fix(svos-front): kernel app origin admits the seat host's task reports (POST /tasks/start|progress|checking|exit); every task launch had failed start_unreported on a Caddy 404

2026-10-19 01:15:11 -07:00
parent ee6036a172
commit d5e41d8cad
2 changed files with 27 additions and 2 deletions
@@ -238,7 +238,8 @@ https://svos-terminal.phasefinal.com:443 {
 #   nh3-dev, read at source): the apps (bridge, terminal, app-miranda, app-high-seat) GET /auth/kernel-key, POST
 #   /auth/enroll, POST /auth/proofs, POST /registry/apps/*/manifest, /verbs/*, POST /seats/enroll; Miranda's agent
 #   connector GET /auth/whoami, /registry/apps, /registry/apps/*, /principals/*/grants, /seats, /events,
-#   /artifacts/resolve (and /verbs/*). Anything else 404. B2's check: GET /auth/kernel-key without a credential is a
+#   /artifacts/resolve (and /verbs/*); app-terminal's task host POST /tasks/start|progress|checking|exit (U15, added
+#   2026-10-19). Anything else 404. B2's check: GET /auth/kernel-key without a credential is a
 #   401 from the KERNEL, not from Caddy.
 # - Client identity/forwarding headers are deleted as on the other sites; the same 1 MiB body cap; nothing streams.
 https://svos-kernel.phasefinal.com:443 {
@@ -277,9 +278,11 @@ https://svos-kernel.phasefinal.com:443 {
 		handle @app_grants {
 			reverse_proxy 127.0.0.1:8410
 		}
+		# 2026-10-19: + the seat host's U15 task reports (apps/terminal svos_terminal/tasks.py -> kernel/app.py). They were
+		# never added after v0.0.11, so every task launch failed start_unreported (Caddy 404) until now.
 		@app_post {
 			method POST
-			path /auth/enroll /auth/proofs /seats/enroll
+			path /auth/enroll /auth/proofs /seats/enroll /tasks/start /tasks/progress /tasks/checking /tasks/exit
 		}
 		handle @app_post {
 			reverse_proxy 127.0.0.1:8410