feat(instrumenta): implement v1 — items API, audit, stdio, UI, forwarding

[Teagan42]

Summary

Full Instrumenta v1 implementation covering all 6 PRs from the wayfinder map (#199).

What changed

PR	Scope	Files
1	Items API — item_flags, local_prompts, local_resources CRUD	backend.py, items_router.py, test_items.py
2	Audit log — structured stdout + /audit endpoint	audit.py, backend.py, test_audit.py
3	dev.sh integration + test fixture	dev.sh, conftest.py
4	Stdio supervisor + PATH probe	stdio_supervisor.py, path_probe.py, test_stdio.py
5	HTMX configuration UI	static/index.html
6	Upstream prompt/resource forwarding	aggregator.py

New endpoints

• GET/PUT/DELETE /items/flags — enable/disable tools, prompts, resources
• GET/POST/PATCH/DELETE /items/prompts — local prompt library
• GET/POST/PATCH/DELETE /items/resources — local resource library
• GET/POST /audit — audit log viewer + writer
• GET /runtimes — PATH probe for node/python3/uv

Key decisions

• Tables existed in schema from day one; this PR adds repository methods and routes
• Aggregator now discovers upstream prompts/resources (cached, not yet forwarded through MCP server — that's a follow-up)
• Stdio supervisor uses asyncio.create_subprocess_exec with capped exponential backoff (1s → 30s)
• UI follows Vox conventions: CSS custom properties, prefers-color-scheme, dl.kv, zero CDN
• 88 tests passing (44 existing + 44 new)

Testing

cd services/instrumenta
.venv/bin/python -m pytest -x -q

Out of scope (v1)

• Postgres backend
• Hot-reload of upstream tools
• API key auth enforcement
• Audit log retention/pruning
• shell.exec dangerous built-in

[github-code-quality]

Code Coverage Overview

Languages: Rust

Rust / code-coverage/llvm-cov

The overall line coverage in commit 18221cb in the feat/instrumenta-v1 branch remains at 90%, unchanged from commit 644a9d4 in the main branch.

---

_{Updated August 25, 2026 06:53 UTC}