coilyco-flight-deck/infrastructure
2
0
Fork 0
Code Issues 118 Pull requests Projects Releases Packages Wiki Activity Actions 2

Fix skillsmp host Caddy shortcut 404 #525

New issue
Closed
opened 2026-07-10 09:24:55 +00:00 by coilyco-ops · 5 comments
coilyco-ops commented 2026-07-10 09:24:55 +00:00
Member
Copy link

Problem

The deploy-owned skillsmp MCP documents a tailnet-only HTTP shortcut at http://kai-server/skillsmp/mcp, but the live host Caddy route returns 404. The direct NodePort backend works, so this is the host-side shortcut/reload path, not the skillsmp pod.

Evidence from the director surface on 2026-07-10 UTC:

POST http://kai-server.tail09a41b.ts.net/skillsmp/mcp
Host: kai-server
headers: Content-Type: application/json, Accept: application/json, text/event-stream
body: MCP initialize payload
result: HTTP 404 Not Found, body: 404 page not found

POST http://kai-server.tail09a41b.ts.net:30081/mcp
result: HTTP 200, serverInfo skillsmp

The deploy-side issue is coilyco-bridge/deploy#133. That run correctly identified this as infrastructure-owned because the shortcut is host Caddy, not a deploy repo service object.

Do

  • Inspect the kai-server Caddy shortcut config and generator/manual site path for the existing skillsmp shortcut.
  • Fix the route or reload/deploy path so http://kai-server/skillsmp/mcp proxies to 127.0.0.1:30081 and preserves MCP streaming headers.
  • Keep the public https://skillsmp.coilysiren.me/mcp Authelia gate unchanged.
  • Post verification evidence back here and on coilyco-bridge/deploy#133 if possible.

Acceptance

  • POST http://kai-server.tail09a41b.ts.net/skillsmp/mcp with Host: kai-server and MCP initialize headers returns HTTP 200 with serverInfo.name == skillsmp.
  • POST http://kai-server.tail09a41b.ts.net:30081/mcp still returns HTTP 200.
  • Unauthenticated https://skillsmp.coilysiren.me/mcp still returns 401.

Related: infrastructure#474 is the broader consult/design issue for pretty tailnet-direct MCP URLs. This issue is only the concrete repair of the already-documented HTTP shortcut.

Codex, via director surface

## Problem The deploy-owned skillsmp MCP documents a tailnet-only HTTP shortcut at `http://kai-server/skillsmp/mcp`, but the live host Caddy route returns 404. The direct NodePort backend works, so this is the host-side shortcut/reload path, not the skillsmp pod. Evidence from the director surface on 2026-07-10 UTC: ```text POST http://kai-server.tail09a41b.ts.net/skillsmp/mcp Host: kai-server headers: Content-Type: application/json, Accept: application/json, text/event-stream body: MCP initialize payload result: HTTP 404 Not Found, body: 404 page not found POST http://kai-server.tail09a41b.ts.net:30081/mcp result: HTTP 200, serverInfo skillsmp ``` The deploy-side issue is `coilyco-bridge/deploy#133`. That run correctly identified this as infrastructure-owned because the shortcut is host Caddy, not a deploy repo service object. ## Do * Inspect the kai-server Caddy shortcut config and generator/manual site path for the existing skillsmp shortcut. * Fix the route or reload/deploy path so `http://kai-server/skillsmp/mcp` proxies to `127.0.0.1:30081` and preserves MCP streaming headers. * Keep the public `https://skillsmp.coilysiren.me/mcp` Authelia gate unchanged. * Post verification evidence back here and on `coilyco-bridge/deploy#133` if possible. ## Acceptance * `POST http://kai-server.tail09a41b.ts.net/skillsmp/mcp` with `Host: kai-server` and MCP initialize headers returns HTTP 200 with `serverInfo.name == skillsmp`. * `POST http://kai-server.tail09a41b.ts.net:30081/mcp` still returns HTTP 200. * Unauthenticated `https://skillsmp.coilysiren.me/mcp` still returns 401. Related: infrastructure#474 is the broader consult/design issue for pretty tailnet-direct MCP URLs. This issue is only the concrete repair of the already-documented HTTP shortcut. <!-- ward-agent-signature --> Codex, via director surface
coilyco-ops commented 2026-07-10 09:25:05 +00:00
Author
Member
Copy link

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-infrastructure-525 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T09:25:04Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)
  • Resolved: coilyco-flight-deck/infrastructure#525 · branch issue-525 · harness codex · workflow direct-main
  • Run: engineer-codex-infrastructure-525 · ward v0.573.0 · dispatched 2026-07-10T09:25:04Z
  • Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.573.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-infrastructure-525` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T09:25:04Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#525` · branch `issue-525` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-infrastructure-525` · ward `v0.573.0` · dispatched `2026-07-10T09:25:04Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.573.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`
coilyco-ops commented 2026-07-10 09:32:38 +00:00
Author
Member
Copy link

Post-close verification on 2026-07-10 still fails acceptance.

Evidence from the director surface after the issue closed:

POST http://kai-server.tail09a41b.ts.net/skillsmp/mcp
Host: kai-server
headers: Content-Type: application/json, Accept: application/json, text/event-stream
body: MCP initialize payload
result: HTTP 404 Not Found, body: 404 page not found

POST http://kai-server.tail09a41b.ts.net:30081/mcp
result: HTTP 200, serverInfo skillsmp

The issue is reopened because acceptance requires the shortcut path to initialize the skillsmp MCP through host Caddy.

Post-close verification on 2026-07-10 still fails acceptance. Evidence from the director surface after the issue closed: ```text POST http://kai-server.tail09a41b.ts.net/skillsmp/mcp Host: kai-server headers: Content-Type: application/json, Accept: application/json, text/event-stream body: MCP initialize payload result: HTTP 404 Not Found, body: 404 page not found POST http://kai-server.tail09a41b.ts.net:30081/mcp result: HTTP 200, serverInfo skillsmp ``` The issue is reopened because acceptance requires the shortcut path to initialize the skillsmp MCP through host Caddy.
coilyco-ops commented 2026-07-10 09:50:07 +00:00
Author
Member
Copy link

WARD-OUTCOME: blocked 🛑

details

workflow: direct-main; review summary: review gate skipped by ~/.ward/config.yaml default

The implementation felt like a deploy-path bug, then a namespace mismatch, then a dead end. The repo and host both reloaded cleanly, the direct NodePort still returns 200, and the public Authelia gate still returns 401, but the host shortcut still returns 404.

confidence: low
surprises: the host Caddy runtime does not appear to proxy to the expected backend path from the container-visible view, despite the adapted config showing the route.
follow-ups: inspect the actual Caddy runtime namespace or host-to-NodePort path on kai-server before trying another config shape.

WARD-OUTCOME: blocked 🛑 <details><summary>details</summary> workflow: direct-main; review summary: review gate skipped by ~/.ward/config.yaml default The implementation felt like a deploy-path bug, then a namespace mismatch, then a dead end. The repo and host both reloaded cleanly, the direct NodePort still returns 200, and the public Authelia gate still returns 401, but the host shortcut still returns 404. confidence: low surprises: the host Caddy runtime does not appear to proxy to the expected backend path from the container-visible view, despite the adapted config showing the route. follow-ups: inspect the actual Caddy runtime namespace or host-to-NodePort path on kai-server before trying another config shape. </details>
coilyco-ops commented 2026-07-10 10:56:04 +00:00
Author
Member
Copy link

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-infrastructure-525 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T10:56:03Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)
  • Resolved: coilyco-flight-deck/infrastructure#525 · branch issue-525 · harness codex · workflow direct-main
  • Run: engineer-codex-infrastructure-525 · ward v0.580.0 · dispatched 2026-07-10T10:56:03Z
  • Comment thread: 2 included in the pre-flight read, 1 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-infrastructure-525` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T10:56:03Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#525` · branch `issue-525` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-infrastructure-525` · ward `v0.580.0` · dispatched `2026-07-10T10:56:03Z` - **Comment thread:** 2 included in the pre-flight read, 1 stripped (ward's own automated comments). - included: @coilyco-ops (2026-07-10T09:32:38Z), @coilyco-ops (2026-07-10T09:50:07Z) - stripped: @coilyco-ops (2026-07-10T09:25:05Z) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`
coilyco-ops commented 2026-07-10 11:24:15 +00:00
Author
Member
Copy link

WARD-OUTCOME: blocked 🛑

details

workflow: direct-main; review summary: review gate skipped by ~/.ward/config.yaml default
host verification: direct NodePort http://kai-server:30081/mcp stayed 200 and public https://skillsmp.coilysiren.me/mcp stayed 401, but http://kai-server/skillsmp/mcp remained 404 after live Caddy reloads and route variants.
felt: the source fix was straightforward; the live Caddy matcher path felt stubborn.
confidence: medium
surprises: the live admin graph showed the shortcut route while the request still missed it
follow-ups: keep digging the host Caddy match/reload path

WARD-OUTCOME: blocked 🛑 <details><summary>details</summary> workflow: direct-main; review summary: review gate skipped by ~/.ward/config.yaml default host verification: direct NodePort `http://kai-server:30081/mcp` stayed 200 and public `https://skillsmp.coilysiren.me/mcp` stayed 401, but `http://kai-server/skillsmp/mcp` remained 404 after live Caddy reloads and route variants. felt: the source fix was straightforward; the live Caddy matcher path felt stubborn. confidence: medium surprises: the live admin graph showed the shortcut route while the request still missed it follow-ups: keep digging the host Caddy match/reload path </details>
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue-515
issue-486
issue-529
issue-500
issue-483
No results found.
Labels
Clear labels   
burndown-2026-06
Backlog burndown June 2026

  
coherence-core
Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  
consult
A human decision, design, or external action must happen first. Fail-closed default for unlabeled/low-confidence.

  
headless
Agent can take it from open issue to merged change with no human in the loop. The auto-burndown queue.

  
interactive
Agent does the work but pauses at a human checkpoint mid-flight (design choice, destructive step, human-only verification).

  
P0
now / blocking / urgent

  
P1
next / important

  
P2
backlog / will do

  
P3
someday / low

  
P4
icebox / frozen / reopen if it becomes real

No labels
burndown-2026-06
coherence-core
consult
headless
interactive
P0
P1
P2
P3
P4
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
coilyco-flight-deck/infrastructure#525
No description provided.