Bring V2 admin Scale settings to parity with the classic page

[Paul Lizer (paullizer)]

Summary

Most of the V2 Admin Settings Scale group was missing from the field schema, so V2 drew only the enable_* switches its fallback scan could guess. Admins could not edit the Redis connection, cache TTLs, Cosmos resource or throughput guardrails in V2, and none of the classic page's operational panels existed. This brings Scale to parity with the classic page in the existing V2 design language: section cards, a capability switch with its dependents nested beneath it, collapsible groups, and links between related sections.

• Redis & Caching: Redis Cache gets its connection settings, a key field that becomes Key Vault Secret Name under Key Vault auth (with a link to Key Vault while that is not set up), and Test Redis connection. Redis Metrics shows health and capacity when scrolled into view, with an inline, read-only Redis Explorer. Conversation Cache gets its TTL and 15-minute activity readouts.
• Cosmos: DAI Metrics shows the always-on index components plus backfill, read and cache metrics; its diagnostics and backfill actions appear only while Document Access Index diagnostics (enable_dai_debug) is on under Operations > Debug Logging, matching the classic page. Cosmos Maintenance shows index and stale-cache status with on-demand runs. Cosmos DB Throughput adds the resource, guardrails, access validation and manual scaling, and Cosmos Metrics is a list-beside-detail container workbench whose policies save with the page.
• Safe operations: applying indexes, deleting stale cache docs, resetting the backfill, and scaling or converting throughput all confirm first, and a scale shows the current RU/s and the estimated target. V2 saves enforce the classic throughput rules, put each error beside the field that broke it, and report RU/s values the server rounds. Container policy timestamps always come from storage, so saving a stale page cannot reset a cooldown.
• Shared plumbing: two generic schema descriptors (label_variants, requires.when), and a "Used by" line on cards that other sections depend on.

Worth a careful look:

• No new routes. V2 calls the existing admin-guarded APIs (redis-monitoring, redis-explorer, app-maintenance, cosmos-throughput). A parity test pins their paths, methods and guards against route_backend_settings.py, and the maintenance request bodies against admin_settings.js.
• Shared with V1: functions_cosmos_throughput.py gains collect_cosmos_throughput_policy_errors, which returns structured errors. validate_cosmos_throughput_policy_settings, which V1 calls, now wraps it and returns the same messages as before.
• Browser mirrors: the page mirrors the policy rules and the manual-scale target so it can explain a change before sending it. The server stays authoritative, and the mirrors are tested against cases generated from the Python functions.
• DAI diagnostics gate: the diagnostics fields depend on the enable_dai_debug key, the switch the V2 Operations work declared under Debug Logging, so they appear as soon as it is turned on. Scale itself has no toggle for it.
• Section links: prerequisite links use the base's navigateToSetting from Add the Governance group to V2 Admin Settings #1680, which leads to the section owning a hidden target's condition. The "Used by" line links through the same function.
• Suppressed keys: the four always-on DAI flags (forced to true on every read and write) no longer get fallback switches, which reverted on save.
• Shared section helpers: collectRequirements, deriveSectionStatus, computeSectionStatus and buildSectionDependents take the base's fieldsByKey and then runtimeFlags.
• Seeded default: redis_auth_type now seeds 'key' instead of ''. Every reader already treats an empty value as key auth, so runtime behavior is unchanged.
• Deliberate difference from V1: Validate access keeps what it read with its result instead of replacing the status panel, because it reads unsaved values that may name another target. Manual changes always estimate from the saved target.

Screenshots (UI test fixture, synthetic data)

Redis Cache with Key Vault authentication selected: the Key Vault prerequisite, and "Used by" on both cards

Redis Metrics with the inline Redis Explorer

Confirming a manual scale

Cosmos Metrics workbench with a container policy edited in place

Linked issue

N/A (no tracking issue for this work)

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Synced with paullizer-react-v2-ui at 485d51aa by merge commit 8d3024e2 and renumbered to 0.261.274, because the Governance group (#1680) took 0.261.273.

Testing / validation

Run from the repo root in PowerShell with $env:PYTHONDONTWRITEBYTECODE="1", on the merge result committed as 8d3024e2:

• npx tsc -b --noEmit (in application/v2_ui): passed
• npm run build (in application/v2_ui): passed
• python -m pytest (Get-ChildItem functional_tests -Filter "test_v2_admin_*.py").FullName functional_tests/test_cosmos_throughput_autoscale_logic.py functional_tests/test_pytest_return_false_guard.py functional_tests/test_search_result_cache_admin_setting.py functional_tests/test_ai_connection_embedding_defaults_api.py functional_tests/test_content_screening_admin_settings_fix.py -p no:cacheprovider -q: 436 passed, 12 failed. All 12 fail identically on the base 485d51aa and are unrelated to Scale: test_v2_admin_security_parity.py::test_every_v1_security_field_is_claimed (unclaimed chat_content_settings_present marker), test_v2_admin_settings_schema.py::test_defaults_match_their_field_type (m365_trusted_download_hosts default []), test_v2_admin_settings_rail_collapse.py::test_the_rail_collapses_to_labelled_icons (disabled={delegationDirty} assertion), and 9 checks in test_ai_connection_embedding_defaults_api.py.
• python -m pytest (Get-ChildItem ui_tests -Filter "test_v2_admin_*.py").FullName -p no:cacheprovider -q: 159 passed across all 14 V2 admin UI suites, including Governance (local Chromium)
• python -m pytest functional_tests/route_tests/test_route_blueprint_policy_inventory.py functional_tests/route_tests/test_route_unauthenticated_policy_contract.py functional_tests/route_tests/test_route_policy_test_coverage.py -p no:cacheprovider -q: 21 passed
• python scripts/build_docs_inventory.py --check: inventory in sync
• python functional_tests/test_docs_app_surface_coverage.py: 7/7 passed
• python functional_tests/test_docs_site_quality.py: 6/6 passed
• Not run: functional_tests/route_tests/test_workflow_*_policy.py. They fail at import on this machine (import OpenSSL raises AttributeError: module 'lib' has no attribute 'GEN_EMAIL', a local pyOpenSSL/cryptography mismatch), and this change touches no workflow code.
• Manual: reverting the capacity-change guard fails the double-submit check in test_v2_admin_scale_settings.py. An automated review found three issues, all fixed with coverage: a second scale could be sent while the status refreshed, policy inputs rewrote half-typed numbers, and Validate access replaced the status that manual changes estimate from. Playwright screenshots were reviewed at desktop and 390px widths, light and dark, and XL text.

New tests: test_v2_admin_scale_parity.py (17), test_v2_admin_scale_normalization.py (13), test_v2_admin_scale_logic.py with test_v2_admin_scale_logic.ts (18 checks, browser mirrors against generated Python cases), and ui_tests/test_v2_admin_scale_settings.py (15).

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Release notes: new v0.261.274 section. Feature doc: docs/explanation/features/V2_ADMIN_SCALE_SETTINGS.md. Admin docs: docs/admin/scale.md rewritten to cover every Scale setting, readout and action. No fix doc is needed: this PR carries no bug fix of its own.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) (no new routes)
• Settings sent to non-admin frontends use sanitize_settings_for_user() (admin-only surface; redis_key is a declared secret, so V2 receives only the redaction placeholder)
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included