merge: resolve conflicts with upstream/main

Merged upstream changes including:
- WebEndpoint spec + SympoziumConfig controller
- web-proxy binary
- Various Helm chart updates

Kept both MCPServer and WebEndpoint/SympoziumConfig features.

Author: henrikrexed

.github/workflows/build.yaml

@@ -113,6 +113,7 @@ jobs:
           - apiserver
           - ipc-bridge
           - webhook
+          - web-proxy
           - channel-telegram
           - channel-whatsapp
           - channel-discord

.github/workflows/docs.yml

@@ -0,0 +1,55 @@
+name: Deploy docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'index.html'
+      - 'install.sh'
+      - 'CNAME'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install MkDocs Material
+        run: pip install "mkdocs>=1.6,<2" mkdocs-material
+
+      - name: Build docs site
+        run: mkdocs build --site-dir _site/docs
+
+      - name: Assemble root site
+        run: |
+          cp index.html _site/index.html
+          cp install.sh _site/install.sh
+          cp CNAME _site/CNAME
+
+      - uses: actions/upload-pages-artifact@v3
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/release.yaml

@@ -106,6 +106,7 @@ jobs:
           - skill-sre-observability
           - skill-github-gitops
           - skill-llmfit
+          - web-proxy
     steps:
       - uses: actions/checkout@v4
 

.gitignore

@@ -43,6 +43,9 @@ web/dist/*
 !web/dist/index.html
 web/node_modules/
 
+# MkDocs build output
+site/
+
 output.cast
 tmp.gif
 whatsapp

AGENTS.md

@@ -23,6 +23,7 @@ cmd/
   apiserver/            # HTTP + WebSocket API server
   controller/           # Controller manager (all reconcilers + routers)
   ipc-bridge/           # IPC bridge sidecar (fsnotify → NATS)
+  web-proxy/            # Web proxy (OpenAI-compat API + MCP gateway)
   sympozium/             # CLI + TUI (Bubble Tea)
   webhook/              # Admission webhook server
 channels/
@@ -49,6 +50,7 @@ internal/
   orchestrator/         # Pod builder + spawner for agent Jobs
   session/              # Session store
   webhook/              # Policy enforcer
+  webproxy/             # Web proxy handlers (OpenAI, MCP, rate limiting)
 migrations/             # PostgreSQL schema migrations
 test/integration/       # Integration test scripts (shell)
 docs/                   # Design & contributor documentation
@@ -96,13 +98,13 @@ kind create cluster --name kind
 make install
 
 # Build all images
-make docker-build TAG=v0.0.32
+make docker-build TAG=v0.1.0
 
 # Load images into Kind (all components)
-for img in controller apiserver ipc-bridge webhook agent-runner \
+for img in controller apiserver ipc-bridge webhook agent-runner web-proxy \
            channel-telegram channel-slack channel-discord channel-whatsapp \
            skill-k8s-ops skill-sre-observability skill-llmfit; do
-  kind load docker-image ghcr.io/alexsjones/sympozium/$img:v0.0.32 --name kind
+  kind load docker-image ghcr.io/alexsjones/sympozium/$img:v0.1.0 --name kind
 done
 
 # Deploy the control plane
@@ -121,8 +123,8 @@ make build
 make test
 
 # Build specific image + reload into Kind
-make docker-build-agent-runner TAG=v0.0.32
-kind load docker-image ghcr.io/alexsjones/sympozium/agent-runner:v0.0.32 --name kind
+make docker-build-agent-runner TAG=v0.1.0
+kind load docker-image ghcr.io/alexsjones/sympozium/agent-runner:v0.1.0 --name kind
 
 # Restart the controller to pick up new images
 kubectl rollout restart deployment sympozium-controller-manager -n sympozium-system
@@ -139,7 +141,7 @@ make vet                # go vet
 make fmt                # gofmt
 make tidy               # go mod tidy
 make docker-build       # Build all Docker images
-make docker-build-<name> TAG=v0.0.32   # Build a specific image
+make docker-build-<name> TAG=v0.1.0   # Build a specific image
 make generate           # Regenerate deepcopy + CRD manifests
 make manifests          # Regenerate CRD YAML only
 make clean              # Remove build artifacts
@@ -174,6 +176,7 @@ TEST_MODEL=gpt-5.2 TEST_TIMEOUT=180 ./test/integration/test-write-file.sh
 | `test-llmfit-cluster-fit.sh` | `llmfit` skill — agent runs node-level llmfit placement probe workflow |
 | `test-telegram-channel.sh` | Telegram channel deployment + message flow |
 | `test-slack-channel.sh` | Slack channel deployment (Socket Mode) |
+| `test-web-proxy-api.sh` | Web proxy API — healthz, auth, models, chat completions (blocking + streaming), MCP SSE |
 
 ### Writing New Tests
 
@@ -243,6 +246,8 @@ SkillPacks are CRDs containing Markdown instructions + optional sidecar definiti
 | Writing tools | `docs/writing-tools.md` | How to add new agent tools |
 | Writing skills | `docs/writing-skills.md` | How to create SkillPack CRDs |
 | Writing integration tests | `docs/writing-integration-tests.md` | Test patterns and templates |
+| Web endpoint skill | `docs/skill-web-endpoint.md` | How to expose agents as HTTP APIs (OpenAI-compat + MCP) |
+| Serving mode | `docs/serving-mode.md` | How serving mode works for long-lived agent deployments |
 | Sample CRs | `config/samples/` | Example SympoziumInstance, AgentRun, SympoziumPolicy, SympoziumSchedule, SkillPack |
 | CRD definitions | `api/v1alpha1/` | Go type definitions for all CRDs |
 | Built-in PersonaPacks | `config/personas/` | Pre-configured agent bundles (platform-team, devops-essentials) |
@@ -283,10 +288,10 @@ SkillPacks are CRDs containing Markdown instructions + optional sidecar definiti
 go build ./...
 
 # Rebuild affected images
-make docker-build-<component> TAG=v0.0.32
+make docker-build-<component> TAG=v0.1.0
 
 # Load into Kind
-kind load docker-image ghcr.io/alexsjones/sympozium/<component>:v0.0.32 --name kind
+kind load docker-image ghcr.io/alexsjones/sympozium/<component>:v0.1.0 --name kind
 
 # Restart controller if controller/ipc-bridge/agent-runner changed
 kubectl rollout restart deployment sympozium-controller-manager -n sympozium-system

CONTRIBUTING.md

@@ -25,13 +25,68 @@ See [`AGENTS.md`](AGENTS.md) for the full setup guide. The short version:
 # Prerequisites: Go 1.25+, Docker, Kind, kubectl
 kind create cluster --name kind
 make install                          # Install CRDs
-make docker-build TAG=v0.0.32        # Build all images
+make docker-build TAG=v0.1.0         # Build all images
 # Load images into Kind (see AGENTS.md for the full loop)
 kubectl apply -k config/             # Deploy control plane
 ```
 
 ---
 
+## Local Development (no Docker build/push cycle)
+
+For day-to-day development you can run the controller and API server as local processes against a remote (or local) cluster. This skips the Docker build → image load → rollout cycle entirely, which is especially helpful on low-bandwidth connections or when iterating quickly on controller logic.
+
+All you need is a running cluster with CRDs installed and a valid kubeconfig.
+
+### Run everything locally
+
+```bash
+make dev-all
+```
+
+This starts four services in parallel:
+
+| Service | Address | What it does |
+|---------|---------|-------------|
+| Controller | `:9090` (metrics), `:9091` (health) | All CRD reconcilers running locally |
+| API server | `:8080` | REST API for the UI |
+| Vite dev server | `:5173` | Frontend with hot-reload |
+| NATS port-forward | `:4222` | Forwards cluster NATS to localhost |
+
+The in-cluster controller deployment is automatically scaled to zero so there's no conflict. When you Ctrl+C, the in-cluster controller is restored to 1 replica.
+
+Open `http://localhost:5173` in your browser. The API token is `dev-token` (override with `SYMPOZIUM_TOKEN`).
+
+### Run just the controller locally
+
+If you're only working on controller logic and already have `make dev` running for the UI:
+
+```bash
+make run-controller
+```
+
+This builds and runs the controller manager locally, scaling down the in-cluster one. On exit it restores the in-cluster deployment.
+
+### Run just the API server + UI
+
+If you're only working on the API or frontend and want the in-cluster controller to keep running:
+
+```bash
+make dev
+```
+
+### Undeploy cluster workloads (keep CRDs)
+
+To stop all in-cluster Sympozium deployments while keeping CRDs and their instances intact:
+
+```bash
+kubectl scale deploy -n sympozium-system --replicas=0 --all
+```
+
+This is useful when you want the local processes to be the only thing running, or when switching between local and cluster-based development.
+
+---
+
 ## GitHub Checks
 
 Every push and PR runs the following checks via GitHub Actions (`.github/workflows/build.yaml`):
@@ -114,17 +169,17 @@ chore(deps): bump gorilla/websocket to v1.5.1
 
 Sympozium follows [Semantic Versioning](https://semver.org/) (`vMAJOR.MINOR.PATCH`):
 
-- **PATCH** (`v0.0.31` → `v0.0.32`) — Bug fixes, docs, minor improvements
-- **MINOR** (`v0.1.0`) — New features, new CRD fields (backward-compatible)
+- **PATCH** (`v0.1.0` → `v0.1.1`) — Bug fixes, docs, minor improvements
+- **MINOR** (`v0.1.0` → `v0.2.0`) — New features, new CRD fields (backward-compatible)
 - **MAJOR** (`v1.0.0`) — Breaking API/CRD changes
 
 ### Releasing
 
 1. Ensure all changes are committed and pushed to `main`.
 2. Create and push a tag:
    ```bash
-   git tag v0.0.33
-   git push origin v0.0.33
+   git tag v0.1.1
+   git push origin v0.1.1
    ```
 3. The release workflow automatically:
    - Builds CLI binaries for all platforms