tui — Hybrid Gateway

tui — Hybrid Gateway An architecture diagram generated by Archify. Phone browser · Chrome mobile · Architecture component Phone browser Chrome mobile Cloudflare Tunnel · no open ports · Architecture component Cloudflare Tunnel no open ports tui gateway :8080 · JWT gate + Zen inject · Your host (laptop / Northflank origin) › JWT trust boundary · Clojure tui gateway :8080 JWT gate + Zen inject Clojure opencode web :4096 · sessions PTY tools · Your host (laptop / Northflank origin) opencode web :4096 sessions PTY tools Edge Worker · ingest + rollback only · Architecture component Edge Worker ingest + rollback only Local secrets · auth.json + env keys · Your host (laptop / Northflank origin) Local secrets auth.json + env keys Zen Responses API · muse-spark-1.3 · Architecture component · POST /v1/responses Zen Responses API muse-spark-1.3 POST /v1/responses HTTPS forward :8080 proxy + identity Bearer up / SSE down inject server-side telemetry Your host (laptop / Northflank origin) JWT trust boundary Legend Backend Cloud Security External

Hybrid, not a rewrite

  • • Clojure owns auth + key handling; upstream opencode owns sessions, PTY, tools
  • • Gateway never stores prompts; it only gates and forwards

Secrets rule

  • • Raw keys travel gateway -> Zen only
  • • Every log line carries ****last4, enforced by test

Edge role

  • • Worker ingests telemetry and is a rollback target
  • • No agent loops at the edge (CPU caps)