---
path: /studio/isis/gpu-worker-architecture
surface: studio
domain: isis
auth:
  signed-in + studio entitlement (AAA-gated — segment `gpu-worker-architecture`
  in `AAA_ONLY_STUDIO_ROUTES`)
source: apps/oshun/web/src/app/studio/isis/gpu-worker-architecture/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; live
  screen-reader, touch, offline, and telemetry-delivery checks pending a manual
  AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body
  re-derived 2026-06-03 from current source (lane-console architecture)'
---

# Isis GPU Worker Architecture

## Purpose

Admin RunPod endpoint-operations dashboard: it reads the live dashboard context
(endpoint health rows, tenant cost windows vs budget envelopes, queue snapshot,
secret rotations) from `GET /v1/admin/isis/runpod-endpoints`, and drives
operator-audited secret-key rotations through their state machine via
`POST …/runpod-endpoints/rotations` + `…/:rotationId/advance`. It is admin-scoped
and fails closed.

## Entry points

- Sibling quick-action from `/studio/isis/intelligent-routing`
- Studio index (`/studio`)
- Direct URL / bookmark (AAA entitlement required)

## Layout regions

`page.tsx` mounts `<ShellLayout active="studio">` (no breadcrumb panel) and three
panels: the workspace, the Route Map, and sibling quick-actions.

- **Header**: shell header
- **Workspace panel** (`data-isis-gpu-worker-architecture-workspace`):
  - `<h1>` (`WorkspaceHeading`) "Isis GPU Worker Architecture Workspace"
  - Summary paragraph (`data-isis-gpu-worker-architecture-summary`) +
    `data-runpod-summary` (endpoint/budget/queue counts)
  - Endpoint list (`data-runpod-endpoints`, each `data-runpod-endpoint` with
    `data-runpod-endpoint-badge`); filter input `data-runpod-search`
  - Budget envelopes (`data-runpod-budgets` / `data-runpod-budget`)
  - Queue snapshot (`data-runpod-queue` / `data-runpod-queue-job`)
  - Secret rotations (`data-runpod-rotations` / `data-runpod-rotation` with
    `data-runpod-rotation-state`) + start-rotation form (`data-runpod-start-form`)
- **Route Map panel** (`data-isis-gpu-worker-architecture-route-map`): `<h2>Route
  Map</h2>` over `STUDIO_ISIS_GPU_WORKER_ARCHITECTURE_ROUTE_MAP` (5 entries)
- **Sibling quick-actions panel**: `/studio/isis/intelligent-routing`, `/studio`

## States

- [ ] **Loading** — `data-runpod-loading` "Loading RunPod dashboard…"
- [ ] **Unauthorized** — 401/403 admin-scope fail-closed;
      `data-runpod-unauthorized`
- [ ] **Error** — non-OK or malformed context; `data-runpod-error`
- [ ] **Ready** — context present; endpoints, budgets, queue, rotations render
- [ ] **Result** — after a rotation action, `data-runpod-action-result`
      (`data-runpod-action-status`)

## Interactions

### Secret rotations

- [ ] **Advance** (`data-runpod-rotation-advance=<rotationId>`, button) — advances
      the rotation to the next state via `POST …/runpod-endpoints/rotations/
      :rotationId/advance`
- [ ] **Rollback** (`data-runpod-rotation-rollback=<rotationId>`, button) — also
      POSTs to the `…/:rotationId/advance` endpoint (no separate rollback verb)

### Start-rotation form (`data-runpod-start-form`)

- [ ] **Rotation id** (`data-runpod-start-id`, text input)
- [ ] **Endpoint** (`data-runpod-start-endpoint`, `<select>` of endpoint ids)
- [ ] **New key id** (`data-runpod-start-newkey`, text input)
- [ ] **Old key id** (`data-runpod-start-oldkey`, text input)
- [ ] **Rationale (audit)** (`data-runpod-start-rationale`, text input)
- [ ] **Start rotation** (`data-runpod-start-submit`, button; "Working…" while
      submitting) — `POST /v1/admin/isis/runpod-endpoints/rotations`

### Filter

- [ ] **Search** (`data-runpod-search`, input,
      `aria-label="Filter endpoints by name, id, region, or GPU class"`)

### Route Map

- [ ] **Route-map articles** ×5

### Sibling quick-actions

- [ ] **Open Isis Intelligent Routing workspace** →
      `/studio/isis/intelligent-routing`
- [ ] **Back to Studio workspace index** → `/studio`

## Data & contracts

- **Reads**: `GET /v1/admin/isis/runpod-endpoints` (rows, budgets, queue,
  secretRotations)
- **Writes**:
  - `POST /v1/admin/isis/runpod-endpoints/rotations` (start a rotation)
  - `POST /v1/admin/isis/runpod-endpoints/rotations/:rotationId/advance` (drive the
    rotation state machine; both the Advance and Rollback buttons target this verb)
- **Realtime**: none
- **Caching**: client fetch on mount, `cache: 'no-store'`, `buildBffAuthHeaders()`
- **Auth/role check**: admin-scoped, fail-closed (401/403); route gated on
  signed-in + studio entitlement (AAA segment)
- **Component sources**:
  - `apps/oshun/web/src/components/studio/StudioIsisGPUWorkerArchitectureWorkspace.tsx`
  - `apps/oshun/web/src/components/studio/StudioIsisGPUWorkerArchitectureRouteMap.ts`

## Cross-references

- Studio overview: [`../../studio-overview.md`](../../studio-overview.md)
- AAA gating: `libs/isis/entitlements/src/studio-boundary.ts`
- Sibling routes:
  - [`studio-isis-intelligent-routing.md`](./studio-isis-intelligent-routing.md)
  - [`studio-isis-gpu-worker.md`](./studio-isis-gpu-worker.md)
  - [`studio-isis-multi-gpu-orchestration.md`](./studio-isis-multi-gpu-orchestration.md)

## Open questions / known gaps

- [ ] No breadcrumb on this route — navigation is via sibling quick-actions
- [ ] The Rollback button reuses the `…/:rotationId/advance` verb rather than a
      dedicated rollback endpoint — confirm the state machine interprets the
      requested transition correctly for rollbacks