# TASK: `harness serve` — OpenAI-compatible front door (OWUI is the client)

## Context
DESIGN.md "OWUI front door" section (hermes killed): OpenWebUI = interactive
front door with Cloudron SSO + admin RBAC we don't build. MOPAC serves
OpenAI-compatible `/v1/chat/completions`; each stack/vertical registers as
a "model" in OWUI. OWUI chat and webhooks (`harness events`, already live)
are two doors into the same conductor loop.

## Scope
1. `harness serve` subcommand (Go stdlib net/http, same style as events):
   - `POST /v1/chat/completions` — OpenAI request/response shapes
     (model, messages, temperature, max_tokens; reply = single assistant
     message + usage). NON-streaming v0; return an explicit error if
     `stream:true` is requested (OWUI tolerates non-streaming providers).
   - `GET /v1/models` — lists servable "models" from config (the class ->
     tier map is the catalog: each class is exposed as model
     `mopac-<class>`).
   - Bearer auth (vkey), constant-time; unauthenticated = 401 generic.
   - v0 STATELESS: OWUI sends full conversation history each call — run
     one bounded conductor turn over the assembled history, return the
     final text. No session storage.
   - Model routing: request.model (e.g. `mopac-primary`) maps through the
     existing `[models]` tier map; unknown model = 400 naming valid ones.
2. Config: `[serve]` section (port, default 8090; `enabled_models`
   optional subset). Coexists with `harness events` on its own port.
3. Reuse the conductor turn machinery `once` uses — no copy-paste; if the
   turn package needs a small refactor to accept history, do it cleanly.
4. Tool use inside serve turns: v0 = tools OFF (pure chat path), noted in
   README as Next.

## Build discipline
- ALL DEV IN DOCKER (digest-pinned builder, dev.sh gets a `serve` runner).
- Tests: fake OpenAI client against the real server — auth, model map,
   history assembly, usage accounting, unknown-model 400.
- Docs standard: README section + config table rows + status table update.
- NEVER broad pkill; kill exact PIDs.
- Commits in logical chunks, push to origin main.

## Deliverable
`REPORT-20260829-0000-serve.md` in `~/.coordinate/inbox-pmo/`: endpoints,
the model catalog as configured, test results, exact OWUI connection
settings (base URL + vkey) for Charles to plug in, and what's Next
(streaming, tools).