@aiwg/cockpit 2026.7.21 → 2026.7.24

package/web/dist/assets/index-CesGeDud.css

@@ -0,0 +1,32 @@
+/**
+ * Copyright (c) 2014 The xterm.js authors. All rights reserved.
+ * Copyright (c) 2012-2013, Christopher Jeffrey (MIT License)
+ * https://github.com/chjj/term.js
+ * @license MIT
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * Originally forked from (with the author's permission):
+ *   Fabrice Bellard's javascript vt100 for jslinux:
+ *   http://bellard.org/jslinux/
+ *   Copyright (c) 2011 Fabrice Bellard
+ *   The original design remains. The terminal itself
+ *   has been extended to include xterm CSI codes, among
+ *   other features.
+ */.xterm{cursor:text;position:relative;user-select:none;-ms-user-select:none;-webkit-user-select:none}.xterm.focus,.xterm:focus{outline:none}.xterm .xterm-helpers{position:absolute;top:0;z-index:5}.xterm .xterm-helper-textarea{padding:0;border:0;margin:0;position:absolute;opacity:0;left:-9999em;top:0;width:0;height:0;z-index:-5;white-space:nowrap;overflow:hidden;resize:none}.xterm .composition-view{background:#000;color:#fff;display:none;position:absolute;white-space:nowrap;z-index:1}.xterm .composition-view.active{display:block}.xterm .xterm-viewport{background-color:#000;overflow-y:scroll;cursor:default;position:absolute;right:0;left:0;top:0;bottom:0}.xterm .xterm-screen{position:relative}.xterm .xterm-screen canvas{position:absolute;left:0;top:0}.xterm .xterm-scroll-area{visibility:hidden}.xterm-char-measure-element{display:inline-block;visibility:hidden;position:absolute;top:0;left:-9999em;line-height:normal}.xterm.enable-mouse-events{cursor:default}.xterm.xterm-cursor-pointer,.xterm .xterm-cursor-pointer{cursor:pointer}.xterm.column-select.focus{cursor:crosshair}.xterm .xterm-accessibility:not(.debug),.xterm .xterm-message{position:absolute;left:0;top:0;bottom:0;right:0;z-index:10;color:transparent;pointer-events:none}.xterm .xterm-accessibility-tree:not(.debug) *::selection{color:transparent}.xterm .xterm-accessibility-tree{-webkit-user-select:text;user-select:text;white-space:pre}.xterm .live-region{position:absolute;left:-9999px;width:1px;height:1px;overflow:hidden}.xterm-dim{opacity:1!important}.xterm-underline-1{text-decoration:underline}.xterm-underline-2{text-decoration:double underline}.xterm-underline-3{text-decoration:wavy underline}.xterm-underline-4{text-decoration:dotted underline}.xterm-underline-5{text-decoration:dashed underline}.xterm-overline{text-decoration:overline}.xterm-overline.xterm-underline-1{text-decoration:overline underline}.xterm-overline.xterm-underline-2{text-decoration:overline double underline}.xterm-overline.xterm-underline-3{text-decoration:overline wavy underline}.xterm-overline.xterm-underline-4{text-decoration:overline dotted underline}.xterm-overline.xterm-underline-5{text-decoration:overline dashed underline}.xterm-strikethrough{text-decoration:line-through}.xterm-screen .xterm-decoration-container .xterm-decoration{z-index:6;position:absolute}.xterm-screen .xterm-decoration-container .xterm-decoration.xterm-decoration-top-layer{z-index:7}.xterm-decoration-overview-ruler{z-index:8;position:absolute;top:0;right:0;pointer-events:none}.xterm-decoration-top{z-index:2;position:relative}:root{color-scheme:dark;--bg:#0b1220;--panel:#111827;--glass:rgba(15,23,42,.82);--fg:#f8fafc;--muted:#cbd5e1;--line:#334155;--ok:#86efac;--warn:#fde68a;--idle:#94a3b8;--accent:#5eead4;--accent2:#93c5fd;--accent3:#c4b5fd;--accent4:#86efac;--err:#fda4af}*{box-sizing:border-box}body{margin:0;font:15px/1.5 system-ui,sans-serif;background:var(--bg);color:var(--fg);overflow-x:hidden}header{padding:12px 22px;border-bottom:1px solid var(--line);display:flex;align-items:center;gap:14px;flex-wrap:wrap;background:var(--panel);position:sticky;top:0;z-index:5}header h1{font-size:18px;margin:0;font-weight:650}header .mark{color:var(--accent);font-size:20px}header .meta{margin-left:0;color:var(--muted);font-size:13px}.brand-lockup{display:flex;align-items:center;gap:12px}.top-status{margin-left:auto;display:flex;align-items:center;gap:8px;flex-wrap:wrap;color:var(--muted);font-size:12px}.top-status span{border:1px solid var(--line);border-radius:999px;padding:3px 8px;background:#0b1220b8}.health-pill.ok{color:var(--ok);border-color:#86efaca6}.health-pill.warn{color:var(--warn);border-color:#fde68aa6}.executor-pill{max-width:34ch;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.matrix-mini{white-space:nowrap}[role=tablist]{display:flex;gap:4px;padding:0 22px;border-bottom:1px solid var(--line);flex-wrap:wrap}[role=tab]{background:none;border:0;border-bottom:2px solid transparent;color:var(--muted);padding:10px 14px;cursor:pointer;font:inherit}[role=tab][aria-selected=true]{color:var(--fg);border-bottom-color:var(--accent)}[role=tab]:focus-visible{outline:2px solid var(--accent);outline-offset:-2px}main{padding:22px}button,select,input{background:var(--panel);color:var(--fg);border:1px solid var(--line);border-radius:7px;padding:7px 12px;font:inherit}textarea{background:var(--panel);color:var(--fg);border:1px solid var(--line);border-radius:7px;padding:7px 12px;font:inherit;resize:vertical}button{cursor:pointer}button:hover:not(:disabled){border-color:var(--accent)}button:disabled{opacity:.45;cursor:not-allowed}button:focus-visible,select:focus-visible,input:focus-visible,textarea:focus-visible{outline:2px solid var(--accent);outline-offset:2px}table{width:100%;border-collapse:collapse;background:var(--panel);border:1px solid var(--line);border-radius:10px;overflow:hidden}caption{text-align:left;color:var(--muted);padding:10px 14px;font-size:13px}th,td{text-align:left;padding:11px 14px;border-bottom:1px solid var(--line)}th{color:var(--muted);font-weight:600;font-size:12px;text-transform:uppercase;letter-spacing:.04em}tr:last-child td{border-bottom:0}code{font:13px ui-monospace,monospace;color:var(--muted)}.badge{display:inline-block;padding:2px 8px;border-radius:999px;border:1px solid var(--line);font-size:12px}.badge.controller{border-color:var(--ok);color:var(--ok)}.badge.observer,.badge.high{border-color:var(--accent);color:var(--accent)}.badge.isolation-least,.badge.trust-compatibility,.badge.trust-degraded,.badge.daemon-permission_denied{border-color:var(--err);color:var(--err)}.badge.isolation-shared-kernel,.badge.isolation-opaque,.badge.trust-local,.badge.daemon-degraded,.badge.daemon-stopped,.badge.daemon-unknown{border-color:var(--warn);color:var(--warn)}.badge.isolation-strong,.badge.trust-secure,.badge.daemon-available,.badge.daemon-detected{border-color:var(--ok);color:var(--ok)}.badge.isolation-unknown,.badge.trust-unknown,.badge.daemon-unavailable{border-color:var(--idle);color:var(--muted)}.cell-note{color:var(--muted);font-size:12px;margin-top:3px;max-width:260px}.inventory-table{table-layout:fixed}.inventory-table th,.inventory-table td{vertical-align:top}.inventory-table th:nth-child(1),.inventory-table td:nth-child(1){width:17%}.inventory-table th:nth-child(2),.inventory-table td:nth-child(2){width:15%}.inventory-table th:nth-child(3),.inventory-table td:nth-child(3){width:13%}.inventory-table th:nth-child(4),.inventory-table td:nth-child(4){width:11%}.inventory-table th:nth-child(5),.inventory-table td:nth-child(5){width:13%}.inventory-table th:nth-child(6),.inventory-table td:nth-child(6){width:7%}.inventory-table th:nth-child(7),.inventory-table td:nth-child(7){width:6%}.inventory-table th:nth-child(8),.inventory-table td:nth-child(8){width:18%}.inventory-table .badge{max-width:100%;white-space:normal;line-height:1.35}.inventory-table code{display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.inventory-table .cell-note{max-width:100%;overflow-wrap:anywhere;line-height:1.4}.runtime-cell .cell-note,.daemon-cell .cell-note{display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:2;overflow:hidden}.state{display:inline-flex;align-items:center;gap:7px}.dot{width:8px;height:8px;border-radius:50%;flex:0 0 auto;background:var(--idle)}.state.running .dot,.state.working .dot{background:var(--ok)}.state.provisioning .dot,.state.degraded .dot{background:var(--warn)}.empty{color:var(--muted);padding:22px}.err{color:var(--err);padding:12px 0}.controls{display:flex;gap:10px;align-items:center;flex-wrap:wrap;margin-bottom:14px}.controls label{color:var(--muted);font-size:13px}.manage-actions{white-space:nowrap;display:flex;gap:8px;align-items:flex-start;justify-content:flex-start}.inventory-table .manage-actions button{min-width:74px;min-height:38px;padding-inline:10px}.inventory-table .manage-actions .cta{min-width:92px}.section-toolbar{display:flex;align-items:flex-end;justify-content:space-between;gap:14px;flex-wrap:wrap;margin-bottom:14px}.section-toolbar h2{margin:0;font-size:20px}.trust-banner{display:flex;gap:10px;flex-wrap:wrap;align-items:center;margin:0 0 12px;padding:10px 12px;border:1px solid var(--line);border-radius:8px;background:#0f172a8c;overflow-wrap:anywhere}.trust-banner.trust-secure{border-color:#86efacb3;color:var(--ok)}.trust-banner.trust-degraded{border-color:#fde68abf;color:var(--warn)}.trust-banner.trust-disabled{border-color:#fda4afbf;color:var(--err)}.trust-detail{color:var(--muted)}.empty-state{display:grid;gap:10px;justify-items:start;border:1px solid var(--line);border-radius:8px;padding:18px;background:var(--panel)}.empty-state h2{margin:0;font-size:20px}.terminal{background:#0a0c10;border:1px solid var(--line);border-radius:10px;padding:0;height:min(56vh,calc(100vh - 310px));min-height:320px;overflow:hidden}.terminal .xterm{height:100%;padding:8px}.terminal .xterm-viewport,.terminal .xterm-screen{height:100%}.terminal .xterm-viewport{overflow-y:auto}.inputrow{display:flex;gap:8px;margin-top:12px}.inputrow input{flex:1;font-family:ui-monospace,monospace}.hint{color:var(--muted);font-size:13px;margin:6px 0 0}.response-needed{display:grid;gap:10px;margin:14px 0 18px}.response-needed h2{margin:0;font-size:16px}.response-item{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:12px;align-items:start;border:1px solid var(--warn);border-radius:8px;background:#fde68a14;padding:12px 14px}.response-item p{margin:5px 0;color:var(--fg);white-space:pre-wrap;overflow-wrap:anywhere}.response-item span{color:var(--muted);font-size:12px}.mission-summary{display:flex;gap:10px;flex-wrap:wrap;margin:14px 0}.mission-summary span{border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:8px 12px;color:var(--muted)}.mission-summary strong{color:var(--fg)}.missions-layout{display:grid;grid-template-columns:minmax(220px,300px) minmax(0,1fr);gap:14px;align-items:start;margin-top:14px}.mission-sessions{display:grid;gap:8px}.mission-sessions button{display:grid;gap:2px;text-align:left;border-radius:8px}.mission-sessions button.selected{border-color:var(--accent);background:#5eead414}.mission-sessions small{color:var(--muted)}.mission-detail{min-width:0;display:grid;gap:12px}.mission-detail-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:14px}.mission-detail-head h2{margin:0;font-size:18px}.mission-detail-head p{margin:3px 0 0;color:var(--muted);font-size:13px}.block{display:block;margin-top:4px;color:var(--muted);font-size:12px;overflow-wrap:anywhere}.audit-tail{border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:12px 14px}.audit-tail h3{margin:0 0 8px;font-size:14px}.audit-tail p{margin:5px 0;color:var(--muted);font-size:13px}.telemetry-kpis{display:grid;grid-template-columns:repeat(auto-fit,minmax(170px,1fr));gap:10px;margin:14px 0}.telemetry-kpis article{display:grid;gap:4px;border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:12px 14px}.telemetry-kpis span,.telemetry-kpis small{color:var(--muted);font-size:12px}.telemetry-kpis strong{font-size:24px}.controls button[aria-pressed=true]{border-color:var(--accent);color:var(--accent)}.memory-layout{display:grid;grid-template-columns:minmax(260px,360px) minmax(0,1fr);gap:14px;align-items:start;margin-top:14px}.memory-form{display:grid;gap:10px;border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:14px}.memory-form h2{margin:0;font-size:18px}.memory-form label{display:grid;gap:5px;color:var(--muted);font-size:13px}.memory-form input,.memory-form textarea{width:100%}.memory-list{min-width:0}.note-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(240px,1fr));gap:10px}.note-card{display:grid;gap:8px;border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:12px}.note-card header{position:static;display:flex;align-items:flex-start;justify-content:space-between;gap:10px;padding:0;border:0;background:transparent}.note-card h3{margin:0;font-size:15px}.note-card p{margin:0;color:var(--muted);white-space:pre-wrap;overflow-wrap:anywhere}.note-card footer{display:flex;gap:6px;align-items:center;flex-wrap:wrap;color:var(--muted);font-size:12px}.grid2{display:grid;grid-template-columns:minmax(260px,1fr) 1.4fr;gap:16px;align-items:start}.index-live{border:1px solid var(--line);border-radius:8px;background:#111827b8;padding:14px;margin:14px 0 18px}.index-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(180px,1fr));gap:8px;margin-bottom:12px}.index-graph{border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:10px 12px}.index-graph.missing{border-color:var(--warn)}.index-graph p{margin:5px 0 0;color:var(--muted);font-size:13px}.index-query{display:grid;grid-template-columns:minmax(220px,1fr) auto;gap:10px;align-items:end;margin-top:10px}.index-query label{display:grid;gap:5px;color:var(--muted);font-size:13px}.index-results{display:grid;grid-template-columns:repeat(auto-fill,minmax(240px,1fr));gap:8px;margin-top:12px}.index-results article{border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:10px 12px}.index-results p{margin:5px 0;color:var(--muted);font-size:13px;overflow-wrap:anywhere}.index-results small{color:var(--muted)}.act{text-align:left}.action-cluster{display:inline-flex;align-items:stretch;gap:4px}.action-cluster .act{border-radius:7px 0 0 7px}.copy-command{border-radius:0 7px 7px 0;color:var(--muted);font-size:12px;padding-inline:9px}.contrib-layout{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:14px;margin-top:16px}.contrib-grid{display:grid;gap:10px}.contrib-item{display:grid;gap:8px;align-items:start;border:1px solid var(--line);border-radius:8px;background:var(--panel);padding:12px}.contrib-item p{margin:0;color:var(--muted);font-size:13px;overflow-wrap:anywhere}.workflow-steps{display:flex;gap:8px;flex-wrap:wrap}.capgrid{display:grid;grid-template-columns:repeat(auto-fill,minmax(230px,1fr));gap:10px}.capcard{display:block;text-align:left;background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:11px 13px;cursor:pointer}.capcard:hover{border-color:var(--accent)}.capcard-head{display:flex;align-items:center;gap:8px}.capcard-head strong{font-size:14px}.capcard-score{margin-left:auto;color:var(--muted);font-size:12px}.capcard-cap{color:var(--muted);font-size:13px;margin-top:5px;line-height:1.4}.capcard-tags{margin-top:8px;display:flex;gap:5px;flex-wrap:wrap}.tag{font-size:11px;color:var(--muted);border:1px solid var(--line);border-radius:999px;padding:1px 7px}.picker{background:#0a0c10;border:1px solid var(--line);border-radius:10px;padding:12px;margin-bottom:12px}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;z-index:20;display:grid;place-items:center;padding:24px;background:#020617b8;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}.modal{width:min(780px,calc(100vw - 48px));max-height:calc(100vh - 48px);overflow:auto;border:1px solid var(--line);border-radius:8px;background:var(--panel);box-shadow:0 24px 70px #0000007a;padding:20px}.modal h2{margin:0 0 14px;font-size:20px}.form-grid{display:grid;grid-template-columns:minmax(120px,.28fr) minmax(0,1fr);gap:12px;align-items:center}.form-grid label{color:var(--muted);font-size:13px}.form-grid select,.form-grid input,.form-grid textarea{min-width:0;width:100%}.form-grid textarea{min-height:88px;resize:vertical;background:var(--panel);color:var(--fg);border:1px solid var(--line);border-radius:7px;padding:7px 12px;font:inherit}.field-stack{display:grid;gap:7px;min-width:0}.posture-line{color:var(--muted);font-size:13px;overflow-wrap:anywhere}.check-row{display:flex;align-items:center;gap:9px;color:var(--fg)!important}.check-row input{width:auto}.ro{min-width:0;color:var(--fg);overflow-wrap:anywhere}.warn{color:var(--warn)}.ok-text{color:var(--ok)}.modal-actions{display:flex;justify-content:flex-end;gap:10px;margin-top:18px}.welcome{max-width:none}.welcome h2{font-size:clamp(26px,3vw,42px);margin:4px 0 10px;line-height:1.08}.welcome .lead{color:var(--muted);font-size:16px;line-height:1.6;margin:0;max-width:680px}.welcome .lead strong{color:var(--fg)}.eyebrow{color:var(--accent);text-transform:uppercase;letter-spacing:.08em;font-size:12px;font-weight:700;margin:0 0 6px}.statgrid{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-bottom:18px}.stat{display:flex;flex-direction:column;align-items:flex-start;gap:2px;text-align:left;padding:14px 16px}.stat-n{font-size:26px;font-weight:680;color:var(--fg)}.stat-l{color:var(--muted);font-size:13px}.cta-row{display:flex;gap:10px;flex-wrap:wrap;margin-bottom:22px}.cta{background:var(--accent);color:#0b0d12;border-color:var(--accent);font-weight:620;padding:9px 18px}.cta:hover:not(:disabled){filter:brightness(1.08)}.card{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin-bottom:16px}.card h3{margin:0 0 8px;font-size:15px}.card ol{margin:0;padding-left:20px;color:var(--muted);line-height:1.7}.card ol strong{color:var(--fg)}.warn-card{border-color:var(--warn)}.warn-card pre{margin:10px 0 0}.wall-hero{display:grid;grid-template-columns:minmax(280px,1fr) auto;gap:18px;align-items:end;margin:4px 0 18px}.wall-hero-compact{margin:0 0 10px;align-items:center}.wall-hero-compact h2{font-size:clamp(24px,2.4vw,34px);margin-bottom:6px}.wall-hero-compact .lead{font-size:14px;line-height:1.45;max-width:620px}.wall-hero-compact .hero-actions{align-items:center}.hero-actions{display:flex;gap:10px;flex-wrap:wrap;justify-content:flex-end}.segmented{display:inline-flex;gap:0;border:1px solid var(--line);border-radius:8px;overflow:hidden}.segmented button{border:0;border-radius:0;color:var(--muted);background:#0f172ab8}.segmented button[aria-pressed=true]{color:#0b0d12;background:var(--accent);font-weight:650}.operator-wall{min-height:calc(100vh - 130px)}.radial-wall{display:grid;grid-template-columns:1fr;gap:18px;align-items:stretch;margin:10px calc(50% - 50vw) 18px}.radial-map{position:relative;min-height:clamp(640px,calc(100vh - 260px),780px);border-block:1px solid rgba(147,197,253,.25);overflow:hidden;background:radial-gradient(circle at 50% 47%,rgba(94,234,212,.22),transparent 17%),radial-gradient(circle at 18% 62%,rgba(59,130,246,.14),transparent 20%),radial-gradient(circle at 82% 38%,rgba(124,58,237,.18),transparent 18%),linear-gradient(180deg,#0f172af2,#020617c2);box-shadow:inset 0 0 70px #020617b8}.radial-links{position:absolute;top:0;right:0;bottom:0;left:0;width:100%;height:100%;filter:drop-shadow(0 0 14px rgba(94,234,212,.34))}.link-ring{fill:none;stroke:#93c5fd2e;stroke-width:.35;stroke-dasharray:1.2 1.4}.link-ring-inner{stroke:#5eead424;stroke-dasharray:.7 1.8}.link-line{stroke:#5eead48a;stroke-width:.42}.link-ready,.link-idle{stroke:#93c5fd61}.link-attention{stroke:#fde68ac7}.link-blocked{stroke:#fda4af80;stroke-dasharray:1.4 1.2}.handoff-arc{fill:none;stroke:#c4b5fdf0;stroke-width:1.25;stroke-linecap:round;filter:drop-shadow(0 0 5px rgba(196,181,253,.72))}.mode-handoff .link-line{stroke:#93c5fd3d}.mode-handoff .handoff-arc{stroke-width:2.35;filter:drop-shadow(0 0 11px rgba(196,181,253,.9))}.central-hub{position:absolute;left:50%;top:45%;transform:translate(-50%,-50%);width:214px;min-height:178px;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:8px;text-align:center;border-radius:8px;border-color:#5eead4e6;background:linear-gradient(180deg,#5eead457,#0f172ae6);box-shadow:0 0 64px #5eead46b,inset 0 0 38px #93c5fd33;z-index:3}.mode-handoff .central-hub{border-color:#c4b5fde6;box-shadow:0 0 72px #c4b5fd6b,inset 0 0 38px #5eead429}.central-hub strong{font-size:24px}.central-hub span:last-child{color:var(--muted);font-size:12px}.hub-core{width:82px;height:52px;border:1px solid rgba(248,250,252,.78);border-radius:7px;transform:skew(-12deg);background:linear-gradient(135deg,#f8fafcdb,#5eead475);box-shadow:0 10px 32px #5eead459}.orbit-node{position:absolute;left:var(--x);top:var(--y);transform:translate(-50%,-50%);width:104px;min-height:106px;display:grid;grid-template-rows:72px auto;gap:4px;place-items:center;text-align:center;padding:8px 7px;border-radius:8px;background:radial-gradient(circle at 50% 38%,#f8fafc1c,#0f172a8f 54%,#0206176b);border-color:#93c5fd2e;box-shadow:0 20px 38px #00000057,inset 0 -18px 26px #3b82f60f;z-index:2}.orbit-node:hover:not(:disabled){transform:translate(-50%,-50%) translateY(-2px)}.orbit-node:focus-visible{outline-offset:4px}.node-copy{min-width:0;display:flex;flex-direction:column;gap:2px}.node-copy strong{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:94px;font-size:11px}.node-copy span{color:var(--muted);font-size:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:94px}.orbit-node:focus-visible .node-copy span,.orbit-node:hover .node-copy span{font-size:10px}.node-glyph{width:72px;height:62px;display:inline-block;border:2px solid var(--node-accent,var(--accent));background:#ffffff0a;box-shadow:0 0 30px color-mix(in srgb,var(--node-accent,var(--accent)) 48%,transparent)}.node-host,.node-session{--node-accent:var(--accent)}.node-container,.node-inventory{--node-accent:var(--accent2)}.node-vm,.node-mission{--node-accent:var(--accent3)}.node-approval.node-attention,.node-blocked{--node-accent:var(--warn)}.node-cost,.node-capability,.node-library,.node-action{--node-accent:var(--accent4)}.node-blocked{border-color:#fda4af99}.node-attention{border-color:#fde68ab8}.node-running{border-color:#86efacb8}.glyph-host,.glyph-session{border-radius:6px;box-shadow:inset 0 -10px #ffffff0f,0 0 18px #5eead447}.glyph-container,.glyph-inventory{border-radius:7px;transform:skew(-8deg)}.glyph-vm{border-radius:4px;transform:rotate(45deg) scale(.82)}.glyph-mission{border-radius:50%;position:relative}.glyph-mission:before,.glyph-mission:after{content:"";position:absolute;width:10px;height:10px;border:2px solid var(--node-accent);border-radius:50%;background:#0f172ae6}.glyph-mission:before{left:-7px;top:12px}.glyph-mission:after{right:-7px;top:12px}.glyph-approval{border-radius:18px 18px 6px 6px}.glyph-cost{border-radius:50%;border-style:dashed}.glyph-capability{border-radius:8px;background:repeating-linear-gradient(45deg,rgba(255,255,255,.08) 0 4px,transparent 4px 8px)}.glyph-library{border-radius:4px;box-shadow:inset 9px 0 #ffffff14,inset 18px 0 #ffffff0d}.glyph-action{border-radius:10px;transform:rotate(45deg) scale(.8)}.handoff-marker{position:absolute;right:-8px;top:50%;width:16px;height:16px;margin-top:-8px;border-radius:50%;background:var(--accent3);box-shadow:0 0 22px #c4b5fdd1}.mode-handoff .node-mission{border-color:#c4b5fdf2;box-shadow:0 22px 48px #7c3aed5c,inset 0 -18px 26px #c4b5fd1a}.mode-handoff .handoff-marker{width:22px;height:22px;right:-12px;margin-top:-11px}.handoff-callout{position:absolute;z-index:4;display:grid;gap:3px;padding:9px 11px;border:1px solid rgba(196,181,253,.54);border-radius:8px;background:#0f172ac2;box-shadow:0 0 28px #c4b5fd2e}.handoff-callout span{color:var(--muted);font-size:11px;text-transform:uppercase;letter-spacing:.06em}.handoff-callout strong{font-size:13px}.handoff-source{left:20%;top:60%}.handoff-destination{right:14%;top:39%}.radial-overlay{position:absolute;left:22px;right:22px;bottom:18px;border:1px solid rgba(203,213,225,.16);border-radius:8px;background:#0f172aa8;-webkit-backdrop-filter:blur(8px);backdrop-filter:blur(8px);padding:13px;display:grid;grid-template-columns:minmax(280px,.62fr) 1fr;gap:12px;z-index:4}.radial-overlay-head{display:grid;grid-template-columns:minmax(160px,1fr) minmax(220px,.8fr);gap:12px;align-items:end}.radial-overlay h3{margin:0;font-size:18px}.mission-route{display:grid;grid-template-columns:1fr auto auto;gap:8px;align-items:center;padding:9px;border:1px solid rgba(203,213,225,.16);border-radius:8px;background:#02061757}.mission-route span{color:var(--muted);font-size:12px}.mission-route strong{font-size:14px}.route-attention{color:var(--warn)!important}.route-ready{color:var(--ok)!important}.wall-readout{display:grid;grid-template-columns:repeat(5,minmax(90px,1fr));gap:8px;margin:0}.wall-readout div{display:grid;gap:4px;padding:8px 10px;border:1px solid rgba(203,213,225,.12);border-radius:8px;background:#02061752}.wall-readout div:last-child{border-bottom:1px solid rgba(203,213,225,.12)}.wall-readout dt{color:var(--muted);font-size:12px}.wall-readout dd{margin:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.stack-board{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:14px;margin:16px 0}.stack-card{position:relative;min-height:236px;display:grid;grid-template-rows:auto 1fr auto auto;gap:12px;background:linear-gradient(160deg,var(--glass),rgba(15,23,42,.58));border:1px solid var(--line);border-radius:8px;padding:16px;overflow:hidden;box-shadow:0 18px 45px #00000038}.stack-card:before{content:"";position:absolute;top:0;right:0;bottom:0;left:0;border-top:3px solid var(--stack-accent,var(--accent));pointer-events:none}.stack-card.accent-1{--stack-accent:var(--accent)}.stack-card.accent-2{--stack-accent:var(--accent2)}.stack-card.accent-3{--stack-accent:var(--accent3)}.stack-card.accent-4{--stack-accent:var(--accent4)}.stack-head{display:grid;grid-template-columns:42px minmax(0,1fr) auto;gap:12px;align-items:start}.stack-head h3{margin:0;font-size:16px}.stack-head p{margin:3px 0 0;color:var(--muted);font-size:12px}.topology{width:38px;height:38px;border:2px solid var(--stack-accent,var(--accent));background:#ffffff0a;display:inline-block}.topology-terminal{border-radius:6px;box-shadow:inset 0 -10px #ffffff0f}.topology-cube{transform:skew(-8deg);border-radius:7px}.topology-window{border-radius:10px 10px 4px 4px}.stack-log{min-height:92px;border:1px solid rgba(203,213,225,.18);background:#02061770;border-radius:8px;padding:10px;display:flex;flex-direction:column;gap:8px;color:var(--muted);font:12px/1.35 ui-monospace,monospace}.stack-log span:first-child{color:var(--fg)}.segment-progress{height:8px;border-radius:999px;background:#94a3b82e;overflow:hidden}.segment-progress span{display:block;height:100%;background:var(--stack-accent,var(--accent));border-radius:inherit}.transport-bar{display:flex;gap:8px;align-items:center;flex-wrap:wrap}.transport-bar span{margin-left:auto;color:var(--muted);font-size:13px}.telemetry-strip{display:grid;grid-template-columns:repeat(5,minmax(120px,1fr));gap:10px;margin:16px 0}.telemetry-strip button{min-height:82px;display:flex;flex-direction:column;align-items:flex-start;justify-content:center;text-align:left;gap:3px;background:#111827c7;border-radius:8px}.telemetry-strip strong{font-size:24px;color:var(--fg)}.telemetry-strip span{color:var(--muted);font-size:12px}.control-planner{display:grid;grid-template-columns:minmax(320px,1fr) minmax(260px,.36fr);gap:14px;margin-top:16px;align-items:stretch}.guided-start{display:grid;grid-template-columns:1fr;align-items:start;gap:14px;border:1px solid var(--line);background:#0f172a94;border-radius:8px;padding:16px}.guided-start h3{margin:0 0 4px;font-size:18px}.planner-grid{display:grid;grid-template-columns:repeat(3,minmax(160px,1fr));gap:10px}.planner-grid label{display:flex;flex-direction:column;gap:6px;color:var(--muted);font-size:12px}.planner-grid select{width:100%;min-height:38px}.quota-panel{border:1px solid var(--line);border-radius:8px;background:#0f172ab8;padding:16px;display:grid;gap:12px;align-content:start}.quota-donut{--quota:0%;width:148px;aspect-ratio:1;border-radius:50%;justify-self:center;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:4px;background:conic-gradient(var(--accent) var(--quota),rgba(148,163,184,.18) 0);position:relative;color:var(--fg)}.quota-donut:before{content:"";position:absolute;top:13px;right:13px;bottom:13px;left:13px;border-radius:inherit;background:var(--panel);border:1px solid rgba(203,213,225,.16)}.quota-donut strong,.quota-donut span{position:relative;z-index:1}.quota-donut strong{font-size:23px}.quota-donut span{color:var(--muted);font-size:11px;max-width:96px;text-align:center}.quota-readout{margin:0;display:grid;gap:7px}.quota-readout div{display:grid;grid-template-columns:1fr auto;gap:10px;border-bottom:1px solid rgba(203,213,225,.13);padding-bottom:7px}.quota-readout div:last-child{border-bottom:0;padding-bottom:0}.quota-readout dt{color:var(--muted);font-size:12px}.quota-readout dd{margin:0}@media(max-width:820px){header{position:static}.top-status{width:100%;margin-left:0}.wall-hero,.guided-start,.radial-wall,.control-planner,.missions-layout,.memory-layout{grid-template-columns:1fr;align-items:start}.hero-actions{justify-content:flex-start}.telemetry-strip{grid-template-columns:repeat(2,minmax(120px,1fr))}.planner-grid{grid-template-columns:1fr}.radial-wall{margin-inline:0}.radial-map{min-height:0;display:grid;grid-template-columns:1fr;gap:8px;padding:12px}.radial-links,.central-hub .hub-core{display:none}.central-hub,.orbit-node{position:static;transform:none;width:100%;min-height:72px}.central-hub{margin-bottom:4px}.orbit-node:hover:not(:disabled){transform:none}.node-copy span{font-size:10px}.handoff-callout{position:static}.radial-overlay{position:static;grid-template-columns:1fr}.radial-overlay-head,.wall-readout{grid-template-columns:1fr}}@media(prefers-reduced-motion:reduce){*,*:before,*:after{scroll-behavior:auto!important;transition:none!important;animation:none!important}}.session-workspace{display:grid;grid-template-columns:minmax(240px,300px) minmax(0,1fr);gap:16px;align-items:start}@media(max-width:820px){.session-workspace{grid-template-columns:1fr}}.session-nav{border:1px solid var(--line);border-radius:10px;background:var(--panel);padding:10px;max-height:calc(100vh - 250px);overflow-y:auto}.session-nav-head{display:flex;align-items:center;justify-content:space-between;margin:2px 4px 8px}.session-nav-head h2{margin:0;font-size:15px}.session-nav-head .hint{margin:0}.nav-list{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:4px}.nav-instance{border-radius:8px;border:1px solid transparent}.nav-instance.selected{background:#5eead40f;border-color:var(--line)}.nav-instance-row{width:100%;display:flex;align-items:center;gap:8px;background:none;border:0;padding:8px;cursor:pointer;text-align:left;border-radius:8px}.nav-instance-row:hover{border-color:transparent;background:#94a3b814}.nav-instance-name{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-weight:600;font-size:13px}.nav-instance .state{font-size:11px;color:var(--muted)}.nav-instance .badge{font-size:10px;padding:1px 7px;text-transform:lowercase}.nav-sessions{padding:0 6px 8px 10px;display:flex;flex-direction:column;gap:4px}.nav-sessions ul{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:3px}.nav-sessions li{display:flex;align-items:stretch;gap:4px}.nav-session{flex:1;min-width:0;display:flex;flex-wrap:wrap;align-items:center;gap:4px 6px;background:none;border:1px solid transparent;border-left:2px solid var(--line);border-radius:6px;padding:6px 8px;cursor:pointer;text-align:left}.nav-session:hover{background:#94a3b814}.nav-session.selected{border-color:var(--accent);border-left-color:var(--accent);background:#5eead414}.nav-session.live{border-left-color:var(--ok)}.nav-session-name{flex-basis:100%;font-size:12px;font-weight:600;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.nav-session-meta{font-size:11px;color:var(--muted)}.nav-session .badge{padding:0 6px;font-size:10px}.nav-session .live-dot{border-color:var(--ok);color:var(--ok)}.nav-session .unread{border-color:var(--accent2);color:var(--accent2)}.nav-session .response{border-color:var(--warn);color:var(--warn)}.nav-session-end{align-self:center;padding:4px 9px;color:var(--muted);border-color:transparent;background:none;line-height:1}.nav-session-end:hover:not(:disabled){border-color:var(--err);color:var(--err)}.nav-new-session{margin-top:6px;align-self:flex-start}.cta-sm{font-size:12px;padding:5px 10px;border-color:var(--accent);color:var(--accent)}.nav-empty{margin:4px 0;font-size:12px}.session-main{min-width:0}.controls-active{color:var(--muted);font-size:13px;padding:5px 10px;border:1px dashed var(--line);border-radius:7px;max-width:240px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.badge.live-dot{color:var(--ok);border-color:var(--ok)}

package/web/dist/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>AIWG Cockpit</title>
     <!-- The Bridge injects window.__COCKPIT_TOKEN__ at serve time. -->
-    <script type="module" crossorigin src="./assets/index-BRN8u5R_.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-B0ea5aQ1.css">
+    <script type="module" crossorigin src="./assets/index-BoRrjczI.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-CesGeDud.css">
   </head>
   <body>
     <div id="root">Loading AIWG Cockpit…</div>

package/web/src/App.test.tsx

@@ -137,6 +137,32 @@ describe('App shell (rendered DOM)', () => {
       if (url.includes('/api/running')) return jsonResponse({ count: 1, running: [{ instance_id: 'host-1', task_id: 'task-abc', state: 'working', tenant: 'local' }] });
       if (url.includes('/api/approvals')) return jsonResponse({ approvals: [] });
       if (url.includes('/api/cost')) return jsonResponse({ total: { input_tokens: 1000, output_tokens: 2000, usd: 0.42 }, per_instance: [] });
+      if (url.includes('/api/mcp/discovery')) return jsonResponse({
+        enabled: true,
+        status: 'enabled',
+        endpoint: {
+          path: '/mcp',
+          methods: ['POST'],
+          transport: 'streamable-http',
+          stateless: true,
+          get_behavior: '405_method_not_allowed',
+          mcp_session_id: false,
+        },
+        protocol: { latest: '2025-11-25', supported: ['2025-11-25'] },
+        auth: {
+          scheme: 'bearer',
+          required: true,
+          principal_config: 'mcp-principals.toml',
+          principals: [{ client_id: 'cockpit-test', scopes: ['fleet.read', 'output.read'] }],
+          scopes: ['fleet.read', 'output.read'],
+        },
+        capabilities: {},
+        tools: [{ name: 'list_sandboxes' }, { name: 'tail_output' }],
+        resources: [{ uri: 'sandbox://fleet' }],
+        resource_templates: [{ uriTemplate: 'sandbox://sessions/{session_id}/screen' }],
+        errors: [],
+        notes: [],
+      });
       if (url.includes('/api/missions')) return jsonResponse({ count: 1, sessions: [], missions: [{ id: 'm-1', session_id: 'mc-1', source: 'aiwg-mc', title: 'Mission', status: 'completed', terminal: true }] });
       if (url.includes('/api/events/snapshot')) return jsonResponse({
         source: 'cockpit.unified-event-model/v1',
@@ -156,6 +182,8 @@ describe('App shell (rendered DOM)', () => {
 
     expect(await screen.findByText('cockpit.unified-event-model/v1')).toBeTruthy();
     expect(screen.getByText('$0.42')).toBeTruthy();
+    expect(screen.getByLabelText('MCP management posture').textContent).toContain('list_sandboxes');
+    expect(screen.getByLabelText('MCP management posture').textContent).toContain('session id not expected');
     expect(screen.getByText('mission.lifecycle')).toBeTruthy();
     fireEvent.click(screen.getByRole('button', { name: 'session' }));
     expect(screen.getByText('session.lifecycle')).toBeTruthy();
@@ -445,7 +473,11 @@ describe('App shell (rendered DOM)', () => {
   });
 
   it('keeps Destroy enabled for a stopped Docker row so it can be cleaned up', async () => {
-    const stale = { ...instance('stale-dkr-1', 'docker', 'full-suite'), state: 'stopped' };
+    const stale = {
+      ...instance('stale-dkr-1', 'docker', 'full-suite'),
+      state: 'stopped',
+      storage: { persistent: true, delete_on_destroy: true, scope: 'inbox' },
+    };
     const inventory = { instances: [stale], count: 1, fetched_at: new Date().toISOString() };
     globalThis.fetch = vi.fn(async (input: RequestInfo | URL) => {
       const url = String(input);
@@ -463,6 +495,7 @@ describe('App shell (rendered DOM)', () => {
     // Previously hard-disabled for stopped Docker rows, which trapped stale
     // containers in inventory with no in-UI way to remove them.
     expect((destroy as HTMLButtonElement).disabled).toBe(false);
+    expect(screen.getByText(/storage: persistent · delete on destroy/i)).toBeTruthy();
   });
 
   it('offers Reconnect for a running Docker row whose agent is not registered', async () => {

package/web/src/components/Inventory.test.tsx

@@ -0,0 +1,165 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { Inventory } from './Inventory';
+
+const VM_INSTANCE = {
+  id: 'vm-1',
+  runtime: 'vm',
+  provider: 'cloud-hypervisor',
+  capabilities: [
+    { id: 'instance.snapshot', label: 'Snapshot' },
+    { id: 'instance.restore', label: 'Restore' },
+    { id: 'instance.fork', label: 'Fork' },
+    { id: 'warm_pool.manage', label: 'Warm pools' },
+  ],
+  loadout: 'security-audit',
+  state: 'running',
+  tenant: 'default',
+  card_url: '',
+  runtime_posture: { kind: 'vm', isolation: 'strong', label: 'VM' },
+  host_daemon: { status: 'available' },
+  transport: { mode: 'mtls', trust: 'secure', label: 'mTLS', source: 'test' },
+  launch_context: { name: 'vm-one', loadout: 'security-audit' },
+  session_backends: [{ mode: 'managed', backend: 'zellij', available: true, drive: true }],
+};
+
+beforeEach(() => {
+  (window as unknown as { __COCKPIT_TOKEN__: string }).__COCKPIT_TOKEN__ = 't';
+});
+
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();
+});
+
+describe('Inventory provider-aware fast-start controls', () => {
+  it('runs a capability-gated snapshot action and records terminal audit evidence', async () => {
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      const ok = (body: unknown) => new Response(JSON.stringify(body), { status: 200, headers: { 'content-type': 'application/json' } });
+      if (url.includes('/api/inventory')) return ok({ count: 1, fetched_at: '2026-07-29T00:00:00Z', instances: [VM_INSTANCE] });
+      if (url.includes('/api/instances/vm-1/snapshot') && init?.method === 'POST') return ok({ id: 'op-1', state: 'running' });
+      if (url.includes('/api/operations/op-1')) return ok({ id: 'op-1', state: 'succeeded', result: { provider: 'cloud-hypervisor', snapshot_id: 'vm-one-snap' } });
+      if (url.includes('/api/audit/intent') && init?.method === 'POST') return ok({ id: 'audit-1' });
+      return new Response('{}', { status: 404 });
+    }) as unknown as typeof fetch;
+    globalThis.fetch = fetchMock;
+    vi.spyOn(window, 'prompt').mockReturnValue('vm-one-snap');
+
+    render(<Inventory refreshMs={60_000} />);
+
+    fireEvent.click(await screen.findByRole('button', { name: /snapshot vm-1/i }));
+
+    await waitFor(() => expect(screen.getByRole('status').textContent).toContain('Snapshot succeeded: op-1'));
+    const actionCall = (fetchMock as unknown as ReturnType<typeof vi.fn>).mock.calls
+      .find((call) => String(call[0]).includes('/api/instances/vm-1/snapshot'));
+    expect(JSON.parse(String(actionCall?.[1]?.body))).toMatchObject({ asset_ref: 'vm-one-snap' });
+    const auditCall = (fetchMock as unknown as ReturnType<typeof vi.fn>).mock.calls
+      .find((call) => String(call[0]).includes('/api/audit/intent'));
+    expect(JSON.parse(String(auditCall?.[1]?.body))).toMatchObject({
+      event: 'instance.fast_start.terminal',
+      detail: {
+        instance_id: 'vm-1',
+        provider: 'cloud-hypervisor',
+        action: 'snapshot',
+        operation_id: 'op-1',
+        state: 'succeeded',
+      },
+    });
+  });
+
+  it('disables unsafe fast-start controls when VFIO constraints exclude them', async () => {
+    const vfioVm = {
+      ...VM_INSTANCE,
+      capability_constraints: [{
+        capability: 'device.vfio',
+        excludes: ['instance.snapshot', 'instance.restore', 'instance.fork', 'warm_pool.manage'],
+        reason: 'VFIO-backed VMs cannot safely reuse memory state.',
+      }],
+    };
+    globalThis.fetch = vi.fn(async (input: RequestInfo | URL) => {
+      if (String(input).includes('/api/inventory')) {
+        return new Response(JSON.stringify({ count: 1, fetched_at: '2026-07-29T00:00:00Z', instances: [vfioVm] }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+      return new Response('{}', { status: 404 });
+    }) as unknown as typeof fetch;
+
+    render(<Inventory refreshMs={60_000} />);
+
+    const snapshot = await screen.findByRole('button', { name: /snapshot vm-1/i }) as HTMLButtonElement;
+    expect(snapshot.disabled).toBe(true);
+    expect(snapshot.getAttribute('title')).toBe('VFIO-backed VMs cannot safely reuse memory state.');
+    expect((screen.getByRole('button', { name: /restore vm-1/i }) as HTMLButtonElement).disabled).toBe(true);
+    expect((screen.getByRole('button', { name: /fork vm-1/i }) as HTMLButtonElement).disabled).toBe(true);
+    expect((screen.getByRole('button', { name: /warm pool vm-1/i }) as HTMLButtonElement).disabled).toBe(true);
+  });
+
+  it('renders libvirt checkpoint controls without unsupported fork', async () => {
+    const libvirtVm = {
+      ...VM_INSTANCE,
+      provider: 'libvirt',
+      capabilities: [
+        { id: 'instance.checkpoint', label: 'Checkpoint' },
+        { id: 'instance.restore', label: 'Checkpoint restore' },
+        { id: 'warm_pool.manage', label: 'Warm pools' },
+      ],
+    };
+    globalThis.fetch = vi.fn(async (input: RequestInfo | URL) => {
+      if (String(input).includes('/api/inventory')) {
+        return new Response(JSON.stringify({ count: 1, fetched_at: '2026-07-29T00:00:00Z', instances: [libvirtVm] }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+      return new Response('{}', { status: 404 });
+    }) as unknown as typeof fetch;
+
+    render(<Inventory refreshMs={60_000} />);
+
+    expect(await screen.findByRole('button', { name: /checkpoint vm-1/i })).toBeTruthy();
+    expect(screen.getByRole('button', { name: /restore vm-1/i })).toBeTruthy();
+    expect(screen.getByRole('button', { name: /warm pool vm-1/i })).toBeTruthy();
+    expect(screen.queryByRole('button', { name: /fork vm-1/i })).toBeNull();
+  });
+
+  it('renders degraded sandbox trust recovery without secret material', async () => {
+    globalThis.fetch = vi.fn(async (input: RequestInfo | URL) => {
+      if (String(input).includes('/api/inventory')) {
+        return new Response(JSON.stringify({
+          count: 1,
+          fetched_at: '2026-07-29T00:00:00Z',
+          bootstrap_trust: {
+            status: 'degraded',
+            mode: 'mtls',
+            label: 'Sandbox trust degraded',
+            source: '/api/v2/admin/bootstrap/readiness',
+            ca_provider_ref: 'vault://sandbox-ca/current',
+            trust_bundle_ref: 'trust-bundle://sandbox/current',
+            client_identity_ref: 'spiffe://sandbox.agentic.local/cockpit/bridge',
+            rotation_state: 'reload-required',
+            trust_bundle_fresh: false,
+            token_store_configured: true,
+            missing_required_material: ['fresh_trust_bundle'],
+            recovery: 'Refresh sandbox CA/bootstrap readiness, rotate stale trust material, then reload Cockpit.',
+          },
+          instances: [VM_INSTANCE],
+        }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+      return new Response('{}', { status: 404 });
+    }) as unknown as typeof fetch;
+
+    render(<Inventory refreshMs={60_000} />);
+
+    const banner = await screen.findByRole('alert');
+    expect(banner.textContent).toContain('Sandbox trust degraded');
+    expect(banner.textContent).toContain('rotate stale trust material');
+    expect(banner.textContent).toContain('vault://sandbox-ca/current');
+    expect(banner.textContent).not.toMatch(/BEGIN CERTIFICATE|PRIVATE KEY|secret-token/i);
+  });
+});

package/web/src/components/Inventory.tsx

@@ -1,9 +1,24 @@
 import { useCallback, useEffect, useState } from 'react';
 import { api } from '../api';
 import { fmtId } from '../util';
-import type { Instance } from '../types';
+import type { BootstrapTrustPosture, Instance, SandboxRuntimeCapabilityId } from '../types';
 
-interface Inv { count: number; fetched_at: string; instances: Instance[] }
+interface Inv { count: number; fetched_at: string; instances: Instance[]; bootstrap_trust?: BootstrapTrustPosture }
+interface OperationStatus {
+  id?: string;
+  state?: string;
+  result?: Record<string, unknown>;
+  error?: unknown;
+  failure?: unknown;
+}
+
+type FastStartActionId = 'snapshot' | 'restore' | 'fork' | 'warm-pool';
+interface FastStartAction {
+  id: FastStartActionId;
+  label: string;
+  disabled: boolean;
+  reason?: string;
+}
 
 export function Inventory({ onStartSession, onLaunchInstance, refreshTick = 0, refreshMs = 5_000 }: { onStartSession?: (instanceId?: string) => void; onLaunchInstance?: () => void; refreshTick?: number; refreshMs?: number }) {
   const [data, setData] = useState<Inv | null>(null);
@@ -34,6 +49,60 @@ export function Inventory({ onStartSession, onLaunchInstance, refreshTick = 0, r
         setActionErr((e as Error).message);
       });
 
+  const fastStartControl = async (instance: Instance, action: FastStartAction) => {
+    if (action.disabled) return;
+    const baseName = normalizedName(instance.launch_context?.name ?? fmtId(instance.id));
+    const defaultAsset = `${baseName}-${action.id === 'snapshot' ? 'snapshot' : action.id}`;
+    const asset = window.prompt(`${action.label} asset id`, defaultAsset);
+    if (asset === null) return;
+    const body: Record<string, unknown> = { asset_ref: asset.trim() };
+    if (action.id !== 'snapshot') {
+      const nextName = window.prompt('New instance name', `${baseName}-${action.id === 'warm-pool' ? 'warm' : action.id}`);
+      if (nextName === null) return;
+      body.name = normalizedName(nextName);
+    }
+    setActionErr('');
+    setActionMsg(`${action.label} requested; waiting for operation...`);
+    try {
+      const accepted = await api<{ id?: string; operation?: { id?: string } }>(
+        `/api/instances/${encodeURIComponent(instance.id)}/${action.id}`,
+        {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(body),
+        },
+      );
+      const operationId = accepted.id ?? accepted.operation?.id;
+      if (!operationId) {
+        setActionMsg(`${action.label} accepted.`);
+        load();
+        return;
+      }
+      const terminal = await waitForOperation(operationId);
+      await api('/api/audit/intent', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          event: 'instance.fast_start.terminal',
+          detail: {
+            instance_id: instance.id,
+            provider: instance.provider,
+            action: action.id,
+            operation_id: operationId,
+            state: terminal.state,
+            result: terminal.result,
+            error: terminal.error ?? terminal.failure,
+          },
+        }),
+      }).catch(() => undefined);
+      setActionMsg(`${action.label} ${terminal.state ?? 'completed'}: ${operationId}`);
+      load();
+    } catch (e) {
+      setActionMsg('');
+      setActionErr((e as Error).message);
+    }
+  };
+
   if (err) return <p className="err">Could not load inventory: {err}</p>;
   if (!data) return <p className="empty">Loading…</p>;
   if (!data.instances.length) {
@@ -57,6 +126,7 @@ export function Inventory({ onStartSession, onLaunchInstance, refreshTick = 0, r
       </div>
       {actionErr && <p className="err">Action failed: {actionErr}</p>}
       {actionMsg && <p className="hint" role="status">{actionMsg}</p>}
+      {data.bootstrap_trust && <BootstrapTrustBanner posture={data.bootstrap_trust} />}
       <table className="inventory-table">
         <caption>Available instance deployments</caption>
         <thead>
@@ -87,12 +157,25 @@ export function Inventory({ onStartSession, onLaunchInstance, refreshTick = 0, r
                 <span className={`badge isolation-${i.runtime_posture.isolation}`} title={i.runtime_posture.warning || i.runtime_posture.label}>
                   {i.runtime_posture.label}
                 </span>
+                {i.provider && <div className="cell-note">{i.provider}</div>}
+                {hasVfio(i) && (
+                  <div className="cell-note">
+                    VFIO{assignedGpuDevices(i).length ? ` · ${assignedGpuDevices(i).join(', ')}` : ''}
+                  </div>
+                )}
+                {i.gpu?.reason && <div className="cell-note">{i.gpu.reason}</div>}
                 {i.runtime_posture.warning && <div className="cell-note">{i.runtime_posture.warning}</div>}
               </td>
               <td>
                 {i.loadout}
                 {i.launch_context?.image_ref && <div className="cell-note">{i.launch_context.image_ref}</div>}
                 {i.launch_context?.source && <div className="cell-note">{i.launch_context.source}</div>}
+                {i.storage && (
+                  <div className="cell-note">
+                    Storage: {i.storage.persistent ? 'persistent' : 'ephemeral'}{i.storage.delete_on_destroy ? ' · delete on destroy' : ''}
+                  </div>
+                )}
+                {i.storage?.reason && <div className="cell-note">{i.storage.reason}</div>}
               </td>
               <td>
                 <span className={`badge trust-${i.transport.trust}`} title={`${i.transport.source}${i.transport.evidence ? `: ${i.transport.evidence}` : ''}`}>
@@ -133,12 +216,23 @@ export function Inventory({ onStartSession, onLaunchInstance, refreshTick = 0, r
                     Reconnect
                   </button>
                 )}{' '}
+                {fastStartActions(i).map((action) => (
+                  <button
+                    key={action.id}
+                    aria-label={`${action.label} ${fmtId(i.id)}`}
+                    disabled={action.disabled}
+                    title={action.reason}
+                    onClick={() => fastStartControl(i, action)}
+                  >
+                    {action.label}
+                  </button>
+                ))}{' '}
                 {i.state === 'running'
                   ? <button aria-label={`Stop instance ${fmtId(i.id)}`} onClick={() => control(`/api/instances/${encodeURIComponent(i.id)}/stop`, 'POST')}>Stop</button>
                   : <button aria-label={`Start instance ${fmtId(i.id)}`} onClick={() => control(`/api/instances/${encodeURIComponent(i.id)}/start`, 'POST')}>Start</button>}{' '}
                 <button
                   aria-label={`Destroy instance ${fmtId(i.id)}`}
-                  title={i.state !== 'running' && i.runtime === 'docker' ? 'Stopped Docker row — Destroy removes the container directly (admin-v2 has no instance record).' : undefined}
+                  title={i.state !== 'running' && i.runtime === 'docker' ? 'Stopped Docker row — Destroy asks the sandbox management API to remove it.' : undefined}
                   onClick={() => { if (confirm(`Destroy ${fmtId(i.id)}? This cannot be undone.`)) control(`/api/instances/${encodeURIComponent(i.id)}`, 'DELETE'); }}
                 >
                   Destroy
@@ -155,9 +249,35 @@ export function Inventory({ onStartSession, onLaunchInstance, refreshTick = 0, r
   );
 }
 
+function BootstrapTrustBanner({ posture }: { posture: BootstrapTrustPosture }) {
+  const detail = [
+    posture.ca_provider_ref,
+    posture.trust_bundle_ref,
+    posture.rotation_state,
+    posture.expires_at ? `expires ${new Date(posture.expires_at).toLocaleDateString()}` : undefined,
+  ].filter(Boolean).join(' · ');
+  return (
+    <p className={`trust-banner trust-${posture.status}`} role={posture.status === 'secure' ? 'status' : 'alert'}>
+      <span>{posture.label}</span>
+      {detail && <span className="trust-detail">{detail}</span>}
+      {posture.status !== 'secure' && <span className="trust-detail">{posture.recovery}</span>}
+    </p>
+  );
+}
+
 // VM runtimes included per #1778 — the bridge signals the in-guest agent via
 // qemu-guest-agent, the container/docker path via docker exec.
 const RECONNECTABLE_RUNTIMES = ['docker', 'container', 'vm', 'qemu', 'kvm'];
+const FAST_START_ACTIONS: Array<{
+  id: FastStartActionId;
+  label: string;
+  capabilities: SandboxRuntimeCapabilityId[];
+}> = [
+  { id: 'snapshot', label: 'Snapshot', capabilities: ['instance.snapshot', 'instance.checkpoint'] },
+  { id: 'restore', label: 'Restore', capabilities: ['instance.restore'] },
+  { id: 'fork', label: 'Fork', capabilities: ['instance.fork'] },
+  { id: 'warm-pool', label: 'Warm pool', capabilities: ['warm_pool.manage'] },
+];
 
 function isReconnectable(i: Instance): boolean {
   const runtime = String(i.runtime_posture?.kind ?? i.runtime).toLowerCase();
@@ -179,3 +299,56 @@ function instanceHealth(i: Instance): { kind: 'healthy' | 'stale-agent'; label:
   }
   return { kind: 'healthy', label: i.state };
 }
+
+function hasVfio(instance: Instance) {
+  return instance.capabilities?.some((capability) => capability.id === 'device.vfio')
+    || instance.capability_constraints?.some((constraint) => constraint.capability === 'device.vfio')
+    || Boolean(instance.gpu?.assigned || instance.gpu?.available || instance.gpu?.devices?.length);
+}
+
+function assignedGpuDevices(instance: Instance) {
+  return instance.gpu?.devices?.filter(Boolean) ?? [];
+}
+
+function fastStartActions(instance: Instance): FastStartAction[] {
+  const runtime = String(instance.runtime_posture?.kind ?? instance.runtime).toLowerCase();
+  if (!['vm', 'qemu', 'kvm'].includes(runtime)) return [];
+  const capabilities = new Set((instance.capabilities ?? []).map((capability) => capability.id));
+  const constraints = instance.capability_constraints ?? [];
+  const provider = String(instance.provider ?? '').toLowerCase();
+  return FAST_START_ACTIONS.flatMap((action) => {
+    const advertised = action.capabilities.some((capability) => capabilities.has(capability));
+    const exclusion = constraints.find((constraint) =>
+      constraint.excludes?.some((excluded) => action.capabilities.includes(excluded))
+      || action.capabilities.includes(constraint.capability));
+    if (!advertised && !exclusion) return [];
+    const label = action.id === 'snapshot' && provider === 'libvirt' ? 'Checkpoint' : action.label;
+    return [{
+      id: action.id,
+      label,
+      disabled: Boolean(exclusion),
+      reason: exclusion?.reason,
+    }];
+  });
+}
+
+function normalizedName(value: string) {
+  const cleaned = String(value || 'cockpit-vm')
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/-+$/g, '')
+    .slice(0, 63);
+  const prefixed = /^[a-z]/.test(cleaned) ? cleaned : `a-${cleaned.replace(/^-+/, '')}`;
+  return prefixed.length >= 2 ? prefixed : 'cockpit-vm';
+}
+
+async function waitForOperation(operationId: string): Promise<OperationStatus> {
+  let last: OperationStatus = { id: operationId, state: 'unknown' };
+  for (let i = 0; i < 60; i += 1) {
+    last = await api<OperationStatus>(`/api/operations/${encodeURIComponent(operationId)}`);
+    const state = String(last.state ?? '').toLowerCase();
+    if (['succeeded', 'failed', 'canceled', 'cancelled'].includes(state)) return last;
+    await new Promise((resolve) => window.setTimeout(resolve, 1_000));
+  }
+  return last;
+}