REST gateway

graph_os.gateway owns HTTP routing, dashboard aggregation, the widget registry, and the graph-os-daemon host lifecycle. Agent, graph, ontology, catalog, and policy behavior remains owned by agent-utilities or epistemic-graph.

The application boundary is GatewayApplicationPort. The composition root installs one implementation with configure_gateway_application() before it calls register_graph_routes().

1. Receive HTTPThe GraphOS gateway receives an authenticated application request.
2. Cross one portGatewayApplicationPort connects routes to the shared application runtime.
3. Use one compositionMCP and fleet services share the same GraphOS process state.
4. Reach the ownerTyped agent-utilities and epistemic-graph contracts perform domain work.

There is no fallback import of AU's kg_server or multiplexer. An unconfigured process fails closed before routes are served, so the active authority remains observable rather than silently selecting another implementation.

Connector widgets

Dashboard widgets retain only presentation and response-projection logic in graph_os.gateway.widgets. They do not import connector packages or construct vendor API clients. Each connector operation is resolved from the served multiplexer tool catalog and invoked with MCPMultiplexer.delegate_server_tool() through run_on_served_multiplexer(). Credentials, TLS, child lifecycle, and tool admission therefore remain at the connector/fleet boundary.

1. ScheduleThe dashboard aggregator assigns work to a bounded widget worker.
2. ProjectGraphOS retains only presentation and response projection.
3. ResolveThe served multiplexer resolves the operation from the verified catalog.
4. DelegateThe admitted connector child performs the source-specific operation.
5. ReturnThe response returns through the same multiplexer and projection.

A connector absent from the EG-backed catalog, an ambiguous operation, or a child failure produces the widget's existing correlation-safe error shape. GraphOS never falls back to package importability or direct vendor credentials.