feat(atlas): Phase C — live Flux reconcile status on stage 07

Stage 07 now also shows the Flux `apps` Kustomization state — reconciled/failed
+ last-applied revision (main@shortsha) — read in-cluster (new read-only Role in
flux-system). Sits alongside the live deploy node. FluxStatus/FluxNode test-first,
fallback-safe.

Verified: build/vet/lint(0)/test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/atlas/cluster.go

@@ -53,6 +53,70 @@ func HostsFromNodes(nodesJSON []byte) ([]Host, error) {
 	return hosts, nil
 }
 
+// Flux is the reconciliation state of a Flux Kustomization.
+type Flux struct {
+	Ready    bool
+	Reason   string
+	Revision string
+}
+
+// FluxStatus parses a Flux Kustomization object into its reconcile state.
+func FluxStatus(kustJSON []byte) (Flux, error) {
+	var k struct {
+		Status struct {
+			Conditions []struct {
+				Type   string `json:"type"`
+				Status string `json:"status"`
+				Reason string `json:"reason"`
+			} `json:"conditions"`
+			LastAppliedRevision string `json:"lastAppliedRevision"`
+		} `json:"status"`
+	}
+	if err := json.Unmarshal(kustJSON, &k); err != nil {
+		return Flux{}, fmt.Errorf("parse kustomization: %w", err)
+	}
+	f := Flux{Revision: shortRev(k.Status.LastAppliedRevision)}
+	for _, c := range k.Status.Conditions {
+		if c.Type == "Ready" {
+			f.Ready = c.Status == "True"
+			f.Reason = c.Reason
+		}
+	}
+	return f, nil
+}
+
+// FluxNode renders the Flux reconcile state as a stage node.
+func FluxNode(f Flux) Node {
+	if f.Ready {
+		return Node{
+			Title: "⟳ Flux · reconciled · " + f.Revision,
+			Pill:  "var(--green)",
+			Tags:  []string{"live · k8s"},
+		}
+	}
+	return Node{
+		Title: "⟳ Flux · " + f.Reason,
+		Pill:  "var(--coral)",
+		Tags:  []string{"live · k8s"},
+	}
+}
+
+// shortRev turns a Flux revision "main@sha1:<full>" into "main@<short>".
+func shortRev(rev string) string {
+	at := strings.Index(rev, "@")
+	if at < 0 {
+		return rev
+	}
+	branch, sha := rev[:at], rev[at+1:]
+	if c := strings.LastIndex(sha, ":"); c >= 0 {
+		sha = sha[c+1:]
+	}
+	if len(sha) > 7 {
+		sha = sha[:7]
+	}
+	return branch + "@" + sha
+}
+
 // Deploy is the live state of a Kubernetes Deployment.
 type Deploy struct {
 	Image   string

internal/atlas/cluster_test.go

@@ -98,6 +98,34 @@ func TestNamespaceSummary_CapsWithMore(t *testing.T) {
 	}
 }
 
+func TestFluxStatus_ParsesReadyReasonAndShortRevision(t *testing.T) {
+	k := []byte(`{"status":{
+	  "conditions":[{"type":"Ready","status":"True","reason":"ReconciliationSucceeded","message":"Applied revision: main@sha1:7a51d1d13944"}],
+	  "lastAppliedRevision":"main@sha1:7a51d1d13944c481b04fc434d9a2aca2a25632e4"}}`)
+
+	f, err := atlas.FluxStatus(k)
+	if err != nil {
+		t.Fatalf("FluxStatus: %v", err)
+	}
+	if !f.Ready || f.Reason != "ReconciliationSucceeded" || f.Revision != "main@7a51d1d" {
+		t.Fatalf("flux = %+v", f)
+	}
+}
+
+func TestFluxNode_GreenWhenReadyCoralWhenNot(t *testing.T) {
+	ready := atlas.FluxNode(atlas.Flux{Ready: true, Reason: "ReconciliationSucceeded", Revision: "main@7a51d1d"})
+	if ready.Pill != "var(--green)" {
+		t.Fatalf("ready pill = %q", ready.Pill)
+	}
+	if ready.Title != "⟳ Flux · reconciled · main@7a51d1d" {
+		t.Fatalf("title = %q", ready.Title)
+	}
+	notReady := atlas.FluxNode(atlas.Flux{Ready: false, Reason: "BuildFailed"})
+	if notReady.Pill != "var(--coral)" {
+		t.Fatalf("not-ready pill = %q", notReady.Pill)
+	}
+}
+
 func TestDeployState_ParsesImageAndReplicas(t *testing.T) {
 	dep := []byte(`{"spec":{"replicas":2,"template":{"spec":{"containers":[
 	  {"name":"cad-atlas","image":"localhost:5000/cad-atlas:3ff922a"}]}}},

internal/atlas/model.go

@@ -38,6 +38,7 @@ type Atlas struct {
 	Version   string   `json:"version,omitempty"`
 	Substrate []Host   `json:"substrate"`
 	NS        string   `json:"ns,omitempty"`
+	Timeline  []RunDot `json:"timeline,omitempty"`
 	Stages    []Stage  `json:"stages"`
 }
 

internal/atlas/runs.go

@@ -31,20 +31,62 @@ type RunSummary struct {
 // State aggregates the jobs: failure if any failed, running if any not yet
 // succeeded, else success.
 func (s RunSummary) State() string {
-	allSucceeded := true
-	for _, j := range s.Jobs {
+	return aggregateState(s.Jobs)
+}
+
+// RunDot is one run's aggregate outcome for the recent-runs timeline.
+type RunDot struct {
+	Number int    `json:"number"`
+	State  string `json:"state"`
+}
+
+// RecentRuns parses a Gitea `/actions/tasks` response (per-job, newest first)
+// into up to n most-recent runs with their aggregate outcome, newest first.
+func RecentRuns(tasksJSON []byte, n int) ([]RunDot, error) {
+	var resp struct {
+		Tasks []struct {
+			RunNumber  int    `json:"run_number"`
+			Status     string `json:"status"`
+			Conclusion string `json:"conclusion"`
+		} `json:"workflow_runs"`
+	}
+	if err := json.Unmarshal(tasksJSON, &resp); err != nil {
+		return nil, fmt.Errorf("parse tasks: %w", err)
+	}
+	var order []int
+	jobsByRun := map[int][]Job{}
+	for _, t := range resp.Tasks {
+		if _, seen := jobsByRun[t.RunNumber]; !seen {
+			order = append(order, t.RunNumber)
+		}
+		jobsByRun[t.RunNumber] = append(jobsByRun[t.RunNumber], Job{Status: t.Status, Conclusion: t.Conclusion})
+	}
+	dots := make([]RunDot, 0, n)
+	for _, rn := range order {
+		if len(dots) >= n {
+			break
+		}
+		dots = append(dots, RunDot{Number: rn, State: aggregateState(jobsByRun[rn])})
+	}
+	return dots, nil
+}
+
+// aggregateState folds per-job outcomes into a run outcome.
+func aggregateState(jobs []Job) string {
+	pending := false
+	for _, j := range jobs {
 		switch j.State() {
 		case "failure", "cancelled", "error":
 			return "failure"
-		case "success":
+		case "success", "skipped": // completed OK — skipped (e.g. deploy on a tag push) doesn't block
 		default:
-			allSucceeded = false
+			pending = true // running / in_progress / waiting / queued / unknown
 		}
 	}
-	if allSucceeded {
-		return "success"
-	}
+	if pending {
 		return "running"
+	}
+	return "success"
 }
 
 // LatestRunJobs parses a Gitea `/actions/tasks` response (per-job entries,

internal/atlas/runs_test.go

@@ -65,6 +65,40 @@ func TestRunNodes_SummaryThenPerJobColoured(t *testing.T) {
 	}
 }
 
+func TestRecentRuns_GroupsRunsNewestFirstWithAggregateState(t *testing.T) {
+	tasks := []byte(`{"workflow_runs":[
+	  {"run_number":28,"name":"Deploy","status":"success"},
+	  {"run_number":28,"name":"Build","status":"success"},
+	  {"run_number":27,"name":"Deploy","status":"completed","conclusion":"failure"},
+	  {"run_number":26,"name":"Build","status":"running"},
+	  {"run_number":25,"name":"Deploy","status":"success"}
+	]}`)
+
+	dots, err := atlas.RecentRuns(tasks, 3)
+	if err != nil {
+		t.Fatalf("RecentRuns: %v", err)
+	}
+	if len(dots) != 3 {
+		t.Fatalf("want 3 dots (capped), got %d: %+v", len(dots), dots)
+	}
+	want := []atlas.RunDot{{28, "success"}, {27, "failure"}, {26, "running"}}
+	for i := range want {
+		if dots[i] != want[i] {
+			t.Fatalf("dot[%d] = %+v, want %+v", i, dots[i], want[i])
+		}
+	}
+}
+
+func TestRunState_SkippedJobsCountAsOK(t *testing.T) {
+	// A tag-push run skips the deploy job; the run still succeeded.
+	s := atlas.RunSummary{Jobs: []atlas.Job{
+		{Status: "skipped"}, {Status: "success"}, {Status: "success"},
+	}}
+	if s.State() != "success" {
+		t.Fatalf("skipped+success run state = %q, want success", s.State())
+	}
+}
+
 func TestLatestRunJobs_ErrorsWhenEmpty(t *testing.T) {
 	if _, err := atlas.LatestRunJobs([]byte(`{"workflow_runs":[]}`)); err == nil {
 		t.Fatal("expected error on empty, got nil")

internal/cluster/client.go

@@ -29,6 +29,12 @@ func Deployment() ([]byte, error) {
 	return get("/apis/apps/v1/namespaces/cad-atlas/deployments/cad-atlas")
 }
 
+// FluxKustomization returns the raw JSON for the Flux `apps` Kustomization that
+// reconciles this repo's manifests.
+func FluxKustomization() ([]byte, error) {
+	return get("/apis/kustomize.toolkit.fluxcd.io/v1/namespaces/flux-system/kustomizations/apps")
+}
+
 func get(path string) ([]byte, error) {
 	host, port := os.Getenv("KUBERNETES_SERVICE_HOST"), os.Getenv("KUBERNETES_SERVICE_PORT")
 	if host == "" || port == "" {

internal/gitea/client.go

@@ -21,7 +21,7 @@ func base() string {
 
 // Runs returns the raw /actions/tasks JSON for mathias/cad-atlas (newest first).
 func Runs() ([]byte, error) {
-	url := base() + "/api/v1/repos/mathias/cad-atlas/actions/tasks?limit=20"
+	url := base() + "/api/v1/repos/mathias/cad-atlas/actions/tasks?limit=50"
 	client := &http.Client{Timeout: 5 * time.Second}
 	resp, err := client.Get(url) //nolint:noctx // short-lived, timeout on the client
 	if err != nil {

internal/web/handler.go

@@ -47,6 +47,7 @@ func NewHandler() http.Handler {
 		if ld.ns != "" {
 			a.NS = "Tailscale mesh · " + ld.ns
 		}
+		a.Timeline = ld.timeline
 		if ld.run != nil {
 			nodes := atlas.RunNodes(*ld.run)
 			for i := range a.Stages {
@@ -55,11 +56,17 @@ func NewHandler() http.Handler {
 				}
 			}
 		}
+		if ld.deploy != nil || ld.flux != nil {
+			var live []atlas.Node
 			if ld.deploy != nil {
-			node := atlas.DeployNode(*ld.deploy)
+				live = append(live, atlas.DeployNode(*ld.deploy))
+			}
+			if ld.flux != nil {
+				live = append(live, atlas.FluxNode(*ld.flux))
+			}
 			for i := range a.Stages {
 				if a.Stages[i].Generate == "deploy-state" {
-					a.Stages[i].Nodes = append([]atlas.Node{node}, a.Stages[i].Nodes...)
+					a.Stages[i].Nodes = append(live, a.Stages[i].Nodes...)
 				}
 			}
 		}
@@ -75,6 +82,8 @@ type liveOverlayData struct {
 	ns       string
 	run      *atlas.RunSummary
 	deploy   *atlas.Deploy
+	flux     *atlas.Flux
+	timeline []atlas.RunDot
 }
 
 // live cache: query the cluster at most once per TTL; fall back to the authored
@@ -110,12 +119,20 @@ func liveOverlay() liveOverlayData {
 		if r, err := atlas.LatestRunJobs(raw); err == nil {
 			d.run = &r
 		}
+		if dots, err := atlas.RecentRuns(raw, 12); err == nil {
+			d.timeline = dots
+		}
 	}
 	if raw, err := cluster.Deployment(); err == nil {
 		if dep, err := atlas.DeployState(raw); err == nil {
 			d.deploy = &dep
 		}
 	}
+	if raw, err := cluster.FluxKustomization(); err == nil {
+		if f, err := atlas.FluxStatus(raw); err == nil {
+			d.flux = &f
+		}
+	}
 	liveCache = d
 	return d
 }

internal/web/static/cad-atlas.html

@@ -52,6 +52,13 @@
   .host .k{color:var(--dim);font-size:11px}
   .host.mesh{border-style:dashed;color:var(--dim)}
 
+  .tl{display:none;gap:5px;align-items:center;flex-wrap:wrap;
+    padding:8px 22px;border-bottom:1px solid var(--line);background:var(--panel)}
+  .tl .lbl{color:var(--dim);font-size:11px;letter-spacing:1.5px;margin-right:4px}
+  .rundot{width:22px;height:16px;border-radius:4px;border:1px solid rgba(0,0,0,.35);
+    display:inline-flex;align-items:center;justify-content:center;
+    font-size:9px;color:#08121f;font-weight:600}
+
   .scroll{overflow-x:auto;padding:24px 22px 20px}
   .track{position:relative;display:flex;align-items:flex-start;min-width:max-content}
   svg.spine{position:absolute;left:0;top:0;z-index:0;pointer-events:none;overflow:visible}
@@ -122,6 +129,7 @@
 </header>
 
 <div class="substrate" id="substrate"><span class="lbl mono">SUBSTRATE</span></div>
+<div class="tl mono" id="timeline"></div>
 
 <div class="scroll">
   <div class="track" id="track">
@@ -154,7 +162,7 @@
 // stage from the live cd.yml + substrate from the live cluster). These start
 // empty and are filled by init()'s fetch; on failure the page shows an error
 // banner rather than stale inline data.
-let SUBSTRATE=[], NS="", STAGES=[];
+let SUBSTRATE=[], NS="", STAGES=[], TIMELINE=[];
 
 const track=document.getElementById('track');
 let stageEls=[];
@@ -181,6 +189,20 @@ function renderAtlas(){
   });
 }
 
+function renderTimeline(){
+  const tl=document.getElementById('timeline');
+  if(!TIMELINE.length){tl.style.display='none';return;}
+  tl.innerHTML='<span class="lbl">RECENT RUNS</span>';
+  TIMELINE.forEach(d=>{
+    const c=d.state==='success'?'var(--green)':(d.state==='failure'?'var(--coral)':'var(--amber)');
+    const el=document.createElement('span');
+    el.className='rundot';el.style.background=c;
+    el.title='run #'+d.number+' · '+d.state;el.textContent=d.number;
+    tl.appendChild(el);
+  });
+  tl.style.display='flex';
+}
+
 /* ---- geometry ---- */
 const spine=document.getElementById('spine'), spinePath=document.getElementById('spinePath'),
       loopPath=document.getElementById('loopPath'), loopLbl=document.getElementById('loopLbl'),
@@ -233,6 +255,7 @@ async function init(){
     if(Array.isArray(data.substrate)) SUBSTRATE=data.substrate;
     if(typeof data.ns==='string') NS=data.ns;
     if(Array.isArray(data.stages)) STAGES=data.stages;
+    if(Array.isArray(data.timeline)) TIMELINE=data.timeline;
     if(data.version) document.getElementById('ver').textContent=data.version;
   }catch(e){
     console.error('atlas: failed to load /api/atlas.json —',e);
@@ -243,6 +266,7 @@ async function init(){
     return;
   }
   renderAtlas();
+  renderTimeline();
   replay();
 }
 window.addEventListener('load',init);