Skip to content

Appliance UI compliance matrix

This is the durable completion record for the browser-wide compliance program in GitHub issue #115. It inventories every route that deliberately renders HTML from atlaso/app/ui.py or atlaso/app/web_terminal.py, plus the shared shells, dialogs, and responsive variants used by those routes. API, download, redirect-only, and static-asset routes are outside this matrix because they do not render an Atlaso browser surface.

Issue #287 introduced an explicitly maintainer-approved custom/other information-architecture change while preserving the established dashboard, chart, terminal, login, and public-directory interactions. Management surfaces now belong to /ui/management; app-owned public surfaces belong to /ui/public; / is only the interface-aware dispatcher.

Canonical browser-route inventory

The route-inventory test fails when an app-owned human route is added outside its declared plane or when a protocol exemption changes without review. The management routes rendered by the current templates are:

/ui/management
/ui/management/appliance-update
/ui/management/audit-log
/ui/management/authentication
/ui/management/automation
/ui/management/backup-restore
/ui/management/ca/requests
/ui/management/certificate-authority
/ui/management/dashboard
/ui/management/dhcp
/ui/management/dns
/ui/management/esx-storage
/ui/management/firewall
/ui/management/vsphere-key-providers
/ui/management/ldap
/ui/management/login
/ui/management/logs
/ui/management/monitor
/ui/management/network-boot
/ui/management/ntp
/ui/management/openid-connect
/ui/management/physical-interfaces
/ui/management/routes-wan
/ui/management/traffic-publishing
/ui/management/services
/ui/management/services/{service}/logs
/ui/management/settings
/ui/management/tasks
/ui/management/terminal
/ui/management/terminal/remote
/ui/management/users
/ui/management/vaults
/ui/management/vcf-backups
/ui/management/vcf-helper
/ui/management/vcf-offline-depot
/ui/management/vcf-offline-depot/tasks/{job_id}/log
/ui/management/vcf-private-registry
/ui/management/vcf-trust
/ui/management/vlan-interfaces
/ui/management/{page}

The public routes rendered through public_portal_base.html are:

/ui/public
/ui/public/ca
/ui/public/ca/login
/ui/public/ca/requests
/ui/public/login
/ui/public/terminal

The detailed rows below use the complete canonical management and public paths. /PROD/ remains an explicitly exempt protocol and browser contract at its existing root path. Retired root-level browser paths appear only where a row explicitly identifies temporary compatibility behavior; they are not canonical route owners.

Result and evidence key

Each result records desktop (D, 1600×1000), narrow (N, 900×1200), keyboard-only operation (K), launcher focus restoration (F), browser zoom through 200% (Z), and validation failure/recovery (V). N/A means the surface has no editor or validation step. A Pass result means the applicable checks passed; it does not claim that a read-only or unavailable surface has a mutation workflow.

  • E1 — inventory: tests/test_ui_compliance.py extracts every HTML route, page template, and dialog identifier and requires this document to retain it.
  • E2 — foundations: shared-grid/wizard tests and scripts/check_repo.py enforce createGrid(...), createWizard(...), keyboard row actions, server fallbacks, and the raw-Tabulator boundary.
  • E3 — server behavior: focused route tests cover authentication, roles, CSRF, validation recovery, destructive endpoints, desired state, and the global appliance-apply boundary.
  • E4 — rendered fallback: the page response or a paired *-fallback element keeps initial data and empty/error language readable without JavaScript. Dynamic task progress that can exist only after a scripted submission is marked N/A.
  • E5 — responsive evidence: the checked-in screenshot manifest and generated interface gallery cover the canonical management and public surfaces at desktop and narrow sizes. #120 changed no visual layout, so no screenshot became inaccurate.
  • E6 — dialog audit: every shared wizard has an accessible name and live step description; the shared confirmation and About dialogs restore launcher focus, and wizard validation retains data and focuses the invalid control.
  • E7 — deployed audit: the #120 pull request records the exact-head VMware version and host-facing /openapi.json proof, plus page-by-page overflow, keyboard, zoom, JavaScript-disabled, permission, and representative recovery checks.
  • E8 — GitHub CI gates: JavaScript, full pytest, compileall, repository, Photon, docs, Markdown, strict site, version-policy, and whitespace checks run on the final pull-request head; local work uses focused tests.

Management and operations routes

Route and surface Approved interaction and shared foundation Server-rendered or no-JavaScript behavior Permission, confirmation, and apply boundary Result Evidence
/ui/management/dashboard — operations command center Established read-only Dashboard; Tasks/Audit navigation and shared application shell Initial dashboard snapshot, setup state, attention items, recent activity, and stale/error language are rendered in HTML Authenticated read; links enter existing permission-checked workflows; no dashboard mutation or service-specific apply Pass D/N/K/F/Z; V N/A E1–E5, E7–E8
/ui/management/monitor — health metrics, charts, interfaces, and devices Established Monitor charts plus read-only Tabulator using the Tasks reference Initial metrics and truthful interface/device fallback tables; charts degrade to readable metrics and status Authenticated read-only; no destructive action or apply boundary Pass D/N/K/F/Z; V N/A E1–E8
/ui/management/appliance-update plus update-only browser hold — streams, repositories, modules, tasks, global indicator, parent/child maintenance status Wizard-backed Tabulator plus non-grid settings, existing read-only Tasks Tabulator, and approved custom/other topbar/status surfaces; ESX Storage, Automation, DNS, account-menu topbar, Review appliance changes, Tasks hierarchy, and Appliance Apply live-task status references Repository/module details, durable per-stream results, exact action reason, source data, positive-only global indicator, and shared Tasks fallback remain readable; during installation nginx supplies a self-contained no-JavaScript, no-store 503 page with bounded ordered task state Authenticated positive-only indicator and admin write controls before admission; fresh-check install gate; shared deletion confirmation; update-only page requires no session while the control plane is unavailable and exposes no commands, credentials, or detailed errors; maintenance task boundary remains separate from global apply Pass D/N/K/F/Z/V E1–E8
/ui/management/automation — schedules, executions, managed scripts Wizard-backed and read-only Tabulator; Automation Schedules reference Truthful schedules, executions, and managed-scripts fallback tables added by #120 Admin writes, shared discard/destructive confirmation, durable worker/task boundary; no direct host mutation Pass D/N/K/F/Z/V E1–E8
/ui/management/routes-wan — global settings, static routes, routing permissions, NAT, policies Non-grid autosave settings plus wizard-backed Tabulator using four shared resource_wizard(...) dialogs; DNS settings and ESX Storage references Three global switches, four paired fallback tables, and rendered feature-aware validation/config preview Dual routes/WAN permission gate, reviewed add/edit, direct Enabled state, shared confirmations; generated permissions read-only; enforcement only through global wan apply Pass D/N/K/F/Z/V E1–E8
/ui/management/traffic-publishing — source NAT Non-grid autosave plus wizard-backed Tabulator; Routing and WAN, DNS and ESX Storage references NAT switch, family and mode, fallback and preview Firewall permissions; global nat apply Pass; deployed desktop/narrow grid and IPv6 wizard captures, real Apply and reboot verified #721
/ui/management/network-objects — Source Groups and consumer usage Full-height compact wizard-backed Tabulator using the ESX Storage grid/wizard, shared tag editor, and Audit Events workspace references Source Group fallback, built-in Any, line-separated entries, consumers, and validation render in HTML; JavaScript enhances explicit entries with server-validated non-color tag states Existing Firewall scopes; stable IDs; exclusive canonical entries: ["any"]; shared confirmation; in-use deletion conflict; no direct host mutation Pass D/N/K/F/Z/V E1–E8
/ui/management/firewall — operator and managed rules Wizard-backed and direct-edit Tabulator plus non-grid settings; DNS/ESX Storage references Rule and managed-rule fallbacks, validation, and preview Role-gated edits; Network Objects return handoff; shared remove confirmation; global firewall apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/physical-interfaces — observed and desired interfaces Direct-edit Tabulator with the shared boolean glyph formatter; Physical Interfaces reference Paired interface fallback with observed and desired values, including access management UI exposure Role-gated desired-state edits; management-path lockout validation; confirmation for guarded state changes; global network apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/vlan-interfaces — VLAN desired state Wizard-backed Tabulator using vlan-interface-dialog; ESX Storage reference; approved wizard-only persisted-state exception Paired VLAN fallback, access management UI exposure, and validation rail Role-gated reviewed desired-state edits; management-path and dependent-state validation; confirmed deletion; global network apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/dns — service settings, zones, records, previews Direct-edit Tabulator and non-grid settings; DNS reference Zone/record fallbacks and reviewed reverse-zone semantic summaries; settings and validation render in HTML Role-gated autosave, CSRF, explicit fallback labels, shared delete confirmation; global dnsmasq apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/dhcp — settings, IP zones, options, reservations, leases Wizard-backed, direct-edit, and read-only Tabulator; DNS/ESX Storage references Four paired fallbacks plus reviewed generated PXE option summary Role-gated desired-state writes, shared confirmations, validation recovery; global dnsmasq apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/certificate-authority — CA settings, profiles, certificates Wizard-backed Tabulator and non-grid settings; ESX Storage/DNS references Certificate/profile fallbacks, settings, validation, and redacted preview Role-gated writes, CSRF, shared revoke/delete confirmation; global ca apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/ldap — organizations, users, groups, VCF setup Wizard-backed and direct-edit Tabulator plus non-grid settings; DNS zones and ESX Storage references Organization/settings content and paired user/group fallbacks Admin writes, secret-safe one-time dialogs, confirmation and recovery; global ldap apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/vsphere-key-providers — providers, trusted vCenters, certificates, health Wizard-backed and read-only Tabulator plus non-grid settings; ESX Storage/Tasks/Audit Events/DNS references Four tool fallbacks, validation, nullable lifecycle counts, and redacted preview Admin writes; shared destructive confirmation; public-certificate-only trust, exact fingerprint mapping, and global kms apply boundaries preserved Pass D/N/K/F/Z/V E1–E8
/ui/management/ntp — settings, upstreams, source health Wizard-backed Tabulator and non-grid settings; ESX Storage/DNS references Upstream fallback, settings, validation, and config preview Role-gated desired-state writes; capability-gated NTS client/server controls; unsupported disables controls, while unknown preserves desired state and blocks unsafe apply; NTS server apply keeps CA-before-NTP ordering and Firewall-owned TCP/4460 access; global ntpd apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/vcf-helper — FQDN and remote VCF workflows Established VCF Helper workflows and shared wizards; VCF credential-wizard reference Server-rendered forms, reviewed FQDN semantic summary, and recoverable errors Admin permission, TLS fingerprint before credentials, shared confirmation; DNS edits remain global-apply desired state Pass D/N/K/F/Z/V E1–E8
/ui/management/vcf-helper?vcf_trust=1 — certificate-trust handoff Shared VCF credential wizard on the VCF Helper surface Server-rendered VCF Helper state and recoverable validation errors Admin, request-local credentials, explicit TLS confirmation, auditable task boundary Pass D/N/K/F/Z/V E1–E8
/ui/management/vcf-offline-depot — settings, VCFDT, profiles, tasks Wizard-backed Tabulator and non-grid settings; ESX Storage/DNS and Automation schedule references Profile fallback, settings summaries, validation, Tasks fallback, and task status Admin writes; contextual four-step schedule binds type/profile server-side; transient Start feedback; per-profile queue and exclusive identity/apply boundaries preserved Pass D/N/K/F/Z/V E1–E8
/ui/management/vcf-offline-depot/tasks/{job_id}/log — task log Established read-only task/log detail Bounded, redacted log and error state render in HTML Authenticated read; no mutation Pass D/N/K/F/Z; V N/A E1, E3–E5, E7–E8
/ui/management/vcf-private-registry — settings and bundles Wizard-backed Tabulator and non-grid settings; ESX Storage/DNS references Bundle fallback, settings, validation, and redacted previews Admin desired-state writes; shared deletion confirmation; global registry apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/vcf-backups — SFTP settings and validation Non-grid settings; DNS reference Complete settings, validation, and redacted config preview render in HTML Admin autosave with CSRF; selected-user dependency; global vcf_backups apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/esx-storage — volumes and NFS datastores Wizard-backed Tabulator; ESX Storage reference Paired volume/share fallback tables and rendered validation/instructions Admin writes; format authorization and removal confirmation; global esx_storage apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/authentication — provider, clients, keys, mappings, tokens Wizard-backed, direct-edit, and read-only Tabulator; ESX Storage/Physical Interfaces/Tasks references Five paired fallbacks and complete provider settings Admin writes, CSRF, one-time secret display, shared delete confirmation; no host apply side effect Pass D/N/K/F/Z/V E1–E8
/ui/management/openid-connect — canonical OIDC entry Same authenticated surface and contract as /ui/management/authentication Same server response and paired fallbacks Same role, secret, validation, and confirmation boundaries Pass D/N/K/F/Z/V E1–E8
/ui/management/users — local users and password policy Wizard-backed Tabulator and non-grid settings; ESX Storage/DNS references User fallback, policy settings, and password-not-staged states Admin writes; password values never render; confirmation and global local_users apply preserved Pass D/N/K/F/Z/V E1–E8
/ui/management/services — service state Direct-edit Tabulator; Physical Interfaces reference Paired service fallback and truthful unavailable states Permission-gated desired-state enablement; enforcement remains global apply Pass D/N/K/F/Z/V E1–E8
/services/{service}/logs — legacy service-log entry Redirected/normalized Services or Logs surface using their existing read-only contracts Server-rendered target surface or explicit unavailable response Authenticated read; helper allowlist remains server-owned Pass D/N/K/F/Z; V N/A E1, E3–E5, E7–E8
/ui/management/logs — fixed log sources Established read-only Logs tabs Initial bounded, redacted log text and unavailable source states Authenticated read; helper allowlist and redaction enforced server-side Pass D/N/K/F/Z; V N/A E1, E3–E5, E7–E8
/ui/management/tasks — task collection and details Read-only Tabulator; Tasks reference Paired task fallback with server filtering/pagination; detail/log dialogs are enhancements Authenticated read; cancellation remains permission/CSRF checked and confirmed where destructive Pass D/N/K/F/Z/V E1–E8
/ui/management/audit-log — audit events Read-only Tabulator; Audit Events reference Paired audit fallback remains visible until grid readiness or on error Admin read; no mutation Pass D/N/K/F/Z; V N/A E1–E8
/ui/management/network-boot — environments, discovered hosts, ESXi references, media Direct-edit, wizard-backed, and read-only Tabulator; Network Boot/ESX Storage references Paired fallbacks for every collection plus semantic inventory reports and no-script editors Permission-gated actions, CSRF, confirmations, audited immediate actions; global esxi_pxe apply boundary preserved Pass D/N/K/F/Z/V E1–E8
/ui/management/backup-restore — archives, restore, factory reset Established non-grid settings/task workflow; Backup/Restore Factory Reset confirmation and status handoff Forms, status, reviewed archive-scope semantic summary, and complete-reset login handoff render in HTML Admin, CSRF, passphrase handling, destructive confirmation, durable reset marker, and dedicated factory-reset exception preserved Pass D/N/K/F/Z/V E1–E8
/ui/management/settings — appliance settings Non-grid settings; DNS reference Complete settings, validation, and config preview render in HTML Admin autosave/CSRF; guarded changes and global appliance_settings apply only Pass D/N/K/F/Z/V E1–E8
/ui/management/vaults — password vaults and entries Wizard-backed Tabulator; ESX Storage reference Paired entry fallbacks and empty states; secrets remain masked/not emitted Admin, CSRF, audited bounded reveal, shared confirmations; no host apply Pass D/N/K/F/Z/V E1–E8
/ui/management/terminal and /ui/public/terminal — terminal and unavailable state Established terminal surface and shared management/public shell Authenticated unavailable-state page renders when disabled; protocol data is not substituted for browser navigation Explicit local-user Web SSH authorization, HTTPS/applied-state checks, no credential in browser state Pass D/N/K/F/Z/V E1, E3–E8
/ui/management/terminal/remote — vault-backed remote launch Established remote-terminal workflow and fingerprint confirmation Server-rendered target/credential selector and recoverable unavailable/error state Admin, exact host-key confirmation, one-use launch, no password/authenticated URI exposure Pass D/N/K/F/Z/V E1, E3–E8
/ui/management/{page} — known unavailable/placeholder pages Established authenticated unavailable-state shell Title and unavailable copy render entirely in HTML Authentication required; no mutation Pass D/N/K/F/Z; V N/A E1, E3–E5, E7–E8

Public, login, and interface-scoped routes

Route and surface Approved interaction and shared foundation Server-rendered or no-JavaScript behavior Permission, confirmation, and interface boundary Result Evidence
/ — management redirect or public service directory Established management/public front door and public shell Public cards, empty-directory state, and footer render in HTML; management listeners redirect through normal login/dashboard flow Binding and service visibility are server-owned; no public mutation Pass D/N/K/F/Z; V N/A E1, E3–E5, E7–E8
/ui/management/login — management login and invalid-credential recovery Established management login shell Form, CSRF value, return path, and invalid-credential error render in HTML Unauthenticated entry; safe return path and server authentication Pass D/N/K/F/Z/V E1, E3–E5, E7–E8
/ui/public/ca — public CA trust portal Established public CA portal and public shell Trust material, fingerprints, downloads, empty/disabled state, and footer render in HTML Interface-scoped unauthenticated read; no custody/private-key exposure Pass D/N/K/F/Z; V N/A E1, E3–E8
/ui/public/ca/login — public certificate-request login Established public login shell Form and invalid-credential recovery render in HTML Interface-scoped authentication, CSRF, safe return target Pass D/N/K/F/Z/V E1, E3–E5, E7–E8
/ui/management/ca/requests — management request list Read-only Tabulator; Tasks reference Paired request fallback with safe columns and revoke form Authenticated permission/CSRF; shared revoke confirmation; global CA apply boundary Pass D/N/K/F/Z/V E1–E8
/ui/public/ca/requests — public request list and submission Read-only Tabulator plus non-grid request form; Tasks/DNS references Paired request fallback and complete submission form remain usable/readable Interface-scoped authentication, authorization, CSRF, revoke confirmation, validation recovery Pass D/N/K/F/Z/V E1–E8
/PROD/login — depot login Established public login shell Form and invalid-credential recovery render in HTML Interface-scoped authentication/Basic-auth compatibility, CSRF, safe depot return path Pass D/N/K/F/Z/V E1, E3–E5, E7–E8
/PROD/ and /PROD/{depot_path:path} — depot directory browser Read-only Tabulator; Tasks reference Paired directory fallback, exact native links, parent navigation, empty and traversal-error states Interface/auth mode enforced server-side; files/directories retain exact safe URLs Pass D/N/K/F/Z; V N/A E1–E8

Dialog and shared-surface inventory

The shared base.html, public_portal_base.html, partials/resource_wizard.html, partials/task_grid.html, and partials/task_modals.html contracts are part of every applicable row above. The following stable dialog identifiers are explicitly inventoried so route/template changes cannot silently escape the matrix:

  • Shared shell: about-modal, confirm-modal, preview-modal, ntp-source-health-modal, appliance-apply-modal, task-detail-modal, and task-log-modal.
  • Authentication and users: oidc-client-dialog, oidc-client-secret-modal, oidc-key-dialog, api-token-dialog, user-account-dialog, and user-password-modal.
  • The OIDC one-time credential handoff reuses the Managed LDAP credential dialog within the wizard-backed client collection. Its masked field, audited Reveal, Copy, Done/Escape disposal, and focus restoration have focused server/browser-logic regression coverage and a synthetic native-browser smoke check. This records the handoff contract without claiming new deployed-appliance, narrow-viewport, or zoom acceptance.
  • Factory Reset uses factory-reset-password-modal for non-grid settings, reusing the Local Users password dialog. Only Change-selected accounts are prompted at submission; inline validation, contained focus/hover help, cancellation cleanup, and the shared destructive confirmation preserve the reset boundary.
  • Automation and maintenance: automation-schedule-modal, automation-script-create-dialog, automation-script-modal, automation-script-run-modal, automation-script-diff-modal, appliance-update-source-dialog, and managed-package-dialog.
  • Networking and services: dns-domain-dialog, dhcp-scope-dialog, dhcp-option-dialog, dhcp-lease-reservation-modal, dhcp-lease-pxe-modal, firewall-rule-dialog, network-object-source-group-dialog, and ntp-source-dialog.
  • Identity, CA, and vSphere Key Providers: ca-csr-dialog, ca-profile-dialog, ca-certificate-dialog, ldap-organization-dialog, ldap-bind-rotation-dialog, ldap-user-dialog, ldap-group-dialog, ldap-bind-secret-modal, ldap-password-modal, ldap-group-members-modal, ldap-generate-modal, vsphere-provider-dialog, vsphere-vcenter-dialog, vsphere-certificate-dialog, and vsphere-enrollment-dialog.
  • Network Boot and storage: network-boot-host-dialog, network-boot-upload-dialog, network-boot-promote-dialog, esxi-iso-upload-dialog, sddc-ova-upload-dialog, esxi-custom-variable-wizard-dialog, esxi-boot-authorization-dialog, kickstart-wizard-dialog, esx-storage-volume-modal, and esx-storage-share-modal.
  • Routing and WAN: routes-wan-route-dialog, routes-wan-routing-dialog, routes-wan-nat-dialog, and routes-wan-policy-dialog, and port-forward-dialog (Traffic Publishing).
  • VCF workflows: vcf-fqdn-modal, vcf-ldap-modal, vcf-trust-modal, vcf-lab-modal, vcf-sddc-deploy-modal, vcf-target-depot-modal, vcf-vault-import-modal, vcf-depot-profile-dialog, vcf-depot-tool-package-dialog, vcf-depot-configuration-dialog, vcf-depot-tool-reset-modal, vcf-depot-schedule-modal, vcf-registry-bundle-dialog, and vcf-appliance-certificate-modal.
  • Vaults and Monitor: vault-create-modal, vault-entry-modal, and monitor-chart-modal.

Every wizard identifier above uses createWizard(...), data-atlaso-wizard-*, an accessible name and description, first-invalid-control recovery, focus containment, and launcher-focus restoration. Shared confirmation restores its action launcher, or the enclosing account-menu launcher when the action closes that menu, after confirm, cancel, or Escape. Other established dialogs keep native dialog focus containment and their route-specific close/return behavior. Desktop, narrow, and 200% zoom checks require dialog content to scroll without moving essential title/action context outside the viewport.

Template and semantic-summary coverage

Page templates covered by the route rows are appliance_update.html, audit.html, authentication.html, automation.html, backup_restore.html, ca_public.html, ca_request_login.html, ca_request_portal.html, ca_requests.html, certificate_authority.html, dashboard.html, depot_browser.html, dhcp.html, dns.html, esx_storage.html, esxi_pxe.html, firewall.html, kms.html, ldap.html, login.html, logs.html, monitor.html, network_objects.html, ntp.html, physical_interfaces.html, placeholder.html, public_service_home.html, public_terminal.html, remote_terminal.html, traffic_publishing.html, routes_wan.html, services.html, settings.html, tasks.html, terminal.html, users.html, vaults.html, vcf_backups.html, vcf_helper.html, vcf_offline_depot.html, vcf_offline_depot_task_log.html, vcf_private_registry.html, and vlan_interfaces.html.

The DHCP Pool Health view uses partials/dhcp_pool_health.html and the read-only Tasks grid pattern for pool summaries and address evidence. It retains semantic fallbacks, permission-checked launch actions, live updates and explicit nonresponse/unknown states; Verify pool creates a cancellable report-only task. DHCP settings retain the non-grid DNS settings reference, and optional schedules reuse the Automation Schedules wizard.

Shared-only templates are base.html, public_portal_base.html, partials/appliance_apply_status.html, partials/brand_mark.html, partials/config_preview_action.html, partials/resource_wizard.html, partials/port_forwarding.html, partials/task_grid.html, partials/task_modals.html, partials/terminal_panel.html, partials/vcf_ldap_modal.html, partials/vcf_sddc_deploy_modal.html, partials/vcf_sddc_upload_modal.html, partials/vcf_target_depot_modal.html, partials/vcf_trust_modal.html, partials/vcf_vault_credential_picker.html, partials/vcf_vault_import_modal.html, and partials/vcf_appliance_certificate_modal.html.

The only non-fallback native tables are the reviewed #115 semantic summaries: backup archive scope, generated DHCP PXE options, generated DNS reverse zones, and the VCF Helper FQDN review. Tooltip/membership and compact key/value, manifest, configuration, or result summaries remain semantic markup only while they do not gain resource-collection behavior. Any future sortable, filterable, selectable, navigable, editable, or actionable collection must use the shared Tabulator foundation or receive explicit maintainer approval through a separately labeled issue.

Completion rule

vCenter-first enrollment (#171)

vsphere-enrollment-dialog uses the wizard-backed Tabulator pattern with ESX Storage and VCF Helper remote credential references. Administrator-only entry, HTTPS fingerprint confirmation, public certificate inspection, explicit provider approval, recoverable errors, and desired-state Apply remain separate steps. The existing manual public-certificate fallback remains available. The dedicated Atlaso-Docs VM capture and desktop/narrow visual verification are pending under maintainer direction. Live VCF 9.1 acceptance is tracked separately in #172; this matrix entry does not claim either gate passed.

Issue #799 reorganizes the existing Maintenance (backup_restore.html) page into LDAP, Backup, Reset and Diagnostics tabs. Recovery actions retain their original routes and safeguards. partials/diagnostics.html contains the wizard-backed Tabulator collection using Automation Schedules and ESX Storage, the diagnostics-wizard four-step creation flow, and the diagnostics-detail read-only result dialog using Tasks conventions. It preserves the native read-only fallback, current administrator authorization, explicit omission/status text, keyboard entry and responsive shared controls. Diagnostics does not invoke Appliance Apply. Desktop and narrow-view validation belong to #799.

The matrix is complete only while E1–E8 pass on the same pull-request head. A future failure must be remediated in the same change or tracked by a separately labeled issue linked to #115; a new custom/other interaction also requires explicit maintainer approval before implementation.

VCF Helper certificate replacement (#1023, #1027, #1038)

The maintainer-approved custom/other extension reuses VCF Helper action cards, the ESXi PXE .tool-tabs frame, and AtlasoUiPatterns.createWizard. The Deployment, Credentials, Certificates, LDAP, and Lab panels retain headed no-JavaScript groups. Explicit workflow and operation links take precedence over the remembered tab; keyboard navigation and closing the wizard restore the active category and launcher focus. partials/vcf_appliance_certificate_modal.html provides the nine-step vcf-appliance-certificate-modal. Administrator and CSRF checks protect its browser-only operations. Fingerprint confirmation precedes credentials; passwords clear on close. Results distinguish installation, served certificate, strict TLS, login, and health. Desktop and responsive captures and keyboard/browser checks cover the deployed flow. Native certificate replacement and health passed independently on SRM and vCenter 9.1.1; SDDC Manager 9.x target selection is captured, while native SDDC validation remains pending an admitted lab endpoint.

VCF Helper managed certificate renewal (#1052)

partials/vcf_certificate_renewal.html renders the inventory fallback. partials/vcf_certificate_renewal_dialogs.html supplies vcf-renewal-connection-dialog, vcf-renewal-policy-dialog, vcf-renewal-health-dialog, vcf-renewal-prepare-dialog, and vcf-renewal-review-dialog alongside the existing VCF Helper dialogs. Synthetic browser checks cover credential/fingerprint wizard loading, narrow content layout, and Escape dismissal; deployed-appliance validation remains pending.

The renewal workspace uses the read-only Tabulator contract from Tasks for certificate inventory and status. Its per-target policy and guarded replacement workflow use the shared wizard contract from Automation Schedules and the existing Appliance Certificate Replacement workflow. Enrollment is opt-in; scheduled and manual discovery only propose work. CSR generation/signing and replacement require separate administrator actions, including a single-use ten-minute review before VCF Operations' asynchronous EXTERNAL_CA workflow. Native vCenter Machine SSL acceptance on VCF Operations 9.1.1 remains pending. Record native acceptance only after the exact installed leaf, fresh strict TLS, and health are verified; the UI must not imply Atlaso changes VCF's own renewal status.

VCF lab overrides (#849, #873)

partials/vcf_lab_overrides.html uses the approved custom/other VCF Certificate Trust tile/modal reference, AtlasoUiPatterns.createWizard, and the generic wizard DOM contract. Administrator-only operations support saved Vault references and manual credentials. Saved passwords stay server-side and never enter the browser. Manual vcf/root passwords are entered after trust confirmation, sent only with the operation requests, and held in request/process memory rather than persisted in Vault, signed plans, jobs or audits. Password fields clear on close or successful submission. Fingerprint confirmation precedes authentication, and navigation never writes remote properties or restarts services. JavaScript is required for the workflow. Local Edge checks cover review invalidation, recoverable submission errors, automatic credential-free SSH probing, explicit approval, current-value editing, and automatic task-details navigation after successful submission at desktop and narrow viewports. Native VCF acceptance and deployed-appliance UI verification remain outstanding.

Reverse proxy acceptance

partials/reverse_proxies.html uses the existing Traffic Publishing grid, server-rendered fallback, shared wizard, and read-only health grid. reverse-proxy-dialog reuses the step-wizard validation and review interaction. Behavioral tests cover wizard payloads and fallback visibility; native desktop and narrow-viewport screenshot acceptance remains pending under issue #723. This entry records interaction coverage without claiming deployed acceptance.