Ridge Admin

Ridge Admin is the Ridge-native browser administration workbench. A local seed backend owns HTTP sessions, database pools, SSH transports, SQL execution, transactions, temporary exports, secrets, and cleanup. The browser never connects directly to Ridge or SSH.

Current identity: 0.1.0+contract.3, professional preview.

Local Ridge by default

Native packages include ridge-admin, ridged, runtime libraries, and the macOS or Linux service definition. The UI always exposes a built-in Local Ridge profile for 127.0.0.1:7898, database and user ridge, and automatically connects when the bundled service is ready.

Connections

Ridge Admin supports:

• local pgwire connection pools;
• remote loopback Ridge through native SSH direct-tcpip;
• strict or explicit accept-new host verification;
• Ed25519 key, password, passphrase, or agent authentication;
• tunneled cancellation and one reconnect attempt without SQL replay.

Profiles persist endpoint metadata only. Credentials remain in zeroized process memory while required and are never written to the profile store.

Object explorer

The explorer lists the configured database, the synthetic public compatibility schema, tables, columns, indexes, and constraints. Ridge does not have a native multi-schema catalog; the UI labels compatibility objects honestly.

SQL workbench

Independent tabs provide bounded history, result limits, explicit autocommit or manual transactions, structured errors, cancellation, and transaction state. After a disconnect, a mutating or manual query with a lost response is marked uncertain and is never replayed automatically.

Data editor

The editor provides deterministic paging, up to four typed AND/OR filters, durable bounded drafts, inserts, conflict-aware updates, deletes, and one transaction atomic save. CSV import joins the staged save and is bounded to 1 MiB and 10,000 rows. Server-spooled export is bounded to 1,000,000 rows and 1 GiB and defends against spreadsheet formula injection.

Editable types currently include integer aliases, text, bytea, boolean, date, and timestamp. Double and decimal remain inspectable but read-only until lossless mutation parameters are available.

Operations and security

Capability-driven controls expose integrity, verified named backup, offline non-overwriting restore guidance, vacuum, activity, and redacted diagnostics. Backup is visible only when ridged has an operator-controlled backup root.

The web server binds loopback and uses a one-time fragment exchange, HTTP-only same-site session cookie, per-session CSRF token, exact Host/Origin checks, CSP, no-store responses, bounded parsing, and coordinated shutdown.

Platform status

The supported automated browser contract is Chromium headless through Playwright. Firefox and WebKit are not release requirements. Manual screen-reader and privileged macOS LaunchDaemon lifecycle evidence remain separate gaps.