Milestone 24: Collection Workspace (3-region info-dense layout)

[devin-ai-integration]

Summary

Adds a new /collections/:collectionId/workspace route — a one-screen, information-dense "Manage Collection" view loosely modeled after the upstream stig-manager UI. Goal: eliminate the click-into-tabs cycle when an operator just wants to see "where is this collection at?" — assets, STIGs, and roll-up status all on one page.

Layout (1 column on mobile, 2 columns on lg+):

• Left — Manage panel: collection name + description, with a tab strip below (Grants / Users / Settings / Metadata / Labels). Grants is the only tab with a full implementation today (re-uses the existing GrantsTab from M18f). The other four are intentional placeholders pointing to where their content lives or will land.
• Right top — Assets metrics table. Columns: ☐ · Asset · Labels · STIGs · Rules · Assessed % · Submitted % · Accepted % · Rejected %. Sortable by every numeric column. Bulk-select checkboxes. Toolbar: Create (opens NewAssetDialog, gated on Full+), Import (disabled — file-based imports live on the Reviews tab from M22), Delete (n) (bulk delete, gated on Manage+), Refresh.
• Right bottom — STIGs metrics table. Columns: ☐ · BenchmarkId · Revision · Rules · Assets · Assessed % · Submitted % · Accepted % · Rejected %. Toolbar: Assign STIG / Unassign / Refresh. Assign + Unassign are surfaced as disabled placeholders pointing at the per-Asset detail page (M21b) — bulk STIG-assignment-via-collection is a separate API change and out of scope here.

Data source — both tables drive off GET /collections/{cid}/metrics/summary/asset and /metrics/summary/stig (shipped in M10). No API changes in this PR. Percentage formulas mirror upstream's collectionManager.js:

• Assessed % = assessed / assessments × 100
• Submitted % = (submitted + accepted + rejected) / assessments × 100
• Accepted % = accepted / assessments × 100
• Rejected % = rejected / assessments × 100

Routing decision — new route alongside the existing /collections/:cid tabbed detail page. The Collections list row link now defaults to /workspace; the collection-id column on that list still links to the legacy detail page so deep links and existing tests stay green. The workspace header also has an explicit "open detail" affordance.

Code reuse — GrantsTab, NewAssetDialog, the metrics hooks (useMetricsByAsset / useMetricsByStig), and the role helpers all reused without modification. The one tiny change in web/src/lib/api/hooks.ts is exposing the existing MetricsSummary shared type so the new file can type the inner metrics: {...} object.

Tests — 1 new Playwright e2e (35/35 total, all green locally against the compose stack) that:

1. Creates a fresh collection.
2. Navigates to /collections/{cid}/workspace.
3. Asserts the Manage panel + both tables render.
4. Asserts the Owner role badge appears.
5. Asserts the empty-state copy on both tables (fresh collection → no assets, no STIGs).
6. Asserts the bulk Delete is disabled with 0 selected, and Create is enabled for the owner.
7. Returns to /collections and asserts the row link now points to /workspace while the legacy detail link is still present.

Review & Testing Checklist for Human

• Spin up the compose stack, open /collections, click any collection row → lands on the new workspace. Confirm the 3-region layout (Manage / Assets / STIGs) renders side-by-side at viewport ≥ 1280px and stacks on narrow widths.
• Bulk-select 2+ asset rows → confirm the "Delete (n)" button enables and the count updates. Pressing it confirms a delete dialog. Single-asset delete from the Asset detail page still works.
• Confirm the legacy /collections/{cid} page is reachable from the "open detail" link in the workspace header and from the collection-id column on the Collections list. Direct links to that route still work.
• Eyeball a populated collection (a few assets, a few STIGs) and sanity-check the percentage formulas vs. the existing Metrics tab. They should match (both derive from the same /metrics/summary endpoints).
• The "Assign STIG" + "Unassign" buttons on the STIGs toolbar are intentionally disabled in this PR — confirm the tooltip explains where to do it today (Asset detail page). I can wire bulk STIG-by-Collection actions in a follow-up if you'd like.

Notes

• The upstream UI has a top-of-page tab strip (Home / Collection name / Collection / Manage) for multi-workspace navigation. I dropped that from this PR's scope so it stays focused on the workspace layout itself; happy to revisit as M25.
• The Users, Settings, Metadata, and Labels Manage tabs are deliberately stubs in M24 — pointing at where their content will live so the layout is visible end-to-end without me building five new screens in one PR. The Labels stub specifically links back to the legacy detail page where Labels already lives.
• Did not modify the legacy /collections/{cid} detail page at all. If the workspace becomes the canonical entry point we can later strip the now-redundant tabs (Overview / Grants) from the legacy page, but that's a follow-up after we know operators are happy with the workspace.

Link to Devin session: https://app.devin.ai/sessions/022810763c4643c0848ba894c1512b92
Requested by: @Exonical

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring