# CyberBrain26 - Architektura

## Trivrstva izolace

| Vrstva | Cesta | Branch | Ucel | Porty |
|---|---|---|---|---|
| BETA | /home/oem/CyberBrain26 | main | Produkce | 8080, 4000, 7682 |
| NEXT | /home/oem/CyberBrain26-next | staging | Staging | N/A |
| LAB | /home/oem/CyberBrain26-lab | lab/phase-3a | Vyvoj | 8180, 7782, 4100, 8443 |

Pravidlo: BETA je read-only. Zmeny jdou z LAB pres NEXT do BETA.

## Package layout

    src/cyberbrain26/
    ├── __init__.py
    ├── cli.py              # Typer CLI
    ├── paths.py            # platformdirs + CB26_* override
    ├── core/
    │   ├── event_bus.py
    │   ├── task_queue.py
    │   ├── terminal_service.py
    │   ├── openclaw_adapter.py
    │   ├── openclaw_worker.py
    │   ├── worktree_manager.py
    │   ├── task_manager.py
    │   └── webapp_phase3fg.py
    ├── memory/
    │   ├── core.py         # ChromaDB
    │   └── auto.py
    ├── schemas/
    │   └── conversation.py # Pydantic
    └── services/
        ├── registry.py
        ├── safe_oi/
        ├── webapp/
        └── llm_proxy/

## Cesty (paths.py)

Vsechny cesty jdou pres cyberbrain26.paths, ktere respektuji CB26_*
environment variables. V LAB jsou presmerovane do .cb26-data/.

- config_dir(), data_dir(), cache_dir()
- workspace_dir(), conversations_dir(), chroma_dir(), logs_dir()
- project_root()

## Bezpecnost - Policy Engine

- SAFE: navrhy prikazu v bloku, nic se nespousti
- FULL: read-only automaticky, zapis vyzaduje schvaleni

Capability Matrix:
- Low/Medium: read-only -> automaticky
- High: mazani, sit, restart -> pending_approval
- Critical: commit, push, BETA, secrets -> DENY

## LLM routing

- LiteLLM Proxy na portu 4100 (LAB) / 4000 (BETA)
- Config: services/llm_proxy/config.yaml (10 modelu)
- Semanticka cache (in-memory)

## Sluzby - sprava

cyberbrain service {list,status,start,stop}:
- Spousti python -m <module> nebo subprocess (litellm)
- Pidfile: logs_dir()/services/<name>.pid
- self_pidfile=True pro litellm
- Detekce kolize portu


## Faze 4 - Modularni monolit

Viz `src/cyberbrain26/app.py`. Spojuje webapp a safe_oi do jednoho
FastAPI procesu:

- `/safe-oi/*` -> safe_oi (bezpecnostni API)
- `/v1/*`, `/ui`, `/` -> webapp (worktree, terminal, openclaw)
- `/health` -> agregovany stav vsech sluzeb

LiteLLM proxy zustava oddeleny proces (port 4100).

### Porty

- Monolit: 8080 (LAB scratch 8090 pri testech)
- LiteLLM: 4100 (vzdy oddeleny)
- Legacy: safe_oi 7782, webapp 8180 (do prechodu)

### Registry

    cyberbrain service list
    -> litellm  port 4100  LiteLLM proxy
    -> monolith port 8080  Modularni monolit FastAPI
    -> safe-oi  port 7782  SAFE/FULL-OI API
    -> webapp   port 8180  WebApp UI

### Testy

    tests/test_app.py  - 6 testu (sub-app, aggregate health)

Agregovany /health pouziva paralelni httpx s timeoutem 1s.