is None:
      return '<span class="mut">—</span>'
  return f'<a href="{escape(row.pr_url, quote=True)}">#{row.pr_number}</a>'
229 
230 
231def _short_id(workflow_id: str) -> str:
  return escape(workflow_id.removeprefix("froot-bump-"))
233 
234 
235# ── header ───────────────────────────────────────────────────────────────────
236def _alive(model: DashboardModel) -> tuple[str, str]:
  """Global liveness dot + label across every loop."""
  live = sum(1 for x in model.scan_loops if x.live) + sum(
      1 for x in model.review_loops if x.live
  )
  total = len(model.scan_loops) + len(model.review_loops)
  if total == 0:
      return "mute", "no loops configured"
  kind = "ok" if live == total else ("warn" if live else "bad")
  return kind, f"{live}/{total} loops live"
246 
247 
248def _header(model: DashboardModel) -> str:
  kind, label = _alive(model)
  sources = " ".join(
      f"{_dot('ok' if s.ok else 'bad')}{escape(s.name)}"
      for s in model.sources
  )
  return (
      "<header>"
      '<h1>froot<span class="v mono">gemma4:12b</span></h1>'
      f'<span class="hstatus">{_dot(kind)}{escape(label)}</span>'
      f'<span class="hmeta"><span>{sources}</span>'
      f"<span>{len(model.repos_configured)} repos</span>"
      f"<span>built {_ago(model.generated_at, model.generated_at)}"
      " · reload to recompute</span></span>"
      "</header>"
  )
264 
265 
266# ── the gate hero (per loop) ─────────────────────────────────────────────────
267def _bearing(label: str, value: str, kind: str, *, armed: bool = False) -> str:
  cls = "bearing armed" if armed else "bearing"
  return (
      f'<div class="{cls}"><span class="bl">{escape(label)}</span>'
      f'<span class="bv {kind}">{escape(value)}</span></div>'
  )
273 
274 
275def _gate_hero(view: LoopView) -> str:
  t, rel, pr = view.track_record, view.reliability, view.probes
  earned = sum(1 for g in view.class_gates if g.earned)
  total = len(view.class_gates)
  acting = any(r.would_auto_merge for r in view.gate)
  # The four bearings: rate + defect come from the record; the adversarial
  # probe (canary) is the loop's escaped-count; the deep review runs per-PR at
  # the merge, so it is shown armed (always-on), not a record figure.
  rate_ok = "ok" if (t.merge_rate or 0) >= 0.95 else "warn"
  defect_ok = "ok" if not rel.defect_rate else "bad"
  probe_ok = "ok" if pr.escaped == 0 else "bad"
  bearings = "".join(
      (
          _bearing(
              "approval rate",
              _pct(t.merge_rate),
              rate_ok if t.merge_rate is not None else "mut",
          ),
          _bearing(
              "defect rate",
              _pct(rel.defect_rate),
              defect_ok if rel.defect_rate is not None else "mut",
          ),
          _bearing(
              "probe",
              f"{pr.escaped} escaped" if pr.total else "none",
              probe_ok if pr.total else "mut",
          ),
          _bearing("deep review", "armed", "mut", armed=True),
      )
  )
  if total == 0:
      node = (
          '<div class="gatenode"><div class="gl">gate</div>'
          '<div class="gv">—</div><div class="gs">no class yet</div></div>'
      )
  else:
      node = (
          f'<div class="gatenode"><div class="gl">earned</div>'
          f'<div class="gv">{earned}/{total}</div>'
          '<div class="gs">classes</div></div>'
      )
  if acting:
      out = (
          '<div class="outcome act"><div class="ot">AUTO-MERGE</div>'
          '<div class="os">a class is acting now</div></div>'
      )
  elif earned:
      out = (
          '<div class="outcome act"><div class="ot">EARNED</div>'
          '<div class="os">acts where allowlisted</div></div>'
      )
  else:
      out = (
          '<div class="outcome hold"><div class="ot">HOLD</div>'
          '<div class="os">building the record</div></div>'
      )
  flow = (
      '<div class="gateflow">'
      f'<div class="bearings">{bearings}</div>'
      '<div class="flowarrow">&rarr;</div>'
      f"{node}"
      '<div class="flowarrow">&rarr;</div>'
      f"{out}</div>"
  )
  caption = (
      '<p class="caption">A class earns the gate by triangulation: a high '
      "<b>approval rate</b> and a low <b>defect rate</b>, over enough "
      "evidence. Two further legs guard the live merge — an adversarial "
      "<b>probe</b> and an independent <b>deep review</b> at merge. "
      "Auto-merge is allowlist-gated (off by default).</p>"
  )
  return (
      '<div><div class="heroh">Earned autonomy &middot; the gate</div>'
      f"{flow}{caption}</div>"
  )
351 
352 
353def _class_table(view: LoopView) -> str:
  if not view.class_gates:
      return (
          '<div><div class="heroh">Classes</div>'
          '<div class="empty">No classes yet &mdash; a (repo, loop) '
          "earns the gate from its own track record.</div></div>"
      )
  rows = "".join(_class_row(g) for g in view.class_gates)
  return (
      '<div><div class="heroh">Per-class standing</div>'
      '<table class="classes"><thead><tr><th>repo</th><th>rate</th>'
      "<th>defect</th><th>gate</th><th>budget/wk</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div>"
  )
367 
368 
369def _class_row(g: ClassGate) -> str:
  if g.earned:
      gate = '<span class="pill ok">earned</span>'
  else:
      gate = (
          f'<span class="pill hold">hold</span> '
          f'<span class="mut">{escape(g.blocker or "")}</span>'
      )
  defect = "—" if g.defect_rate is None else _pct(g.defect_rate)
  budget = (
      f"{g.reclaim_per_week:.1f}/{g.approvals_per_week:.1f}"
      if g.approvals_per_week
      else "—"
  )
  return (
      f'<tr><td class="mono">{escape(g.repo)}</td>'
      f'<td class="r">{_pct(g.merge_rate)}</td>'
      f'<td class="r">{escape(defect)}</td>'
      f"<td>{gate}</td>"
      f'<td class="r mut">{escape(budget)}</td></tr>'
  )
390 
391 
392# ── metric cards (per loop) ──────────────────────────────────────────────────
393def _card(n: object, label: str, extra: str = "", kind: str = "") -> str:
  x = f'<div class="x">{extra}</div>' if extra else ""
  return (
      f'<div class="card"><div class="n {kind}">{escape(str(n))}</div>'
      f'<div class="l">{escape(label)}</div>{x}</div>'
  )
399 
400 
401def _loop_cards(view: LoopView) -> str:
  t, v, rel, j, pr = (
      view.track_record,
      view.verification,
      view.reliability,
      view.judgment,
      view.probes,
  )
  defects = rel.broke + rel.reverted
  cards = [
      _card(
          t.opened,
          "proposed",
          f"{t.merged} merged · {t.closed_unmerged} closed",
      ),
      _card(_pct(t.merge_rate), "approval rate", "the first bearing"),
      _card(
          t.open_now,
          "awaiting you",
          "open, needs a human",
          "warn" if t.open_now else "",
      ),
      _card(
          _pct(rel.defect_rate) if rel.determined else "—",
          "defect rate",
          f"{rel.held} held · {defects} broke",
          "bad" if defects else "",
      ),
      _card(
          f"{v.passed}/{v.oracle_existed}" if v.oracle_existed else "—",
          "CI passed",
          "the oracle",
      ),
      _card(
          pr.escaped if pr.total else "0",
          "probes escaped",
          f"{pr.caught} caught" if pr.total else "no probes yet",
          "bad" if pr.escaped else "",
      ),
      _card(
          j.clean,
          "clean verdicts",
          f"{j.clean_but_failed} mis-judged"
          if j.clean_but_failed
          else "judge calibrated",
      ),
      _card(rel.held, "merges held", "post-merge, stayed green"),
  ]
  return f'<div class="cards">{"".join(cards)}</div>'
450 
451 
452# ── detail tables ────────────────────────────────────────────────────────────
453def _cadence(view: LoopView, now: datetime) -> str:
  live = sum(1 for s in view.scan_loops if s.live)
  total = len(view.scan_loops)
  nxt = ""
  last = max(
      (s.last_tick for s in view.scan_loops if s.last_tick is not None),
      default=None,
  )
  if last is not None:
      due = last + timedelta(seconds=view.scan_interval_seconds)
      nxt = f" &middot; next {escape(_until(due, now))}"
  every = round(view.scan_interval_seconds / 3600, 1)
  return (
      f'<p class="cad">Scan loop &middot; <b>{live}/{total}</b> live '
      f"&middot; every <b>{every}h</b>{nxt}</p>"
  )
469 
470 
471def _bumps_fold(view: LoopView) -> str:
  if not view.bumps:
      return ""
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(r.package)}</td>'
      f'<td class="mono mut">{escape(r.to_version)}</td>'
      f"<td>{_tag(r.state, _STATE_CLASS)}</td>"
      f"<td>{_tag(r.verdict, _VERDICT_CLASS)}</td>"
      f"<td>{_tag(r.ci, _CI_CLASS)}</td>"
      f"<td>{_tag(r.post_merge, _POST_MERGE_CLASS)}</td>"
      f"<td>{_pr_link(r)}</td>"
      "</tr>"
      for r in view.bumps
  )
  return (
      '<details class="fold"><summary>Bumps '
      f'<span class="c">{len(view.bumps)}</span></summary><div class="body">'
      '<table class="data"><thead><tr><th>package</th><th>&rarr;</th>'
      "<th>state</th><th>verdict</th><th>ci</th><th>post-merge</th>"
      "<th>pr</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div></details>"
  )
494 
495 
496def _failures_fold(view: LoopView) -> str:
  if not view.failures:
      return ""
  rows = "".join(
      "<tr>"
      f'<td class="mono">{_short_id(f.workflow_id)}</td>'
      f"<td>{_tag(f.kind, _FAIL_CLASS)}</td>"
      f'<td class="mut">{escape(f.reason or "—")}</td>'
      "</tr>"
      for f in view.failures
  )
  return (
      '<details class="fold"><summary class="bad">Failures '
      f'<span class="c">{len(view.failures)}</span></summary>'
      '<div class="body"><table class="data"><thead><tr><th>bump</th>'
      "<th>kind</th><th>reason</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div></details>"
  )
514 
515 
516# ── panels ───────────────────────────────────────────────────────────────────
517def _loop_panel(view: LoopView, pid: str, now: datetime) -> str:
  queue = _queue_sec(view)
  return (
      f'<section class="panel" id="{pid}">'
      f'<div class="hero">{_gate_hero(view)}{_class_table(view)}</div>'
      f"{_loop_cards(view)}"
      f"{queue}"
      f"{_cadence(view, now)}"
      f"{_bumps_fold(view)}{_failures_fold(view)}"
      "</section>"
  )
528 
529 
⋯ 234 lines hidden (lines 530–763)530def _queue_sec(view: LoopView) -> str:
  if not view.gate:
      return (
          '<div class="sec"><div class="sech">Approval queue '
          '<span class="n">empty</span></div>'
          '<div class="empty">Nothing awaiting you.</div></div>'
      )
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(r.package)}</td>'
      f'<td class="mono mut">{escape(r.to_version)}</td>'
      f"<td>{_queue_badge(r)}</td>"
      f"<td>{_pr_link(r)}</td>"
      "</tr>"
      for r in view.gate
  )
  return (
      '<div class="sec"><div class="sech">Approval queue '
      f'<span class="n">{len(view.gate)} yours</span></div>'
      '<table class="data"><thead><tr><th>package</th><th>&rarr;</th>'
      "<th>gate</th><th>pr</th></tr></thead>"
      f"<tbody>{rows}</tbody></table></div>"
  )
553 
554 
555def _queue_badge(row: BumpRow) -> str:
  if row.would_auto_merge:
      return '<span class="pill ok">would auto-merge</span>'
  reason = row.held_reason or "held"
  return f'<span class="mut">held &middot; {escape(reason)}</span>'
560 
561 
562def _review_panel(model: DashboardModel, pid: str) -> str:
  r = model.review_record
  live = sum(1 for x in model.review_loops if x.live)
  haz = "bad" if r.hazards else ""
  cards = (
      '<div class="cards">'
      f"{_card(r.repos_covered, 'repos covered')}"
      f"{_card(f'{live}/{len(model.review_loops)}', 'loops live')}"
      f"{_card(r.reviewed, 'reviewed', f'{r.flagged} flagged')}"
      f"{_card(r.hazards, 'hazards', 'transitive', haz)}"
      "</div>"
  )
  body = (
      '<div class="empty">No PRs reviewed yet.</div>'
      if not model.reviews
      else _reviews_table(model.reviews)
  )
  note = (
      '<p class="caption">The transitive ring — advisory. It '
      "re-derives each open PR's reachable determinism hazards and "
      "comments; it never blocks a merge.</p>"
  )
  every = round(model.review_interval_seconds / 60, 1)
  cad = (
      f'<p class="cad">Review loop &middot; <b>{live}</b> live &middot; '
      f"every <b>{every}m</b></p>"
  )
  return (
      f'<section class="panel" id="{pid}">'
      '<div class="heroh">Determinism review &middot; the transitive ring'
      f"</div>{note}{cards}{cad}"
      f'<div class="sec"><div class="sech">Reviews '
      f'<span class="n">{len(model.reviews)}</span></div>{body}</div>'
      "</section>"
  )
597 
598 
599def _reviews_table(reviews: tuple[ReviewRow, ...]) -> str:
  rows = "".join(
      "<tr>"
      f'<td class="mono">{escape(row.repo)}</td>'
      f"<td>{_review_pr_link(row)}</td>"
      f"<td>{_findings_cell(row)}</td>"
      f'<td class="mono mut">{escape(", ".join(row.rules) or "—")}</td>'
      "</tr>"
      for row in reviews
  )
  return (
      '<table class="data"><thead><tr><th>repo</th><th>pr</th>'
      "<th>findings</th><th>rules</th></tr></thead>"
      f"<tbody>{rows}</tbody></table>"
  )
614 
615 
616def _review_pr_link(row: ReviewRow) -> str:
  if row.pr_url is None or row.pr_number is None:
      return '<span class="mut">—</span>'
  return f'<a href="{escape(row.pr_url, quote=True)}">#{row.pr_number}</a>'
620 
621 
622def _findings_cell(row: ReviewRow) -> str:
  if row.findings == 0:
      return '<span class="ok">clean</span>'
  label = "hazard" if row.findings == 1 else "hazards"
  link = ""
  if row.comment_url:
      link = f' <a href="{escape(row.comment_url, quote=True)}">comment</a>'
  return f'<span class="bad">{row.findings} {label}</span>{link}'
630 
631 
632def _telemetry_panel(model: DashboardModel, pid: str, now: datetime) -> str:
  tel: RunTelemetry = model.telemetry
  if not tel.available:
      body = (
          '<div class="empty">Unavailable &mdash; ClickHouse off or no '
          "froot traces in the window.</div>"
      )
  else:
      rows = "".join(
          "<tr>"
          f'<td class="mono">{escape(a.name)}</td>'
          f'<td class="r">{a.count}</td>'
          f'<td class="r">{a.avg_ms:.0f} ms</td>'
          f'<td class="r mut">{a.max_ms:.0f} ms</td>'
          "</tr>"
          for a in tel.activities
      )
      last = f"last {_ago(tel.last_activity, now)}"
      err = "bad" if tel.error_spans else ""
      head = (
          '<div class="cards">'
          f"{_card(tel.total_spans, 'spans', last)}"
          f"{_card(tel.error_spans, 'errors', 'in the window', err)}"
          f"{_card(f'{tel.window_days}d', 'window')}</div>"
      )
      table = (
          '<div class="sec"><div class="sech">Activity latency</div>'
          '<table class="data"><thead><tr><th>activity</th><th>runs</th>'
          "<th>avg</th><th>max</th></tr></thead>"
          f"<tbody>{rows}</tbody></table></div>"
      )
      body = head + table
  note = (
      '<p class="caption">Cross-cutting run telemetry from ClickHouse '
      "(trace-derived, best-effort) — latency per activity across "
      "every loop.</p>"
  )
  return (
      f'<section class="panel" id="{pid}">'
      '<div class="heroh">Run telemetry &middot; ClickHouse</div>'
      f"{note}{body}</section>"
  )
674 
675 
676# ── tabs + page ──────────────────────────────────────────────────────────────
677def _loop_badge(view: LoopView) -> str:
  earned = sum(1 for g in view.class_gates if g.earned)
  if view.class_gates and earned:
      return f"{earned}/{len(view.class_gates)} earned"
  if view.track_record.open_now:
      return f"{view.track_record.open_now} open"
  return str(view.track_record.opened)
684 
685 
686def page(model: DashboardModel) -> str:
  """Render the whole dashboard as one self-contained HTML document."""
  now = model.generated_at
  # (tab-id, panel-id, label, badge, panel-html)
  tabs: list[tuple[str, str, str, str, str]] = []
  for i, view in enumerate(model.bump_loops):
      pid, tid = f"panel-{i}", f"tab-{i}"
      tabs.append(
          (
              tid,
              pid,
              view.title,
              _loop_badge(view),
              _loop_panel(view, pid, now),
          )
      )
  tabs.append(
      (
          "tab-det",
          "panel-det",
          "Determinism review",
          str(model.review_record.reviewed),
          _review_panel(model, "panel-det"),
      )
  )
  tabs.append(
      (
          "tab-tel",
          "panel-tel",
          "Telemetry",
          "live" if model.telemetry.available else "off",
          _telemetry_panel(model, "panel-tel", now),
      )
  )
720 
  inputs, labels, panels, rules = [], [], [], []
  for idx, (tid, pid, label, badge, panel) in enumerate(tabs):
      checked = " checked" if idx == 0 else ""
      inputs.append(
          f'<input class="tabin" type="radio" name="tab" id="{tid}"{checked}>'
      )
      labels.append(
          f'<label for="{tid}">{escape(label)}'
          f'<span class="badge">{escape(badge)}</span></label>'
      )
      panels.append(panel)
      rules.append(f"#{tid}:checked~main #{pid}{{display:block}}")
      rules.append(
          f"#{tid}:checked~main nav.tabbar label[for={tid}]"
          "{color:var(--fg);border-bottom-color:var(--accent)}"
      )
  tabcss = "".join(rules)
  return (
      '<!doctype html><html lang="en"><head><meta charset="utf-8">'
      '<meta name="viewport" content="width=device-width,initial-scale=1">'
      "<title>froot &middot; read-model</title>"
      f"<style>{_CSS}{tabcss}</style></head><body>"
      + "".join(inputs)
      + "<main>"
      + _header(model)
      + f'<nav class="tabbar">{"".join(labels)}</nav>'
      + "".join(panels)
      + _footer()
      + "</main></body></html>"
  )
751 
752 
753def _footer() -> str:
  return (
      "<footer><b>Authority envelope.</b> froot opens PRs everywhere and "
      "auto-merges only on an allowlisted repo where a class has earned its "
      "gate (the allowlist is empty by default, so commit authority is none "
      "until a steward opts in). Trust is earned, narrow to one loop on one "
      "repo, conditional on its environment "
      '(<span class="mono">gemma4:12b</span>), revocable, and time-expiring. '
      "Everything here is derived per request from GitHub + Temporal + "
      "ClickHouse; froot keeps no database.</footer>"
  )

Verification

Full suite green: 365 tests, mypy clean, ruff clean, both determinism gates green. New tests cover the per-loop partition (each loop its own view; failures attributed by workflow id) and the new render structure (tabs, gate hero + four bearings, per-class table, queue badge, earned pill, determinism + telemetry panels). Rendered with representative data and eyed across all four tabs in light and dark.

tests/test_dashboard_render.py · 393 lines

tests/test_dashboard_render.py393 lines · Python

⋯ 71 lines hidden (lines 1–71)1from __future__ import annotations
2 
3from collections.abc import Sequence
4from datetime import UTC, datetime
5 
6from froot.dashboard import read_model, render
7from froot.dashboard.github_source import GithubPr
8from froot.dashboard.model import ActivityStat, DashboardModel, RunTelemetry
9from froot.dashboard.temporal_source import (
  BumpExecution,
  PrReviewExecution,
  ReviewExecution,
  ScanExecution,
14)
15from froot.policy.autonomy import AutonomyPolicy
16 
17NOW = datetime(2026, 6, 3, 12, 0, tzinfo=UTC)
18REPO = "mseeks/revisionist"
19 
20 
21def _model(
  prs: Sequence[GithubPr] = (),
  scans: Sequence[ScanExecution] = (),
  telemetry: tuple[RunTelemetry, str | None] | None = None,
  reviews: Sequence[ReviewExecution] = (),
  pr_reviews: Sequence[PrReviewExecution] = (),
27) -> DashboardModel:
  if telemetry is None:
      telemetry = (
          RunTelemetry(
              available=False,
              total_spans=0,
              error_spans=0,
              last_activity=None,
              window_days=3,
              activities=(),
          ),
          "off",
      )
  return read_model.assemble(
      now=NOW,
      repos=(REPO,),
      scan_interval_seconds=86_400,
      review_interval_seconds=300,
      github=(tuple(prs), None),
      temporal=((tuple(scans), (), tuple(reviews), tuple(pr_reviews)), None),
      telemetry=telemetry,
  )
49 
50 
51def _pr(number: int, package: str, state: str, **kw) -> GithubPr:
  return GithubPr(
      repo=REPO,
      number=number,
      url=f"https://github.com/{REPO}/pull/{number}",
      package=package,
      from_version=kw.get("from_version"),
      to_version=kw.get("to_version", "1.0.0"),
      verdict=kw.get("verdict"),
      state=state,
      opened_at=kw.get("opened", NOW),
      merged_at=kw.get("merged"),
  )
64 
65 
66# ── the page shell: self-contained, no JS, tabbed ────────────────────────────
67def test_page_is_a_self_contained_html_document():
  html = render.page(_model())
  assert html.startswith("<!doctype html>")
  assert html.rstrip().endswith("</html>")
  assert "http://" not in html and "https://" not in html  # no links
  assert "<script" not in html.lower()  # CSS-only tabs, no JavaScript
73 
74 
75def test_page_is_tabbed_one_per_loop_plus_determinism_and_telemetry():
  html = render.page(_model())
  assert '<nav class="tabbar">' in html
  # CSS-only tabs: hidden radio inputs drive the panels, no script.
  assert 'type="radio"' in html and "<script" not in html.lower()
  for label in ("Dependency-patch", "Determinism review", "Telemetry"):
      assert label in html
  # the footer's authority envelope, trimmed of the word-bomb
  assert "Authority envelope" in html
  assert "froot" in html
85 
86 
87def test_gate_hero_shows_the_four_bearings_and_a_decision():
  html = render.page(_model())
  assert "Earned autonomy" in html and "the gate" in html
  for bearing in ("approval rate", "defect rate", "probe", "deep review"):
      assert bearing in html
  assert "HOLD" in html  # no record yet -> the gate holds
93 
94 
95def test_page_renders_track_record_numbers():
  prs = [
      _pr(1, "a", "merged", opened=NOW, merged=NOW),
      _pr(2, "b", "merged", opened=NOW, merged=NOW),
  ]
⋯ 294 lines hidden (lines 100–393)100    html = render.page(_model(prs=prs))
  assert "100%" in html  # 2/2 approval rate
  assert ">2<" in html  # the proposed count as a card stat
  assert "2 merged" in html
104 
105 
106def test_page_links_open_prs_and_lists_them_in_the_queue():
  prs = [_pr(23, "vitest", "open", to_version="3.2.6")]
  html = render.page(_model(prs=prs))
  assert f"https://github.com/{REPO}/pull/23" in html
  assert "vitest" in html
  assert "#23" in html
112 
113 
114def test_page_escapes_dynamic_content():
  evil = "<script>alert(1)</script>"
  prs = [_pr(1, evil, "merged", opened=NOW, merged=NOW)]
  html = render.page(_model(prs=prs))
  assert "<script>alert(1)</script>" not in html
  assert "&lt;script&gt;" in html
120 
121 
122def test_empty_queue_is_explicit_not_blank():
  html = render.page(_model())
  assert "Nothing awaiting you" in html
125 
126 
127# ── telemetry tab ────────────────────────────────────────────────────────────
128def test_telemetry_panel_reports_unavailable_when_off():
  html = render.page(_model())
  assert "Unavailable" in html
131 
132 
133def test_telemetry_panel_renders_activity_rows_when_available():
  telemetry = (
      RunTelemetry(
          available=True,
          total_spans=75,
          error_spans=10,
          last_activity=datetime(2026, 6, 3, 6, 0, tzinfo=UTC),
          window_days=3,
          activities=(
              ActivityStat(
                  name="open_pull_request",
                  count=14,
                  avg_ms=14162.0,
                  max_ms=55828.0,
              ),
          ),
      ),
      None,
  )
  html = render.page(_model(telemetry=telemetry))
  assert "open_pull_request" in html
  assert ">75<" in html and "spans" in html
155 
156 
157def test_scan_cadence_shows_liveness_and_next_due():
  scans = [
      ScanExecution(
          workflow_id="froot-scan-mseeks-revisionist",
          status="running",
          start=datetime(2026, 6, 3, 6, 0, tzinfo=UTC),
      )
  ]
  html = render.page(_model(scans=scans))
  assert REPO in html  # the class row carries the repo
  assert "next" in html  # the next-due hint for the live loop
168 
169 
170# ── determinism review tab ───────────────────────────────────────────────────
171def _review(status: str = "running") -> ReviewExecution:
  return ReviewExecution(
      workflow_id="froot-review-mseeks-revisionist",
      status=status,
      start=datetime(2026, 6, 3, 6, 0, tzinfo=UTC),
  )
177 
178 
179def _pr_review(
  pr: int,
  findings: int,
  rules: tuple[str, ...],
  comment: str | None = None,
184) -> PrReviewExecution:
  return PrReviewExecution(
      workflow_id=f"froot-pr-review-mseeks-revisionist-{pr}-abc1234def56",
      status="completed",
      start=datetime(2026, 6, 3, 6, 0, tzinfo=UTC),
      close=datetime(2026, 6, 3, 6, 1, tzinfo=UTC),
      pr_number=pr,
      head_sha="abc1234def56",
      findings=findings,
      rules=rules,
      comment_url=comment,
  )
196 
197 
198def test_determinism_tab_has_its_own_treatment_and_empty_state():
  html = render.page(_model())
  assert "Determinism review" in html
  assert "transitive ring" in html
  assert "No PRs reviewed yet" in html
203 
204 
205def test_determinism_tab_counts_a_live_review_loop():
  html = render.page(_model(reviews=[_review("running")]))
  assert "loops live" in html  # the liveness card
  assert ">1<" in html  # one repo covered / one loop live
209 
210 
211def test_flagged_review_renders_rule_count_and_comment_link():
  comment = f"https://github.com/{REPO}/pull/7#issuecomment-1"
  pr_reviews = [_pr_review(7, 1, ("datetime.datetime.now",), comment=comment)]
  html = render.page(_model(pr_reviews=pr_reviews))
  assert "datetime.datetime.now" in html
  assert "1 hazard" in html
  assert "#7" in html
  assert comment in html  # the one-click comment link
219 
220 
221def test_clean_review_renders_clean_not_a_hazard():
  html = render.page(_model(pr_reviews=[_pr_review(8, 0, ())]))
  assert ">clean<" in html
224 
225 
226# ── the gate: per-class standing + queue badge ───────────────────────────────
227def _model_p(
  prs: Sequence[GithubPr],
  bumps: Sequence[BumpExecution],
  policy: AutonomyPolicy,
  outcomes: dict[tuple[str, int], str] | None = None,
232) -> DashboardModel:
  telemetry = (
      RunTelemetry(
          available=False,
          total_spans=0,
          error_spans=0,
          last_activity=None,
          window_days=3,
          activities=(),
      ),
      "off",
  )
  return read_model.assemble(
      now=NOW,
      repos=(REPO,),
      policy=policy,
      scan_interval_seconds=86_400,
      review_interval_seconds=300,
      github=(tuple(prs), None),
      temporal=(((), tuple(bumps), (), ()), None),
      telemetry=telemetry,
      outcomes=outcomes,
  )
255 
256 
257def _clean_green(number: int, package: str) -> tuple[GithubPr, BumpExecution]:
  opened = datetime(2026, 5, 20, 12, 0, tzinfo=UTC)
  merged = datetime(2026, 5, 20, 12, 15, tzinfo=UTC)
  pr = _pr(
      number, package, "merged", verdict="clean", opened=opened, merged=merged
  )
  bump = BumpExecution(
      workflow_id=f"froot-bump-mseeks-revisionist-{package}",
      status="completed",
      start=opened,
      close=merged,
      verdict="clean",
      ci="passed",
      pr_number=number,
      repo=REPO,
      reason=None,
  )
  return pr, bump
275 
276 
277def test_class_table_shows_the_unearned_blocker_with_no_history():
  html = render.page(_model())
  assert "Per-class standing" in html
  assert "only 0/5 decided recently" in html  # the honest blocker
281 
282 
283def test_hero_says_no_classes_when_no_repos_configured():
  model = read_model.assemble(
      now=NOW,
      repos=(),
      scan_interval_seconds=86_400,
      review_interval_seconds=300,
      github=((), None),
      temporal=(((), (), (), ()), None),
      telemetry=(
          RunTelemetry(
              available=False,
              total_spans=0,
              error_spans=0,
              last_activity=None,
              window_days=3,
              activities=(),
          ),
          "off",
      ),
  )
  assert "No classes yet" in render.page(model)
304 
305 
306def test_queue_badge_holds_open_pr_with_substantive_reason():
  prs = [_pr(23, "vitest", "open", verdict="clean", opened=NOW)]
  html = render.page(_model_p(prs, [], AutonomyPolicy()))
  assert "held" in html
  assert "class not earned" in html
311 
312 
313def test_class_earned_pill_and_budget():
  pairs = [_clean_green(n, f"pkg{n}") for n in (1, 2, 3, 4, 5)]
  prs = [p for p, _ in pairs]
  bumps = [b for _, b in pairs]
  policy = AutonomyPolicy(min_decided=3, allowlisted_repos=frozenset({REPO}))
  held = {(REPO, n): "held" for n in (1, 2, 3, 4, 5)}  # defect bearing clean
  html = render.page(_model_p(prs, bumps, policy, outcomes=held))
  assert ">earned<" in html  # the class cleared its gate (the pill)
  assert "budget/wk" in html  # the budget column
322 
323 
324def test_queue_badge_would_auto_merge_on_earned_allowlisted_class():
  pairs = [_clean_green(n, f"pkg{n}") for n in (1, 2, 3)]
  prs = [p for p, _ in pairs]
  bumps = [b for _, b in pairs]
  _, open_bump = _clean_green(9, "axios")
  prs.append(_pr(9, "axios", "open", verdict="clean", opened=NOW))
  bumps.append(open_bump)
  policy = AutonomyPolicy(min_decided=3, allowlisted_repos=frozenset({REPO}))
  held = {(REPO, n): "held" for n in (1, 2, 3)}  # clear the defect bearing
  html = render.page(_model_p(prs, bumps, policy, outcomes=held))
  assert "would auto-merge" in html
335 
336 
337# ── reliability + probes surface in the loop's cards / detail ────────────────
338def _model_outcomes(
  prs: Sequence[GithubPr], outcomes: dict[tuple[str, int], str]
340) -> DashboardModel:
  telemetry = (
      RunTelemetry(
          available=False,
          total_spans=0,
          error_spans=0,
          last_activity=None,
          window_days=3,
          activities=(),
      ),
      "off",
  )
  return read_model.assemble(
      now=NOW,
      repos=(REPO,),
      scan_interval_seconds=86_400,
      review_interval_seconds=300,
      github=(tuple(prs), None),
      temporal=(((), (), (), ()), None),
      telemetry=telemetry,
      outcomes=outcomes,
      reliability_window_days=90,
  )
363 
364 
365def test_defect_rate_card_and_post_merge_tags():
  prs = [
      _pr(1, "a", "merged", opened=NOW, merged=NOW),
      _pr(2, "b", "merged", opened=NOW, merged=NOW),
  ]
  outcomes = {(REPO, 1): "held", (REPO, 2): "broke"}
  html = render.page(_model_outcomes(prs, outcomes))
  assert "defect rate" in html
  assert "50%" in html  # 1 of 2 determined was a defect
  assert ">held<" in html and ">broke<" in html  # the post-merge tags
375 
376 
377def test_canary_escape_shows_in_probes_card_and_segregated():
  # A merged canary (to 99.99.99) is a guardrail hole: the probes card counts
  # the escape, and the canary stays out of the genuine bumps.
  prs = [
      _pr(7, "evil", "merged", to_version="99.99.99", opened=NOW, merged=NOW)
  ]
  html = render.page(_model_outcomes(prs, {}))
  assert "probes escaped" in html
  # the canary is not a real bump -> the track record stays at zero proposed
  assert "evil" not in html
387 
388 
389def test_bumps_fold_lists_bumps_with_post_merge_column():
  prs = [_pr(1, "a", "merged", opened=NOW, merged=NOW)]
  html = render.page(_model_outcomes(prs, {(REPO, 1): "reverted"}))
  assert "post-merge" in html  # the bumps-table column
  assert "reverted" in html  # the per-row post-merge tag