Cross-System Status

Last verified against source code: 2026-02-14.

Repositories and Runtime Roles

Repository	Runtime Role	Key Entry Points
`kobi-ai`	Browser UI + Next.js BFF	`/api/ai/`, `/api/canvas/`, `/api/internal/canvas/context`
`kobi-agent-service`	FastAPI LangGraph engine	`/api/v1/chat`, `/api/v1/agents`, `/health`
`kobi-mcp-server`	MCP tools/resources server	`/mcp/tools/`, `/mcp/resources/`, `/health`
`kobi-web`	Documentation site	`src/content/docs/docs/*`

kobi-ai -> kobi-agent-service: connected through /api/ai/* proxy and service-to-service headers (X-Contract-Version, X-User-Id, X-Project-Id, X-Thread-Id, X-Agent-Type).
kobi-agent-service -> kobi-mcp-server: connected through MCP HTTP client (/mcp/tools/call, /mcp/tools/list).
kobi-ai -> kobi-mcp-server: no direct runtime call path by design.
kobi-agent-service -> kobi-ai /api/internal/canvas/context: internal endpoint exists and is protected; no active engine node currently calling it.
Legacy auto-reply path is not active in current kobi-ai runtime.

Engine workflow YAML still lists interaction tools (confirm, ask_opinion, select_option) that are not registered in MCP. Runtime behavior relies on MCP tool list, not YAML alone.
propose_deep_research is registered in MCP but is not included in GATED_TOOLS and MUTATING_TOOLS sets; it enforces approved in handler but misses shared auth+gate middleware path.
kobi-mcp-server/.env.example uses SUPABSE_SERVICE_KEY (typo) while runtime code expects SUPABASE_SERVICE_KEY.

Most current 400s come from one of these:

BFF request allowlist rejection (Unknown request field(s) or Unknown metadata field(s)).
threadId and sessionId both present but not equal.
Internal contract mismatch (X-Contract-Version mismatch or missing required headers/claims) when BFF calls engine.

Use API and Event Contracts and Operations Runbook for exact payload/header checks.