Epic: contract-complete control plane for CLI, web, desktop, and mobile

[Kh1ng]

Difficulty: hard
Risk: medium
Task class: product architecture

Problem

GAH's Rust CLI is the authoritative product, but apps/server exposes only a hand-maintained subset of commands and packages/contracts does not prove parity. The React web app and Tauri desktop wrapper therefore cannot configure or operate everything available through the CLI, and native/mobile clients have no stable complete API to consume.

Goal

Make every CLI capability discoverable through a typed, versioned control-plane contract, then consume one generated/shared client across web, desktop, installable mobile web, and native mobile shells.

Invariants

• Rust CLI/backend semantics remain authoritative.
• Remote clients never gain a policy bypass unavailable to the CLI.
• Read and mutation APIs are separated; mutations are authenticated, authorized, idempotent where needed, and audited.
• Secrets are write-only/redacted and never returned by APIs.
• GitHub and GitLab profiles behave uniformly.
• Web, desktop, and mobile share contracts, client code, and core UI rather than implementing separate products.
• This parent is planning-only; only bounded children are dispatched.

Completion Criteria

• CI maintains a command-to-API/client parity matrix and fails when a CLI capability lacks a declared remote disposition.
• Shared clients can observe, configure, dispatch, review, recover, approve, update, and administer every supported CLI operation.
• Web and desktop pass equivalent end-to-end suites.
• Mobile has an installable remote-control surface; Android/iOS packaging has reproducible CI even when this Linux host cannot build iOS locally.

[Kh1ng]

Bounded delivery chain:

• Control plane 1/7: generate a CLI capability and remote-disposition manifest #531 — generated CLI capability/remote-disposition manifest (medium)
• Control plane 2/7: complete typed read API parity #519 — complete typed read API parity (hard)
• Control plane 3/7: authenticated mutation API with idempotency and audit #532 — authenticated mutation API, idempotency, and audit (hard)
• Control plane 4/7: shared TypeScript client with reconnect and event replay #529 — shared generated TypeScript client, reconnect, and event replay (medium)
• Control plane 5/7: operational UI parity across web and desktop #517 — operational UI parity across web and desktop (hard)
• Control plane 6/7: installable mobile/PWA remote operator #534 — installable mobile/PWA remote operator (medium)
• Control plane 7/7: reproducible Tauri Android/iOS remote-client packaging #526 — reproducible Tauri Android/iOS packaging (hard)

Existing feature tickets #149 (routing UI), #503 (blocked-work remediation UI), and #91 (fleet UI) feed #517 rather than creating separate client state paths.

[Kh1ng]

Triage pass: labeling exec:owner-decision, not exec:autonomous.

This epic (and its ~20 sibling tickets across the Control-plane/7, Codex-orchestration/6, and Manager-integration/6 series) represents a large, speculative architecture commitment — persistent remote sessions, mobile/desktop clients, Codex SDK orchestration, authenticated multi-node fleets. All hard/high-risk, all currently scoped but never greenlit.

Given the current priority is making the existing dashboard/backlog usable rather than expanding scope further, recommend this whole cluster stays parked until there's an explicit decision to pursue it. Not closing anything — just making sure the loop doesnt start autonomously grinding through ~20 more large tickets while that decision is outstanding.

[Kh1ng]

Partial overlap with wayfinder map #790 — specifically #798 (Split control-surface UX by device) covers the device-split dimension. The API parity dimension of this epic remains independently valid. Keeping open.

[Kh1ng]

Completion audit — 2026-09-12

Six of the seven bounded delivery tickets are closed: #531, #519, #532, #529, #517, and #526. The sole open child is #534.

#534's implementation and focused browser verification are complete, but its required physical iPhone install/deep-link/background-resume acceptance is not. Keeping this planning parent open until that child is honestly accepted and closed.