Allowlisted files

Only operational docs and config. DB files, credentials, and private config are never shown.

.claude/commands/webui-dispatch.md

# /webui-dispatch

Placeholder milestone: **Web UI Dispatch MVP**.

## Goal

Local-only web dashboard that lets the operator see and move tasks through Mission Control. Read + controlled writes. Still no brain logic in the UI — it calls the same bridge/API surface workers use.

## Scope

In:
- Local dashboard page served by `mission_control.api` (FastAPI).
- Form to create a task (title, expected output, domain, priority, project).
- Form/action to assign a worker to a task.
- Action to move a task through statuses (pending → in_progress → blocked → done, etc.).
- Per-task history view (events list, runs list).
- Board summary view (counts, blocked, in-progress by worker, recent events).
- All actions call existing service methods. No new orchestration logic in UI layer.

Out:
- **No public exposure.** Bind to `127.0.0.1` only. No reverse proxy, no auth layer yet, no remote access.
- No auto-dispatch, no scheduling, no "smart" suggestions.
- No external notifications.
- No copying of `builderz-labs/mission-control` UI code.
- No heavy SPA framework. Server-rendered HTML + minimal JS preferred; templating with stdlib `string.Template` or simple Jinja if already present.

## Constraints

- Python stdlib + existing FastAPI patterns.
- Reuse `mission_control.service` and `mission_control.bridge`; do not duplicate logic.
- Skills usage: FastAPI skill for route/template wiring patterns only; frontend-design skill for visual polish only. Architecture rules in `CLAUDE.md` override skill defaults.
- Mission Control still records — Fakker still decides. UI is a thin operator surface.

## Deliverables

1. New routes on the existing FastAPI app under `/ui/...` or a mounted sub-app.
2. Templates/static assets under `mission_control/ui/` (create dir if needed).
3. Tests: route-level tests using FastAPI TestClient for each page/form.
4. Doc update: short `MISSION_CONTROL.md` section pointing at local URL and reminding "local only".
5. `/verify` clean.
6. Commit message: `add web ui dispatch mvp`.

## Open Questions (resolve before starting)

- Templating: stdlib `string.Template`, Jinja2 (would be a new dep), or hand-rolled f-strings?
- Auth: skip entirely for v1 since local-only, or stub a single-token header?
- Where does the UI live: same FastAPI app process, or separate?

Ask the user before implementing.

## Done When

- Operator can open local URL, see board, create task, assign worker, move status, view history.
- All UI actions go through existing service/bridge functions.
- Bound to localhost; no remote-accessible endpoint.
- Tests cover each page and form.
- `/verify` green.
- Committed with the message above.