platform

Overview ¶

The audio service (ADR-0014): transcription on the internal listener, Lemonade-backed when BESPOKE_LEMONADE_URL is set, stub mode otherwise (models not yet installed on selfie — roadmap backlog).

web_search, gateway-implemented (ADR-0025): the runtime exposes no hosted search tool to SDK sessions, so the gateway serves the tool itself against the Brave Search API. Key from BESPOKE_BRAVE_API_KEY (or BRAVE_API_KEY); without it web_search degrades to fetch-based search (the webFetchHint).

Curated runtime builtins for assistant surfaces (ADR-0024): gateway sessions keep the Copilot CLI's shell, filesystem, and session tools locked out unconditionally; this file defines the small read-only set a request may re-enable (llm.WithBuiltins) and the permission policy that guards it.

Dashboard card fetching (ADR-0017): pull each app's /_card fragment in parallel with the caller's identity forwarded; any miss falls back to the manifest description.

The embeddings gateway (ADR-0029): POST /llm/embed on the internal 4001 plane, backed by Lemonade's OpenAI-compatible /embeddings endpoint when BESPOKE_LEMONADE_URL is set. No stub mode — fake vectors would silently poison stored indexes, so without a backend the endpoint returns 503 and pkg/llm surfaces ErrEmbedUnavailable for callers to degrade on.

The LLM gateway (docs/design/llm-gateway.md, ADR-0009): platformd owns the single Copilot SDK client and serves plain completions to apps on the internal listener. Sessions are inference-only — tools, skills, config discovery, and the session store are all disabled, and any permission request is denied.

platformd v0: the dashboard/registry (docs/design/architecture.md). Scans apps/*/app.toml on every request — the manifests are the registry.

The MCP surface (ADR-0021, converging the ADR-0018 registry's LLM face): one Streamable HTTP endpoint at the apex /mcp exposing every app's tools to external LLM clients, namespaced <slug>_<tool>, executing as the connected tailnet user. Mounted behind auth like every page — Caddy stamps identity on the way in.

Global search fan-out (ADR-0028): query each app's /_search in parallel with the caller's identity forwarded, group results by app. Any miss (absent endpoint, error, slow, oversized) is simply skipped — a broken app can't break search. Mirrors cards.go.