feat(cockpit): action tier executes via a governed operator — auto-router Phase 3 (v0.282.0)

[vikasprogrammer]

The action tier no longer just deep-links — it can carry the action out, via the same concierge pattern, kept fully governed.

Flow

A detected action ("create a task to migrate the acme site", "run the churn report every morning") shows a card with Set it up · Open Automations/Tasks · Route to an agent. Clicking Set it up → POST /api/router/act → spawns the operator: an ephemeral System agent (sibling to the read-only concierge), run-as the member, that does the request via governed tools and nothing else:

Request	Tool	Governance
a task ("create a task to…")	task_create	filed immediately, audited
a scheduled/triggered job ("every morning…")	automation_propose	a DRAFT an owner must approve — never fires unattended

Cockpit polls the operator's transcript and renders its one-line confirmation inline ("✓ Created task: …" / "✓ Proposed automation … — pending an owner's approval"), with a link to Tasks / the Inbox.

Why this is safe

• Explicit consent — nothing executes until you click Set it up (the action classification alone spawns nothing).
• No new power — the operator runs as you and every tool call still passes the gate hook; a task is auto-applied+audited exactly as any agent's task_create, and an automation still requires a human approval (automation_propose → owner). The operator persona is scoped to only these two tools, do-only-what-was-asked.
• category:'System' → the operator is never a route target (verified no leak).

Files

• src/edge/concierge.ts — ensureOperator/OPERATOR_ID + a shared System-agent provisioner (concierge + operator)
• src/server.ts — POST /api/router/act
• web/src/App.tsx — action card "Set it up" + unified run-polling (ask concierge / action operator)
• web/src/lib/api.ts — routerAct

Verification

• typecheck + web build clean; test:governance → 130/130 ✓
• Operator provisions (category System, claude-code runtime); neither operator nor concierge leaks into routing across 6 probes
• Live smoke test of a real task creation to follow on deploy (the operator's actual tool-calling needs a live claude run)

Note

First execution carries claude cold-start latency (shown as "Setting it up…"). The operator run appears as a chat session in the member's list (same follow-up as the concierge — could hide System-agent chats).

🤖 Generated with Claude Code