feat(settings): CA generation from the UI; Routstr panel beside the API key

WebUI RULE (operator, 2026-08-14): never point users at a terminal. The
certificate section told users to run setup-node-ca.sh by hand — it now
has a Generate button backed by system.node-ca.generate, which runs the
idempotent script server-side (live-tested: generated and /ca.crt serves).
Routstr budget panel moves directly under the Claude API key card.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/api/rpc/assistant_chat.rs

@@ -344,6 +344,7 @@ impl RpcHandler {
             "content.indeehub-projects" => self.handle_content_indeehub_projects().await,
             "system.settings.get" => self.handle_system_settings_get(params).await,
             "system.settings.set" => self.handle_system_settings_set(params).await,
+            "system.node-ca.generate" => self.handle_system_node_ca_generate().await,
             "system.kiosk-display.get" => self.handle_system_kiosk_display_get().await,
             "system.kiosk-display.set" => self.handle_system_kiosk_display_set(params).await,
             "bitcoin.relay-update-settings" => {

core/archipelago/src/api/rpc/dispatcher.rs

@@ -503,6 +503,7 @@ impl RpcHandler {
             "ai.permissions.set" => self.handle_ai_permissions_set(params).await,
             "system.settings.get" => self.handle_system_settings_get(params).await,
             "system.settings.set" => self.handle_system_settings_set(params).await,
+            "system.node-ca.generate" => self.handle_system_node_ca_generate().await,
             "system.kiosk-display.get" => self.handle_system_kiosk_display_get().await,
             "system.kiosk-display.set" => self.handle_system_kiosk_display_set(params).await,
 

core/archipelago/src/api/rpc/system/handlers.rs

@@ -1248,6 +1248,30 @@ impl RpcHandler {
         }
     }
 
+    /// system.node-ca.generate — run the node's (idempotent) CA setup so the
+    /// dashboard can offer certificate generation as a button. WebUI rule:
+    /// users must never be pointed at a terminal; the script reuses an
+    /// existing CA and only reissues the leaf, so re-running is safe.
+    pub(in crate::api::rpc) async fn handle_system_node_ca_generate(
+        &self,
+    ) -> Result<serde_json::Value> {
+        let script = "/opt/archipelago/scripts/setup-node-ca.sh";
+        if tokio::fs::metadata(script).await.is_err() {
+            anyhow::bail!(
+                "The certificate setup script is not on this node yet — it arrives with the next update."
+            );
+        }
+        let status = host_sudo(&["/usr/bin/bash", script]).await?;
+        if !status.success() {
+            anyhow::bail!(
+                "Certificate generation failed (exit {:?}) — see the node log for detail",
+                status.code()
+            );
+        }
+        info!("Node CA generated/reissued via dashboard");
+        Ok(serde_json::json!({ "generated": true }))
+    }
+
     /// system.kiosk-display.get — Current kiosk display preset + whether this
     /// node has a kiosk at all (no kiosk unit -> the Settings section hides).
     pub(in crate::api::rpc) async fn handle_system_kiosk_display_get(

neode-ui/src/components/federation/NetworkMap3D.vue

@@ -702,11 +702,22 @@ function applyGraph() {
   const reqs = [...(props.requests ?? [])].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
   const reqRing = requestRingRadius(peerNodes.length)
   const seenReqs = new Set<string>()
+  // Requests are a call to action: cluster them tightly at one stage angle
+  // (instead of spread around the orbit, where they could sit BEHIND the
+  // globe — reading as a mis-scaled chart the user had to rotate by hand)
+  // and steer the camera to face them when a new one arrives.
+  const REQUEST_STAGE_ANGLE = 0.35
+  const reqSpacing = Math.min(0.5, (Math.PI * 0.9) / Math.max(reqs.length, 1))
+  let newRequestArrived = false
   reqs.forEach((req, i) => {
     seenReqs.add(req.id)
-    const slot = { angle: (i / reqs.length) * Math.PI * 2 + 0.35, ringRadius: reqRing }
+    const slot = {
+      angle: REQUEST_STAGE_ANGLE + (i - (reqs.length - 1) / 2) * reqSpacing,
+      ringRadius: reqRing,
+    }
     const existing = reqMap.get(req.id)
     if (!existing) {
+      newRequestArrived = true
       const vis = createRequest(req, slot)
       if (introPlayed) {
         if (staticMode) vis.p = 1
@@ -738,6 +749,20 @@ function applyGraph() {
   for (const [id, vis] of reqMap) {
     if (!seenReqs.has(id)) killRequest(vis)
   }
+  // Face the request cluster when a new one arrives. Depth for a node at
+  // world angle a is proportional to sin(a − rotY): front-center (nearest
+  // to the viewer, horizontally centred) is a − rotY = −π/2. Only on
+  // ARRIVAL, so a user who rotates away afterwards isn't fought.
+  if (newRequestArrived && introPlayed) {
+    const target = nearestAngle(cam.rotY, REQUEST_STAGE_ANGLE + Math.PI / 2)
+    for (const t of spinTween) t.kill()
+    if (staticMode && !tickerAttached) {
+      cam.rotY = target
+      render()
+    } else {
+      gsap.to(cam, { rotY: target, duration: 1.1, ease: motionTokens.ease.inOut, overwrite: 'auto' })
+    }
+  }
 
   // --- orbit guide rings ---
   const desiredRings: { radius: number; kind: 'peer' | 'request' }[] = []

neode-ui/src/views/settings/NodeCertificateSection.vue

@@ -26,7 +26,30 @@ async function computeFingerprint(pem: string): Promise<string> {
     .join(':')
 }
 
-onMounted(async () => {
+const generating = ref(false)
+const generateError = ref('')
+
+// WebUI rule: never point a user at a terminal — the backend runs the
+// (idempotent) CA setup script for us.
+async function generateCa() {
+  generating.value = true
+  generateError.value = ''
+  try {
+    const { rpcClient } = await import('@/api/rpc-client')
+    await rpcClient.call({ method: 'system.node-ca.generate', timeout: 60000 })
+    loading.value = true
+    await probe()
+    if (!caAvailable.value) {
+      generateError.value = 'Generation reported success but the certificate is not being served yet — try reloading in a few seconds.'
+    }
+  } catch (e: unknown) {
+    generateError.value = e instanceof Error ? e.message : 'Certificate generation failed'
+  } finally {
+    generating.value = false
+  }
+}
+
+async function probe() {
   try {
     const res = await fetch('/ca.crt', { cache: 'no-store' })
     if (!res.ok) throw new Error(`HTTP ${res.status}`)
@@ -48,7 +71,9 @@ onMounted(async () => {
   } finally {
     loading.value = false
   }
-})
+}
+
+onMounted(probe)
 </script>
 
 <template>
@@ -70,9 +95,13 @@ onMounted(async () => {
       v-else-if="!caAvailable"
       class="p-3 bg-white/5 border border-white/10 rounded-lg text-sm text-white/70"
     >
-      This node has not generated a certificate authority yet. Run
-      <code class="px-1 py-0.5 bg-black/30 rounded text-xs">scripts/setup-node-ca.sh</code>
-      on the node, then reload this page.
+      <p class="mb-3">This node has not generated its certificate yet.</p>
+      <button
+        :disabled="generating"
+        @click="generateCa"
+        class="px-4 py-2 glass-button rounded-lg text-sm font-semibold disabled:opacity-60"
+      >{{ generating ? 'Generating…' : 'Generate certificate' }}</button>
+      <p v-if="generateError" class="mt-2 text-xs text-orange-300/90">{{ generateError }}</p>
     </div>
 
     <div v-else class="space-y-4">

neode-ui/src/views/settings/RoutstrBudgetSection.vue

@@ -0,0 +1,112 @@
+<script setup lang="ts">
+import { ref, onMounted, computed } from 'vue'
+import { rpcClient } from '@/api/rpc-client'
+
+// Routstr prepaid budget (D-05): the assistant may only spend against an
+// operator-set sats ceiling. Zero allowance = Routstr never selected. This
+// panel is the ONLY UI for that ceiling; it fronts assistant.budget-get/set.
+const loaded = ref(false)
+const allowance = ref(0)
+const spent = ref(0)
+const remaining = ref(0)
+const draft = ref('')
+const applying = ref(false)
+const error = ref('')
+const savedTick = ref(false)
+
+const active = computed(() => allowance.value > 0)
+
+async function refresh() {
+  const res = await rpcClient.call<{ allowance_sats: number; spent_sats: number; remaining_sats: number }>({
+    method: 'assistant.budget-get',
+  })
+  allowance.value = res.allowance_sats
+  spent.value = res.spent_sats
+  remaining.value = res.remaining_sats
+  draft.value = String(res.allowance_sats)
+}
+
+onMounted(async () => {
+  try {
+    await refresh()
+    loaded.value = true
+  } catch { /* backend without the RPC — section hides */ }
+})
+
+async function apply() {
+  const parsed = Number(draft.value)
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    error.value = 'Enter a whole number of sats (0 disables Routstr).'
+    return
+  }
+  applying.value = true
+  error.value = ''
+  try {
+    await rpcClient.call({ method: 'assistant.budget-set', params: { allowance_sats: parsed } })
+    await refresh()
+    savedTick.value = true
+    setTimeout(() => { savedTick.value = false }, 2500)
+  } catch (e: unknown) {
+    error.value = e instanceof Error ? e.message : 'Failed to save budget'
+  } finally {
+    applying.value = false
+  }
+}
+</script>
+
+<template>
+  <div v-if="loaded" class="glass-card px-6 py-6 mb-6">
+    <div class="flex items-center gap-3 mb-2">
+      <h2 class="text-xl font-semibold text-white/96">Routstr AI Budget</h2>
+      <span
+        class="text-xs font-mono px-2 py-0.5 rounded"
+        :class="active ? 'bg-emerald-500/20 text-emerald-300' : 'bg-white/10 text-white/50'"
+      >{{ active ? 'enabled' : 'off' }}</span>
+    </div>
+    <p class="text-sm text-white/60 mb-5">
+      Routstr is pay-per-use AI inference, paid in sats over Cashu, used when your local
+      model can't take a request. It never spends without a prepaid ceiling you set here —
+      at <span class="font-mono">0</span> it is completely disabled. The assistant stops
+      when the ceiling is reached; raising it widens the remainder without erasing the
+      spend history.
+    </p>
+
+    <div class="grid grid-cols-3 gap-4 mb-5 text-center">
+      <div class="rounded-lg bg-white/5 py-3">
+        <div class="text-lg font-mono text-white/90">{{ allowance.toLocaleString() }}</div>
+        <div class="text-xs text-white/50 mt-1">Allowance (sats)</div>
+      </div>
+      <div class="rounded-lg bg-white/5 py-3">
+        <div class="text-lg font-mono text-white/90">{{ spent.toLocaleString() }}</div>
+        <div class="text-xs text-white/50 mt-1">Spent</div>
+      </div>
+      <div class="rounded-lg bg-white/5 py-3">
+        <div class="text-lg font-mono" :class="remaining > 0 ? 'text-emerald-300' : 'text-white/60'">{{ remaining.toLocaleString() }}</div>
+        <div class="text-xs text-white/50 mt-1">Remaining</div>
+      </div>
+    </div>
+
+    <div class="flex items-end gap-3">
+      <div class="flex-1 max-w-xs">
+        <label class="block text-sm text-white/60 mb-1" for="routstr-allowance">Set allowance (sats)</label>
+        <input
+          id="routstr-allowance"
+          v-model="draft"
+          type="number"
+          min="0"
+          step="1"
+          inputmode="numeric"
+          class="w-full bg-white/5 border border-white/10 rounded-lg px-4 py-2.5 text-sm text-white font-mono placeholder-white/30 focus:outline-none focus:border-white/30 transition-colors"
+          @keydown.enter="apply"
+        />
+      </div>
+      <button
+        :disabled="applying || draft === String(allowance)"
+        @click="apply"
+        class="px-4 py-2 glass-button rounded-lg text-sm font-medium disabled:opacity-50"
+      >{{ applying ? 'Saving…' : 'Save' }}</button>
+      <span v-if="savedTick" class="text-sm text-emerald-300 pb-2">Saved</span>
+    </div>
+    <div v-if="error" class="mt-3 alert-error text-sm">{{ error }}</div>
+  </div>
+</template>

neode-ui/src/views/settings/SystemSection.vue

@@ -3,6 +3,7 @@ import InterfaceModeSection from '@/views/settings/InterfaceModeSection.vue'
 import KioskDisplaySection from '@/views/settings/KioskDisplaySection.vue'
 import ClaudeAuthSection from '@/views/settings/ClaudeAuthSection.vue'
 import AIDataAccessSection from '@/views/settings/AIDataAccessSection.vue'
+import RoutstrBudgetSection from '@/views/settings/RoutstrBudgetSection.vue'
 import WebhookSection from '@/views/settings/WebhookSection.vue'
 import TelemetrySection from '@/views/settings/TelemetrySection.vue'
 import NodeCertificateSection from '@/views/settings/NodeCertificateSection.vue'
@@ -15,6 +16,7 @@ import SystemDangerZone from '@/views/settings/SystemDangerZone.vue'
   <InterfaceModeSection />
   <KioskDisplaySection />
   <ClaudeAuthSection />
+  <RoutstrBudgetSection />
   <AIDataAccessSection />
   <WebhookSection />
   <TelemetrySection />