feat(cloud-console): task listing, attempt history, CORS, and console SPA

Implements the cloud-console OpenSpec change: adds GET /v1/tasks (filterable,
bounded pagination, tasks:read) and GET /v1/tasks/{id}/attempts (404 on unknown
task) to the platform SDK, with matching CloudClient methods and a closed-by-
default CLOUD_CONSOLE_CORS_ORIGINS allow-list wired through CloudControlConfig.
Ships an independent Vue 3 + Vite SPA at cloud-console/ that authenticates with
an operator-supplied bearer token held in sessionStorage, renders tasks with
attempt history, device pool, host registry, and the plugin registry with a
registration form.

Backend test suite: 438 passed (-m "not integration"); cloud-console typecheck
and production build both succeed. PostgreSQL-backed repository tests and
manual end-to-end verification remain pending external infrastructure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_cloud_client.py

@@ -150,6 +150,8 @@ def test_client_applies_bearer_token_to_every_public_method(tmp_path) -> None:
 
     task_id = client.submit_task(goal="authenticated")["task_id"]
     assert client.get_task_status(task_id)["status"] == "queued"
+    assert client.list_tasks()["total"] == 1
+    assert client.get_task_attempts(task_id) == []
     assert client.list_devices() == []
     assert client.list_hosts() == []
     assert client.list_plugins() == []
@@ -164,6 +166,74 @@ def test_client_applies_bearer_token_to_every_public_method(tmp_path) -> None:
     )
 
 
+def test_client_list_tasks_and_get_attempts_match_direct_http(tmp_path) -> None:
+    from datetime import UTC, datetime
+
+    from core.models import Device
+
+    client, pool = _client_and_pool(tmp_path)
+    pool.sync_host_devices(
+        "host-a",
+        [Device(id="dev-a", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    first_id = client.submit_task(goal="first")["task_id"]
+    second_id = client.submit_task(goal="second")["task_id"]
+
+    # Drive one task through an attempt so get_task_attempts has data.
+    scheduler = TaskScheduler(pool, CloudStore(tmp_path / "cloud.sqlite3"), _config())
+    scheduler.assign()
+    task = scheduler.store.get_task(first_id)
+    if task is not None and task.status == "assigned":
+        scheduler.store.record_task_result(
+            task_id=first_id,
+            attempt=task.attempt_count,
+            lease_id=task.lease_id or "",
+            host_id=task.assigned_host_id or "",
+            status="failed",
+            failure_reason="boom",
+            terminal_result={"exit_code": 1},
+            completed_at=datetime.now(UTC),
+        )
+
+    # The TestClient is the HTTP boundary — issuing direct calls through it
+    # exercises the same FastAPI routes the client does, which is the parity
+    # contract platform-sdk already relies on.
+    http_client = client._http  # type: ignore[attr-defined]
+    direct_list = http_client.get(
+        client._url("/tasks"),  # type: ignore[attr-defined]
+        params={"limit": 50, "offset": 0},
+        headers=client._headers,  # type: ignore[attr-defined]
+    ).json()
+    direct_attempts = http_client.get(
+        f"{client._url('/tasks')}/{first_id}/attempts",  # type: ignore[attr-defined]
+        headers=client._headers,  # type: ignore[attr-defined]
+    ).json()
+
+    via_client = client.list_tasks()
+    assert via_client == direct_list
+    assert via_client["total"] == 2
+    # Most-recent-first: second (the newer) before first.
+    assert [item["id"] for item in via_client["items"]] == [second_id, first_id]
+
+    failed_only = client.list_tasks(status="failed")
+    assert failed_only["total"] == 1
+    assert failed_only["items"][0]["id"] == first_id
+
+    attempts = client.get_task_attempts(first_id)
+    assert attempts == direct_attempts
+    assert len(attempts) == 1
+    assert attempts[0]["status"] == "failed"
+    assert attempts[0]["failure_reason"] == "boom"
+
+
+def test_client_get_attempts_raises_for_unknown_task(tmp_path) -> None:
+    import httpx
+
+    client, _ = _client_and_pool(tmp_path)
+    with pytest.raises(httpx.HTTPStatusError):
+        client.get_task_attempts("does-not-exist")
+
+
 def test_client_raises_typed_authorization_error_without_exposing_token(
     tmp_path,
 ) -> None:

tests/test_cloud_repository_contract.py

@@ -73,6 +73,8 @@ def test_cloud_repository_exposes_crud_and_atomic_lease_operations() -> None:
         "list_devices",
         "enqueue_task",
         "get_task",
+        "list_tasks",
+        "count_tasks",
         "save_plugin",
         "assign_task",
         "claim_assignment",
@@ -453,6 +455,105 @@ def test_task_attempt_history_is_ordered_and_complete(database_url: str) -> None
         database.close()
 
 
+def test_list_tasks_returns_empty_when_repository_has_no_tasks(
+    database_url: str,
+) -> None:
+    database = CloudDatabase(database_url)
+    try:
+        assert database.repository.list_tasks() == []
+        assert database.repository.count_tasks() == 0
+        assert database.repository.list_tasks(status="queued") == []
+        assert database.repository.count_tasks(status="queued") == 0
+    finally:
+        database.close()
+
+
+def test_list_tasks_returns_most_recent_first_with_optional_status_filter(
+    database_url: str,
+) -> None:
+    database = CloudDatabase(database_url)
+    base = datetime(2026, 7, 12, 6, 0, tzinfo=UTC)
+    queued_ids = [_unique_id("list-task") for _ in range(2)]
+    failed_ids = [_unique_id("list-task") for _ in range(2)]
+
+    try:
+        for index, task_id in enumerate(queued_ids):
+            database.repository.enqueue_task(
+                ScheduledTask(
+                    id=task_id,
+                    goal="queued goal",
+                    workflow_definition_id=None,
+                    constraints=TaskConstraints(),
+                    status="queued",
+                    created_at=base + timedelta(seconds=index),
+                )
+            )
+        for index, task_id in enumerate(failed_ids):
+            database.repository.enqueue_task(
+                ScheduledTask(
+                    id=task_id,
+                    goal="failed goal",
+                    workflow_definition_id=None,
+                    constraints=TaskConstraints(),
+                    status="failed",
+                    failure_reason="boom",
+                    created_at=base + timedelta(seconds=10 + index),
+                )
+            )
+
+        unfiltered = database.repository.list_tasks()
+        assert [task.id for task in unfiltered] == (
+            list(reversed(failed_ids)) + list(reversed(queued_ids))
+        )
+        assert database.repository.count_tasks() == 4
+
+        queued = database.repository.list_tasks(status="queued")
+        assert [task.id for task in queued] == list(reversed(queued_ids))
+        assert all(task.status == "queued" for task in queued)
+        assert database.repository.count_tasks(status="queued") == 2
+
+        failed = database.repository.list_tasks(status="failed")
+        assert [task.id for task in failed] == list(reversed(failed_ids))
+        assert database.repository.count_tasks(status="failed") == 2
+
+        # A status with no matches returns an empty page and zero count.
+        assert database.repository.list_tasks(status="done") == []
+        assert database.repository.count_tasks(status="done") == 0
+    finally:
+        database.close()
+
+
+def test_list_tasks_pagination_bounds(database_url: str) -> None:
+    database = CloudDatabase(database_url)
+    base = datetime(2026, 7, 12, 7, 0, tzinfo=UTC)
+    task_ids = [_unique_id("page-task") for _ in range(4)]
+
+    try:
+        for index, task_id in enumerate(task_ids):
+            database.repository.enqueue_task(
+                ScheduledTask(
+                    id=task_id,
+                    goal=f"goal-{index}",
+                    workflow_definition_id=None,
+                    constraints=TaskConstraints(),
+                    created_at=base + timedelta(seconds=index),
+                )
+            )
+
+        # Most-recent-first ordering means page 1 returns the newest two ids.
+        page_one = database.repository.list_tasks(limit=2, offset=0)
+        assert [task.id for task in page_one] == [task_ids[3], task_ids[2]]
+
+        page_two = database.repository.list_tasks(limit=2, offset=2)
+        assert [task.id for task in page_two] == [task_ids[1], task_ids[0]]
+
+        # An offset past the end of the result set returns an empty page,
+        # not an error — the caller is expected to consult count_tasks().
+        assert database.repository.list_tasks(limit=10, offset=100) == []
+    finally:
+        database.close()
+
+
 def test_atomic_assignment_creates_lease_attempt_and_reservation(
     database_url: str,
 ) -> None:

tests/test_cloud_sdk_api.py

@@ -272,6 +272,8 @@ def test_submit_with_constraints(tmp_path) -> None:
     [
         ("post", "/v1/tasks", {"goal": "x"}, "tasks:submit"),
         ("get", "/v1/tasks/missing", None, "tasks:read"),
+        ("get", "/v1/tasks", None, "tasks:read"),
+        ("get", "/v1/tasks/missing/attempts", None, "tasks:read"),
         ("get", "/v1/devices", None, "pool:read"),
         ("get", "/v1/hosts", None, "pool:read"),
         ("get", "/v1/plugins", None, "plugins:read"),
@@ -332,6 +334,102 @@ def test_every_public_route_enforces_its_scope(
     assert authorized.status_code not in {401, 403}
 
 
+def test_list_tasks_returns_summary_with_pagination_and_status_filter(
+    tmp_path,
+) -> None:
+    app, pool, scheduler, _ = _build_app(tmp_path)
+    # Submit three tasks; assign one so the population covers multiple statuses.
+    first_id = scheduler.submit(goal="first")
+    second_id = scheduler.submit(goal="second")
+    pool.sync_host_devices(
+        "host-a",
+        [Device(id="device-a", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    scheduler.assign()
+    # assigned_id is whichever task the scheduler picked (oldest-first = first_id).
+    assigned_id = first_id
+
+    client = _client_for(app)
+
+    unfiltered = client.get("/v1/tasks").json()
+    assert unfiltered["total"] == 2
+    assert unfiltered["limit"] == 50
+    assert unfiltered["offset"] == 0
+    assert [item["id"] for item in unfiltered["items"]] == [second_id, assigned_id]
+    # Lease id must not leak through the summary surface.
+    assert all("lease_id" not in item for item in unfiltered["items"])
+
+    queued_only = client.get("/v1/tasks", params={"status": "queued"}).json()
+    assert queued_only["total"] == 1
+    assert [item["id"] for item in queued_only["items"]] == [second_id]
+    assert all(item["status"] == "queued" for item in queued_only["items"])
+
+    assigned_only = client.get(
+        "/v1/tasks", params={"status": "assigned"}
+    ).json()
+    assert assigned_only["total"] == 1
+    assert [item["id"] for item in assigned_only["items"]] == [assigned_id]
+
+
+def test_list_tasks_rejects_page_size_above_maximum(tmp_path) -> None:
+    app, _, _, _ = _build_app(tmp_path)
+    client = _client_for(app)
+
+    too_large = client.get("/v1/tasks", params={"limit": 101})
+    assert too_large.status_code == 422
+    # And the boundary value is accepted.
+    boundary = client.get("/v1/tasks", params={"limit": 100})
+    assert boundary.status_code == 200
+
+
+def test_list_tasks_rejects_negative_offset(tmp_path) -> None:
+    app, _, _, _ = _build_app(tmp_path)
+    client = _client_for(app)
+    response = client.get("/v1/tasks", params={"offset": -1})
+    assert response.status_code == 422
+
+
+def test_list_task_attempts_returns_chronological_history(tmp_path) -> None:
+    app, pool, scheduler, _ = _build_app(tmp_path)
+    pool.sync_host_devices(
+        "host-a",
+        [Device(id="device-a", driver_type="wda", status="idle")],  # type: ignore[arg-type]
+    )
+    task_id = scheduler.submit(goal="attempt me")
+    scheduler.assign()
+    task = scheduler.store.get_task(task_id)
+    scheduler.store.record_task_result(
+        task_id=task_id,
+        attempt=task.attempt_count,
+        lease_id=task.lease_id or "",
+        host_id=task.assigned_host_id or "",
+        status="failed",
+        failure_reason="boom",
+        terminal_result={"exit_code": 1},
+        completed_at=datetime.now(UTC),
+    )
+
+    client = _client_for(app)
+    resp = client.get(f"/v1/tasks/{task_id}/attempts")
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert len(body) == 1
+    assert body[0]["task_id"] == task_id
+    assert body[0]["status"] == "failed"
+    assert body[0]["failure_reason"] == "boom"
+    assert body[0]["terminal_result"] == {"exit_code": 1}
+    assert body[0]["host_id"] == "host-a"
+    assert body[0]["device_id"] == "device-a"
+
+
+def test_list_task_attempts_returns_404_for_unknown_task(tmp_path) -> None:
+    app, _, _, _ = _build_app(tmp_path)
+    client = _client_for(app)
+    resp = client.get("/v1/tasks/does-not-exist/attempts")
+    assert resp.status_code == 404, resp.text
+    assert "does-not-exist" in resp.json()["detail"]
+
+
 def test_plugin_admin_scope_is_checked_before_registration(
     tmp_path,
     monkeypatch,