[teamleaderleo]

Problem

Huge Blue/app-server inspection needs a read-only, typed visibility contract, but the current Run attach work is deliberately scoped to terminal ticket redemption. The existing SSH/session registry and cmux-tui trusted-carrier probes already provide the identity and enrollment facts needed for inspection.

Change

This draft PR records the follow-up design for issue #21332:

• define disabled, unavailable, unenrolled, and admitted inspection states;
• bind SSH-backed inspection to the registered SSHHost/session identity;
• reuse Cloud app-server cloud.machine.list/cloud.machine.connect_info and the trusted-carrier/enrollment probe where applicable;
• keep provider credentials, terminal tokens, shell commands, raw route addresses, and arbitrary provider metadata out of the response;
• keep Huge Blue execution-provider admission and Run attach-ticket redemption out of scope.

The implementation PR should follow this design once the owner of the app-server route confirms whether the inspection endpoint belongs on the Cloud app-server path or authenticated VM API path.

Validation

• git diff --check
• Documentation-only change; no native build required.

Closes #21332

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a design document for a read-only Huge Blue app-server inspection route, defining four inspection states and the proposed response shape.

Design notes

• Reuses the existing SSHHost/session registry and cloud.machine.list/connect_info instead of introducing new credentials.
• Keeps provider credentials, terminal tokens, shell commands, and raw route addresses out of responses.
• Leaves the endpoint path and transport envelope open until the route owner confirms the serving API path.

^{Written for commit 619e067. Summary will update on new commits.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[teamleaderleo]

Bead cx-vzr8e created for this PR by the cmux coordinator.

[teamleaderleo]

Owned by projects-3f on cosmic-gray · session

[teamleaderleo]

Closing as superseded by #21365 (merged 2026-10-18). That PR implemented slices 1 and 2 of this design plus the Cloud probe from slice 3 as GET /api/vm/:id/huge-blue-inspection, and the shipped contract (states, reasons, redaction) now lives in web/services/vms/README.md ("Huge Blue inspection"). This draft predates that and its proposed response shape and open URL question no longer match what shipped. Slice 4 (a client inspection view) is still open under #21332 if anyone picks it up.