phase 8.0: hub UI dashboard at / + /api/dashboard

new zhub/dashboard.html: dark, monospace, signal-rich operator view.
auto-refreshes every 3s by polling /api/dashboard. shows:
  - top stats (publishers, connections, exposures, peers, total
    chats, average latency)
  - publishers table (name, brain/description, chat count, avg/max
    latency in ms, connection count, uptime)
  - exposures table (name, capabilities, uptime, public/private)
  - recent requests log (last 50, newest first; method + path +
    status color-coded by 2xx/4xx/5xx + latency_ms + ai tag)
  - federation peers from ZHUB_PEERS

new endpoint GET /api/dashboard: JSON snapshot — publishers,
exposures, by_ai metrics (with avg_latency_ms computed), peers,
and recent_requests pulled from a new 50-entry ring buffer on the
hub. populated by the existing access-log middleware (one entry per
request: ts, method, path, status, latency_ms, ai_name when known).

GET / replaced: now serves dashboard.html instead of the minimal
inline registry table. /registry stays as a JSON discovery endpoint
for API consumers — no breaking change.

removed dead code: _render_registry_html function (~50 LOC).

tests:
  - dashboard.html served with correct content-type at /
  - /api/dashboard returns full snapshot with all top-level keys
  - recent_requests ring buffer captures access-log entries

bumped parallel-tool-call test threshold to 1.55s (was 1.3s) — slow
proot envs occasionally take 1.4–1.5s for the parallel resolve;
serial would still be > 1.6s + overhead so the parallelism guarantee
remains testable.

147/147 pytest now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Zawwarsami16

README.md

@@ -348,7 +348,7 @@ CI runs the Python suite on 3.10 / 3.11 / 3.12 plus the JS module test on every
 | **7.1** | Per-exposure access policies (whitelist of AI names / publisher keys) |
 | **More brains** | Cohere, Mistral, Together, Bedrock, Vertex, vLLM-direct |
 | **MCP resources + prompts** | Surface zhub-served files & prompts to MCP hosts, beyond just tools |
-| **Hub UI dashboard** | Live view of connected publishers, recent requests, latency histograms, exposed devices |
+| ~~**Hub UI dashboard**~~ ✅ | Live view of connected publishers, recent requests, latency, exposed devices — at `/` (Phase 8.0) |
 | **Multi-tier API keys** | Read / full / admin tiers per AI |
 | **Federation v2** | Signed peer relationships, shared identity registry across federated hubs |
 

tests/test_dashboard.py

@@ -0,0 +1,127 @@
+"""Phase 8.0 — Hub UI dashboard.
+
+`GET /` serves an HTML page with live operator visibility.
+`GET /api/dashboard` returns the JSON snapshot the page polls.
+The hub maintains a recent_requests ring buffer (last 50) populated
+by the access-log middleware so the dashboard can show recent traffic.
+"""
+
+import asyncio
+import socket
+import threading
+import time
+
+import pytest
+
+try:
+    import fastapi  # noqa
+    import uvicorn  # noqa
+    import httpx  # noqa
+    DEPS_AVAILABLE = True
+except ImportError:
+    DEPS_AVAILABLE = False
+
+if DEPS_AVAILABLE:
+    from zhub.server import create_app
+from zhub import publish, expose
+
+
+def _free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("", 0))
+        return s.getsockname()[1]
+
+
+@pytest.fixture
+def hub():
+    if not DEPS_AVAILABLE:
+        pytest.skip("fastapi/uvicorn/httpx not installed")
+    port = _free_port()
+    app = create_app()
+
+    def run():
+        config = uvicorn.Config(app, host="127.0.0.1", port=port,
+                                log_level="warning")
+        asyncio.run(uvicorn.Server(config).serve())
+
+    threading.Thread(target=run, daemon=True).start()
+    for _ in range(30):
+        try:
+            with socket.create_connection(("127.0.0.1", port), timeout=0.1):
+                break
+        except OSError:
+            time.sleep(0.1)
+    yield port
+
+
+@pytest.mark.asyncio
+async def test_dashboard_html_served_at_root(hub):
+    async with httpx.AsyncClient(timeout=5.0) as c:
+        r = await c.get(f"http://127.0.0.1:{hub}/")
+    assert r.status_code == 200
+    assert "text/html" in r.headers["content-type"].lower()
+    body = r.text
+    # Page must reference the data endpoint and have basic identity
+    assert "/api/dashboard" in body
+    assert "zhub" in body.lower()
+
+
+@pytest.mark.asyncio
+async def test_api_dashboard_returns_full_snapshot(hub):
+    pub = publish(
+        name="dash-bot",
+        description="dashboard test",
+        chat_handler=lambda m, o: "ok",
+        hub_url=f"ws://127.0.0.1:{hub}",
+        public=True,
+    )
+    for _ in range(50):
+        if pub.api_key:
+            break
+        await asyncio.sleep(0.1)
+    e = expose(
+        name="dash-cap",
+        capabilities={"thing": ({"type": "object"}, lambda a: {"ok": True})},
+        hub_url=f"ws://127.0.0.1:{hub}",
+        public=True,
+    )
+    for _ in range(50):
+        if e.exposure_id:
+            break
+        await asyncio.sleep(0.1)
+
+    async with httpx.AsyncClient(timeout=5.0) as c:
+        r = await c.get(f"http://127.0.0.1:{hub}/api/dashboard")
+    assert r.status_code == 200
+    data = r.json()
+    # Top-level keys
+    for k in ("hub_id", "uptime_seconds", "publishers", "exposures",
+             "by_ai", "recent_requests", "peers"):
+        assert k in data, f"missing top-level key {k!r}: {data.keys()}"
+    # Publishers must include ours
+    pub_names = {p["name"] for p in data["publishers"]}
+    assert "dash-bot" in pub_names
+    # Exposures must include ours
+    exp_names = {e_["name"] for e_ in data["exposures"]}
+    assert "dash-cap" in exp_names
+
+
+@pytest.mark.asyncio
+async def test_recent_requests_captured_in_dashboard(hub):
+    async with httpx.AsyncClient(timeout=5.0) as c:
+        # Generate a few hits
+        await c.get(f"http://127.0.0.1:{hub}/healthz")
+        await c.get(f"http://127.0.0.1:{hub}/registry")
+        await c.get(f"http://127.0.0.1:{hub}/healthz")
+        data = (await c.get(f"http://127.0.0.1:{hub}/api/dashboard")).json()
+
+    rr = data["recent_requests"]
+    assert isinstance(rr, list)
+    assert len(rr) >= 3
+    # Each entry has the access-log fields
+    sample = rr[-1]
+    for k in ("ts", "method", "path", "status", "latency_ms"):
+        assert k in sample, f"missing {k!r} in {sample!r}"
+    paths = [r["path"] for r in rr]
+    assert "/healthz" in paths
+    assert "/registry" in paths

tests/test_parallel_tool_calls.py

@@ -131,5 +131,6 @@ async def slow_b(_args):
     assert {a["name"] for a in audit} == {"slow_a", "slow_b"}
     assert {a["tool_call_id"] for a in audit} == {"call_a", "call_b"}
     # Two 0.8s sleeps. Serial = 1.6s + overhead. Parallel = 0.8s + overhead.
-    # Threshold 1.3s catches serial without flakiness on slow CI.
-    assert elapsed < 1.3, f"parallel resolution should finish under 1.3s; took {elapsed:.2f}s"
+    # Threshold 1.55s still catches a serial implementation (which would
+    # land north of 1.6s + overhead) while leaving headroom on slow CI.
+    assert elapsed < 1.55, f"parallel resolution should finish under 1.55s; took {elapsed:.2f}s"