Merge remote-tracking branch 'origin/main' into sdn-server-refactor-ui

# Conflicts:
#	kubo/plugin/plugins/sdnruntime/sdnruntime.go
#	kubo/plugin/plugins/sdnruntime/sdnruntime_test.go
#	kubo/sdn/build/release/Dockerfile.linux
#	kubo/sdn/build/release/build-release.sh
#	kubo/sdn/flowrt/abi_test.go
#	kubo/sdn/flowrt/flatsql_query_test.go
#	kubo/sdn/flowrt/flatsql_store_link.go
#	kubo/sdn/flowrt/flatsql_store_link_test.go
#	kubo/sdn/flowrt/runtime.go
#	kubo/sdn/modulert/hostbridge.go
#	kubo/sdn/modulert/hostbridge_test.go
#	kubo/sdn/modulert/module.go
#	kubo/sdn/modulert/publication_signature.go
#	kubo/sdn/modulert/publication_signature_test.go
#	kubo/sdn/sdnflows/installer.go
#	kubo/sdn/sdnflows/isomorphic_installer_test.go
#	kubo/sdn/sdnservices/opaque_state.go
#	kubo/sdn/sdnservices/opaque_state_test.go
#	kubo/sdn/sdnservices/sdnservices.go
#	sdn-server/cmd/spacedatanetwork/apps_ui.go
#	sdn-server/cmd/spacedatanetwork/apps_ui_test.go
#	sdn-server/cmd/spacedatanetwork/conjunction_ui.go
#	sdn-server/cmd/spacedatanetwork/conjunction_ui_test.go
#	sdn-server/cmd/spacedatanetwork/embedded/conjunction_app.html
#	sdn-server/cmd/spacedatanetwork/embedded/spaceaware_app.html
#	sdn-server/cmd/spacedatanetwork/main.go

Author: TJKoury

README.md

@@ -36,23 +36,23 @@ Space Data Network enables real-time sharing of space situational awareness data
 
 ## Current UI Surfaces
 
-- `/` serves the **conjunction screening app** — the shipped, browser-first SDN
-  UI. It is a single self-contained artifact (all JS/CSS/fonts inlined,
-  no wasm) embedded in the daemon and served from memory. It runs anonymously
-  against public read endpoints (`/api/v1/{peers,channels,stats}`,
-  `/api/v1/data/health`) — no login is required or offered.
+- `/` on a Kubo-integrated or production SDN node serves the **SDN Node
+  Console** from `kubo/sdn/sdnui/assets`. Its rail exposes Node, Peers, Data,
+  Channels, Apps, and Modules, backed by the node's `/sdn/v1` API.
+- `/apps/` on the standalone service is the installed-app launcher, with
+  application pages such as `/apps/conjunction/`. Kubo also exposes installed
+  application records and pages below `/sdn/v1/apps/`.
 - `/login` is the **legacy wallet-bootstrap surface** (wallet creation and
-  first-admin bootstrap for operators). The conjunction app never links to it;
-  it is the daemon's own wallet-gated page.
+  first-admin bootstrap for operators).
 - `/webui` is the upstream-style IPFS WebUI (unchanged).
 - `/admin` is reserved for admin and auth flows.
 
-The shipped UI is conjunction-only (owner directive 2026-07-11). The full
-SpaceAware app (login screen, console, BMC2 boards, orbital, gantt) stays in the
-source tree, dormant, behind a dev switch: set `SDN_UI_MODE=spaceaware` to serve
-that route skeleton for local development. With the switch unset (the shipped
-default), the daemon serves the conjunction app at `/` and returns 404 for the
-descoped SpaceAware screens.
+The standalone `sdn-server` listener can still serve the embedded conjunction
+application at its own `/` route. Production reverse-proxy configuration must
+not use that sidecar root as a replacement for the Kubo SDN Node Console:
+normal public `/`, `/index.html`, and the console's exact assets route to the
+Kubo console, while `/apps/`, wallet, and application API fallbacks remain on
+the standalone service.
 
 The SDN browser path uses `sdn-js` plus the generic async capability surfaces from `space-data-module-sdk` and the existing `hd-wallet-wasm` and `hd-wallet-ui` identity stack. It uses direct SDN APIs and browser-safe package exports without a helper service.
 

deployment/scripts/deploy.sh

@@ -28,6 +28,8 @@ Usage: $0 [OPTIONS] COMMAND [TYPE]
 
 Commands:
     deploy      Deploy to servers (optionally specify type: full, edge, registry)
+    cutover-spaceaware
+                Route spaceaware.io to an already healthy SpaceAware release
     status      Check status of all servers
     logs        Fetch logs from servers
     stop        Stop services on servers
@@ -209,40 +211,67 @@ EOF"
     fi
 }
 
-configure_spaceaware_public_wss_proxy() {
+configure_spaceaware_public_host_route() {
     local ip=$1
-    local config_dir=$2
 
-    if [[ "$config_dir" != "/etc/space-data-network" ]]; then
+    if ! is_spaceaware_config; then
         return
     fi
 
-    ssh_cmd "$ip" "if [ -f /etc/nginx/sites-enabled/spaceaware ]; then
-python3 - <<'PY'
-from pathlib import Path
+    ssh_cmd "$ip" "mkdir -p /opt/spacedatanetwork/deployment/spaceaware"
+    scp_cmd "${DEPLOY_DIR}/spaceaware/install-public-host-route.mjs" "$ip" "/opt/spacedatanetwork/deployment/spaceaware/install-public-host-route.mjs"
+    scp_cmd "${DEPLOY_DIR}/spaceaware/install-spaceaware-public-host-route.mjs" "$ip" "/opt/spacedatanetwork/deployment/spaceaware/install-spaceaware-public-host-route.mjs"
+    scp_cmd "${DEPLOY_DIR}/spaceaware/verify-spaceaware-public-host-route.mjs" "$ip" "/opt/spacedatanetwork/deployment/spaceaware/verify-spaceaware-public-host-route.mjs"
+    ssh_cmd "$ip" "set -euo pipefail
+chown root:root \
+    /opt/spacedatanetwork/deployment/spaceaware/install-public-host-route.mjs \
+    /opt/spacedatanetwork/deployment/spaceaware/install-spaceaware-public-host-route.mjs \
+    /opt/spacedatanetwork/deployment/spaceaware/verify-spaceaware-public-host-route.mjs
+chmod 0755 \
+    /opt/spacedatanetwork/deployment/spaceaware/install-public-host-route.mjs \
+    /opt/spacedatanetwork/deployment/spaceaware/install-spaceaware-public-host-route.mjs \
+    /opt/spacedatanetwork/deployment/spaceaware/verify-spaceaware-public-host-route.mjs
+systemctl cat space-data-network-module-delivery.service >/dev/null
+systemctl restart space-data-network-module-delivery.service
+systemctl is-active --quiet space-data-network-module-delivery.service
+sidecar_ready=false
+for attempt in \$(seq 1 30); do
+    if curl -kfsS --connect-timeout 5 --max-time 15 https://127.0.0.1:18443/ | grep -F 'sdn-node-console-v1' >/dev/null \
+        && curl -kfsS --connect-timeout 5 --max-time 15 https://127.0.0.1:18443/ | grep -F '2.0.28' >/dev/null \
+        && curl -kfsS --connect-timeout 5 --max-time 15 https://127.0.0.1:18443/wallet/callback | grep -F 'Completing wallet connection' >/dev/null \
+        && curl -kfsS --connect-timeout 5 --max-time 15 https://127.0.0.1:18443/api/module-delivery/provider >/dev/null; then
+        sidecar_ready=true
+        break
+    fi
+    sleep 1
+done
+test "\$sidecar_ready" = true
+node /opt/spacedatanetwork/deployment/spaceaware/install-public-host-route.mjs \
+    --verify-script /opt/spacedatanetwork/deployment/spaceaware/verify-spaceaware-public-host-route.mjs"
+}
 
-path = Path('/etc/nginx/sites-enabled/spaceaware')
-text = path.read_text()
-next_text = text.replace(
-    'server_name spaceaware.io www.spaceaware.io;',
-    'server_name spaceaware.io www.spaceaware.io sdn.spaceaware.io;',
-)
-next_text = next_text.replace(
-    'proxy_pass http://127.0.0.1:18080;',
-    'proxy_pass http://127.0.0.1:8080;',
-)
-if next_text != text:
-    backup = path.with_suffix(path.suffix + '.pre-sdn-wss-route')
-    if not backup.exists():
-        backup.write_text(text)
-    path.write_text(next_text)
-PY
-nginx -t
-systemctl reload nginx
-fi
-if systemctl cat space-data-network-module-delivery.service >/dev/null 2>&1; then
-    systemctl restart space-data-network-module-delivery.service || true
-fi"
+cutover_spaceaware_public_host_route() {
+    local ip=$1
+
+    if ! is_spaceaware_config; then
+        log_error "SpaceAware public-host cutover requires deployment/spaceaware/servers.yaml."
+        return 1
+    fi
+
+    ssh_cmd "$ip" "mkdir -p /opt/spacedatanetwork/deployment/spaceaware"
+    scp_cmd "${DEPLOY_DIR}/spaceaware/install-spaceaware-public-host-route.mjs" "$ip" "/opt/spacedatanetwork/deployment/spaceaware/install-spaceaware-public-host-route.mjs"
+    scp_cmd "${DEPLOY_DIR}/spaceaware/verify-spaceaware-public-host-route.mjs" "$ip" "/opt/spacedatanetwork/deployment/spaceaware/verify-spaceaware-public-host-route.mjs"
+    scp_cmd "${DEPLOY_DIR}/spaceaware/cutover-spaceaware-public-host-route.sh" "$ip" "/opt/spacedatanetwork/deployment/spaceaware/cutover-spaceaware-public-host-route.sh"
+    ssh_cmd "$ip" "set -euo pipefail
+chown root:root \
+    /opt/spacedatanetwork/deployment/spaceaware/install-spaceaware-public-host-route.mjs \
+    /opt/spacedatanetwork/deployment/spaceaware/verify-spaceaware-public-host-route.mjs \
+    /opt/spacedatanetwork/deployment/spaceaware/cutover-spaceaware-public-host-route.sh
+chmod 0755 \
+    /opt/spacedatanetwork/deployment/spaceaware/install-spaceaware-public-host-route.mjs \
+    /opt/spacedatanetwork/deployment/spaceaware/verify-spaceaware-public-host-route.mjs \
+    /opt/spacedatanetwork/deployment/spaceaware/cutover-spaceaware-public-host-route.sh
+/opt/spacedatanetwork/deployment/spaceaware/cutover-spaceaware-public-host-route.sh"
 }
 
 prepare_full_node_assets() {
@@ -483,7 +512,7 @@ deploy_binary() {
 
         ssh_cmd "$ip" "chmod 755 ${config_dir} && chown root:root ${config_dir}/config.yaml && chmod 644 ${config_dir}/config.yaml && chmod +x /opt/spacedatanetwork/scripts/install-wasmedge.sh /opt/spacedatanetwork/scripts/go-with-wasmedge.sh && WASMEDGE_DIR=/opt/spacedatanetwork/.wasmedge /opt/spacedatanetwork/scripts/go-with-wasmedge.sh build -o /opt/spacedatanetwork/bin/spacedatanetwork ./cmd/spacedatanetwork && chown -R sdn:sdn /opt/spacedatanetwork /var/lib/spacedatanetwork${spaceaware_migration_hardening}"
         ssh_cmd "$ip" "systemctl daemon-reload && systemctl enable ${full_service} && systemctl restart ${full_service} && if [ '${full_service}' = 'space-data-network' ]; then systemctl disable --now spacedatanetwork >/dev/null 2>&1 || true; fi"
-        configure_spaceaware_public_wss_proxy "$ip" "$config_dir"
+        configure_spaceaware_public_host_route "$ip"
 
         log_success "Deployed full node bundle to $ip"
         return
@@ -596,6 +625,34 @@ do_deploy() {
     done
 }
 
+do_spaceaware_cutover() {
+    local endpoint
+    local found="false"
+
+    if ! is_spaceaware_config; then
+        log_error "SpaceAware public-host cutover requires deployment/spaceaware/servers.yaml."
+        return 1
+    fi
+
+    while IFS= read -r line; do
+        endpoint="$(parse_server_endpoint "$line")"
+        if [[ -z "$endpoint" ]]; then
+            continue
+        fi
+        found="true"
+        if [[ "$DRY_RUN" == "true" ]]; then
+            log_info "[DRY-RUN] Would cut spaceaware.io over on $endpoint after loopback readiness checks"
+        else
+            cutover_spaceaware_public_host_route "$endpoint"
+        fi
+    done < <(sed -n "/^full_nodes:/,/^[a-z]/p" "$CONFIG_FILE")
+
+    if [[ "$found" != "true" ]]; then
+        log_error "No full node target found for SpaceAware public-host cutover."
+        return 1
+    fi
+}
+
 # Parse arguments
 SSH_KEY="${HOME}/.ssh/sdn_deploy_key"
 SSH_USER="root"
@@ -613,7 +670,7 @@ while [[ $# -gt 0 ]]; do
         -b|--binary) USE_DOCKER="false"; shift ;;
         -n|--dry-run) DRY_RUN="true"; shift ;;
         -h|--help) usage ;;
-        deploy|status|logs|stop|restart)
+        deploy|status|logs|stop|restart|cutover-spaceaware)
             COMMAND="$1"
             TYPE="${2:-}"
             shift
@@ -630,6 +687,13 @@ case $COMMAND in
     deploy)
         do_deploy "$TYPE"
         ;;
+    cutover-spaceaware)
+        if [[ -n "$TYPE" ]]; then
+            log_error "cutover-spaceaware does not accept a server type."
+            exit 1
+        fi
+        do_spaceaware_cutover
+        ;;
     status)
         log_info "Checking server status..."
         for t in full edge registry; do

deployment/spaceaware/README.md

@@ -7,6 +7,66 @@ The deployment config uses `host: sdn.spaceaware.io` on purpose. Keep the real
 address and key material in `~/.ssh/config`; do not commit machine-specific SSH
 paths or IP addresses here.
 
+The production edge terminates TLS for `spaceaware.io`, `www.spaceaware.io`,
+and `sdn.spaceaware.io` in Nginx. The first-stage
+`install-public-host-route.mjs` keeps SpaceAware on the local Kubo gateway at
+port 5020. For the SDN host, normal `/`, `/index.html`, and the exact SDN Node
+Console assets route to port 5020; WebSocket upgrades use port 18080. The
+installed-app launcher, wallet, module-delivery APIs, and other SDN fallbacks
+remain on the SDN HTTPS sidecar at port 18443.
+
+After a signed SpaceAware external-proxy release has been installed, the
+separate `cutover-spaceaware` command splits the shared TLS server into two
+host-specific server blocks. SpaceAware and www then use the SpaceAware SDN
+HTTP service at `127.0.0.1:5010`, WebSocket upgrades on `/` and `/p2p/*` use
+`127.0.0.1:8080`, and terrain paths use `127.0.0.1:8081`. The SDN host retains
+the 5020 Node Console, 18443 application sidecar, and 18080 WebSocket split.
+The private `/asset-ipfs/` route and immutable CID cache behavior are retained
+on both hosts.
+
+Both installers apply their change atomically, require a reviewed source
+shape, validate Nginx before reload, and restore the original config if
+validation, reload, or transactional public-route verification fails. Durable
+backups go under
+`/var/backups/spacedatanetwork/nginx`, outside Nginx's `sites-enabled/*`
+include. A retry validates and reloads even when the desired file is already
+installed, so an interruption between replacement and reload is recoverable.
+The installers serialize through `/run/sdn-public-host-route.lock`, recheck the
+config immediately around replacement and reload, and never roll back over a
+concurrent operator edit.
+The final cutover is pinned to the reviewed production source digest and its
+deterministic canonical split digest; any manual byte drift fails closed for
+operator review instead of being partially transformed.
+
+Both deployment paths run `verify-spaceaware-public-host-route.mjs` after
+reload while the original file is still available for rollback. The normal SDN
+deploy uses its shared `sdn-public` contract; the final SpaceAware cutover uses
+the complete two-host contract. The verifier connects directly to
+`127.0.0.1:443` with the production SNI and Host values, bypassing external
+DNS/CDN state. It requires the public SpaceAware release identity and callback
+bytes to match `/opt/spaceaware/current/web`, validates callback method and
+security headers, parses the health and provider JSON contracts, checks both
+terrain prefixes, compares each public provider key and peer ID with its direct
+5010/18443 backend, compares the public SDN console HTML and all exact console
+assets byte-for-byte with the direct 5020 backend, confirms `/apps/` still
+matches the 18443 sidecar, and completes RFC 6455 handshakes through both public
+hosts (including the SDN root and `/p2p/*`). Any failure restores, validates,
+and reloads the pre-cutover Nginx file.
+
+The normal binary deploy invokes only the first-stage SDN installer, and only
+when the exact `deployment/spaceaware/servers.yaml` target is selected. The
+SpaceAware cutover is an explicit second command. It refuses to run unless all
+four SpaceAware units are loaded and active and direct loopback probes for
+ports 5010, 8080, and 8081 pass. The loopback gate requires the exact activated
+release identity, structured health/provider responses, and a valid WebSocket
+handshake. It also requires `wallet.spacedatanetwork.org` to serve its
+content-addressed 2.0.28 login/account JavaScript, CSS, and WASM, validating
+the entrypoint SRI and every filename digest. It separately fetches all three
+activated 2.0.28 wallet assets from `static.spacedatanetwork.org`, accepting
+them only when their SHA-384 bytes match the SRI values in the activated
+callback and OrbPro HTML. Accepting any arbitrary HTTP status is not
+sufficient. It does not restart those services.
+
 From the `space-data-network` repository root:
 
 ```bash
@@ -17,6 +77,21 @@ From the `space-data-network` repository root:
   deploy full
 ```
 
+Once the SpaceAware release is active in external-proxy mode, cut its public
+hosts over without redeploying or restarting either application:
+
+```bash
+./deployment/scripts/deploy.sh \
+  -c deployment/spaceaware/servers.yaml \
+  -u root \
+  cutover-spaceaware
+```
+
+Use `-n` first to confirm the exact target. The cutover command installs the
+reviewed readiness wrapper and route installer under
+`/opt/spacedatanetwork/deployment/spaceaware/`, together with the shared
+verifier; no route file is changed until all readiness checks pass.
+
 Before deploying from a development workstation, make sure the local desktop
 tool is running so the bundled desktop/Kubo integration is healthy in the same
 checkout:
@@ -40,6 +115,8 @@ production service after deploy:
   -b \
   status
 curl -fsS https://sdn.spaceaware.io/ >/dev/null
+curl -fsS https://sdn.spaceaware.io/app.js >/dev/null
+curl -fsS https://sdn.spaceaware.io/apps/ >/dev/null
 curl -fsS https://sdn.spaceaware.io/webui/ >/dev/null
 ```
 

deployment/spaceaware/cutover-spaceaware-public-host-route.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+installer_path="${SPACEAWARE_ROUTE_INSTALLER_PATH:-/opt/spacedatanetwork/deployment/spaceaware/install-spaceaware-public-host-route.mjs}"
+verifier_path="${SPACEAWARE_ROUTE_VERIFIER_PATH:-/opt/spacedatanetwork/deployment/spaceaware/verify-spaceaware-public-host-route.mjs}"
+max_attempts="${SPACEAWARE_CUTOVER_MAX_ATTEMPTS:-30}"
+
+if [[ ! "${max_attempts}" =~ ^[1-9][0-9]*$ ]]; then
+    echo "SPACEAWARE_CUTOVER_MAX_ATTEMPTS must be a positive integer." >&2
+    exit 1
+fi
+if [[ ! -f "${installer_path}" || -L "${installer_path}" ]]; then
+    echo "SpaceAware route installer must be a regular file: ${installer_path}" >&2
+    exit 1
+fi
+if [[ ! -f "${verifier_path}" || -L "${verifier_path}" ]]; then
+    echo "SpaceAware route verifier must be a regular file: ${verifier_path}" >&2
+    exit 1
+fi
+
+required_units=(
+    spaceaware-sdn.service
+    spaceaware-ipfs.service
+    spaceaware-ingest.service
+    spaceaware-terrain-cache.service
+)
+
+for unit in "${required_units[@]}"; do
+    load_state="$(systemctl show --property=LoadState --value "${unit}")"
+    if [[ "${load_state}" != "loaded" ]]; then
+        echo "Required SpaceAware unit is not loaded: ${unit} (${load_state:-unknown})" >&2
+        exit 1
+    fi
+    if ! systemctl is-active --quiet "${unit}"; then
+        echo "Required SpaceAware unit is not active: ${unit}" >&2
+        exit 1
+    fi
+done
+
+spaceaware_ready=false
+for ((attempt = 1; attempt <= max_attempts; attempt += 1)); do
+    if node "${verifier_path}" --mode loopback; then
+        spaceaware_ready=true
+        break
+    fi
+    if (( attempt < max_attempts )); then
+        sleep 1
+    fi
+done
+if [[ "${spaceaware_ready}" != true ]]; then
+    echo "SpaceAware loopback endpoints did not become ready after ${max_attempts} attempts." >&2
+    exit 1
+fi
+
+node "${installer_path}" --verify-script "${verifier_path}"