Document how the desktop client should classify and display sub-mode artifacts, including summary-only outputs and markdown code documents.
Constraint: Keep interface paths stable; update display and validation rules only
Confidence: high
Scope-risk: narrow
Not-tested: Documentation-only change; git diff --check passed
Record the 2026-05-31 production Manager smoke result for ordinary sub mode after the Agent Manager Runtime image update.
Constraint: Keep ordinary sub mode separate from swarm mode and document real production ids only
Confidence: high
Scope-risk: narrow
Not-tested: Documentation-only change; git diff --check passed
Add separate Runtime mode selection for ordinary sub and swarm flows, including Swarm-specific create payload shaping and Azure VM env wiring. Document the ordinary sub artifact callback gap, swarm runtime findings, PayPal billing boundaries, deployment migration requirements, and desktop/API progress.
Constraint: Keep ordinary sub and HeiCode-Swarm Runtime deployments separate
Confidence: high
Scope-risk: moderate
Tests: go test ./...
Sprint 13. Lifts the resource-binding wizard's "Connect cloud account"
step from a disabled "Coming soon" button to a real binding flow,
scoped to Azure for now (AWS / GCP coming soon).
What ships:
- New AzureCloudBindingSheet — Service Principal credentials form
(subscription_id / tenant_id / client_id / client_secret + display
name)
- Creates a mcp-server ResourceBinding of type 'cloud_account' with
provider=azure metadata, permission_scope=['azure:read'], status
flips between 'active' (vault configured) and 'pending' (vault
not yet wired)
- Sheet shows a yellow warning when OpenBao isn't configured,
explaining that client_secret will NOT be persisted server-side
until vault is online — operators re-enter or rotate the secret
once vault is up
- Explicit "what Heicode will / will not do" footer card per
product docs §13.9 — read-only ARM, never modify without desktop
approval, never log client_secret
- Cloud step "Connect" button now opens this sheet (was disabled)
- Wizard summary description updated: AWS/GCP labelled coming soon
instead of implying all three providers ship today
Phase 2 (Azure OAuth code flow) + phase 3 (ARM auto-discovery) need
Azure App Registration + OpenBao online first — separate sprints.
i18n localized en + zh.
Verification:
- tsc --noEmit clean
- no backend change — leverages existing mcp-server ResourceBinding
endpoint which already supports cloud_account type
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sprint 11 — closes M13 ("七态完整性") on the three highest-traffic
pages (Deployments, Events, Audit). Earlier behaviour was binary
(loading skeleton OR card list); 401/403 and offline both fell
through to a toast or a blank page.
New /components/query-state.tsx:
- One wrapper that takes isLoading + error + isEmpty + retry
- classifyError reads axios + fetch shapes; maps to 'permission'
/ 'network' / 'generic'
- Permission state: ShieldOff icon, no retry button (admins must
grant access; retry would just 401 again)
- Network state: WifiOff icon, retry wired
- Generic state: AlertTriangle + retry + decoded error.message
- Empty state: passthrough to existing EmptyState
- Loading: passthrough to caller's loadingFallback or 3 skeleton rows
Applied to:
- AgnetDeploymentsPage (replaces inline loading/empty ternary)
- AgnetAuditPage (same)
- AgnetEventsPage (wraps the events ol)
In all three, the existing useQuery now also surfaces error + refetch.
retry: false set so QueryState handles error display directly
instead of TanStack retrying 3 times silently.
i18n strings added for 5 new copy keys (permission denied, network
unreachable, retry, load failed) in en + zh.
Verification:
- tsc --noEmit clean
- no backend change
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
chenchenandClaude Opus 4.8