feat(ai-workspace): add local relay profiles

infra/scripts/check-ai-workspace-topology.sh

@@ -90,40 +90,63 @@ bool_and() {
 }
 
 assistant_code=$(http_status "$ASSISTANT_URL/healthz")
-hub_body=$(http_body "$HUB_URL/healthz")
-hub_code=000
-if [ -n "$hub_body" ]; then
-  hub_code=$(http_status "$HUB_URL/healthz")
-fi
 gateway_code=$(http_status "$GATEWAY_URL/readyz")
 task_code=$(http_status "$TASK_URL")
 engine_code=$(http_status "$ENGINE_URL")
 
 assistant_ok=$(ok_status "$assistant_code")
-hub_ok=$(ok_status "$hub_code")
 gateway_ok=$(ok_status "$gateway_code")
 task_ok=$(ok_status "$task_code")
 engine_ok=$(ok_status "$engine_code")
 
-agents_online=$(printf "%s" "$hub_body" | json_number agentsOnline)
-case "$agents_online" in
-  ""|*[!0-9]*) agents_online=0 ;;
+profile=$(read_env "$PLATFORM_ENV" NODEDC_ENV || true)
+case "$profile" in
+  "") profile=local ;;
 esac
-
 hub_public=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_HUB_PUBLIC_URL || true)
 hub_internal=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_HUB_INTERNAL_URL || true)
 ops_entitlement=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_OPS_ENTITLEMENT_URL || true)
+action_relay_enabled=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ENABLED || true)
+action_relay_id=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ID || true)
+case "$action_relay_enabled" in
+  1|true|TRUE|yes|YES|on|ON) action_relay_enabled=true ;;
+  *) action_relay_enabled=false ;;
+esac
 
 hub_public_kind=$(url_kind "$hub_public")
 hub_internal_kind=$(url_kind "$hub_internal")
 ops_entitlement_kind=$(url_kind "$ops_entitlement")
 
-local_services_ok=$(bool_and "$(bool_and "$assistant_ok" "$hub_ok")" "$(bool_and "$gateway_ok" "$task_ok")")
+local_hub_body=$(http_body "$HUB_URL/healthz")
+local_hub_code=000
+if [ -n "$local_hub_body" ]; then
+  local_hub_code=$(http_status "$HUB_URL/healthz")
+fi
+local_hub_ok=$(ok_status "$local_hub_code")
+
+relay_health_code=000
+relay_health_ok=false
+if [ -n "$hub_internal" ]; then
+  relay_health_code=$(http_status "$(printf "%s" "$hub_internal" | sed 's#/*$##')/healthz")
+  relay_health_ok=$(ok_status "$relay_health_code")
+fi
+
+agents_online=$(printf "%s" "$local_hub_body" | json_number agentsOnline)
+case "$agents_online" in
+  ""|*[!0-9]*) agents_online=0 ;;
+esac
+
+local_services_ok=$(bool_and "$assistant_ok" "$(bool_and "$gateway_ok" "$task_ok")")
 worker_on_local_hub=false
 if [ "$agents_online" -gt 0 ]; then
   worker_on_local_hub=true
 fi
 
+action_relay_configured=false
+if [ "$action_relay_enabled" = true ] && [ -n "$action_relay_id" ]; then
+  action_relay_configured=true
+fi
+
 hub_runtime_kind=custom
 case "$hub_public_kind:$hub_internal_kind" in
   local:local|local:missing|missing:local) hub_runtime_kind=local ;;
@@ -135,6 +158,10 @@ esac
 classification=contract-only
 if [ "$local_services_ok" = true ]; then
   if [ "$engine_ok" = true ] \
+    && [ "$action_relay_configured" = true ] \
+    && [ "$hub_runtime_kind" = prod-public ]; then
+    classification=local-remote-worker-relay
+  elif [ "$engine_ok" = true ] \
     && [ "$worker_on_local_hub" = true ] \
     && [ "$ops_entitlement_kind" = local ] \
     && [ "$hub_runtime_kind" = local ]; then
@@ -156,9 +183,11 @@ fi
 
 cat <<EOF
 classification=$classification
+profile=$profile
 platform_env=$PLATFORM_ENV
 assistant_health=$assistant_ok status=$assistant_code url=$ASSISTANT_URL/healthz
-hub_health=$hub_ok status=$hub_code url=$HUB_URL/healthz agents_online=$agents_online
+local_hub_health=$local_hub_ok status=$local_hub_code url=$HUB_URL/healthz agents_online=$agents_online
+relay_health=$relay_health_ok status=$relay_health_code url=${hub_internal%/}/healthz
 gateway_health=$gateway_ok status=$gateway_code url=$GATEWAY_URL/readyz
 task_health=$task_ok status=$task_code url=$TASK_URL
 engine_health=$engine_ok status=$engine_code url=$ENGINE_URL
@@ -166,14 +195,20 @@ hub_public_kind=$hub_public_kind
 hub_internal_kind=$hub_internal_kind
 hub_runtime_kind=$hub_runtime_kind
 ops_entitlement_kind=$ops_entitlement_kind
+assistant_action_relay_enabled=${action_relay_enabled:-missing}
+assistant_action_relay_id=${action_relay_id:-missing}
+assistant_action_relay_configured=$action_relay_configured
 EOF
 
 case "$classification" in
   true-local-e2e|tunnel-local-e2e)
     echo "meaning=local write-path e2e can be interpreted if the worker can reach returned MCP URLs"
     ;;
+  local-remote-worker-relay)
+    echo "meaning=local apps are the downstream target; deployed AI Hub is used only as remote worker relay and assistant actions route back to local Assistant"
+    ;;
   hybrid-prod-bridge)
-    echo "meaning=do not treat UI dialog as local write-path proof; worker/HUB/MCP topology is mixed"
+    echo "meaning=do not treat UI dialog as local write-path proof; topology is mixed or assistant action relay is not configured"
     ;;
   local-ops-vertical)
     echo "meaning=Gateway and Tasker local vertical checks are valid, but no live Codex worker e2e is proven"
@@ -192,3 +227,10 @@ if [ "${REQUIRE_TRUE_E2E:-0}" = "1" ]; then
     *) exit 2 ;;
   esac
 fi
+
+if [ "${REQUIRE_LOCAL_REMOTE_WORKER_RELAY:-0}" = "1" ]; then
+  case "$classification" in
+    local-remote-worker-relay) exit 0 ;;
+    *) exit 2 ;;
+  esac
+fi