host: live wiring — native http-listen <-> Dream bridge + serve.sh, 145/145

lib/host/server.sx adapts the native http-listen contract (string-keyed
{method,path,query,headers,body} -> {:status :headers :body}) to the Dream
host app: native->dream reassembles path+query into a target dream-request
parses; dream->native is near-identity (dream-response is already
{:body :headers :status}). host/serve = http-listen over host/native-handler
. host/make-app. lib/host/serve.sh boots the full module set and serves in the
foreground (container-entry shaped). Verified live on a host port: health/feed/
feed?actor=/relations reads serve real JSON, unknown->404. server suite (13)
covers the bridge as pure functions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plans/host-on-sx.md

@@ -36,10 +36,13 @@ host — no `ocaml-on-sx` dependency.
 
 ## Status (rolling)
 
-`bash lib/host/conformance.sh` → **132/132** (7 suites: handler, middleware, sxtp,
-router, feed, relations, ledger). Phases 1 & 2 DONE; Phase 3 (strangler ledger)
-underway — ledger module + `relations` container cut-over landed (reads + guarded
-writes, 50% off Quart). Golden-response harness vs live Quart next.
+`bash lib/host/conformance.sh` → **145/145** (8 suites: handler, middleware, sxtp,
+router, feed, relations, server, ledger). Phases 1 & 2 DONE; Phase 3 cut-over
+landed (50% off Quart). **The host now serves live HTTP** — `lib/host/server.sx`
+bridges the native `http-listen` server to the Dream app and `lib/host/serve.sh`
+boots it (verified: GET /health, /feed, /feed?actor=, relations get-children/
+get-parents all serve real JSON on a host port; unknown→404). Remaining: golden
+harness vs live Quart, internal-HMAC middleware, docker stack + Caddy subdomain.
 
 ## Ground rules
 
@@ -126,10 +129,18 @@ lib/host/sxtp.sx                        subsystem APIs (feed/search/commerce/…
       detach → gone. The TYPED actions (`relate`/`unrelate`/`can-relate`) stay
       proxied by design — registry + cardinality validation lib/relations lacks.
 
-## Phase 4 — Dream framework layer (gated)
-- [ ] gate: `ocaml-on-sx` Phases 1–5 + minimal stdlib green
-- [ ] adopt `dream-on-sx` routing/middleware/session ergonomics over the same handlers
-- [ ] re-home external adapters as native where replacements land
+## Phase 4 — Live wiring + Dream framework layer
+- [x] native `http-listen` ↔ Dream-app bridge (`lib/host/server.sx`:
+      `host/native-handler`/`host/serve`) + `lib/host/serve.sh` launcher. Serves
+      real HTTP on a host port — verified live (health/feed/relations reads + 404).
+- [ ] promote into the docker stack + a Caddy subdomain (NOT `rose-ash.com` — that
+      is the legacy public site, untouched). Scope now includes `hosts/` + Caddy.
+- [ ] proxy-to-Quart fallback for un-migrated paths (strangler requirement before
+      a real subdomain fronts users).
+- [ ] internal-HMAC middleware on `/internal/*` (service-to-service auth; protocol
+      checks native, signature check needs an HMAC-SHA256 kernel prim — absent today).
+- [ ] (gated) adopt `dream-on-sx` session/CSRF ergonomics; re-home external
+      adapters as native where replacements land.
 
 ## Progress log
 
@@ -215,6 +226,23 @@ lib/host/sxtp.sx                        subsystem APIs (feed/search/commerce/…
   off Quart. NEXT: golden-response harness vs live Quart, then survey the next
   domain (blog/likes proxied — likes needs an SX subsystem first).
 
+- **Phase 4 — live wiring bridge (DONE, 145/145).** `lib/host/server.sx` adapts the
+  native `http-listen` contract (string-keyed req `{"method" "path" "query"
+  "headers" "body"}` → `{:status :headers :body}`) to the Dream app: `host/-native
+  ->dream` reassembles `path`+`query` into a target `dream-request` parses;
+  `host/-dream->native` is near-identity (dream-response is already `{:body
+  :headers :status}`). `host/serve port groups` = `http-listen` over
+  `host/native-handler (host/make-app groups)`. `lib/host/serve.sh` boots the full
+  module set (mirrors conformance) and serves in the foreground (container-entry
+  shaped). **Verified live** on a host port: `/health` 200 JSON, `/feed` recent-
+  first seeded activities, `/feed?actor=` filtered, relations `get-children`/`get-
+  parents` real JSON, unknown→404. Demo run was a standalone `sx_server.exe`
+  process (NOT the docker stack) — killed by its own PID, never `pkill` (siblings
+  share the binary). The standing "live wiring is a hosts/ change" Blocker is
+  resolved for the SX side: the bridge is pure SX in `lib/host`; only the *launch*
+  (docker stack + Caddy) remains. NEXT: golden harness, internal-HMAC, then promote
+  into the stack behind a fresh subdomain.
+
 ## Blockers
 
 - **Live wiring to the native OCaml HTTP server** (Phase 3/4): the prod server in