Context
The operator console is part of the control plane. A workflow engine without a safe human surface trains people to bypass the controls at 2 a.m.
Operations Command Center is that surface: dashboard metrics, execution state, retry and cancel, OIDC authorization-code with PKCE, and tenant-scoped audit.
Decision
Action requests require an Idempotency-Key and an expectedVersion. PostgreSQL row locks and advisory locks back the workflow actions. The browser session is not a homemade cookie the API blindly trusts. Fixture auth exists so you can review the UI without Keycloak; OIDC mode is the real path.
What I rejected
A “Retry” button that POSTs with no key and no version. Double-submit and two tabs would start two recoveries. I also rejected letting the UI call internal worker URLs directly.
Failure scenario
Two operators hit Retry on the same exhausted run. One request wins the version. The second returns 409. Audit records who acted, on which tenant, with which key.
Evidence
Authenticated Next.js console, optimistic-concurrency tests, and tenant audit history in PostgreSQL. Pair it with the identity gateway so the session and the API agree.
Inspect: Repository · Run locally