feat(nvcf-ui): import the self-hosted UI into the monorepo

.bazelignore

@@ -86,6 +86,17 @@ src/libraries/go/lib/pkg/nvkit/build
 # Bazel-managed caches we keep inside the workspace for CI cache: paths.
 .bazel-cache
 
+# Lifted from src/uis/nvcf-ui/.bazelignore on migration into the root module.
+# ui/node_modules in particular is required: aspect_rules_js refuses to evaluate
+# npm_translate_lock unless every nested node_modules pnpm will create is
+# ignored here.
+src/uis/nvcf-ui/ui/node_modules
+src/uis/nvcf-ui/ui/dist
+src/uis/nvcf-ui/ui/coverage
+src/uis/nvcf-ui/backend/static
+src/uis/nvcf-ui/backend/bin
+src/uis/nvcf-ui/node_modules
+
 # Lifted from src/compute-plane-services/ess-agent/.bazelignore on migration into the root module.
 src/compute-plane-services/ess-agent/local
 src/compute-plane-services/ess-agent/vault

.coderabbit.yaml

@@ -56,6 +56,7 @@ reviews:
     - "!**/*.tgz"
     - "!**/*.png"
     - "!**/*.jpg"
+    - "!**/pnpm-lock.yaml"
     - "!tools/ci/generated-release-jobs.yml"
   path_instructions:
     - path: "src/**/*.go"
@@ -71,12 +72,41 @@ reviews:
       instructions: >-
         Cassandra DDL migrations are forward-only and one keyspace per
         subdirectory. Flag destructive statements and missing IF NOT EXISTS.
+    - path: "src/uis/nvcf-ui/ui/src/features/**/*.tsx"
+      instructions: >-
+        Suspense hook variants (useGetFooSuspense) are expected when data is prefetched in
+        a route loader; regular useQuery is fine for secondary or deferred fetches.
+        Route loaders use ensureQueryData with revalidateIfStale: true for blocking data.
+        void prefetchQuery is intentional for fire-and-forget child-route cache warming.
+        No manual fetch calls for endpoints that have generated hooks in ui/src/generated/.
+        Prefer KUI components from @nvidia/foundations-react-core over plain HTML where a
+        natural fit exists — flag clear misses but use judgment.
+        New components should have co-located tests.
+    - path: "src/uis/nvcf-ui/ui/src/**/*.test.tsx"
+      instructions: >-
+        Route-level views must use renderWithRouter from ~/testing/render, not standard render.
+        Tests should cover happy path, error state, and empty state — not just the happy path.
+        Prefer accessible queries (getByRole, getByText) over test IDs.
+    - path: "src/uis/nvcf-ui/ui/src/generated/**"
+      instructions: >-
+        This is generated code (from control-plane-openapi.yaml / nvcf-openapi.yaml / sis-openapi.yaml).
+        Do NOT comment on code style, naming, or general best practices — Biome enforces formatting via CI.
+        ONLY flag spec-consistency issues: generated code that doesn't match the current spec
+        (e.g., missing or renamed fields, changed types, endpoints absent from codegen output),
+        OR generated files that appear to have been manually edited without a corresponding spec change.
+    - path: "src/uis/nvcf-ui/spec/*.yaml"
+      instructions: >-
+        These are the source of truth for the API. Generated output lives in
+        ui/src/generated/ and must never be edited directly. Flag any PR that touches
+        ui/src/generated/ without a corresponding spec change that justifies it.
   tools:
     shellcheck:
       enabled: true
     yamllint:
       enabled: true
     golangci-lint:
       enabled: true
+    biome:
+      enabled: true
 chat:
   auto_reply: true

.github/CODEOWNERS

@@ -31,6 +31,7 @@
 # ledger, deployment stages, NVCT API, vanity gateway, autoscaler, Helm ReVal,
 # LLM gateway, LLM request router, SIS, and Stargate.
 /src/control-plane-services/ @NVIDIA/nvcf-control-plane-dev
+/src/uis/ @NVIDIA/nvcf-control-plane-dev
 /src/invocation-plane-services/ @NVIDIA/nvcf-control-plane-dev
 /src/libraries/rust/stargate/ @NVIDIA/nvcf-control-plane-dev
 /deploy/helm/admin-token-issuer-proxy/ @NVIDIA/nvcf-control-plane-dev

.github/workflows/bazel.yml

@@ -147,7 +147,8 @@ jobs:
           helm-reval|src/control-plane-services/helm-reval|false|go-root|build-container
           stargate|src/libraries/rust/stargate|false|go-root|build-container
           nvsnap|src/compute-plane-services/nvsnap|false|go-root|build-container
-          image-credential-helper|src/compute-plane-services/image-credential-helper|false|go-root|build-container'
+          image-credential-helper|src/compute-plane-services/image-credential-helper|false|go-root|build-container
+            nvcf-ui|src/uis/nvcf-ui|false|go-root|build-container'
 
           # Java rows are discovered from component-local bazel-java-ci.json
           # descriptors. The descriptor's parent directory is the component

MODULE.bazel

@@ -231,6 +231,23 @@ use_repo(go_deps, "cat_dario_mergo", "com_github_armon_go_metrics", "com_github_
 # semantics, not a build setting, so the value here is kept at the majority
 # edition and carries no meaning beyond that.
 # ============================================================================
+# ---- JS/TS (aspect_rules_js, pnpm-native) ----
+# Lifted from src/uis/nvcf-ui/MODULE.bazel when the UI joined the root module.
+# 3.2.x reads the build-script allowlist from pnpm-workspace.yaml (allowBuilds).
+bazel_dep(name = "aspect_rules_js", version = "3.2.2")
+bazel_dep(name = "rules_nodejs", version = "6.7.3")
+
+node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
+node.toolchain(node_version = "22.12.0")
+
+npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm")
+npm.npm_translate_lock(
+    name = "npm",
+    pnpm_lock = "//src/uis/nvcf-ui/ui:pnpm-lock.yaml",
+    verify_node_modules_ignored = "//:.bazelignore",
+)
+use_repo(npm, "npm")
+
 bazel_dep(name = "rules_rust", version = "0.69.0")
 
 rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")