Website visitors now have a single registration path through the CodeGW sign-up page, while the header no longer presents a separate login action beside registration. Static export output is included so the repository matches the deployed Azure Static Web Apps artifact.
Constraint: Website must use the CodeGW sign-up URL and remove the header login button.
Rejected: Keeping the separate Agnet login URL | it sends registration traffic to the wrong surface.
Confidence: high
Scope-risk: narrow
Directive: Keep public website registration links pointed at https://code.xinghanlab.com/sign-up unless product routing changes.
Tested: pnpm run build; Azure Static Web Apps production deploy; live curl checks for sign-up URL and removed login link.
Not-tested: Browser visual pass after deployment.
Co-authored-by: OmX <omx@oh-my-codex.dev>
Manager now exposes a Resource Grant manifest and the Agnet control-plane response carries runtime state, agent instances, and permission_manifest so frontend runs can submit bounded resource grants without plaintext credentials.
Constraint: Manager remains the user console while NewAPI stays independent and OpenBao is referenced through secret_ref only.
Rejected: platform-side high-risk approval | client approval is the product boundary; Agnet only validates approval evidence.
Confidence: medium
Scope-risk: moderate
Directive: Do not mix child Agnet runtime model selection with NewAPI billing or expose OpenBao as a public route.
Tested: git diff --check; jq empty locale JSON; go vet ./controller ./model ./router; go test -count=1 ./controller ./model ./router
Not-tested: frontend typecheck/build because local node_modules tooling is absent and user requested builds happen on the VM.
Co-authored-by: OmX <omx@oh-my-codex.dev>
Manager needs a platform-owned secret handoff path so resource bindings can keep only vault references while OpenBao stores tenant-scoped credential payloads.
Tested: go test ./controller ./model ./router && go vet ./controller ./model ./router
Co-authored-by: OmX <omx@oh-my-codex.dev>
Worker 3 completed the assigned validation pass without source edits, recording backend pass evidence plus environment and contract findings for leader integration.
Tested: go vet ./controller ./model ./router; go test focused resource and Agnet grant cases; go test ./controller ./model ./router; git diff --check; focused docs secret scan.
Not-tested: frontend tsc/eslint require bun or full web dependencies; live Agnet curl checks require credentials and service URL.
Co-authored-by: OmX <omx@oh-my-codex.dev>
External IdP login alone did not set Gin session; proxied API calls returned 401 and triggered session-expired toast. Call POST /api/user/login after token exchange, support Turnstile on sign-in, handle 2FA pending session, and clear Manager cookie on logout.
Made-with: Cursor
