Leitstand is the read-only observation surface for the Heimgewebe operator ecosystem. It renders bounded artifacts from authoritative source systems and also provides a local digest CLI. It does not orchestrate, dispatch tasks, ingest HTTP events, mutate external systems, or establish a second source of truth.
Leitstand has two deliberately separate surfaces.
The internal Express service renders current exported evidence:
| Route | Purpose | Authority remains with |
|---|---|---|
/ |
compact source and attention overview | individual source systems |
/health |
process, Git, contract, and freshness receipt | current process and local files |
/bureau |
task and claim projection | Bureau |
/checkouts |
checkout and worktree projection | Grabowski |
/storage-health |
bounded storage-health projection | storage-health producer |
/ecosystem-map |
verified system relationships | Systemkatalog publication |
/repoground |
repository-grounding bundles | RepoGround publication |
/repobriefs is a permanent compatibility redirect to /repoground.
Removed legacy routes such as /events, /ops, /observatory, /intent, /anatomy, /timeline, /insights, and /reflexion are not active contracts.
The local CLI reads configured files and writes daily digest output. It combines:
- semantic daily insights from semantAH;
- recent Chronik events;
- WGX fleet-health metrics.
These local file writes are report generation, not external mutation or execution authority.
- Bureau owns task and claim truth.
- Grabowski owns local execution, worktrees, leases, and receipts.
- Chronik owns event history.
- Plexer transports bounded operational events.
- Systemkatalog owns system purposes and relationships.
- RepoGround owns repository-grounding publications.
- Leitstand only validates, normalizes, summarizes, and renders their exported evidence.
The Systemkatalog is the cross-system role inventory. Leitstand does not maintain a competing catalog.
The canonical runtime is internal:
https://leitstand.heimgewebe.home.arpa
Expected properties:
- HTTPS through the internal reverse proxy;
- no WAN publication;
- exact immutable Git release with commit and tree identity;
leitstand.serviceandleitstand-storage-health.serviceswitched as one rollback-capable transaction;- create-only deployment receipts and idempotent same-release replay;
- safe application bind on
127.0.0.1:3000; - structured local and canonical route readbacks;
- source-specific artifact freshness.
The canonical effect path is scripts/leitstand-release.py; host-specific paths come from an exact runtime JSON based on deploy/systemd/runtime-config.example.json.
See:
- Local Versioned Release Runtime
- Runtime Contract
- Data Flow
- Drift Signals
- Security Policy
- Documentation Router
/health reports the applied freshness limit for every required source:
| Source | Default limit |
|---|---|
| Bureau snapshot | 20 minutes |
| Checkout snapshot | 20 minutes |
| Storage health | 90 minutes |
| Systemkarte manifest | 168 hours |
A stale source yields warn. A missing, unreadable, invalid, or contract-mismatched required source yields fail and HTTP 503.
The receipt does not by itself prove DNS, TLS trust, reverse-proxy persistence, external reachability, or source-system correctness.
pnpm build:static creates a bounded preview containing only /, browser assets, and _static-boundary.json.
The manifest records:
- supported static routes;
- runtime-only routes;
- removed routes;
- truths the preview does not establish.
The static preview is not the canonical runtime.
Requirements:
- Node.js 20 or newer;
- pnpm 9.1.0 through Corepack.
corepack enable
corepack prepare pnpm@9.1.0 --activate
pnpm install --frozen-lockfile
pnpm buildStart the compiled internal server:
pnpm start:serverBuild the static preview:
pnpm build:staticCreate a leitstand.config.json file:
{
"paths": {
"semantah": {
"todayInsights": "$VAULT_ROOT/.gewebe/insights/today.json"
},
"chronik": {
"dataDir": "$VAULT_ROOT/.gewebe/chronik/data"
},
"wgx": {
"metricsDir": "$VAULT_ROOT/.gewebe/wgx/metrics"
}
},
"output": {
"dir": "digests/daily"
},
"digest": {
"maxEvents": 20
}
}Configured paths may contain $VARIABLE references. Unset variables fail explicitly.
Generate today's digest:
pnpm daily-digest --config leitstand.config.jsonGenerate a digest for a specific date:
pnpm daily-digest --config leitstand.config.json --date 2025-12-04The CLI writes one Markdown file and one JSON file to the configured output directory.
The web runtime accepts dedicated read-only artifact path overrides. See .env.example for the current names. No event, ACS, Ops, or Observatory environment surface exists.
The pull-request quality gates are:
pnpm check:vendor-contracts
pnpm lint
pnpm typecheck
pnpm test:release-runtime
pnpm test
pnpm test:browser-shell
pnpm build
scripts/ci/repo-structure-guard.sh
scripts/ci/docs-relations-guard.sh
scripts/ci/generated-files-guard.sh
scripts/ci/check-drift-gates.sh
bash scripts/ci/observer-invariant-guard.shThe browser regression verifies the shared shell on mobile and desktop, including focus restoration, responsive navigation, overflow, and the canonical RepoGround route.
src/
server.ts read-only Express runtime
runtimeHealth.ts bounded process, Git, and snapshot receipt
controllers/ artifact validation and view models
views/ EJS projections
cli.ts local digest entry point
insights.ts semantAH digest input
events.ts Chronik digest input
metrics.ts WGX digest input
scripts/
build-static.mjs bounded static preview
ci/ repository and observer guards
docs/
index.md canonical documentation router
.wgx/profile.yml provides standardized up, guard, and smoke entry points by delegating to the repository's pnpm scripts. It is not an execution-authority grant and does not establish deployed health. See the WGX decision.
MIT