dashboardlisted

# dashboard — control-room architecture + browser verify loop ## Architecture map No build step, no framework, stdlib only. Four layers: | Layer | File | Responsibility | |---|---|---| | Server | `bin/dashboard.py` | `http.server`, **loopback only** (127.0.0.1 default; `localhost` accepted; anything else refused at startup); routes; SSE; control token; owns the git/gh calls + TTL cache | | State | `lib/dashboard_state.py` | PURE builders: read engine artifacts (session logs, supervisor.log, config) → JSON-able dicts. git/gh state is INJECTED by the server (`build_repo_state(git_in_flight=…)`) — builders never call the network. Unit-tested against `tests/fixtures/repo-alpha` | | Control | `lib/dashboard_control.py` | PURE decisions for lifecycle writes (`control_plan`) + input validation (`_MODEL_RE` parity with the supervisor's `valid_model_id`) | | Pages | `lib/dashboard_page.html` (main), `lib/config_page.html` (config), `lib/pipeline_page.html` (canvas viewer, #357) | Vanilla JS, single file each, `__CONTROL_TOKEN__`/`__MODEL_CHOICES__` substituted at serve time (absent placeholder = no-op) | Routes: pages `GET /` · `/config` · `/pipeline` · reads `GET /api/state` · `/api/config` · `/api/models` · `/api/ws-prompt` · `/api/pipeline` (selectors `role=` | `name=` | `token=`, exactly one — #383 D1) · `/api/triggers` (trigger cards + trust + gallery + runs, #383 D1) · `/api/boards` · `/api/stream` (SSE tick) · writes `POST /api/control` (action-multiplexed — every mutating