apomesh-control-plane

apomesh-control-plane is the UI-layer crate behind the desktop operator console: a Tauri binary whose Rust side is the console’s typed IPC bridge. The Svelte webview never speaks gRPC — it calls invoke("command", …), and this crate answers each call by talking to the orchestrator’s ApomeshDaemon service over gRPC (via apomesh-protocol + tonic), then projects the wire Envelope stream into camelCase view types the webview renders. Its Cargo.toml names its job directly: submit, observe, and cancel sessions against an orchestrator’s gRPC ApomeshDaemon service. You touch this crate to add or reshape a command the console exposes, or the projection that carries a new wire variant to the webview.

The Svelte webview itself — the panes, the layout, the operator walkthrough — is not this crate. See Operate the console for the UI tour.

Position in the workspace

• Layer: UI — the operator surface over the control and execution planes.
• Depends on: apomesh-protocol (the gRPC client + wire types), apomesh-substrate-types (the boot-immutable tier-4 extension-handler registry the projection consults to enrich Payload::Extension events), apomesh-substrate-catalog (the prompt-processor registry for the manifest pin-vs-live diff), plus apomesh-smartchat (the operator-chat service client) and the deep-research projection crate (one enrichment handler). It pulls none of the heavy substrate/orchestrator runtime trees, so the console build stays light.
• Consumed by: nothing in the workspace — it is a leaf binary. Its runtime consumer is the Svelte webview, over Tauri’s invoke() IPC, not a Cargo dep.

What it owns

• The command surface. Every #[tauri::command] the webview reaches via invoke(), registered in one invoke_handler![] in lib.rs. The families:

  Family	Modules	What the commands do
  Endpoints & connection	endpoints, connection	Register, connect, and activate orchestrator endpoints; probe an endpoint’s auth backend; resolve the caller’s tenant (who_am_i).
  Identity & tokens	oauth, tokens	System-browser OIDC PKCE sign-in with transparent refresh; mint, list, and revoke scope-bound runtime tokens.
  Sessions & HITL	session, hitl, tail	Start and cancel a session; answer a human-in-the-loop pause; tail the live event stream.
  Runtime observation	runtime	List and inspect sessions, workers, in-flight dispatches, and cost; read every memory tier; reconstruct state at a position; resume a recoverable session.
  Catalog admin	agents, skills, models, providers	CRUD the per-tenant agent, skill, and model catalogs, the LLM-provider registry, sealed provider credentials, and provider profiles.
  Published registries	published_agents, published_skills, strategy_configs	List, resolve, and publish the versioned, cross-tenant published agents, skills, and strategy configurations.
  SmartChat	smartchat	Drive the operator-chat conversation surface over the daemon’s SmartChat service.
  Tools & MCP	tools_mcp	Introspect the tool registry, invoke a tool, and administer MCP servers.
  Assets	assets	Resolve a terminal envelope’s generated-media reference to bytes over the orchestrator’s REST asset endpoint — the bridge’s one non-gRPC call.

• The typed projection layer. types.rs holds the *View shapes and the PayloadVariant mirror of the wire’s Payload oneof, all camelCase-serialized across the FFI boundary so the webview reads plain JSON. events.rs::project() folds a wire Envelope into an EnvelopeView with a wildcard-free match over Payload — a new wire variant breaks the build here, keeping the closed-enum contract at the boundary.

• The parity canary. The payload_variant_round_trips test in types.rs drives its round-trip off a wildcard-free variant_wire_name match plus a const ALL_PAYLOAD_VARIANTS array, so a new PayloadVariant cannot compile without its wire-name arm. This crate is a contract-parity mirror surface: a wire vocabulary change sweeps it in the same PR.

• Endpoint & profile management. OrchestratorRegistry (endpoints.rs) owns the persisted multi-endpoint registry; ClientState (client.rs) holds one authenticated gRPC channel per endpoint, keyed by EndpointId, with exactly one active at a time.

Public surface

• run() — the entry point: builds the Tauri runtime, installs the plugins (shell, opener, log, store, dialog), wires managed state, and mounts the full invoke_handler![] command surface.
• AuthedDaemonClient + ClientState (client.rs) — the authenticated ApomeshDaemonClient, composed once with its AuthInterceptor at connect time; active_client() backs every daemon-facing command.
• EnvelopeView + the *View types + events::project() — the wire→view projection every observation command returns.
• OrchestratorRegistry (endpoints.rs) — the persisted registry the webview drives to register, connect, and activate endpoints.

Usage

The crate is a binary: run it through the console’s worktree-aware dev launcher.

# From the control-plane UI root — launches the Vite webview + the Tauri shell:
cd ui/control-plane && bun run dev:app

Each linked git worktree gets its own Vite port and isolated app-data, so multiple worktrees don’t collide on port 1420 or share layout state. On first launch, register an orchestrator endpoint (its gRPC URL, e.g. http://127.0.0.1:50051, plus inline credentials or an env-var reference), connect it, and set it active — every session and observation command then targets that endpoint’s channel.

Related

• Operate the console — the operator walkthrough of the UI.
• Take the console tour — first-run onboarding.
• Control and execution — the planes this console fronts.
• apomesh-protocol — the wire this bridge speaks and projects.