infinicode 2.3.6 → 2.5.0

package/dist/kernel/federation/federation.d.ts

@@ -11,13 +11,14 @@
  * (heartbeat / task.dispatch / command / config / update).
  */
 import type { Capability, KernelLike, Logger } from '../types.js';
-import type { HardwareSnapshot, NodeIdentity, NodeStatus, PeerInfo, SharedConfig, StreamFrame } from './types.js';
+import type { HardwareSnapshot, NodeIdentity, NodeManifest, NodeStatus, PeerInfo, SharedConfig, StreamFrame } from './types.js';
 import { ConfigSync } from './config-sync.js';
 import { AutoUpdate } from './auto-update.js';
 import { ComputeRouter, type ComputeNeed } from './compute-router.js';
 import { type ManifestInputs } from './node-identity.js';
 import { type AgentHandle, type RoleContext, type RunRecord } from './types.js';
 import { AgentBackendRegistry, type BackendId } from '../agents/index.js';
+import { loadCoderConfig, type CoderConfig } from '../agents/backends/profiles.js';
 export interface DispatchTask {
     description: string;
     capabilities: Capability[];
@@ -34,6 +35,14 @@ export interface DispatchTask {
     sessionId?: string;
     /** Model hint passed to a CLI backend (provider/model or a CLI-native id). */
     model?: string;
+    /** Named coder profile to run (e.g. "deep", "cheap"). */
+    profile?: string;
+    /** Rotation strategy: 'auto' | 'tasktype' | 'policy' | 'roundrobin' | 'fallback'. */
+    strategy?: string;
+    /** Policy tier: 'free-first' | 'cheapest' | 'fastest' | 'highest-quality' | 'balanced'. */
+    policy?: string;
+    /** Task-type key for routing (e.g. 'refactor', 'docs', 'bulk'). */
+    taskType?: string;
 }
 export interface FederationOptions {
     version: string;
@@ -51,6 +60,51 @@ export interface FederationOptions {
     autoPullConfig?: boolean;
     /** Satellite: how often to re-pull shared config (ms, default 30000; 0 disables). */
     configPullMs?: number;
+    /** Coder profiles + rotation config (from node config `coder`). Merged over
+     *  built-in defaults, so the mesh rotates across backends out of the box. */
+    coder?: Parameters<typeof loadCoderConfig>[0];
+    /** Serve the web control dashboard at GET / and /ui (off unless enabled). */
+    dashboard?: boolean;
+    /** Publish this node's shared config to the fleet (backs POST /fed/apply +
+     *  the dashboard's "Apply config to fleet" button). */
+    onApply?: () => Promise<unknown> | unknown;
+    /** Gate remote/dashboard slash-commands. Returns {ok:false,reason} to reject —
+     *  used to keep an unauthenticated, network-exposed node read-only. */
+    commandGate?: (input: string) => {
+        ok: boolean;
+        reason?: string;
+    };
+    /** TLS material — when set, the node + dashboard are served over HTTPS. */
+    tls?: {
+        cert: Buffer;
+        key: Buffer;
+    };
+    /** RoboPark scheduler base URL — proxied under /robopark/* for the dashboard. */
+    schedulerUrl?: string;
+    /** Bearer token presented to the scheduler on proxied requests. */
+    schedulerToken?: string;
+    /** Refuse write actions through the scheduler proxy (read-only console). */
+    schedulerReadOnly?: boolean;
+}
+/** Consolidated fleet view served at GET /fed/status. */
+export interface FleetStatus {
+    self: NodeManifest;
+    role: RoleContext | null;
+    nodes: NodeStatus[];
+    hardware?: HardwareSnapshot;
+    runs: RunRecord[];
+    agents: AgentHandle[];
+    activity: Array<{
+        peerId: string;
+        f: StreamFrame;
+    }>;
+    /** Console capabilities for the dashboard: whether control writes are allowed
+     *  on this node and whether a RoboPark scheduler is linked. */
+    control: {
+        readonly: boolean;
+        schedulerLinked: boolean;
+    };
+    ts: number;
 }
 export interface FederationDeps {
     kernel: KernelLike;
@@ -83,6 +137,10 @@ export declare class Federation {
     readonly compute: ComputeRouter;
     /** Executors available on this node (native kernel + installed CLIs). */
     readonly backends: AgentBackendRegistry;
+    /** Resolved coder profiles + rotation policy for this node. */
+    readonly coderConfig: CoderConfig;
+    /** Per-node round-robin cursor for backend rotation. */
+    private readonly rotationState;
     /** Local subscribers to the merged mesh frame stream (for MCP stream_activity). */
     private frameSubs;
     /** Recent frames for catch-up. */
@@ -110,6 +168,20 @@ export declare class Federation {
      * is captured on the RunRecord so the run can be followed and later messaged.
      */
     private runViaBackend;
+    /** Stream one backend's frames up the mesh, tagged with the backend id. */
+    private backendFrameSink;
+    /** Run a single backend attempt. Never throws — a missing/unavailable backend
+     *  returns a failed result so a rotation chain can fall through to the next. */
+    private runBackendOnce;
+    /** Write a backend result onto the run record. */
+    private writeResult;
+    /**
+     * Resolve a rotation chain for the task and run it with fallback: try each
+     * profile's backend in order, streaming its activity; the first `completed`
+     * wins, otherwise fall through to the next. Composes task-type routing, policy
+     * tiers, round-robin and fallback (see agents/backends/rotation.ts).
+     */
+    private runViaBackendChain;
     /**
      * Hand a task to the best-fit connected peer (compute-routed) or a named one.
      * Non-blocking by default — returns a runId to follow. Pass wait to block
@@ -203,6 +275,8 @@ export declare class Federation {
     /** Neutral node-status list (self + peers) — feeds the mesh map. */
     nodeStatuses(): NodeStatus[];
     peers(): PeerInfo[];
+    /** Consolidated fleet view for the dashboard + `robopark fleet` (GET /fed/status). */
+    statusSnapshot(): FleetStatus;
     /** Latest local hardware snapshot (for the MOLTFED connector / panels). */
     latestHardware(): HardwareSnapshot | undefined;
     /** Subscribe to the merged mesh frame stream (local + peer frames). */

package/dist/kernel/federation/federation.js

@@ -1,4 +1,5 @@
 import { MeshServer, MeshClient } from './transport-http.js';
+import { DASHBOARD_HTML } from './dashboard-html.js';
 import { PeerMesh } from './peer-mesh.js';
 import { EventBridge } from './event-bridge.js';
 import { ConfigSync } from './config-sync.js';
@@ -12,6 +13,8 @@ import { discoverTailscalePeers } from './discovery.js';
 import { LanBeacon } from './lan-discovery.js';
 import { DEFAULT_MESH_PORT } from './types.js';
 import { createDefaultBackendRegistry } from '../agents/index.js';
+import { RotationState, selectChain } from '../agents/backends/rotation.js';
+import { loadCoderConfig } from '../agents/backends/profiles.js';
 export class Federation {
     deps;
     server;
@@ -33,6 +36,10 @@ export class Federation {
     compute = new ComputeRouter();
     /** Executors available on this node (native kernel + installed CLIs). */
     backends;
+    /** Resolved coder profiles + rotation policy for this node. */
+    coderConfig;
+    /** Per-node round-robin cursor for backend rotation. */
+    rotationState = new RotationState();
     /** Local subscribers to the merged mesh frame stream (for MCP stream_activity). */
     frameSubs = new Set();
     /** Recent frames for catch-up. */
@@ -45,6 +52,7 @@ export class Federation {
         this.deps = deps;
         this.client = new MeshClient({ token: deps.options.token });
         this.backends = deps.backends ?? createDefaultBackendRegistry();
+        this.coderConfig = loadCoderConfig(deps.options.coder);
         this.configSync = new ConfigSync({ logger: deps.logger, apply: deps.options.applyConfig });
         this.autoUpdate = new AutoUpdate({
             version: deps.options.version,
@@ -65,7 +73,15 @@ export class Federation {
             logger,
             getManifest: () => buildManifest(identity, this.describeWithBackends()),
             getNodes: () => this.nodeStatuses(),
+            getStatus: () => this.statusSnapshot(),
             runCommand: (input) => this.deps.kernel.command(input),
+            commandGate: options.commandGate,
+            onApply: options.onApply,
+            dashboardHtml: options.dashboard ? DASHBOARD_HTML : undefined,
+            tls: options.tls,
+            schedulerUrl: options.schedulerUrl,
+            schedulerToken: options.schedulerToken,
+            schedulerReadOnly: options.schedulerReadOnly,
             onRpc: (env, remote) => this.onRpc(env, remote),
         });
         await this.server.start();
@@ -81,9 +97,15 @@ export class Federation {
         });
         this.mesh.start();
         // Bridge local kernel events → mesh stream (coalesced, animation-friendly).
+        // Also record into frameHistory so this node's own activity shows up in the
+        // /fed/status snapshot the dashboard + `robopark fleet` poll — not just in
+        // the live SSE push to connected harnesses.
         this.bridge = new EventBridge({
             nodeId: identity.nodeId,
-            emit: f => this.server?.broadcast(f),
+            emit: f => {
+                this.server?.broadcast(f);
+                this.ingestFrame(identity.nodeId, f);
+            },
         });
         this.unsub = this.deps.kernel.subscribeAll(e => this.bridge?.handle(e));
         // Telemetry heartbeat → stream a HardwareSnapshot on a fixed cadence.
@@ -234,11 +256,17 @@ export class Federation {
         if (!rec)
             return;
         const nodeId = this.deps.identity.nodeId;
-        const backendId = task.agent && task.agent !== 'kernel' ? task.agent : null;
-        rec.agent = backendId ?? 'kernel';
+        // Rotation is requested when a profile/strategy/route/policy is given, or the
+        // caller asks for 'auto'. Otherwise a concrete agent is a single fixed backend.
+        const wantsRotation = !!(task.profile || task.strategy || task.taskType || task.policy || task.agent === 'auto');
+        const backendId = task.agent && task.agent !== 'kernel' && task.agent !== 'auto' ? task.agent : null;
+        rec.agent = wantsRotation ? 'rotate' : (backendId ?? 'kernel');
         this.server?.broadcast(frame('ev', nodeId, { k: 'RUN_STARTED', run: runId, desc: task.description, agent: rec.agent }));
         try {
-            if (backendId) {
+            if (wantsRotation) {
+                await this.runViaBackendChain(runId, task, rec);
+            }
+            else if (backendId) {
                 await this.runViaBackend(runId, backendId, task, rec);
             }
             else {
@@ -263,31 +291,82 @@ export class Federation {
      * is captured on the RunRecord so the run can be followed and later messaged.
      */
     async runViaBackend(runId, backendId, task, rec) {
+        const res = await this.runBackendOnce(runId, backendId, task, task.model);
+        this.writeResult(rec, runId, backendId, res);
+    }
+    /** Stream one backend's frames up the mesh, tagged with the backend id. */
+    backendFrameSink(runId, backendId) {
+        const nodeId = this.deps.identity.nodeId;
+        return (f) => {
+            if (f.kind === 'log' && f.text) {
+                this.server?.broadcast(frame('log', nodeId, { run: runId, agent: backendId, line: f.text }));
+            }
+            else {
+                this.server?.broadcast(frame('ev', nodeId, { k: 'AGENT_OUTPUT', run: runId, agent: backendId, kind: f.kind, text: f.text }));
+            }
+        };
+    }
+    /** Run a single backend attempt. Never throws — a missing/unavailable backend
+     *  returns a failed result so a rotation chain can fall through to the next. */
+    async runBackendOnce(runId, backendId, task, model, args) {
         const backend = this.backends.get(backendId);
         if (!backend || !backend.available()) {
-            throw new Error(`backend not available on this node: ${backendId}`);
+            return { status: 'failed', error: `backend not available on this node: ${backendId}` };
         }
-        const nodeId = this.deps.identity.nodeId;
-        const localRole = loadRole();
-        const preamble = rolePreamble(localRole);
-        const res = await backend.run({ prompt: task.prompt, capabilities: task.capabilities, model: task.model, sessionId: task.sessionId }, {
-            runId,
-            rolePreamble: preamble,
-            onFrame: f => {
-                if (f.kind === 'log' && f.text) {
-                    this.server?.broadcast(frame('log', nodeId, { run: runId, agent: backendId, line: f.text }));
-                }
-                else {
-                    this.server?.broadcast(frame('ev', nodeId, { k: 'AGENT_OUTPUT', run: runId, agent: backendId, kind: f.kind, text: f.text }));
-                }
-            },
-        });
+        const preamble = rolePreamble(loadRole());
+        try {
+            return await backend.run({ prompt: task.prompt, capabilities: task.capabilities, model: model ?? task.model, args, sessionId: task.sessionId }, { runId, rolePreamble: preamble, onFrame: this.backendFrameSink(runId, backendId) });
+        }
+        catch (err) {
+            return { status: 'failed', error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    /** Write a backend result onto the run record. */
+    writeResult(rec, runId, backendId, res) {
+        rec.agent = backendId;
         rec.status = res.status;
         rec.sessionId = res.sessionId;
         rec.missionId = res.sessionId ?? runId;
         rec.outputs = [{ status: res.status, content: res.content, error: res.error }];
-        if (res.status === 'failed' && res.error)
-            rec.error = res.error;
+        rec.error = res.status === 'failed' ? res.error : undefined;
+    }
+    /**
+     * Resolve a rotation chain for the task and run it with fallback: try each
+     * profile's backend in order, streaming its activity; the first `completed`
+     * wins, otherwise fall through to the next. Composes task-type routing, policy
+     * tiers, round-robin and fallback (see agents/backends/rotation.ts).
+     */
+    async runViaBackendChain(runId, task, rec) {
+        const nodeId = this.deps.identity.nodeId;
+        const req = {
+            strategy: task.strategy,
+            profile: task.profile,
+            model: task.model,
+            taskType: task.taskType,
+            policy: task.policy,
+            backend: task.agent && task.agent !== 'auto' && task.agent !== 'kernel' ? task.agent : undefined,
+        };
+        const chain = selectChain(this.coderConfig, req, this.rotationState);
+        let last = { status: 'failed', error: 'no backend available in rotation chain' };
+        for (let i = 0; i < chain.length; i++) {
+            const step = chain[i];
+            this.server?.broadcast(frame('ev', nodeId, {
+                k: 'ROTATION_ATTEMPT', run: runId, agent: step.backend, model: step.model,
+                profile: step.profileName, attempt: i + 1, of: chain.length,
+            }));
+            last = await this.runBackendOnce(runId, step.backend, task, step.model, step.args);
+            if (last.status === 'completed') {
+                this.writeResult(rec, runId, step.backend, last);
+                return;
+            }
+            if (i < chain.length - 1) {
+                this.server?.broadcast(frame('ev', nodeId, {
+                    k: 'ROTATION_FALLBACK', run: runId, from: step.backend,
+                    next: chain[i + 1].backend, reason: (last.error ?? '').slice(0, 200),
+                }));
+            }
+        }
+        this.writeResult(rec, runId, chain[chain.length - 1]?.backend ?? 'kernel', last);
     }
     // ── Outbound operations ──────────────────────────────────────────────────
     /**
@@ -585,13 +664,30 @@ export class Federation {
             version: d.version,
             capabilities: d.capabilities,
             commands: d.commands,
-        });
+        }, loadRole()?.site);
         const peers = (this.mesh?.list() ?? []).map(nodeStatusFromPeer);
         return [self, ...peers];
     }
     peers() {
         return this.mesh?.list() ?? [];
     }
+    /** Consolidated fleet view for the dashboard + `robopark fleet` (GET /fed/status). */
+    statusSnapshot() {
+        return {
+            self: buildManifest(this.deps.identity, this.describeWithBackends()),
+            role: this.getRole(),
+            nodes: this.nodeStatuses(),
+            hardware: this.lastHw,
+            runs: this.localRuns(),
+            agents: this.localAgents(),
+            activity: this.recentFrames(60),
+            control: {
+                readonly: Boolean(this.deps.options.schedulerReadOnly),
+                schedulerLinked: Boolean(this.deps.options.schedulerUrl),
+            },
+            ts: Date.now(),
+        };
+    }
     /** Latest local hardware snapshot (for the MOLTFED connector / panels). */
     latestHardware() {
         return this.lastHw;

package/dist/kernel/federation/moltfed-adapter.js

@@ -17,6 +17,7 @@ export function toNodesStatus(statuses) {
             // extra infinicode fields are ignored by InfiniBot but useful to richer UIs
             role: s.role,
             load: s.load,
+            site: s.site,
         })),
     };
 }

package/dist/kernel/federation/telemetry.d.ts

@@ -18,4 +18,4 @@ export declare function selfNodeStatus(identity: NodeIdentity, hw: HardwareSnaps
     version: string;
     capabilities: NodeStatus['capabilities'];
     commands: string[];
-}): NodeStatus;
+}, site?: string): NodeStatus;

package/dist/kernel/federation/telemetry.js

@@ -120,7 +120,7 @@ export function nodeStatusFromPeer(peer) {
     };
 }
 /** Local node's own status entry. */
-export function selfNodeStatus(identity, hw, manifest) {
+export function selfNodeStatus(identity, hw, manifest, site) {
     return {
         nodeId: identity.nodeId,
         displayName: identity.displayName,
@@ -134,5 +134,6 @@ export function selfNodeStatus(identity, hw, manifest) {
         connectedAtMs: Date.now(),
         load: loadFromSnapshot(hw),
         lastSeenAt: Date.now(),
+        site,
     };
 }

package/dist/kernel/federation/transport-http.d.ts

@@ -9,9 +9,37 @@ export interface MeshServerOptions {
     getManifest: () => NodeManifest;
     /** Optional: full mesh view (self + peers) for the GET /fed/nodes probe. */
     getNodes?: () => unknown;
+    /** Optional: consolidated fleet snapshot (self + nodes + hardware + roles +
+     *  runs + recent activity) for the dashboard and `robopark fleet` (GET /fed/status). */
+    getStatus?: () => unknown;
     /** Optional: run a kernel slash-command on this node (POST /fed/command).
-     *  Powers the in-TUI mesh command palette. */
+     *  Powers the in-TUI mesh command palette + the dashboard's action buttons. */
     runCommand?: (input: string) => Promise<unknown>;
+    /** Optional gate on POST /fed/command inputs. Returns {ok:false,reason} to
+     *  reject — used to keep an unauthenticated, network-exposed node read-only. */
+    commandGate?: (input: string) => {
+        ok: boolean;
+        reason?: string;
+    };
+    /** Optional: publish this node's shared config to the fleet (POST /fed/apply). */
+    onApply?: () => Promise<unknown> | unknown;
+    /** Optional: static HTML for the control dashboard, served at GET / and /ui. */
+    dashboardHtml?: string;
+    /** Optional TLS — when set, the node serves HTTPS/WSS instead of plain HTTP. */
+    tls?: {
+        cert: Buffer;
+        key: Buffer;
+    };
+    /** Optional: base URL of the RoboPark scheduler. When set, the node proxies
+     *  GET/POST /robopark/* to it so the dashboard can show sessions + telemetry
+     *  (product data) alongside the mesh. */
+    schedulerUrl?: string;
+    /** Optional bearer token to present to the scheduler on proxied requests. */
+    schedulerToken?: string;
+    /** When true, only GET/HEAD are proxied to the scheduler — write actions
+     *  (end-session, production_mode toggle, trigger) are refused. Set for a
+     *  network-exposed, tokenless node so the operator console stays read-only. */
+    schedulerReadOnly?: boolean;
     onRpc: RpcHandler;
     logger: Logger;
 }
@@ -23,8 +51,13 @@ export declare class MeshServer {
     constructor(opts: MeshServerOptions);
     get streamCount(): number;
     start(): Promise<void>;
+    /** Proxy a dashboard request to the RoboPark scheduler (product data). */
+    private proxyToScheduler;
     /** Push a frame to every connected stream subscriber. */
     broadcast(frame: StreamFrame): void;
+    /** Token presented on a request — Bearer header (peers/CLI) OR ?token= query
+     *  (browsers, which can't set headers on navigation or EventSource). */
+    private presentedToken;
     private authOk;
     private handle;
     private openStream;

package/dist/kernel/federation/transport-http.js

@@ -14,7 +14,17 @@
  * MeshClient/MeshServer shape later for deep InfiniBot-fabric interop.
  */
 import { createServer } from 'node:http';
+import { createServer as createHttpsServer } from 'node:https';
+import { timingSafeEqual } from 'node:crypto';
 import { frameToSSE, parseSSE } from './protocol.js';
+/** Constant-time string compare — avoids leaking the token via response timing. */
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
 export class MeshServer {
     opts;
     server;
@@ -27,7 +37,10 @@ export class MeshServer {
         return this.sse.size;
     }
     async start() {
-        this.server = createServer((req, res) => this.handle(req, res));
+        const handler = (req, res) => this.handle(req, res);
+        this.server = this.opts.tls
+            ? createHttpsServer({ cert: this.opts.tls.cert, key: this.opts.tls.key }, handler)
+            : createServer(handler);
         await new Promise((resolve, reject) => {
             this.server.once('error', reject);
             this.server.listen(this.opts.port, this.opts.host ?? '0.0.0.0', () => {
@@ -35,7 +48,34 @@ export class MeshServer {
                 resolve();
             });
         });
-        this.opts.logger.info(`[federation] mesh listening on ${this.opts.host ?? '0.0.0.0'}:${this.opts.port}`);
+        const scheme = this.opts.tls ? 'https' : 'http';
+        this.opts.logger.info(`[federation] mesh listening on ${scheme}://${this.opts.host ?? '0.0.0.0'}:${this.opts.port}`);
+    }
+    /** Proxy a dashboard request to the RoboPark scheduler (product data). */
+    proxyToScheduler(req, res, path) {
+        const base = this.opts.schedulerUrl.replace(/\/+$/, '');
+        // strip the /robopark prefix; forward the rest (incl. query) to the scheduler
+        const rest = path.replace(/^\/robopark/, '') || '/';
+        const target = `${base}${rest}`;
+        this.readBody(req)
+            .then(async (body) => {
+            const headers = { 'content-type': req.headers['content-type'] ?? 'application/json' };
+            if (this.opts.schedulerToken)
+                headers['authorization'] = `Bearer ${this.opts.schedulerToken}`;
+            const upstream = await fetch(target, {
+                method: req.method,
+                headers,
+                body: req.method === 'GET' || req.method === 'HEAD' ? undefined : body,
+                signal: AbortSignal.timeout(10_000),
+            });
+            const text = await upstream.text();
+            res.writeHead(upstream.status, { 'content-type': upstream.headers.get('content-type') ?? 'application/json' });
+            res.end(text);
+        })
+            .catch(err => {
+            res.writeHead(502, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ ok: false, error: `scheduler unreachable: ${err instanceof Error ? err.message : String(err)}` }));
+        });
     }
     /** Push a frame to every connected stream subscriber. */
     broadcast(frame) {
@@ -51,19 +91,86 @@ export class MeshServer {
             }
         }
     }
+    /** Token presented on a request — Bearer header (peers/CLI) OR ?token= query
+     *  (browsers, which can't set headers on navigation or EventSource). */
+    presentedToken(req) {
+        const h = req.headers['authorization'];
+        if (typeof h === 'string' && h.startsWith('Bearer '))
+            return h.slice(7);
+        const url = req.url ?? '';
+        const q = url.indexOf('?');
+        if (q >= 0) {
+            const t = new URLSearchParams(url.slice(q + 1)).get('token');
+            if (t)
+                return t;
+        }
+        return undefined;
+    }
     authOk(req) {
         if (!this.opts.token)
             return true;
-        const h = req.headers['authorization'];
-        return typeof h === 'string' && h === `Bearer ${this.opts.token}`;
+        const presented = this.presentedToken(req);
+        return presented !== undefined && safeEqual(presented, this.opts.token);
     }
     handle(req, res) {
         const url = req.url ?? '/';
+        const path = url.split('?', 1)[0];
         if (!this.authOk(req)) {
             res.writeHead(401).end('unauthorized');
             return;
         }
         const remote = req.socket.remoteAddress ?? 'unknown';
+        // Control dashboard (single self-contained page). Same-origin fetches carry
+        // the ?token= through, so no CORS is opened.
+        if (req.method === 'GET' && (path === '/' || path === '/ui' || path === '/dashboard')) {
+            if (!this.opts.dashboardHtml) {
+                res.writeHead(404).end('dashboard not enabled (start with --dashboard)');
+                return;
+            }
+            res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+            res.end(this.opts.dashboardHtml);
+            return;
+        }
+        if (req.method === 'GET' && path === '/fed/status') {
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify(this.opts.getStatus?.() ?? {}));
+            return;
+        }
+        // RoboPark product data (sessions, telemetry, robots) — proxied to the
+        // scheduler so the dashboard is one pane of glass. Already token-gated above.
+        if (path.startsWith('/robopark/')) {
+            if (!this.opts.schedulerUrl) {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, disabled: true, error: 'no scheduler linked — start with --scheduler-url' }));
+                return;
+            }
+            // Keep a network-exposed, tokenless node read-only: mesh writes are gated
+            // by commandGate; the scheduler proxy is the product-side equivalent.
+            const method = (req.method ?? 'GET').toUpperCase();
+            if (this.opts.schedulerReadOnly && method !== 'GET' && method !== 'HEAD') {
+                res.writeHead(403, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, readonly: true, error: 'this node is network-exposed without a token — control actions are disabled. Restart with --token <secret> to enable them.' }));
+                return;
+            }
+            this.proxyToScheduler(req, res, path);
+            return;
+        }
+        if (req.method === 'POST' && path.startsWith('/fed/apply')) {
+            if (!this.opts.onApply) {
+                res.writeHead(404).end('no apply handler');
+                return;
+            }
+            Promise.resolve(this.opts.onApply())
+                .then(result => {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify(result ?? { ok: true }));
+            })
+                .catch(err => {
+                this.opts.logger.warn(`[federation] apply error: ${err instanceof Error ? err.message : String(err)}`);
+                res.writeHead(500).end('apply failed');
+            });
+            return;
+        }
         if (req.method === 'GET' && url.startsWith('/fed/manifest')) {
             res.writeHead(200, { 'content-type': 'application/json' });
             res.end(JSON.stringify(this.opts.getManifest()));
@@ -93,6 +200,12 @@ export class MeshServer {
                     res.writeHead(400).end('bad json');
                     return;
                 }
+                const gate = this.opts.commandGate?.(input);
+                if (gate && !gate.ok) {
+                    res.writeHead(403, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ ok: false, text: gate.reason ?? 'command not permitted on this node' }));
+                    return;
+                }
                 const result = await this.opts.runCommand(input);
                 res.writeHead(200, { 'content-type': 'application/json' });
                 res.end(JSON.stringify(result ?? { ok: false, text: 'no result' }));

package/dist/kernel/federation/types.d.ts

@@ -125,6 +125,10 @@ export interface NodeStatus {
     /** 0–100 rough load, from the latest hardware snapshot. */
     load?: number;
     lastSeenAt: number;
+    /** Physical deployment this node belongs to (e.g. "Tel Aviv"). Sourced from
+     *  this node's own RoleContext.site — lets a fleet UI group by location as
+     *  a customer scales from one site to many, without per-site bespoke code. */
+    site?: string;
 }
 export type MessageKind = 'hello' | 'welcome' | 'heartbeat' | 'manifest' | 'task.dispatch' | 'task.accepted' | 'task.status' | 'task.result' | 'task.cancel' | 'command' | 'command.result' | 'config.request' | 'config.offer' | 'update.announce' | 'update.request' | 'role.get' | 'role.set' | 'agents.list' | 'agents.offer' | 'message.send' | 'message.accepted' | 'event' | 'telemetry' | 'ack' | 'error';
 /** A dispatched/received task run — tracked for non-blocking handoff + monitoring. */
@@ -167,10 +171,26 @@ export interface AgentHandle {
     description: string;
     lastActiveAt: number;
 }
+/** Result of a one-shot `infinicode maintain` run, pushed to an InfiniBot gateway. */
+export interface MaintenanceReport {
+    nodeId: string;
+    role: string;
+    site?: string;
+    taskName: string;
+    startedAt: number;
+    finishedAt: number;
+    durationMs: number;
+    ok: boolean;
+    summary: string;
+    errors?: string[];
+}
 /** Persistent per-device role + server-architecture context. */
 export interface RoleContext {
     /** e.g. "RoboPanda" — the identity a spawned agent adopts. */
     role: string;
+    /** Physical deployment/location this device belongs to (e.g. "Tel Aviv").
+     *  Optional — a single-site deployment can leave it unset. */
+    site?: string;
     /** Free-text description of this device's job + the wider architecture. */
     architecture?: string;
     /** Extra structured context injected into every task run on this node. */