Admin Cockpit · Journey

Journey: Isis LoRA operations rehearsal

A source-reconciled journey record for Admin Cockpit — shipped behavior, state boundaries, failure modes, and the automation evidence available today.

automated · 1 spec
9sections6 minread1table
Markdown source
On this page
Journey at a glance
ActorsIsis operatorRights reviewerInfrastructure operatorModel reviewer
Systems exercisedisis-civitai-intake.mdisis-comfy-nodes.mdisis-lora-training.mdisis-model-merging.mdisis-output-gallery.mdisis-runpod-endpoints.mdisis-voice-cloning.mdisis-workflow-editor.md
Automation1 E2E spec(s)

Journey flow#

Generated from the authored steps below — click a node to jump to that section.

flowchart TD s1["1. Review Civitai intake"] s2["2. Inspect nodes and edit a workflow"] s3["3. Rehearse RunPod operations"] s4["4. Read LoRA training status"] s5["5. Review the output gallery"] s6["6. Model a merge"] s7["7. Inspect voice-cloning records"] s8["8. Stop at the boundary between projections"] s1 --> s2 --> s3 --> s4 --> s5 --> s6 --> s7 --> s8 click s1 href "#1-review-civitai-intake" click s2 href "#2-inspect-nodes-and-edit-a-workflow" click s3 href "#3-rehearse-runpod-operations" click s4 href "#4-read-lora-training-status" click s5 href "#5-review-the-output-gallery" click s6 href "#6-model-a-merge" click s7 href "#7-inspect-voice-cloning-records" click s8 href "#8-stop-at-the-boundary-between-projections"

The Admin Cockpit exposes eight Isis routes, but they are not one durable Civitai→RunPod→training→release pipeline. Seven pages load read projections from Isis BFF endpoints; the workflow editor loads an approved class and node palette through its own loader. Most visible decisions and controls then update component-local state or call pure domain helpers. This journey is an operator rehearsal across independent projections.

Route Read surface Current write boundary
/isis/civitai-intake Queue and search candidates Local decisions/import requests
/isis/comfy-nodes Curated node registry Read-only
/isis/workflow-editor Approved class and node palette Local graph; Promote has no handler
/isis/runpod-endpoints Endpoint, queue, cost, audit projections Local failover/rotation rehearsal
/isis/lora-training Training-run projection Abort/Promote have no handlers
/isis/output-gallery Output/provenance projection Local bulk-action model
/isis/model-merging Components and fixture sets Local merge model; Save has no handler
/isis/voice-cloning Clone-workflow projection Read-only

Personas#

  • Isis operator — has an admin session and can enter the Isis workspace.
  • Rights reviewer — represented by rights/consent fields in the projections; no cross-workspace approval handoff is driven here.
  • Infrastructure operator — rehearses RunPod queue, failover, and secret rotation decisions.
  • Model reviewer — filters gallery outputs and evaluates local action eligibility.

Pre-conditions#

  • The admin session exists and sessionCanEnterWorkspace(session, 'isis') passes.
  • The seven BFF read endpoints can return their fixture/store projections.
  • The workflow editor loader returns an approved workflow class and curated node types.
  • Operator identity is present when local domain helpers require an auditable actor.
  • No expectation is made that state selected on one Isis route appears on another route.

Steps#

1. Review Civitai intake#

  • /isis/civitai-intake loads queue entries, operator id, and search candidates from GET /v1/admin/isis/civitai-intake.
  • The panel groups entries, reveals details, evaluates approve/reject decisions, and wraps search/import candidates in intake policy.
  • Missing operator identity disables audited controls.
  • The UI states that there is no unmanaged provider download.
  • Approve/import changes only panel state through domain helpers; it does not POST a durable Civitai intake mutation.

2. Inspect nodes and edit a workflow#

  • /isis/comfy-nodes loads a curated registry, hides deprecated nodes by default, and names alternatives.
  • /isis/workflow-editor loads a real approved class and node palette, permits local graph edits, and validates disallowed node types and guardrails.
  • Graph changes are not saved to a BFF workflow record.
  • Promote to class is rendered without an action handler.

3. Rehearse RunPod operations#

  • /isis/runpod-endpoints loads endpoints, tenant windows, cost envelopes, queue jobs, failover entries, secret rotations, operator id, and reference time.
  • Health/cost/queue/control tabs expose worst-health sorting, budget verdicts, tenant fairness, and audit-ready action models.
  • The browser test exercises local failover and secret-rotation controls.
  • Missing operator identity disables audited actions.
  • These controls update component-local entries; they do not reserve a GPU, fail over a live endpoint, or rotate a provider secret.

4. Read LoRA training status#

  • /isis/lora-training loads current runs from GET /v1/admin/isis/lora-training.
  • The panel renders run state and a dataset-rights warning when required evidence is missing.
  • There is no form that submits base model, rank, epochs, learning rate, or a new training job.
  • Abort and Promote buttons have no handlers; no audit event or downstream model mutation follows them.
  • /isis/output-gallery loads records, authorization, and reference time from its BFF read endpoint.
  • Filter facets narrow records and selection gates the bulk-action controls.
  • Pure action builders model audited actions, undo windows, and required takedown reason in component state.
  • The browser spec proves the no-selection disabled state.
  • Bulk actions do not write gallery or provenance records to a backend.

6. Model a merge#

  • /isis/model-merging loads operator id, candidate components, and available fixture sets.
  • The panel blocks the local merge/save model until a base and at least two components are present, and blocks audited save without operator identity.
  • Provenance is computed from the selected component model.
  • Save as managed model has no handler; no weights are merged and no model-registry record is created.

7. Inspect voice-cloning records#

  • /isis/voice-cloning loads clone-workflow records from its BFF read endpoint.
  • The route is session and Isis-workspace gated and renders an honest empty state on loader failure.
  • This surface does not submit a new clone, verify consent in the rights workspace, or send an abuse case to Trust & Safety.

8. Stop at the boundary between projections#

  • Each route renders an explicit loader-failure notice or empty projection instead of inventing live data.
  • Unit coverage exercises the local decision functions, validation, and state transitions.
  • No shared job id or durable state threads intake, workflow, RunPod, training, gallery, merge, voice, review, and model promotion together.
  • No release package is submitted to /review and no model is promoted through /models.

Post-conditions#

  • The operator can inspect all eight Isis projections and rehearse the local policies and controls that are implemented.
  • Loader failures remain visible and access gates remain fail-closed.
  • The browser and component tests establish control anatomy and pure-domain behavior, not external provider or training side effects.
  • No trained LoRA, RunPod reservation, durable provenance bundle, merged weights, release package, or model promotion is claimed.

Failure modes#

  • Missing session — the page redirects with its own return target.
  • Forbidden Isis workspace — the page redirects before its loader renders.
  • BFF read failure — the seven read routes show an alert and an empty projection.
  • Operator identity absent — audited local controls are disabled.
  • Rights warning ignored — the projection can explain the block but no live training submit exists to enforce it.
  • Local action mistaken for provider mutation — RunPod, intake, gallery, and merge interactions do not call write endpoints.
  • Button presence mistaken for workflow — training Abort/Promote, workflow Promote, and merge Save have no handlers.
  • Cross-page continuity assumed — component-local state does not propagate across the eight routes.
  • Unit audit entry mistaken for durable audit — domain helper output exists only in the rendered/local model unless a future route persists it.

E2E coverage#

Coverage is shallow in the browser and broad at the component level. It does not browser-walk all eight pages and does not prove any provider write, training run, cross-page state, release review, or production promotion.

Per-view files touched by this journey#

Cross-references#

Open questions#

  • Which durable command API should own Civitai intake decisions and import requests?
  • How will a versioned workflow graph be saved and promoted?
  • Which service owns RunPod reservations, provider mutations, idempotency, quota, and cost ceilings?
  • What command creates/cancels a LoRA run and streams progress?
  • Where is an immutable provenance bundle persisted for output and merges?
  • Which review package connects an approved artifact to the model registry?
  • What E2E fixture can safely prove the complete pipeline without invoking unmanaged provider downloads?