# Deploy Pharosiraptor for an Intrikata instance

Agent-discoverable playbook: how a **user computer** or **Cloudflare** backs megapraxis/metamegapraxis graph reads for an Intrikata handle.

Live console: https://intrikata.com/  
Cert: https://intrikata.com/data/browser-pharosiraptor.json  
Operant cert: https://intrikata.com/data/operant-bootstrap.json  

## Resolution order (browser console)

When the console needs graph data it tries, in order:

| Priority | Backend | When |
|---|---|---|
| 1 | **Local bridge** `GET /api/local-bridge/*` | cloudflared tunnel registered for this browser session |
| 2 | **Direct HTTPS proxy** `localStorage intrikata.proxyBase` | `proxy set https://…` or `?proxy=` URL param |
| 3 | **CF operant** `GET /api/operant/{id}/…` | Instance was `bootstrap`’d on D1 (minimal 7 graphs) |
| 4 | **Browser JS** IndexedDB (`/js/pharosiraptor-browser.js`) | Always after seed from `provision.json` |

**Why not raw `http://localhost:8080`?** Browsers block mixed content (HTTPS page → HTTP localhost). CORS alone is not enough. The automatic path uses **Cloudflare Tunnel** so the edge and browser both use HTTPS.

CLI (`cli/intrikata.py`) still prefers **local GraphDoc** `http://localhost:8080` when healthy (same machine, no browser).

---

## Automatic local connect (recommended)

On the machine running Pharosiraptor/GraphDoc (`:8080`):

```text
# one-time: install cloudflared (already present if you use CF tunnels)
# https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation/

curl -O https://intrikata.com/scripts/pharosiraptor-local-bridge.py
# optional: copy session from console `proxy` command
py pharosiraptor-local-bridge.py --session <session_from_console>
```

The script:

1. Checks `GET http://127.0.0.1:8080/api/health`
2. Starts `cloudflared tunnel --url http://127.0.0.1:8080`
3. Registers the tunnel with `POST /api/local-bridge/register`
4. Opens the console with `?lb_session=…&proxy=…`

The console **auto-connects on load** when `lb_session` is present or a registration is still live (2h TTL). Chip shows `local tunnel` when connected.

Console commands:

```text
proxy          # status + auto-reconnect attempt
proxy connect  # same
bridge         # alias
proxy clear    # drop direct proxyBase (bridge registration expires server-side)
```

## Path A — Cloudflare D1 operant (minimal Pharosiraptor)

Already deployed on this project (`wrangler.toml` D1 binding `DB`).

```text
console:  instance new <handle>
          bootstrap
          operant
CLI:      py intrikata.py bootstrap <handle>
          py intrikata.py operant <handle> --q Swarm::
API:      POST /api/bootstrap { "handle": "..." }
          GET  /api/operant/{instance_id}/health|graphs|nodes?q=
```

Host health (not per-instance): `GET /api/health` → JSON.

### Auto-provision (2+ local instances)

If this browser already holds **2 or more** Intrikata instances, the console **background-provisions** each:

1. Seeds **browser Pharosiraptor** (IndexedDB) from `data/provision.json`
2. Attempts **CF bootstrap** when not yet `cf_operant`

This does **not** bypass the contact claim subscription gate (2 free **claimed** instances per contact). LocalStorage instance count is independent of claim/billing.

## Path B — Local GraphDoc / full Pharosiraptor on the user computer

1. Run GraphDoc/Pharosiraptor so `GET http://localhost:8080/api/health` returns healthy.
2. Use the **CLI** on that machine (`py intrikata.py status|graphs|…`) — same-host, no CORS.
3. Optional browser bridge: expose GraphDoc via a **CORS-enabled** reverse proxy or Cloudflare Tunnel, then in the console:

```text
proxy set https://<your-tunnel-or-proxy-origin>
proxy
pharosiraptor health
pharosiraptor nodes Swarm::
```

`proxy clear` removes the override. (`pharos` remains a deprecated alias of `pharosiraptor` / `operant`.)

**Honesty:** browsers block raw `http://localhost:8080` from `https://intrikata.com` without CORS. That is residual, not a silent “local connected” claim.

## Path C — Browser-only (no CF operant, no proxy)

```text
instance new <handle>     # seeds browser Pharosiraptor automatically
pharosiraptor health      # backend=browser-js
pharosiraptor graphs
pharosiraptor nodes Swarm::
provision                 # download JSON bundle for offline import
```

Implementation: https://intrikata.com/js/pharosiraptor-browser.js  
Store: IndexedDB `intrikata-pharosiraptor-v1` (per-instance nodes + meta).  
Legacy short path names (if still requested) 301 to these URLs via `_redirects` — no short-named files remain on disk.

## Non-command input

Free-form English is **not** a graph mutation path. Console: `unknown command` + soft-hint.  
Handles must match server grammar (letters/digits/`._@+-`).  
See validation cert notes in operator docs / SwarmInvocation non-command cycle.

## Agent discovery

- https://intrikata.com/llms.txt  
- https://intrikata.com/data/browser-pharosiraptor.json  
- https://intrikata.com/data/operant-bootstrap.json  
- Sibling skills: https://praxis-stack.pages.dev/llms.txt  

## Tarski residuals

- Full MCP `megapraxis.boot` grids ≠ browser/D1 minimal operant  
- Cross-origin local GraphDoc requires user-configured CORS/tunnel  
- Background CF bootstrap subject to rate limits and free-tier quotas