F11.3: Local web "fleet IDE" (`sith ui`)

[gnanirahulnutakki]

Part of epic #29 (E11). Milestone: Phase L (day-0 adoption wedge). Source: docs/EPICS.md / docs/SITH-NOTION.md.

F11.3 — Local web "fleet IDE" (sith ui)

What it is. The same fleet model served as a local web UI on localhost — the visual
"Lens-but-better" surface — from the same binary's embedded frontend.

How it works.

1. sith ui starts a localhost server binding the embedded web frontend to the local fleet model.
2. The frontend is the same one E8 serves in hub mode; here it runs single-user, kubeconfig-direct.
3. It offers aggregated multi-cluster views, fleet search/correlation, and per-pod table stakes.
4. It binds to loopback only; no external listener, no account, no telemetry.

flowchart TD
    A["sith ui"] --> B["Localhost server + embedded frontend"]
    B --> C["Same source-abstract fleet model (local source)"]
    B --> D{"Bind scope?"}
    D -- "loopback only" --> E["Single-user, no account, no telemetry"]
    D -- "external" --> X["Refused — local mode is loopback only"]

Loading

Acceptance criteria.

• sith ui serves the aggregated fleet view on localhost with no account and no telemetry.
• It reuses the same frontend as the hub console (one codebase, two modes).

Key risk / guardrail. Accidentally exposing local mode on a routable interface. Guardrail:
local mode binds loopback only; serving beyond the machine is a hub-mode decision with authn.

---

Spec & slice. Slice 4 of docs/BUILD-SEQUENCE.md (PR #40). AC: sith ui serves the aggregated fleet on localhost, binds loopback only (external bind refused — invariant test), no account/telemetry; reuses the same frontend as the hub console (E8), embedded via //go:embed.

[gnanirahulnutakki]

Implemented and released.

• Feature PR: feat: add the local fleet IDE #57, merged to dev as eaf7daf
• Release PR: release: promote Slice 4 local fleet IDE #58, merged to main as 0245a28
• Signed GSTACK checkpoints: 25aba5f, 779a0ac, 23b96be
• Local make ci: green; internal/webui coverage 73.6%
• Digest-pinned two-kind-cluster race gate: green in 73.798s
• Feature CI: green in 2m36s
• Post-merge dev CI: green in 2m27s, including real two-cluster fan-out
• Release and post-merge main CodeQL: Actions and Go green
• Dependabot / CodeQL / secret-scanning open alerts: 0 / 0 / 0 before release

Acceptance is covered by loopback refusal tests, exact Host/Origin and per-process capability enforcement, embedded same-model frontend, no remote assets/account/telemetry, cache search/correlation parity, exact-context operations, explicit Secret disclosure, preview-bound apply, and real forwarded HTTP against both clusters.