feat(#470): plugin UI — generated Tailwind subset, static SPA serving, ingest gate (C8)

.github/workflows/ci.yml

@@ -294,6 +294,16 @@ jobs:
       - name: Test (vitest)
         run: npm run test
 
+      - name: Plugin UI stylesheet drift check
+        # Epic #470 C8 — middleware/assets/plugin-ui/plugin-ui.css is generated
+        # from this workspace's theme tokens + tailwind bridge and committed so
+        # the runtime image needs no web-ui toolchain. Regenerate and diff here
+        # so an edit to the tokens, the bridge or the vocabulary that was not
+        # regenerated fails loudly instead of shipping a stylesheet that
+        # disagrees with the shell. Runs inside the existing web-ui job, not as
+        # a new required check.
+        run: npm run plugin-ui:css:check
+
   # ------------------------------------------------------------------
   # Schema smoke: apply every migration in the repo against pgvector.
   # Catches SQL-only regressions before they hit prod-or-OSS-demo

Dockerfile

@@ -162,6 +162,12 @@ ENV BUILDER_BOILERPLATE_DIR=/app/boilerplate
 # path that doesn't ship in the public release.
 COPY middleware/assets/entity-registry.v1.yaml ./entity-registry.v1.yaml
 ENV BUILDER_ENTITY_REGISTRY_PATH=/app/entity-registry.v1.yaml
+# Plugin-UI assets — the generated design-system stylesheet plugin UIs link
+# (`/api/_harness/plugin-ui.css`) plus any @font-face sources. Generated by
+# `web-ui/scripts/build-plugin-ui-css.mjs` and committed; a missing directory
+# aborts boot via verifyAssetBundles rather than 404ing at runtime.
+COPY middleware/assets/plugin-ui ./plugin-ui
+ENV PLUGIN_UI_ASSETS_DIR=/app/plugin-ui
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 

middleware/assets/boilerplate/agent-integration/assets/admin-ui/CLAUDE.md

@@ -3,8 +3,10 @@
 Dieses Dokument beschreibt die **harten Constraints** und das gewünschte
 Pattern für den `admin-ui-body`-Slot in `assets/admin-ui/index.html`.
 Quelle der Wahrheit für das Baseline-Stylesheet:
-`middleware/src/admin-ui/harness-admin-css.ts` (im Browser served via
-`/bot-api/_harness/admin-ui.css`).
+`web-ui/scripts/build-plugin-ui-css.mjs`, das nach
+`middleware/assets/plugin-ui/plugin-ui.css` baut und im Browser unter
+`/bot-api/_harness/plugin-ui.css` ausgeliefert wird
+(`admin-ui.css` bleibt als Alias auf dieselben Bytes bestehen).
 
 ## Wann dieser Guide greift
 

middleware/assets/boilerplate/agent-integration/assets/admin-ui/index.html

@@ -9,7 +9,10 @@
       element styling, .harness-* helper classes, and CSS-vars for the host
       iframe constraints (--harness-iframe-{max,min,height}). Same-origin via
       the web-dev /bot-api rewrite → middleware /api/_harness/admin-ui.css.
-      Source of truth: middleware/src/admin-ui/harness-admin-css.ts.
+      Generated by web-ui/scripts/build-plugin-ui-css.mjs into
+      middleware/assets/plugin-ui/plugin-ui.css and served at
+      /bot-api/_harness/plugin-ui.css; /bot-api/_harness/admin-ui.css stays
+      as the legacy same-bytes alias, so this link remains correct.
     -->
     <link rel="stylesheet" href="/bot-api/_harness/admin-ui.css" />
   </head>

middleware/assets/plugin-ui/fonts/README.md

@@ -0,0 +1,34 @@
+# plugin-ui fonts
+
+Drop `.woff2` files here to have them served to plugin UIs at
+`/api/_harness/plugin-ui/fonts/<file>` (browser: `/bot-api/...`) and declared
+as `@font-face` inside the generated `plugin-ui.css`.
+
+`next/font` injects the shell's faces into web-ui's own document only, and an
+iframe is a separate document — so a plugin UI never inherits them
+(`implementation.md` §2.3, in the epic #470 spec directory). The generated
+stylesheet therefore always binds `--font-geist`, `--font-geist-mono` and
+`--font-source-serif`: with this directory empty it binds the platform
+fallback stacks, with a file present it binds the real family. Leaving them
+unbound would not merely lose the face — `theme.css` composes
+`--font-sans: var(--font-geist), system-ui, …`, and an undefined var
+invalidates the whole declaration, dropping the plugin UI to the browser's
+serif default.
+
+Recognised names (matched case-insensitively by
+`web-ui/scripts/build-plugin-ui-css.mjs`):
+
+| file | family | bound variable |
+|---|---|---|
+| `geist.woff2` | `Geist` | `--font-geist` |
+| `geist-mono.woff2` | `Geist Mono` | `--font-geist-mono` |
+| `source-serif.woff2` | `Source Serif 4` | `--font-source-serif` |
+
+After adding or removing a file, regenerate the stylesheet:
+
+```
+cd web-ui && npm run plugin-ui:css
+```
+
+No face ships today: the shell's own are downloaded by `next/font/google` at
+build time and are committed nowhere in this repo.