From 5d2d7a54516edb3851aaa907c263811f9caec046 Mon Sep 17 00:00:00 2001
From: "Orca (ecs-claude)" <orca@ecs.local>
Date: Thu, 13 Aug 2026 23:12:16 +0800
Subject: [PATCH] =?UTF-8?q?feat(studio):=20fleet=20config=20panel=20?=
 =?UTF-8?q?=E2=80=94=20view=20+=20switch=20active=20fleet=20(ADR=20#19=20A?=
 =?UTF-8?q?+B)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The visible config surface the ADR #19 read model was missing: which fleet
this Studio is managing, against which credential/account, and the ability to
switch between fleets from the UI.

- oab-mcp: new read-only `fleet_config` tool (9th tool) — lists the configured
  per-fleet bindings (name/cluster/region/profile/expected_principal) plus the
  config file path and default cluster. Server now retains the bindings path.
  Profiles are names, not secrets. Catalog test + module doc updated.
- src-tauri: `fleet_config` bridge command (mirrors runtime_context).
- console: FleetConfig view-model + Source method (Tauri + Mock fixture); a pure
  `fleetConfigHtml` renderer (one switchable button per fleet, empty state shows
  where to add bindings). Clicking a fleet re-points every read (roster +
  identity) at its cluster — the ADR "switch" step, which through oab-mcp's
  per-cluster binding changes the managing credential. 7 new render tests.

Slice A (view) + B (switch) of the config panel. Editing (write-back to
fleets.toml) is slice C, stacked on this.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 console/index.html         |  1 +
 console/src/fixtures.ts    | 27 ++++++++++++++-
 console/src/main.ts        | 56 ++++++++++++++++++++++++++----
 console/src/render.test.ts | 62 +++++++++++++++++++++++++++++++--
 console/src/render.ts      | 64 +++++++++++++++++++++++++++++++++-
 console/src/source.ts      | 15 ++++++--
 console/src/styles.css     | 71 ++++++++++++++++++++++++++++++++++++++
 console/src/types.ts       | 21 +++++++++++
 crates/oab-mcp/src/main.rs | 51 ++++++++++++++++++++++++---
 src-tauri/src/lib.rs       | 22 ++++++++++++
 10 files changed, 373 insertions(+), 17 deletions(-)

diff --git a/console/index.html b/console/index.html
index a737b15..ad8254e 100644
--- a/console/index.html
+++ b/console/index.html
@@ -18,6 +18,7 @@
       </div>
     </header>
     <main class="content">
+      <section id="config" class="config-wrap"></section>
       <section id="identity" class="identity-wrap"></section>
       <section class="logs">
         <nav class="tabs" id="tabs">
diff --git a/console/src/fixtures.ts b/console/src/fixtures.ts
index b71cfbf..9bfbca7 100644
--- a/console/src/fixtures.ts
+++ b/console/src/fixtures.ts
@@ -1,4 +1,4 @@
-import type { Deployment, RuntimeContext } from "./types";
+import type { Deployment, FleetConfig, RuntimeContext } from "./types";
 
 // Stand-in data so the console renders without a live core. Mirrors the shape
 // studio-cp's `deploy_list` / `deploy_get` return. Swapped for the Tauri source
@@ -59,3 +59,28 @@ export const FIXTURE_RUNTIME_CONTEXT: RuntimeContext = {
   expected_principal: "arn:aws:iam::504190915686:role/openab-orca-task-role",
   identity_matches: true,
 };
+
+// Stand-in fleet-binding config so the browser build renders the config panel
+// without a core. Two fleets on different accounts — the shape the panel lets
+// the operator switch between.
+export const FIXTURE_FLEET_CONFIG: FleetConfig = {
+  path: "~/.config/oab-studio/fleets.toml",
+  default_cluster: "oab",
+  fleets: [
+    {
+      name: "prod",
+      cluster: "oab",
+      region: "ap-east-2",
+      profile: "orca-prod",
+      expected_principal:
+        "arn:aws:iam::504190915686:role/openab-orca-task-role",
+    },
+    {
+      name: "staging",
+      cluster: "oab-staging",
+      region: "ap-southeast-1",
+      profile: "orca-staging",
+      expected_principal: null,
+    },
+  ],
+};
diff --git a/console/src/main.ts b/console/src/main.ts
index 9be421a..b6eea23 100644
--- a/console/src/main.ts
+++ b/console/src/main.ts
@@ -1,12 +1,20 @@
 import { defaultSource } from "./source";
-import { renderRoster, renderIdentity } from "./render";
+import { renderRoster, renderIdentity, renderFleetConfig } from "./render";
+import type { FleetConfig } from "./types";
 import { createPane, bindBackend, type Level } from "./log";
 
 const POLL_MS = 5000;
-const CLUSTER = "oab";
+const DEFAULT_CLUSTER = "oab";
+
+// The active fleet's cluster drives every read (roster + identity) and, through
+// oab-mcp's per-cluster binding, which credential/account we manage as. Selecting
+// a fleet in the config panel is the "switch" step of the ADR #19 loop.
+let activeCluster = DEFAULT_CLUSTER;
+let fleetConfig: FleetConfig | null = null;
 
 const roster = document.getElementById("roster");
 const identityEl = document.getElementById("identity");
+const configEl = document.getElementById("config");
 const clusterLabel = document.getElementById("cluster-label");
 const pollStatus = document.getElementById("poll-status");
 const logEl = document.getElementById("log");
@@ -67,7 +75,7 @@ let lastError = "";
 async function tick(): Promise<void> {
   if (!roster) return;
   try {
-    const deployments = await source.listDeployments(CLUSTER);
+    const deployments = await source.listDeployments(activeCluster);
     renderRoster(roster, deployments);
     if (lastError) {
       note("info", `roster recovered — ${deployments.length} deployment(s)`);
@@ -96,13 +104,48 @@ async function tick(): Promise<void> {
 async function refreshIdentity(): Promise<void> {
   if (!identityEl) return;
   try {
-    renderIdentity(identityEl, await source.runtimeContext(CLUSTER));
+    renderIdentity(identityEl, await source.runtimeContext(activeCluster));
   } catch (e) {
     note("error", `identity: ${errText(e)}`);
     renderIdentity(identityEl, null);
   }
 }
 
+// The fleet-binding config panel (ADR #19 "declare"). Fetched once on boot; the
+// bindings are read at core startup, so they don't change under us at runtime.
+async function refreshConfig(): Promise<void> {
+  if (!configEl) return;
+  try {
+    fleetConfig = await source.fleetConfig();
+    renderFleetConfig(configEl, fleetConfig, activeCluster);
+  } catch (e) {
+    note("error", `fleet config: ${errText(e)}`);
+    fleetConfig = null;
+    renderFleetConfig(configEl, null, activeCluster);
+  }
+}
+
+// Switch the active fleet: re-point every read at its cluster (and thus its
+// bound credential) and refresh immediately, so "switch fleet" == "switch
+// managing account" the ADR calls for. No-op if it's already active.
+function selectCluster(cluster: string): void {
+  if (!cluster || cluster === activeCluster) return;
+  activeCluster = cluster;
+  if (clusterLabel) clusterLabel.textContent = activeCluster;
+  note("info", `switched to cluster "${activeCluster}"`);
+  if (configEl) renderFleetConfig(configEl, fleetConfig, activeCluster);
+  void refreshIdentity();
+  void tick();
+}
+
+// One delegated listener: a click on any fleet button switches to its cluster.
+if (configEl) {
+  configEl.addEventListener("click", (ev) => {
+    const btn = (ev.target as HTMLElement).closest<HTMLElement>("[data-cluster]");
+    if (btn?.dataset.cluster) selectCluster(btn.dataset.cluster);
+  });
+}
+
 // The Tauri command bridge — present only inside the desktop shell (the browser
 // build has no `__TAURI__`, so callers no-op / hide their UI).
 type Invoke = <T>(cmd: string, args?: Record<string, unknown>) => Promise<T>;
@@ -188,10 +231,11 @@ function setupUpdater(): void {
 async function boot(): Promise<void> {
   note("info", `OAB Studio ${BUILD} (built ${__BUILD_TIME__})`);
   if (activity && mcp) await bindBackend(activity, mcp);
-  if (clusterLabel) clusterLabel.textContent = CLUSTER;
-  note("info", `polling cluster "${CLUSTER}" every ${POLL_MS / 1000}s`);
+  if (clusterLabel) clusterLabel.textContent = activeCluster;
+  note("info", `polling cluster "${activeCluster}" every ${POLL_MS / 1000}s`);
   setupUpdater();
   await startCore();
+  void refreshConfig();
   void refreshIdentity();
   void tick();
   window.setInterval(() => void tick(), POLL_MS);
diff --git a/console/src/render.test.ts b/console/src/render.test.ts
index e4f062f..b0fcc23 100644
--- a/console/src/render.test.ts
+++ b/console/src/render.test.ts
@@ -1,6 +1,10 @@
 import { describe, it, expect } from "vitest";
-import { rosterHtml, identityHtml } from "./render";
-import { FIXTURE_DEPLOYMENTS, FIXTURE_RUNTIME_CONTEXT } from "./fixtures";
+import { rosterHtml, identityHtml, fleetConfigHtml } from "./render";
+import {
+  FIXTURE_DEPLOYMENTS,
+  FIXTURE_FLEET_CONFIG,
+  FIXTURE_RUNTIME_CONTEXT,
+} from "./fixtures";
 import { AGENT_STATES, type Deployment, type RuntimeContext } from "./types";
 
 function ctx(partial: Partial<RuntimeContext>): RuntimeContext {
@@ -116,3 +120,57 @@ describe("identityHtml", () => {
     expect(html).not.toContain("<script>");
   });
 });
+
+describe("fleetConfigHtml", () => {
+  it("renders one switchable button per configured fleet", () => {
+    const html = fleetConfigHtml(FIXTURE_FLEET_CONFIG, "oab");
+    const buttons = html.match(/class="cfg-fleet/g) ?? [];
+    expect(buttons.length).toBe(FIXTURE_FLEET_CONFIG.fleets.length);
+    expect(html).toContain('data-cluster="oab"');
+    expect(html).toContain('data-cluster="oab-staging"');
+  });
+
+  it("marks the active cluster and no other", () => {
+    const html = fleetConfigHtml(FIXTURE_FLEET_CONFIG, "oab-staging");
+    const active = html.match(/cfg-fleet is-active/g) ?? [];
+    expect(active.length).toBe(1);
+    // the active button is the staging one
+    const idx = html.indexOf("oab-staging");
+    expect(html.lastIndexOf("is-active", idx)).toBeGreaterThan(-1);
+  });
+
+  it("shows the profile and region as the credential line", () => {
+    const html = fleetConfigHtml(FIXTURE_FLEET_CONFIG, "oab");
+    expect(html).toContain("orca-prod");
+    expect(html).toContain("ap-east-2");
+  });
+
+  it("falls back to 'default chain' when a fleet has no profile", () => {
+    const cfg = structuredClone(FIXTURE_FLEET_CONFIG);
+    cfg.fleets[0].profile = null;
+    cfg.fleets[0].region = null;
+    expect(fleetConfigHtml(cfg, "oab")).toContain("default chain");
+  });
+
+  it("renders an empty state with the config path when no fleets", () => {
+    const html = fleetConfigHtml(
+      { path: "~/.config/oab-studio/fleets.toml", default_cluster: "oab", fleets: [] },
+      "oab",
+    );
+    expect(html).toContain("No fleets configured");
+    expect(html).toContain("fleets.toml");
+    expect(html).not.toContain("cfg-fleet");
+  });
+
+  it("renders an unavailable state for null", () => {
+    expect(fleetConfigHtml(null, "oab")).toContain("fleet config unavailable");
+  });
+
+  it("escapes fleet fields", () => {
+    const cfg = structuredClone(FIXTURE_FLEET_CONFIG);
+    cfg.fleets[0].name = "<x>";
+    const html = fleetConfigHtml(cfg, "oab");
+    expect(html).toContain("&lt;x&gt;");
+    expect(html).not.toContain("<x>");
+  });
+});
diff --git a/console/src/render.ts b/console/src/render.ts
index 1df2fce..3821aaa 100644
--- a/console/src/render.ts
+++ b/console/src/render.ts
@@ -1,4 +1,9 @@
-import type { AgentState, Deployment, RuntimeContext } from "./types";
+import type {
+  AgentState,
+  Deployment,
+  FleetConfig,
+  RuntimeContext,
+} from "./types";
 
 const STATE_CLASS: Record<AgentState, string> = {
   Starting: "s-starting",
@@ -113,3 +118,60 @@ export function identityHtml(ctx: RuntimeContext | null): string {
 export function renderIdentity(el: HTMLElement, ctx: RuntimeContext | null): void {
   el.innerHTML = identityHtml(ctx);
 }
+
+// ---- Fleet config panel (ADR #19: the "declare" side) ------------------------
+
+function credLine(f: FleetConfig["fleets"][number]): string {
+  // Profile-first (assume-role is later work); region pins the fleet's location.
+  const parts = [f.profile ?? "default chain", f.region].filter(
+    (p): p is string => Boolean(p),
+  );
+  return parts.map(escapeHtml).join(" · ");
+}
+
+function fleetButton(
+  f: FleetConfig["fleets"][number],
+  activeCluster: string,
+): string {
+  const active = f.cluster === activeCluster;
+  const cls = active ? "cfg-fleet is-active" : "cfg-fleet";
+  return `<button class="${cls}" type="button" data-cluster="${escapeHtml(f.cluster)}" aria-pressed="${active}">
+      <span class="cfg-name">${escapeHtml(f.name || f.cluster)}</span>
+      <span class="cfg-cluster">${escapeHtml(f.cluster)}</span>
+      <span class="cfg-cred">${credLine(f)}</span>
+    </button>`;
+}
+
+// Pure: the fleet-binding config -> the config panel HTML. Each fleet is a
+// button that switches the active cluster (the "switch" step). `activeCluster`
+// marks which one is currently selected. An empty config still renders — it
+// shows where to add bindings, which is exactly the "no panel for config" gap.
+export function fleetConfigHtml(
+  cfg: FleetConfig | null,
+  activeCluster: string,
+): string {
+  if (!cfg) {
+    return `<div class="config"><span class="muted">fleet config unavailable</span></div>`;
+  }
+  const path = cfg.path
+    ? `<span class="cfg-path" title="edit this file to configure fleets"><code>${escapeHtml(cfg.path)}</code></span>`
+    : "";
+  const body = cfg.fleets.length
+    ? `<div class="cfg-list">${cfg.fleets.map((f) => fleetButton(f, activeCluster)).join("")}</div>`
+    : `<p class="cfg-empty">No fleets configured — add <code>[[fleet]]</code> entries to the config file above. Managing <code>${escapeHtml(cfg.default_cluster)}</code> via the default credential chain.</p>`;
+  return `<div class="config">
+      <div class="cfg-head">
+        <span class="cfg-label">fleets</span>
+        ${path}
+      </div>
+      ${body}
+    </div>`;
+}
+
+export function renderFleetConfig(
+  el: HTMLElement,
+  cfg: FleetConfig | null,
+  activeCluster: string,
+): void {
+  el.innerHTML = fleetConfigHtml(cfg, activeCluster);
+}
diff --git a/console/src/source.ts b/console/src/source.ts
index 3f66715..f5d80eb 100644
--- a/console/src/source.ts
+++ b/console/src/source.ts
@@ -1,11 +1,16 @@
-import type { Deployment, RuntimeContext } from "./types";
-import { FIXTURE_DEPLOYMENTS, FIXTURE_RUNTIME_CONTEXT } from "./fixtures";
+import type { Deployment, FleetConfig, RuntimeContext } from "./types";
+import {
+  FIXTURE_DEPLOYMENTS,
+  FIXTURE_FLEET_CONFIG,
+  FIXTURE_RUNTIME_CONTEXT,
+} from "./fixtures";
 
 // A read source for the console. Desktop (Tauri → studio-cp) and the standalone
 // browser build implement this identically, so the UI never knows which it is.
 export interface Source {
   listDeployments(cluster?: string): Promise<Deployment[]>;
   runtimeContext(cluster?: string): Promise<RuntimeContext>;
+  fleetConfig(): Promise<FleetConfig>;
 }
 
 // Fixture-backed source for the standalone / browser build — no core required.
@@ -16,6 +21,9 @@ export class MockSource implements Source {
   async runtimeContext(): Promise<RuntimeContext> {
     return structuredClone(FIXTURE_RUNTIME_CONTEXT);
   }
+  async fleetConfig(): Promise<FleetConfig> {
+    return structuredClone(FIXTURE_FLEET_CONFIG);
+  }
 }
 
 // Minimal shape of the Tauri global bridge (v2, `withGlobalTauri`). Accessed via
@@ -43,6 +51,9 @@ export class TauriSource implements Source {
   async runtimeContext(cluster?: string): Promise<RuntimeContext> {
     return this.invoke()<RuntimeContext>("runtime_context", { cluster });
   }
+  async fleetConfig(): Promise<FleetConfig> {
+    return this.invoke()<FleetConfig>("fleet_config");
+  }
 }
 
 // Pick a source: Tauri when running inside the shell, else the mock.
diff --git a/console/src/styles.css b/console/src/styles.css
index 1f726fc..9d0a1d5 100644
--- a/console/src/styles.css
+++ b/console/src/styles.css
@@ -354,3 +354,74 @@ td.counts.warn {
   margin-top: 8px;
   color: var(--ok);
 }
+
+/* ---- Fleet config panel (ADR #19: the "declare" side) ---- */
+.config-wrap {
+  margin: 0 0 12px;
+}
+.config {
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  background: var(--panel);
+  padding: 10px 12px;
+  font-size: 13px;
+}
+.cfg-head {
+  display: flex;
+  align-items: baseline;
+  gap: 10px;
+  margin-bottom: 8px;
+}
+.cfg-label {
+  color: var(--muted);
+  text-transform: uppercase;
+  font-size: 11px;
+  letter-spacing: 0.04em;
+}
+.cfg-path {
+  color: var(--muted);
+  font-size: 12px;
+  overflow-wrap: anywhere;
+}
+.cfg-list {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
+  gap: 8px;
+}
+.cfg-fleet {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  text-align: left;
+  cursor: pointer;
+  border: 1px solid var(--border);
+  border-left: 3px solid var(--border);
+  border-radius: 5px;
+  background: var(--bg);
+  color: var(--text);
+  padding: 8px 10px;
+  font: inherit;
+}
+.cfg-fleet:hover {
+  border-color: var(--s-starting);
+}
+.cfg-fleet.is-active {
+  border-left-color: var(--s-starting);
+  box-shadow: inset 0 0 0 1px var(--s-starting);
+}
+.cfg-name {
+  font-weight: 600;
+}
+.cfg-cluster {
+  color: var(--muted);
+  font-size: 12px;
+}
+.cfg-cred {
+  color: var(--muted);
+  font-size: 12px;
+  overflow-wrap: anywhere;
+}
+.cfg-empty {
+  color: var(--muted);
+  margin: 0;
+}
diff --git a/console/src/types.ts b/console/src/types.ts
index 51ff090..41b7d4a 100644
--- a/console/src/types.ts
+++ b/console/src/types.ts
@@ -43,6 +43,27 @@ export interface FleetBinding {
   expected_principal: string | null;
 }
 
+// One configured fleet → managing-credential binding — mirrors an entry of
+// oab-mcp's `fleet_config` tool (ADR #19). `cluster` is the switch key: selecting
+// a fleet makes subsequent calls target its cluster (and thus its credential).
+export interface FleetConfigEntry {
+  name: string;
+  cluster: string;
+  region: string | null;
+  profile: string | null;
+  expected_principal: string | null;
+}
+
+// The declarative fleet-binding config — mirrors oab-mcp's `fleet_config` tool
+// (ADR #19). `path` is the file the bindings load from (so the panel can show
+// where to edit them); `default_cluster` is the fallback target when no fleet is
+// selected.
+export interface FleetConfig {
+  path: string | null;
+  default_cluster: string;
+  fleets: FleetConfigEntry[];
+}
+
 // The effective runtime identity/context the control plane resolved for a
 // cluster — mirrors oab-mcp's `runtime_context` tool (ADR #19). `identity_matches`
 // is `null` when the binding declares no `expected_principal`.
diff --git a/crates/oab-mcp/src/main.rs b/crates/oab-mcp/src/main.rs
index 1d02881..1957004 100644
--- a/crates/oab-mcp/src/main.rs
+++ b/crates/oab-mcp/src/main.rs
@@ -6,7 +6,7 @@
 //! first-class client:
 //!
 //! - read: `deploy_list`, `deploy_get`, `get_agent_states`, `deploy_events`,
-//!   `runtime_context`
+//!   `runtime_context`, `fleet_config`
 //! - write: `deploy_apply`, `deploy_scale`, `deploy_delete`
 //!
 //! Every tool is a thin dispatch into `studio-cp`; this crate owns only the
@@ -37,6 +37,9 @@ struct OabMcp {
     /// Declarative fleet → managing-credential bindings (ADR: Per-Fleet
     /// managing identity).
     bindings: Arc<scp::FleetBindings>,
+    /// Where the bindings were loaded from (surfaced by `fleet_config` so the
+    /// operator knows which file to edit); `None` when no config dir resolved.
+    bindings_path: Option<String>,
     /// Per-cluster resolved configs, memoized so a binding is resolved once.
     resolved: Arc<Mutex<HashMap<String, aws_config::SdkConfig>>>,
 }
@@ -49,7 +52,7 @@ const INSTRUCTIONS: &str = "OAB Studio control plane. Observe deployments and \
 per-instance lifecycle states (6-state model), and drive writes (apply a \
 manifest, scale, delete). Reads are safe; writes mutate live ECS services.";
 
-/// The seven-tool read/write surface. Argument shapes are plain JSON Schema.
+/// The read/write tool surface. Argument shapes are plain JSON Schema.
 fn tools() -> Vec<Tool> {
     vec![
         Tool::new(
@@ -150,6 +153,14 @@ fn tools() -> Vec<Tool> {
                 }
             })),
         ),
+        Tool::new(
+            "fleet_config",
+            "List the configured per-fleet managing-credential bindings (ADR: Per-Fleet managing identity): each fleet's name, target cluster, AWS profile and region, and expected_principal, plus the config file path they load from and the server's default cluster. Read-only; the declarative 'declare' side of the config→switch→observe→reconcile loop. Profiles are names, not secrets.",
+            as_map(json!({
+                "type": "object",
+                "properties": {}
+            })),
+        ),
     ]
 }
 
@@ -388,6 +399,32 @@ impl OabMcp {
         }))
     }
 
+    /// The declarative fleet-binding config, read-only: which credential manages
+    /// which fleet/cluster, plus the file it loads from and the default cluster.
+    /// The `declare` side of the loop — what a config panel renders and switches
+    /// between. Profiles are names, never secret material.
+    fn t_fleet_config(&self, _args: &Map<String, Value>) -> Result<Value> {
+        let fleets: Vec<Value> = self
+            .bindings
+            .fleets
+            .iter()
+            .map(|b| {
+                json!({
+                    "name": b.name,
+                    "cluster": b.cluster,
+                    "region": b.region,
+                    "profile": b.profile,
+                    "expected_principal": b.expected_principal,
+                })
+            })
+            .collect();
+        Ok(json!({
+            "path": self.bindings_path,
+            "default_cluster": self.default_cluster,
+            "fleets": fleets,
+        }))
+    }
+
     async fn t_delete(&self, args: &Map<String, Value>) -> Result<Value> {
         let cluster = self.cluster(args);
         let resource = args
@@ -454,6 +491,7 @@ impl ServerHandler for OabMcp {
             "deploy_scale" => self.t_scale(args).await,
             "deploy_delete" => self.t_delete(args).await,
             "runtime_context" => self.t_runtime_context(args).await,
+            "fleet_config" => self.t_fleet_config(args),
             other => {
                 return Err(McpError::invalid_params(
                     format!("unknown tool {other:?}"),
@@ -476,8 +514,9 @@ async fn main() -> anyhow::Result<()> {
     let default_cluster = std::env::var("OAB_CLUSTER").unwrap_or_else(|_| "oab".to_string());
     // Fleet → managing-credential bindings are strictly opt-in: a missing file
     // yields an empty set. Warn on stderr only (stdout is the MCP JSON-RPC wire).
-    let bindings = match scp::default_bindings_path() {
-        Some(path) => scp::load_bindings(&path).unwrap_or_else(|e| {
+    let bindings_path = scp::default_bindings_path();
+    let bindings = match &bindings_path {
+        Some(path) => scp::load_bindings(path).unwrap_or_else(|e| {
             eprintln!(
                 "warning: failed to load fleet bindings from {}: {e:#}",
                 path.display()
@@ -490,6 +529,7 @@ async fn main() -> anyhow::Result<()> {
         aws,
         default_cluster,
         bindings: Arc::new(bindings),
+        bindings_path: bindings_path.map(|p| p.display().to_string()),
         resolved: Arc::new(Mutex::new(HashMap::new())),
     };
     let service = server.serve(rmcp::transport::stdio()).await?;
@@ -510,7 +550,7 @@ mod tests {
             .iter()
             .map(|t| t["name"].as_str().expect("tool has a name").to_string())
             .collect();
-        assert_eq!(names.len(), 8);
+        assert_eq!(names.len(), 9);
         for expected in [
             "deploy_list",
             "deploy_get",
@@ -520,6 +560,7 @@ mod tests {
             "deploy_scale",
             "deploy_delete",
             "runtime_context",
+            "fleet_config",
         ] {
             assert!(names.contains(&expected.to_string()), "missing {expected}");
         }
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 881aeaf..726c5bf 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -124,6 +124,27 @@ async fn runtime_context(
     }
 }
 
+/// Bridge command: the declarative fleet-binding config (ADR #19), sourced
+/// through the bundled `oab-mcp` sidecar's `fleet_config` tool. The console
+/// renders the configured fleets and lets the operator switch the active one.
+#[tauri::command]
+async fn fleet_config(core: tauri::State<'_, Core>) -> Result<Value, String> {
+    let client = {
+        let guard = core.0.lock().await;
+        guard
+            .as_ref()
+            .cloned()
+            .ok_or_else(|| "core not started yet".to_string())?
+    };
+    match client.call_tool("fleet_config", json!({})).await {
+        Ok(v) => Ok(v),
+        Err(e) => {
+            client.log("error", &format!("fleet_config: {e}"));
+            Err(e)
+        }
+    }
+}
+
 /// What the frontend needs to render the "update available" state: the version
 /// on the release vs. what's running, plus the release notes.
 #[derive(serde::Serialize)]
@@ -192,6 +213,7 @@ pub fn run() {
             start_core,
             deploy_list,
             runtime_context,
+            fleet_config,
             check_update,
             install_update
         ])