[viethqb]

Re-verified the admin pages (Workspace settings, Control Plane, Data governance) on the Docker demo stack (no Kubernetes).

Re-shot: 101 screenshots: all 99 under static/img/platform/admin/ (86 existing ones re-captured, 13 new) plus control-plane-access-overview and control-plane-permissions. Data was seeded with the new idempotent scripts/seed-admin.mjs, and the steps done in the UI are listed in scripts/shots/admin-demo-data.md.

Rewritten with live behaviour: 40 pages changed, including:

• Query engines: the real Add engine flow with the Docker provisioner (72 s to running), restart (38 s), saving settings, assigning workspaces, the monitor, delete, the Kubernetes and Docker comparison, and registering an external engine.
• Migrate policies: a full run that was proved, migrated and undone.
• Masks and filters, grants and clearance, each checked with real queries as member-sso.
• Classifications: the tabbed tag page and the New classification dialog.
• Notifications: SMTP to Mailpit now works.
• Impersonation, the audit log, storage, secrets and catalogs.

Defects found: 20 new rows, plus 14 existing rows to update or close (KI-022, KI-126, KI-128, KI-130 and KI-020 can be closed). The rows are below.

Still not verifiable:

• StarRocks engines, ingress, autoscaling, pod logs and exec: these need Kubernetes.
• Enforcement on an external engine: the demo Trino has no Ranger plugin.
• Rule overlaps that already exist: egret refuses to create them, so the Overlaps tab only shows its empty state.
• Slack delivery: the stack has no Slack.

Both engines I added were deleted at the end. Their policy profiles remain under Profiles without an engine, which is how the product behaves.

---

KI backlog: admin area (Workspace settings, Control Plane, Governance)

Found on the Docker demo stack (http://egret.localtest.me:18080, 2026-10-20) while re-verifying the admin pages.
Ready-to-paste rows for platform/known-issues.md; ids are placeholders.

New rows

KI	Area	Type	Sev	Description
KI-NEW-1	SQL Lab / Workspace settings	Defect	S1	Only workspace admins can list a workspace's database connections. Members with ws_editor (direct or through a group), ws_viewer or a custom role with query:run get 403 on GET /api/ws/{ws}/databases, so the SQL Lab database picker is empty for them, also for a provisioned engine assigned to the workspace. Queries sent through the API with a database_id run. Steps: bao.tran (ws_editor) or member-sso in Docs sandbox → SQL Lab → Select a database: no options, console 403. Same as ws_admin alice.nguyen: two options.
KI-NEW-2	Engines / Monitor	Defect	S2	The engine Monitor tab of a running Trino 483 engine says Engine not reachable — is a coordinator running? and Coordinator unreachable — no live queries. /cluster and /queries answer 502: the summary calls GET /v1/node (404 on Trino 483) and a JWT-delegation engine gives the egret-monitor account no sign-in. Steps: docs-trino → Monitor while a query runs. Not Docker-specific.
KI-NEW-3	Engines	UX	S3	On a Docker-provisioned engine the Logs and Exec buttons are offered although they cannot work: Logs shows the raw bad request: not available with the Docker engine provisioner; Exec opens a shell that closes at once with [connection closed] and no reason (the WebSocket answers 400). Hide them or say why.
KI-NEW-4	Engines	Consistency	S3	Dialogs speak Kubernetes on a Docker engine: Delete says This destroys the engine's Kubernetes cluster, Restart says it rolls the coordinator and worker pods, Review changes says re-provisions (rolls) the engine pods.
KI-NEW-5	Engines	Defect	S3	After Add engine with Worker → Replicas 0, the stored spec says workerReplicas: 2 and Overview shows Coord 1 · Worker 2 while only the coordinator container exists. The first Save changes on Settings corrects it to Worker 0. With the field blank, one worker container starts and the strip still says 2.
KI-NEW-6	Engines / Settings	UX	S3	Review changes lists an unrelated auth.passwordUsers [] Added next to the real change, has only Close, and Save changes then applies without a confirmation while the header stays running although the coordinator container is recreated. Steps: docs-trino → Settings → Server → Add property query.max-run-time = 2h → Review changes.
KI-NEW-7	Engines	UX	S3	The engine header and list show the endpoint docs-trino-coordinator.egret-engines:8080; on the Docker network the container's names are docs-trino-trino(.egret-engines(.svc)) and the workspace connection uses docs-trino-trino.egret-engines.svc:8443. The shown address does not resolve.
KI-NEW-8	Engines / Add engine	UX	S3	Turning on Expose via ingress without a Host is silently dropped: the engine is created with no ingress and no message. With a host the Docker provisioner refuses (not supported by the Docker engine provisioner: ingress), which is the expected answer.
KI-NEW-9	Governance / Lineage	Defect	S2	View lineage fails on a provisioned engine: engine docs-trino: engine: Access Denied: Cannot access catalog demo_warehouse. Egret's lineage reader is not let into the catalog by the engine's own policy, so the overview shows a Warning, the table's Lineage tab shows No reader is known, and View exposure lists the view as clearance unknown. POST /classifications/lineage-sweep fails the same way; the console has no control to run the sweep the UI tells you to run. Steps: view demo_warehouse.analytics.revenue_by_country over sessions.
KI-NEW-10	Governance / Migrate	Gap	S3	A one-policy migration cannot be proved when its catalog is also served by a provisioned engine: proving this migration needs 48735 probe evaluations across 2 profile(s), 2697570 units of work … over the limit of 1300000. The same policy on a catalog only the external engine serves proved with 1575 probes. Steps: hand-written select on tpch_bench.*.*.* in docs-legacy-trino (also served by docs-trino, 28 policies) → Preview migration.
KI-NEW-11	Governance / Engine permissions	UX	S3	In Grant engine permission the user search list stays open after a pick and covers the Grant button; you have to click elsewhere first.
KI-NEW-12	Control Plane / Engines	UX	S3	After Register engine without a profile you land on Plugin config with the raw API text conflict: engine trino-demo-ext is bound to no policy profile: bind a profile first Bind a policy profile on the Settings tab, then come back. (prefix kept, sentences run together).
KI-NEW-13	Audit log	Gap	S2	Decisions made while impersonating are recorded under the impersonated user with an empty detail; only impersonation.start/impersonation.end name the admin. The workspace Activity tab shows member-sso as the actor of what ops.admin did.
KI-NEW-14	Storage	Security	S2	Storage → <connection> → Browse lists query-results/*.jsonl, the stored results of every user's SQL Lab queries, and GET /storage/{id}/download?key=… returns them to anyone with storage:read, which the built-in data_steward role holds. These are each user's post-mask results.
KI-NEW-15	Secrets	UX	S3	System-managed secrets (engine-internal-*, engine-monitor-*, engine-tls-*, catalog-client-*) are listed with user secrets, can be rotated or deleted, and are offered in the catalog Password secret picker. The list's Used by and Created columns are cut off at 1440 px.
KI-NEW-16	Catalogs / Storage	Gap	S3	A second egret warehouse on the same bucket is refused (Storage profile overlaps with existing warehouse demo-warehouse) also through a connection with another key prefix (sandbox/); the New catalog form does not say a warehouse needs its own bucket. Related: KI-129.
KI-NEW-17	Control Plane / Users	UX	S3	Disable on a user page acts at once and signs the user out, without a confirmation, while Delete asks for a typed confirmation.
KI-NEW-18	Access requests	Gap	S3	No mail is sent when someone requests access or when a request is approved or denied, although the workspace has working SMTP (Mailpit received nothing). Admins only see the queue when they open it.
KI-NEW-19	SQL Lab	UX	S3	SQL Lab runs every query with query_max_run_time = 60s; a longer statement (the first CTAS on a fresh engine) fails with the bare error timeout and no hint about the limit. Steps: SHOW SESSION LIKE 'query_max_run_time' → Value 60s.
KI-NEW-20	Workspace settings / Notifications	UX	S3	Before settings exist the page loads GET /notifications/smtp and /notifications/slack, which answer 404 and show as console errors.

Rows to update or close

KI	Now	Evidence
KI-016	Update: not blank any more, a redirect loop	/control-plane/config redirects to /control-plane/config/workspaces/workspaces/workspaces/… without end.
KI-018	Still true	Access overview → Recent changes shows by 8a66d837.
KI-020	Close (no longer true)	People & groups → Users shows usernames for everyone who signed in or was granted (member-sso, alice-nguyen, …); only admin-sso, never granted, shows No username yet.
KI-021	Still true	admin-sso (group platform-admins) has no platform role.
KI-022	Close on the Docker demo stack	Add engine works with the Docker provisioner: docs-trino running in 72 s, restart 38 s, delete 7 s; StarRocks, ingress, autoscaling, pod logs and exec stay Kubernetes-only.
KI-125	Still true, extend	The Policy profile pickers (Register external engine, engine Settings) list tag-less profiles such as docs-external-policy without marking them unbindable.
KI-126	Close (fixed)	Docs sandbox SMTP saved (mailpit:1025, None), Send test message → Test message sent…, mail in Mailpit; Slack save → Slack settings saved.
KI-127	Still true	Workspace Roles & permissions: finance_reporter 2 permissions; Control Plane role page 8 permissions.
KI-128	Close (fixed)	Add member → typing emma suggests Emma Schmidt emma.schmidt@egret.local.
KI-129	Still true	sandbox-lake (prefix sandbox/) → Browse lists the bucket root.
KI-130	Close (fixed)	The Classifications list has a Data column (0 tables · 4 columns), and the tag page's Where used lists the tables and columns.
KI-132	Still true	New grant → Preview: the result is below the fold of a 900 px viewport.
KI-134	Update, wider than written	Kind = Mutation lists no entry for creating users, groups, roles, workspaces, secrets, storage connections, catalogs, tags, for provisioning, restarting, reconfiguring or deleting an engine, declaring a catalog or saving SMTP settings; Action is still an exact match (secret → nothing).
KI-135	Update	Seed default policies on an empty manual profile does add 13 policies ({"created":13}), but they appear on Policies as egret-seeded; Advanced still says This profile has no hand-written policy. and no message is shown.

Page text now stale outside the admin area

• platform/faq.md (Do I need Kubernetes?): Add engine now also works with the Docker engine provisioner ([engines] provisioner = "docker"); the sentence that a cluster is needed to provision engines from the UI is no longer true for Trino.
• platform/deploy-operate/engines-and-ranger.md (the Add engine row and the paragraph after the table): add the Docker provisioner; Not run locally is out of date.
• platform/deploy-operate/troubleshooting/index.md (row kubernetes unavailable; engine provisioning disabled): mention EGRET_ENGINES__PROVISIONER=docker.
• SQL Lab pages: non-admin members get an empty database picker (KI-NEW-1); pages that tell an editor to pick a database in SQL Lab are wrong for them until it is fixed.

🤖 Generated with Claude Code