redhat-developer · gabemontero · Jul 13, 2026 · Jul 8, 2026 · Jul 8, 2026 · Jul 13, 2026
@@ -0,0 +1,84 @@
+# RHDHPLAN-1507 Frontend Coverage Analysis
+
+> **Date:** 2026-07-17
+> **Feature:** AI Asset Entity Model & Ingestion Framework
+> **Cross-referenced against:** RHDHPLAN-1509 (AI Catalog Discovery UI)
+
+## Feature Structure
+
+| Level   | Key           | Summary                                         | Status      |
+| ------- | ------------- | ----------------------------------------------- | ----------- |
+| Feature | RHDHPLAN-1507 | AI Asset Entity Model & Ingestion Framework     | In Progress |
+| Epic    | RHIDP-15258   | Entity-Provider SDK Package with Typed Contract | New         |
+| Epic    | RHIDP-15294   | OCI Skill Registry Ingestion Framework          | New         |
+| Epic    | RHIDP-15295   | Neo4j Knowledge Graph Sync Adapter              | New         |
+
+### Stories by Epic
+
+**RHIDP-15258 (SDK):** RHIDP-15255, 15259, 15260, 15262, 15302, 15303 (6 stories, all New)
+**RHIDP-15294 (OCI Skill Registry):** RHIDP-15268, 15296, 15297, 15298 (4 stories, all New)
+**RHIDP-15295 (Neo4j Sync):** RHIDP-15299, 15300, 15301 (3 stories, all New)
+
+## RHDHPLAN-1509 Structure (Cross-Reference)
+
+| Level   | Key           | Summary                                                 | Status      |
+| ------- | ------------- | ------------------------------------------------------- | ----------- |
+| Feature | RHDHPLAN-1509 | AI Catalog Discovery UI — Browse, Search & Detail Pages | New         |
+| Epic    | RHIDP-15164   | [Agentic] AI Catalog Frontend Plugin                    | In Progress |
+| Story   | RHIDP-15165   | Plugin scaffold and dev app                             | **Closed**  |
+| Story   | RHIDP-15166   | Browse page with search and filters                     | **Closed**  |
+| Story   | RHIDP-15167   | Entity page extensions and adoption actions             | New         |
+| Story   | RHIDP-15449   | Extensible browse filters via NFS                       | Review      |
+| Story   | RHIDP-15479   | Add translations for supported languages                | New         |
+| Story   | RHIDP-15480   | E2E tests with Playwright                               | New         |
+| Story   | RHIDP-15481   | Dynamic plugin export and overlay registration          | New         |
+
+## 1) Frontend Needs Covered by RHDHPLAN-1509
+
+RHDHPLAN-1507's feature description explicitly states: _"no new top-level navigation is required for this Feature (the dedicated AI Catalog UI is delivered in RHDHPLAN-1509)"_ and out-of-scope says _"Any user-facing AI Catalog browse/search/detail UI beyond what the existing generic Software Catalog UI already renders for Resource/Component entities — delivered in RHDHPLAN-1509."_
+
+All RHDHPLAN-1507 acceptance criteria with frontend aspects map to existing RHDHPLAN-1509 stories:
+
+| RHDHPLAN-1507 Acceptance Criteria (frontend aspect)        | RHDHPLAN-1509 Coverage                  | Status          |
+| ---------------------------------------------------------- | --------------------------------------- | --------------- |
+| AI assets browsable with card grid, grouped by category    | RHIDP-15166 (Browse page)               | Closed          |
+| Filter by category, source connector, tags                 | RHIDP-15166 + RHIDP-15449 (NFS filters) | Closed / Review |
+| Detail page: name, description, category, source, versions | RHIDP-15167 (Entity page extensions)    | New             |
+| "How to use this" panel with TechDocs rendering            | RHIDP-15167                             | New             |
+| Skill spec body fetchable on demand via OCI annotation     | RHIDP-15167 (entity page extensions)    | New             |
+| Global/federated search includes AI assets                 | RHIDP-15166                             | Closed          |
+| RBAC visibility enforcement in UI                          | RHIDP-15164 (consumes RHDHPLAN-1508)    | In Progress     |
+| Dynamic plugin export                                      | RHIDP-15481                             | New             |
+| Theming, accessibility, air-gapped UI, empty/error states  | RHIDP-15164 (baseline)                  | In Progress     |
+
+## 2) Frontend Needs NOT Covered by RHDHPLAN-1509
+
+**None identified.**
+
+RHDHPLAN-1507 is purely entity model + backend SDK + ingestion framework. All three epics are backend-only:
+
+- **RHIDP-15258 (SDK):** TypeScript interfaces, annotation validation, delta sync abstractions, Neo4j adapter interface, skillcard.yaml validation — no frontend
+- **RHIDP-15294 (OCI Skill Registry):** OCI artifact fetching, skillcard parsing, multi-registry config, digest-based sync — no frontend
+- **RHIDP-15295 (Neo4j Sync):** Relationship mapping, SkillBundle nodes, graph sync — no frontend
+
+The standard Backstage catalog UI renders AI entities out of the box since they use existing entity kinds (Resource, Component, AIResource). Everything beyond basic catalog visibility is RHDHPLAN-1509's scope.
+
+## 3) Uncovered RHIDP Jiras / OpenSpec Changes
+
+N/A — category 2 is empty, so no gaps to fill.
+
+## OpenSpec Changes on This Branch Related to RHDHPLAN-1507
+
+The following openspec changes relate to RHDHPLAN-1507 and are all backend-only (no frontend specs):
+
+| OpenSpec Change             | Related Epic                                        |
+| --------------------------- | --------------------------------------------------- |
+| `ai-catalog-entity-model`   | RHIDP-15258 (SDK)                                   |
+| `oci-skill-registry`        | RHIDP-15294 (OCI Skill Registry)                    |
+| `oci-skill-connector`       | RHIDP-15294 (absorbed RHIDP-15315)                  |
+| `neo4j-knowledge-graph`     | RHIDP-15295 (Neo4j Sync)                            |
+| `upstream-schema-alignment` | RHIDP-15334 (RHDHPLAN-1513, cross-refs RHIDP-15258) |
+
+## Summary
+
+RHDHPLAN-1507 is the cleanest feature from a frontend perspective — it has zero frontend work of its own, and all UI needs are fully covered by RHDHPLAN-1509's existing epic (RHIDP-15164) and its stories. No additional RHIDP stories or openspec changes are needed for frontend coverage.
@@ -0,0 +1,121 @@
+# RHDHPLAN-1508 Frontend Coverage Analysis
+
+> **Date:** 2026-07-17
+> **Feature:** AI Catalog RBAC & Versioning Policy Model
+> **Cross-referenced against:** RHDHPLAN-1509 (AI Catalog Discovery UI)
+
+## Feature Structure
+
+| Level   | Key           | Summary                                                | Status      |
+| ------- | ------------- | ------------------------------------------------------ | ----------- |
+| Feature | RHDHPLAN-1508 | AI Catalog RBAC & Versioning Policy Model              | In Progress |
+| Epic    | RHIDP-15270   | AI Catalog Graduated Visibility Permissions            | New         |
+| Epic    | RHIDP-15274   | Version-Level Policy Cascade for AI Catalog Assets     | New         |
+| Epic    | RHIDP-15277   | AI Catalog RBAC Audit Logging                          | New         |
+| Epic    | RHIDP-15304   | RBAC Admin UI Section for AI Catalog Policy Management | New         |
+
+### Stories by Epic
+
+**RHIDP-15270 (Graduated Visibility):**
+| Key | Summary | Frontend? |
+|---|---|---|
+| RHIDP-15271 | Define and register `ai-catalog.asset.read` permission | No (backend) |
+| RHIDP-15272 | Define `ai-catalog.asset.read.usage-docs` with field-level filtering | No (backend) |
+| RHIDP-15273 | **Frontend graduated visibility with RequirePermission gating** | **Yes** |
+| RHIDP-15306 | Define and register `ai-catalog.admin` permission | No (backend) |
+| RHIDP-15310 | Backend read-time RBAC filtering for SkillBundle skill lists | No (backend, UX messaging absorbed into RHIDP-15273) |
+| RHIDP-15312 | Per-category and per-connector conditional policy backend support | No (backend) |
+
+**RHIDP-15274 (Version-Level Policy Cascade):**
+| Key | Summary | Frontend? |
+|---|---|---|
+| RHIDP-15275 | Implement asset-level to version-level policy evaluation and cascade logic | No (backend) |
+
+**RHIDP-15277 (Audit Logging):**
+| Key | Summary | Frontend? |
+|---|---|---|
+| RHIDP-15279 | Emit audit events for RBAC policy changes on AI catalog assets | No (backend) |
+| RHIDP-15280 | Emit audit events for entity provider ingestion sync cycles | No (backend) |
+
+**RHIDP-15304 (RBAC Admin UI):**
+| Key | Summary | Frontend? |
+|---|---|---|
+| RHIDP-15307 | **AI Catalog Policy Dashboard in RBAC Admin UI** | **Yes** |
+| RHIDP-15308 | **Category and Connector Policy Editor in RBAC Admin UI** | **Yes** |
+| RHIDP-15309 | **Default Posture Configuration UI for AI Catalog** | **Yes** |
+
+## 1) Frontend Needs Covered by RHDHPLAN-1509
+
+RHDHPLAN-1509's feature acceptance criteria state: _"All visibility enforcement (browse list, search results including global search, and detail page direct navigation by URL/entity reference) consistently applies the RBAC policies defined by RHDHPLAN-1508."_
+
+This covers the **binary entity visibility** layer — i.e., when a user is denied `ai-catalog.asset.read`, the entity is hidden from browse, search, and direct URL access:
+
+| RHDHPLAN-1508 AC (frontend aspect)                                                         | RHDHPLAN-1509 Coverage    | Status      |
+| ------------------------------------------------------------------------------------------ | ------------------------- | ----------- |
+| Entity hidden from browse/search when `ai-catalog.asset.read` denied                       | RHIDP-15166 (Browse page) | Closed      |
+| Entity hidden from direct URL when `ai-catalog.asset.read` denied                          | RHIDP-15167 (Entity page) | New         |
+| No-leakage guarantee (no distinguishable errors between "doesn't exist" and "not visible") | RHIDP-15164 (baseline)    | In Progress |
+
+## 2) Frontend Needs NOT Covered by RHDHPLAN-1509
+
+RHDHPLAN-1508 has **4 frontend stories** across 2 epics that are its own deliverables, not part of RHDHPLAN-1509:
+
+### A. Graduated Visibility UI (RHIDP-15273)
+
+**What:** `RequirePermission` gating on entity detail pages. Users with `ai-catalog.asset.read` but NOT `ai-catalog.asset.read.usage-docs` see the asset's name, category, description, owner, and version list, but usage/install instructions, configuration snippets, and connection endpoints are replaced with a "request access" / "contact owner" placeholder.
+
+**Why not in RHDHPLAN-1509:** RHDHPLAN-1509 only handles binary visibility (asset exists vs. hidden). The graduated tier-2 model (asset visible but sensitive fields redacted) is RHDHPLAN-1508's own concern. RHDHPLAN-1509 _renders_ the entity detail page (RHIDP-15167), but RHDHPLAN-1508 _gates_ specific sections of it (RHIDP-15273).
+
+**Also includes:** SkillBundle UX messaging (absorbed from closed RHIDP-15311) — when a bundle contains a mix of permitted and restricted skills, the UI communicates that some skills are filtered.
+
+### B. RBAC Admin UI for AI Catalog (RHIDP-15304, 3 stories)
+
+**What:** A standalone admin page at `/ai-catalog/admin/rbac` (a new frontend plugin page calling the RBAC REST API directly), accessible only to users with `ai-catalog.admin`. Three stories:
+
+| Story       | What it builds                                                                                                                                                                                     |
+| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| RHIDP-15307 | Policy Dashboard — summary view of all active AI Catalog policies grouped by category and connector                                                                                                |
+| RHIDP-15308 | Category and Connector Policy Editor — create/edit/delete conditional policies for `ai-catalog.asset.read` and `ai-catalog.asset.read.usage-docs` with category and connector filters, no raw YAML |
+| RHIDP-15309 | Default Posture Configuration — UI to set default-allow/deny per category and per connector                                                                                                        |
+
+**Why not in RHDHPLAN-1509:** RHDHPLAN-1509 is the discovery UI (browse, search, detail pages for developers). Admin RBAC management is a distinct concern. RHDHPLAN-1509's out-of-scope explicitly says: _"Defining or implementing the RBAC policy model itself (delivered by RHDHPLAN-1508); this feature only consumes and enforces the policies that RHDHPLAN-1508 provides."_
+
+**Feasibility note:** The upstream RBAC admin UI (`@backstage-community/plugin-rbac`) has no frontend extension points — no way to inject an "AI Catalog" tab. The standalone page pattern (calling RBAC REST API directly) follows the same approach as existing RHDH admin pages.
+
+## 3) Uncovered RHIDP Jiras / OpenSpec Changes
+
+All 4 frontend stories have RHIDP Jiras defined **and** have corresponding openspec changes on this branch:
+
+| Frontend Story                        | RHIDP Jira                | OpenSpec Change               | Spec                              |
+| ------------------------------------- | ------------------------- | ----------------------------- | --------------------------------- |
+| RHIDP-15273 (Graduated visibility UI) | Defined under RHIDP-15270 | `ai-catalog-asset-governance` | `specs/graduated-visibility/`     |
+| RHIDP-15273 (also)                    | "                         | `security-safety-governance`  | `specs/fine-grained-permissions/` |
+| RHIDP-15307 (Policy Dashboard)        | Defined under RHIDP-15304 | `ai-catalog-asset-governance` | `specs/rbac-admin-ui/`            |
+| RHIDP-15308 (Policy Editor)           | Defined under RHIDP-15304 | `ai-catalog-asset-governance` | `specs/rbac-admin-ui/`            |
+| RHIDP-15309 (Default Posture UI)      | Defined under RHIDP-15304 | `ai-catalog-asset-governance` | `specs/default-deny-config/`      |
+
+**No gaps found.** All RHDHPLAN-1508 frontend work has Jira coverage and openspec specifications.
+
+## OpenSpec Changes on This Branch Related to RHDHPLAN-1508
+
+| OpenSpec Change               | Related Epics                             | Frontend Specs?                                                |
+| ----------------------------- | ----------------------------------------- | -------------------------------------------------------------- |
+| `security-safety-governance`  | RHIDP-15270 (cross-refs)                  | `fine-grained-permissions` touches RHIDP-15273                 |
+| `ai-catalog-asset-governance` | RHIDP-15270, 15274, 15277, 15304          | `graduated-visibility`, `rbac-admin-ui`, `default-deny-config` |
+| `ingestion-audit-metrics`     | RHIDP-15277 (absorbed from RHDHPLAN-1513) | `audit-events` (backend only), `analytics-api` (backend only)  |
+
+## Summary
+
+RHDHPLAN-1508 has **4 frontend stories** that are NOT in RHDHPLAN-1509's scope:
+
+- **1 graduated visibility story** (RHIDP-15273) that adds `RequirePermission` gating to the entity detail page built by RHDHPLAN-1509
+- **3 admin UI stories** (RHIDP-15307, 15308, 15309) under a dedicated RBAC Admin UI epic (RHIDP-15304) that build a standalone policy management page
+
+All 4 stories have RHIDP Jira coverage and openspec specifications on this branch. No gaps.
+
+The relationship between RHDHPLAN-1508 and RHDHPLAN-1509 is clean:
+
+- **RHDHPLAN-1509** builds the entity detail page → RHIDP-15167
+- **RHDHPLAN-1508** gates sections of that page with permissions → RHIDP-15273
+- **RHDHPLAN-1509** enforces binary visibility (show/hide entity) in browse/search
+- **RHDHPLAN-1508** adds graduated visibility (show entity, hide sensitive fields) and admin management UI