# Conductor

A web-based, drag-and-drop UI builder for creating simple frontend applications backed by REST API endpoints.

Designed for IBM Concert Workflows / Rapid Infrastructure Automation, but backend-agnostic — any system that exposes HTTP/REST endpoints can be used as an integration target.

---

## Overview

- **Visual Editor** — drag-and-drop canvas for placing and configuring UI components
- **JSON Editor** — direct access to the canonical project definition
- **Preview Mode** — run the application as an end user
- **REST Proxy** — server-side proxy for API calls; secrets never reach the browser
- **Backend-agnostic REST integration** — build and run REST-backed interfaces without an AI dependency

---

## Repository Structure

```
conductor/
├── frontend/          # React + TypeScript UI
│   ├── public/
│   └── src/
├── backend/           # Node.js + Express + TypeScript API
│   └── src/
├── docs/              # Project documentation
│   ├── REQUIREMENTS.md
│   ├── ARCHITECTURE.md
│   ├── NICE-TO-HAVE.md
│   └── BUILD_AND_TEST_PLAN.md
├── examples/
│   └── project-definitions/
├── docker-compose.yml
└── README.md
```

---

## Local Development

### Prerequisites

- Node.js 20+
- npm 10+

### Frontend

```bash
cd frontend
npm install
npm start
# Runs on http://localhost:3000
```

### Backend

```bash
cd backend
npm install
npm run dev
# Runs on http://localhost:4000
```

The frontend development server proxies `/api/*` requests to `http://localhost:4000`.

---

## Development Docker

```bash
docker compose up --build
# Frontend: http://localhost:3000
# Backend:  http://localhost:4000
```

## Production installation

Conductor's production distribution is one non-root container serving the compiled frontend, published application routes, and backend API on port 8080. SQLite data is stored in a persistent volume. The development stack above remains separate.

The command below is the final production coordinate and will succeed only after the public `v1.0.0` Gitea Release and container image have been published. Until then, a missing-manifest response means publication is incomplete; do not substitute `latest` or private registry credentials.

```bash
docker pull gitea.skeletonworks.online/vwiebe/conductor:v1.0.0
```

The v1.0.0 production image supports Linux/AMD64. Anonymous source and image availability are mandatory publication checks. A complete internet-facing installation also requires persistent generated keys, the tagged Compose bundle, a data volume, and HTTPS.

Independent self-hosters should follow [docs/INSTALL.md](docs/INSTALL.md) from start to finish. For backup, restore, upgrade, and rollback, see [docs/OPERATIONS.md](docs/OPERATIONS.md). Conductor never ships a default username or password.

---

## Documentation

| Document | Description |
|---|---|
| [ROADMAP.md](ROADMAP.md) | Unified v1.0.0 work plan grouped by function and slice |
| [MVP_SCOPE.md](MVP_SCOPE.md) | Approved MVP and v1.0.0 release boundary |
| [TESTING.md](TESTING.md) | Detailed manual test workflows and acceptance records |
| [docs/REQUIREMENTS.md](docs/REQUIREMENTS.md) | Full product requirements |
| [docs/MVP_TRACEABILITY.md](docs/MVP_TRACEABILITY.md) | v1.0.0 requirements mapped to slices and validation evidence |
| [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) | Technical architecture |
| [docs/NICE-TO-HAVE.md](docs/NICE-TO-HAVE.md) | Future enhancements |
| [docs/BUILD_AND_TEST_PLAN.md](docs/BUILD_AND_TEST_PLAN.md) | Incremental build and test plan |
| [docs/INSTALL.md](docs/INSTALL.md) | Public source/container and reverse-proxy installation |
| [docs/OPERATIONS.md](docs/OPERATIONS.md) | Production configuration, backup, restore, upgrade, and rollback |
| [docs/RELEASE.md](docs/RELEASE.md) | Image tagging, release construction, and publication |
| [docs/RELEASE_NOTES_v1.0.0.md](docs/RELEASE_NOTES_v1.0.0.md) | v1.0.0 capabilities, compatibility, and publication record requirements |
| [docs/USER_GUIDE.md](docs/USER_GUIDE.md) | Project authoring and published-application use |
| [docs/ADMIN_GUIDE.md](docs/ADMIN_GUIDE.md) | Users, sessions, credentials, publishing, and execution history |
| [docs/FIRST_RUN_SETUP.md](docs/FIRST_RUN_SETUP.md) | First-administrator setup and recovery entry points |
| [docs/SECRETS.md](docs/SECRETS.md) | Credential encryption and key lifecycle |
| [docs/PROXY_SECURITY.md](docs/PROXY_SECURITY.md) | REST destination, request, response, and history policy |
| [docs/AUTHORIZATION_AND_PUBLISHING_SECURITY.md](docs/AUTHORIZATION_AND_PUBLISHING_SECURITY.md) | Authentication, RBAC, and publication trust boundaries |
| [docs/DEVELOPER_GUIDE.md](docs/DEVELOPER_GUIDE.md) | Architecture, invariants, tests, and contribution workflow |
| [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) | Production and application troubleshooting |
| [docs/KNOWN_LIMITATIONS.md](docs/KNOWN_LIMITATIONS.md) | Explicit v1.0.0 limitations and deferred capabilities |

---

## Stack

| Layer | Technology |
|---|---|
| Frontend | React 18, TypeScript 5 |
| Backend | Node.js 20, Express 4, TypeScript 5 |
| Database | SQLite (MVP) |
| Deployment | Single production container, Docker Compose, Caddy/NGINX reverse proxy |