ADR-0128: Single console with a Platform Manager space, standalone Manager console kept

Context

Product architecture, interfaces: the portal must have a Platform Manager space. The Navin Platform Manager has its own console and API (RBAC, approvals, stop rules, X-NM-On-Behalf-Of delegation).

Decision

The portal is the single console. Its Platform Manager space goes through the Control Plane domain eai.domains.platform_manager (routes /v1/platform-manager/..., role platform_admin). The Control Plane relays the reads (summary with real counts, services with the five state fields and the administrative state, sheet, nodes, clusters, operations) and the operation requests with the portal user's identity, and audits each request in its own chain. The Manager stays the authority: it decides with its RBAC, approvals and stop rules and returns the operation_id. The Manager is reached through a configured URL (operator egress allowlist), an optional CA bundle and a token held as a secret reference of the secrets domain.

The Manager console stays available on its own: for the bootstrap before the platform exists and for recovery when the Control Plane is down.

Consequences

Two consoles exist for the Manager but one authorisation rule: the Manager's. The Control Plane never bypasses a refusal; it relays it in English and French.

Evidence

services/control-plane/tests/test_platform_manager_bridge.py, against a real Manager process (real PostgreSQL, uvicorn) started by services/control-plane/tests/fixtures/platform_manager_server.py.