# app.99pages.uk HTML5/PWA Deployment

## Role

app.99pages.uk is the remote HTML5/PWA projection for V3. It should not become
the execution owner.

## Responsibilities

- Magic Link sign-in.
- Device/workspace seat binding.
- Registered install path binding.
- Pairing with local Core CLI.
- Run/event projection.
- Approval projection.
- Report display.
- MCP/app manifest browsing.
- Optional links to app-specific projection URLs.

## Non-Responsibilities

- Owning shell execution.
- Owning MCP business logic.
- Re-implementing SubCLI.
- Building a custom UI for every MCP.

## Registration Contract

Before Core CLI is allowed to operate commercially, app.99pages.uk must register
the customer, license seat, device/workspace, Windows USB volume serial, USB
root id, and the intended portable install anchor. The portal must not bind to
the raw drive letter because USB letters and Unix mount points change.

The Windows burner writes `.99pages-usb-root.json` at the USB root and
`.99pages-device-lock.json` into the USB install folder. Local Core CLI
validates that device lock before falling back to the portal-approved install
lock. If a user moves the software folder to a different relative location or
copies only the software folder away from the root marker, Core CLI reports an
anchor mismatch. Operational commands remain blocked until app.99pages.uk
approves a rebind.

## Local Bridge Contract

The portal should communicate with local Core CLI bridge endpoints:

- `/api/health`
- `/api/runs`
- `/api/events`
- `/api/approvals`
- `/api/mcp/manifest`
- `/api/mcp/status`
- `/api/mcp/tools/:module`
- `/api/mcp/call`
- `/api/mcp/resume`
- `/api/subcli/profiles`
- `/api/subcli/spawn`
- `/api/subcli/result`

## Deployment Order

1. Confirm V3 Core CLI passes `99p doctor`.
2. Confirm local bridge works.
3. Confirm Magic Link pairing binds to Core CLI session, not Cockpit.
4. Deploy app.99pages.uk PWA as remote-control surface.
5. Add event/report/approval screens.
6. Add app manifest browser.
7. Add custom visual projections only for high-value workflows.

## Acceptance

- Refreshing the PWA does not lose the paired workspace state.
- User can see runs and approvals.
- User can approve/resume risky MCP calls.
- User can read final reports.
- User can browse app manifests.
- No raw provider/model names are exposed.
