Isis ops · Output gallery (admin)

Purpose#

Operator view of the output gallery (§24.10) with the same filter facets as the customer gallery, plus bulk actions (re-tag, send-to-editorial, revoke-consent, takedown) with operator audit and an undo window.

Entry points#

• Direct URL — /isis/output-gallery
• External runbooks / deep links
• Not in canonical IA — no sidebar entry

Layout regions#

Page does NOT wrap in AdminShell. Resolves a GalleryAdminContext ({ records, authorization, nowUnixSeconds }) via binding (bindGalleryAdminLoader) and renders <OutputGalleryAdminPanel {...ctx} />. Default binding yields { records: [], authorization: { operatorId: 'operator-anon', tier: 'operator-admin' }, nowUnixSeconds: now }.

• OutputGalleryAdminPanel:
  • Filter controls — GalleryFilter state shaped by applyGalleryFilter; facets include excludeTakenDown, domain set (tara / veritas / nyx / nisaba / metis / arete / sophia), kind set (image / video / audio-narration / audio-music / mesh-3d / caption-dub / accessibility-pass), entitlement set (contemplative / curated-creator / aaa-creator / operator-admin), CSV fields parsed via csvToList
  • Records list — filtered records; selection set tracked in selected: readonly string[]
  • Bulk action chooser — BulkAction['kind'] selector (default 'takedown'); reason / tags textbox bound to reasonOrTags
  • Validate + record — validateBulkAction and recordBulkAction run on submit; undo window provided by undoBulkAction

States#

• Anonymous → global middleware redirects
• Binding unset → empty records list; authorization operator-anon / tier operator-admin
• Filter excludeTakenDown: false → taken-down records visible
• Domain / kind / entitlement filter toggled → applyGalleryFilter narrows the records list
• CSV input parsed into list → empty list returns undefined from csvToList (clears the filter)
• Bulk action validateBulkAction rejects → no record written
• Bulk action recorded → recordBulkAction returns a BulkActionInvocation; undo window opens
• Undo within window → undoBulkAction reverses the action

Interactions#

• Domain toggle chips (per OutputDomain)
• Kind toggle chips (per OutputKind)
• Entitlement toggle chips (per OutputRecord['entitlementTier'])
• CSV inputs (e.g., creator id list) — parsed via csvToList
• "Exclude taken-down" checkbox
• Record-row checkbox (selection)
• Bulk action kind select — sets actionKind
• Reason / tags textbox — bound to reasonOrTags; meaning depends on actionKind
• Submit bulk action — validates + records
• Undo bulk action (within undo window)

Data & contracts#

• Reads: binding() returns GalleryAdminContext with records: readonly OutputRecord[], authorization: AuthorizationCheck, nowUnixSeconds: number
• Writes: in-component via recordBulkAction / undoBulkAction (pure functions from @isis/output-gallery contract). Persistence happens via a downstream binding (not visible at page level)
• Realtime: None.
• Auth/role check: only the global middleware; tier supplied by authorization (defaults operator-admin)

Cross-references#

• Shell: shell/02-routing-layouts.md
• Sibling Isis routes: isis-runpod-endpoints.md (execution), isis-civitai-intake.md (intake)
• Related canonical workspace: ../workspaces/safety/rights.md (provenance / consent), ../workspaces/content/editorial.md (send-to-editorial target)
• Library: @isis/output-gallery — applyGalleryFilter, recordBulkAction, undoBulkAction, validateBulkAction, AuthorizationCheck, BulkAction, BulkActionInvocation, GalleryFilter, OutputDomain, OutputKind, OutputRecord
• Component source: apps/oshun/admin/src/app/isis/output-gallery/OutputGalleryAdminPanel.tsx

Open questions / known gaps#

• No session / scope check at the page level
• tier: 'operator-admin' as const default lets the binding defaults grant maximum scope — verify production binding gates appropriately
• The relationship between gallery send-to-editorial bulk action and the /editorial workspace is not declared in OSHUN_ADMIN_WORKSPACE_RELATIONSHIPS