feat: SRS connectivity status across the full guardrail chain

Policies page now shows a live three-row status pill (on load + 30s poll +
click-to-recheck):
  AgentOS        — the health fetch itself (SPA → agentos-server)
  AgentOS → SRS  — raw /health reachability + an x-api-key'd /v1/rai/policies
                   probe (the exact proxy path the Policies UI uses)
  CAS → SRS      — relayed from the CAS's new GET /srs/health: the link the
                   gateway PII redaction + SrsPolicyDecider depend on

All probes carry 5s timeouts so a wedged SRS can never hang the UI (the
failure mode behind the earlier policies-list outage).

- computeragent-server: new GET /srs/health (probes SRS from the CAS pod)
- agentos-server: GET /v1/srs/health aggregates own probe + CAS relay
- spa: SrsStatus pill + SrsHealth/SrsProbe types

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: patel-lyzr

agentos/src/api.ts

@@ -205,6 +205,23 @@ export interface PIIDetectionConfig {
   custom_pii?: CustomPII[];
 }
 
+/** One SRS connectivity probe (reachability + authenticated API call). */
+export interface SrsProbe {
+  configured: boolean;
+  reachable: boolean;
+  authenticated: boolean;
+  latencyMs: number | null;
+  error?: string;
+}
+
+/** GET /srs/health — the full guardrail chain, measured server-side:
+ *  `agentos` = agentos-server → SRS; `cas` = agentos → CAS + CAS → SRS.
+ *  The response arriving at all proves the SPA → agentos hop. */
+export interface SrsHealth {
+  agentos: SrsProbe;
+  cas: { reachable: boolean; srs: SrsProbe | null; error?: string };
+}
+
 export interface PolicyDoc {
   _id: string;
   name: string;
@@ -503,6 +520,9 @@ export const api = {
   deleteSchedule: (id: string) => reqJSON<{ ok: boolean }>("DELETE", `/schedules/${encodeURIComponent(id)}`),
   runScheduleNow: (id: string) => postJSON<{ ok: boolean }>(`/schedules/${encodeURIComponent(id)}/run-now`, {}),
   // Policies — SRS-proxied. Server injects x-api-key.
+  // SRS connectivity, measured server-side: raw /health reachability + an
+  // authenticated /v1/rai/policies probe (the exact path this UI uses).
+  srsHealth: () => getJSON<SrsHealth>("/srs/health"),
   policies: () => getJSON<{ policies: PolicyDoc[] }>("/policies").then((d) => d.policies),
   policy: (id: string) => getJSON<PolicyDoc>(`/policies/${encodeURIComponent(id)}`),
   createPolicy: (body: Partial<PolicyDoc>) => postJSON<PolicyDoc>("/policies", body),

agentos/src/components/PoliciesPage.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react";
-import { api, type PolicyDoc, type CedarPolicyEntry, type OPAPolicyDoc, type PIIAction } from "../api.ts";
+import { api, type PolicyDoc, type CedarPolicyEntry, type OPAPolicyDoc, type PIIAction, type SrsHealth } from "../api.ts";
 import { useAuth } from "../context/AuthContext.tsx";
 
 /**
@@ -49,6 +49,7 @@ export function PoliciesPage() {
           <div>
             <div className="text-base font-semibold">Policies</div>
             <div className="text-[11px] text-gray-500">SRS-managed · Cedar + OPA</div>
+            <SrsStatus />
           </div>
           {canWrite && (
             <button
@@ -645,6 +646,66 @@ function RegoPoliciesModal({
   );
 }
 
+/**
+ * SRS connectivity pill. Polls `/srs/health` on mount, on every refresh, and
+ * every 30s — both signals are measured from agentos-server (the browser has
+ * no route to SRS): raw reachability + the authenticated proxy path the
+ * Policies UI itself uses. Click to re-check immediately.
+ */
+function SrsStatus() {
+  const [health, setHealth] = useState<SrsHealth | null>(null);
+  const [agentosUp, setAgentosUp] = useState<boolean | null>(null); // the fetch itself = SPA → agentos
+  const [checking, setChecking] = useState(false);
+
+  const check = () => {
+    setChecking(true);
+    api.srsHealth()
+      .then((h) => { setHealth(h); setAgentosUp(true); })
+      .catch(() => { setHealth(null); setAgentosUp(false); })
+      .finally(() => setChecking(false));
+  };
+  useEffect(() => {
+    check();
+    const t = setInterval(check, 30_000);
+    return () => clearInterval(t);
+  }, []);
+
+  const probeState = (p: { configured: boolean; reachable: boolean; authenticated: boolean; latencyMs: number | null; error?: string } | null | undefined, fallback: string) => {
+    if (!p) return { dot: "bg-gray-500", text: fallback };
+    if (!p.configured) return { dot: "bg-gray-500", text: "not configured" };
+    if (p.authenticated) return { dot: "bg-emerald-500", text: `connected · ${p.latencyMs}ms` };
+    if (p.reachable) return { dot: "bg-amber-500", text: "reachable, auth failing" };
+    return { dot: "bg-red-500", text: "unreachable" };
+  };
+
+  const rows: Array<{ label: string; dot: string; text: string; title?: string }> = [
+    agentosUp === false
+      ? { label: "AgentOS", dot: "bg-red-500", text: "unreachable" }
+      : { label: "AgentOS", dot: agentosUp ? "bg-emerald-500" : "bg-gray-500", text: agentosUp ? "connected" : "checking…" },
+    { label: "AgentOS → SRS", ...probeState(health?.agentos, "checking…"), title: health?.agentos?.error },
+    health && !health.cas.reachable
+      ? { label: "CAS → SRS", dot: "bg-red-500", text: "CAS unreachable", title: health.cas.error }
+      : { label: "CAS → SRS", ...probeState(health?.cas.srs, health ? "no /srs/health (old CAS?)" : "checking…"), title: health?.cas.error ?? health?.cas.srs?.error },
+  ];
+
+  return (
+    <button
+      type="button"
+      onClick={check}
+      title="Click to re-check connectivity"
+      className={`mt-1.5 block text-left space-y-0.5 ${checking ? "opacity-60" : ""}`}
+    >
+      {rows.map((r) => (
+        <span key={r.label} title={r.title} className="flex items-center gap-1.5 text-[10px] text-gray-500 hover:text-gray-300">
+          <span className={`h-1.5 w-1.5 rounded-full ${r.dot}`} />
+          <span className="w-24 text-left">{r.label}</span>
+          <span>{r.text}</span>
+        </span>
+      ))}
+    </button>
+  );
+}
+
 /**
  * Click-to-copy policy id. Shown wherever a policy surfaces so users can paste
  * the id straight into the SDK (`ComputerAgent(policy_id="…")`). `short` shows

examples/computeragent-server.ts

@@ -942,6 +942,43 @@ export class ComputerAgentServer {
       }),
     );
 
+    // SRS connectivity as seen from THIS server — the exact link the gateway's
+    // PII redaction and the SrsPolicyDecider depend on. `reachable` = raw
+    // GET /health; `authenticated` = an x-api-key'd /v1/rai/policies probe.
+    // Surfaced in the AgentOS UI's SRS status pill (proxied via agentos-server).
+    this.app.get("/srs/health", async (c) => {
+      const srsBase = (process.env.SRS_BASE_URL ?? "").replace(/\/+$/, "");
+      const srsKey = process.env.SRS_API_KEY ?? "";
+      if (!srsBase) {
+        return c.json({ configured: false, reachable: false, authenticated: false, latencyMs: null });
+      }
+      const t0 = Date.now();
+      let reachable = false;
+      let authenticated = false;
+      let error: string | null = null;
+      try {
+        const h = await fetch(`${srsBase}/health`, { signal: AbortSignal.timeout(5000) });
+        reachable = h.ok;
+        if (reachable) {
+          const a = await fetch(`${srsBase}/v1/rai/policies`, {
+            headers: { "x-api-key": srsKey },
+            signal: AbortSignal.timeout(5000),
+          });
+          authenticated = a.ok;
+          if (!a.ok) error = `auth check: SRS ${a.status}`;
+        }
+      } catch (err) {
+        error = (err as Error).message;
+      }
+      return c.json({
+        configured: true,
+        reachable,
+        authenticated,
+        latencyMs: Date.now() - t0,
+        ...(error ? { error } : {}),
+      });
+    });
+
     this.app.post("/run", async (c) => {
       const max = this.opts.maxConcurrentRuns ?? 4;
       if (this.runs.size >= max) {

packages/agentos-server/src/routes/policies.ts

@@ -81,6 +81,67 @@ async function srs(
   }
 }
 
+// ── SRS connectivity health ────────────────────────────────────────────────
+// The full guardrail chain, measured server-side (the browser has no route to
+// SRS or the CAS):
+//   agentos — THIS server → SRS: raw GET /health reachability + an x-api-key'd
+//             /v1/rai/policies probe (the exact proxy path the Policies UI uses).
+//   cas     — THIS server → CAS (is the harness up?) and CAS → SRS (the link
+//             the gateway PII redaction + SrsPolicyDecider depend on), relayed
+//             from the CAS's own /srs/health.
+// The SPA polls this to render the SRS status pill. Responding at all proves
+// the SPA → agentos hop.
+interface SrsProbe {
+  configured: boolean;
+  reachable: boolean;
+  authenticated: boolean;
+  latencyMs: number | null;
+  error?: string;
+}
+
+async function probeSrs(): Promise<SrsProbe> {
+  if (!SRS_BASE) return { configured: false, reachable: false, authenticated: false, latencyMs: null };
+  const t0 = Date.now();
+  let reachable = false;
+  let authenticated = false;
+  let error: string | null = null;
+  try {
+    const h = await fetch(`${SRS_BASE}/health`, { signal: AbortSignal.timeout(5000) });
+    reachable = h.ok;
+    if (reachable) {
+      const a = await fetch(`${SRS_BASE}/v1/rai/policies`, {
+        headers: { "x-api-key": SRS_KEY },
+        signal: AbortSignal.timeout(5000),
+      });
+      authenticated = a.ok;
+      if (!a.ok) error = `auth check: SRS ${a.status}`;
+    }
+  } catch (err) {
+    error = (err as Error).message;
+  }
+  return { configured: true, reachable, authenticated, latencyMs: Date.now() - t0, ...(error ? { error } : {}) };
+}
+
+async function probeCasSrs(): Promise<{ reachable: boolean; srs: SrsProbe | null; error?: string }> {
+  const { caBase } = await import("../upstream.js");
+  const { caAuthHeader } = await import("../auth.js");
+  try {
+    const r = await fetch(`${caBase()}/srs/health`, {
+      headers: caAuthHeader(),
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!r.ok) return { reachable: true, srs: null, error: `CAS /srs/health → ${r.status}` };
+    return { reachable: true, srs: (await r.json()) as SrsProbe };
+  } catch (err) {
+    return { reachable: false, srs: null, error: (err as Error).message };
+  }
+}
+
+policiesRouter.get("/srs/health", authorize("policies:read"), async (_req, res) => {
+  const [agentos, cas] = await Promise.all([probeSrs(), probeCasSrs()]);
+  res.json({ agentos, cas });
+});
+
 // ── RAI policies → SRS /v1/rai/policies ───────────────────────────────────
 policiesRouter.get("/policies", authorize("policies:read"), (_req, res) =>
   srs(res, "GET", "/v1/rai/policies", { fallback: { policies: [] } }),