Implementation plan for the next admin slice:

1. Add CSRF-bound versioned plan/apply endpoints; browser requests identify a cache only by cache_ref and the daemon resolves the already managed private path in-process. Arbitrary paths are never accepted.
2. Reuse MaintenanceSetup plan semantics for cache identity, binding/config/provider/model/policy hashes, but enforce browser policy: no service install/start, provider start, model download, migration, reset, or direct SQLite edits. Unsafe prerequisites return exact CLI handoffs.
3. Re-plan on every apply and reject changed plan ids as stale_plan. Apply enrollment/reconcile through MaintenanceManager with idempotency and preserve coalesced initial jobs. Add explicit disable and reconcile controls with target/state validation and receipts.
4. Add a binding plan/apply capability with GitCode API URL defaulted to https://api.gitcode.com/api/v5, owner/name derivation from repo id, strict aliases/scopes, cache identity/version checks, stale plan rejection, and durable idempotency. Existing bindings may be updated atomically; unbind/removal remains unavailable.
5. Extend Maintenance UI with selected cache/repository editor, effect ledger (network, cache, provider/data boundary, blockers, confirmations), review modal, apply receipts, CLI handoffs, and capability-derived disabled states.
6. Cover missing/ambiguous binding, default URL, scope changes, stale plans, partial recovery, coalesced jobs, reload/error states, and responsive Light/Dark/System browser QA.

This remains one epic slice: no tag, release, or go install.

Implemented and merged in !100: https://gitcode.com/urandon/gitcode-mcp/merge_requests/100

Delivered:

• capability-gated maintenance policy plan/apply plus disable/reconcile controls;
• deterministic effect ledgers, stale-plan rejection, exact confirmation, durable bounded idempotency receipts, and replay/conflict semantics;
• atomic repository binding add/update/no-op with opaque cache refs, default/preserved GitCode API routing, normalized scopes, and alias conflict checks;
• explicit CLI handoffs for service install/start, model download, and cache migration; browser authority does not include those operations;
• responsive Svelte workbenches with System default and explicit Light/Dark/System theme selection.

Verification:

• go test ./...
• go vet ./...
• go test -race ./internal/adminhttp ./internal/servicectl ./internal/cache
• npm run check
• npm test
• npm run test:e2e -- --reporter=line: 8 passed, 1 live-environment test skipped
• ./scripts/check-admin-ui-assets.sh
• git diff --check

No release/tag or go install was performed; this is one slice of the UI epic.