Context. surface studio · domain isis · route /studio/isis/gpu-worker-architecture · auth signed-in + studio entitlement (AAA-gated — segment gpu-worker-architecture in AAA_ONLY_STUDIO_ROUTES) · source apps/oshun/web/src/app/studio/isis/gpu-worker-architecture/page.tsx
Last walked. 2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data (2xx), console/page-errors, expected content, screenshot verified; live screen-reader, touch, offline, and telemetry-delivery checks pending a manual AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body re-derived 2026-06-03 from current source (lane-console architecture)
Purpose#
Admin RunPod endpoint-operations dashboard: it reads the live dashboard context
(endpoint health rows, tenant cost windows vs budget envelopes, queue snapshot,
secret rotations) from GET /v1/admin/isis/runpod-endpoints, and drives
operator-audited secret-key rotations through their state machine via
POST …/runpod-endpoints/rotations + …/:rotationId/advance. It is admin-scoped
and fails closed.
Entry points#
- Sibling quick-action from
/studio/isis/intelligent-routing - Studio index (
/studio) - Direct URL / bookmark (AAA entitlement required)
Layout regions#
page.tsx mounts <ShellLayout active="studio"> (no breadcrumb panel) and three
panels: the workspace, the Route Map, and sibling quick-actions.
- Header: shell header
- Workspace panel (
data-isis-gpu-worker-architecture-workspace):<h1>(WorkspaceHeading) "Isis GPU Worker Architecture Workspace"- Summary paragraph (
data-isis-gpu-worker-architecture-summary) +data-runpod-summary(endpoint/budget/queue counts) - Endpoint list (
data-runpod-endpoints, eachdata-runpod-endpointwithdata-runpod-endpoint-badge); filter inputdata-runpod-search - Budget envelopes (
data-runpod-budgets/data-runpod-budget) - Queue snapshot (
data-runpod-queue/data-runpod-queue-job) - Secret rotations (
data-runpod-rotations/data-runpod-rotationwithdata-runpod-rotation-state) + start-rotation form (data-runpod-start-form)
- Route Map panel (
data-isis-gpu-worker-architecture-route-map):<h2>Route Map</h2>overSTUDIO_ISIS_GPU_WORKER_ARCHITECTURE_ROUTE_MAP(5 entries) - Sibling quick-actions panel:
/studio/isis/intelligent-routing,/studio
States#
- Loading —
data-runpod-loading"Loading RunPod dashboard…" - Unauthorized — 401/403 admin-scope fail-closed;
data-runpod-unauthorized - Error — non-OK or malformed context;
data-runpod-error - Ready — context present; endpoints, budgets, queue, rotations render
- Result — after a rotation action,
data-runpod-action-result(data-runpod-action-status)
Interactions#
Secret rotations#
- Advance (
data-runpod-rotation-advance=<rotationId>, button) — advances the rotation to the next state viaPOST …/runpod-endpoints/rotations/ :rotationId/advance - Rollback (
data-runpod-rotation-rollback=<rotationId>, button) — also POSTs to the…/:rotationId/advanceendpoint (no separate rollback verb)
Start-rotation form (data-runpod-start-form)#
- Rotation id (
data-runpod-start-id, text input) - Endpoint (
data-runpod-start-endpoint,<select>of endpoint ids) - New key id (
data-runpod-start-newkey, text input) - Old key id (
data-runpod-start-oldkey, text input) - Rationale (audit) (
data-runpod-start-rationale, text input) - Start rotation (
data-runpod-start-submit, button; "Working…" while submitting) —POST /v1/admin/isis/runpod-endpoints/rotations
Filter#
- Search (
data-runpod-search, input,aria-label="Filter endpoints by name, id, region, or GPU class")
Route Map#
- Route-map articles ×5
Sibling quick-actions#
- Open Isis Intelligent Routing workspace →
/studio/isis/intelligent-routing - Back to Studio workspace index →
/studio
Data & contracts#
- Reads:
GET /v1/admin/isis/runpod-endpoints(rows, budgets, queue, secretRotations) - Writes:
POST /v1/admin/isis/runpod-endpoints/rotations(start a rotation)POST /v1/admin/isis/runpod-endpoints/rotations/:rotationId/advance(drive the rotation state machine; both the Advance and Rollback buttons target this verb)
- Realtime: none
- Caching: client fetch on mount,
cache: 'no-store',buildBffAuthHeaders() - Auth/role check: admin-scoped, fail-closed (401/403); route gated on signed-in + studio entitlement (AAA segment)
- Component sources:
apps/oshun/web/src/components/studio/StudioIsisGPUWorkerArchitectureWorkspace.tsxapps/oshun/web/src/components/studio/StudioIsisGPUWorkerArchitectureRouteMap.ts
Cross-references#
- Studio overview:
../../studio-overview.md - AAA gating:
libs/isis/entitlements/src/studio-boundary.ts - Sibling routes:
Open questions / known gaps#
- No breadcrumb on this route — navigation is via sibling quick-actions
- The Rollback button reuses the
…/:rotationId/advanceverb rather than a dedicated rollback endpoint — confirm the state machine interprets the requested transition correctly for rollbacks