@@ -29,6 +29,7 @@ jobs:
       rules_performance: ${{ steps.scope.outputs.rules_performance }}
       wheels: ${{ steps.scope.outputs.wheels }}
       recovery: ${{ steps.scope.outputs.recovery }}
+      ui: ${{ steps.scope.outputs.ui }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -54,11 +55,12 @@ jobs:
               echo "compiler_differential=$8"
               echo "clickhouse=$9"
               echo "recovery=${10}"
+              echo "ui=${11}"
             } >> "${GITHUB_OUTPUT}"
           }
 
           if [[ "${EVENT_NAME}" != "pull_request" && "${EVENT_NAME}" != "merge_group" ]]; then
-            write_scope true true true true true true true true true true
+            write_scope true true true true true true true true true true true
             exit 0
           fi
 
@@ -70,7 +72,7 @@ jobs:
           if [[ -z "${BASE_SHA}" || -z "${HEAD_SHA}" ]] || \
              ! git diff --name-only -z "${BASE_SHA}...${HEAD_SHA}" > "${changed_paths}"; then
             echo "Could not diff ${BASE_SHA:-<none>}...${HEAD_SHA:-<none>}; running every suite" >&2
-            write_scope true true true true true true true true true true
+            write_scope true true true true true true true true true true true
             exit 0
           fi
 
@@ -116,7 +118,7 @@ jobs:
                 && "${HEAD_REF}" == release-please--branches--* ]] && release_metadata_only; then
             echo "Release Please pull request changes only release metadata; skipping the suites" \
               | tee -a "${GITHUB_STEP_SUMMARY}"
-            write_scope false false false false false false false false false false
+            write_scope false false false false false false false false false false false
             exit 0
           fi
 
@@ -129,6 +131,7 @@ jobs:
           wheels=false
           compiler_differential=false
           recovery=false
+          ui=false
           broad=false
           changed=false
           # A change that only touches the website, root-level Markdown, the README demo GIFs or the
@@ -149,6 +152,13 @@ jobs:
                 wheels=true
                 ;;
             esac
+            case "${path}" in
+              ui/*|clients/typescript/*|.github/workflows/verify.yml)
+                # The web UI is not packaged; its own checks and unit tests cover it. It compiles
+                # against the generated control client, so client changes run them too.
+                ui=true
+                ;;
+            esac
             case "${path}" in
               crates/sqlbuild-orchestration/*|crates/sqlbuild-process-ownership/*|crates/sqlbuild-cli/*|Cargo.toml|Cargo.lock|.github/workflows/verify.yml)
                 recovery=true
@@ -201,6 +211,8 @@ jobs:
                 ;;
               tests/unit/*|tests/integration/*)
                 ;;
+              ui/*)
+                ;;
               .github/workflows/verify.yml|Makefile)
                 performance=true
                 format_performance=true
@@ -215,7 +227,7 @@ jobs:
           done < "${changed_paths}"
 
           if [[ "${changed}" != "true" ]]; then
-            write_scope true true true true true true true true true true
+            write_scope true true true true true true true true true true true
             exit 0
           fi
 
@@ -241,7 +253,8 @@ jobs:
             "${wheels}" \
             "${compiler_differential}" \
             "${clickhouse}" \
-            "${recovery}"
+            "${recovery}" \
+            "${ui}"
 
   lockfile:
     name: Lockfile consistency
@@ -1110,6 +1123,28 @@ jobs:
       - name: Verify packaged Compose deployment and operational recovery
         run: make test-compose-packaged
 
+  ui:
+    name: UI checks and unit tests
+    needs: changes
+    if: needs.changes.outputs.ui == 'true'
+    runs-on: ubuntu-24.04
+    defaults:
+      run:
+        working-directory: ui
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: ui/package-lock.json
+      - name: Install dependencies
+        run: npm ci
+      - name: Type-check
+        run: npm run check
+      - name: Unit tests
+        run: npm test
+
   verify:
     # The required Verify of a Release Please pull request is the commit status that the trusted
     # release checks in release-please.yml post on the branch's current head, after the lockfile
@@ -1145,6 +1180,7 @@ jobs:
         clickhouse,
         wheels,
         compose,
+        ui,
       ]
     runs-on: ubuntu-24.04
     steps:
@@ -1171,6 +1207,8 @@ jobs:
           CLICKHOUSE_RESULT: ${{ needs.clickhouse.result }}
           WHEELS_RESULT: ${{ needs.wheels.result }}
           COMPOSE_RESULT: ${{ needs.compose.result }}
+          UI_SELECTED: ${{ needs.changes.outputs.ui }}
+          UI_RESULT: ${{ needs.ui.result }}
         run: |
           if [[ "${CHANGES_RESULT}" != "success" || "${LOCKFILE_RESULT}" != "success" ]]; then
             echo "Required classification or lockfile checks did not pass" >&2
@@ -1209,4 +1247,9 @@ jobs:
               exit 1
             fi
           done
+          if [[ "${UI_RESULT}" != "success" ]] && \
+             ! [[ "${UI_SELECTED}" != "true" && "${UI_RESULT}" == "skipped" ]]; then
+            echo "Required UI checks did not pass: ${UI_RESULT}" >&2
+            exit 1
+          fi
           echo "All path-relevant verification jobs passed"
@@ -194,6 +194,22 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/control/bootstrap": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["readBootstrap"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/control/locations/{location_id}/targets/{target}/catalog": {
         parameters: {
             query?: never;
@@ -210,6 +226,22 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/control/locations/{location_id}/targets/{target}/changes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["subscribeChanges"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/control/locations/{location_id}/targets/{target}/checks": {
         parameters: {
             query?: never;
@@ -822,6 +854,11 @@ export interface paths {
 export type webhooks = Record<string, never>;
 export interface components {
     schemas: {
+        /**
+         * @description Closed permission vocabulary; unknown actions fail deserialization.
+         * @enum {string}
+         */
+        Action: "view" | "view.sql" | "view.evidence" | "job.run" | "run.cancel" | "run.rerun" | "run.rewrite_history" | "trigger.toggle" | "sensor.reset_cursor" | "run.adhoc" | "connection.test" | "user.manage" | "role.assign" | "audit.view";
         /**
          * @description Administrator membership and person eligibility share the final-admin invariant.
          * @enum {string}
@@ -955,6 +992,11 @@ export interface components {
             /** Format: uuid */
             request_id: string;
         };
+        /** @description What the UI needs first: how people sign in, and what this person may see and do. */
+        ControlBootstrap: {
+            access: components["schemas"]["PersonAccess"];
+            login_mode: components["schemas"]["LoginMode"];
+        };
         /** @description One stretch of the cursor, as raw bound texts. */
         CoverageBatch: {
             end: string;
@@ -1057,6 +1099,14 @@ export interface components {
             target: string;
             window?: null | components["schemas"]["RunWindow"];
         };
+        /** @description One location target the person can view, with the actions allowed on at least one of its nodes. */
+        LocationAccess: {
+            actions: components["schemas"]["Action"][];
+            /** Format: uuid */
+            location_id: string;
+            name: string;
+            target: string;
+        };
         /** @description Locations report bounded facts, never connection strings or user exception text. */
         LocationHealth: {
             /** @enum {string} */
@@ -1166,6 +1216,11 @@ export interface components {
             /** Format: uuid */
             session_id: string;
         };
+        /**
+         * @description How people sign in to this server.
+         * @enum {string}
+         */
+        LoginMode: "password" | "trusted_proxy" | "oidc";
         /** @description Recorded moves, their old-name view steps and janitor cleanups, newest moves first. */
         MaintenanceHistory: {
             /** @description Empty when the history is for one model; cleanups are not tied to models. */
@@ -1292,6 +1347,14 @@ export interface components {
             csrf_token: string;
             identity: components["schemas"]["SessionIdentity"];
         };
+        /** @description The person's name, the actions allowed server-wide, and the location targets they can view. */
+        PersonAccess: {
+            actions: components["schemas"]["Action"][];
+            locations: components["schemas"]["LocationAccess"][];
+            name: string;
+            /** Format: uuid */
+            principal_id: string;
+        };
         /** @description Observed physical evidence is not a live warehouse-existence guarantee. */
         PhysicalEvidence: {
             observation: components["schemas"]["CatalogObservation"];
@@ -2336,6 +2399,32 @@ export interface operations {
             };
         };
     };
+    readBootstrap: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ControlBootstrap"];
+                };
+            };
+            /** @description Session rejected or person disabled */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     readPersonCatalog: {
         parameters: {
             query: {
@@ -2389,6 +2478,43 @@ export interface operations {
             };
         };
     };
+    subscribeChanges: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                location_id: string;
+                target: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description changed events: all, runs, ticks, snapshot:<location>, node_status:<target>. Refetch REST on all/reconnect; no durable cursor. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/event-stream": components["schemas"]["ChangeNotice"];
+                };
+            };
+            /** @description Session rejected or person disabled */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description View does not cover every node of this target */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     listPersonChecks: {
         parameters: {
             query?: never;
 
@@ -5,7 +5,7 @@ use std::net::SocketAddr;
 use axum::{Extension, Router};
 
 use crate::api::_helpers::authentication::{oidc, password_sessions, trusted_proxy};
-use crate::api::models::{ApiAuthentication, DevelopmentScope, GroupRole, HumanLogin};
+use crate::api::models::{ApiAuthentication, DevelopmentScope, GroupRole, HumanLogin, LoginMode};
 use crate::store::errors::ControlError;
 use crate::store::models::ControlStore;
 
@@ -28,6 +28,11 @@ pub(crate) async fn configure(
         HumanLogin::Oidc(settings) => settings.group_roles.clone(),
         _ => Vec::new(),
     };
+    let login_mode = match &login {
+        HumanLogin::Oidc(_) => LoginMode::Oidc,
+        HumanLogin::TrustedProxy(_) => LoginMode::TrustedProxy,
+        _ => LoginMode::Password,
+    };
     let (development, routes) = match login {
         HumanLogin::None => (None, Router::new()),
         HumanLogin::Development(scope) => {
@@ -44,7 +49,9 @@ pub(crate) async fn configure(
     };
     Ok((
         development,
-        routes.layer(Extension(default_role)),
+        routes
+            .layer(Extension(default_role))
+            .layer(Extension(login_mode)),
         group_roles,
     ))
 }
@@ -49,6 +49,14 @@ pub(crate) fn session_routes(store: &ControlStore) -> Router<ControlStore> {
 pub(crate) fn person_routes() -> Router<ControlStore> {
     Router::new()
         .route("/api/auth/cli/approve", post(super::cli_login::approve))
+        .route(
+            "/api/control/bootstrap",
+            get(crate::api::_helpers::resources::person_bootstrap::read),
+        )
+        .route(
+            "/api/control/locations/{location_id}/targets/{target}/changes",
+            get(crate::api::_helpers::resources::changes::subscribe_person),
+        )
         .route(
             "/api/control/audit",
             get(crate::api::_helpers::resources::audit::read),