# Operator Dashboard

## Purpose

The dashboard is the read-only production console for the OSM lead-source
service. It exposes service safeguards and accepted reconciliation evidence
without adding an HTTP mutation surface.

## Endpoints

- `/` — responsive HTML operator dashboard
- `/status` and `/api/status` — secret-free runtime state
- `/api/dashboard` — runtime state, evidence snapshot, and readiness gates
- `/healthz` — liveness response
- `/readyz` — readiness response and current mode

`POST`, `PUT`, `PATCH`, and `DELETE` remain unsupported. Unknown paths return a
JSON 404.

## Default evidence

Release `0.2.0` bundles the accepted ACT evidence as the fallback dashboard
snapshot. This is explicitly labeled `verified-release-evidence`; it is not
presented as a new live run.

## Runtime snapshot

Set the following optional runtime variable to display persisted evidence from
a later reconciliation run:

```text
OSM_LEAD_SOURCE_DASHBOARD_SNAPSHOT_PATH=/data/reports/dashboard.json
```

The file must:

- be a regular non-symlink file;
- be between 1 byte and 512 KiB;
- remain the same size during the read;
- contain UTF-8 JSON;
- contain exactly the accepted fields; and
- use lowercase 64-character SHA-256 values.

Accepted schema:

```json
{
  "kind": "runtime-evidence",
  "generated_at": "2026-08-01T00:00:00Z",
  "region": "au-act",
  "profile": "luxeillum",
  "profile_version": "0.1.0-draft",
  "report_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "source_sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
  "source_size_bytes": 123,
  "counts": {
    "active": 10,
    "review": 1
  },
  "categories": {
    "Restaurant / cafe": 10
  },
  "noco": {
    "exact_identity_matches": 7,
    "unmatched_identities": 3,
    "duplicate_row_excess_detected": false
  }
}
```

If loading or validation fails, the service shows the accepted release evidence
and a generic warning. It does not expose file content, filesystem errors, or
secret environment values.

## Runtime status fields

The status API reports booleans and bounded labels only. Presence of the sidecar
URL is exposed as `sidecar_configured`; the URL itself is never returned.
Likewise, Noco tokens, private keys, and database credentials are never included.

`OSM_LEAD_SOURCE_RELEASE_SHA` may be set to the deployed commit SHA so the
operator console can identify the release without querying Coolify.

## Security headers

Every response includes no-store caching and restrictive browser headers. The
HTML uses no external scripts, stylesheets, fonts, images, or analytics. The
Content Security Policy permits only the inline stylesheet required by the
single-file dashboard and blocks all other resource types.