Quesarby MLAI

Reference

Protected surfaces fail closed.

The console requires a session. There is no public hosted assistant API.

What this site actually exposes

Sign-in opens /console: per-user field notes on architecture nodes, a consent-gated model chat, and the sealed audits of that chat. Model replies are sign-in-gated, rate-limited per user, and not an Abbey session.

Every per-user server function runs behind the session middleware and scopes its queries by the signed-in user id, never an id sent by the browser. Without a session the console redirects to sign-in. On the static GitHub Pages build these surfaces render a server-only notice instead.

The surfaces below are everything the server exposes. There is no hosted assistant API and no platform SDK.

Checked against these sources on .

Reference

What this site exposes

Protected surfaces require a Better Auth session and fail closed. There is no public hosted assistant API.

  • /api/auth/*

    Current

    Better Auth: Google, Apple and X sign-in, passkeys, email and password, session.

  • askPersona

    Current

    Server function behind the session: one persona reply through the model interface, rate-limited per user.

  • askDesk

    Current

    Server function behind the session: a desk answer from the catalog and, when configured, the model.

  • Console notes

    Current

    Per-user field notes on architecture nodes, scoped by user id.

  • GET /feed.xml

    Current

    RSS 2.0 for lab notes, research publications and releases. Public.

  • POST /api/telemetry, POST /api/csp-report

    Current

    Operational sinks: allowlisted anonymous page events (rate-limited, size-limited) and browser CSP violation reports (logged, not stored).

  • GET /api/cron/audits-expire

    Current

    Daily expiry of old chat audits. Requires Authorization: Bearer CRON_SECRET; without the secret it answers 503 and is off.

  • Consent, audits, admin review

    Current

    Consent-gated chat with sealed audits you can read and delete; admin review with a stated reason.

  • Workspace connectors, billing, inquiries

    Current

    Drive and SharePoint connectors, profile billing, and the public inquiry form with a rate limit.

All docsPrevious: Each surface has its own gate.
Architecture

Next

Developers

The READMEs these articles cite.