PR_26171_GAMMA_011-admin-system-health-foundation

[ToolboxAid]

Summary

• Creates the Admin System Health foundation as a static Theme V2 Admin page.
• Presents Environment Summary, Postgres-only Database Health, Cloudflare R2 Storage Health, Runtime Environment, Limits & Capacity, Diagnostics Plan, and Diagnostics Log sections.
• Wires queued runtime diagnostics for Postgres, Cloudflare R2, and runtime environment visibility through safe Admin System Health contracts.
• Updates existing Admin System Health Playwright route coverage for the foundation and runtime diagnostics view.

Queued Scope 012 Update

PR_26171_GAMMA_012-admin-system-health-status-reason-cleanup was applied to this existing draft PR/workstream branch by owner direction.

• Removed the fake FAIL diagnostics row.
• Replaced placeholder WARN health statuses with PASS for declared facts and PENDING for intentionally unwired foundation checks.
• Added title/aria-label reason text for every non-PASS status.
• Preserved Postgres-only and Cloudflare R2 wording.
• Did not add persistence, API wiring, SQLite, samples, or a separate PR012 GitHub PR.

Queued Scope 013 Update

PR_26171_GAMMA_013-admin-system-health-diagnostics-plan was applied to this existing draft PR/workstream branch by owner direction.

• Added a table-first Diagnostics Plan section.
• Defined future checks for Postgres connection, Postgres migration reader, R2 bucket configuration, R2 list/read/write/delete, runtime environment masking, and limits/capacity metrics.
• Kept all unwired diagnostics plan checks as PENDING with title/aria-label reason text.
• Preserved Theme V2 only, Postgres/R2 wording, masked secret display, and no client-side secret exposure.
• Did not add API wiring, persistence, SQLite, samples, or a separate PR013 GitHub PR.

Queued Scope 014 Update

PR_26171_GAMMA_014-admin-postgres-diagnostics-runtime was applied to this existing draft PR/workstream branch by owner direction.

• Wired the Database Health table to the existing safe Admin System Health status API.
• Rendered Postgres provider, host, port, database, migration summary, and connection status.
• Preserved secret masking and refused unsafe secret-bearing responses.
• Kept R2 and runtime environment wiring out of PR014 scope.
• Did not add persistence, SQLite, storage connectivity action wiring, samples, or a separate PR014 GitHub PR.
• Commit: 297108b15
• ZIP: tmp/PR_26171_GAMMA_014-admin-postgres-diagnostics-runtime_delta.zip

Queued Scope 015 Update

PR_26171_GAMMA_015-admin-r2-diagnostics-runtime was applied to this existing draft PR/workstream branch by owner direction.

• Wired the Storage Health table to existing safe Cloudflare R2 status and connectivity contracts.
• Rendered bucket configured state, list check, read check, write check, and delete check.
• Used the existing storage connectivity action contract for list/write/read/delete diagnostics.
• Preserved credential masking and blocked unsafe secret-bearing responses.
• Did not add new persistence code, SQLite, storage action buttons, samples, or a separate PR015 GitHub PR.
• Commit: d69a02c15
• ZIP: tmp/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime_delta.zip

Queued Scope 016 Update

PR_26171_GAMMA_016-admin-runtime-environment-runtime was applied to this existing draft PR/workstream branch by owner direction.

• Extended the existing Admin System Health status payload with server-owned runtime environment key visibility.
• Rendered loaded runtime environment keys alphabetically.
• Masked secret-like values for PASSWORD, SECRET, TOKEN, KEY, SERVICE_ROLE, JWT, and DATABASE_URL.
• Returned safe display states only: configured, not configured, or ********.
• Verified secret test values are absent from both page text and client-visible Admin System Health API response bodies.
• Did not add persistence, SQLite, raw env value exposure, samples, or a separate PR016 GitHub PR.
• Commit: 1806adbf5
• ZIP: tmp/PR_26171_GAMMA_016-admin-runtime-environment-runtime_delta.zip

Validation

• git diff --check
• Targeted static Admin page checks for requested section labels, table rows, and reason text for non-PASS statuses.
• Targeted status cleanup static check verified no fake failure text and no placeholder WARN/FAIL health status cells in the static HTML.
• Targeted static checks verified no inline styles, no inline scripts, and no inline handlers.
• Targeted PR014/PR015/PR016 diff checks verified no SQLite text was introduced in the changed page/runtime/server diffs.
• Targeted PR014 source check verified Postgres diagnostics use the safe status endpoint without exposing a full Postgres URL.
• Targeted PR015 source check verified R2 diagnostics use the existing safe storage connectivity API client action.
• Targeted PR016 source check verified no raw env value fields such as value: env[...], rawValue, or actualValue were introduced.
• Targeted PR016 source check verified all required runtime secret mask markers are present.
• Targeted Playwright behavior verified /api/admin/system-health/status is called only for Admin sessions.
• Targeted Playwright behavior verified /api/admin/system-health/storage-connectivity-action is called four times for Admin sessions.
• Targeted Playwright behavior verified non-admin sessions do not call status or storage connectivity endpoints.
• Targeted Playwright behavior verified no full Postgres URL or configured secret values are exposed.
• Targeted Playwright behavior verified runtime env keys render alphabetically and secret-like test values are masked in page text plus API response bodies.
• npx playwright test tests/playwright/tools/AdminHealthOperationsPage.spec.mjs --config=codex_playwright_system_chrome.config.cjs --project=playwright (3 passed)
• Playwright V8 coverage after PR016: (90%) assets/theme-v2/js/admin-system-health.js; advisory WARN for src/dev-runtime/server/local-api-router.mjs because browser V8 coverage does not collect server-side runtime files.

Skipped by request:

• Full samples smoke, because this PR does not touch sample runtime behavior.
• Full Playwright suite, because targeted Admin route coverage was sufficient for the changed route and payload behavior.

Reports

• docs_build/dev/reports/codex_review.diff
• docs_build/dev/reports/codex_changed_files.txt
• docs_build/dev/reports/PR_26171_GAMMA_011-admin-system-health-foundation.md
• docs_build/dev/reports/PR_26171_GAMMA_011-admin-system-health-foundation-manual-validation-notes.md
• docs_build/dev/reports/PR_26171_GAMMA_011-admin-system-health-foundation-instruction-compliance-checklist.md
• docs_build/dev/reports/PR_26171_GAMMA_012-admin-system-health-status-reason-cleanup.md
• docs_build/dev/reports/PR_26171_GAMMA_012-admin-system-health-status-reason-cleanup-manual-validation-notes.md
• docs_build/dev/reports/PR_26171_GAMMA_012-admin-system-health-status-reason-cleanup-instruction-compliance-checklist.md
• docs_build/dev/reports/PR_26171_GAMMA_013-admin-system-health-diagnostics-plan.md
• docs_build/dev/reports/PR_26171_GAMMA_013-admin-system-health-diagnostics-plan-manual-validation-notes.md
• docs_build/dev/reports/PR_26171_GAMMA_013-admin-system-health-diagnostics-plan-instruction-compliance-checklist.md
• docs_build/dev/reports/PR_26171_GAMMA_014-admin-postgres-diagnostics-runtime.md
• docs_build/dev/reports/PR_26171_GAMMA_014-admin-postgres-diagnostics-runtime-manual-validation-notes.md
• docs_build/dev/reports/PR_26171_GAMMA_014-admin-postgres-diagnostics-runtime-instruction-compliance-checklist.md
• docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime.md
• docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime-manual-validation-notes.md
• docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime-instruction-compliance-checklist.md
• docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime.md
• docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-manual-validation-notes.md
• docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-instruction-compliance-checklist.md
• docs_build/dev/reports/playwright_v8_coverage_report.txt
• docs_build/dev/reports/coverage_changed_js_guardrail.txt

Merge Control

Draft PR only. Not merged. EOD merge remains owner-controlled and requires explicit approval.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1806adbf5d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update stale system-health wireframe coverage

This updated targeted spec matches the new System Health markup, but the existing tests/playwright/tools/AdminPlatformToolsWireframes.spec.mjs adminPage.systemHealth branch still asserts the removed legacy selectors and buttons (for example lines 582-678 check [data-admin-system-health-status], [data-admin-system-health-summary-rows], and [data-admin-system-health-storage-action='storage-list']). When that existing admin wireframe spec runs against this refactored page, those locators no longer exist, so the full Playwright admin wireframe suite will fail; update that spec or preserve compatible test targets with this markup change.

Useful? React with 👍 / 👎.