serve: OpenAI-compatible front door (harness serve)

OpenWebUI becomes the interactive surface by talking to MOPAC like any
OpenAI provider: GET /v1/models lists the servable catalog (one model per
[models.classes] class, named mopac-<class>, routed through the same
tier table `once` uses; unknown model = 400 naming the valid ones) and
POST /v1/chat/completions runs ONE bounded stateless conductor turn over
the sent conversation history — no session storage, tools hard-off,
non-streaming (stream:true gets an explicit 400; OWUI tolerates
non-streaming providers). Bearer vkey auth compares SHA-256 digests in
constant time; missing/wrong keys get one byte-identical 401 body, and
the vkey never reaches logs or responses. temperature/max_tokens are
forwarded upstream; usage is summed across rounds and returned in the
reply. Upstream failures surface as a terse 502. Own port (:8090
default) so it coexists with the events receiver; dev.sh gets a serve
runner publishing 8090 on the LAN. Tests drive a scripted fake OpenAI
upstream through the real HTTP server: auth matrix, catalog + subset,
history assembly (client system message preserved, harness identity
prepended only when missing), multi-round usage accounting, refused
tool-call feedback, knob forwarding, 400/502 paths.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

cmd/harness/main.go

@@ -10,12 +10,14 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
 	"ukrrs.com/mopac/harness/internal/config"
 	"ukrrs.com/mopac/harness/internal/events"
 	"ukrrs.com/mopac/harness/internal/loop"
+	"ukrrs.com/mopac/harness/internal/serve"
 )
 
 const usage = `MOPAC harness (v0)
@@ -24,6 +26,7 @@ Usage:
   harness once [-config PATH] [-dry-run] [-demo] [-task-id ID]
   harness loop [-config PATH] [-interval DUR] [-once] [-dry-run]
   harness events [-config PATH] [-listen ADDR]
+  harness serve [-config PATH] [-listen ADDR]
 
 once runs ONE conductor iteration and exits (chain by re-invoking; no daemon):
   intake (Redmine scope, or the [demo] issue) -> plan/model routing ->
@@ -41,6 +44,14 @@ events runs the webhook receiver until SIGINT/SIGTERM: Redmine/Discourse/
   provider event id) and handed to the conductor (dispatch stub for now).
   Routes: POST /hooks/{redmine,discourse,gitea}, GET /healthz.
 
+serve runs the OpenAI-compatible front door until SIGINT/SIGTERM (the
+  OpenWebUI connection): GET /v1/models lists the servable models (one per
+  [models.classes] class, named mopac-<class>), POST /v1/chat/completions
+  runs ONE bounded stateless conductor turn over the sent history and
+  returns the final text + usage. Bearer vkey auth ([serve] vkey_ref);
+  non-streaming v0; tools off. Own port - coexists with events.
+  Routes: POST /v1/chat/completions, GET /v1/models, GET /healthz.
+
 Flags:
   -config PATH    config file (default $HARNESS_CONFIG or ./harness.toml)
   -dry-run        once/loop: intake + plan only; no LLM call, no REPORT,
@@ -49,7 +60,7 @@ Flags:
   -task-id ID     once: run only the task/issue with this id
   -interval DUR   loop: poll interval (overrides [loop] poll_interval_secs)
   -once           loop: single scan then exit (cron-able)
-  -listen ADDR    events: bind address (overrides [events] listen)
+  -listen ADDR    events/serve: bind address (overrides [events]/[serve] listen)
 
 Exit codes:
   0 ok (including "no tasks in scope"; loop: clean SIGINT stop)
@@ -77,6 +88,8 @@ func run(args []string) int {
 		return runLoop(args[1:])
 	case "events":
 		return runEvents(args[1:])
+	case "serve":
+		return runServe(args[1:])
 	default:
 		fmt.Fprintf(os.Stderr, "harness: unknown command %q\n\n%s", args[0], usage)
 		return 1
@@ -249,3 +262,67 @@ func runEvents(args []string) int {
 	fmt.Printf("harness: events receiver stopped\n")
 	return 0
 }
+
+func runServe(args []string) int {
+	fs := flag.NewFlagSet("serve", flag.ContinueOnError)
+	cfgPath := fs.String("config", "", "config file path")
+	listen := fs.String("listen", "", "bind address (overrides [serve] listen)")
+	if err := fs.Parse(args); err != nil {
+		return 1
+	}
+	if fs.NArg() > 0 {
+		fmt.Fprintf(os.Stderr, "harness: unexpected argument %q\n", fs.Arg(0))
+		return 1
+	}
+
+	if *cfgPath == "" {
+		*cfgPath = os.Getenv("HARNESS_CONFIG")
+	}
+	if *cfgPath == "" {
+		*cfgPath = "harness.toml"
+	}
+	cfg, err := config.Load(*cfgPath)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "harness: %v\n", err)
+		return 1
+	}
+	// The conductor owns the turn machinery and the model router the
+	// catalog is built from.
+	conductor, err := loop.New(cfg, os.Stdout)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "harness: %v\n", err)
+		return 1
+	}
+	srv, err := serve.NewServer(cfg.Serve, conductor.Router(), conductor, os.Stdout)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "harness: %v\n", err)
+		return 1
+	}
+	if *listen == "" {
+		*listen = cfg.Serve.Listen
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	httpSrv := &http.Server{
+		Addr:              *listen,
+		Handler:           srv.Handler(),
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+	go func() {
+		<-ctx.Done()
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = httpSrv.Shutdown(shutdownCtx)
+	}()
+
+	fmt.Printf("harness: serve (OpenAI-compatible) on %s (models: %s)\n", *listen, strings.Join(srv.ModelNames(), ", "))
+	err = httpSrv.ListenAndServe()
+	if err != nil && !errors.Is(err, http.ErrServerClosed) {
+		fmt.Fprintf(os.Stderr, "harness: %v\n", err)
+		return 1
+	}
+	fmt.Printf("harness: serve stopped\n")
+	return 0
+}