POST
POST /v1/gateway/preview
{
"query": "Smart Print estimate preview",
"dryRunOnly": true
}Smart Shikka Core Control Center
Read-only preview dashboard — no real execution, no provider call
Overview
API Base URL
Public Brand URL
Local Service Name
smart-shikka-api.service
Local Port
37842
Route Count
54
Module Count
26
All Unsafe Flags
false
Core Structure Map
Static architecture view of the preview-only layers. No live execution or external call.
API Layer
safe_preview
Public/token-protected preview endpoints; no real execution.
MCP Read-only Layer
safe_preview
Calculator, knowledge search, report draft, status read previews.
Provider Registry Blocked Layer
blocked_execution_preview
Provider catalog and call-block preview; no SDK, no key, no outbound call.
Approval Bridge Preview Layer
blocked_execution_preview
Request/decision preview; real execution always blocked.
App Integration Layer
app_integration_preview
Smart Print and Drishti Kundali context envelopes; no mutation/payment/send.
Owner/Ops Dashboard Layer
owner_ops_preview
Owner panel metadata aggregator; no external call or real execution.
Control Center Layer
safe_preview
This static read-only shell; no script, no secret, no live env.
Route Explorer
54 routes in the preview contract index.
GET
GET /v1/gateway/observability/preview-status
{}
GET
GET /v1/gateway/observability/recent-events
{
"limit": 10
}
POST
POST /v1/security/bumblebee/preview-ingest
{
"lines": [
"{\"event\":\"test\"}"
],
"dryRunOnly": true
}
POST
POST /v1/security/bumblebee/preview-alert
{
"alertType": "suspicious_token",
"severity": "high"
}
POST
POST /v1/mcp/read-only-tools/preview
{
"toolId": "calculator",
"intent": "add",
"userMessage": "2 + 2"
}
POST
POST /v1/audit-store/preview
{
"eventType": "test_event",
"dryRunOnly": true
}
POST
POST /v1/memory-retrieval/preview
{
"query": "customer order summary",
"dryRunOnly": true
}
POST
POST /v1/provider-registry/preview
{
"action": "catalog_preview"
}
POST
POST /v1/approval-execution/preview
{
"action": "request_preview",
"requestedAction": "deploy"
}
POST
POST /v1/assistant/orchestrator/preview
{
"action": "plan_preview",
"userMessage": "What is the workflow?"
}
POST
POST /v1/app-integration/preview
{
"action": "context_envelope",
"appId": "smart_print"
}
POST
POST /v1/owner-ops-dashboard/preview
{
"action": "dashboard_preview",
"appId": "smart_print"
}
POST
POST /v1/core/preview-contracts
{
"action": "policy_check"
}
GET
GET /settings/providers
{}
GET
GET /v1/core/provider-settings
{}
POST
POST /v1/core/provider-settings/preview
{
"action": "policy_check"
}
GET
GET /knowledge
{}
GET
GET /v1/core/knowledge
{}
POST
POST /v1/core/knowledge/preview
{
"action": "policy_check"
}
GET
GET /memory
{}
GET
GET /v1/core/memory
{}
POST
POST /v1/core/memory/preview
{
"action": "policy_check"
}
GET
GET /goose
{}
GET
GET /v1/core/goose
{}
POST
POST /v1/core/goose/preview
{
"action": "policy_check"
}
GET
GET /browser-extension
{}
GET
GET /v1/core/browser-extension
{}
POST
POST /v1/core/browser-extension/preview
{
"action": "policy_check"
}
GET
GET /messaging
{}
GET
GET /v1/core/messaging
{}
POST
POST /v1/core/messaging/preview
{
"action": "policy_check"
}
GET
GET /
{}
GET
GET /apps
{}
GET
GET /v1/core/apps
{}
POST
POST /v1/core/apps/preview
{
"action": "policy_check"
}
GET
GET /external-services
{}
GET
GET /v1/core/external-services
{}
POST
POST /v1/core/external-services/preview
{
"action": "status_preview"
}
GET
GET /research-engine
{}
GET
GET /v1/core/research-engine
{}
POST
POST /v1/core/research-engine/preview
{
"action": "status_preview"
}
GET
GET /approvals
{}
GET
GET /v1/core/approvals
{}
POST
POST /v1/core/approvals/preview
{
"action": "status_preview"
}
GET
GET /execution-plans
{}
GET
GET /v1/core/execution-plans
{}
POST
POST /v1/core/execution-plans/preview
{
"action": "status_preview"
}
GET
GET /adapters
{}
GET
GET /v1/core/adapters
{}
POST
POST /v1/core/adapters/preview
{
"action": "status_preview"
}
GET
GET /policy-decisions
{}
GET
GET /v1/core/policy-decisions
{}
POST
POST /v1/core/policy-decisions/preview
{
"action": "status_preview"
}Module Explorer
26 modules available.
Gateway Preview
gateway_preview
- Gateway preview does not route real traffic.
Gateway Observability
gateway_observability
- Observability is in-memory only; no external export.
Security Inventory Preview
security_inventory_preview
- No real remediation or security rule update.
Security Alert Preview
security_alert_preview
- No real WhatsApp/GitHub/create/deploy gate change.
MCP Read-only Tools Preview
mcp_readonly_tools_preview
- Read-only tools preview only; no live MCP execution.
Audit Store Preview
audit_store_preview
- Audit store preview is in-memory only; no real persistence.
Memory + Retrieval Preview
memory_retrieval_preview
- Memory retrieval preview is in-memory only; no vector/embedding write.
Provider Registry Preview
provider_registry_preview
- No provider SDK, no key exposure, no outbound call.
Approval Execution Preview
approval_execution_preview
- Real execution is always blocked; approval is preview-only.
Assistant Orchestrator Preview
assistant_orchestrator_preview
- No real AI/provider call or action execution.
App Integration Preview
app_integration_preview
- No real app execution, mutation, payment, or send.
Owner/Ops Dashboard Preview
owner_ops_dashboard_preview
- Aggregates only safe metadata; no external call or real execution.
Core Preview Contract Index
core_preview_contract_index
- Central metadata-only index; no real execution or external call.
Owner API Key Settings Preview
provider_settings_preview
- No provider call or key validation in preview.
- No secret storage, env write, or key exposure.
- All provider settings are owner-only and blocked until explicit future unlock.
Knowledge / RAG Upload Preview
knowledge_rag_preview
- No real file upload, document parsing, or OCR in preview.
- No external URL fetch, website crawling, or embedding generation.
- No vector DB call, vector write, memory write, or secret exposure.
Memory Write Approval Preview
memory_approval_preview
- No real memory write, persistence, or customer record update in preview.
- No vector DB call, embedding generation, or file/database/audit write.
- No provider call, external network, send, payment, or approved execution.
Goose Connector Preview
goose_connector_preview
- No real Goose execution, shell, or process execution in preview.
- No file read/write, workspace mutation, or git mutation in preview.
- No browser automation, MCP live tool execution, provider call, or external network.
Browser Extension Preview
browser_extension_preview
- No real browser extension build, installable manifest, content script, or background worker in preview.
- No browser automation, DOM access, page scraping, cookies/history access, or scripting in preview.
- No local storage / session storage / indexed DB, service worker, provider call, external network, or real execution.
WhatsApp / Telegram Connector Preview
messaging_connector_preview
- No real WhatsApp or Telegram API call, no webhook registration, no real inbound webhook processing in preview.
- No message send, no email/SMS send, no message persistence, no contact/customer update in preview.
- No provider call, external network, local storage / session storage / indexed DB, service worker, or real execution.
Preview Apps Home Dashboard
preview_apps_home_dashboard
- No real execution, no provider call, no external network, no WhatsApp/Telegram API call, no Goose execution.
- No database/file/audit/memory write, no mutation, no embedding generation, no vector write, no payment, no send.
- No local storage / session storage / indexed DB / service worker, no key material exposure, no live HTTP check.
External Service Toolkit Preview
external_service_toolkit_preview
- No real API call, no provider SDK, no key configuration, no external network.
- No send, no upload, no screenshot, no PDF, no mutation, no write, no payment.
- All candidate APIs require owner approval. No production provider selected.
Research Engine Preview
research_engine_preview
- No Python execution, no subprocess, no internet fetch, no source fetch.
- No report write, no key/secret, no provider call, no mutation.
- Owner approval required for live research run.
Tool Approval Workflow Preview
tool_approval_workflow_preview
- No real approval persistence, no execution unlock, no send, no write, no payment.
- No external API call, no Python execution, no screenshot, no PDF, no file upload.
- All unsafe capabilities disabled. Owner approval required for all live actions.
Safe Tool Execution Plan Preview
safe_tool_execution_plan_preview
- No real execution, no adapter execution, no provider call, no send, no write, no payment.
- No Python execution, no rollback execution, no approval persistence, no audit persistence.
- All unsafe capabilities disabled. Planning layer only.
Tool Adapter Registry Preview
tool_adapter_registry_preview
- No adapter execution, no adapter SDK, no provider SDK, no external API, no send, no write, no payment.
- No Python execution, no subprocess, no research execution, no file/PDF/screenshot.
- All unsafe capabilities disabled. Registry and capability routing only.
Policy Decision API Preview
policy_decision_api_preview
- No policy decision persistence, no receipt signing, no real execution.
- No adapter execution, no external API, no Python, no send, no write, no payment.
- Decision engine preview only. All unsafe capabilities disabled.
API Explorer
27 API groups; all endpoints are preview-only and read-only.
public
auth_required
read_only
preview_only
blocked_execution
owner_ops
app_integration
mcp
Gateway Preview
gateway
POST
POST /v1/gateway/preview
{"query":"Smart Print estimate preview","dryRunOnly":true}{ previewOnly, mode, requestedMode, provider, model, blocked, requiresApproval, mutationExecuted, providerCallExecuted, realExecutionPerformed }Unauthenticated preview-only route; always returns safe metadata and never routes real traffic.
Gateway Observability
observability
GET
GET /v1/gateway/observability/preview-status
{}{ ok, previewOnly, eventCount, maxEventCount, recentEvents, redactionApplied, storage, persistentStoreEnabled, externalNetworkEnabled, mutationExecuted, providerCallExecuted, realExecutionPerformed }Token-protected read-only route; returns in-memory safe observability summary.
GET
GET /v1/gateway/observability/recent-events
{"limit":10}{ previewOnly, events, redactionApplied, eventCount, capped }Token-protected read-only route; returns redacted and capped in-memory events.
Security Inventory Preview
security
POST
POST /v1/security/bumblebee/preview-ingest
{"lines":["{\"event\":\"test\"}"],"dryRunOnly":true}{ previewOnly, accepted, redacted, parsedRows, errors, policyFlags }Preview-only security inventory ingest; no real rule update or remediation.
Security Alert Preview
security
POST
POST /v1/security/bumblebee/preview-alert
{"alertType":"suspicious_token","severity":"high"}{ previewOnly, alertPreview, workflowSteps, blocked, policyFlags }Preview-only alert workflow; no real WhatsApp/GitHub/create/deploy gate change.
MCP Read-only Tools Preview
tools
POST
POST /v1/mcp/read-only-tools/preview
{"toolId":"calculator","intent":"add","userMessage":"2 + 2"}{ previewOnly, toolId, result, redactedInput, policyFlags }Read-only preview tools; no live MCP/tool execution or network call.
Audit Store Preview
persistence
POST
POST /v1/audit-store/preview
{"eventType":"test_event","dryRunOnly":true}{ previewOnly, auditEventId, redactedSummary, persisted, policyFlags }Preview-only audit store; persisted is always false and no real storage write.
Memory + Retrieval Preview
persistence
POST
POST /v1/memory-retrieval/preview
{"query":"customer order summary","dryRunOnly":true}{ previewOnly, matches, queryPreview, memoryWriteEnabled, vectorDatabaseEnabled, embeddingGenerationEnabled, policyFlags }Preview-only memory retrieval; no memory/vector/embedding write or network call.
Provider Registry Preview
provider
POST
POST /v1/provider-registry/preview
{"action":"catalog_preview"}{ previewOnly, catalog, diagnostics, selectedAdapter, providerCallsEnabled, policyFlags }Preview-only provider registry; no provider SDK, no key exposure, no outbound call.
Approval Execution Preview
approval
POST
POST /v1/approval-execution/preview
{"action":"request_preview","requestedAction":"deploy"}{ superseded, canonicalRoute, realExecutionPerformed }Superseded compatibility tombstone; canonical approval authority is POST /api/ceo/approve.
Assistant Orchestrator Preview
orchestration
POST
POST /v1/assistant/orchestrator/preview
{"action":"plan_preview","userMessage":"What is the workflow?"}{ superseded, canonicalRoute, realExecutionPerformed }Superseded compatibility tombstone; canonical orchestration authority is POST /api/ceo/turn.
App Integration Preview
integration
POST
POST /v1/app-integration/preview
{"action":"context_envelope","appId":"smart_print"}{ superseded, canonicalRoute, canonicalManifest, realExecutionPerformed }Superseded compatibility tombstone; canonical app dispatch uses POST /api/ceo/turn and the seven-app manifest.
Owner/Ops Dashboard Preview
dashboard
POST
POST /v1/owner-ops-dashboard/preview
{"action":"dashboard_preview","appId":"smart_print"}{ previewOnly, action, dashboard, modules, readiness, blockers, nextActions, health, policyFlags }Preview-only owner/ops dashboard aggregator; no real execution or external call.
Core Preview Contract Index
contract_index
POST
POST /v1/core/preview-contracts
{"action":"policy_check"}{ previewOnly, action, routeCatalog?, moduleCatalog?, smokePack?, safetyExpectations?, summary?, policyFlags }Token-protected preview-only route; returns the central contract index catalog and policy checks.
Owner API Key Settings Preview
provider_settings
GET
GET /settings/providers
{}{ superseded, canonicalReadRoute, canonicalWriteRoute, realExecutionPerformed }Superseded compatibility tombstone; canonical settings authority is /api/settings/control-plane.
GET
GET /v1/core/provider-settings
{}{ superseded, canonicalReadRoute, canonicalWriteRoute, realExecutionPerformed }Superseded compatibility tombstone; canonical settings authority is /api/settings/control-plane.
POST
POST /v1/core/provider-settings/preview
{"action":"policy_check"}{ superseded, canonicalReadRoute, canonicalWriteRoute, realExecutionPerformed }Superseded compatibility tombstone; canonical settings authority is /api/settings/control-plane.
Knowledge / RAG Upload Preview
knowledge_rag
GET
GET /knowledge
{}text/html; previewOnly, uploadEnabled=false, documentParsingEnabled=false, embeddingGenerationEnabled=false, vectorWriteExecuted=false, memoryWriteExecuted=falsePublic static HTML page with no file upload, no parser, no URL fetch, no crawling, no embedding, no secret.
GET
GET /v1/core/knowledge
{}{ previewOnly, status, policyFlags, sourceCatalog, uploadEnabled, documentParsingEnabled, embeddingGenerationEnabled, vectorWriteExecuted }Token-protected safe JSON status; no file upload, no parser, no URL fetch, no embedding, no vector write.
POST
POST /v1/core/knowledge/preview
{"action":"policy_check"}{ action, status, html, summary, schema, chunking, redaction, retrieval, sourceCatalog, policyFlags, policyCompliant }Preview actions for knowledge / RAG uploads; requires local auth token; no real upload, parser, fetch, embedding, or vector DB call.
Memory Write Approval Preview
memory_approval
GET
GET /memory
{}text/html; previewOnly, memoryWriteEnabled=false, memoryPersistenceEnabled=false, vectorDatabaseEnabled=false, embeddingGenerationEnabled=false, customerRecordUpdated=falsePublic static HTML page with no memory write, no persistence, no secret, no input/button/form/script.
GET
GET /v1/core/memory
{}{ previewOnly, status, policyFlags, categoryCatalog, memoryWriteEnabled, memoryPersistenceEnabled, vectorDatabaseEnabled, embeddingGenerationEnabled, customerRecordUpdated }Token-protected safe JSON status; no memory write, no persistence, no vector DB, no embedding, no customer update.
POST
POST /v1/core/memory/preview
{"action":"policy_check"}{ action, status, html, summary, suggestion, approvalFlow, redaction, retention, forgetFlow, policyFlags, policyCompliant }Preview actions for memory write approval; requires local auth token; no real memory write, persistence, vector DB, or embedding.
Goose Connector Preview
goose_connector
GET
GET /goose
{}text/html; previewOnly, gooseExecutionEnabled=false, shellExecutionEnabled=false, fileWriteExecuted=false, workspaceMutationEnabled=falsePublic static HTML page with no Goose execution, no shell/process, no file/workspace/git mutation, no script, no secret.
GET
GET /v1/core/goose
{}{ previewOnly, status, policyFlags, commandCatalog, gooseExecutionEnabled, shellExecutionEnabled, commandExecutionPerformed }Token-protected safe JSON status; no Goose execution, shell, process, file/workspace/git mutation, or provider call.
POST
POST /v1/core/goose/preview
{"action":"policy_check"}{ action, status, html, summary, commandCatalog, executionPlan, approvalFlow, sandboxPolicy, rollbackPlan, policyFlags, policyCompliant }Preview actions for Goose connector; requires local auth token; no real Goose execution, shell, process, file/workspace/git mutation, or provider call.
Browser Extension Preview
browser_extension
GET
GET /browser-extension
{}text/html; previewOnly, extensionBuildEnabled=false, installableManifestEnabled=false, contentScriptEnabled=false, browserAutomationEnabled=false, pageScrapingEnabled=falsePublic static HTML page with no real extension build, no installable manifest, no content script, no background worker, no browser automation, no DOM access, no page scraping, no script, no secret.
GET
GET /v1/core/browser-extension
{}{ previewOnly, status, policyFlags, permissionCatalog, extensionBuildEnabled, installableManifestEnabled, contentScriptEnabled, browserAutomationEnabled, pageScrapingEnabled }Token-protected safe JSON status; no real extension build, no installable manifest, no content script, no background worker, no browser automation, no DOM access, no page scraping, no provider call.
POST
POST /v1/core/browser-extension/preview
{"action":"policy_check"}{ action, status, html, summary, permissionCatalog, pageContext, redaction, actionDraft, manifest, policyFlags, policyCompliant }Preview actions for browser extension; requires local auth token; no real extension build, no installable manifest, no content script, no background worker, no browser automation, no DOM access, no page scraping, no provider call.
WhatsApp / Telegram Connector Preview
messaging_connector
GET
GET /messaging
{}text/html; previewOnly, whatsappEnabled=false, telegramEnabled=false, whatsappApiCallExecuted=false, telegramApiCallExecuted=false, sendEnabled=false, webhookRegistrationEnabled=falsePublic static HTML page with no real WhatsApp/Telegram API call, no webhook registration, no real inbound processing, no message send, no message persistence, no script, no secret.
GET
GET /v1/core/messaging
{}{ previewOnly, status, policyFlags, channelCatalog, whatsappEnabled, telegramEnabled, sendEnabled, webhookRegistrationEnabled }Token-protected safe JSON status; no real WhatsApp/Telegram API call, no webhook registration, no real inbound processing, no message send, no provider call.
POST
POST /v1/core/messaging/preview
{"action":"policy_check"}{ action, status, html, summary, channelCatalog, inboundMessage, redaction, replyDraft, sendPolicy, webhookSchema, policyFlags, policyCompliant }Preview actions for WhatsApp / Telegram connector; requires local auth token; no real API call, no webhook registration, no real inbound processing, no message send, no provider call.
Preview Apps Home Dashboard
preview_apps_home
GET
GET /
{}text/html; previewOnly, static app catalog, route index, safety summary, next safe actionsPublic read-only home HTML page with no real execution, no provider call, no external network, no secret, no mutation, no storage, no service worker.
GET
GET /apps
{}text/html; previewOnly, compact app catalog and route indexPublic read-only /apps HTML page with no real execution, no provider call, no secret, no mutation, no storage.
GET
GET /v1/core/apps
{}{ previewOnly, status, appCatalog, routeIndex, navigation, policyFlags, policyCompliant }Token-protected safe JSON status; no real execution, no provider call, no external network, no secret exposure.
POST
POST /v1/core/apps/preview
{"action":"policy_check"}{ action, status, html, summary, appCatalog, routeIndex, navigation, policyFlags, policyCompliant }Preview actions for the home dashboard; requires local auth token; no real execution, no provider call, no external network, no mutation, no secret exposure.
External Service Toolkit Preview
external_services
GET
GET /external-services
{}text/html; previewOnly, external service toolkit catalog and policy previewPublic read-only external service toolkit HTML page; no real API call, no provider SDK, no key, no send, no upload, no screenshot, no PDF.
GET
GET /v1/core/external-services
{}{ status, policyFlags, previewOnly }Token-protected external service toolkit status; no real API call, no provider SDK, no key, no mutation.
POST
POST /v1/core/external-services/preview
{"action":"status_preview"}{ action, result|catalog|permissions|policy|status|summary, policyFlags, previewOnly }Preview actions for external service toolkit; requires local auth token; no real API call, no provider SDK, no key, no send, no upload, no screenshot, no PDF.
Research Engine Preview
research
GET
GET /research-engine
{}text/html; previewOnly, research engine preview page with research types and source catalogPublic read-only research engine HTML page; no Python execution, no subprocess, no internet fetch, no report write.
GET
GET /v1/core/research-engine
{}{ status, policyFlags, previewOnly }Token-protected research engine status; no Python execution, no subprocess, no internet fetch, no report write.
POST
POST /v1/core/research-engine/preview
{"action":"status_preview"}{ action, result|catalog|plan|schema|policy|flow|safety, policyFlags, previewOnly }Preview actions for research engine; requires local auth token; no Python execution, no subprocess, no internet fetch, no report write.
Tool Approval Workflow Preview
safety
GET
GET /approvals
{}{ contentType, html, previewOnly }Public HTML preview of tool approval workflow; no real persistence, no execution, no send, no write, no payment.
GET
GET /v1/core/approvals
{}{ previewOnly, status, policyFlags }Token-protected tool approval workflow status; no real persistence, no execution, no send, no write, no payment.
POST
POST /v1/core/approvals/preview
{"action":"status_preview"}{ action, result|status|summary, policyFlags, previewOnly }Preview actions for tool approval workflow; requires local auth token; no real persistence, no execution, no send, no write, no payment.
Safe Tool Execution Plan Preview
safety
GET
GET /execution-plans
{}{ contentType, html, previewOnly }Public HTML preview of safe tool execution plan; no real execution, no adapter, no send, no write, no payment.
GET
GET /v1/core/execution-plans
{}{ previewOnly, status, policyFlags }Token-protected safe tool execution plan status; no real execution, no adapter, no send, no write, no payment.
POST
POST /v1/core/execution-plans/preview
{"action":"status_preview"}{ action, result|status|summary, policyFlags, previewOnly }Preview actions for safe tool execution plan; requires local auth token; no real execution, no adapter, no send, no write, no payment.
Tool Adapter Registry Preview
safety
GET
GET /adapters
{}HTML page (no script, no form, no button)Public HTML tool adapter registry preview; no token, no adapter execution, no SDK, no send, no write, no payment.
GET
GET /v1/core/adapters
{}{ previewOnly, status, policyFlags }Token-protected tool adapter registry status; no adapter execution, no SDK, no send, no write, no payment.
POST
POST /v1/core/adapters/preview
{"action":"status_preview"}{ action, result|status|summary, policyFlags, previewOnly }Preview actions for tool adapter registry; requires local auth token; no adapter execution, no SDK, no send, no write, no payment.
Policy Decision API Preview
safety
GET
GET /policy-decisions
{}{ html }Public policy decision API HTML preview; no token; safe static read-only page.
GET
GET /v1/core/policy-decisions
{}{ status, policyFlags, previewOnly }Protected policy decision API JSON status; requires local auth token; no persistence, no execution.
POST
POST /v1/core/policy-decisions/preview
{"action":"status_preview"}{ action, result|status|summary, policyFlags, previewOnly }Preview actions for policy decision API; requires local auth token; no persistence, no execution, no send, no write, no payment.
Core Control Center
control_center
GET
/control-center
{}text/html; previewOnly, realExecutionPerformed=false, providerCallExecuted=false, mutationExecuted=falsePublic static HTML page with no secret and no live env read.
GET
/v1/core/control-center
{}{ status, routeCount, moduleCount, apiExplorerGroups, mcpExplorerTools, policyFlags, previewOnly }Safe JSON status; requires x-smart-shikka-local-token header if local auth is configured.
POST
/v1/core/control-center/preview
{"action":"status_preview"}{ action, status, html, summary, policyFlags, policyCompliant, previewOnly }Preview actions for control center; requires x-smart-shikka-local-token header if local auth is configured.
MCP Read-only Tools
4 read-only preview tools; no live execution or provider call.
Calculator Preview
calculator_preview
{
"toolId": "calculator_preview",
"intent": "<INTENT>",
"userMessage": "<USER_MESSAGE>",
"pageContext": {},
"knowledgeContext": {},
"maxResults": 10
}{
"previewOnly": true,
"readOnly": true,
"toolId": "calculator_preview",
"toolStatus": "preview_only",
"policy": {
"allowed": true,
"riskLevel": "safe"
},
"result": {},
"mutationExecuted": false,
"providerCallExecuted": false,
"realExecutionPerformed": false,
"externalNetworkEnabled": false,
"approvedExecutionEnabled": false,
"saveExecuted": false,
"sendExecuted": false,
"paymentExecuted": false,
"customerRecordUpdated": false
}Safe numeric/formula preview only. No real calculation backend, no payment math.
Knowledge Search Preview
knowledge_search_preview
{
"toolId": "knowledge_search_preview",
"intent": "<INTENT>",
"userMessage": "<USER_MESSAGE>",
"pageContext": {},
"knowledgeContext": {},
"maxResults": 10
}{
"previewOnly": true,
"readOnly": true,
"toolId": "knowledge_search_preview",
"toolStatus": "preview_only",
"policy": {
"allowed": true,
"riskLevel": "safe"
},
"result": {},
"mutationExecuted": false,
"providerCallExecuted": false,
"realExecutionPerformed": false,
"externalNetworkEnabled": false,
"approvedExecutionEnabled": false,
"saveExecuted": false,
"sendExecuted": false,
"paymentExecuted": false,
"customerRecordUpdated": false
}Searches only provided sanitized context. No DB, no network, no raw private data echo.
Report Draft Preview
report_draft_preview
{
"toolId": "report_draft_preview",
"intent": "<INTENT>",
"userMessage": "<USER_MESSAGE>",
"pageContext": {},
"knowledgeContext": {},
"maxResults": 10
}{
"previewOnly": true,
"readOnly": true,
"toolId": "report_draft_preview",
"toolStatus": "preview_only",
"policy": {
"allowed": true,
"riskLevel": "safe"
},
"result": {},
"mutationExecuted": false,
"providerCallExecuted": false,
"realExecutionPerformed": false,
"externalNetworkEnabled": false,
"approvedExecutionEnabled": false,
"saveExecuted": false,
"sendExecuted": false,
"paymentExecuted": false,
"customerRecordUpdated": false
}Draft outline/text preview only. No save, no send, no export, no PDF generation.
Status Read Preview
status_read_preview
{
"toolId": "status_read_preview",
"intent": "<INTENT>",
"userMessage": "<USER_MESSAGE>",
"pageContext": {},
"knowledgeContext": {},
"maxResults": 10
}{
"previewOnly": true,
"readOnly": true,
"toolId": "status_read_preview",
"toolStatus": "preview_only",
"policy": {
"allowed": true,
"riskLevel": "safe"
},
"result": {},
"mutationExecuted": false,
"providerCallExecuted": false,
"realExecutionPerformed": false,
"externalNetworkEnabled": false,
"approvedExecutionEnabled": false,
"saveExecuted": false,
"sendExecuted": false,
"paymentExecuted": false,
"customerRecordUpdated": false
}Read-only metadata summary. No live route call, no Core DB read.
Safety Flags
Total Flags
17
Enabled
2
Disabled
15
All Expected
true
previewOnlytrue
controlCenterOnlytrue
realExecutionPerformedfalse
mutationExecutedfalse
providerCallExecutedfalse
externalNetworkEnabledfalse
approvedExecutionEnabledfalse
memoryWriteExecutedfalse
auditWriteExecutedfalse
fileWriteExecutedfalse
databaseWriteExecutedfalse
paymentExecutedfalse
sendExecutedfalse
customerRecordUpdatedfalse
embeddingGenerationEnabledfalse
keyMaterialExposedfalse
smokeExecutedfalse
Safety Matrix
All unsafe capabilities are blocked by policy; no live execution or network call.
Total Capabilities
15
All Blocked
true
| Capability | Status | Expected | Evidence |
|---|---|---|---|
| Provider Call | blocked | off | providerCallExecuted=false; capability is blocked by control center policy. |
| External Network | blocked | off | externalNetworkEnabled=false; capability is blocked by control center policy. |
| Real Execution | blocked | off | realExecutionPerformed=false; capability is blocked by control center policy. |
| Approved Execution | blocked | off | approvedExecutionEnabled=false; capability is blocked by control center policy. |
| Mutation | blocked | off | mutationExecuted=false; capability is blocked by control center policy. |
| Database Write | blocked | off | databaseWriteExecuted=false; capability is blocked by control center policy. |
| File Write | blocked | off | fileWriteExecuted=false; capability is blocked by control center policy. |
| Audit Write | blocked | off | auditWriteExecuted=false; capability is blocked by control center policy. |
| Memory Write | blocked | off | memoryWriteExecuted=false; capability is blocked by control center policy. |
| Payment | blocked | off | paymentExecuted=false; capability is blocked by control center policy. |
| Send | blocked | off | sendExecuted=false; capability is blocked by control center policy. |
| Customer Record Update | blocked | off | customerRecordUpdated=false; capability is blocked by control center policy. |
| Embedding Generation | blocked | off | embeddingGenerationEnabled=false; capability is blocked by control center policy. |
| Key Material Exposure | blocked | off | keyMaterialExposed=false; capability is blocked by control center policy. |
| Smoke Execution | blocked | off | smokeExecuted=false; capability is blocked by control center policy. |
Route Risk Matrix
Risk posture for every preview route from the contract catalog.
| Route | Risk Level | Risk Factors | Mitigation |
|---|---|---|---|
POST POST /v1/gateway/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/gateway/observability/preview-status |
auth_required_preview |
|
Protect with local token; do not expose the token in browser or logs. |
GET GET /v1/gateway/observability/recent-events |
auth_required_preview |
|
Protect with local token; do not expose the token in browser or logs. |
POST POST /v1/security/bumblebee/preview-ingest |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/security/bumblebee/preview-alert |
safe_preview |
|
Public preview route; no auth or live execution required. |
POST POST /v1/mcp/read-only-tools/preview |
safe_preview |
|
Public preview route; no auth or live execution required. |
POST POST /v1/audit-store/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/memory-retrieval/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/provider-registry/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/approval-execution/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/assistant/orchestrator/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/app-integration/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/owner-ops-dashboard/preview |
owner_ops_preview |
|
Owner/ops route; verify role and intent before any real ops enablement. |
POST POST /v1/core/preview-contracts |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /settings/providers |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/provider-settings |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/provider-settings/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /knowledge |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/knowledge |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/knowledge/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /memory |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/memory |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/memory/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /goose |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/goose |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/goose/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /browser-extension |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/browser-extension |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/browser-extension/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /messaging |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/messaging |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/messaging/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET / |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /apps |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/apps |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/apps/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /external-services |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/external-services |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/external-services/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /research-engine |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/research-engine |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/research-engine/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /approvals |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/approvals |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/approvals/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /execution-plans |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/execution-plans |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/execution-plans/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /adapters |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/adapters |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/adapters/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /policy-decisions |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
GET GET /v1/core/policy-decisions |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
POST POST /v1/core/policy-decisions/preview |
blocked_execution_preview |
|
Forbidden capabilities are blocked by contract; real execution remains disabled. |
Module Risk Matrix
Risk posture for every preview module from the module catalog.
| Module | Risk Level | Risk Factors | Mitigation |
|---|---|---|---|
| Gateway Preview (gateway_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Gateway Observability (gateway_observability) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Security Inventory Preview (security_inventory_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Security Alert Preview (security_alert_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| MCP Read-only Tools Preview (mcp_readonly_tools_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Audit Store Preview (audit_store_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Memory + Retrieval Preview (memory_retrieval_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Provider Registry Preview (provider_registry_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Approval Execution Preview (approval_execution_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Assistant Orchestrator Preview (assistant_orchestrator_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| App Integration Preview (app_integration_preview) | app_integration_preview |
|
App integration module; verify per-app policy and consent before real handoff. |
| Owner/Ops Dashboard Preview (owner_ops_dashboard_preview) | owner_ops_preview |
|
Owner/ops module; restrict to authorized operators and audit before enabling. |
| Core Preview Contract Index (core_preview_contract_index) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Owner API Key Settings Preview (provider_settings_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Knowledge / RAG Upload Preview (knowledge_rag_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Memory Write Approval Preview (memory_approval_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Goose Connector Preview (goose_connector_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Browser Extension Preview (browser_extension_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| WhatsApp / Telegram Connector Preview (messaging_connector_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Preview Apps Home Dashboard (preview_apps_home_dashboard) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| External Service Toolkit Preview (external_service_toolkit_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Research Engine Preview (research_engine_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Tool Approval Workflow Preview (tool_approval_workflow_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Safe Tool Execution Plan Preview (safe_tool_execution_plan_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Tool Adapter Registry Preview (tool_adapter_registry_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
| Policy Decision API Preview (policy_decision_api_preview) | safe_preview |
|
All execution, provider, and write flags are disabled; safe to preview. |
Diagnostics Preview
Static, preview-only diagnostics with no live checks, no env read, and no network call.
Deployment
All modules are preview-only
pass
No live deployment or VPS checks are performed; all modules are preview-only.
Verify systemd service and port 37842 on the VPS before staging.
API Route Availability
Route catalog is preview-only and complete
pass
Route catalog enumerates 54 preview-only routes; no live route calls are made.
Run an authenticated smoke test against /v1/core/preview-contracts after deployment.
Auth Boundary
Token-protected routes are identified
manual_check_required
Token-protected routes require the configured local token header only when a token is configured; no secret is read or exposed.
Rotate the configured local auth token and verify 401 responses for missing tokens.
Control Center HTML Safety
HTML page contains no scripts, forms, or execution controls
pass
HTML page is built from static contracts with no <script>, <button>, <form>, or external resources.
Review the rendered /control-center page source for any injected secret.
Provider Safety
Provider calls and external network are disabled
pass
All modules have providerCallEnabled=false and externalNetworkEnabled=false; no provider SDK is initialized.
Confirm provider adapter is not initialized in server config.
Execution Safety
Real and approved execution are disabled
pass
All modules have realExecutionEnabled=false; approvedExecutionEnabled=false in policy flags.
Ensure dry_run mode is set before enabling any real execution gate.
App Integration Readiness
App integration preview module is configured
pass
App integration preview module is present with mutation/payment/send disabled.
Test Smart Print and Drishti Kundali context envelopes manually.
Owner/Ops Readiness
Owner/Ops dashboard preview module is configured
pass
Owner/Ops dashboard preview module is present and aggregates safe metadata only.
Review owner-ops dashboard preview before enabling owner-only routes.
Documentation
All modules have a docsPath
pass
Module catalog references a docs file for every module; no file content is read.
Confirm docs files exist in the deployed docs/ directory.
Section Completion
Current completion status of the Web/Desktop control center sections.
Total Sections
15
All Complete
false
Overview
complete
Route Explorer
complete
Module Explorer
complete
API/MCP Explorer
complete
MCP Tools
complete
Safety Matrix
complete
Diagnostics
complete
Desktop/PWA Shell
complete
Provider Registry
complete
Approval Bridge
complete
App Integration
complete
Owner/Ops
complete
Smoke Checklist
complete
Live Deploy
pending
Smart Print/Drishti Consumption
pending
Print/Export Safe View
Browser print and export are safe for this read-only preview page.
- Browser print is safe; only static preview text is shown.
- No token, API key, Mongo URI, or provider key appears in the page.
- No live data is fetched when printing or exporting.
- No hidden environment variables are exposed.
- No execution, payment, send, or provider call is triggered.
- Printed copy remains preview-only and non-binding.
Use your browser print dialog to save a read-only copy. Do not use this copy for production operations.
Completion Summary
Final web/desktop section status. Live deploy and Smart Print/Drishti consumption are handled separately.
Web/Desktop Shell
complete
Route Explorer
complete
API/MCP Explorer
complete
Safety Matrix
complete
Diagnostics
complete
Live Deploy
pending separately
Smart Print/Drishti Consumption
pending later
Real provider/execution
intentionally OFF
Copy-Safe cURL Examples
Replace <LOCAL_AUTH_TOKEN> with your local token only when running locally. Never commit a real token.
POST /v1/gateway/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/gateway/preview" \
-H "Content-Type: application/json" \
-d '{"query":"Smart Print estimate preview","dryRunOnly":true}'GET /v1/gateway/observability/preview-status
curl -X GET "https://shikka.anoopampress.com/api/v1/gateway/observability/preview-status" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"GET /v1/gateway/observability/recent-events
curl -X GET "https://shikka.anoopampress.com/api/v1/gateway/observability/recent-events" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/security/bumblebee/preview-ingest
curl -X POST "https://shikka.anoopampress.com/api/v1/security/bumblebee/preview-ingest" \
-H "Content-Type: application/json" \
-d '{"lines":["{\"event\":\"test\"}"],"dryRunOnly":true}'POST /v1/security/bumblebee/preview-alert
curl -X POST "https://shikka.anoopampress.com/api/v1/security/bumblebee/preview-alert" \
-H "Content-Type: application/json" \
-d '{"alertType":"suspicious_token","severity":"high"}'POST /v1/mcp/read-only-tools/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/mcp/read-only-tools/preview" \
-H "Content-Type: application/json" \
-d '{"toolId":"calculator","intent":"add","userMessage":"2 + 2"}'POST /v1/audit-store/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/audit-store/preview" \
-H "Content-Type: application/json" \
-d '{"eventType":"test_event","dryRunOnly":true}'POST /v1/memory-retrieval/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/memory-retrieval/preview" \
-H "Content-Type: application/json" \
-d '{"query":"customer order summary","dryRunOnly":true}'POST /v1/provider-registry/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/provider-registry/preview" \
-H "Content-Type: application/json" \
-d '{"action":"catalog_preview"}'POST /v1/approval-execution/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/approval-execution/preview" \
-H "Content-Type: application/json" \
-d '{"action":"request_preview","requestedAction":"deploy"}'POST /v1/assistant/orchestrator/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/assistant/orchestrator/preview" \
-H "Content-Type: application/json" \
-d '{"action":"plan_preview","userMessage":"What is the workflow?"}'POST /v1/app-integration/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/app-integration/preview" \
-H "Content-Type: application/json" \
-d '{"action":"context_envelope","appId":"smart_print"}'POST /v1/owner-ops-dashboard/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/owner-ops-dashboard/preview" \
-H "Content-Type: application/json" \
-d '{"action":"dashboard_preview","appId":"smart_print"}'POST /v1/core/preview-contracts
curl -X POST "https://shikka.anoopampress.com/api/v1/core/preview-contracts" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"policy_check"}'GET /settings/providers
curl -X GET "https://shikka.anoopampress.com/api/settings/providers" \
-H "Content-Type: application/json"GET /v1/core/provider-settings
curl -X GET "https://shikka.anoopampress.com/api/v1/core/provider-settings" \
-H "Content-Type: application/json"POST /v1/core/provider-settings/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/provider-settings/preview" \
-H "Content-Type: application/json" \
-d '{"action":"policy_check"}'GET /knowledge
curl -X GET "https://shikka.anoopampress.com/api/knowledge" \
-H "Content-Type: application/json"GET /v1/core/knowledge
curl -X GET "https://shikka.anoopampress.com/api/v1/core/knowledge" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/knowledge/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/knowledge/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"policy_check"}'GET /memory
curl -X GET "https://shikka.anoopampress.com/api/memory" \
-H "Content-Type: application/json"GET /v1/core/memory
curl -X GET "https://shikka.anoopampress.com/api/v1/core/memory" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/memory/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/memory/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"policy_check"}'GET /goose
curl -X GET "https://shikka.anoopampress.com/api/goose" \
-H "Content-Type: application/json"GET /v1/core/goose
curl -X GET "https://shikka.anoopampress.com/api/v1/core/goose" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/goose/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/goose/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"policy_check"}'GET /browser-extension
curl -X GET "https://shikka.anoopampress.com/api/browser-extension" \
-H "Content-Type: application/json"GET /v1/core/browser-extension
curl -X GET "https://shikka.anoopampress.com/api/v1/core/browser-extension" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/browser-extension/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/browser-extension/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"policy_check"}'GET /messaging
curl -X GET "https://shikka.anoopampress.com/api/messaging" \
-H "Content-Type: application/json"GET /v1/core/messaging
curl -X GET "https://shikka.anoopampress.com/api/v1/core/messaging" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/messaging/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/messaging/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"policy_check"}'GET /
curl -X GET "https://shikka.anoopampress.com/api/" \
-H "Content-Type: application/json"GET /apps
curl -X GET "https://shikka.anoopampress.com/api/apps" \
-H "Content-Type: application/json"GET /v1/core/apps
curl -X GET "https://shikka.anoopampress.com/api/v1/core/apps" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/apps/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/apps/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"policy_check"}'GET /external-services
curl -X GET "https://shikka.anoopampress.com/api/external-services" \
-H "Content-Type: application/json"GET /v1/core/external-services
curl -X GET "https://shikka.anoopampress.com/api/v1/core/external-services" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/external-services/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/external-services/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"status_preview"}'GET /research-engine
curl -X GET "https://shikka.anoopampress.com/api/research-engine" \
-H "Content-Type: application/json"GET /v1/core/research-engine
curl -X GET "https://shikka.anoopampress.com/api/v1/core/research-engine" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/research-engine/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/research-engine/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"status_preview"}'GET /approvals
curl -X GET "https://shikka.anoopampress.com/api/approvals" \
-H "Content-Type: application/json"GET /v1/core/approvals
curl -X GET "https://shikka.anoopampress.com/api/v1/core/approvals" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/approvals/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/approvals/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"status_preview"}'GET /execution-plans
curl -X GET "https://shikka.anoopampress.com/api/execution-plans" \
-H "Content-Type: application/json"GET /v1/core/execution-plans
curl -X GET "https://shikka.anoopampress.com/api/v1/core/execution-plans" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/execution-plans/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/execution-plans/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"status_preview"}'GET /adapters
curl -X GET "https://shikka.anoopampress.com/api/adapters" \
-H "Content-Type: application/json"GET /v1/core/adapters
curl -X GET "https://shikka.anoopampress.com/api/v1/core/adapters" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/adapters/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/adapters/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"status_preview"}'GET /policy-decisions
curl -X GET "https://shikka.anoopampress.com/api/policy-decisions" \
-H "Content-Type: application/json"GET /v1/core/policy-decisions
curl -X GET "https://shikka.anoopampress.com/api/v1/core/policy-decisions" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>"POST /v1/core/policy-decisions/preview
curl -X POST "https://shikka.anoopampress.com/api/v1/core/policy-decisions/preview" \
-H "Content-Type: application/json" \
-H "x-smart-shikka-local-token: <LOCAL_AUTH_TOKEN>" \
-d '{"action":"status_preview"}'Smoke Checklist
Leak Checks
10
Smoke Tests
54
Network Call
true
Route Invocation
true
Leak Checks
- no_api_key
- no_password
- no_secret
- no_private_key
- no_access_token
- no_provider_key
- no_database_uri
- no_mongo_url
- no_whatsapp_token
- no_customer_pii
No route is invoked; no network call; no real token required for preview catalog.