homelab-frontend/tasks/7.3-workflow-prefix.md

# 7.3 — `/workflow/*` to Temporal (GREEN)

Phase: 7 — Additional capability prefixes
Stage: GREEN
Depends on: Phase 6 (cutover) — done, confirmed live in-cluster

Temporal runs in the `temporal` namespace. Temporal namespace registration is
automatic via queue-operator and is NEVER done manually — this route must not create,
register or mutate Temporal namespaces, only proxy to what queue-operator has already
provisioned.

- [ ] `/workflow/*` on `api.riotpiao.com` proxies to the Temporal Service in the `temporal` namespace
- [ ] Nothing in this route registers a Temporal namespace. Registration stays with queue-operator
- [ ] Path rewriting between the `/workflow` prefix and Temporal's own paths is explicit in configuration
- [ ] Timeouts and body caps are explicit, with no silent defaults (G6). Long-poll semantics are accounted for rather than truncated by a short read timeout
- [ ] The route requires authentication and the token is checked for workflow capability — a GPU token must not drive workflows
- [ ] The NetworkPolicy is extended to reach only Temporal
- [ ] Streaming or long-poll responses pass through unbuffered, and a client disconnect cancels the upstream call rather than orphaning it (G4)
- [ ] `/v1/*` behaviour is unchanged before and after
- [ ] Metrics and rejection counters cover this route with its own route label

## Verify

```bash
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
# expected: 401 without a token

curl -s -H "authorization: Bearer $WORKFLOW_TOKEN" https://api.riotpiao.com/workflow/health
# expected: Temporal's own response, proxied unmodified

kubectl -n temporal exec svc/temporal-admintools -- tctl --ad temporal-frontend:7233 namespace list | sort > /tmp/ns.after
diff /tmp/ns.before /tmp/ns.after
# expected: no diff — the gateway registered nothing; queue-operator remains the only registrar
```