config: [serve] section for the OpenAI-compatible front door

listen (default :8090, own port so it coexists with [events]), vkey_ref
(the bearer key OpenWebUI connections present; refs only, resolved at
startup), and an optional enabled_models subset of the catalog. Entries
must name a real servable model (mopac-<class> from [models.classes]) so
a typo fails at config load, not mid-request. Example file extended;
once/loop configs without [serve] stay valid.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

harness.toml.example

@@ -153,3 +153,15 @@ secret_ref = "env:HARNESS_DISCOURSE_WEBHOOK_SECRET"
 secret_ref = "env:HARNESS_GITEA_WEBHOOK_SECRET"
 # Gitea always verifies via HMAC-SHA256 in X-Gitea-Signature; the
 # secret_header override does not apply to it.
+
+# SERVE (optional): the `harness serve` OpenAI-compatible front door for
+# OpenWebUI (DESIGN "OWUI front door"). Each [models.classes] class is
+# exposed as a servable model named mopac-<class> (mopac-study,
+# mopac-code, ...); POST /v1/chat/completions runs ONE bounded stateless
+# conductor turn over the conversation history OWUI sends (tools off,
+# v0; non-streaming). Bearer vkey auth — the same value goes into the
+# OWUI connection config. Own port: coexists with [events].
+[serve]
+listen = ":8090"                        # publish on the LAN via docker -p
+vkey_ref = "env:HARNESS_SERVE_VKEY"
+# enabled_models = ["mopac-primary", "mopac-study"]  # optional subset