Accepted direction

No admin panel. Just authenticated artifact publishing.

Agents upload a complete HTML report folder through REST. Humans open the stable report URL, and Tinbox or issues can link to it.

Authenticate

Client authenticates through archea.dev/Gitea OAuth/OIDC.

Upload folder

Agent sends `index.html` plus images and report-local assets.

Serve URL

Raptor serves `/UUID/index.html` and files in that artifact folder.

Replace in place

Update overwrites the artifact. Raptor v1 does not keep revisions.

REST API sketch Well + SQLite

POST /api/artifacts
Authorization: Bearer <token>
Content-Type: multipart/form-data

title=Tinbox code review
files[]=index.html
files[]=assets/chart.png

201 Created
Location: /3f0d.../index.html

PUT /api/artifacts/3f0d...
Authorization: Bearer <token>
Content-Type: multipart/form-data

files[]=index.html
files[]=assets/chart.png

204 No Content

raptor.archea.dev/3f0d.../index.html

AI Code Review

Findings for deployment flow

High: artifact serving policy must block path traversal.

Medium: report kit version should be visible in metadata.

Note: Tinbox can store this URL as a task attachment.

Open decision

Report kit for AI-generated HTML

Raptor can expose a stable optional asset path, for example `/static/report-kit/`, so agents can generate consistent reports.

Recommended v1

Small Raptor-owned CSS kit and HTML patterns.

Later option

Shoelace or another component library if reports need interaction.