Inspected the Factory controller, dashboard frontend, vxData SDK, and workspace build configuration on the factory/campaign-controller-prototype branch.
Established the two-process local loop: FastAPI on 127.0.0.1:8000 and Vite on 127.0.0.1:5173, with /api/factory rewritten to the controller root by VITE_FACTORY_PROXY_TARGET.
Identified the @virdx/ui-components build as a frontend prerequisite because its workspace exports resolve through dist/ and the dashboard development target does not build dependencies.
Established that realistic campaign state needs a server-side VXDATA_TOKEN for production vxData plus kubeconfig access to list Argo workflows. The browser does not receive either credential.
Verified the current virdx context can read the admin token Secret, production vxData accepts it, the user can list and create Workflows and get, create, and update Leases in argo-workflows, and a real read-only campaign evaluation succeeds.
Reported the exact setup and run commands to the parent agent. No monorepo files were changed and no development servers were started.
Lessons Learned: Pitfalls
GET /campaigns is static. Its success does not prove that campaign details can query vxData or Argo.
API_URL is not the controller endpoint override. The controller passes FACTORY_VXDATA_API_URL explicitly to the SDK, while authentication still comes from the SDK’s VXDATA_TOKEN.
VITE_PLATFORM_BEARER_TOKEN applies only to /api/platform. It neither authenticates the Factory API nor its vxData calls.
The Factory HTTP API has no authentication. Binding it beyond loopback would expose a route that can submit real GPU work.
Lessons Learned: Improvements
Add a Factory local-development section to apps/factory/README.md with the controller command, VXDATA_TOKEN source, kube RBAC needs, Vite proxy target, ports, and a warning that Dispatch mutates the real cluster.
Add a dev target for Factory and make dashboard-frontend:dev depend on the ui-components build so the documented workspace command works from a clean checkout.
Provide a read-only or fixture-backed local mode for UI work. Current realistic rendering requires an administrative production token and Argo access even when the operator does not intend to dispatch.
