From 16595afd27709432eb78880a782c36d8c94dc27a Mon Sep 17 00:00:00 2001
From: Rohan Adwankar <39285979+RohanAdwankar@users.noreply.github.com>
Date: Thu, 8 Oct 2026 17:08:54 -0700
Subject: [PATCH] Restore dashboard creation in View mode

Dashboard authoring persists visualizations without modifying monitored infrastructure. Restore both dashboard tools to the View policy and document this intentional exception so future safety changes preserve it.

Signed-off-by: Rohan Adwankar <39285979+RohanAdwankar@users.noreply.github.com>
---
 .../openclaw-seed/extensions/automation-context.ts    |  6 ++++++
 helm/mosaic-stack/tests/automation-context.test.mjs   | 11 ++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/helm/mosaic-stack/files/openclaw-seed/extensions/automation-context.ts b/helm/mosaic-stack/files/openclaw-seed/extensions/automation-context.ts
index 2129656..c18e1c0 100644
--- a/helm/mosaic-stack/files/openclaw-seed/extensions/automation-context.ts
+++ b/helm/mosaic-stack/files/openclaw-seed/extensions/automation-context.ts
@@ -15,6 +15,10 @@ const ALWAYS_MUTATING_TOOLS = new Set([
   "write",
 ]);
 
+// View mode protects monitored workloads and infrastructure from changes.
+// Saving a Grafana dashboard persists a visualization of observed data, which is
+// part of the View workflow. Both dashboard creation tools are intentionally
+// allowed here; a Grafana API write alone does not make an action require Edit.
 const READ_ONLY_TOOLS = new Set([
   "agents_list",
   "bcm_execute_cmsh",
@@ -25,6 +29,7 @@ const READ_ONLY_TOOLS = new Set([
   "bcm_node_health_summary",
   "bcm_search_notes",
   "bcm_search_tools",
+  "dashboard_create",
   "dashboard_list",
   "dashboard_open",
   "dcgm_current",
@@ -35,6 +40,7 @@ const READ_ONLY_TOOLS = new Set([
   "find",
   "get_goal",
   "glob",
+  "grafana_dashboard_create",
   "grafana_dashboard_health",
   "grafana_dashboard_open",
   "grafana_dashboard_presets",
diff --git a/helm/mosaic-stack/tests/automation-context.test.mjs b/helm/mosaic-stack/tests/automation-context.test.mjs
index 01949c6..0230648 100644
--- a/helm/mosaic-stack/tests/automation-context.test.mjs
+++ b/helm/mosaic-stack/tests/automation-context.test.mjs
@@ -123,7 +123,6 @@ test("uses fixed tool capabilities with a narrow diagnostic exception", () => {
   for (const tool of [
     "write", "edit", "apply_patch",
     "run_kubectl_admin", "bcm_execute_cmsh_admin", "bcm_add_note", "bcm_remove_note",
-    "dashboard_create", "grafana_dashboard_create",
   ]) {
     assert.equal(toolRequiresEdit(tool), true, tool);
   }
@@ -150,3 +149,13 @@ test("applies explicit per-server MCP tool access without trusting unknown serve
   assert.equal(toolAccess("unconfigured__inspect"), "unknown");
   configureMcpToolPolicies(undefined);
 });
+
+// Dashboard persistence is an observation workflow, not infrastructure mutation.
+test("View permits dashboard authoring while infrastructure changes still require Edit", () => {
+  for (const name of ["dashboard_create", "grafana_dashboard_create"]) {
+    assert.equal(toolRequiresEdit(name), false, name);
+  }
+  for (const name of ["run_kubectl_admin", "bcm_execute_cmsh_admin", "apply_patch"]) {
+    assert.equal(toolRequiresEdit(name), true, name);
+  }
+});