feat: harden seat intent and expand HIL coverage

src/cognitive_agent/server.py

@@ -20,8 +20,10 @@ from cognitive_agent.config_loader import load_local_env
 
 
 REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
-load_local_env(REPOSITORY_ROOT / ".env")
-load_local_env(REPOSITORY_ROOT / ".env.auth")
+# Repository-local launch configuration is deliberate and must not be shadowed
+# by stale variables inherited from an IDE or an earlier model experiment.
+load_local_env(REPOSITORY_ROOT / ".env", override=True)
+load_local_env(REPOSITORY_ROOT / ".env.auth", override=True)
 
 from cognitive_agent.auth import AuthConfig, AuthRuntime, verify_password  # noqa: E402
 from cognitive_agent.application.seat_service import SeatDemoService  # noqa: E402
@@ -31,12 +33,14 @@ from cognitive_agent.infrastructure.llm.openai_responses import OpenAIIntentErro
 
 
 STATIC_ROOT = REPOSITORY_ROOT / "apps" / "web-console"
+mimetypes.add_type("application/manifest+json", ".webmanifest")
 REQUEST_ID_PATTERN = re.compile(r"^req-[a-z0-9-]+$")
 PUBLIC_AUTH_PATHS = {
     "/login",
     "/login.html",
     "/login.css",
     "/login.js",
+    "/network.js",
     "/api/auth/status",
     "/api/auth/login",
 }
@@ -182,6 +186,7 @@ class SeatDemoHandler(BaseHTTPRequestHandler):
                     if payload.get("vehicle_id")
                     else None
                 ),
+                simulation_fault=str(payload.get("simulation_fault", "normal")),
             )
             self._json(result, HTTPStatus.CREATED)
         except HardwareSafetyError as exc:
@@ -370,7 +375,14 @@ class SeatDemoHandler(BaseHTTPRequestHandler):
         self.send_response(HTTPStatus.OK)
         self.send_header("Content-Type", f"{content_type or 'application/octet-stream'}; charset=utf-8")
         self.send_header("Content-Length", str(len(content)))
-        self.send_header("Cache-Control", "no-store")
+        cache_control = "no-cache"
+        if relative_path.startswith(("vendor/", "assets/", "icons/")):
+            cache_control = "public, max-age=31536000, immutable"
+        elif candidate.name in {"index.html", "login.html", "service-worker.js"}:
+            cache_control = "no-cache"
+        self.send_header("Cache-Control", cache_control)
+        if candidate.name == "service-worker.js":
+            self.send_header("Service-Worker-Allowed", "/")
         self._send_security_headers()
         self.end_headers()
         self.wfile.write(content)
@@ -427,10 +439,10 @@ class SeatDemoHandler(BaseHTTPRequestHandler):
         self.send_header(
             "Content-Security-Policy",
             "default-src 'self'; "
-            "script-src 'self' 'wasm-unsafe-eval' https://unpkg.com https://cdn.jsdelivr.net; "
+            "script-src 'self' 'wasm-unsafe-eval'; "
             "style-src 'self'; "
             "img-src 'self' data:; "
-            "connect-src 'self' https://cdn.jsdelivr.net; "
+            "connect-src 'self'; "
             "object-src 'none'; base-uri 'none'; frame-ancestors 'none'",
         )
         if self._is_https():
@@ -462,7 +474,9 @@ def main() -> None:
         print(f"Cabin orchestration demo: http://{args.host}:{args.port}", flush=True)
     hardware = SeatDemoHandler.service.hardware_settings
     print(
-        "Execution modes: dry_run + hardware "
+        "Execution modes: dry_run + simulated_hardware "
+        f"({'enabled' if SeatDemoHandler.service.simulated_hardware_enabled else 'locked'}) "
+        "+ hardware "
         f"({'configured' if hardware.configured else 'locked'})",
         flush=True,
     )