feat(aws-control): overview pane and a primitive-based visual pass

[bolichen97]

Summary

Follows #8943 (remove-account, merged); rebased onto main after it landed.

AWS Control was a flat, hand-rolled surface: ~20 retyped card containers with four different insets, nine raw <button>s where primitives exist, four grammars of empty state, three encodings of health, and a consent card that spent four <dl> rows on one boolean. Nothing told the reader whether anything was wrong before they clicked. This brings it to the same bar as Issue Radar / Ops Mission Control, using only primitives that already exist in ui.tsx.

New Overview pane (the app's landing). A metric strip (Accounts, Keys healthy, Drive used, Month to date, Share links, Backup) — each card carries a one-line reading under its number — then an Accounts card and a Cloud drive card side by side, then Paid services. Every figure restates a fact another pane owns; the pane adds no mutation beyond the two consent gates. The bare /aws-control path and unknown segments land here; every named pane path is unchanged.

One account row, two densities. AccountRow gained a variant and is shared by the Overview card and the Accounts pane, so the remove flow (#8943), the Reconnect disclosure and the hand-off gating exist once. Degraded accounts now get a Reconnect button in the row (previously only unresolved rows had a route back to green).

Primitives everywhere. Card + PanelSectionHeader around every list; SearchInput, Checkbox, IconButton, Clickable replace the hand-rolled controls; EmptyState / FilteredEmpty replace the four empty-state grammars (the filtered state now offers Clear in place); loading mirrors the row box; health is a dot plus a Badge word on every row (account, key, backup, share) and the word is never hidden at any width.

Consent. AwsConsentGate compact mode renders receipt / ask / error as one row each with no container of its own, so Overview and Usage lay them in one divide-y list; the default card is rebuilt on Card. Usage's bill row becomes three StatCards; the reason a figure is missing is a visible line, not a title attribute.

Storage split drawn once. StorageBar in shared.tsx is placed by both the Usage StorageMeter and the Overview drive card.

App Store art. Four hero SVGs (hero-{light,dark}.svg, hero-detail-{light,dark}.svg) with the same restraint as the other builtins' art and a hue of their own (cyan, with the amber accent), wired into app.json.

i18n. 41 new keys in all 12 catalogs (+ en-XA), three newly dead keys removed, plural forms per locale (CJK without _one, ru with _few/_many), pluralKeys.json registered.

Behaviour changes, declared. The bare /aws-control path lands on Overview instead of Files. File grid tiles show size · modified under the name instead of the kind word (the kind is already the tile's icon and the list view's Kind column; the two facts a tile could not otherwise show are how big and how recent). "Failed" on an account row is relabelled "Needs attention". Reconnect and Remove are items in the account row's overflow menu. The Accounts pane's totals line ("N accounts · M of K keys healthy", same test id) moves from its own strip into the pane header's subtitle slot. Its account count, and the Overview's Accounts card, count every listed row including the unresolved "Not connected yet" pseudo-row (accounts.length), where the strip used to count resolved accounts only (totals.accounts), so the sentence, the card and the list header always name one number. The Overview's "N need attention" counts the rows that wear the Needs attention badge (degraded), not the unresolved "Unknown" row. Each metric card opens the pane that owns its figure. The default key's star on the Keys card is now a "Default profile" badge with the word beside the glyph. The Backup pane's state badge for a recorded run reads "Backed up" rather than "Up to date", since the ledger records that a run happened, not that it is recent.

Dialogs stay hand-rolled on purpose: DriveSectionView restores focus to a remembered opener that Radix's dialog would fight; their panels are restyled to the card classes.

Screenshots

Overview (dark / light):

Accounts · Files · Usage:

States a plain pane load never shows (account row menu open · filter with no match · Files grid view · Overview before the drive exists · Reconnect guidance open · empty Files · the full consent card · empty Share links · Add accounts expanded · a stale bill with its notice · a failed consent status read as a compact row):

More frames (390px, backup, share links, library, store art)

Tests

Every pre-existing data-testid is kept. Behavioural assertions changed only where the surface moved: the bare path now lands on Overview (six navigation tests updated to say so), the health word is a Badge (tone assertions read the badge variant), the filtered-empty state is FilteredEmpty (one Files assertion rewritten to pin the echo + Clear), the em-dash cost tests assert the value and its visible reason. Added: Overview renders the six metric cards from the mocked queries; the Overview Accounts card offers the same remove flow; Add account lands on the Accounts pane with the disclosure open; the drive card shows the setup EmptyState when exists: false; 390px root list includes Overview; compact consent rows (ask / receipt / error / no-container); storage tiles; backup state badges.

Verification

tsc -b, eslint (0 errors), jscpd (0 clones), lint:phantom-classes, i18n:check (19 checks PASS), docs-lint, brand gate, black gate — clean. Full frontend suite: 1875 files / 29 495 tests passed. Backend: the manifest/asset/registry suites plus test_aws_control_app.py — 554 passed (no Python besides app.json changed). Every frame above is a real render of this branch against fixture APIs (dark 1280, light 1280, dark 390 for all seven panes).

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of 18fc9965455aa363719316e23e468dd812aceaa1 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Both halves of the change hold up under inspection: the Overview restates facts through shared components and shared query cache keys (StorageBar, AccountRow, the Usage pane's cost cache entry) rather than re-deriving them, every declared behavior change has backing code and a stated rationale, failure states are handled per-read, the spec (docs/system-specs/modules/aws-control.md) is updated in the same commit, and temp-screenshots/ is an established repo convention at base. The compact consent ask keeps the billing facts (account, region, credential source) in the row, so the consent surface is denser but not less informed. Nothing rises to a design finding.

Design-Verdict: PASS

Overview drift risk is designed away — every restated figure shares the owning pane's component or cache key, and each behavior change is declared with backing code.

[DESIGN-REVIEWED] 18fc996

[github-actions]

First Principles Review (Fable 5) — ✅ PASS

Premise-level review of 18fc9965455aa363719316e23e468dd812aceaa1 — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

The review is complete. This PR is unusually well-defended: nearly every observable difference is declared in the description with a named harm, the new shared components have counted multi-site consumers, dead code (CrumbHeader, SectionHeader, dead i18n keys) is deleted rather than left, and the primitives pass is mandated by documented invariants in website/AGENTS.md. The committed screenshots follow the repo's documented temp-screenshots/ deliverables convention (1179 tracked files), and the hero-art manifest fields are an existing schema consumed by 20+ builtins.

First-Principles-Verdict: PASS

A read-only Overview built entirely from facts, queries and primitives the panes already own — every item declared, every new symbol multi-consumer, every relabel argued from a nameable defect.

What this change ships

Intent: give the operator one landing surface that answers "is everything fine" before they pick a pane, and unify the app's hand-rolled visuals onto existing primitives. This is an ADDITION, framed as one (feat).

1. New Overview landing pane (metric strip, accounts card, drive card, paid services) — justified; adds no mutation, shares the panes' cache keys.
2. Bare /aws-control now lands on Overview, not Files — declared changed default; load-bearing for item 1's harm.
3. Degraded accounts gain a Reconnect route (previously only unresolved rows had one) — justified gap fix.
4. Health becomes dot + badge word on every row — justified; fixes the counted "three encodings of health".
5. Raw buttons/cards/empty states replaced by ui.tsx primitives — mandated by website/AGENTS.md invariants.
6. Accounts totals move into the header and count every listed row — declared; one population per printed number.
7. File grid tiles show size · modified instead of the kind word — derived (kind already on icon and list column).
8. Consent gate compact rows for ask/receipt/error — extension of an existing prop; existing callers unaffected (they gated on receipts).
9. Relabels ("Needs attention", "Default profile", "Backed up") — declared, each argued from what the data actually records.
10. Hero art via existing manifest fields; 41 CI-mandated i18n keys; CrumbHeader/SectionHeader/dead keys deleted — existing mechanisms plus genuine subtractions.

New shared symbols counted: MetricCard 9 uses, QuickTile 3, StorageBar 4 (Usage meter + Overview, replacing a second drawing of the same split). No zero-consumer surface, no second spelling of an existing mechanism found.

[FIRST-PRINCIPLES-REVIEWED] 18fc996

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 18fc9965455aa363719316e23e468dd812aceaa1 and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 18fc996

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 18fc9965455aa363719316e23e468dd812aceaa1: <one-sentence reason>

[github-actions]

UX Review (Fable 5) — 🟡 CONCERNS

UX-level review of 18fc9965455aa363719316e23e468dd812aceaa1 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

All evidence reviewed. Reconciliation is complete: the blind reader correctly identified essentially every new control across all 24 screenshots; no primary control was misread or refused. Remaining items are concerns-level.

UX-Verdict: CONCERNS

Overview lands and reads well cold; the one real wrinkle is "Amazon S3 — Confirmed" sitting under "No cloud drive yet," which the blind reader could not reconcile.

Watch

• Shot-19: Overview renders "No cloud drive yet" with "Paid services · Amazon S3 · Confirmed" directly below; reader: "I can't reconcile that." Every first-run user passes through this state (consent granted, bucket not yet created) — moderate frequency, confusion not failure. Fix: when consent is granted, let overview.drive_empty_body acknowledge it ("Storage is confirmed — the bucket hasn't been created yet.").
• "Set up cloud drive" reads as creating a paid resource; reader was "hesitant… would want confirmation of that first," but the handler only opens the Files pane's review-and-confirm flow. One line — "Nothing is created until you review and confirm." — removes the hesitation blocking the pane's main empty-state action.
• Metric cards and drive tiles navigate on click, but the reader rated that "a guess" both times (correct, but unmarked). A small affordance (trailing chevron on MetricCard/QuickTile) would make the landing pane's primary paths self-evident.

Evidence gaps

• Artifact library's empty state was rewritten onto EmptyState (LibrarySection library-empty) but no screenshot shows the empty library — add one alongside shot-13.
• Files search with no matches now renders FilteredEmpty (drive-search-empty); only the Accounts variant (shot-04) is shown — one screenshot of a no-match file search would close it.

[UX-REVIEWED] 18fc996

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed 18fc9965455aa363719316e23e468dd812aceaa1 — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] 18fc996

Verdict parsed from the review's SHA-scoped output markers for commit 18fc9965455aa363719316e23e468dd812aceaa1.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 18fc9965455aa363719316e23e468dd812aceaa1: <one-sentence reason>

[bolichen97]

Round 1 response — all on 07fd1e266 (one amended commit).

GPT 5.6 (3 blocking) — all fixed

• Overview hides read failures — each of the pane's reads now renders AwsErrorNotice with a retry when it fails: costs, share links and backup under the metric strip (overview-{costs,shares,backup}-error), the drive read inside the Cloud drive card (overview-drive-error) instead of the setup empty state. The stat holds a dash with "No figure right now". A 409 from the drive or bill read is the reader's pending decision (setup / the CE gate on the same pane), not a failure, so it keeps routing there — same split the Usage pane makes. Three tests pin it.
• Storage tiles lack a 320px layout — grid-cols-1 sm:grid-cols-3, and the meter now draws the shared QuickTile (see First Principles below).
• Degraded row has a third action — Reconnect is now an item in the row's overflow menu (same account-reconnect test id, opens the same disclosure); the row carries the select surface and the menu only. Test added.

Design (CONCERNS) — fixed

• The compact ask meta line now renders the account it would bill (aws-consent-account) before region and credential source; the test pins it. The previous comment claimed the row kept it while the JSX did not — the comment was right about the requirement and wrong about the code.
• The "a way through to the pane" sentence in the Overview doc comment was a promise the tiles don't keep; reworded to what is true (the pane is one rail click away). Spec matches.

First Principles (CONCERNS)

• StorageMeter.onOpen zero consumers — dropped, with its Clickable branch.
• Two spellings of the section tile — StorageMeter now renders QuickTile; one exported SECTION_TILES (section → icon + label) in DrivePage.tsx feeds both it and the Overview card. SECTION_TILE_ICON and OVERVIEW_TILES are gone.
• Stale TODO(PaneHeader subtitle) — removed; the remaining comment states the real reason the blurb is not the header's subtitle (it must leave when the empty state arrives; the slot is unconditional).
• feat(chat): offer the selection toolbar while a reply streams #8990 content in the patch — stale-compare artefact, not the branch: git log origin/main..HEAD is exactly one commit, git diff --stat main..HEAD is 45 files and the PR's changedFiles is 45. The branch had been rebased onto main past feat(chat): offer the selection toolbar while a reply streams #8990 before that review ran.

Also from re-shooting the frames after the changes: the Overview drive tile label wraps instead of truncating ("Artifac…" at 1280 in the half-width card), and the account row no longer shows a stray "·" at 390px when the region hides. Screenshots in the description re-pinned to the new sha.

[bolichen97]

Round 2 — on aed315f88.

GPT 5.6 (1 blocking) — fixed. Both Overview reads now branch on the error code: only a 409 whose code is aws_consent_required is the reader's pending decision (setup / the CE gate); every other rejection, the account_unavailable / account_mismatch 409s included, renders AwsErrorNotice with its retry and hand-off — the drive card says the account sentence for a 409, the read-failed sentence otherwise, the same split DrivePaneGate makes. Test pins a stale-connection 409 → notice and a consent 409 → setup on the same fixture.

First Principles (CONCERNS) — taken.

• StorageMeter no longer prints the byte total and object count; the Usage pane's stat cards own those and the meter owns the split. The Overview drive card likewise drops its headline figure (overview-drive-used) — the Drive used metric card above already prints it. One rendering per fact per pane; spec sentence added.
• Item 9 (file tile subtitle: kind → size · modified) was a deliberate change that the description failed to declare; it now does, alongside the other declared behaviour changes.

[bolichen97]

Round 3 — on 537880124 (rebased onto current main; still one commit).

GPT 5.6 (1 blocking) — fixed as prescribed. The failure captions are gone: a stat whose read failed shows the dash and nothing under it, on the Overview (spend, drive, share links, backups) and on the Usage pane (console-cost-failed-note removed). The AwsErrorNotice under the strip is the single surface that says the read failed, with its retry and hand-off. The consent caption stays — that is a pending decision, not an error. Two orphaned keys (overview.stat_spend_unavailable, console.stat_cost_unreadable) removed from all 12 catalogs; tests updated to assert the caption's absence.

First Principles (CONCERNS) — taken.

• SectionHeader deleted from shared.tsx with its test block — same grounds as CrumbHeader, zero consumers after this pass.
• The accounts totals line's move into PaneHeader's subtitle slot is now declared in the description.
• MetricCard vs issue-radar's Stat: noted; lifting one into ui.tsx is a cross-app change I would rather land on its own than fold into this pass.

[bolichen97]

Round 4 — on fd59be214, answering the UX lane (advisory, but three of its points were real).

Taken

• One population. The Overview's Accounts card, its sub-line and the list now all count the same rows — every row, the unresolved pseudo-row included (accounts.length, not totals.accounts); the Accounts pane's header sentence uses the same count, so "3 accounts" sits over a list headed "3". The sub-line counts rows whose badge is not Healthy (degraded and unknown alike). Test pins card = list = 3, sub-line = 2 on a fixture with an unresolved row.
• Danger tone. access-forget ("Remove from list") is back to the plain Btn, as on main; danger is reserved for Withdraw, which actually revokes something.
• Inert elements styled as targets. One prop, two shapes: QuickTile with onClick is the bordered, hover-lit target and opens what it names — the Overview's three drive tiles now navigate to Files / Artifact library / Backup (test pins it); without onClick it draws as a flat row with no border, which is what the Usage meter's read-only readings now are. The keys Badge is the repo's standard non-interactive pill; left as is.
• Withdraw keeps its object in the compact receipt ("Withdraw confirmation"); withdraw_short removed from all catalogs.
• "broker" is gone from overview.accounts_note in all 12 languages: "Agents use these keys without ever seeing them; nothing from a key appears in a chat."
• Evidence gaps — four frames added to the description: the account row's menu open on the degraded row, the accounts filter with no match (Clear in place), Files in grid view with size · modified, and the Overview before the drive exists.

Not taken

• backup_last_run's · — when bytes are unknown is main's behaviour, untouched by this pass (the capture fixture omits the size); happy to fix it in its own change.

[bolichen97]

Round 5 — on 581d74213.

GPT 5.6 (non-blocking finding) — fixed. The Overview's two compact gates now pass onConsentChange: the S3 grant invalidates the drive read, the CE grant the bill read, so a consent 409 cached before the confirm is re-issued instead of the pane showing "set up" and a dash under a receipt that says Confirmed.

UX (CONCERNS) — taken

• Attention count vs row vocabulary. The sub-line now counts exactly the rows that wear the "Needs attention" badge (degraded); the unresolved "Unknown" row is in the account count but not in this one. Test pins 3 accounts / 1 needs attention on the fixture with an unresolved row.
• Stat cards signal clicks they don't have. Every metric card now opens the pane that owns its figure (accounts and keys → Accounts, drive → Files, spend → Usage, share links → Share links, backups → Backup); MetricCard.onClick is required for that reason, and its unused className is gone. Test pins spend → Usage.
• Withdraw consequence. The compact receipt carries one line under its meta: "Withdrawing stops agents using this service until you confirm again." (withdraw_effect, 12 languages). Test pins it.
• Default-key star. Now a muted "Default profile" badge with the star inside it, so the glyph has its word.
• Evidence gaps — three more frames in the description: the degraded row's Reconnect guidance opened from the menu (command + Copy), the empty Files pane, and the full (non-compact) consent card as the Files pane shows it before storage consent.

First Principles (from the previous round) — openPane's extraState narrowed to { withAddAccounts?: boolean }; MetricCard.className dropped; the account-count population change is declared in the description.

[github-actions]

GPT 5.6 Review — ⚠️ review incomplete

GPT 5.6 did not produce a complete verdict for 581d74213d8e00dce13986a65789cdd330fcda5e; inspect the workflow logs and re-run it.

This comment is updated in place on each push.

See the GPT 5.6 Review job logs; this commit has no completed GPT verdict.

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 581d74213d8e00dce13986a65789cdd330fcda5e: <one-sentence reason>

[github-actions]

GPT 5.6 Review — ⚠️ review incomplete

GPT 5.6 did not produce a complete verdict for 581d74213d8e00dce13986a65789cdd330fcda5e; inspect the workflow logs and re-run it.

This comment is updated in place on each push.

See the GPT 5.6 Review job logs; this commit has no completed GPT verdict.

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 581d74213d8e00dce13986a65789cdd330fcda5e: <one-sentence reason>

[bolichen97]

Round 6 — on 2c4cdf686. Design suggestion taken: the Accounts card says "All healthy" only when every row is ok; with an Unknown row and nothing degraded the caption stays silent rather than assert health the list below does not show. Test pins it. (The round-5 failures across the review lanes were API rate limit exceeded for installation on the shared app token, not this diff; those runs were re-run.)

[bolichen97]

Round 7 — on fe721b1e2.

GPT 5.6 (1 blocking) — fixed in both cost views. A 200 that carries fetchError is a failed refresh the backend softened with its cache: the figure stays (it is the last true reading) and AwsErrorNotice now says the refresh failed beside it, with the retry — on the Overview's Month to date card and on the Usage pane. console.costs_refresh_failed, 12 languages; a test on each view pins figure + notice together.

UX (CONCERNS) — taken

• "Up to date" over any run — the badge now says "Backed up" (12 languages): what the ledger records, not a recency it cannot vouch for.
• "Month to date" names no scope — with a figure, the card's sub-line reads "This account's AWS bill".
• bg-aim ≈ accent in the purple themes — the library segment is back on bg-info, the token main used; the two largest segments are distinct again in the re-shot frames.
• Evidence — the empty Share links pane is in the description now.

Not taken

• Make the "Needs attention" badge open Reconnect — that is the third control on the row that GPT 5.6 blocked in round 1 (max-two-buttons-per-row); Reconnect stays the first item of the row's menu, and the badge stays a word.
• Name the order of magnitude on the consent asks — the gate cannot know the bill before the service is used; a number there would be a guess presented as a fact.
• Library empty state — the library's list is the local artifact store, which the capture fixture cannot empty from the API alone; and backup_last_run's · — when bytes are unknown is main's behaviour, untouched here.

[bolichen97]

Round 8 — on 18fc99654. No code changes; art and evidence only.

UX (CONCERNS) — taken

• Hero art shared Issue Radar's green — the four hero SVGs now own a cyan family (#22d3ee / #164e63 …) with the amber accent kept; every other tone was mapped one-for-one so the composition is unchanged. Store frames in the description re-rendered.
• Incoherent empty-Files fixture — recut: the frame now serves a drive whose Files section holds 0 objects, so the rail reads "Files 0" beside "Files is empty". In the app the two come from one drive read and one list read of the same bucket, refreshed together after every mutation, so they cannot disagree outside the moment of a refresh.
• Evidence — three frames added: Add accounts expanded (the Checkbox list), the Overview with a stale bill and its notice, and the Paid services card with a failed consent status read as a compact error row (retry + hand-off).

Not taken

• "No cloud drive yet" beside "S3 · Confirmed" — both are true and independent: consent is the permission to spend, the bucket is the thing to spend on, and the confirm card on the Files pane is what makes the second possible. Tying them with a sentence would need the drive card to read the consent state, a second reader of a query the gate already owns; the setup CTA under the empty state is the reader's next step either way.
• Hover-only discoverability of metric-card navigation — noted; it is the product's StatCard pattern, and the cards keep the cursor and role the primitive gives them.