Implementation plan (slice E):
- Add a CSRF-bound, observation-only admin compare endpoint over the existing cache/service/RAG use cases. It will run deterministic full-text and requested hybrid searches side by side, never sync, set up a provider, or enqueue indexing.
- Extend the source-search explanation contract with raw lexical/semantic scores alongside fusion/ranks, namespace id, eligible/embedded/missing/stale/failed chunks, and content/covered generation. Preserve filtering before semantic top-K and reject stale chunk hashes before display.
- Add explicit provider smoke and bounded RAG repair capabilities. Smoke is an operator-requested provider read; setup/start/model download remain CLI handoffs. Repair will have an exact plan, a bounded maximum chunk count, durable idempotency, coalescing, and a visible local-provider data boundary.
- Build the repository Search Lab in the existing Svelte shell: cache/repo target, deep-linkable bounded query and filters, full-text/hybrid result columns, requested/effective/fallback explanation, coverage/namespace/generation cards, score breakdown, citations, copyable sanitized experiment summary, and repair/smoke states.
- Finish epic quality gates: keyboard-only and narrow/desktop E2E, focus/modal restoration, reduced motion, Light/Dark/System and contrast audit, hidden-side-effect assertions, stale/partial/provider-down/no-namespace/failed-chunk fixtures, deterministic asset/license verification, binary-size and startup/RSS benchmark note, disable/upgrade docs.
Safety boundaries: no remote GitCode access from Search Lab; no hidden indexing; no browser cache paths; no provider installation/start/model download; no RAG purge/reset/rebuild-all. design-qa.md remains a local uncommitted QA artifact. Per current release policy, no tag/release or go install ./... will be done for an intermediate change; those are considered only after the whole epic converges.
Implementation is ready in !101.
Delivered:
- observation-only full-text versus requested hybrid comparison for one managed cache/repository, including effective mode, typed fallback, RAG coverage/generation, raw lexical/semantic/fusion scores, ranks, locations, and bounded citations;
- explicit provider metadata smoke that sends no cached source text;
- stale-plan-safe bounded RAG repair with a confirmed max chunk count, provider data-boundary ledger, durable idempotent receipt, and background job;
- deterministic bounded index slices and generation/failure coverage reporting;
- frontend dependency license gate plus documented asset/binary/startup/RSS/release budgets.
Cross-tab design correction after dogfood feedback:
- Overview, Caches, Jobs, Maintenance, Diagnostics, and Search Lab now share one typography/control/icon token layer;
- page/section/card/micro roles are 54/22/14/11 px at the reference desktop viewport, controls are 40 px high with 13 px text, and no visible text is below 11 px;
- Lucide is the only icon set, with documented navigation, inline, entity, effect, and readiness roles;
- Light, Dark, and System share the same semantic surfaces; System remains the default;
- desktop and 390 px QA report no document overflow;
- changing RAG profile or repair cap invalidates the old plan and receipt before apply.
The durable rules are in docs/admin-ui-design-system.md and are linked from docs/admin-ui.md.
Verification: go test ./..., go vet ./..., Svelte check, Vitest, dependency license check, Playwright (9 passed; live-environment smoke skipped when no daemon is supplied), deterministic embedded asset rebuild, and git diff --check. No release tag or go install was made for this review unit.
Final design and release QA report
Correction to the earlier implementation note: design-qa.md was temporary agent working material, not a user-owned artifact. Its durable findings belong here; the local file has been removed.
Visual and responsive result
- Overview, Caches, Jobs, Maintenance, Diagnostics, and Search Lab were reviewed together at the 1487 × 1058 reference viewport and at 390 px narrow width.
- The views share one shell and one typography/control/icon hierarchy: consistent navigation, content inset, restrained surfaces, semantic status colors, 40 px controls, and no visible text below the documented minimum.
- Light, Dark, and System preserve the same hierarchy; System remains the default. Narrow and desktop checks reported no document-level horizontal overflow.
- Lucide remains the only icon set; status meaning is always present as text rather than color alone.
Interaction, accessibility, and safety
- Keyboard-semantic controls, visible focus, modal focus/return, Escape/cancel behavior, reduced-motion handling, labelled native fields, and textual disabled/error states were exercised.
- The one-time loopback session remains HttpOnly/SameSite Strict and CSRF-bound. The production bootstrap uses a generated CSP hash; no
unsafe-inlineallowance was added. - Snapshot/SSE reload continuity was verified without exposing absolute cache paths. Browser requests use opaque cache identities and sanitized deep links.
- Job cancel/retry confirmation preserves exact target/scope/work identity and durable idempotent receipts. Maintenance and binding use plan → exact confirmation → apply, including stale-plan rejection.
- Search comparison remains observation-only: it does not sync, configure providers, or start indexing. Provider smoke and bounded repair remain distinct explicit actions with a visible data boundary. Changing repair profile or cap invalidates the prior plan and receipt.
Dogfood defects found and fixed
- Svelte bootstrap was initially blocked by CSP; fixed with the generated bootstrap hash while retaining
frame-ancestors none. - Maintenance repository targets initially stayed empty after snapshot load; fixed by making the target derivation explicitly reactive.
- An early comparison capture started below the page origin; capture normalization now aligns both states before comparison.
- Cross-tab review found independent 8–10 px density choices outside Overview; replaced with shared typography, control-height, and icon-frame tokens.
- Search repair inputs could leave an obsolete rendered plan active; profile/cap changes now invalidate both plan and receipt.
Verification conclusion
Frontend typecheck, unit tests, dependency-license validation, Playwright critical flows, deterministic embedded asset rebuild, full Go tests, and git diff --check passed at delivery. Post-correction review found no remaining P0/P1/P2 visual, interaction, accessibility, or safety issue. The later v0.2.2 release regression suite also passed and published successfully to both release surfaces.
Parent: #52
Depends on: read-only operator views; job supervision
Design: https://gitcode.com/urandon/gitcode-mcp/wiki/Admin-Web-UI-Design-2026-08-25.md
Goal
Add a RAG search experiment surface and finish the admin UI's dogfood, accessibility, packaging, and release quality gates.
Scope
Acceptance criteria
go install ./...,go test ./..., frontend checks, Playwright, asset verification, andgit diff --checkpass.Non-goals