Summary
PR #264 fixed the AI capability tile to report the resolved backend, not the stored row. The same stored-vs-resolved defect still lives in the MISP and Webhook tiles (src/iceberg/services/effective_config.py:506-507):
{"label": "MISP push", "value": onoff(misp.enabled), "ok": True}, # hard-coded ok, stored flag onlyBoth hard-code ok: True and read only the stored enabled flag. The SSO hub tile has a sibling gap (effective_config.py:290-292, 379-394): its usability check covers client_id + env client_secret but not the provider locator (auth0_domain / authentik_base_url).
Failure scenario
- MISP is enabled with an empty URL or no
ICEBERG_MISP_API_KEY (the send path reads the env key at services/misp.py:238). The /admin hub correctly shows NOT CONFIGURED, while /admin/config — the page an operator opens to debug — shows a green "on" pill for the same subsystem.
- Auth0 enabled with client id + env secret but empty
auth0_domain (the save handler web/admin_oidc.py:98-103 accepts it): metadata_url becomes https:///.well-known/openid-configuration, discovery fails at first login — yet the tile shows "AUTH0" / is-ok.
Suggested fix
Reuse the _integration_tile off→not-configured→enabled logic (as the AI tile now does at effective_config.py:487-496) for MISP and Webhook. Add a provider-locator check to the SSO readiness predicate, ideally as an oidc_settings.validate_provider mirroring ai_settings.validate_selection.
Found in Fable review of PR #232 → HEAD.
Summary
PR #264 fixed the AI capability tile to report the resolved backend, not the stored row. The same stored-vs-resolved defect still lives in the MISP and Webhook tiles (
src/iceberg/services/effective_config.py:506-507):{"label": "MISP push", "value": onoff(misp.enabled), "ok": True}, # hard-coded ok, stored flag onlyBoth hard-code
ok: Trueand read only the storedenabledflag. The SSO hub tile has a sibling gap (effective_config.py:290-292, 379-394): its usability check coversclient_id+ envclient_secretbut not the provider locator (auth0_domain/authentik_base_url).Failure scenario
ICEBERG_MISP_API_KEY(the send path reads the env key atservices/misp.py:238). The/adminhub correctly shows NOT CONFIGURED, while/admin/config— the page an operator opens to debug — shows a green "on" pill for the same subsystem.auth0_domain(the save handlerweb/admin_oidc.py:98-103accepts it):metadata_urlbecomeshttps:///.well-known/openid-configuration, discovery fails at first login — yet the tile shows "AUTH0" / is-ok.Suggested fix
Reuse the
_integration_tileoff→not-configured→enabled logic (as the AI tile now does ateffective_config.py:487-496) for MISP and Webhook. Add a provider-locator check to the SSO readiness predicate, ideally as anoidc_settings.validate_providermirroringai_settings.validate_selection.Found in Fable review of PR #232 → HEAD.