feat: Monitor Runtime Events tab — real-time microVM lifecycle from CloudWatch

Backend:
- New /api/v1/monitor/runtime-events endpoint
- Queries CloudWatch Logs for AgentCore microVM events
- Classifies: invocation, response, cold_start, release (SIGTERM),
  workspace assembly, S3 sync, Plan A injection, usage write, SSM mapping
- Summary stats: invocations, cold starts, releases, active tenants

Frontend:
- New 'Runtime Events' tab in Monitor Center
- 5 summary cards (invocations, cold starts, VM releases, active tenants, time range)
- Real-time event timeline with color-coded types and icons
- Auto-refresh every 15 seconds
- Shows tenant_id, timestamps, event details
- IT Admin can see: when microVMs start, when they release,
  which tenants are active, cold start vs warm ratio

Author: JiaDe

enterprise/admin-console/server/main.py

@@ -1465,6 +1465,98 @@ def get_session_detail(session_id: str):
     return {"session": session, "conversation": conv, "quality": quality, "planE": plan_e}
 
 
+@app.get("/api/v1/monitor/runtime-events")
+def get_runtime_events(minutes: int = 30):
+    """Query CloudWatch Logs for microVM lifecycle events (invocations, SIGTERM, assembly)."""
+    try:
+        import time as _time
+        cw = _boto3.client("logs", region_name="us-east-1")
+        start_time = int((_time.time() - minutes * 60) * 1000)
+        events = []
+
+        for log_group in _LOG_GROUPS:
+            try:
+                # Get all recent log events
+                resp = cw.filter_log_events(
+                    logGroupName=log_group,
+                    startTime=start_time,
+                    limit=200,
+                    interleaved=True,
+                )
+                for event in resp.get("events", []):
+                    msg = event.get("message", "")
+                    ts = event.get("timestamp", 0)
+                    iso_ts = datetime.fromtimestamp(ts / 1000, tz=timezone.utc).isoformat()
+
+                    # Classify event type
+                    if "SIGTERM" in msg:
+                        events.append({"type": "release", "message": "microVM released (SIGTERM)", "timestamp": iso_ts, "raw": msg.strip()[:200]})
+                    elif "First invocation" in msg or "assembling workspace" in msg:
+                        tenant = ""
+                        if "tenant" in msg:
+                            parts = msg.split("tenant")
+                            if len(parts) > 1:
+                                tenant = parts[1].strip().split(" ")[0].strip("= ")
+                        events.append({"type": "cold_start", "message": f"Cold start — workspace assembly", "tenant": tenant, "timestamp": iso_ts, "raw": msg.strip()[:200]})
+                    elif "Workspace ready" in msg or "Workspace assembled" in msg:
+                        events.append({"type": "ready", "message": "Workspace ready", "timestamp": iso_ts, "raw": msg.strip()[:200]})
+                    elif "Invocation tenant_id=" in msg:
+                        tenant = msg.split("tenant_id=")[1].split(" ")[0] if "tenant_id=" in msg else ""
+                        msg_len = msg.split("message_len=")[1].split(" ")[0] if "message_len=" in msg else "?"
+                        events.append({"type": "invocation", "message": f"Agent invocation (msg_len={msg_len})", "tenant": tenant, "timestamp": iso_ts, "raw": msg.strip()[:200]})
+                    elif "Response tenant_id=" in msg:
+                        duration = ""
+                        if "duration_ms=" in msg:
+                            duration = msg.split("duration_ms=")[1].split(" ")[0]
+                        model = ""
+                        if "model=" in msg:
+                            model = msg.split("model=")[1].split(" ")[0]
+                        tokens = ""
+                        if "tokens=" in msg:
+                            tokens = msg.split("tokens=")[1].split(" ")[0]
+                        events.append({"type": "response", "message": f"Response ({duration}ms, {tokens} tokens, {model})", "timestamp": iso_ts, "raw": msg.strip()[:200]})
+                    elif "DynamoDB usage written" in msg:
+                        events.append({"type": "usage", "message": "Usage written to DynamoDB", "timestamp": iso_ts, "raw": msg.strip()[:200]})
+                    elif "Plan A" in msg:
+                        events.append({"type": "plan_a", "message": "Plan A constraints injected", "timestamp": iso_ts, "raw": msg.strip()[:200]})
+                    elif "S3 workspace synced" in msg or "watchdog" in msg.lower():
+                        events.append({"type": "sync", "message": "S3 workspace sync", "timestamp": iso_ts, "raw": msg.strip()[:200]})
+                    elif "SSM user-mapping" in msg:
+                        events.append({"type": "mapping", "message": msg.strip()[:100], "timestamp": iso_ts, "raw": msg.strip()[:200]})
+            except _ClientError:
+                pass
+
+        # Sort by timestamp descending (newest first)
+        events.sort(key=lambda e: e["timestamp"], reverse=True)
+
+        # Summary stats
+        invocations = [e for e in events if e["type"] == "invocation"]
+        cold_starts = [e for e in events if e["type"] == "cold_start"]
+        releases = [e for e in events if e["type"] == "release"]
+        responses = [e for e in events if e["type"] == "response"]
+
+        # Unique active tenants
+        active_tenants = set()
+        for e in invocations:
+            t = e.get("tenant", "")
+            if t:
+                active_tenants.add(t)
+
+        return {
+            "events": events[:100],  # cap at 100
+            "summary": {
+                "totalEvents": len(events),
+                "invocations": len(invocations),
+                "coldStarts": len(cold_starts),
+                "releases": len(releases),
+                "activeTenants": len(active_tenants),
+                "timeRangeMinutes": minutes,
+            },
+        }
+    except Exception as e:
+        return {"events": [], "summary": {"error": str(e)}}
+
+
 @app.get("/api/v1/monitor/alerts")
 def get_alert_rules():
     """Alert rules with real-time status evaluation against actual data."""

enterprise/admin-console/src/hooks/useApi.ts

@@ -161,6 +161,18 @@ export function useAlertRules() {
   });
 }
 
+export interface RuntimeEvent {
+  type: string; message: string; timestamp: string; tenant?: string; raw?: string;
+}
+
+export function useRuntimeEvents(minutes: number = 30) {
+  return useQuery<{ events: RuntimeEvent[]; summary: Record<string, number> }>({
+    queryKey: ['runtime-events', minutes],
+    queryFn: () => api.get(`/monitor/runtime-events?minutes=${minutes}`),
+    refetchInterval: 15_000,
+  });
+}
+
 // === Audit ===
 
 export function useAuditEntries(params?: { limit?: number; eventType?: string }) {

enterprise/admin-console/src/pages/Monitor/index.tsx

@@ -4,7 +4,7 @@ import Chart from 'react-apexcharts';
 import type { ApexOptions } from 'apexcharts';
 import { Bot, MessageSquare, Star, AlertTriangle, Shield, RefreshCw, Eye, Radio, Clock, Zap } from 'lucide-react';
 import { Card, StatCard, Badge, Button, PageHeader, Table, StatusDot, Tabs } from '../../components/ui';
-import { useSessions, useAgents, useMonitorHealth, useAlertRules } from '../../hooks/useApi';
+import { useSessions, useAgents, useMonitorHealth, useAlertRules, useRuntimeEvents } from '../../hooks/useApi';
 import { CHANNEL_LABELS } from '../../types';
 import type { ChannelType } from '../../types';
 import SessionDetail from './SessionDetail';
@@ -28,6 +28,7 @@ export default function Monitor() {
   const navigate = useNavigate();
   const { data: healthData, refetch: refetchHealth } = useMonitorHealth();
   const { data: alertRules = [], refetch: refetchAlerts } = useAlertRules();
+  const { data: runtimeData } = useRuntimeEvents(60);
   const [selectedSession, setSelectedSession] = useState<string | null>(null);
   const [activeTab, setActiveTab] = useState('sessions');
 
@@ -107,6 +108,7 @@ export default function Monitor() {
             { id: 'sessions', label: 'Live Sessions', count: sessions.length },
             { id: 'health', label: 'Agent Health', count: health.length },
             { id: 'alerts', label: 'Alert Rules', count: alertCount || undefined },
+            { id: 'runtime', label: 'Runtime Events' },
           ]}
           activeTab={activeTab}
           onChange={setActiveTab}
@@ -244,6 +246,71 @@ export default function Monitor() {
               </div>
             </div>
           )}
+
+          {activeTab === 'runtime' && (
+            <div>
+              {/* Summary cards */}
+              <div className="grid grid-cols-2 gap-3 sm:grid-cols-5 mb-4">
+                <div className="rounded-lg bg-dark-bg border border-dark-border p-3 text-center">
+                  <div className="text-lg font-bold text-primary">{runtimeData?.summary?.invocations || 0}</div>
+                  <div className="text-[10px] text-text-muted">Invocations</div>
+                </div>
+                <div className="rounded-lg bg-dark-bg border border-dark-border p-3 text-center">
+                  <div className="text-lg font-bold text-amber-400">{runtimeData?.summary?.coldStarts || 0}</div>
+                  <div className="text-[10px] text-text-muted">Cold Starts</div>
+                </div>
+                <div className="rounded-lg bg-dark-bg border border-dark-border p-3 text-center">
+                  <div className="text-lg font-bold text-red-400">{runtimeData?.summary?.releases || 0}</div>
+                  <div className="text-[10px] text-text-muted">VM Releases</div>
+                </div>
+                <div className="rounded-lg bg-dark-bg border border-dark-border p-3 text-center">
+                  <div className="text-lg font-bold text-green-400">{runtimeData?.summary?.activeTenants || 0}</div>
+                  <div className="text-[10px] text-text-muted">Active Tenants</div>
+                </div>
+                <div className="rounded-lg bg-dark-bg border border-dark-border p-3 text-center">
+                  <div className="text-lg font-bold text-text-muted">{runtimeData?.summary?.timeRangeMinutes || 60}m</div>
+                  <div className="text-[10px] text-text-muted">Time Range</div>
+                </div>
+              </div>
+
+              {/* Event timeline */}
+              <p className="text-sm text-text-secondary mb-3">Real-time AgentCore microVM lifecycle events from CloudWatch Logs</p>
+              <div className="space-y-1.5 max-h-[500px] overflow-y-auto">
+                {(runtimeData?.events || []).map((e, i) => {
+                  const typeConfig: Record<string, { color: string; icon: string }> = {
+                    invocation: { color: 'text-primary', icon: '→' },
+                    response: { color: 'text-green-400', icon: '←' },
+                    cold_start: { color: 'text-amber-400', icon: '🔥' },
+                    release: { color: 'text-red-400', icon: '⏹' },
+                    ready: { color: 'text-green-400', icon: '✓' },
+                    sync: { color: 'text-cyan-400', icon: '↻' },
+                    plan_a: { color: 'text-orange-400', icon: '🛡' },
+                    usage: { color: 'text-blue-400', icon: '📊' },
+                    mapping: { color: 'text-purple-400', icon: '🔗' },
+                  };
+                  const cfg = typeConfig[e.type] || { color: 'text-text-muted', icon: '·' };
+                  return (
+                    <div key={i} className="flex items-start gap-2 rounded-lg bg-dark-bg/50 px-3 py-2 text-xs hover:bg-dark-bg transition-colors">
+                      <span className={`${cfg.color} font-mono w-4 shrink-0 text-center`}>{cfg.icon}</span>
+                      <span className="text-text-muted shrink-0 w-20 font-mono">{new Date(e.timestamp).toLocaleTimeString()}</span>
+                      <Badge color={e.type === 'invocation' ? 'primary' : e.type === 'response' ? 'success' : e.type === 'cold_start' ? 'warning' : e.type === 'release' ? 'danger' : 'default'}>
+                        {e.type}
+                      </Badge>
+                      <span className="text-text-secondary flex-1">{e.message}</span>
+                      {e.tenant && <code className="text-[10px] text-text-muted bg-dark-card px-1 rounded truncate max-w-[200px]">{e.tenant}</code>}
+                    </div>
+                  );
+                })}
+                {(!runtimeData?.events || runtimeData.events.length === 0) && (
+                  <div className="text-center py-8 text-text-muted">
+                    <Radio size={24} className="mx-auto mb-2 opacity-50" />
+                    <p className="text-sm">No runtime events in the last {runtimeData?.summary?.timeRangeMinutes || 60} minutes</p>
+                    <p className="text-xs mt-1">Events appear when agents are invoked via IM channels or Portal</p>
+                  </div>
+                )}
+              </div>
+            </div>
+          )}
         </div>
       </Card>
     </div>