Add web UI and worker capture/approval command channel

Introduces the browser-facing surface and the worker-side protocol that
backs it:

- internal/ui: joined read model plus per-task lifecycle and approval
  controls, kept separate from the raw endpoints workers and harnesses
  depend on.
- internal/webui + web/: Vite/React app, build output embedded via
  go:embed and served as an SPA fallback.
- federation: per-(worker, task) captures with a monotonic revision that
  advances only when pane text actually changes, and a command queue
  restricted to grant_approval / deny_approval, each bound to the capture
  revision the operator acted on.
- orchestra-worker: publishes captures and executes commands only after
  re-reading the pane and confirming the revision still matches. Sends
  keystrokes only for a visible y/n prompt or OpenCode's fully labelled
  selector, and refuses to deny through that selector rather than guess
  at unobservable navigation.

This is the ownership boundary AUDIT.md's B14 and B17 call for: approval
becomes an explicit, revision-bound operation executed by the worker that
owns the pane, instead of a side effect of prompting over a
coordinator-driven remote socket.

Also ignores the web build inputs and outputs. node_modules ships vendored
Go packages, so go build and go test walk into it if it is merely
untracked; both node_modules and .node_modules are excluded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01535A3Y8RtkAi8wYuWhtkEd

internal/federation/client.go

@@ -181,3 +181,31 @@ func (c Client) Complete(ctx context.Context, taskID, reportRef string) error {
 	}
 	return err
 }
+
+func (c Client) PublishCapture(ctx context.Context, capture Capture) (Capture, error) {
+	resp, err := c.request(ctx, http.MethodPost, "/v1/federation/workers/"+url.PathEscape(c.WorkerID)+"/captures", capture)
+	if err != nil {
+		return Capture{}, err
+	}
+	defer resp.Body.Close()
+	var out Capture
+	err = json.NewDecoder(resp.Body).Decode(&out)
+	return out, err
+}
+func (c Client) Commands(ctx context.Context) ([]Command, error) {
+	resp, err := c.request(ctx, http.MethodGet, "/v1/federation/commands", nil)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	var out []Command
+	err = json.NewDecoder(resp.Body).Decode(&out)
+	return out, err
+}
+func (c Client) ResolveCommand(ctx context.Context, id, status, message string) error {
+	resp, err := c.request(ctx, http.MethodPost, "/v1/federation/commands/"+url.PathEscape(id), map[string]string{"status": status, "message": message})
+	if resp != nil {
+		resp.Body.Close()
+	}
+	return err
+}

internal/federation/federation.go

@@ -1,7 +1,9 @@
 package federation
 
 import (
+	"crypto/sha256"
 	"errors"
+	"fmt"
 	"sync"
 	"time"
 )
@@ -18,6 +20,26 @@ type Worker struct {
 	Token    string    `json:"-"`
 }
 
+// Capture is published by a worker that owns the pane. The coordinator never
+// reads a remote herdr socket; this is the worker-pulled counterpart.
+type Capture struct {
+	TaskID   string    `json:"task_id"`
+	PaneID   string    `json:"pane_id"`
+	Text     string    `json:"text"`
+	Revision uint64    `json:"revision"`
+	At       time.Time `json:"at"`
+}
+type Command struct {
+	ID              string    `json:"id"`
+	TaskID          string    `json:"task_id"`
+	Kind            string    `json:"kind"`
+	PaneID          string    `json:"pane_id"`
+	CaptureRevision uint64    `json:"capture_revision"`
+	CreatedAt       time.Time `json:"created_at"`
+	Status          string    `json:"status"`
+	Error           string    `json:"error,omitempty"`
+}
+
 type Registry struct {
 	mu sync.Mutex
 	// AdmitToken, if set, is a pre-shared secret every registration must
@@ -29,6 +51,8 @@ type Registry struct {
 	TTL        time.Duration
 	OnOffline  func(Worker)
 	cursors    map[string]uint64
+	captures   map[string]Capture // worker/task
+	commands   map[string][]Command
 }
 
 func (r *Registry) init() {
@@ -41,6 +65,101 @@ func (r *Registry) init() {
 	if r.cursors == nil {
 		r.cursors = map[string]uint64{}
 	}
+	if r.captures == nil {
+		r.captures = map[string]Capture{}
+	}
+	if r.commands == nil {
+		r.commands = map[string][]Command{}
+	}
+}
+
+func captureKey(worker, task string) string { return worker + "\x00" + task }
+func (r *Registry) PutCapture(worker string, c Capture) (Capture, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.init()
+	if _, ok := r.workers[worker]; !ok {
+		return Capture{}, ErrUnknownWorker
+	}
+	if c.TaskID == "" || c.PaneID == "" {
+		return Capture{}, errors.New("task_id and pane_id required")
+	}
+	k := captureKey(worker, c.TaskID)
+	old := r.captures[k]
+	if old.Text != c.Text || old.PaneID != c.PaneID {
+		c.Revision = old.Revision + 1
+	}
+	if c.Revision == 0 {
+		c.Revision = 1
+	}
+	c.At = time.Now().UTC()
+	r.captures[k] = c
+	return c, nil
+}
+func (r *Registry) Capture(worker, task string) (Capture, bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.init()
+	c, ok := r.captures[captureKey(worker, task)]
+	return c, ok
+}
+func (r *Registry) Queue(worker string, c Command) (Command, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.init()
+	if _, ok := r.workers[worker]; !ok {
+		return Command{}, ErrUnknownWorker
+	}
+	if c.TaskID == "" || c.PaneID == "" || c.CaptureRevision == 0 || (c.Kind != "grant_approval" && c.Kind != "deny_approval") {
+		return Command{}, errors.New("invalid control command")
+	}
+	c.ID = fmt.Sprintf("cmd-%x", sha256.Sum256([]byte(fmt.Sprintf("%s/%s/%s/%d/%d", worker, c.TaskID, c.Kind, c.CaptureRevision, time.Now().UnixNano()))))[:20]
+	c.CreatedAt = time.Now().UTC()
+	c.Status = "pending"
+	r.commands[worker] = append(r.commands[worker], c)
+	return c, nil
+}
+func (r *Registry) Commands(worker string) ([]Command, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.init()
+	if _, ok := r.workers[worker]; !ok {
+		return nil, ErrUnknownWorker
+	}
+	var out []Command
+	for _, c := range r.commands[worker] {
+		if c.Status == "pending" {
+			out = append(out, c)
+		}
+	}
+	return out, nil
+}
+func (r *Registry) Command(worker, id string) (Command, bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.init()
+	for _, c := range r.commands[worker] {
+		if c.ID == id {
+			return c, true
+		}
+	}
+	return Command{}, false
+}
+func (r *Registry) CompleteCommand(worker, id, status, message string) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.init()
+	for i := range r.commands[worker] {
+		if r.commands[worker][i].ID == id {
+			if r.commands[worker][i].Status != "pending" {
+				return errors.New("command already resolved")
+			}
+			r.commands[worker][i].Status = status
+			r.commands[worker][i].Error = message
+			return nil
+		}
+	}
+	return errors.New("command not found")
 }
 
 // Register admits a worker. admitToken must match r.AdmitToken whenever one

internal/federation/federation_test.go

@@ -75,3 +75,33 @@ func TestOfflineHookRunsOnceOnTransition(t *testing.T) {
 	case <-time.After(10 * time.Millisecond):
 	}
 }
+
+func TestCaptureRevisionAndCommandQueue(t *testing.T) {
+	r := &Registry{}
+	if err := r.Register(Worker{ID: "w", Token: "t"}, ""); err != nil {
+		t.Fatal(err)
+	}
+	c, err := r.PutCapture("w", Capture{TaskID: "task", PaneID: "pane", Text: "Permission required\n$ ls"})
+	if err != nil || c.Revision != 1 {
+		t.Fatalf("capture=%#v err=%v", c, err)
+	}
+	again, err := r.PutCapture("w", Capture{TaskID: "task", PaneID: "pane", Text: c.Text})
+	if err != nil || again.Revision != 1 {
+		t.Fatalf("same capture=%#v err=%v", again, err)
+	}
+	cmd, err := r.Queue("w", Command{TaskID: "task", Kind: "grant_approval", PaneID: "pane", CaptureRevision: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	commands, err := r.Commands("w")
+	if err != nil || len(commands) != 1 || commands[0].ID != cmd.ID {
+		t.Fatalf("commands=%#v err=%v", commands, err)
+	}
+	if err := r.CompleteCommand("w", cmd.ID, "acknowledged", ""); err != nil {
+		t.Fatal(err)
+	}
+	commands, _ = r.Commands("w")
+	if len(commands) != 0 {
+		t.Fatalf("pending=%#v", commands)
+	}
+}