agentboard 0.2.0

data/app/controllers/agentboard/application_controller.rb

@@ -0,0 +1,90 @@
+module Agentboard
+  # Dashboard authentication (spec §14, open decision #1 — recommended default):
+  #   1. host-auth adapter: `config.authenticate_with = ->(controller) { actor_or_nil }`
+  #   2. otherwise local-only access with an optional dashboard token
+  # The engine refuses to serve in production unless explicitly enabled.
+  class ApplicationController < ActionController::Base
+    protect_from_forgery with: :exception
+    layout "agentboard/application"
+
+    before_action :refuse_production!
+    before_action :authenticate_agentboard!
+    around_action :with_correlation
+
+    helper_method :current_actor, :current_project, :pending_approvals_count, :can?, :edition_notices
+
+    rescue_from Agentboard::Error, with: :render_domain_error
+    rescue_from ActiveRecord::StaleObjectError do
+      render_domain_error(Agentboard::Error.version_conflict("Someone else changed this record; reload and try again"))
+    end
+    rescue_from ActiveRecord::RecordInvalid do |e|
+      render_domain_error(Agentboard::Error.validation_failed(e.record.errors.full_messages.to_sentence))
+    end
+
+    private
+
+    def current_actor = @current_actor
+    def can?(permission) = Authorization.allowed?(current_actor, permission)
+    def edition_notices = @edition_notices ||= Extensions.run(:dashboard_notices).flatten.compact.uniq
+    def current_project = @current_project ||= Project.current
+
+    def pending_approvals_count
+      @pending_approvals_count ||= Approval.pending.where(project_id: current_project.id).count
+    end
+
+    def refuse_production!
+      return unless Rails.env.production? && !Agentboard.config.mount_in_production
+
+      head :not_found
+    end
+
+    # Host-app authentication with roles is team mode (AgentBoard Pro). Without a licence
+    # the dashboard falls back to local single-user access instead of failing open.
+    def authenticate_agentboard!
+      hook = Agentboard.config.authenticate_with
+      if hook && Agentboard.feature?(:team_mode)
+        @current_actor = hook.call(self)
+        return head(:unauthorized) unless @current_actor
+      else
+        unless request.local? || Agentboard.config.allow_non_local_requests
+          return render plain: "AgentBoard only accepts local requests by default.", status: :forbidden
+        end
+        if (token = Agentboard.config.dashboard_token).present?
+          if params[:token].present? && ActiveSupport::SecurityUtils.secure_compare(params[:token].to_s, token)
+            session[:agentboard_authenticated] = true
+          end
+          return render(plain: "Dashboard token required (?token=…)", status: :unauthorized) unless session[:agentboard_authenticated]
+        end
+        @current_actor = Authorization.local_human
+      end
+      Current.actor = @current_actor
+    end
+
+    def with_correlation
+      Current.correlation_id = request.request_id.presence || Ids.correlation
+      yield
+    end
+
+    def render_domain_error(error)
+      respond_to do |format|
+        format.json { render json: Result.failure(error, correlation_id: Current.correlation_id).to_h, status: http_status(error) }
+        format.html do
+          flash[:alert] = error.message
+          redirect_back fallback_location: root_path, status: :see_other
+        end
+      end
+    end
+
+    def http_status(error)
+      {
+        "NOT_FOUND" => :not_found, "UNAUTHORIZED" => :unauthorized, "FORBIDDEN" => :forbidden, "VALIDATION_FAILED" => :unprocessable_entity,
+        "VERSION_CONFLICT" => :conflict, "LEASE_CONFLICT" => :conflict, "LEASE_EXPIRED" => :conflict, "INVALID_TRANSITION" => :unprocessable_entity,
+        "POLICY_DENIED" => :forbidden, "APPROVAL_REQUIRED" => :forbidden, "RATE_LIMITED" => :too_many_requests
+      }.fetch(error.code, :unprocessable_entity)
+    end
+
+    def find_ticket(key = params[:ticket_key] || params[:key])
+      Ticket.find_by_key!(key, project: current_project)
+    end
+  end
+end

data/app/controllers/agentboard/approvals_controller.rb

@@ -0,0 +1,15 @@
+module Agentboard
+  class ApprovalsController < ApplicationController
+    def index
+      Approvals.expire_due!
+      @pending = Approval.pending.where(project_id: current_project.id).order(:created_at)
+      @decided = Approval.where(project_id: current_project.id).where.not(decision: "pending").order(updated_at: :desc).limit(50)
+    end
+
+    def update
+      approval = Approval.where(project_id: current_project.id).find(params[:id])
+      Approvals.decide!(approval: approval, actor: current_actor, decision: params.require(:decision), reason: params[:reason].presence)
+      redirect_back fallback_location: approvals_path, notice: "Approval #{params[:decision]}", status: :see_other
+    end
+  end
+end

data/app/controllers/agentboard/assets_controller.rb

@@ -0,0 +1,32 @@
+module Agentboard
+  # Serves the engine's precompiled CSS/JS and the Turbo/Stimulus builds shipped inside their
+  # gems, so the dashboard works with any (or no) host asset pipeline and without Node.
+  class AssetsController < ActionController::Base
+    skip_forgery_protection
+
+    def self.asset_paths
+      @asset_paths ||= {
+        "agentboard.css" => Agentboard::Engine.root.join("app/assets/stylesheets/agentboard/application.css"),
+        "agentboard.js" => Agentboard::Engine.root.join("app/javascript/agentboard/application.js"),
+        "capture.js" => Agentboard::Engine.root.join("app/javascript/agentboard/capture.js"),
+        "turbo.js" => Pathname.new(Gem.loaded_specs.fetch("turbo-rails").full_gem_path).join("app/assets/javascripts/turbo.min.js"),
+        "stimulus.js" => Pathname.new(Gem.loaded_specs.fetch("stimulus-rails").full_gem_path).join("app/assets/javascripts/stimulus.min.js")
+      }
+    end
+
+    def self.fingerprint(name)
+      @fingerprints ||= {}
+      @fingerprints[name] = nil if Rails.env.development?
+      @fingerprints[name] ||= Digest::SHA256.file(asset_paths.fetch(name)).hexdigest[0, 12]
+    end
+
+    def show
+      path = self.class.asset_paths[params[:name]] or return head(:not_found)
+      type = params[:name].end_with?(".css") ? "text/css" : "text/javascript"
+      if params[:v].present? && !Rails.env.development?
+        expires_in 1.year, public: true
+      end
+      send_file path, type: "#{type}; charset=utf-8", disposition: "inline"
+    end
+  end
+end

data/app/controllers/agentboard/board_controller.rb

@@ -0,0 +1,46 @@
+module Agentboard
+  class BoardController < ApplicationController
+    def show
+      @filters = params.permit(:q, :kind, :priority, :label, :agent, :milestone).to_h.compact_blank
+      scope = current_project.tickets.where(status: StateMachines::Ticket::BOARD_COLUMNS + %w[blocked reopened])
+                             .includes(:project, :acceptance_criteria, :leases, :executions, :depends_on)
+      scope = apply_filters(scope)
+      tickets = scope.ordered.to_a
+      done_cutoff = Agentboard.config.settings.dig("board", "done_visible_days").to_i.days.ago
+      @columns = Agentboard.config.board_columns.index_with { [] }
+      tickets.each do |t|
+        col = if t.status == "blocked" && t.leases.any? { |l| l.released_at.nil? }
+          Agentboard.config.board_column_for("in_progress")
+        else
+          Agentboard.config.board_column_for(t.status)
+        end
+        next if t.status == "done" && t.completed_at && t.completed_at < done_cutoff
+
+        @columns[col] << t
+      end
+      @labels = current_project.tickets.pluck(:labels).flatten.uniq.sort
+      @milestones = current_project.milestones.where(status: "open").order(:target_date, :name)
+      @active_executions = Execution.active.joins(:ticket).where(agentboard_tickets: { project_id: current_project.id }).includes(:ticket).limit(6)
+    end
+
+    private
+
+    def apply_filters(scope)
+      if (q = @filters["q"]).present?
+        if (m = q.strip.upcase.match(/\A#{Regexp.escape(current_project.key)}-(\d+)\z/))
+          scope = scope.where(number: m[1].to_i)
+        else
+          scope = scope.where("LOWER(title) LIKE :q OR LOWER(description) LIKE :q", q: "%#{ActiveRecord::Base.sanitize_sql_like(q.downcase)}%")
+        end
+      end
+      scope = scope.where(kind: @filters["kind"]) if @filters["kind"].present?
+      scope = scope.where(milestone_id: @filters["milestone"]) if @filters["milestone"].present?
+      scope = scope.where(priority: @filters["priority"].to_i) if @filters["priority"].present?
+      if @filters["label"].present?
+        ids = scope.select { |t| t.labels.include?(@filters["label"]) }.map(&:id)
+        scope = scope.where(id: ids)
+      end
+      scope
+    end
+  end
+end

data/app/controllers/agentboard/captures_controller.rb

@@ -0,0 +1,17 @@
+module Agentboard
+  class CapturesController < ApplicationController
+    def create
+      return head(:not_found) unless Capture.enabled_for_env?
+
+      ticket = Captures.create!(project: current_project, actor: current_actor, params: params.require(:capture).to_unsafe_h)
+      render json: { ok: true, key: ticket.key, url: ticket_url(ticket) }, status: :created
+    end
+
+    def screenshot
+      artifact = Artifact.joins(:ticket).where(agentboard_tickets: { project_id: current_project.id }, kind: "screenshot").find(params[:id])
+      path = artifact.uri.delete_prefix("file:")
+      PathGuard.within!(Agentboard.config.root_path.join(".agentboard", "captures"), path)
+      send_file path, type: "image/png", disposition: "inline"
+    end
+  end
+end

data/app/controllers/agentboard/comments_controller.rb

@@ -0,0 +1,9 @@
+module Agentboard
+  class CommentsController < ApplicationController
+    def create
+      ticket = find_ticket
+      Tickets.add_comment!(ticket: ticket, actor: current_actor, body: params.require(:comment).require(:body))
+      redirect_to ticket_path(ticket, anchor: "activity"), status: :see_other
+    end
+  end
+end

data/app/controllers/agentboard/criteria_controller.rb

@@ -0,0 +1,17 @@
+module Agentboard
+  class CriteriaController < ApplicationController
+    def create
+      ticket = find_ticket
+      Tickets.add_criterion!(ticket: ticket, actor: current_actor, description: params.require(:criterion).require(:description),
+                             verification_kind: params.dig(:criterion, :verification_kind).presence || "manual")
+      redirect_to ticket_path(ticket, anchor: "criteria"), status: :see_other
+    end
+
+    def update
+      ticket = find_ticket
+      criterion = ticket.acceptance_criteria.find(params[:id])
+      Tickets.set_criterion_state!(criterion: criterion, actor: current_actor, state: params.require(:state), evidence_id: params[:evidence_id].presence)
+      redirect_to ticket_path(ticket, anchor: "criteria"), status: :see_other
+    end
+  end
+end

data/app/controllers/agentboard/dependencies_controller.rb

@@ -0,0 +1,20 @@
+module Agentboard
+  class DependenciesController < ApplicationController
+    def create
+      ticket = find_ticket
+      other = Ticket.find_by_key!(params.require(:depends_on), project: current_project)
+      Tickets.add_dependency!(ticket: ticket, depends_on: other, actor: current_actor)
+      redirect_to ticket_path(ticket), notice: "#{ticket.key} now depends on #{other.key}", status: :see_other
+    end
+
+    def destroy
+      ticket = find_ticket
+      Authorization.authorize!(current_actor, "ticket.write")
+      dep = ticket.dependencies.find(params[:id])
+      dep.destroy!
+      EventStore.append!(type: "ticket.dependency_removed", aggregate: ticket, ticket: ticket, actor: current_actor,
+                         payload: { depends_on: dep.depends_on_ticket.key })
+      redirect_to ticket_path(ticket), status: :see_other
+    end
+  end
+end

data/app/controllers/agentboard/executions_controller.rb

@@ -0,0 +1,48 @@
+module Agentboard
+  class ExecutionsController < ApplicationController
+    before_action :load_execution, except: :index
+
+    def index
+      @status = params[:status].presence
+      scope = Execution.joins(:ticket).where(agentboard_tickets: { project_id: current_project.id }).includes(:ticket, :verification_results).recent
+      scope = scope.where(status: @status) if @status
+      @executions = scope.limit(200)
+      @daemon = Runtime::DaemonControl.status
+    end
+
+    def show
+      @events = Event.where(execution_id: @execution.id).order(:received_at, :id).last(400)
+      @results = @execution.verification_results
+      @usage = @execution.usage_records
+      @artifacts = @execution.artifacts.order(:created_at)
+      @daemon = Runtime::DaemonControl.status
+      @pending_approvals = Approval.pending.where(execution_id: @execution.id).order(:created_at)
+    end
+
+    def cancel
+      Executions.request_cancel!(execution: @execution, actor: current_actor, reason: params[:reason].presence || "cancelled from dashboard")
+      redirect_to execution_path(@execution), notice: "Cancellation requested", status: :see_other
+    end
+
+    def retry
+      execution = Executions.retry!(execution: @execution, actor: current_actor)
+      redirect_to execution_path(execution), notice: "Retry queued as attempt #{execution.attempt}", status: :see_other
+    end
+
+    def resume
+      execution = Executions.resume!(execution: @execution, actor: current_actor, message: params[:message].presence || "Continue the task.")
+      redirect_to execution_path(execution), notice: "Resuming the provider session as attempt #{execution.attempt}", status: :see_other
+    end
+
+    # Redacted log tail for the console (polled).
+    def log
+      render plain: Redactor.redact(@execution.log_tail(bytes: 48 * 1024)), content_type: "text/plain"
+    end
+
+    private
+
+    def load_execution
+      @execution = Execution.joins(:ticket).where(agentboard_tickets: { project_id: current_project.id }).find(params[:id])
+    end
+  end
+end

data/app/controllers/agentboard/milestones_controller.rb

@@ -0,0 +1,23 @@
+module Agentboard
+  class MilestonesController < ApplicationController
+    def index
+      @milestones = current_project.milestones.order(Arel.sql("CASE WHEN status = 'open' THEN 0 ELSE 1 END"), :target_date, :name)
+      @progress = Ticket.where(milestone_id: @milestones.map(&:id)).group(:milestone_id, :status).count
+    end
+
+    def create
+      Authorization.authorize!(current_actor, "ticket.write")
+      p = params.require(:milestone).permit(:name, :target_date)
+      m = current_project.milestones.create!(name: p[:name], target_date: p[:target_date].presence)
+      EventStore.append!(type: "milestone.created", aggregate: m, project: current_project, actor: current_actor, payload: { name: m.name, target_date: m.target_date })
+      redirect_to milestones_path, notice: "Milestone created", status: :see_other
+    end
+
+    def update
+      Authorization.authorize!(current_actor, "ticket.write")
+      m = current_project.milestones.find(params[:id])
+      m.update!(status: params.require(:status).presence_in(%w[open closed]) || m.status)
+      redirect_to milestones_path, status: :see_other
+    end
+  end
+end

data/app/controllers/agentboard/pulse_controller.rb

@@ -0,0 +1,12 @@
+module Agentboard
+  # Lightweight change feed for live updates without ActionCable: clients poll the latest
+  # event cursor and morph-refresh the page when it moves.
+  class PulseController < ApplicationController
+    def show
+      latest = Event.where(project_id: [ current_project.id, nil ]).order(received_at: :desc, id: :desc).pick(:id, :received_at)
+      active = Execution.active.joins(:ticket).where(agentboard_tickets: { project_id: current_project.id }).count
+      render json: { cursor: latest&.first, at: latest&.last&.utc&.iso8601(3), active_executions: active,
+                     pending_approvals: pending_approvals_count }
+    end
+  end
+end

data/app/controllers/agentboard/sessions_controller.rb

@@ -0,0 +1,19 @@
+module Agentboard
+  # Dashboard association (precedence 3) and confirmation of heuristic links.
+  class SessionsController < ApplicationController
+    def update
+      session_record = AgentSession.where(project_id: current_project.id).find(params[:id])
+      if params[:revoke] == "1"
+        SessionCredential.revoke!(session_record, actor: current_actor, reason: "revoked from dashboard")
+        return redirect_back(fallback_location: agents_path, notice: "Session revoked; its MCP tools now fail with UNAUTHORIZED", status: :see_other)
+      end
+      if params[:ticket_key].present?
+        ticket = Ticket.find_by_key!(params[:ticket_key], project: current_project)
+        SessionAssociation.link!(session: session_record, ticket: ticket, source: "dashboard", actor: current_actor)
+      else
+        SessionAssociation.unlink!(session: session_record, actor: current_actor)
+      end
+      redirect_back fallback_location: agents_path, status: :see_other
+    end
+  end
+end

data/app/controllers/agentboard/settings_controller.rb

@@ -0,0 +1,9 @@
+module Agentboard
+  class SettingsController < ApplicationController
+    def show
+      @config = Agentboard.config
+      @doctor = Doctor.new(root: Agentboard.config.root_path).checks
+      @outbox = Outbox.stats
+    end
+  end
+end

data/app/controllers/agentboard/tickets_controller.rb

@@ -0,0 +1,139 @@
+module Agentboard
+  class TicketsController < ApplicationController
+    before_action :load_ticket, except: %i[index new create]
+
+    # Backlog: dense, filterable list of every ticket.
+    def index
+      @status = params[:status].presence
+      scope = current_project.tickets.includes(:project, :acceptance_criteria, :leases, :executions).ordered
+      scope = scope.where(status: @status) if @status
+      scope = scope.where(kind: params[:kind]) if params[:kind].present?
+      if params[:q].present?
+        scope = scope.where("LOWER(title) LIKE ?", "%#{ActiveRecord::Base.sanitize_sql_like(params[:q].downcase)}%")
+      end
+      @tickets = scope.limit(500)
+      @counts = current_project.tickets.group(:status).count
+    end
+
+    def show
+      @events = @ticket.events.last(200).reverse
+      @executions = @ticket.executions.includes(:verification_results).limit(20)
+      @artifacts = @ticket.artifacts.limit(50)
+      @approvals = Approval.where(ticket_id: @ticket.id).order(created_at: :desc).limit(20)
+      @head_sha = Evidence.head_sha(@ticket)
+      @checks = CompletionPolicy.checks_report(@ticket, head_sha: @head_sha)
+      @completion = CompletionPolicy.evaluate(@ticket)
+      @sessions = @ticket.session_links.includes(:agent_session).order(started_at: :desc).limit(10)
+      @providers = Providers.registry.keys.select { |k| Agentboard.config.provider_enabled?(k) }
+      @workflows = WorkflowDefinition.where(project: current_project).group_by(&:name).map { |_, v| v.max_by(&:version) }
+      @other_tickets = current_project.tickets.where.not(id: @ticket.id).open.ordered.limit(200)
+    end
+
+    def new
+      @ticket = current_project.tickets.new(kind: "task", priority: 2, status: params[:status].presence_in(%w[backlog ready]) || "backlog")
+    end
+
+    def create
+      p = ticket_params
+      @ticket = Tickets.create!(project: current_project, actor: current_actor, title: p[:title], description: p[:description].to_s,
+                                kind: p[:kind].presence || "task", priority: p[:priority].presence || 2,
+                                labels: p[:labels].to_s.split(","), criteria: p[:criteria].to_s.lines,
+                                status: (p[:status].presence_in(%w[backlog ready]) || "backlog"),
+                                parent: p[:parent_id].present? ? current_project.tickets.find(p[:parent_id]) : nil,
+                                milestone: p[:milestone_id].present? ? current_project.milestones.find(p[:milestone_id]) : nil)
+      redirect_to ticket_path(@ticket), notice: "#{@ticket.key} created"
+    rescue Agentboard::Error => e
+      @ticket = current_project.tickets.new(title: p[:title], description: p[:description], kind: p[:kind], priority: p[:priority])
+      flash.now[:alert] = e.message
+      render :new, status: :unprocessable_entity
+    end
+
+    def edit; end
+
+    def update
+      Tickets.update!(ticket: @ticket, actor: current_actor, attributes: ticket_params.except(:criteria, :status), expected_version: params[:lock_version])
+      redirect_to ticket_path(@ticket), notice: "Saved"
+    end
+
+    def transition
+      to = params.require(:to)
+      Tickets.transition!(ticket: @ticket, to: to, actor: current_actor, reason: params[:reason].presence,
+                          override_criteria: params[:override_criteria] == "1", verification_requested: params[:verification_requested] == "1",
+                          expected_version: params[:lock_version].presence)
+      respond_to do |format|
+        format.json { render json: Result.success({ key: @ticket.key, status: @ticket.reload.status, version: @ticket.lock_version }).to_h }
+        format.html { redirect_back fallback_location: ticket_path(@ticket), notice: "#{@ticket.key} → #{StateMachines::Ticket::LABELS[to]}", status: :see_other }
+      end
+    end
+
+    # Board drag & drop: server-validated transition plus ordering.
+    def move
+      to = params.require(:to)
+      Tickets.transition!(ticket: @ticket, to: to, actor: current_actor, reason: params[:reason].presence) if to != @ticket.status
+      Tickets.reorder!(ticket: @ticket, actor: current_actor, position: params[:position]) if params[:position].present?
+      render json: Result.success({ key: @ticket.key, status: @ticket.reload.status }).to_h
+    end
+
+    def verify
+      results = VerificationService.verify_repository!(ticket: @ticket, actor: current_actor)
+      passed = results.count(&:passed?)
+      redirect_to ticket_path(@ticket), notice: "Verification finished: #{passed}/#{results.size} checks passed", status: :see_other
+    end
+
+    def run
+      if params[:workflow].present?
+        definition = WorkflowEngine.latest(project: current_project, name: params[:workflow])
+        run = WorkflowEngine.start!(definition: definition, ticket: @ticket, actor: current_actor)
+        redirect_to workflow_run_path(run), notice: "Workflow #{definition.name} started", status: :see_other
+      else
+        execution = Executions.enqueue!(ticket: @ticket, provider_key: params.require(:provider), actor: current_actor,
+                                        action: params[:action_name].presence || "implement",
+                                        idempotency_key: params[:idempotency_key].presence,
+                                        metadata: params[:scenario].present? ? { "scenario" => params[:scenario] } : {})
+        notice = Runtime::DaemonControl.status[:running] ? "Execution queued" : "Execution queued — start the runtime with `bundle exec agentboard daemon start`"
+        redirect_to execution_path(execution), notice: notice, status: :see_other
+      end
+    end
+
+    def complete
+      CompletionPolicy.complete!(ticket: @ticket, actor: current_actor, expected_version: params[:lock_version].presence)
+      redirect_to ticket_path(@ticket), notice: "#{@ticket.key} is done", status: :see_other
+    end
+
+    def suggestions
+      @suggestions = TicketAdvisor.suggest(@ticket)
+      render layout: false
+    end
+
+    # A human accepts one suggestion; it goes through the normal domain services.
+    def accept_suggestion
+      value = params.require(:value).to_s
+      case params.require(:kind)
+      when "criterion" then Tickets.add_criterion!(ticket: @ticket, actor: current_actor, description: value)
+      when "subtask"
+        Tickets.create!(project: current_project, actor: current_actor, title: value, parent: @ticket, kind: "task", priority: @ticket.priority)
+      when "dependency"
+        Tickets.add_dependency!(ticket: @ticket, depends_on: Ticket.find_by_key!(value, project: current_project), actor: current_actor)
+      when "complexity"
+        Tickets.update!(ticket: @ticket, actor: current_actor, attributes: { labels: (@ticket.labels.reject { |l| l.start_with?("size:") } + [ "size:#{value}" ]) })
+      else
+        raise Error.validation_failed("Unknown suggestion kind")
+      end
+      redirect_to ticket_path(@ticket), notice: "Suggestion accepted", status: :see_other
+    end
+
+    def link_pr
+      PullRequests.link_manually!(ticket: @ticket, actor: current_actor, url: params.require(:url), state: params.require(:state),
+                                       merge_commit_sha: params[:merge_commit_sha].presence)
+      redirect_to ticket_path(@ticket), notice: "Pull request linked", status: :see_other
+    end
+
+    private
+
+    def load_ticket = @ticket = find_ticket(params[:key])
+
+    def ticket_params
+      params.require(:ticket).permit(:title, :description, :kind, :priority, :labels, :criteria, :status, :milestone_id, :parent_id)
+    end
+  end
+end

data/app/controllers/agentboard/workflow_runs_controller.rb

@@ -0,0 +1,16 @@
+module Agentboard
+  class WorkflowRunsController < ApplicationController
+    before_action { @run = WorkflowRun.joins(:ticket).where(agentboard_tickets: { project_id: current_project.id }).find(params[:id]) }
+
+    def show
+      @definition = @run.definition
+      @steps = @run.current_steps
+      @all_steps = @run.steps.includes(:executions).order(:created_at)
+    end
+
+    def cancel
+      WorkflowEngine.cancel!(run: @run, actor: current_actor, reason: "cancelled from dashboard")
+      redirect_to workflow_run_path(@run), status: :see_other
+    end
+  end
+end

data/app/controllers/agentboard/workflows_controller.rb

@@ -0,0 +1,62 @@
+module Agentboard
+  class WorkflowsController < ApplicationController
+    SAMPLE = <<~YAML
+      version: 1
+      name: feature_delivery
+      steps:
+        - id: plan
+          type: agent
+          provider: fake
+          action: plan
+        - id: implement
+          type: agent
+          provider: fake
+          action: implement
+          depends_on: [plan]
+        - id: test
+          type: command
+          command: rails_test
+          depends_on: [implement]
+        - id: review
+          type: agent
+          provider: fake
+          action: review
+          depends_on: [test]
+        - id: approval
+          type: human_approval
+          depends_on: [review]
+    YAML
+
+    def index
+      WorkflowEngine.sync_from_disk!(project: current_project) if params[:sync]
+      @definitions = WorkflowDefinition.where(project: current_project).order(:name, version: :desc).group_by(&:name)
+      @runs = WorkflowRun.joins(:ticket).where(agentboard_tickets: { project_id: current_project.id }).includes(:ticket, :workflow_definition, :steps)
+                         .order(created_at: :desc).limit(30)
+      @yaml = params[:yaml].presence || SAMPLE
+    end
+
+    def show
+      @definition = WorkflowDefinition.where(project: current_project).find(params[:id])
+      @parsed = @definition.parsed
+    end
+
+    def validate
+      definition = Workflows::Definition.parse_yaml(params.require(:yaml), enforce_features: true)
+      render json: { ok: true, name: definition.name, steps: definition.topological_order, digest: definition.digest }
+    rescue Agentboard::Error => e
+      render json: { ok: false, errors: e.details[:errors] || [ e.message ] }, status: :unprocessable_entity
+    end
+
+    def create
+      definition = WorkflowEngine.register!(project: current_project, yaml: params.require(:yaml), actor: current_actor)
+      redirect_to workflow_path(definition), notice: "Registered #{definition.name} v#{definition.version}", status: :see_other
+    end
+
+    def start
+      definition = WorkflowDefinition.where(project: current_project).find(params[:id])
+      ticket = Ticket.find_by_key!(params.require(:ticket_key), project: current_project)
+      run = WorkflowEngine.start!(definition: definition, ticket: ticket, actor: current_actor)
+      redirect_to workflow_run_path(run), status: :see_other
+    end
+  end
+end