Move the quiet-toggle and pattern-extraction slices out of voice.go (#321)

Continues the decomposition PR #50 started. voice.go 542 -> 365:

  quiet_toggle.go  144  resolveQuietToggle, quietInflections, quietStem,
                        quietTokens, quietPhrase, quietOn/OffPhrases,
                        classifyQuietToggle  (quiet_toggle_test.go already
                        existed for these)
  patterns.go     +44  detectPattern, next to detectAndPropose which it calls
                        and which patterns.go's own header already pointed at

What is left in voice.go is the handler: reactiveHandler, HandlePushToTalk,
handleText, runTurn, applyAction, replySystem, chatHistory, reply.

Move-only: all 133 distinct non-blank lines removed from voice.go were
matched in the two destination files, zero lines added to voice.go. The only
non-move edits are import lists (log added to patterns.go, unicode and
internal/pattern dropped from voice.go) and two comments that pointed at
voice.go for code that is no longer there.

cmd/mavend/patterns.go

@@ -1,6 +1,6 @@
 // mavend/patterns.go — the shared detect+propose step of pattern inference
 // (Vikunja #43). Event *extraction* (fact -> action/object) happens at fact-
-// write time in voice.go's detectPattern, tied to whichever channel wrote the
+// write time in detectPattern below, tied to whichever channel wrote the
 // fact. Detection — turning a run of events into a proposed routine — is
 // channel-agnostic: it only needs what's already in the events table, so it
 // runs both right after a voice fact-write (for the immediate "напоминать?"
@@ -13,6 +13,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log"
 	"time"
 
 	"github.com/kami/maven/internal/pattern"
@@ -72,3 +73,48 @@ func detectAndPropose(ctx context.Context, ds *store.Store, action, object strin
 	}
 	return r, id, nil
 }
+
+// detectPattern extracts an event from the written fact and runs the pattern
+// detector. If a stable recurring pattern is found and no proposed routine
+// exists for this action+object yet, one is created and the user is prompted
+// to confirm via the park() mechanism. Returns the suggestion phrase when a
+// new proposal was created and parked; "" otherwise.
+func (h *reactiveHandler) detectPattern(ctx context.Context, factID int64, key, value string, ts time.Time) string {
+	ev := pattern.Extract(factID, key, value, ts)
+	if ev == nil {
+		return "" // not an actionable event
+	}
+	if _, err := h.dataStore.CreateEvent(ctx, factID, ev.Action, ev.Object, ts); err != nil {
+		log.Printf("voice: create event: %v", err)
+		return ""
+	}
+	// Detect+propose (Vikunja #43) is shared with the digestion tick's
+	// proactive scan — see detectAndPropose above. Event *extraction* stays
+	// here, tied to this fact write; detection over the accumulated history does
+	// not need to happen right now for the voice path to have already done
+	// its job — it's dedupe-safe to also let the next tick find the same
+	// pattern independently.
+	r, id, err := detectAndPropose(ctx, h.dataStore, ev.Action, ev.Object, ts)
+	if err != nil {
+		log.Printf("voice: detect pattern %s/%s: %v", ev.Action, ev.Object, err)
+		return ""
+	}
+	if r == nil {
+		return "" // not enough data, too irregular, or already proposed/decided
+	}
+	log.Printf("voice: proposed routine: %s/%s every %.1f days", r.Action, r.Object, r.IntervalDays)
+
+	// Park the proposal for voice confirmation.
+	phrase := pattern.PhraseRoutine(r)
+	h.mu.Lock()
+	h.pendingRoutine = &pendingRoutineConfirm{
+		routineID: id,
+		action:    r.Action,
+		object:    r.Object,
+		interval:  r.IntervalDays,
+		phrase:    phrase,
+		expiry:    ts.Add(confirmTTL),
+	}
+	h.mu.Unlock()
+	return phrase
+}

cmd/mavend/quiet_toggle.go

@@ -0,0 +1,144 @@
+// Quiet-mode toggle recognition — the pre-route keyword check that lets
+// "тихий режим" flip the daemon-wide quiet_hours config without going through
+// the router. Moved out of voice.go unchanged (Vikunja #321); the tests live in
+// quiet_toggle_test.go.
+package main
+
+import (
+	"context"
+	"log"
+	"strings"
+	"unicode"
+
+	"github.com/kami/maven/internal/ipc"
+)
+
+// resolveQuietToggle — pre-route keyword check. Returns (reply, true) when
+// the utterance is a quiet-on/off command; ("", false) otherwise. Called from
+// runTurn BEFORE the router so a classifier miscue can't drop it — which means
+// both the voice path and the text path (mavweb /api/chat, telegram) reach it,
+// so a false positive here is a network-reachable way to flip a daemon-wide
+// setting. See classifyQuietToggle for the matching rule.
+func (h *reactiveHandler) resolveQuietToggle(ctx context.Context, text string) (string, bool) {
+	on, off := classifyQuietToggle(text)
+	if !on && !off {
+		return "", false
+	}
+	val := "false"
+	reply := "тихий режим выключен."
+	if on {
+		val = "true"
+		reply = "тихий режим включён. буду реже напоминать."
+	}
+	if _, err := h.api.WriteFact(ctx, ipc.WriteFactReq{
+		Ts:         h.now(),
+		Kind:       "config",
+		Key:        "quiet_hours",
+		Value:      val,
+		Source:     "tap:voice",
+		Confidence: 1.0,
+	}); err != nil {
+		log.Printf("voice: write quiet_hours: %v", err)
+		return "не получилось переключить тихий режим.", true
+	}
+	return reply, true
+}
+
+// quietInflections — the inflectional endings a stem may carry and still be
+// the same word. Adjective/adverb/noun/verb endings, all ≤3 letters. This is
+// what separates "тихий"/"тихом"/"тихо" (stem "тих" + a real ending) from
+// "тихонько"/"потихоньку", which are different words: "онько" is not an
+// ending, and "потихоньку" doesn't start with the stem at all.
+var quietInflections = []string{
+	"", "а", "е", "и", "й", "о", "у", "ы", "ю", "я",
+	"ая", "ее", "ей", "ем", "ие", "ий", "им", "их", "ия", "ию", "ое", "ой", "ом", "ую", "ые", "ый", "ым", "ых", "ья",
+	"ами", "ого", "ому", "ыми", "ать", "ить", "ять",
+}
+
+// quietStem reports whether tok is the given stem carrying at most one
+// inflectional ending. Word boundaries come from tokenisation (see
+// quietTokens), not from a regexp — Go's \b is ASCII-oriented and treats every
+// Cyrillic letter as a non-word character, so `\bтих\b` would happily match
+// inside "тихонько". Comparing whole tokens sidesteps that entirely.
+func quietStem(tok, stem string) bool {
+	if !strings.HasPrefix(tok, stem) {
+		return false
+	}
+	suffix := tok[len(stem):]
+	for _, e := range quietInflections {
+		if suffix == e {
+			return true
+		}
+	}
+	return false
+}
+
+// quietTokens splits an utterance into lowercase word tokens, dropping
+// punctuation and spacing. Unicode-aware, so Cyrillic words tokenise the same
+// way ASCII ones do.
+func quietTokens(text string) []string {
+	return strings.FieldsFunc(strings.ToLower(strings.TrimSpace(text)), func(r rune) bool {
+		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
+	})
+}
+
+// quietPhrase matches a pattern (a sequence of stems) against the token list.
+// Multi-word patterns match any contiguous run of tokens — "включи тихий
+// режим" carries "тихий режим". Single-word patterns match ONLY when they are
+// the whole utterance: bare "тихо" is a command, but "в комнате тихо" is a
+// remark about the room and must not flip a daemon-wide setting.
+func quietPhrase(tokens, pattern []string) bool {
+	if len(pattern) == 0 || len(tokens) < len(pattern) {
+		return false
+	}
+	if len(pattern) == 1 {
+		return len(tokens) == 1 && quietStem(tokens[0], pattern[0])
+	}
+	for i := 0; i+len(pattern) <= len(tokens); i++ {
+		hit := true
+		for j, stem := range pattern {
+			if !quietStem(tokens[i+j], stem) {
+				hit = false
+				break
+			}
+		}
+		if hit {
+			return true
+		}
+	}
+	return false
+}
+
+// quietOffPhrases / quietOnPhrases — the toggle vocabulary, as stem sequences.
+var (
+	quietOffPhrases = [][]string{
+		{"quiet", "off"}, {"quiet", "end"},
+		{"громк", "режим"}, {"шумн", "режим"},
+		{"отмен", "тих"}, {"выключ", "тих"}, {"не", "тих"},
+	}
+	quietOnPhrases = [][]string{
+		{"quiet", "on"}, {"quiet", "mode"},
+		{"тих", "режим"}, {"не", "шум"}, {"не", "беспоко"},
+		{"тих"},
+	}
+)
+
+// classifyQuietToggle reads an utterance as a quiet-mode command. OFF is
+// resolved before ON for the same reason classifyConfirm checks negatives
+// first: the OFF phrases are built out of the ON words ("выключи тихий"
+// contains "тихий"), so scanning ON first would shadow them and "выключи
+// тихий режим" would turn quiet mode on. Negation wins.
+func classifyQuietToggle(text string) (on, off bool) {
+	tokens := quietTokens(text)
+	for _, p := range quietOffPhrases {
+		if quietPhrase(tokens, p) {
+			return false, true
+		}
+	}
+	for _, p := range quietOnPhrases {
+		if quietPhrase(tokens, p) {
+			return true, false
+		}
+	}
+	return false, false
+}

cmd/mavend/voice.go

@@ -50,13 +50,11 @@ import (
 	"strings"
 	"sync"
 	"time"
-	"unicode"
 
 	"github.com/kami/maven/internal/audio"
 	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/memory"
-	"github.com/kami/maven/internal/pattern"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
@@ -277,181 +275,6 @@ func (h *reactiveHandler) applyAction(ctx context.Context, dec router.Decision)
 	return ""
 }
 
-// detectPattern extracts an event from the written fact and runs the pattern
-// detector. If a stable recurring pattern is found and no proposed routine
-// exists for this action+object yet, one is created and the user is prompted
-// to confirm via the park() mechanism. Returns the suggestion phrase when a
-// new proposal was created and parked; "" otherwise.
-func (h *reactiveHandler) detectPattern(ctx context.Context, factID int64, key, value string, ts time.Time) string {
-	ev := pattern.Extract(factID, key, value, ts)
-	if ev == nil {
-		return "" // not an actionable event
-	}
-	if _, err := h.dataStore.CreateEvent(ctx, factID, ev.Action, ev.Object, ts); err != nil {
-		log.Printf("voice: create event: %v", err)
-		return ""
-	}
-	// Detect+propose (Vikunja #43) is shared with the digestion tick's
-	// proactive scan — see patterns.go. Event *extraction* above stays here,
-	// tied to this fact write; detection over the accumulated history does
-	// not need to happen right now for the voice path to have already done
-	// its job — it's dedupe-safe to also let the next tick find the same
-	// pattern independently.
-	r, id, err := detectAndPropose(ctx, h.dataStore, ev.Action, ev.Object, ts)
-	if err != nil {
-		log.Printf("voice: detect pattern %s/%s: %v", ev.Action, ev.Object, err)
-		return ""
-	}
-	if r == nil {
-		return "" // not enough data, too irregular, or already proposed/decided
-	}
-	log.Printf("voice: proposed routine: %s/%s every %.1f days", r.Action, r.Object, r.IntervalDays)
-
-	// Park the proposal for voice confirmation.
-	phrase := pattern.PhraseRoutine(r)
-	h.mu.Lock()
-	h.pendingRoutine = &pendingRoutineConfirm{
-		routineID: id,
-		action:    r.Action,
-		object:    r.Object,
-		interval:  r.IntervalDays,
-		phrase:    phrase,
-		expiry:    ts.Add(confirmTTL),
-	}
-	h.mu.Unlock()
-	return phrase
-}
-
-// resolveQuietToggle — pre-route keyword check. Returns (reply, true) when
-// the utterance is a quiet-on/off command; ("", false) otherwise. Called from
-// runTurn BEFORE the router so a classifier miscue can't drop it — which means
-// both the voice path and the text path (mavweb /api/chat, telegram) reach it,
-// so a false positive here is a network-reachable way to flip a daemon-wide
-// setting. See classifyQuietToggle for the matching rule.
-func (h *reactiveHandler) resolveQuietToggle(ctx context.Context, text string) (string, bool) {
-	on, off := classifyQuietToggle(text)
-	if !on && !off {
-		return "", false
-	}
-	val := "false"
-	reply := "тихий режим выключен."
-	if on {
-		val = "true"
-		reply = "тихий режим включён. буду реже напоминать."
-	}
-	if _, err := h.api.WriteFact(ctx, ipc.WriteFactReq{
-		Ts:         h.now(),
-		Kind:       "config",
-		Key:        "quiet_hours",
-		Value:      val,
-		Source:     "tap:voice",
-		Confidence: 1.0,
-	}); err != nil {
-		log.Printf("voice: write quiet_hours: %v", err)
-		return "не получилось переключить тихий режим.", true
-	}
-	return reply, true
-}
-
-// quietInflections — the inflectional endings a stem may carry and still be
-// the same word. Adjective/adverb/noun/verb endings, all ≤3 letters. This is
-// what separates "тихий"/"тихом"/"тихо" (stem "тих" + a real ending) from
-// "тихонько"/"потихоньку", which are different words: "онько" is not an
-// ending, and "потихоньку" doesn't start with the stem at all.
-var quietInflections = []string{
-	"", "а", "е", "и", "й", "о", "у", "ы", "ю", "я",
-	"ая", "ее", "ей", "ем", "ие", "ий", "им", "их", "ия", "ию", "ое", "ой", "ом", "ую", "ые", "ый", "ым", "ых", "ья",
-	"ами", "ого", "ому", "ыми", "ать", "ить", "ять",
-}
-
-// quietStem reports whether tok is the given stem carrying at most one
-// inflectional ending. Word boundaries come from tokenisation (see
-// quietTokens), not from a regexp — Go's \b is ASCII-oriented and treats every
-// Cyrillic letter as a non-word character, so `\bтих\b` would happily match
-// inside "тихонько". Comparing whole tokens sidesteps that entirely.
-func quietStem(tok, stem string) bool {
-	if !strings.HasPrefix(tok, stem) {
-		return false
-	}
-	suffix := tok[len(stem):]
-	for _, e := range quietInflections {
-		if suffix == e {
-			return true
-		}
-	}
-	return false
-}
-
-// quietTokens splits an utterance into lowercase word tokens, dropping
-// punctuation and spacing. Unicode-aware, so Cyrillic words tokenise the same
-// way ASCII ones do.
-func quietTokens(text string) []string {
-	return strings.FieldsFunc(strings.ToLower(strings.TrimSpace(text)), func(r rune) bool {
-		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
-	})
-}
-
-// quietPhrase matches a pattern (a sequence of stems) against the token list.
-// Multi-word patterns match any contiguous run of tokens — "включи тихий
-// режим" carries "тихий режим". Single-word patterns match ONLY when they are
-// the whole utterance: bare "тихо" is a command, but "в комнате тихо" is a
-// remark about the room and must not flip a daemon-wide setting.
-func quietPhrase(tokens, pattern []string) bool {
-	if len(pattern) == 0 || len(tokens) < len(pattern) {
-		return false
-	}
-	if len(pattern) == 1 {
-		return len(tokens) == 1 && quietStem(tokens[0], pattern[0])
-	}
-	for i := 0; i+len(pattern) <= len(tokens); i++ {
-		hit := true
-		for j, stem := range pattern {
-			if !quietStem(tokens[i+j], stem) {
-				hit = false
-				break
-			}
-		}
-		if hit {
-			return true
-		}
-	}
-	return false
-}
-
-// quietOffPhrases / quietOnPhrases — the toggle vocabulary, as stem sequences.
-var (
-	quietOffPhrases = [][]string{
-		{"quiet", "off"}, {"quiet", "end"},
-		{"громк", "режим"}, {"шумн", "режим"},
-		{"отмен", "тих"}, {"выключ", "тих"}, {"не", "тих"},
-	}
-	quietOnPhrases = [][]string{
-		{"quiet", "on"}, {"quiet", "mode"},
-		{"тих", "режим"}, {"не", "шум"}, {"не", "беспоко"},
-		{"тих"},
-	}
-)
-
-// classifyQuietToggle reads an utterance as a quiet-mode command. OFF is
-// resolved before ON for the same reason classifyConfirm checks negatives
-// first: the OFF phrases are built out of the ON words ("выключи тихий"
-// contains "тихий"), so scanning ON first would shadow them and "выключи
-// тихий режим" would turn quiet mode on. Negation wins.
-func classifyQuietToggle(text string) (on, off bool) {
-	tokens := quietTokens(text)
-	for _, p := range quietOffPhrases {
-		if quietPhrase(tokens, p) {
-			return false, true
-		}
-	}
-	for _, p := range quietOnPhrases {
-		if quietPhrase(tokens, p) {
-			return true, false
-		}
-	}
-	return false, false
-}
-
 // replySystem answers system-observable queries using the handler's clock
 // and (in future) system interfaces. The decision's utterance is parsed
 // for keywords to determine what the user is asking about.

cmd/mavweb/handlers_test.go

@@ -63,6 +63,18 @@ type fakeCore struct {
 	// for handleTrace tests
 	tickTrace ipc.TickTrace
 	traceErr  error
+
+	// for handleChatAPI tests
+	chatText string
+	chatErr  error
+}
+
+func (f *fakeCore) Chat(_ context.Context, text string) (string, error) {
+	f.chatText = text
+	if f.chatErr != nil {
+		return "", f.chatErr
+	}
+	return "поняла", nil
 }
 
 func (f *fakeCore) EnableTool(_ context.Context, name string, cmd []string, destructive bool, scope string, _ time.Time) error {
@@ -1045,3 +1057,64 @@ func TestHandleRoutines_NilCore_503(t *testing.T) {
 		t.Fatalf("status = %d, want 503", rr.Code)
 	}
 }
+
+// --- handleChatAPI step-up gate (Vikunja #317) ---
+//
+// POST /api/chat reaches the router, the LLM and the act path, so it carries
+// the same gate as POST /tools and POST /api/revert.
+
+func postChat(text string) *http.Request {
+	req := httptest.NewRequest(http.MethodPost, "/api/chat", strings.NewReader("text="+url.QueryEscape(text)))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	return req
+}
+
+func TestHandleChatAPI_RequireStepUp_FailsClosed(t *testing.T) {
+	core := &fakeCore{}
+	rr := httptest.NewRecorder()
+	handleChatAPI(rr, postChat("выключи свет"), core, nil, true)
+	if rr.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body=%s", rr.Code, rr.Body.String())
+	}
+	if core.chatText != "" {
+		t.Errorf("core.Chat called with %q, but -require-stepup should deny", core.chatText)
+	}
+}
+
+func TestHandleChatAPI_UnassertedSession_Denied(t *testing.T) {
+	core := &fakeCore{}
+	rr := httptest.NewRecorder()
+	handleChatAPI(rr, postChat("выключи свет"), core, webauthn.NewPasskeySession(5*time.Minute), false)
+	if rr.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rr.Code)
+	}
+	if core.chatText != "" {
+		t.Errorf("core.Chat called with %q despite an unasserted session", core.chatText)
+	}
+}
+
+func TestHandleChatAPI_AssertedSession_PassesGate(t *testing.T) {
+	core := &fakeCore{}
+	rr := httptest.NewRecorder()
+	handleChatAPI(rr, postChat("привет"), core, stepUpSession(), true)
+	if rr.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303; body=%s", rr.Code, rr.Body.String())
+	}
+	if core.chatText != "привет" {
+		t.Errorf("core.Chat text = %q, want %q", core.chatText, "привет")
+	}
+}
+
+// Default deploy: WebAuthn unconfigured and -require-stepup off ⇒ chat keeps
+// working, resting on the transport-level auth in front of mavweb.
+func TestHandleChatAPI_FailOpenByDefault(t *testing.T) {
+	core := &fakeCore{}
+	rr := httptest.NewRecorder()
+	handleChatAPI(rr, postChat("привет"), core, nil, false)
+	if rr.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303", rr.Code)
+	}
+	if core.chatText != "привет" {
+		t.Errorf("core.Chat text = %q, want %q", core.chatText, "привет")
+	}
+}

cmd/mavweb/main.go

@@ -329,7 +329,7 @@ func main() {
 	coreSock := flag.String("core", "", "mavend IPC socket path for presence-signal ingest (empty = disabled)")
 	pkOrigin := flag.String("webauthn-origin", "", "WebAuthn origin URL (e.g. https://maven.kvmx.ru)")
 	pkRPID := flag.String("webauthn-rpid", "", "WebAuthn RP ID (e.g. maven.kvmx.ru)")
-	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (/tools POST, /api/revert) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
+	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /api/revert, /api/chat) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
 	pkFile := flag.String("passkey-file", "./passkeys.json", "path to WebAuthn credential store (JSON)")
 	nexusURL := flag.String("nexus", "", "Nexus base URL for the /ecosystem panel (empty = not configured)")
 	praxisURL := flag.String("praxis", "", "Praxis base URL for the /ecosystem panel (empty = not configured)")
@@ -434,9 +434,9 @@ func main() {
 	}
 	if stepUpSession == nil {
 		if *requireStepUp {
-			log.Printf("SECURITY: step-up verification is DISABLED (-webauthn-origin/-webauthn-rpid unset) and -require-stepup is set: POST /tools (tool enable/disable/dismiss — defines and executes arbitrary argv) and POST /api/revert will be DENIED (403). Set -webauthn-origin and -webauthn-rpid to enable passkey step-up.")
+			log.Printf("SECURITY: step-up verification is DISABLED (-webauthn-origin/-webauthn-rpid unset) and -require-stepup is set: POST /tools (tool enable/disable/dismiss — defines and executes arbitrary argv), POST /routines (accepting schedules recurring firing), POST /api/revert and POST /api/chat (reaches the router, the LLM and the act path) will be DENIED (403). Set -webauthn-origin and -webauthn-rpid to enable passkey step-up.")
 		} else {
-			log.Printf("SECURITY WARNING: step-up verification is DISABLED because -webauthn-origin/-webauthn-rpid are unset. UNGUARDED SURFACES: POST /tools (defines arbitrary argv via name+cmd, which internal/tool then EXECUTES) and POST /api/revert (voids the latest fact for a key). These are protected only by whatever transport-level auth sits in front of mavweb (wg+nginx+auth) — do NOT expose -addr on a public interface. Set -webauthn-origin and -webauthn-rpid to require passkey step-up, or pass -require-stepup to fail closed instead.")
+			log.Printf("SECURITY WARNING: step-up verification is DISABLED because -webauthn-origin/-webauthn-rpid are unset. UNGUARDED SURFACES: POST /tools (defines arbitrary argv via name+cmd, which internal/tool then EXECUTES), POST /routines (accepting schedules recurring firing), POST /api/revert (voids the latest fact for a key) and POST /api/chat (reaches the router, the LLM and, through applyAction, the act path). These are protected only by whatever transport-level auth sits in front of mavweb (wg+nginx+auth) — do NOT expose -addr on a public interface. Set -webauthn-origin and -webauthn-rpid to require passkey step-up, or pass -require-stepup to fail closed instead.")
 		}
 	}
 
@@ -454,14 +454,26 @@ func main() {
 		handleRoutines(w, r, core, stepUpSession, *requireStepUp)
 	})
 
-	// /api/revert voids the latest fact for a key — a store mutation, so it
-	// sits behind the same passkey step-up as tool enable (nil session ⇒
-	// WebAuthn unconfigured ⇒ transport-level auth only, same as /tools).
+	// State-changing routes on this server, and their gate (Vikunja #317):
+	//
+	//   POST /tools      step-up  — defines argv that internal/tool executes
+	//   POST /routines   step-up  — accepting schedules recurring firing
+	//   POST /api/revert step-up  — voids the latest fact for a key
+	//   POST /api/chat   step-up  — reaches the router, LLM and the act path
+	//   POST /api/signal none     — appends a presence fact, no argv, no act
+	//   POST /api/ptt, /ws  none  — proxy audio to mavend's voice port, which
+	//                               is itself only reachable inside the deploy
+	//
+	// "step-up" means stepUpOK: asserted passkey when WebAuthn is configured,
+	// otherwise fail-open unless -require-stepup, which denies.
+	//
+	// GET /chat only renders the page and echoes back the q/r query params the
+	// POST redirect set — nothing to gate.
 	mux.HandleFunc("/chat", func(w http.ResponseWriter, r *http.Request) {
 		handleChatPage(w, r, core)
 	})
 	mux.HandleFunc("/api/chat", func(w http.ResponseWriter, r *http.Request) {
-		handleChatAPI(w, r, core)
+		handleChatAPI(w, r, core, stepUpSession, *requireStepUp)
 	})
 	mux.HandleFunc("/api/revert", func(w http.ResponseWriter, r *http.Request) {
 		handleRevert(w, r, core, stepUpSession, *requireStepUp)
@@ -1258,7 +1270,14 @@ func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 }
 
 // handleChatAPI processes a chat message POST and redirects back to /chat.
-func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
+//
+// State-changing, and the widest surface on this server: the text reaches the
+// router, the LLM, and through mavend's applyAction the whole action path
+// including `act` — so it is gated on the same step-up as POST /tools and
+// POST /api/revert (Vikunja #317). With WebAuthn unconfigured the gate is
+// fail-open exactly like the others (see stepUpOK); with -require-stepup it
+// denies, which is the point of that flag.
+func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
 		http.Error(w, "POST only", http.StatusMethodNotAllowed)
 		return
@@ -1267,6 +1286,10 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		http.Error(w, "chat disabled (no -core)", http.StatusServiceUnavailable)
 		return
 	}
+	if !stepUpOK(session, requireStepUp) {
+		http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
+		return
+	}
 	text := strings.TrimSpace(r.FormValue("text"))
 	if text == "" {
 		http.Redirect(w, r, "/chat", http.StatusSeeOther)

deploy/ecosystem/docker-compose.yml

@@ -8,6 +8,18 @@
 #
 # Maven's own compose joins this same network (add `ecosystem` as an external
 # network there) to reach nexus:9740 / praxis:8989 / hexis:9741 directly.
+#
+# NO RELEASE PINNING (Vikunja #354): each `build:` below points at a sibling
+# WORKING TREE, so `up --build` ships whatever is checked out there, including
+# uncommitted edits. Before bringing this up, check what you are about to
+# deploy:
+#
+#   for r in nexus praxis hexis; do git -C ../../../$r status --short; \
+#     git -C ../../../$r log -1 --oneline; done
+#
+# The host nginx that fronts these is deploy/ecosystem/nginx.conf — it binds
+# the wg and LAN addresses only, with allow/deny. Keep it that way: none of
+# these containers has auth of its own.
 name: ecosystem
 
 services:

deploy/ecosystem/nginx.conf

@@ -1,6 +1,7 @@
-# Reverse-proxy the three sibling admin UIs. Drop into your nginx sites (or the
-# nginx-panel app) and reload. Assumes the compose publishes each service on
-# 127.0.0.1:<port>. Add TLS (certbot / your existing cert block) per server.
+# Reverse-proxy Maven's own web UI plus the three sibling admin UIs. Drop into
+# your nginx sites (or the nginx-panel app) and reload. Assumes the compose
+# publishes each service on 127.0.0.1:<port>. Add TLS (certbot / your existing
+# cert block) per server.
 #
 # NOTE: hexis.<domain> previously pointed at the MCP tool — repoint that
 # elsewhere first (the app now owns hexis.*).
@@ -12,6 +13,50 @@
 # Do NOT "fix" a failed bind by reverting to `listen 80` (all interfaces) —
 # that removes the only access control these containers have.
 
+# maven.<domain> → mavweb (docker-compose.yml publishes it on 127.0.0.1:9201).
+# Same bind + ACL as the siblings, and for a stronger reason: mavweb serves
+# POST /tools, which defines argv that internal/tool EXECUTES, plus POST
+# /routines, /api/revert and /api/chat (Vikunja #317). Without
+# -webauthn-origin/-webauthn-rpid mavweb has no auth of its own, so this block
+# is the auth. If you add TLS and a basic-auth/oauth2-proxy layer, keep the
+# allow/deny anyway — belt and braces on an RCE surface.
+#
+# WebSocket upgrade matters here: /ws carries push-to-talk audio, so the
+# Upgrade/Connection headers below are required, not decoration. The map keeps
+# `Connection: upgrade` off plain requests; it sits in the http context, which
+# is where sites-available files are included — if your nginx already defines
+# $connection_upgrade, drop this block.
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen 10.42.0.1:80;
+    listen 192.168.1.104:80;
+    server_name maven.kvmx.ru;
+
+    allow 10.42.0.0/24;
+    allow 192.168.1.0/24;
+    deny all;
+
+    # push-to-talk uploads raw PCM; the default 1m is enough for a short
+    # utterance but not for a long one.
+    client_max_body_size 32m;
+
+    location / {
+        proxy_pass http://127.0.0.1:9201;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;   # an LLM turn can take minutes on the iGPU
+    }
+}
+
 server {
     listen 10.42.0.1:80;
     listen 192.168.1.104:80;