From d5e41d8cad59573ef8b518197ee5615f2d67f29d Mon Sep 17 00:00:00 2001
From: Vuong Hoang <vh@phasefinal.com>
Date: Mon, 19 Oct 2026 01:15:11 -0700
Subject: [PATCH] fix(svos-front): kernel app origin admits the seat host's
 task reports (POST /tasks/start|progress|checking|exit); every task launch
 had failed start_unreported on a Caddy 404

---
 configs/svos-front/Caddyfile                 |  7 +++++--
 playbooks/svos-front-caddy-task-reports.yaml | 22 ++++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 playbooks/svos-front-caddy-task-reports.yaml

diff --git a/configs/svos-front/Caddyfile b/configs/svos-front/Caddyfile
index 01bb742..1954155 100644
--- a/configs/svos-front/Caddyfile
+++ b/configs/svos-front/Caddyfile
@@ -238,7 +238,8 @@ https://svos-terminal.phasefinal.com:443 {
 #   nh3-dev, read at source): the apps (bridge, terminal, app-miranda, app-high-seat) GET /auth/kernel-key, POST
 #   /auth/enroll, POST /auth/proofs, POST /registry/apps/*/manifest, /verbs/*, POST /seats/enroll; Miranda's agent
 #   connector GET /auth/whoami, /registry/apps, /registry/apps/*, /principals/*/grants, /seats, /events,
-#   /artifacts/resolve (and /verbs/*). Anything else 404. B2's check: GET /auth/kernel-key without a credential is a
+#   /artifacts/resolve (and /verbs/*); app-terminal's task host POST /tasks/start|progress|checking|exit (U15, added
+#   2026-10-19). Anything else 404. B2's check: GET /auth/kernel-key without a credential is a
 #   401 from the KERNEL, not from Caddy.
 # - Client identity/forwarding headers are deleted as on the other sites; the same 1 MiB body cap; nothing streams.
 https://svos-kernel.phasefinal.com:443 {
@@ -277,9 +278,11 @@ https://svos-kernel.phasefinal.com:443 {
 		handle @app_grants {
 			reverse_proxy 127.0.0.1:8410
 		}
+		# 2026-10-19: + the seat host's U15 task reports (apps/terminal svos_terminal/tasks.py -> kernel/app.py). They were
+		# never added after v0.0.11, so every task launch failed start_unreported (Caddy 404) until now.
 		@app_post {
 			method POST
-			path /auth/enroll /auth/proofs /seats/enroll
+			path /auth/enroll /auth/proofs /seats/enroll /tasks/start /tasks/progress /tasks/checking /tasks/exit
 		}
 		handle @app_post {
 			reverse_proxy 127.0.0.1:8410
diff --git a/playbooks/svos-front-caddy-task-reports.yaml b/playbooks/svos-front-caddy-task-reports.yaml
new file mode 100644
index 0000000..e1400d3
--- /dev/null
+++ b/playbooks/svos-front-caddy-task-reports.yaml
@@ -0,0 +1,22 @@
+# nh3-svos: the kernel app origin (svos-kernel.phasefinal.com) admits the seat host's U15 task reports, POST
+# /tasks/start /tasks/progress /tasks/checking /tasks/exit. Missing since v0.0.11, every task launch failed
+# start_unreported: Caddy 404'd the start report, and the helper printed "seat launch failed" (diagnosed 2026-10-19 for
+# svos-dev, thread 01M59KF34NBQ9F0XZB2JJRVTJY). Validate before swap; backup Caddyfile.pre-task-reports; reload, not restart.
+steps:
+  - {name: stage the new Caddyfile, upload: {src: configs/svos-front/Caddyfile, dest: /etc/caddy/Caddyfile.new, mode: "0644"}, sudo: true}
+  - name: Validate, back up, swap, reload
+    sudo: true
+    shell: |
+      set -e
+      cd /etc/caddy
+      set -a; . /etc/caddy/env; set +a
+      /usr/local/bin/caddy validate --config Caddyfile.new --adapter caddyfile 2>&1 | tail -2
+      cp -p Caddyfile Caddyfile.pre-task-reports
+      chown --reference=Caddyfile Caddyfile.new; chmod --reference=Caddyfile Caddyfile.new
+      mv Caddyfile.new Caddyfile
+      systemctl reload caddy-svos; sleep 2; systemctl is-active caddy-svos
+verify:
+  - name: Front door inventory still current
+    sudo: true
+    shell: /usr/local/sbin/svos-front-inventory --check
+    changed_when: "false"