Run turnstone-console alongside the server

Console (cluster dashboard + admin panel) starts as a background
daemon under marvin on :8090, sharing the same config.toml and SQLite
DB (WAL multi-writer). Forwarded via run.sh and exposed through
tailcat; same login as the server.

README.md

@@ -51,6 +51,9 @@ scripts/run.sh
 
 - Web UI: <http://localhost:8080> (login `marvin` / `marvin-turnstone`
   unless `ADMIN_PASSWORD` was overridden — change it)
+- Console (admin panel + usage/verdicts/audit/settings): port 8090,
+  same login — shares the DB with the server, so workstreams, tools,
+  judges, policies, and settings are managed dynamically
 - Ops SSH: `ssh -i configs/ssh/id_ed25519 -p 2222 marvin@localhost`
 - QEMU runs foreground; quit with `ctrl-a x`
 

scripts/expose.sh

@@ -8,14 +8,14 @@
 # Prints a stable tailcat address (saved key at
 # ~/.config/tailcat/keys/default.private.json). On the client machine:
 #
-#   tailcat forward <tc-address> 8080:8080 2222:2222
+#   tailcat forward <tc-address> 8080:8080 8090:8090 2222:2222
 #
 # then browse http://localhost:8080 and ssh -p 2222 as usual.
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
 TC="${TAILCAT_BIN:-$HOME/.local/bin/tailcat}"
-PORTS="${TAILCAT_PORTS:-8080,2222}"
+PORTS="${TAILCAT_PORTS:-8080,8090,2222}"
 
 if ! command -v "$TC" >/dev/null 2>&1; then
   echo "tailcat not found at $TC" >&2

scripts/run.sh

@@ -2,7 +2,9 @@
 # Boot the turnstone VM (foreground; QEMU: ctrl-a x to quit).
 #
 # Web UI:   http://localhost:8080
-# Ops SSH:  ssh -i configs/ssh/id_ed25519 -p 2222 marvin@localhost
+# Web UI:    http://localhost:8080
+# Console:   http://localhost:8090
+# Ops SSH:   ssh -i configs/ssh/id_ed25519 -p 2222 marvin@localhost
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
@@ -12,6 +14,7 @@ exec boco boot marvin-turnstone \
   --memory "${VM_MEMORY:-4096M}" \
   --mount-mode direct \
   --forward "tcp:0.0.0.0:8080-:8080" \
+  --forward "tcp:0.0.0.0:8090-:8090" \
   --forward "tcp:0.0.0.0:2222-:22" \
   --mount "$PWD/configs/turnstone:/home/marvin/.config/turnstone" \
   --mount "$PWD/data:/var/lib/turnstone" \

start-turnstone.sh

@@ -43,6 +43,13 @@ setpriv --reuid=marvin --regid=marvin --init-groups \
     --password "$ADMIN_PASSWORD" \
   || echo "start-turnstone: admin seeding failed (continuing)"
 
+# Console (cluster dashboard + admin panel) as a background daemon under
+# marvin — PID 1 stays the server, so if the server dies the VM halts.
+# Shares the same config.toml/database as the server (WAL multi-writer).
+setpriv --reuid=marvin --regid=marvin --init-groups \
+  /usr/local/bin/turnstone-console --host 0.0.0.0 --port 8090 &
+echo "start-turnstone: console starting on :8090"
+
 # NOTE: turnstone reads $HOME/.config/turnstone/config.toml as marvin
 exec setpriv --reuid=marvin --regid=marvin --init-groups \
   /usr/local/bin/turnstone-server --host 0.0.0.0 --port 8080