devagent-ignition 0.1.0__py3-none-any.whl

devagent_spatial/studio.py

@@ -0,0 +1,894 @@
+"""Loopback-only customer project wizard; no credential storage or PLC writes."""
+from __future__ import annotations
+import csv
+import io
+import json
+import re
+import uuid
+import threading
+import hashlib
+import secrets
+import time
+from pathlib import Path
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import urlsplit,unquote
+from .generator import build, slugify, BuildHold, ROOT
+from .model import qualify, clean_project, MAX_EQUIPMENT, MAX_SIGNALS
+from .strict_json import loads as strict_loads
+
+LIMIT = 300_000
+STUDIO_HTML = (ROOT/'assets'/'studio.html').read_bytes() if (ROOT/'assets'/'studio.html').exists() else b''
+
+
+def csv_rows(raw: str, required: tuple[str,...], *, maximum: int) -> list[dict]:
+    if not isinstance(raw,str) or len(raw)>100_000:
+        raise BuildHold('CSV_TEXT_TOO_LARGE')
+    if not raw.strip():return []
+    stream=io.StringIO(raw)
+    reader=csv.DictReader(stream, strict=True)
+    if not reader.fieldnames or not set(required).issubset(reader.fieldnames):
+        raise BuildHold('CSV_HEADERS_REQUIRED: '+','.join(required))
+    if len(reader.fieldnames)>30 or len(reader.fieldnames)!=len(set(reader.fieldnames)):
+        raise BuildHold('CSV_HEADERS_INVALID_OR_DUPLICATE')
+    rows=[]
+    try:
+        for row in reader:
+            if len(rows)>=maximum:raise BuildHold('CSV_LIMIT_EXCEEDED')
+            if None in row or any(not isinstance(v,str) for v in row.values()):
+                raise BuildHold('CSV_EXTRA_UNESCAPED_DELIMITERS')
+            if any(v.strip() for v in row.values()):rows.append({k:v.strip() for k,v in row.items()})
+    except csv.Error as ex:
+        raise BuildHold('CSV_MALFORMED: '+str(ex)) from ex
+    return rows
+
+
+def _kind_from_asset_signals(asset_id: str, roles: set[str]) -> str:
+    """Make a conceptual display symbol, never assert discovered hardware identity."""
+    family_groups = (
+        (set(('photoeye_blocked', 'photoeye_count')), 'photoeye'),
+        (set(('scanner_result', 'scanner_barcode', 'scan_count', 'no_read_count')), 'scanner'),
+        (set(('vfd_frequency',)), 'vfd'),
+        (set(('tank_level',)), 'tank'),
+    )
+    matches = [kind for family,kind in family_groups if roles & family]
+    if len(matches) == 1:
+        return matches[0]
+    if len(matches) > 1:
+        return 'other'
+    # These are conventional IDs only. The project explicitly flags them for review.
+    for pattern,kind in ((r'^(?:CV|CONV)[0-9]', 'conveyor'),
+                         (r'^VFD[0-9]', 'vfd'),
+                         (r'^PUMP[0-9]', 'pump'),
+                         (r'^SCN[0-9]', 'scanner'),
+                         (r'^PE[0-9]', 'photoeye')):
+        if re.match(pattern,asset_id):
+            return kind
+    return 'other'
+
+
+def from_wizard(payload: dict) -> dict:
+    """Keep four original steps; accept safe partial inputs without guessing OPC identity."""
+    if not isinstance(payload,dict):raise BuildHold('WIZARD_EXPECTED_OBJECT')
+    if set(payload)-{'name','industry','layout','palette','description','equipment_csv','connections_csv','signals_csv','requirements'}:
+        raise BuildHold('UNRECOGNIZED_WIZARD_FIELD')
+    for k in ('name','industry','layout','palette','description','equipment_csv','connections_csv','signals_csv','requirements'):
+        if k in payload and not isinstance(payload[k],str):
+            raise BuildHold('WIZARD_TEXT_FIELD_INVALID_'+k.upper())
+    name=payload.get('name','').strip()
+    if not name:raise BuildHold('PROJECT_NAME_REQUIRED')
+    industry=payload.get('industry','').strip() or 'Unspecified Industry'
+    layout=payload.get('layout','').strip() or 'spatial_overview'
+    palette=payload.get('palette','').strip() or 'r9_cyan'
+    description=payload.get('description','')
+    eqcsv=csv_rows(payload.get('equipment_csv',''),('id',), maximum=MAX_EQUIPMENT)
+    if any(set(r)-{'id','name','kind','floor','zone','x','y','z'} for r in eqcsv):raise BuildHold('UNRECOGNIZED_EQUIPMENT_CSV_FIELD')
+    conncsv=csv_rows(payload.get('connections_csv',''),('from','to'),maximum=400)
+    if any(set(r)-{'from','to'} for r in conncsv):raise BuildHold('UNRECOGNIZED_CONNECTION_CSV_FIELD')
+    sigcsv=csv_rows(payload.get('signals_csv',''),('id','asset_id','role','datatype','namespace_uri','node_id'),maximum=MAX_SIGNALS)
+    if any(set(r)-{'id','asset_id','role','datatype','namespace_uri','node_id','unit','polarity'} for r in sigcsv):raise BuildHold('UNRECOGNIZED_SIGNAL_CSV_FIELD')
+    equipment=[]
+    for idx,r in enumerate(eqcsv):
+        floor_text=r.get('floor','').strip()
+        try:floor=int(floor_text) if floor_text else 1
+        except (ValueError,TypeError):raise BuildHold(f'EQUIPMENT_FLOOR_INVALID_ROW_{idx+2}')
+        zone = r.get('zone','') or ('FLOOR_UNSPECIFIED_PREVIEW_F1' if not floor_text else '')
+        e={'id':r['id'],'name':r.get('name','') or r['id'],
+           'kind':r.get('kind','') or 'other','floor':floor,'zone':zone}
+        coord=[r.get(k,'') for k in ('x','y','z')]
+        if any(coord):
+            if not all(coord):raise BuildHold(f'PARTIAL_COORDINATES_ROW_{idx+2}')
+            try:e['position']={k:float(r[k]) for k in ('x','y','z')}
+            except ValueError:raise BuildHold(f'INVALID_COORDINATES_ROW_{idx+2}')
+        equipment.append(e)
+    if not equipment and sigcsv:
+        # Candidates, not verified equipment: asset_id comes from supplied mapping,
+        # displayed symbol is guessed only when a recognized kind is unambiguous.
+        asset_roles={}
+        for r in sigcsv:
+            asset_roles.setdefault(r['asset_id'],set()).add(r['role'])
+        if len(asset_roles)>MAX_EQUIPMENT:
+            raise BuildHold('TOO_MANY_ASSETS_DERIVED_FROM_SIGNALS')
+        for asset_id,roles in sorted(asset_roles.items()):
+            equipment.append({'id':asset_id,'name':asset_id,
+                              'kind':_kind_from_asset_signals(asset_id,roles),
+                              'floor':1,'zone':'INFERRED_FROM_TAGS_REVIEW_REQUIRED'})
+    if not equipment:
+        raise BuildHold('INSUFFICIENT_INPUT: supply equipment IDs or fully asset-linked OPC UA signal CSV')
+    signals=[]
+    for r in sigcsv:
+        s={'id':r['id'],'asset_id':r['asset_id'],'role':r['role'], 'datatype':r['datatype'],
+           'unit':r.get('unit',''),'polarity':r.get('polarity',''),
+           'source':{'namespace_uri':r['namespace_uri'],'node_id':r['node_id']},'write_authorized':False}
+        signals.append(s)
+    requirements=[]
+    reqtext=payload.get('requirements','')
+    if len(reqtext)>16000:raise BuildHold('INVALID_REQUIREMENTS_TEXT')
+    for i,line in enumerate(reqtext.splitlines()):
+        line=line.strip()
+        if line:requirements.append({'id':f'R{i+1:03d}','text':line})
+    return {'schema_version':1,'name':name,'industry':industry,
+            'theme':'devagent_spatial_v1','palette':palette,'layout':layout,'description':description,
+            'equipment':equipment,'connections':[{'from':r['from'],'to':r['to']} for r in conncsv],
+            'signals':signals,'requirements':requirements}
+
+
+class StudioServer(ThreadingHTTPServer):
+    daemon_threads=True
+    allow_reuse_address=True
+    def __init__(self,address,workspace:Path,vendor_three:Path|None,*,allow_legacy_concept_build:bool=False):
+        if address[0]!='127.0.0.1':raise ValueError('LAB_STUDIO_BIND_LOOPBACK_ONLY')
+        self.workspace=workspace.expanduser().resolve()
+        self.workspace.mkdir(parents=True,exist_ok=True)
+        self.vendor_three=vendor_three
+        self.allow_legacy_concept_build=bool(allow_legacy_concept_build)  # test compatibility only
+        self.creator_three_ready=False
+        if vendor_three is not None:
+            vendor=Path(vendor_three).expanduser().resolve()
+            names=('three.module.js','three.core.js','LICENSE-three.txt')
+            try:
+                self.creator_three_ready=(all((vendor/n).is_file() for n in names)
+                    and (vendor/'three.module.js').stat().st_size>200_000
+                    and (vendor/'three.core.js').stat().st_size>500_000
+                    and "REVISION = '180'" in (vendor/'three.core.js').read_text(encoding='utf8'))
+            except (OSError,UnicodeError):self.creator_three_ready=False
+        # Studio R2 is a single isolated-lab instance; serialize test imports/stimuli.
+        self.lab_lock=threading.Lock()
+        self.lab_sessions={}
+        # Ephemeral, single-use, AI + deterministic-harness receipts.
+        # Store only the approved model-input fingerprint; never an API key or raw proposal.
+        self.engineer_review_lock=threading.Lock()
+        self.engineer_reviews={}
+        self.lab_results={}  # In-memory, session-bound lab receipts only. No production claims.
+        from .live_lab_binding import LiveLabBridge
+        self.lab_live=LiveLabBridge()
+        from .preview_simulation import PreviewSimulator
+        self.preview_sim=PreviewSimulator()
+        # Source-pinned V8 demo state is isolated from every generated customer
+        # project and never opens a PLC, OPC UA, or Ignition connection.
+        from .original_v8 import OriginalV8Demo
+        self.original_v8=OriginalV8Demo()
+        from .original_r9 import OriginalR9Demo
+        self.original_r9=OriginalR9Demo()
+        self.original_r9_token=secrets.token_urlsafe(36)
+        self.lab_port=8770
+        super().__init__(address,StudioHandler)
+
+
+class StudioHandler(BaseHTTPRequestHandler):
+    server_version='DevAgentSpatialStudio/0.6-lab-feed-candidate'
+    def headers(self,typ,nbytes):
+        self.send_response(200)
+        self.send_header('Content-Type',typ)
+        self.send_header('Content-Length',str(nbytes))
+        self.send_header('X-Content-Type-Options','nosniff')
+        self.send_header('Cache-Control','no-store')
+        self.send_header('Referrer-Policy','no-referrer')
+        self.send_header('Cross-Origin-Resource-Policy','same-origin')
+        self.send_header('X-Frame-Options','DENY')
+        self.send_header('Content-Security-Policy',"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'")
+        self.end_headers()
+    def output(self,code,data,typ='application/json; charset=utf-8',*,allow_same_origin_frame=False):
+        # Only generated operator viewer HTML may be embedded by this SAME origin
+        # Creator Design Review. All other responses keep the deny-by-default policy.
+        raw=json.dumps(data,ensure_ascii=False).encode() if not isinstance(data,bytes) else data
+        self.send_response(code);self.send_header('Content-Type',typ);self.send_header('Content-Length',str(len(raw)))
+        self.send_header('X-Content-Type-Options','nosniff');self.send_header('Cache-Control','no-store')
+        self.send_header('Referrer-Policy','no-referrer')
+        self.send_header('Cross-Origin-Resource-Policy','same-origin')
+        self.send_header('X-Frame-Options','SAMEORIGIN' if allow_same_origin_frame else 'DENY')
+        ancestors="'self'" if allow_same_origin_frame else "'none'"
+        self.send_header('Content-Security-Policy',"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'none'; frame-ancestors "+ancestors)
+        self.end_headers()
+        self.wfile.write(raw)
+    def same_host(self):
+        host=self.headers.get('Host','')
+        return host in {f'127.0.0.1:{self.server.server_port}',f'localhost:{self.server.server_port}'}
+    def do_GET(self):
+        if not self.same_host():return self.output(403,{'error':'HOST_NOT_ALLOWED'})
+        path=unquote(urlsplit(self.path).path)
+        if path in ('/','/index.html'):
+            return self.output(200,(ROOT/'assets'/'studio.html').read_bytes(),'text/html; charset=utf-8')
+        if path=='/api/original-r9/info':
+            return self.output(200,self.server.original_r9.info())
+        if path=='/api/original-r9/lab/state':
+            return self.output(200,self.server.original_r9.snapshot())
+        if path=='/api/original-r9/lab/session':
+            return self.output(200,{'enabled':True,
+                'csrf_token':self.server.original_r9_token,
+                'scope':'ORIGINAL_R9_ISOLATED_SYNTHETIC_ONLY'})
+        if path=='/api/original-r9/engine/status':
+            return self.output(200,{'offline_ready':True,'three_vendor':'SNAPSHOT_PINNED',
+                'production':'HOLD'})
+        if path=='/api/original-r9/bridge/facility/state':
+            return self.output(404,{'error':'NO_REAL_V1C_CONNECTION_IN_CREATOR_DEMO',
+                'source':'UNKNOWN_NOT_MAPPED'})
+        r9_asset=re.fullmatch(r'/original-r9/(index\.html|styles\.css|app\.mjs|model\.mjs|state_adapter\.mjs|lab_panel\.mjs|vendor/three\.module\.js|vendor/three\.core\.js|vendor/addons/controls/OrbitControls\.js)',path)
+        if r9_asset:
+            from .original_r9 import web_response,OriginalR9Hold
+            try:
+                raw,mime=web_response(r9_asset.group(1))
+                return self.output(200,raw,mime,allow_same_origin_frame=path.endswith('/index.html'))
+            except (OriginalR9Hold,OSError,UnicodeError):
+                return self.output(422,{'status':'HOLD','reason':'R9_SNAPSHOT_VALIDATION_FAILED'})
+        if path in ('/api/state','/api/original-v8/state'):
+            return self.output(200,self.server.original_v8.snapshot())
+        v8_pages={
+            '/original-v8/index.html':'index.html',
+            '/original-v8/simulator.html':'simulator.html',
+        }
+        if path in v8_pages:
+            file=ROOT/'reference'/'v8-original'/'web'/v8_pages[path]
+            return self.output(200,file.read_bytes(),'text/html; charset=utf-8',allow_same_origin_frame=True)
+        v8_static={
+            '/app.js':('app.js','text/javascript; charset=utf-8'),
+            '/simulator.js':('simulator.js','text/javascript; charset=utf-8'),
+            '/style.css':('style.css','text/css; charset=utf-8'),
+        }
+        if path in v8_static:
+            name,mime=v8_static[path]
+            return self.output(200,(ROOT/'reference'/'v8-original'/'web'/name).read_bytes(),mime)
+        if path=='/topology.json':
+            return self.output(200,(ROOT/'reference'/'v8-original'/'topology.json').read_bytes(),
+                               'application/json; charset=utf-8')
+        if path in ('/api/example/warehouse','/api/example/water','/api/example/single_floor','/api/example/cv101_guided',
+                    '/api/example/warehouse-3floor-standard-2d'):
+            kind=path.rsplit('/',1)[-1]
+            return self.output(200,json.loads((ROOT/'examples'/f'{kind}.json').read_text(encoding='utf8')))
+        if path=='/api/status':return self.output(200,{'status':'READY','engine':'DevAgent V0.7.3 Engineering Harness Candidate',
+                'creator_three_ready':self.server.creator_three_ready,
+                'mode':'LOCAL_ONLY','writes':False,'agent':'BYOM_DRAFT_AND_HUMAN_REVIEW'})
+        if path=='/api/ai/providers':
+            from .agent_runtime import PROVIDERS
+            return self.output(200,{'providers':list(PROVIDERS),'secret_storage':'NONE',
+                'mode':'SESSION_ONLY','production_release':'HOLD'})
+        # Locally persisted, explicitly synthetic protocol evidence; no production proof.
+        opc_report=re.fullmatch(r'/api/v076-opc/([a-z0-9-]{1,100})/report/([0-9a-f]{12})',path)
+        if opc_report:
+            pid,rid=opc_report.groups()
+            from .studio_workflow import load_project,LabHold
+            try:
+                load_project(self.server.workspace,pid)
+                file=self.server.workspace/pid/'reports'/('lab-opc-v076-'+rid+'.json')
+                if not file.is_file() or file.stat().st_size>3_000_000:
+                    return self.output(404,{'status':'HOLD','reason':'REPORT_NOT_FOUND'})
+                return self.output(200,strict_loads(file.read_text(encoding='utf8')))
+            except (OSError,ValueError,LabHold) as exc:
+                return self.output(422,{'status':'HOLD','reason':'LAB_REPORT_UNAVAILABLE'})
+        cmd_report=re.fullmatch(r'/api/v078-command/([a-z0-9-]{1,100})/report/([0-9a-f]{12})',path)
+        if cmd_report:
+            pid,rid=cmd_report.groups()
+            from .studio_workflow import load_project,LabHold
+            try:
+                load_project(self.server.workspace,pid)
+                file=self.server.workspace/pid/'reports'/('lab-command-v078-'+rid+'.json')
+                if not file.is_file() or file.is_symlink() or file.stat().st_size>400_000:
+                    return self.output(404,{'status':'HOLD','reason':'COMMAND_FAT_REPORT_NOT_FOUND'})
+                return self.output(200,strict_loads(file.read_text(encoding='utf8')))
+            except (OSError,ValueError,LabHold):
+                return self.output(422,{'status':'HOLD','reason':'LAB_REPORT_UNAVAILABLE'})
+        # Separate engineering workflow: no lab tools are added to operator HMI.
+        simulation_status=re.fullmatch(r'/api/preview-sim/([a-z0-9-]{1,100})/status',path)
+        if simulation_status:
+            from .studio_workflow import load_project,LabHold
+            from .preview_simulation import PreviewSimulationHold
+            try:
+                pid=simulation_status.group(1)
+                return self.output(200,self.server.preview_sim.status(pid,load_project(self.server.workspace,pid)))
+            except (LabHold,PreviewSimulationHold,OSError,ValueError) as exc:
+                return self.output(422,{'status':'HOLD','reason':str(exc)[:120]})
+        lab_page=re.fullmatch(r'/projects/([a-z0-9-]+)/test/index.html',path)
+        if lab_page:
+            from .studio_workflow import load_project,LabHold
+            try:load_project(self.server.workspace,lab_page.group(1))
+            except (LabHold,OSError,ValueError,KeyError) as ex:
+                return self.output(422,{'status':'HOLD','reason':str(ex)[:100]})
+            return self.output(200,(ROOT/'assets'/'test_workspace.html').read_bytes(),'text/html; charset=utf-8')
+        lab_status=re.fullmatch(r'/api/lab/([a-z0-9-]+)/status',path)
+        if lab_status:
+            from .studio_workflow import load_project,project_lab_dir,studio_state,_same_session,LabHold
+            try:
+                pid=lab_status.group(1)
+                model=load_project(self.server.workspace,pid)
+                prepared=project_lab_dir(self.server.workspace,pid).is_dir()
+                try:
+                    state=studio_state(self.server.lab_port)
+                    info={'online':True,'lab_tags':state['customer']['tag_count'],
+                          'revision':state['customer']['revision'],
+                          'active_project_session':_same_session(self.server.lab_sessions.get(pid),state)}
+                except LabHold:info={'online':False,'lab_tags':None,'revision':None,'active_project_session':False}
+                return self.output(200,{'project_name':model['name'],'assets':len(model['equipment']),
+                    'signals':len(model['signals']),'prepared':prepared,'studio':info,
+                    'hmi_lab_feed_attached':self.server.lab_live.enabled(pid),
+                    'preview_status':'CONCEPT_ONLY_NOT_FINAL_IGNITION','production':'HOLD'})
+            except (LabHold,OSError,ValueError,KeyError) as ex:
+                return self.output(422,{'status':'HOLD','reason':str(ex)[:100]})
+        test_report=re.fullmatch(r'/api/lab/([a-z0-9-]+)/(test-coverage|lab-report.json)',path)
+        if test_report:
+            from .test_reporting import summarize
+            from .studio_workflow import LabHold
+            try:
+                pid,kind=test_report.groups()
+                report=summarize(self.server.workspace,pid,self.server.lab_port,
+                    self.server.lab_sessions.get(pid),self.server.lab_results.get(pid))
+                if kind=='lab-report.json':
+                    return self.output(200,report,'application/json; charset=utf-8')
+                return self.output(200,report)
+            except (LabHold,OSError,KeyError,ValueError,TypeError) as ex:
+                return self.output(422,{'status':'HOLD','reason':str(ex)[:100]})
+        lab_evidence=re.fullmatch(r'/api/lab/([a-z0-9-]+)/evidence/((?:protocol-probe|isolated-fault-scenario)-[0-9a-f]{12}\.json)',path)
+        if lab_evidence:
+            from .studio_workflow import load_project,project_lab_dir,LabHold
+            try:
+                pid,name=lab_evidence.groups()
+                load_project(self.server.workspace,pid)
+                labdir=project_lab_dir(self.server.workspace,pid)
+                file=labdir/name
+                if not file.is_file() or file.is_symlink() or file.resolve().parent!=labdir.resolve():
+                    return self.output(404,{'status':'HOLD','reason':'EVIDENCE_NOT_FOUND'})
+                if file.stat().st_size>1_000_000:return self.output(422,{'status':'HOLD','reason':'EVIDENCE_SIZE_HOLD'})
+                return self.output(200,file.read_bytes(),'application/json; charset=utf-8')
+            except (LabHold,ValueError,OSError,KeyError) as ex:
+                return self.output(422,{'status':'HOLD','reason':str(ex)[:100]})
+        live_feed=re.fullmatch(r'/api/live-lab/([a-z0-9-]+)/readings',path)
+        if live_feed:
+            from .studio_workflow import LabHold
+            try:
+                pid=live_feed.group(1)
+                from .studio_workflow import load_project
+                model=load_project(self.server.workspace,pid)
+                if self.server.preview_sim.active(pid):
+                    # Explicitly requested project-scoped synthetic preview feed.
+                    # This NEVER probes or writes Studio/OPC UA.
+                    result=self.server.preview_sim.reading(pid,model)
+                else:
+                    result=self.server.lab_live.read(self.server.workspace,pid,self.server.lab_port)
+                return self.output(200 if result['status']!='HOLD' else 422,result)
+            except (LabHold,ValueError,OSError,KeyError) as ex:
+                return self.output(422,{'status':'HOLD','reason':str(ex)[:115]})
+        if path in ('/assets/creator.css','/assets/creator_scene.mjs','/assets/creator_ui.mjs','/assets/creator_2d.mjs','/assets/creator_original_v8.mjs','/assets/creator_original_r9.mjs','/assets/creator_r9_diagnostics.mjs','/assets/facility2d_core.mjs','/assets/flow_geometry.mjs','/assets/r9_transport.mjs'):
+            file=ROOT/'assets'/path.rsplit('/',1)[-1]
+            return self.output(200,file.read_bytes(),'text/css; charset=utf-8' if path.endswith('.css') else 'text/javascript; charset=utf-8')
+        vendor_asset=re.fullmatch(r'/assets/creator-vendor/(three\.module\.js|three\.core\.js)',path)
+        if vendor_asset:
+            if not self.server.creator_three_ready:return self.output(404,{'error':'VENDOR_UNAVAILABLE_USE_SCHEMATIC_FALLBACK'})
+            file=Path(self.server.vendor_three).expanduser().resolve()/vendor_asset.group(1)
+            return self.output(200,file.read_bytes(),'text/javascript; charset=utf-8')
+        if path=='/assets/v078_command_ui.js':
+            return self.output(200,(ROOT/'assets'/'v078_command_ui.js').read_bytes(),
+                               'text/javascript; charset=utf-8')
+        if path=='/assets/v076_fat_ui.js':
+            return self.output(200,(ROOT/'assets'/'v076_fat_ui.js').read_bytes(),
+                               'text/javascript; charset=utf-8')
+        if path=='/assets/harness.js':
+            return self.output(200,(ROOT/'assets'/'harness.js').read_bytes(),'text/javascript; charset=utf-8')
+        if path=='/assets/agent.js':
+            return self.output(200,(ROOT/'assets'/'agent.js').read_bytes(),'text/javascript; charset=utf-8')
+        # The unified AI engineering button must have a real, served event handler.
+        # Explicit allowlisting preserves the read-only static asset boundary.
+        if path=='/assets/project_package.js':
+            return self.output(200,(ROOT/'assets'/'project_package.js').read_bytes(),
+                               'text/javascript; charset=utf-8')
+        if path=='/assets/customer_documents.js':
+            return self.output(200,(ROOT/'assets'/'customer_documents.js').read_bytes(),
+                               'text/javascript; charset=utf-8')
+        if path=='/assets/live_design_review.js':
+            return self.output(200,(ROOT/'assets'/'live_design_review.js').read_bytes(),'text/javascript; charset=utf-8')
+        if path=='/assets/unified_engineer.js':
+            return self.output(200,(ROOT/'assets'/'unified_engineer.js').read_bytes(),
+                               'text/javascript; charset=utf-8')
+        match=re.fullmatch(r'/projects/([a-z0-9-]+)/viewer/(index.html|style.css|viewer.js|three_scene.js|flow_geometry.mjs|r9_transport.mjs|fallback_scene.js|operations_ui.js|runtime_feed.js|facility2d_core.mjs|facility2d_app.mjs|facility2d_simulation.mjs|facility2d.css|equipment_controls.mjs|vendor/three.module.js|vendor/three.core.js)',path)
+        if match:
+            name,resource=match.groups()
+            file=(self.server.workspace/name/'viewer'/resource).resolve()
+            base=(self.server.workspace/name/'viewer').resolve()
+            if not file.is_relative_to(base) or not file.is_file():return self.output(404,{'error':'NOT_FOUND'})
+            types={'.html':'text/html; charset=utf-8','.css':'text/css; charset=utf-8','.js':'text/javascript; charset=utf-8','.mjs':'text/javascript; charset=utf-8'}
+            return self.output(200,file.read_bytes(),types.get(file.suffix,'application/octet-stream'),
+                               allow_same_origin_frame=(resource=='index.html'))
+        return self.output(404,{'error':'NOT_FOUND'})
+    def do_POST(self):
+        if not self.same_host():return self.output(403,{'error':'HOST_NOT_ALLOWED'})
+        origin=self.headers.get('Origin')
+        if origin not in (None, f'http://127.0.0.1:{self.server.server_port}',f'http://localhost:{self.server.server_port}'):
+            return self.output(403,{'error':'ORIGIN_NOT_ALLOWED'})
+        route=urlsplit(self.path).path
+        if route in ('/api/original-r9/lab/command','/api/original-r9/reset'):
+            # This is isolated *in-memory* synthetic lab state, never an OPC UA
+            # command. Require explicit browser origin and CSRF for mutations.
+            if origin is None or not self.same_host():
+                return self.output(403,{'error':'R9_ORIGIN_REQUIRED'})
+            if self.headers.get('Content-Type','').split(';')[0]!='application/json':
+                return self.output(415,{'error':'R9_JSON_REQUIRED'})
+            try:
+                size=int(self.headers.get('Content-Length','-1'))
+            except ValueError:
+                return self.output(400,{'error':'R9_INVALID_LENGTH'})
+            if not 0<size<=512:return self.output(413,{'error':'R9_REQUEST_TOO_LARGE'})
+            if route=='/api/original-r9/lab/command':
+                if self.headers.get('X-DevAgent-Lab-Token')!=self.server.original_r9_token:
+                    return self.output(403,{'error':'R9_CSRF_REQUIRED'})
+            elif self.headers.get('X-DevAgent-Request')!='original-r9-simulator-v1':
+                return self.output(403,{'error':'R9_RESET_CONFIRMATION_REQUIRED'})
+            try:
+                payload=strict_loads(self.rfile.read(size))
+                if not isinstance(payload,dict):raise ValueError('R9_OBJECT_REQUIRED')
+                if route.endswith('/command'):
+                    if set(payload)!={'command','request_id'}:raise ValueError('R9_COMMAND_FIELDS_INVALID')
+                    return self.output(200,self.server.original_r9.command(payload['command'],payload['request_id']))
+                if payload!={'confirm':'RESET_SYNTHETIC_R9_ONLY'}:raise ValueError('R9_RESET_FIELDS_INVALID')
+                return self.output(200,self.server.original_r9.reset())
+            except (ValueError,TypeError,KeyError) as exc:
+                return self.output(409,{'status':'HOLD','reason':str(exc)[:120]})
+        # Explicit local user action, raw binary file, no disk persistence.
+        if route=='/api/customer-documents/inspect':
+            if origin is None or self.headers.get('X-DevAgent-Request')!='customer-doc-intake-v1':
+                return self.output(403,{'status':'HOLD','reason':'DOCUMENT_ORIGIN_REQUIRED'})
+            if self.headers.get('Content-Type','').split(';')[0]!='application/octet-stream':
+                return self.output(415,{'status':'HOLD','reason':'BINARY_DOCUMENT_REQUIRED'})
+            from .customer_intake import inspect,IntakeHold,MAX_FILE
+            try:
+                size=int(self.headers.get('Content-Length','-1'))
+                if not 0<size<=MAX_FILE:return self.output(413,{'status':'HOLD','reason':'DOCUMENT_SIZE_LIMIT'})
+                filename=unquote(self.headers.get('X-DevAgent-Filename',''))
+                data=inspect(filename,self.rfile.read(size))
+                return self.output(200,data)
+            except (IntakeHold,ValueError,TypeError) as exc:
+                code=str(exc)
+                if not re.fullmatch(r'[A-Z][A-Z0-9_]{1,119}',code):code='DOCUMENT_INSPECTION_HOLD'
+                return self.output(422,{'status':'HOLD','reason':code})
+        if route=='/api/customer-package/inspect':
+            if origin is None or self.headers.get('X-DevAgent-Request')!='customer-project-package-v1':
+                return self.output(403,{'status':'HOLD','reason':'PACKAGE_ORIGIN_REQUIRED'})
+            if self.headers.get('Content-Type','').split(';')[0]!='application/octet-stream':
+                return self.output(415,{'status':'HOLD','reason':'BINARY_PROJECT_ZIP_REQUIRED'})
+            from .project_package import inspect_package,PackageHold,MAX_PACKAGE_BYTES
+            try:
+                size=int(self.headers.get('Content-Length','-1'))
+                if not 0<size<=MAX_PACKAGE_BYTES:
+                    return self.output(413,{'status':'HOLD','reason':'PROJECT_PACKAGE_SIZE_HOLD'})
+                filename=unquote(self.headers.get('X-DevAgent-Filename',''))
+                response=inspect_package(filename,self.rfile.read(size))
+                return self.output(200,response)
+            except (PackageHold,ValueError,TypeError) as exc:
+                reason=str(exc)
+                if not re.fullmatch(r'[A-Z0-9_]{2,100}',reason):reason='PROJECT_PACKAGE_HOLD'
+                return self.output(422,{'status':'HOLD','reason':reason})
+        if self.headers.get('Content-Type','').split(';')[0]!='application/json':return self.output(415,{'error':'JSON_REQUIRED'})
+        try:size=int(self.headers.get('Content-Length','-1'))
+        except ValueError:return self.output(400,{'error':'INVALID_LENGTH'})
+        if not 0<size<=LIMIT:return self.output(413,{'error':'REQUEST_SIZE_HOLD'})
+        route=urlsplit(self.path).path
+        if route in ('/api/scenario','/api/original-v8/scenario'):
+            # The immutable original simulator posts same-origin JSON without a
+            # custom header. Host/origin checks plus loopback binding preserve
+            # its source behavior while preventing cross-origin actuation.
+            if origin is None:
+                return self.output(403,{'error':'ORIGINAL_V8_SIMULATOR_ORIGIN_REQUIRED'})
+            try:
+                payload=strict_loads(self.rfile.read(size))
+                return self.output(200,self.server.original_v8.transition(payload))
+            except (ValueError,TypeError,KeyError) as exc:
+                return self.output(400,{'error':str(exc)[:120]})
+        if route=='/api/original-v8/reset':
+            if origin is None or self.headers.get('X-DevAgent-Request')!='original-v8-simulator-v1':
+                return self.output(403,{'error':'ORIGINAL_V8_SIMULATOR_ORIGIN_REQUIRED'})
+            try:
+                payload=strict_loads(self.rfile.read(size))
+                if payload!={'confirm':'RESET_SYNTHETIC_DEMO_ONLY'}:
+                    raise ValueError('ORIGINAL_V8_RESET_CONFIRMATION_REQUIRED')
+                return self.output(200,self.server.original_v8.reset())
+            except (ValueError,TypeError) as exc:
+                return self.output(400,{'error':str(exc)[:120]})
+        if route=='/api/engineer/revoke':
+            if origin is None or self.headers.get('X-DevAgent-Request')!='engineer-pipeline-v1':
+                return self.output(403,{'status':'HOLD','reason':'ENGINEER_ORIGIN_REQUIRED'})
+            try:
+                payload=strict_loads(self.rfile.read(size))
+                if not isinstance(payload,dict) or set(payload)!={'review_token','confirm'} or payload['confirm']!='REVOKE_LOCAL_REVIEW_ONLY':
+                    raise ValueError('ENGINEER_REVOKE_SCHEMA_HOLD')
+                token=payload['review_token']
+                if not isinstance(token,str) or not 30<=len(token)<=128:
+                    raise ValueError('ENGINEER_REVIEW_TOKEN_INVALID')
+                with self.server.engineer_review_lock:
+                    revoked=self.server.engineer_reviews.pop(token,None) is not None
+                return self.output(200,{'status':'REVIEW_REVOKED' if revoked else 'REVIEW_ALREADY_UNAVAILABLE',
+                                        'production':'HOLD'})
+            except (ValueError,TypeError):
+                return self.output(422,{'status':'HOLD','reason':'ENGINEER_REVOKE_SCHEMA_HOLD'})
+        if route=='/api/customer-documents/suggest':
+            if origin is None or self.headers.get('X-DevAgent-Request')!='customer-doc-intake-v1':
+                return self.output(403,{'status':'HOLD','reason':'DOCUMENT_ORIGIN_REQUIRED'})
+            from .customer_intake import suggest,IntakeHold
+            from .agent_runtime import AgentHold
+            try:
+                payload=strict_loads(self.rfile.read(size))
+                if not isinstance(payload,dict) or set(payload)!={'connection','documents','confirm'} or payload['confirm']!='CUSTOMER_REQUESTED_AI_DOCUMENT_EXTRACTION':
+                    raise IntakeHold('DOCUMENT_AI_CONSENT_REQUIRED')
+                return self.output(200,suggest(payload['connection'],payload['documents']))
+            except (IntakeHold,AgentHold,ValueError,TypeError,KeyError) as exc:
+                code=str(exc)
+                if not re.fullmatch(r'[A-Z][A-Z0-9_]{1,119}',code):code='AI_DOCUMENT_EXTRACTION_HOLD'
+                return self.output(422,{'status':'HOLD','reason':code,'production':'HOLD'})
+        command_action=re.fullmatch(r'/api/v078-command/([a-z0-9-]{1,100})/run',route)
+        if command_action:
+            if origin is None or self.headers.get('X-DevAgent-Request')!='isolated-device-command-v078':
+                return self.output(403,{'status':'HOLD','reason':'COMMAND_ORIGIN_REQUIRED'})
+            from .v078_commands import (contract_template,run_virtual_plc_fat,CommandHold,LAB_CONFIRM)
+            from .studio_workflow import load_project,LabHold
+            pid=command_action.group(1)
+            try:
+                req=strict_loads(self.rfile.read(size))
+                if not isinstance(req,dict) or set(req)!={'asset_id','reviewer','confirm'}:
+                    raise CommandHold('COMMAND_REQUEST_SCHEMA_INVALID')
+                if req['confirm']!=LAB_CONFIRM:
+                    raise CommandHold('COMMAND_LAB_CONFIRM_REQUIRED')
+                model=load_project(self.server.workspace,pid)
+                c=contract_template(model,req['asset_id'])
+                name=req['reviewer']
+                if not isinstance(name,str) or not 3<=len(name.strip())<=100 or any(ord(ch)<32 for ch in name):
+                    raise CommandHold('LAB_REVIEWER_NAME_REQUIRED')
+                c['engineer']=name
+                c['approval']='APPROVED_FOR_ISOLATED_FAT_ONLY'
+                if not self.server.lab_lock.acquire(blocking=False):
+                    raise CommandHold('LAB_BUSY')
+                try:
+                    import asyncio
+                    result=asyncio.run(asyncio.wait_for(run_virtual_plc_fat(
+                        model,c,port=4899,confirm=LAB_CONFIRM),timeout=45))
+                    rid=secrets.token_hex(6)
+                    from .v076_opc_fat import save_new
+                    save_new(self.server.workspace/pid/'reports'/('lab-command-v078-'+rid+'.json'),result)
+                    public={'status':result['status'],'cases_checked':result['case_count'],
+                      'report_url':f'/api/v078-command/{pid}/report/{rid}',
+                      'gateway':'NOT_VERIFIED','physical_plc':'NOT_VERIFIED','production':'HOLD'}
+                    return self.output(200 if result['status'].startswith('PASS_') else 422,public)
+                finally:self.server.lab_lock.release()
+            except (OSError,CommandHold,LabHold,ValueError,TypeError,KeyError,TimeoutError) as exc:
+                code=str(exc)
+                if not re.fullmatch('[A-Z][A-Z0-9_]{1,119}',code):code='VIRTUAL_COMMAND_LAB_HOLD'
+                return self.output(422,{'status':'HOLD','reason':code,
+                    'gateway':'NOT_VERIFIED','production':'HOLD'})
+        # Customer UI FAT action is bound to an existing AI-reviewed/build project.
+        # It opens only an ephemeral fake OPC UA server on localhost; NEVER Gateway/PLC.
+        opc_action=re.fullmatch(r'/api/v076-opc/([a-z0-9-]{1,100})/run',route)
+        if opc_action:
+            if origin is None or self.headers.get('X-DevAgent-Request')!='isolated-opc-fat-v076':
+                return self.output(403,{'status':'HOLD','reason':'OPC_LAB_ORIGIN_REQUIRED'})
+            from .v076_opc_fat import run_loopback_fat,save_new,LabHold
+            from .studio_workflow import load_project
+            pid=opc_action.group(1)
+            try:
+                req=strict_loads(self.rfile.read(size))
+                if req!={'confirm':'ISOLATED_FAKE_OPC_LOOPBACK_ONLY'}:
+                    raise LabHold('LAB_CONFIRMATION_REQUIRED')
+                model=load_project(self.server.workspace,pid)
+                # Do not start a second protocol server while one lab is active.
+                if not self.server.lab_lock.acquire(blocking=False):
+                    raise LabHold('LAB_BUSY')
+                try:
+                    import asyncio
+                    result=asyncio.run(asyncio.wait_for(run_loopback_fat(model,port=4898),timeout=50))
+                    rid=secrets.token_hex(6)
+                    save_new(self.server.workspace/pid/'reports'/('lab-opc-v076-'+rid+'.json'),result)
+                    result={'status':result['status'],'cases_passed':result['cases_passed'],
+                            'cases_planned':result['cases_planned'],
+                            'report_url':f'/api/v076-opc/{pid}/report/{rid}',
+                            'gateway':'NOT_VERIFIED','production':'HOLD'}
+                    return self.output(200 if result['status']=='PASS_LAB_OPC_PROTOCOL_ONLY' else 422,result)
+                finally:self.server.lab_lock.release()
+            except (OSError,LabHold,ValueError,TypeError,KeyError) as exc:
+                code=str(exc)
+                if not re.fullmatch('[A-Z][A-Z0-9_]{1,119}',code):code='FAKE_OPC_LAB_HOLD'
+                return self.output(422,{'status':'HOLD','reason':code,
+                         'gateway':'NOT_VERIFIED','production':'HOLD'})
+        if route=='/api/creator-scene':
+            if origin is None or self.headers.get('X-DevAgent-Request')!='concept-scene-v1':
+                return self.output(403,{'status':'HOLD','reason':'CONCEPT_SCENE_ORIGIN_REQUIRED'})
+            try:
+                payload=strict_loads(self.rfile.read(size))
+                if not isinstance(payload,dict):raise BuildHold('SCENE_EXPECTED_OBJECT')
+                # Only declared equipment/topology drive this design preview. OPC tags
+                # and operating values are deliberately excluded, never inferred.
+                model=from_wizard({
+                    'name':payload.get('name') or 'Untitled preview',
+                    'equipment_csv':payload.get('equipment_csv',''),
+                    'connections_csv':payload.get('connections_csv','')})
+                from .generator import enrich
+                scene=enrich(model)
+                return self.output(200,{
+                    'status':'CONCEPTUAL_LAYOUT_NOT_AS_BUILT','data_source':'USER_EQUIPMENT_CSV_ONLY',
+                    'engine_status':'NO_LIVE_TAGS_NO_PLC_VERIFICATION',
+                    'assets':[{'id':e['id'],'name':e['name'],'kind':e['kind'],'floor':e['floor'],
+                               'zone':e['zone'],'position':e['position'],'dimensions':e['dimensions'],
+                               'geometry_status':e['geometry_status']} for e in scene['equipment']],
+                    'connections':scene['connections'],
+                    'three_available':self.server.creator_three_ready})
+            except (BuildHold,ValueError,KeyError,TypeError,UnicodeError,RecursionError) as e:
+                return self.output(422,{'status':'HOLD','reason':str(e)[:180],
+                                        'data_source':'NO_LIVE_DATA'})
+        preview_action=re.fullmatch(r'/api/preview-sim/([a-z0-9-]{1,100})/(start|stop|pause|fault)',route)
+        if preview_action:
+            from .preview_simulation import PreviewSimulationHold
+            from .studio_workflow import load_project,LabHold
+            if origin is None or self.headers.get('X-DevAgent-Lab')!='isolated-workspace-v1':
+                return self.output(403,{'status':'HOLD','reason':'SIMULATION_ORIGIN_CONFIRMATION_REQUIRED'})
+            try:
+                pid,operation=preview_action.groups()
+                payload=strict_loads(self.rfile.read(size))
+                if not isinstance(payload,dict) or payload.get('confirm')!='SYNTHETIC_PREVIEW_ONLY' or set(payload)-{'confirm','asset_id','pace'}:
+                    raise PreviewSimulationHold('SYNTHETIC_PREVIEW_CONFIRMATION_REQUIRED')
+                if operation!='fault' and 'asset_id' in payload:
+                    raise PreviewSimulationHold('UNEXPECTED_FAULT_ASSET')
+                if operation!='start' and 'pace' in payload:
+                    raise PreviewSimulationHold('PREVIEW_PACE_ONLY_ON_START')
+                if 'pace' in payload and payload['pace'] not in ('slow','normal','fast'):
+                    raise PreviewSimulationHold('UNKNOWN_PREVIEW_PACE')
+                model=load_project(self.server.workspace,pid)
+                # Never hide an actual authorized lab feed behind synthetic values.
+                if operation!='stop' and self.server.lab_live.enabled(pid):
+                    raise PreviewSimulationHold('LIVE_LAB_ATTACHED_STOP_OR_DETACH_FIRST')
+                return self.output(200,self.server.preview_sim.action(pid,model,operation,fault_asset=payload.get('asset_id'),pace=payload.get('pace')))
+            except (PreviewSimulationHold,LabHold,ValueError,OSError,TypeError) as exc:
+                return self.output(422,{'status':'HOLD','reason':str(exc)[:140]})
+        operator_action=re.fullmatch(r'/api/preview-sim/([a-z0-9-]{1,100})/operator/(start|stop|reset|ack)',route)
+        if operator_action:
+            from .preview_simulation import PreviewSimulationHold
+            from .studio_workflow import load_project,LabHold
+            if origin is None or self.headers.get('X-DevAgent-Operator')!='synthetic-session-v1':
+                return self.output(403,{'status':'HOLD','reason':'SIMULATION_OPERATOR_ORIGIN_REQUIRED'})
+            try:
+                pid,command=operator_action.groups()
+                body=strict_loads(self.rfile.read(size))
+                if body!={'confirm':'SYNTHETIC_OPERATOR_ONLY'}:
+                    raise PreviewSimulationHold('EXACT_SIMULATION_OPERATOR_CONFIRMATION_REQUIRED')
+                if not self.server.preview_sim.active(pid):
+                    raise PreviewSimulationHold('NO_ACTIVE_PROJECT_SCOPED_SIMULATOR')
+                if self.server.lab_live.enabled(pid):
+                    raise PreviewSimulationHold('OPC_LAB_ACTIVE_SYNTHETIC_CONTROLS_DENIED')
+                model=load_project(self.server.workspace,pid)
+                result=self.server.preview_sim.action(pid,model,'operator-'+command)
+                result['command_authority']='SYNTHETIC_SIMULATOR_ONLY'
+                return self.output(200,result)
+            except (PreviewSimulationHold,LabHold,ValueError,KeyError,OSError) as exc:
+                return self.output(422,{'status':'HOLD','reason':str(exc)[:140]})
+        lab_action=re.fullmatch(r'/api/lab/([a-z0-9-]+)/(prepare|import|probe|scenario|sample|autorun|readonly-probe)',route)
+        if lab_action:
+            if origin is None or self.headers.get('X-DevAgent-Lab')!='isolated-workspace-v1':
+                return self.output(403,{'status':'HOLD','reason':'LAB_CSRF_CONFIRMATION_REQUIRED'})
+            if not self.server.lab_lock.acquire(blocking=False):
+                return self.output(409,{'status':'HOLD','reason':'ANOTHER_LAB_ACTION_IN_PROGRESS'})
+            try:
+                from . import studio_workflow as wf
+                from .operations import make_synthetic_frames,evaluate
+                pid,op=lab_action.groups()
+                body=strict_loads(self.rfile.read(size))
+                if not isinstance(body,dict) or body!={'confirm':'ISOLATED_TEST_ONLY'}:
+                    raise wf.LabHold('EXPLICIT_ISOLATED_LAB_CONFIRMATION_REQUIRED')
+                workspace=self.server.workspace;port=self.server.lab_port
+                model=wf.load_project(workspace,pid)
+                if op=='prepare':data=wf.prepare(workspace,pid,model)
+                elif op=='readonly-probe':
+                    data=wf.readonly_probe_existing_unbound(workspace,pid,port)
+                    self.server.lab_results.setdefault(pid,{})['unbound_probe']=data
+                    # The read-only evidence can attach live display only.
+                    if self.server.preview_sim.active(pid):raise wf.LabHold('STOP_SYNTHETIC_SIMULATION_BEFORE_OPC_ATTACH')
+                    self.server.lab_live.attach(workspace,pid,port,readonly_receipt=data)
+                elif op=='sample':
+                    receipt=evaluate(model,make_synthetic_frames(model))
+                    data={'status':'PASS_SYNTHETIC_RULE_DEMO_ONLY','project_id':pid,
+                        'frames':len(receipt['frames']),
+                        'alarm_events':[{'kind':e['kind'],'asset':e['asset_id']} for e in receipt['events']],
+                        'studio':'NOT_USED','ignition':'NOT_VERIFIED','production':'HOLD'}
+                    self.server.lab_results.setdefault(pid,{})['sample']=data
+                elif op=='autorun':
+                    # Explicit one-click isolated-lab intent. Hard HOLD on a
+                    # populated / non-lab Studio before modifying any tags.
+                    state=wf.studio_state(port)
+                    session=self.server.lab_sessions.get(pid)
+                    if state['customer']['tag_count']==0:
+                        # Only a truly empty Studio may accept new customer tags.
+                        prep=wf.prepare(workspace,pid,model)
+                        imported,session=wf.import_tags(workspace,pid,port,state,session)
+                        self.server.lab_sessions[pid]=session
+                        self.server.lab_results[pid]={}
+                        execution='NEW_ISOLATED_LAB_IMPORT'
+                    else:
+                        # A failed probe/fault after a successful import must be
+                        # resumable, but NEVER adopt pre-existing foreign tags.
+                        # require_session checks Creator import provenance, exact
+                        # Studio process/revision/endpoint and entire manifest.
+                        if not wf._same_session(session,state):
+                            raise wf.LabHold('STUDIO_HAS_EXISTING_TAGS_REQUIRE_FRESH_ISOLATED_LAB')
+                        wf.require_session(workspace,pid,port,session)
+                        prep={'status':'EXISTING_PREPARED_LAB_REUSED'}
+                        imported={'status':'SAME_CREATOR_PROJECT_SESSION_REUSED',
+                                  'imported':state['customer']['tag_count']}
+                        execution='RESUME_VERIFIED_CREATOR_SESSION'
+                    protocol=wf.protocol_probe(workspace,pid,port,session)
+                    self.server.lab_results.setdefault(pid,{})['probe']=protocol
+                    if self.server.preview_sim.active(pid):raise wf.LabHold('STOP_SYNTHETIC_SIMULATION_BEFORE_OPC_ATTACH')
+                    self.server.lab_live.attach(workspace,pid,port,session=session)
+                    scenario=wf.run_fault_scenario(workspace,pid,port,session)
+                    self.server.lab_results.setdefault(pid,{})['fault']=scenario
+                    data={'status':'PASS_STUDIO_LAB_PROTOCOL_AND_FAULT_ONLY',
+                          'execution':execution,'prepared':prep,'imported':imported,
+                          'readback':protocol,'fault':scenario,
+                          'ignition':'NOT_VERIFIED','production':'HOLD',
+                          'fat':'LAB_SOURCE_AND_EVENT_ONLY_NOT_HMI_FAT'}
+                elif op=='import':
+                    state=wf.studio_state(port)
+                    data,session=wf.import_tags(workspace,pid,port,state,self.server.lab_sessions.get(pid))
+                    self.server.lab_sessions[pid]=session
+                    self.server.lab_results[pid]={}
+                elif op=='probe':
+                    data=wf.protocol_probe(workspace,pid,port,self.server.lab_sessions.get(pid))
+                    self.server.lab_results.setdefault(pid,{})['probe']=data
+                    if self.server.preview_sim.active(pid):raise wf.LabHold('STOP_SYNTHETIC_SIMULATION_BEFORE_OPC_ATTACH')
+                    self.server.lab_live.attach(workspace,pid,port,session=self.server.lab_sessions.get(pid))
+                elif op=='scenario':
+                    data=wf.run_fault_scenario(workspace,pid,port,self.server.lab_sessions.get(pid))
+                    self.server.lab_results.setdefault(pid,{})['fault']=data
+                reply_code=200
+            except (wf.LabHold,ValueError,OSError,KeyError,TypeError) as ex:
+                code=str(ex)
+                if len(code)>160:code='LAB_WORKFLOW_HOLD'
+                reply_code=422
+                data={'status':'HOLD','reason':code,
+                    'production':'HOLD','ignition':'NOT_VERIFIED'}
+            finally:self.server.lab_lock.release()
+            # The response is sent AFTER unlocking so an immediate client follow-up
+            # cannot spuriously race with the previous completed lab action.
+            return self.output(reply_code,data)
+        if route == '/api/engineer/prepare':
+            # The only user-facing Creator preparation workflow: real BYOM -> harness.
+            # The model call itself proves we did not simply accept a front-end 'connected' badge.
+            if origin is None or self.headers.get('X-DevAgent-Request') != 'engineer-pipeline-v1':
+                return self.output(403, {'status':'HOLD','reason':'ENGINEER_ORIGIN_REQUIRED'})
+            try:
+                from .agent_harness import run_harness
+                from .agent_runtime import AgentHold
+                request = strict_loads(self.rfile.read(size))
+                if not isinstance(request,dict) or set(request)-{'wizard','connection','request','max_attempts'}:
+                    raise AgentHold('ENGINEER_REQUEST_INVALID')
+                connection=request.get('connection')
+                if not isinstance(connection,dict) or not connection.get('model'):
+                    raise AgentHold('AI_PROVIDER_REQUIRED')
+                result=run_harness(request)
+                if result.get('status')!='DRAFT_REQUIRES_HUMAN_REVIEW' or not result.get('winner'):
+                    return self.output(422,{'status':'HOLD','reason':'AI_HARNESS_NO_VALID_CANDIDATE',
+                                            'attempts':result.get('attempts',[]),
+                                            'engineering':result.get('engineering',{}),
+                                            'production':'HOLD'})
+                from .agent_harness import _checked_wizard
+                candidate=_checked_wizard(result['winner']['fields'])
+                result['winner']['fields']=candidate
+                digest=hashlib.sha256(json.dumps(candidate,sort_keys=True,ensure_ascii=False,
+                                                  separators=(',',':')).encode('utf8')).hexdigest()
+                token=secrets.token_urlsafe(32)
+                with self.server.engineer_review_lock:
+                    now=time.monotonic()
+                    self.server.engineer_reviews={k:v for k,v in self.server.engineer_reviews.items()
+                        if now-v['created']<600}
+                    if len(self.server.engineer_reviews)>=64:
+                        raise AgentHold('ENGINEER_REVIEW_CAPACITY_HOLD')
+                    self.server.engineer_reviews[token]={'digest':digest,'created':now}
+                result['review_token']=token
+                result['review_expires_seconds']=600
+                result['review_scope']='ISOLATED_CONCEPT_PREVIEW_ONLY'
+                return self.output(200,result)
+            except (AgentHold,ValueError,KeyError,TypeError,RecursionError,OSError) as e:
+                code=str(e)
+                if not re.fullmatch(r'[A-Z][A-Z0-9_]{1,119}',code):code='AI_PIPELINE_HOLD'
+                return self.output(422,{'status':'HOLD','reason':code,'production':'HOLD'})
+        if route == '/api/engineer/build':
+            if origin is None or self.headers.get('X-DevAgent-Request') != 'engineer-pipeline-v1':
+                return self.output(403,{'status':'HOLD','reason':'ENGINEER_ORIGIN_REQUIRED'})
+            try:
+                request=strict_loads(self.rfile.read(size))
+                if not isinstance(request,dict) or set(request)!={'wizard','review_token','confirm'}:
+                    raise BuildHold('ENGINEER_BUILD_SCHEMA_HOLD')
+                if request['confirm']!='CUSTOMER_APPROVED_ISOLATED_CONCEPT_ONLY':
+                    raise BuildHold('CUSTOMER_REVIEW_REQUIRED')
+                token=request['review_token']
+                if not isinstance(token,str) or not 30<=len(token)<=128:
+                    raise BuildHold('ENGINEER_REVIEW_TOKEN_INVALID')
+                from .agent_harness import _checked_wizard
+                wizard=_checked_wizard(request['wizard'])
+                digest=hashlib.sha256(json.dumps(wizard,sort_keys=True,ensure_ascii=False,
+                                                 separators=(',',':')).encode('utf8')).hexdigest()
+                with self.server.engineer_review_lock:
+                    receipt=self.server.engineer_reviews.pop(token,None)
+                if not receipt or time.monotonic()-receipt['created']>600 or not secrets.compare_digest(digest,receipt['digest']):
+                    raise BuildHold('ENGINEER_REVIEW_EXPIRED_OR_INPUT_CHANGED')
+                data=from_wizard(wizard)
+                report=qualify(data)
+                if report['status']=='HOLD':
+                    return self.output(422,{'status':'HOLD','reason':'ENGINEERING_CONTRACT_HOLD',
+                                            'engineering':report,'production':'HOLD'})
+                slug=slugify(data['name']);pid=f'{slug}-{uuid.uuid4().hex[:8]}'
+                built=build(data,self.server.workspace/pid,vendor_three=self.server.vendor_three)
+                return self.output(201,{'status':built['status'],'project_id':pid,
+                  'url':f'/projects/{pid}/viewer/index.html','warnings':built['issues'],
+                  'fat_cases':built['fat_cases_generated'],
+                  'renderer':'THREE_JS_R180' if built['three_vendor_bundled'] else 'SCHEMATIC_FALLBACK',
+                  'ai_pipeline':'SERVER_VERIFIED_HARNESS_REVIEW_RECEIPT',
+                  'ignition':'NOT_VERIFIED','production':'HOLD'})
+            except (BuildHold,ValueError,TypeError,KeyError,RecursionError,OSError) as e:
+                code=str(e)
+                if not re.fullmatch(r'[A-Z][A-Z0-9_]{1,119}',code):code='ENGINEER_BUILD_HOLD'
+                return self.output(422,{'status':'HOLD','reason':code,'production':'HOLD'})
+        if route == '/api/agent/harness':
+            # User explicitly triggers review/AI: no background transmission.
+            if self.headers.get('X-DevAgent-Request') != 'agent-harness-v1' or origin is None:
+                return self.output(403, {'status':'HOLD','reason':'AGENT_CSRF_PROTECTION_REQUIRED'})
+            try:
+                from .agent_harness import run_harness
+                from .agent_runtime import AgentHold
+                raw = strict_loads(self.rfile.read(size))
+                result = run_harness(raw)
+                return self.output(200 if not result['status'].startswith('HOLD') else 422, result)
+            except (AgentHold, ValueError, TypeError, KeyError, RecursionError, OSError) as ex:
+                code = str(ex)
+                if not re.fullmatch(r'[A-Z][A-Z0-9_]{1,119}', code):
+                    code = 'AGENT_HARNESS_FAILED_CLOSED'
+                return self.output(422, {'status':'HOLD','reason':code,
+                                         'production':'HOLD','source_mutation':'NONE'})
+        if route in ('/api/ai/test','/api/agent/draft'):
+            if self.headers.get('X-DevAgent-Request')!='agent-session-v1' or origin is None:
+                return self.output(403,{'error':'AGENT_CSRF_PROTECTION_REQUIRED'})
+            try:
+                from .agent_runtime import connectivity,run_agent,AgentHold
+                raw=strict_loads(self.rfile.read(size))
+                result=connectivity(raw) if route=='/api/ai/test' else run_agent(raw)
+                return self.output(200 if not result['status'].startswith('HOLD') else 422,result)
+            except AgentHold as e:
+                # Expose only internal HOLD codes, never model text or secrets.
+                code=str(e)
+                if not re.fullmatch(r'[A-Z][A-Z0-9_]{1,119}',code):
+                    code='AGENT_PROVIDER_OR_ENGINEERING_VALIDATION_FAILED'
+                return self.output(422,{'status':'HOLD','reason':code,
+                       'detail':'No project was changed. Review provider permissions, model compatibility, or engineering inputs.'})
+            except (ValueError,TypeError,KeyError,RecursionError,UnicodeError):
+                return self.output(422,{'status':'HOLD','reason':'AGENT_PROVIDER_OR_ENGINEERING_VALIDATION_FAILED',
+                       'detail':'No project was changed.'})
+        if route not in ('/api/validate','/api/build'):
+            return self.output(404,{'error':'NOT_FOUND'})
+        if route=='/api/build' and not self.server.allow_legacy_concept_build:
+            return self.output(403,{'status':'HOLD','reason':'AI_ENGINEERING_PIPELINE_REQUIRED',
+                                    'next_action':'USE_ENGINEER_PREPARE_AND_REVIEWED_BUILD',
+                                    'production':'HOLD'})
+        try:
+            payload=strict_loads(self.rfile.read(size))
+            data=from_wizard(payload)
+        except (BuildHold, ValueError, KeyError, TypeError, RecursionError, UnicodeError) as e:
+            return self.output(400,{'status':'HOLD','reason':str(e)[:350]})
+        report=qualify(data)
+        if route=='/api/validate':return self.output(200,report)
+        if report['status']=='HOLD':return self.output(422,report)
+        try:
+            slug=slugify(data['name']);id=f'{slug}-{uuid.uuid4().hex[:8]}'
+            result=build(data,self.server.workspace/id,vendor_three=self.server.vendor_three)
+        except (BuildHold,ValueError,OSError,TypeError,RecursionError) as e:return self.output(422,{'status':'HOLD','reason':str(e)[:350]})
+        return self.output(201,{'status':result['status'],'project_id':id,'url':f'/projects/{id}/viewer/index.html',
+                                'warnings':result['issues'],'fat_cases':result['fat_cases_generated'],
+                                'renderer':'THREE_JS_R180' if result['three_vendor_bundled'] else 'SCHEMATIC_FALLBACK'})