Model proxy (P1, #1827)
The bus initializes and manages one pinned CLIProxyAPI per instance. PIN records
release URLs and independently reviewable SHA256s of the archive, executable and
panel. mosaic proxy fetch verifies both downloads before installing under
<dataRoot>/opt/cliproxyapi/<version>/; there is no runtime panel update.
From a human terminal, with the business bus running:
mosaic proxy fetch
mosaic proxy init [--port N] [--business ID]
Init prompts twice without echo and passes the key to the bus through its
path-bound human proof. An agent, tester, redirected stdin or mismatched
confirmation refuses. The management key must contain 1–4096 printable ASCII
characters with no spaces (bytes 0x21–0x7e). The bus exclusively creates proxy.json beside config.json,
the private management-key file and initial proxy directory. It never rewrites
config.json. Init does not install/start a service. The validated system config
contains proxy.port and proxy.binary only when proxy.json exists.
The management client is imported by the bus; it only GETs/PUTs the v8 list on 127.0.0.1, never follows redirects, and emits receipts with SHA256 key IDs only. Client-key values are held in memory, never returned by a bus verb. P2 adds per-agent lifecycle integration; this row creates only the sentinel.
The unit starts through a hash-checking runner with the pinned panel directory
and -local-model, so catalogs require no network. Render/install is explicit;
no test or acceptance script installs or starts a host unit.
Acceptance is agents/magica/work/queue-329/acceptance.sh, outside the generic gate. It uses a fresh scratch root and private network namespace. The historical v1.26.7 panel sandbox findings remain in BUILD.md. Q250 / mos-1606 drops the Console panel forward; P4 builds a native Console page. P1 retains the pinned panel asset and records Claude/Codex OAuth redirect URLs for that page.
A stale .proxy-init.lock has no automatic expiry. Only the human may clear it,
after stopping this instance's bus user unit so it cannot restart and confirming
that no initialization operation is active. Check the selected config/data root:
if proxy.json, secrets/proxy-management.key or <dataRoot>/proxy/ exists,
retain that state and resolve the partial/completed initialization separately;
do not delete it to make init run again. If none exists and the bus is stopped,
remove only the stale lock, substituting the actual selected config directory:
rm -- "<configDir>/.proxy-init.lock"
Then start the bus normally and retry init from the human terminal. If the bus
or initialization state is uncertain, leave the lock in place. A refused fetch
may leave empty opt/cliproxyapi/ parent directories; they are not an installed
version and need not be removed before retrying.