System view: plane health + diagnostics for the connected instance

Context

Operator, live session 2026-08-18: "diagnostics views (e.g. OC, MC, KB container logs)." The cockpit renders fleet truth; the PLANES that produce it — the containers/host processes of the connected Agent OS instance — have no surface at all.

The Problem

When a plane degrades today, diagnosis runs through MCP log-proxies (REM-pipeline state, self-heal recent events, healthcheck collection counts, tenant-sync repo states — the pattern peer-verified 2026-08-13: no raw-log surface exists on any plane) or the operator drops to a terminal. A mission control that cannot show its own engine room sends the operator away at exactly the wrong moment. And subject-wise this is NOT fleet content: planes ≠ agents — mixing plane logs into the fleet's reading tabs would blur the plane separation the architecture holds strictly.

The Architectural Reality

• The local instance's plane inventory (ai/deploy/docker-compose.local-agent-os.yml): chroma, kb-server, mc-server, orchestrator, fleet-server, ingress.
• Health/deployment truth verbs exist today: MC/KB healthcheck, deployment-state snapshot, deployment inspection, REM-pipeline state.
• Exposure-surface precedent: D#14501 (closed) — the R3-safe control-plane exposure for the boot-identity fact + restart actuator; #16856 (open) — probes must declare observe-vs-mutate; #16706 (open) — external-plane recovery.
• Keeper-view pattern: apps/agentos/view/Viewport.mjs shell tab items — System joins Home · Fleet · Accounts · Chat per #17269's navigation model (a distinct SUBJECT earns a distinct place).

The Fix

A System keeper view for the CONNECTED instance (name provisional — decided in #17269's navigation-model review, not silently here):

1. Per-plane cards — state, version, uptime, deployment snapshot — binding the EXISTING truth verbs through the authenticated bridge.
2. Logs region per plane — renders once the log-serving verb (sibling service ticket, filed together) lands; until then the honest not-yet-wired state naming that sibling. Never a fabricated stream.
3. Observe-only by design — the restart-actuator class (D#14501 lineage) stays out of this cut, and the view SAYS it is observe-only (#16856's declaration discipline).

Acceptance Criteria

• Design sketch (§04-consistent) reviewed BEFORE implementation (spec-first gate).
• Plane cards bind existing health/deployment verbs; absent/unreachable planes render reason-carrying states (the #16744 vocabulary discipline applied plane-side), never a generic offline.
• The view is observe-only and declares it; no mutation affordance in this cut.
• Logs region: honest absence + named sibling ticket until the verb exists; per-plane bounded log rendering once it does.
• Instance-scoped: the view always names WHICH instance it diagnoses (consumes the instance switcher's scope, sibling ticket filed together).

Out of Scope

The log-serving verb (sibling service ticket) · restart/remediation actuation (D#14501 / #16706 lineage — a future, separately-gated cut) · alerting/notification.

Related

Epic #14560 (parent) · #17269 (keeper placement) · sibling: fleet-server plane-log verb + instance switcher (filed together) · D#14501 · #16856 · #16706 · #17288.

Live latest-open sweep: latest 20 re-checked 2026-08-18T08:15Z, no equivalent; A2A herd window clean (one unrelated engine claim #17327).

Origin Session ID: ca3c67ac-a3d6-4e93-98e0-c5f7f65011ee

Retrieval Hint: query_raw_memories("system view plane health diagnostics logs keeper view connected instance")