# Phast runtime

This directory is the canonical source for the existing `phast-app` Fly app,
serving `phast.app` and `my.phast.app`. It remains one Python/FastMCP runtime.

## App convention

`phast.json` is the minimal Prephab manifest. Schema version 1 requires a
stable slug and name, an HTTPS origin, Python as the runtime, `/` as the default
human route, `/mcp` as the default MCP route, and Prephab shape version 1.
Registry tools return this same shape.

`my.phast.app` renders its human surface with the installed Prefab UI package.
Its MCP exposes `apps_list`, `apps_get`, `apps_create`, and `apps_update`, plus
bounded status and Prefab-app tools. There is intentionally no delete.

## Production blockers

The current Fly app has no volume and Phast has no accepted owner-auth pattern.
The registry therefore refuses to treat the image filesystem as durable, and
create/update always fail before writing. Do not deploy this as an enabled
control plane until both seams are closed:

1. create and attach one Fly volume at `/data`, then set
   `PHAST_DATA_DIR=/data`; the runtime verifies that the directory is a mount;
2. reuse an accepted FastMCP owner identity provider and replace the explicit
   mutation guard with caller identity/authorization checks.

Do not substitute a shared secret in the UI or an environment flag for owner
authentication. Once both prerequisites exist, exercise list/get/create/update
through `my.phast.app/mcp`, verify persistence across a Machine replacement,
then deploy through the existing Phast launch path.

## Local validation

Run `python -m unittest tests.test_phast`. Tests use a temporary SQLite file;
they do not weaken the production mount or authentication guards.

## On Teahub prod (2026-10-14)
Ported from the old factory (`tea-mcp/src/phast`, plus `phastacp` as `acp/`) as it was. Phast is a client of Teahub:
this org owns the code, the site (`phast/site`) and phast.app. The Fly app named in `fly.toml` (`phast-app`) does not
exist yet; the production blockers above still stand (volume at /data, owner auth via Gitea OAuth).