# Foresixa Bot Observatory — refreshed source handoff

The recovered original archive contained a JavaScript Worker application. This refresh preserves its dashboard, seed, validation, checks and hosting files, and adds `server.py`, `app_config.json`, `templates/dashboard.html`, a Node validation bridge and local HTTP tests. The Python adapter is newly prepared here, not recovered from or installed on the Mac.

## Local offline use

Requirements: Python3.9+ and Node.js18+ already installed. No pip or npm package installation is needed for the local launcher. No outbound API calls, tunnel, payment configuration or model execution is started.

Extract this package into a new folder. Do not overwrite a running application or existing data. From `Foresixa_Bot_Observatory`, run:

```bash
python3 -m unittest test_local_server.py
python3 server.py
```

The server binds only to127.0.0.1:8767. If that port is occupied, use `python3 server.py --port 8768`. It never kills an existing process. Open the printed local `/login` URL. Read the private `data/local-access-token.txt` on your own machine and enter that value in the local login form. Do not paste the token into chat. Alternatively, set `FORESIXA_OBSERVATORY_TOKEN` locally to an existing secret of at least32characters. Token content is never printed by the launcher. Keep the containing directory private.

The browser receives a local HttpOnly, SameSite session cookie. This HTTP loopback adapter is not a public HTTPS deployment; it rejects unfamiliar Host and browser Origin headers. It must not be exposed by tunneling or proxying it as-is. The earlier600second setup provisioner is separate and is not started by this dashboard.

## Data and routes

- `GET /`: recovered dashboard, after local authentication.
- `GET /api/snapshot`: eight recorded profiles plus locally saved events and pagination.
- `POST /api/events`: bearer/cookie authenticated imports, validated using the original JavaScript rules. IDs are immutable; duplicate imports return409 and roll back the complete batch.
- `GET /manifest.webmanifest` and `/icon.svg`: app assets.
- `POST /login`: local token login. No filesystem-serving route exposes the configuration, token or database.

Local events are stored in `data/observatory.sqlite3`, not `trading_live.db`. No existing database or workbook is modified. The training workbook remains a separately supplied reference. There is no XLSX ingestion in this launcher; do not pass an unsupported `--training-data` flag.

`trainerConnected` remains false. Imported records are reported activity, not independently verified results or a running trainer. Conversations, model weights, payments and model training are not implemented by this dashboard. The historical seed is preserved from the recovered source; the current reference workbook and subsequent Founder directions govern any later curriculum reconciliation.

## Verification

Run the recovered JavaScript checks from `webapp`:

```bash
node checks.mjs
node upgrade-checks.mjs
```

New local HTTP tests exercise authentication, login, dashboard/assets, snapshot, event readback, duplicate and atomic-batch rejection, foreign origins/hosts, body limit and history cursor validation. Tests use synthetic data and temporary storage. Mac installation, real training and browser/device rendering remain unverified.

`ORIGINAL_INTEGRATION_README.md` preserves the prior handoff notes. The hosted Worker build remains in `webapp`; it is distinct from the new Python launcher. This download link retrieves source files; it does not deploy the application to the Mac.