[adrianwebb]

Outcome

Native API HTTP/router/invoker/worker adapter with real Identity/Admin composition and isolated request principals. Authenticated status/application reads and exact-archive image-context preparation. Missing applications return typed safe HTTP 404; unexpected failures remain 503.

Work authority

• Work item / Issue: feat: Build Task 3B native installed API composition #617
• Proposal / decision: Approved Task 3B architecture, feat: prepare Task 3B installed composition and durable host root platform#713
• Assignment / checkpoint: Maintainer-directed Task 3B review, fixes and integration in this Codex chat.
• Actor: Codex for @adrianwebb
• Human authority: @adrianwebb explicitly requested review, fixes, cordis merges and task-branch cleanup; all issues stay open.
• Agent / capacity provider: Codex / OpenAI
• Exact base ref: cordis dd992c1
• Exact head ref: feature/617-task3b-api-server 0d80374

Contributor mode:

• Agent-authored under human authority

Plan

Owner documentation → outside-in program tests → strict class implementation → owner checks/build → real installed verification → addressed review → cordis integration.

Changes and commits

Native API HTTP/router/invoker/worker adapter with real Identity/Admin composition and isolated request principals. Authenticated status/application reads and exact-archive image-context preparation. Missing applications return typed safe HTTP 404; unexpected failures remain 503.
Review repairs durable documentation links and refreshes exact owner archives, source commits, SHA-256 and lock integrity. Native Cordis remains the lifecycle authority; capabilities stay in their canonical owning repositories.
Includes restored cordis policy and merged container baseline #618. The already-approved policy was restored exactly by #621, without adding identities; this server PR must pass normal base-owned admission. The missing-application regression first reproduced HTTP 503 in the actual authenticated installed scene before the typed 404 mapping.

Verification

• Fresh owner strict check/build and 6 unit/integration/built-program smoke tests passed.
• Current exact-head CI and admission checks read back green.
• Refreshed exact-artifact installed scene (293 assertions) and historical assembled verification (15 tests) passed.
  Exact source/archive/OCI custody is delivered by Platform #718. The actual installed program/browser scene passed after the missing-application HTTP regression fix.

Risk and rollback

Qualified for Ubuntu 26.04 x64/local Unix-socket Docker. Accepted is distinct from ready. Incomplete activation requires explicit repair; generalized recovery remains deferred. Revert through a new reviewed issue-linked cordis PR if necessary. The Platform fixture checks installation labels before resource cleanup; no broad Docker pruning or original service changes.

Completion summary

Review fixes, fresh owner verification, exact-head CI and refreshed assembled verification pass. No Task 3C/3D or production publication. Keep every issue, including platform#678, open until authorized release.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.

Part of #617

Current exact-head checks:

• authorization: success
• validate: success
• verify: success

[adrianwebb]

Current verify and PR-template validation pass. Review #618 first, but hold both PRs on #620: exact cordis base lacks the existing trusted AGPL committer policy. No permission grant, gate waiver or baseline rewrite has been made. This server follow-up is nine incremental files after #618 and the real installed/identity/HTTPS/browser scene passed. Full integration remains blocked until trusted base policy admission is addressed.

[adrianwebb]

Review complete at 0d80374: public/native Cordis contracts and repository boundaries checked, review fixes addressed, exact-head CI/admission green. Fresh owner checks/build/program tests and real installed scene (293 assertions), 15 historical checks and Platform Ubuntu installed CI pass: https://github.com/treeseed-ai/platform/actions/runs/40146085024. Merging only into cordis under maintainer instruction; every issue remains open.