Drive agentic chat verification run over WebSocket

What does this MR do and why?

This MR wires the agentic chat verification check run action available for SM instances with a self-hosted DWS/AIGW:

• On Run button click, the CreateFunctionalVerificationWorkflow mutation is triggered. It then uses the worfklowId from the response to open a WebSocket connection via WorfklowStream.
• The check is successful when the stream reports a terminal checkpoint of INPUT_REQUIRED or TOOL_CALL_APPROVAL_REQUIRED. The check failed if it reports a terminal checkpoint of FINISHED, FAILED, or STOPPED. When available, the check surfaces the underlying failure detail from ui_chat_log.
• Handles 3 different WebSocket-layer failure cases:
  • handshake_failed: the WebSocket connection's handshake never completes. The message hints at checking the reverse proxy configuration and ensuring that it supports WebSocket upgrades based on RFH reports [ref].
  • abnormal_close: the connection opens successfully, then closes unexpectedly before a terminal checkpoint arrives. The message includes the close category, code, and server-provided reason when available.
  • timeout: no terminal message or close event ever arrives. A watchdog timer (100 seconds) forces the run to FAILED.

References

Related to #627472 (closed)

Parent epic: #602572 (closed)

How to set up and validate locally

1. Enable the duo_agentic_chat_verification_check feature flag
2. Enable self-hosted models and configure a self-hosted model for the instance.
3. Visit /admin/gitlab_duo as an instance admin.
4. In the Functional verification checks card, select gitlab-duo (or whichever namespace that has DAP enabled) from namespace selector
5. Click run

Case	Steps	Expected
Passed	Select a valid self-hosted model for Agentic Chat in /admin/gitlab_duo/model_selection/features (ex: Claude Sonnet 4.6)	Status badge updates to Passed
Failed with DWS error	Select an outdated self-hosted model for Agentic Chat (ex: Claude Sonnet 3.7).	Status badge updates to Failed. Error message: Error: There was an error processing your request in the Duo Agent Platform, please contact support if the issue persists. View Workhorse logs for more details.
Failed due to WebSocket abnormal_close	Click Run button In the browser console, run gl.dwsMockSocket.close(1006)	Status badge updates to Failed. Error message: Reason: abnormal_close. Connection closed unexpectedly (error, code 1006)
Failed due to WebSocket close with reason	Click Run button In the browser console, run gl.dwsMockSocket.close(4400, 'bad token')	Status badge updates to Failed. Error message: Reason: abnormal_close. Connection closed unexpectedly (error, code 4400): bad token.
Failed due to WebSocket handshake error	Update GDK's nginx config by opening nginx/conf/nginx.conf from the GDK root directory. Intercept the /ws endpoint by adding the following within the server block (before gitlab-workhorse): location /api/v4/ai/duo_workflows/ws { return 502; } Restart GDK: gdk restart In the GitLab Duo admin page, click Run button.	Status badge updates to Failed. Error message: Reason: handshake_failed. No response from the WebSocket connection. If using a reverse proxy, verify it supports WebSocket upgrades.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.