serve: OpenAI-compatible front door (harness serve)

OpenWebUI becomes the interactive surface by talking to MOPAC like any
OpenAI provider: GET /v1/models lists the servable catalog (one model per
[models.classes] class, named mopac-<class>, routed through the same
tier table `once` uses; unknown model = 400 naming the valid ones) and
POST /v1/chat/completions runs ONE bounded stateless conductor turn over
the sent conversation history — no session storage, tools hard-off,
non-streaming (stream:true gets an explicit 400; OWUI tolerates
non-streaming providers). Bearer vkey auth compares SHA-256 digests in
constant time; missing/wrong keys get one byte-identical 401 body, and
the vkey never reaches logs or responses. temperature/max_tokens are
forwarded upstream; usage is summed across rounds and returned in the
reply. Upstream failures surface as a terse 502. Own port (:8090
default) so it coexists with the events receiver; dev.sh gets a serve
runner publishing 8090 on the LAN. Tests drive a scripted fake OpenAI
upstream through the real HTTP server: auth matrix, catalog + subset,
history assembly (client system message preserved, harness identity
prepended only when missing), multi-round usage accounting, refused
tool-call feedback, knob forwarding, 400/502 paths.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

dev.sh

@@ -3,13 +3,16 @@
 # digest-pinned Docker builder (DESIGN "ALL dev work in Docker" — big rule);
 # the host runs containers, never toolchains.
 #
-# Usage: ./dev.sh {build|vet|test|check|events|loop|smoke|shell} [args...]
+# Usage: ./dev.sh {build|vet|test|check|events|serve|loop|smoke|shell} [args...]
 #
 #   build    compile ./cmd/harness into bin/harness
 #   vet      go vet ./...
 #   test     go test ./...
 #   check    build + vet + test (the pre-commit gate)
 #   events   run `harness events` with host port 4100 published (LAN smoke)
+#   serve    run `harness serve` (OpenAI-compatible front door for OWUI)
+#            with host port 8090 published; vkey + litellm key env passed
+#            through (the vkey value is what the OWUI connection config gets)
 #   loop     run `harness loop` (the self-host daemon; repo bind-mounted so
 #            REPORTs + state/loop/loop.jsonl land in the repo; key env vars
 #            passed through; args go to the loop, e.g. `./dev.sh loop --once`)
@@ -51,6 +54,15 @@ events)
         -e HARNESS_GITEA_WEBHOOK_SECRET \
         "$IMAGE" /h/bin/harness events -listen ":4100" "$@"
     ;;
+serve)
+    # OpenAI-compatible front door for OpenWebUI: port 8090 on the host LAN
+    # (OWUI base URL http://<host>:8090/v1, api key = HARNESS_SERVE_VKEY).
+    # Stop with SIGINT or `docker stop mopac-serve`.
+    exec docker run --rm -i --name mopac-serve -p 8090:8090 \
+        -v "$PWD:/h" -w /h -u "$(id -u):$(id -g)" -e HOME=/tmp \
+        -e HARNESS_SERVE_VKEY -e HARNESS_LITELLM_KEY -e HARNESS_KEYPROXY_TOKEN \
+        "$IMAGE" /h/bin/harness serve -listen ":8090" "$@"
+    ;;
 loop)
     # Self-host daemon: repo bind-mounted (REPORTs + loop.jsonl land in the
     # repo); key refs' env vars passed through. Stop with SIGINT/double Ctrl-C
@@ -68,7 +80,7 @@ shell)
     run sh
     ;;
 *)
-    echo "dev.sh: unknown command $cmd (build|vet|test|check|events|loop|smoke|shell)" >&2
+    echo "dev.sh: unknown command $cmd (build|vet|test|check|events|serve|loop|smoke|shell)" >&2
     exit 1
     ;;
 esac