Skip to content

Skill-shell: embed proxy + okstratr harness registry SSOT client - #9

Open
benjsmith wants to merge 10 commits into
mainfrom
feat/skill-shell-rationalization
Open

benjsmith wants to merge 10 commits into
mainfrom
feat/skill-shell-rationalization

Conversation

@benjsmith

@benjsmith benjsmith commented Sep 18, 2026

Copy link
Copy Markdown
Owner

Summary

  • Daemon same-origin reverse-proxy: /embed/ce/*127.0.0.1:8766, /embed/okstratr/*127.0.0.1:8767, with loopback-only upstream guard and X-CE-Host / X-Okstratr-Host: switchbay.
  • Feature flag proxied_skill_embeds (default off) switches Graph → CE and Agents → okstratr same-document panels via /embed/* (no iframes). Embed v2 same-document mount (ADR-004b).
  • Settings → Harness registry · okstratr (ADR-005): thin client okstratr_harness + daemon routes GET/POST /api/okstratr/harness (enable/disable/set/reload). Writes okstratr harnesses.toml SSOT — no second Switchbay allowlist. Pi/local LLM panels labeled as rail-only.
  • Unit tests: embed proxy + harness client/mapper (mocked okstratr JSON).

Test plan

  • PYTHONPATH=src uv run --no-sync pytest tests/unit/test_embed_proxy.py tests/unit/test_okstratr_harness.py -q
  • Flag off: Graph/Agents unchanged
  • Flag on: panels hit /embed/ce/ and /embed/okstratr/
  • With okstratr up: Settings → Harness registry lists rows; enable/disable/set default model persist in okstratr registry
  • okstratr down → /api/okstratr/harness returns 502 with clear error
  • Non-loopback SWITCHBAY_OKSTRATR_UPSTREAM → 502

Do not merge until Ben reviews E2E evidence (charter).

Daemon proxies /embed/ce/* → 127.0.0.1:8766 and /embed/okstratr/* →
:8767 with loopback-only upstream guard and X-CE-Host /
X-Okstratr-Host: switchbay. Feature-flag Graph/Agents to proxied
same-document panels (default off). ADR-004 + allowlist tests.
Avoid flashing the lazy AgentDashboardTab while /api/settings loads
when proxied embeds are on (that race showed as module script import
failures). Clarify 502 upstream messaging.
Start and health-check curiosity-engine viewer.sh serve for /embed/ce,
restart on death, and rebuild the static bundle when wiki mtime changes.
Toggle via Settings proxied_skill_embeds; supervisor runs as a daemon
background task so Graph does not 502 when the viewer process exits.
ProxiedSkillPanel listens for sy:files-changed (dispatched from the
WS files_changed handler), debounces, and soft-refetches /embed/* with
cache-busting so the panel updates without a full loading flash. CE
supervisor rebuilds on wiki mtime and broadcasts files_changed; embed
proxy forces Cache-Control: no-store so stale HTML shells do not stick.
Ben lock / contract C1+C2 (Switchbay half):
- okstratr_supervisor mirrors CE: spawn `okstratr serve --host/--port`
  (PATH binary or python -m; SWITCHBAY_OKSTRATR_BIN / UPSTREAM overrides),
  health /health, restart on death; pid/log under ~/.local/state/switchbay/
- Daemon on_startup always starts CE + okstratr supervisors (proxied_skill_embeds
  remains UI panel choice only; no longer gates keep-alive or tears down CE)
- GET /api/core-skills/status → {ce, okstratr, wiki_build} contract shape
- POST /api/okstratr/host-notify maps okstratr.host_notify → protocol.notice
  rail broadcast (path-native; no OS/email channel)
- Unit tests for URL/port/argv helpers, notify mapping+HTTP, status shape;
  embed_proxy tests still green
Execute proxied CE/okstratr scripts in-panel (no iframe): rewrite asset
URLs under /embed/*, inject markup, createElement-append classic/module
scripts, tear down on soft-reload. Poll /api/core-skills/status for
starting/unhealthy/building-wiki/live banners and suppress 502 flash
while supervisors are still starting.
Wire Settings → Harness registry (okstratr) through /api/okstratr/harness*
(enable/disable/set/reload) calling loopback upstream with X-Okstratr-Host.
No parallel Switchbay allowlist; Pi/local LLM panels labeled as rail-only.
ADR-005 + tests with mocked okstratr JSON.
@benjsmith

Copy link
Copy Markdown
Owner Author

Harness registry SSOT client (pushed 3c5a9c1)

  • Module switchbay.okstratr_harness — thin client over okstratr list/enable/disable/set/reload (loopback SWITCHBAY_OKSTRATR_UPSTREAM + X-Okstratr-Host: switchbay; browser can also use /embed/okstratr/api/harness…).
  • Routes: GET /api/okstratr/harness, POST …/enable|disable|set|reload.
  • Settings UI: Harness registry · okstratr (list + enable/disable + set default model). Pi/local LLM labeled as rail-only, not desk SSOT.
  • Tests: tests/unit/test_okstratr_harness.py (10 passed). ADR-005 + ADR-004 TODO closed.
  • okbay doc-only note on PR #16 (b806cd8): thin-client pattern pointing at /api/okstratr/host-notify style.

No merge.

@benjsmith benjsmith changed the title Phase 4a: same-origin embed reverse-proxy (no iframes) Skill-shell: embed proxy + okstratr harness registry SSOT client Sep 19, 2026
CE filebrowser only writes .workbench/pack-runs/*.json as queued;
Switchbay now polls (~4s) and exposes POST /api/packs/drain to seat
_dispatch_chat like handle_pack_action. Shared JSON status is rewritten
atomically — no CE PATCH. Tests mock dispatch (no paid model seats).
Thin-shell wiring: Browser/Zen upload posts to CE SSOT
(/embed/ce/api/ingest/from-upload) when the embed proxy is up, with
fallback to local /api/ingest/from-upload.
Parity with pack-runs drain (ADR-006): poll .workbench/ingest-runs/,
POST /api/ingest/drain, opportunistic kick on files_changed. Prefer
deterministic CE local_ingest; escalate to _dispatch_chat only when
run metadata opts in. Refuse vault_path escape / .. components.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant