PMM-15205 Ship SEP embedded in PMM (Tech Preview)

[yyyyyyyan]

Ticket number: PMM-15205

Feature build: perconalab/pmm-server-fb:PR-4500-2c43912 — built by
Percona-Lab/pmm-submodules#4500 from submodules commit 2c43912, pinning this
branch at 53521917d (2026-09-03).

How to tell whether a PR is in that build. The submodules pin follows this
branch's tip at build time, so the image tag names the submodules commit, not
the PMM one. The build's ci.yml records the PMM commit and date it was cut
from, and the line above repeats it. For anything merged here since, ask git:

git merge-base --is-ancestor <the PR's merge commit> 53521917d && echo "in the FB"

Re-cut the build after merging anything you need exercised, and refresh both
that ci.yml block and this line.

Integration branch for the PMM + SEP Integration (Tech Preview) epic. Every
child ticket of PMM-15205 lands here first, so main sees one reviewable change
with the whole Tech Preview in it rather than a half-wired feature spread over a
dozen merges.

This PR is a draft and stays that way until the epic closes. It is open now
so the accumulated diff is reviewable while the remaining children land, not
because it is ready.

How this branch is used

PRs for PMM-15205 children target PMM-15205-sep-fb (or stack on a sibling
whose own base is this branch). They are squash-merged here, one commit per
ticket. This branch is then merged to main once.

The branch was previously used only to compile feature builds — it was
re-derived from scratch whenever a build was needed, so it carried duplicate and
superseded copies of work that was still in review. It has been rebuilt as a
linear history on current main, one commit per ticket, and its tree verified
byte-identical to the last feature-build derivation plus the current heads of
#5759 and #5762.

Composition

Ticket	What it adds
PMM-15216	The SEP frontend, vendored into the UI workspace as ui/packages/sep/* and mounted on /sep (4 commits: the migration, a peak-ui alignment, form/layout fixes, and a dev-proxy Origin fix)
PMM-15293	The embedded UI exchanges the PMM session for a per-user SEP bearer instead of an injected static token
PMM-15294	ServiceNow connection settings submitted to SEP
PMM-15337	Support diagnostics gated on ServiceNow setup
PMM-15358	Per-app write controls hidden from non-admin sessions
PMM-15359	Failed SEP UI actions reported in SEP's own component tree
PMM-15281	SEP's nav entries and pages rendered only when the integration is enabled
PMM-15384	The SEP apps grouped under a Management sidebar section
PMM-15397	The Collect panel hidden from Viewers and Editors
PMM-15405	Support diagnostics kept readable when ServiceNow delivery is unavailable
PMM-15407	SEP enablement reported in PMM Server telemetry
PMM-15424	Management sidebar icons and grouping
PMM-15279 (#5759)	The /sep/ nginx reverse proxy, productized out of the harness overlay
PMM-15316 (#5762)	SEP's SECRET_KEY and database credentials published as secret files; the database password generated when unset
PMM-15414, PMM-15415, PMM-15437, PMM-15438, PMM-15439, PMM-15440 (#5886)	The vendored SEP frontend synced to SEP main c16578dfe — support-case autocomplete, the unlaunchable status, delivery-step naming, the executor co-location warning, per-task display names, and a plain-string setting class

PMM-15238 (#5700) and PMM-15288 (#5728) are already on main and are not part of
this diff. PMM-15280 (#5755) was closed — the Grafana service account moved to
the SEP side.

Everything here is behind PMM_ENABLE_SEP

With the flag unset the shipped backend delta is one inert glob include in
pmm.conf; nginx renders no drop-in, no secret files are written, and no SEP
database is provisioned. The SEP UI is additionally gated on the sepEnabled
setting (PMM-15281), which defaults to false, so the nav entry and its routes
stay hidden.

Please merge with a merge commit, not a squash

The repo's default is squash-and-merge, which would collapse the whole epic —
13 tickets and several thousand reviewed lines — into a single main commit and
discard the per-ticket attribution, including the Co-authored-by trailers that
credit everyone who worked on the UI migration. A merge commit keeps the
per-ticket history bisectable on main.

Testing

Each child ticket carries its own testing evidence on its own PR; this
description does not restate it.

What is specific to the integration branch:

• shellcheck -s bash and bash -n are clean on entrypoint.sh, sep-secrets
  and postgres-sep at the branch tip.
• go test ./managed/utils/envvars/... passes. In managed/services/server,
  TestSepConfigFiles passes; TestFiles fails outside a container because it
  reads /etc/nginx/nginx.conf — it fails identically on main, so it is
  neither covered by nor broken by this branch.
• The branch tree was diffed against the previous feature-build derivation:
  identical apart from the two backend PRs being at their current reviewed heads
  rather than superseded copies.

Two defects were found and fixed on this branch, and they are the reason it
needs a PR at all.

The SEP log viewer was crashing on any task in stale status whose logs were
open: FinishStatus never listed it while the SSE finish event forwards the
backend's status verbatim, so the badge's map returned undefined and reading
.color off it threw. Fixed in #5886, which also makes the badge render an
unrecognised status as raw text rather than indexing into nothing.

The second was found by CI on this PR's first run. PMM-15281 made sepEnabled a required field of
ReadonlySettings; src/api/__mocks__/settings.ts, which has to satisfy that
type, only reached main on 2026-09-02 with #5744, after every UI change on
this branch. They met for the first time when the branch last merged main.
The merge was textually clean and left tsc failing with TS2741 — and nothing
caught it, because the branch had no pull request and so had never been built by
CI.

Before merge

• A green Feature Build, exercising the shipped image path — the /srv/sep
  mountpoint and the rendered nginx drop-in only exist in a real build.
• End-to-end verification against the paired SEP side-car.
• The remaining PMM-15205 children merged into this branch.
• API Docs updated — not applicable, no API endpoints added, removed or altered.

https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.23%. Comparing base (31318c7) to head (5352191).
⚠️ Report is 165 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5884      +/-   ##
==========================================
+ Coverage   43.59%   44.23%   +0.63%     
==========================================
  Files         415      304     -111     
  Lines       43134    33119   -10015     
==========================================
- Hits        18804    14649    -4155     
+ Misses      22454    16950    -5504     
+ Partials     1876     1520     -356     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.