feat(#2): BifrostState pane — GET /admin/sessions/{id}/bifrost (admin-key)

v1 coverage-audit: the last unbuilt design-brief §5 debug widget. First
admin-key consumer in ratatoskr.

- sessions.py: get_session_bifrost(client, session_id, *, admin_key) —
  admin-scoped (admin.sessions.read); the request overrides Authorization
  with admin_key (distinct from the consumer bearer). 200 -> dict, non-200
  -> SessionApiFailed (403 scope-denied, 404 not-bound).
- cli.py: --admin-key flag + RATATOSKR_ADMIN_API_KEY env -> ParsedArgs.admin_key.
- tui.py: new "Bifrost" TabPane + _format_bifrost_state + _hydrate_bifrost_state
  best-effort worker (unconditional on_mount). Writes {endpoint, connected,
  caps, tools} + audits; self-labels "not configured" / "not bound" / graceful
  on 403+error, never crashes.
- Contract #2 amended (FN, incl. the bearer-override POST) + validated. TDD:
  4 wrapper tests + 1 format unit + 3 hydrate integration. Suite 552 green.
- LIVE-AUTH-PROVEN on :8081 (admin key reached resource-layer 404, not 401/403).

Ledger correction: #11 (AdminEvents) is NO LONGER BLOCKED — the admin key
was verified to carry admin.events.read; only the pane is unbuilt. Coverage:
REST 11/40.

docs/contracts/issues/2.contract.md

@@ -280,3 +280,36 @@ TESTS:
   cross_owner_404 [error]: 404 session_not_found → SessionApiFailed(status=404)
   empty_session_id [adversarial]: "" → AssertionError; no HTTP issued
 ```
+
+## Amendment 2026-07-01 — admin BifrostState read (v1 coverage-audit)
+
+Admin-scoped Bifrost dispatch-state read (spec #176, `GET /admin/sessions/{id}/bifrost`),
+surfaced in the TUI BifrostState pane on session-attach. The first admin-key
+consumer in ratatoskr: requires the `admin.sessions.read` scope, so the request
+OVERRIDES the Authorization header with the caller-supplied `admin_key` (distinct
+from the client's default consumer key). Same result-shape convention as the
+other introspection wrappers: 200 → parsed dict verbatim, non-200 → `SessionApiFailed`.
+
+```contract
+FN get_session_bifrost(client: httpx.AsyncClient, session_id: str, *, admin_key: str) -> dict[str, Any]
+BRIEF: GET /admin/sessions/{session_id}/bifrost — admin-scoped live Bifrost binding (spec #176): {endpoint_url, consumer_id, connected, capabilities_granted, tools:[{name, description}]}. Requires admin.sessions.read; the request sets Authorization: Bearer <admin_key> (override), NOT the client's default consumer bearer. Parsed dict verbatim; any non-200 → SessionApiFailed — notably 403 auth_scope_denied and 404 session_not_bifrost_bound.
+PRE: [PRE-001 hard] client is not None -- assert client is not None
+PRE: [PRE-002 hard] session_id is non-empty str -- assert session_id and isinstance(session_id, str)
+PRE: [PRE-003 hard] admin_key is non-empty str -- assert admin_key and isinstance(admin_key, str)
+POST: [POST-001 return_value] on 200 returns resp.json() unmodified -- assert result == resp.json()
+POST: [POST-002 state_change] the outbound request Authorization header == f"Bearer {admin_key}" (override) -- assert request.headers["Authorization"] == "Bearer " + admin_key
+ERROR_ROUTING:
+  HTTP non-200 (incl. 403 auth_scope_denied, 404 session_not_found / session_not_bifrost_bound):
+    local_handling: raise SessionApiFailed(status=resp.status_code, body=resp.content)
+    flow_control: abort
+    state_recovery: none (caller decides: 403 → key lacks scope; 404 not-bound → benign unbound session)
+STEPS:
+  1. [setup, prescriptive] assert PRE-001..PRE-003
+  2. [sequential, prescriptive] resp = await client.get(f"/admin/sessions/{session_id}/bifrost", headers={"Authorization": f"Bearer {admin_key}"})
+  3. [branch, prescriptive] IF resp.status_code == 200: RETURN resp.json(); ELSE RAISE SessionApiFailed
+TESTS:
+  happy_uses_admin_bearer [happy,tracer]: 200 {endpoint_url, connected, capabilities_granted, tools} → dict verbatim; request Authorization == "Bearer <admin_key>" (override)
+  scope_denied_403 [error]: 403 → SessionApiFailed(status=403)
+  not_bound_404 [error]: 404 session_not_bifrost_bound → SessionApiFailed(status=404)
+  empty_admin_key [adversarial]: admin_key="" → AssertionError; no HTTP issued
+```

docs/coverage-map.md

@@ -48,7 +48,7 @@ resolved (§ Surface 1, scope-resolution table).
 
 | Surface | Points | ✅ covered-live | ⬜ gap (in-scope) | 🚫 excluded-by-design |
 |---|---|---|---|---|
-| REST (OpenAPI 2.2.0, path groups) | 40 | 10 | 8 | 22 |
+| REST (OpenAPI 2.2.0, path groups) | 40 | 11 | 7 | 22 |
 | SSE events | 11 | 11 | 0 | 0 |
 | Bifrost provider planes | 8 verbs | 8 | 0 | (10 gated verbs deferred) |
 
@@ -78,6 +78,7 @@ sub-gap).
 | `GET /me` | ✅ | `sessions.py:411` `get_me` → `cli.py` `--whoami` | identity/whoami probe; 401→SessionApiFailed |
 | `GET /capabilities` | ✅ | `sessions.py:428` `get_capabilities` → `cli.py` `--whoami` | Echo ephemeral-template discovery |
 | `GET /sessions/{id}/tools` | ✅ | `sessions.py:411` `get_session_tools` → `tui.py` `_hydrate_session_tools` | owner-scoped tool inventory in the TUI Tools pane (#183) |
+| `GET /admin/sessions/{id}/bifrost` | ✅ | `sessions.py:428` `get_session_bifrost` → `tui.py` `_hydrate_bifrost_state` | admin-scoped BifrostState pane (#176); admin key (`RATATOSKR_ADMIN_API_KEY`); live-auth-proven |
 
 **Sub-gaps inside ✅ path groups** (the method we use is live; a sibling method
 on the same path is an unwired frontier item — see frontier Tier 1):
@@ -95,9 +96,8 @@ on the same path is an unwired frontier item — see frontier Tier 1):
 
 | Endpoint | Status | Why in-scope |
 |---|---|---|
-| `GET /admin/events` | ⬜ | design-brief §5 v1 **AdminEvents pane**; = issue **#11**, **blocked** on `admin.events.read` scope (infra-ops) |
-| `GET /admin/sessions/{id}/bifrost` | ⬜ | design-brief §5 v1 **BifrostState widget** — never built; admin-key-gated |
-| `GET /admin/sessions/{id}/tools` | ⬜ | design-brief §5 v1 **Tools widget** — never built; admin-key-gated |
+| `GET /admin/events` | ⬜ | design-brief §5 v1 **AdminEvents pane** (issue **#11**). **NO LONGER BLOCKED** — the `RATATOSKR_ADMIN_API_KEY` (`ratatoskr-readonly`) verified to carry `admin.events.read` (2026-07-01); pane just unbuilt. The last unbuilt §5 debug pane. |
+| `GET /admin/sessions/{id}/tools` | ⬜ | admin variant of the Tools inventory — **covered-by-alternative** via the owner-scoped `GET /sessions/{id}/tools` (✅); this admin variant remains a gap only for cross-user operator debug |
 | (`GET /sessions` picker · resume) | ⬜ | sub-gaps above — presenter-wiring only, wrappers exist |
 
 **Tier 2 — rounds out I/O coverage under A (postdates the design-brief):**
@@ -205,14 +205,13 @@ starts exercising them.
 
 1. ✅ **DONE** — Session picker (`v0.18.7`) + SSE-resume (`v0.18.5`/`.6`).
 2. ✅ **DONE** — `GET /capabilities` + `GET /me` (`v0.18.8`, `--whoami`).
-3. **BifrostState + Tools widgets** (`GET /admin/sessions/{id}/bifrost` — the
-   admin session-bifrost inspection) — design-brief'd v1, unbuilt. Admin-key-gated.
-   *(The Tools half is effectively covered by the owner-scoped `GET /sessions/{id}/tools`
-   inventory, item 5 — the admin `/admin/sessions/{id}/tools` remains a gap only for
-   cross-user operator debug.)*
-4. **#11 — AdminEvents pane** — **blocked** on an `admin.events.read` scope grant
-   (infra-ops). The single externally-blocked item; everything else can ship
-   without it.
+3. ✅ **DONE** — BifrostState pane (`v0.18.10`, `GET /admin/sessions/{id}/bifrost`,
+   admin-key; live-auth-proven). The Tools half was already covered by the
+   owner-scoped `GET /sessions/{id}/tools` (item 5).
+4. **#11 — AdminEvents pane** (`GET /admin/events`) — **NO LONGER BLOCKED.** The
+   `RATATOSKR_ADMIN_API_KEY` was verified (2026-07-01) to carry `admin.events.read`;
+   the blocker (an admin key with the scope) is already satisfied. Only the pane
+   itself is unbuilt — an SSE-consuming admin pane, the last unbuilt §5 surface.
 
 **Tier 2 — rounds out coverage:**