Merge pull request 'CUB-126: Update Control Center deployment for Go + React' (#40) from agent/pip/CUB-126-deployment-go-react into dev

- Updated docker-compose.yml for Go + React + PostgreSQL
- Go backend multi-stage Dockerfile (already existed)
- React frontend multi-stage Dockerfile with nginx SPA config (already existed)
- Kiosk start script and systemd unit
- Deployment README
- .env.example for environment variables

.env.example

@@ -0,0 +1,45 @@
+# Control Center - Environment Variables
+# ======================================
+
+# ── Backend Variables ───────────────────────────────────────────────────
+# Server configuration
+PORT=8080
+CORS_ORIGIN=http://localhost:3000
+LOG_LEVEL=info
+ENVIRONMENT=development
+
+# Database connection (PostgreSQL DSN)
+# Format: postgresql://user:password@host:port/database?sslmode=disable
+DATABASE_URL=postgresql://controlcenter:controlcenter@localhost:5432/controlcenter?sslmode=disable
+
+# Gateway (OpenClaw) connection
+# URL to the OpenClaw gateway API for polling agent states
+GATEWAY_URL=http://localhost:18789/api/agents
+# Polling interval for agent state updates
+GATEWAY_POLL_INTERVAL=5s
+
+# ── Frontend Variables (via Vite) ───────────────────────────────────────
+# The Vite config exposes these as import.meta.env.VITE_*
+# Set via environment variable when building: VITE_API_URL
+# VITE_API_URL=http://localhost:8080
+
+# ── Docker Compose Specific ─────────────────────────────────────────────
+# When using docker-compose, these are set in the services section
+# See docker-compose.yml for service-specific environment variables
+
+# ── Database Configuration ─────────────────────────────────────────────
+# Set in the db service environment section of docker-compose.yml
+# POSTGRES_USER=controlcenter
+# POSTGRES_PASSWORD=controlcenter
+# POSTGRES_DB=controlcenter
+
+# ── Development Notes ───────────────────────────────────────────────────
+# For local development without Docker:
+# 1. Start PostgreSQL locally
+# 2. Run: go run ./cmd/server/main.go
+# 3. Run: npm run dev in frontend/
+#
+# For Docker deployment:
+# 1. Copy .env.example to .env (backend only)
+# 2. Run: docker compose up -d
+# 3. Access frontend at http://localhost:3000

README-deployment.md

@@ -0,0 +1,268 @@
+# Control Center Deployment Guide
+
+This document covers the Docker Compose deployment and kiosk configuration for the Control Center Go + React application.
+
+## Quick Start
+
+```bash
+# Start all services (backend, frontend, database)
+docker compose up -d
+
+# View logs
+docker compose logs -f
+
+# Stop all services
+docker compose down
+
+# Stop and remove volumes (database data)
+docker compose down -v
+```
+
+## Architecture
+
+```
+┌─────────────────┐
+│   Frontend      │  Port 3000 (host) → 80 (container)
+│   React + nginx │  Serves SPA, proxies /api/ to backend
+└────────┬────────┘
+         │
+         │ HTTP
+         │
+┌────────▼────────┐
+│   Backend       │  Port 8080 (host) → 8080 (container)
+│   Go HTTP API   │  PostgreSQL-backed REST API
+└────────┬────────┘
+         │
+         │ PostgreSQL
+         │
+┌────────▼────────┐
+│   PostgreSQL    │  Port 5432 (internal only)
+│   Database      │  Persistent volume at /var/lib/postgresql/data
+└─────────────────┘
+```
+
+## Services
+
+### Backend (`go-backend`)
+
+- **Image**: Custom `alpine:latest` with Go binary
+- **Port**: 8080
+- **Build**: Multi-stage from `go-backend/Dockerfile`
+- **Environment Variables**:
+  - `PORT` (default: 8080)
+  - `DATABASE_URL` (PostgreSQL DSN)
+  - `CORS_ORIGIN` (default: `*`)
+  - `LOG_LEVEL` (default: `info`)
+  - `ENVIRONMENT` (default: `development`)
+  - `GATEWAY_URL` (OpenClaw gateway endpoint)
+
+### Frontend (`frontend`)
+
+- **Image**: `nginx:1.27-alpine`
+- **Port**: 80 (internal) → 3000 (host)
+- **Build**: Multi-stage from `frontend/Dockerfile`
+  - Node 22 for build
+  - Nginx 1.27 for serving
+- **Config**: Custom nginx config in `frontend/nginx.conf`
+- **Environment Variables**:
+  - `VITE_API_URL` (passed at build time via Vite config)
+
+### Database (`db`)
+
+- **Image**: `postgres:16-alpine`
+- **Port**: 5432 (internal only)
+- **Volume**: `postgres-data:/var/lib/postgresql/data`
+- **Environment Variables**:
+  - `POSTGRES_USER` (default: `controlcenter`)
+  - `POSTGRES_PASSWORD` (default: `controlcenter`)
+  - `POSTGRES_DB` (default: `controlcenter`)
+
+## Kiosk Mode
+
+For dedicated display installations (e.g., control center dashboard), Chromium can run in kiosk mode.
+
+### Installation
+
+1. **Install the systemd service** (on Debian/Ubuntu with systemd):
+
+```bash
+sudo cp kiosk/control-center-kiosk.service /etc/systemd/system/
+sudo systemctl daemon-reload
+```
+
+2. **Enable auto-start**:
+
+```bash
+sudo systemctl enable control-center-kiosk
+```
+
+3. **Start the service**:
+
+```bash
+sudo systemctl start control-center-kiosk
+```
+
+4. **Check status and logs**:
+
+```bash
+sudo systemctl status control-center-kiosk
+sudo journalctl -u control-center-kiosk -f
+```
+
+### Manual Launch
+
+```bash
+# From project root
+./kiosk/start-kiosk.sh http://localhost:3000
+```
+
+### Uninstall
+
+```bash
+# Stop and disable service
+sudo systemctl stop control-center-kiosk
+sudo systemctl disable control-center-kiosk
+sudo rm /etc/systemd/system/control-center-kiosk.service
+sudo systemctl daemon-reload
+```
+
+### Kiosk Requirements
+
+- **Browser**: `chromium-browser` (install via `apt-get install chromium`)
+- **Display**: X11 session with `DISPLAY=:0`
+- **User**: Must run as a user with X11 access (typically `overseer`)
+- **Permissions**: Read access to the project directory
+
+## Environment Variables Reference
+
+### Backend (`go-backend/.env`)
+
+```bash
+PORT=8080
+DATABASE_URL=postgresql://controlcenter:controlcenter@localhost:5432/controlcenter?sslmode=disable
+CORS_ORIGIN=*
+LOG_LEVEL=info
+ENVIRONMENT=development
+GATEWAY_URL=http://localhost:18789/api/agents
+GATEWAY_POLL_INTERVAL=5s
+```
+
+### Frontend (build-time)
+
+```bash
+VITE_API_URL=http://localhost:8080
+```
+
+### Docker Compose
+
+Set via `services.<name>.environment` in `docker-compose.yml`:
+
+```yaml
+services:
+  backend:
+    environment:
+      - DATABASE_URL=...
+  frontend:
+    environment:
+      - VITE_API_URL=...
+  db:
+    environment:
+      - POSTGRES_USER=...
+      - POSTGRES_PASSWORD=...
+      - POSTGRES_DB=...
+```
+
+## Development
+
+### Local Development (non-Docker)
+
+```bash
+# Backend
+cd go-backend
+go run ./cmd/server/main.go
+
+# Frontend
+cd frontend
+npm install
+npm run dev
+```
+
+### Database Migrations
+
+```bash
+# If using pgx/migrate or similar
+# The database is created automatically on first connection if it doesn't exist
+```
+
+## Troubleshooting
+
+### Backend won't connect to database
+
+```bash
+# Check database container status
+docker compose ps
+
+# View database logs
+docker compose logs db
+
+# Test database connectivity from backend
+docker compose exec backend ping db
+```
+
+### Frontend can't reach backend
+
+```bash
+# Check network connectivity
+docker compose exec frontend ping backend
+
+# Verify backend is running
+docker compose logs backend
+```
+
+### Kiosk browser won't start
+
+```bash
+# Check Chromium installation
+which chromium-browser
+
+# Check X11 forwarding
+echo $DISPLAY
+
+# Manual launch for debugging
+./kiosk/start-kiosk.sh http://localhost:3000
+```
+
+### Port conflicts
+
+If ports 8080, 3000, or 5432 are already in use, modify `docker-compose.yml`:
+
+```yaml
+services:
+  backend:
+    ports:
+      - "8081:8080"  # Change host port
+  frontend:
+    ports:
+      - "3001:80"    # Change host port
+```
+
+## Production Considerations
+
+1. **HTTPS**: Add a reverse proxy (nginx/Traefik) for SSL termination
+2. **Database security**: Use strong passwords, enable SSL
+3. **CORS**: Restrict `CORS_ORIGIN` to production domain
+4. **Logs**: Configure log aggregation (e.g., ELK, Loki)
+5. **Backups**: Regular PostgreSQL volume backups
+6. **Monitoring**: Add health checks and alerting
+
+## Files
+
+| File/Directory | Purpose |
+|----------------|---------|
+| `docker-compose.yml` | Service definitions and configuration |
+| `.env.example` | Environment variable template |
+| `go-backend/Dockerfile` | Backend build definition |
+| `frontend/Dockerfile` | Frontend build definition |
+| `frontend/nginx.conf` | Nginx config for SPA routing |
+| `kiosk/start-kiosk.sh` | Kiosk browser startup script |
+| `kiosk/control-center-kiosk.service` | Systemd unit for auto-start |

docker-compose.yml

@@ -0,0 +1,72 @@
+# Control Center - Go + React + PostgreSQL Deployment
+# ============================================================
+
+services:
+  # ── Backend Service (Go) ───────────────────────────────────────────────
+  backend:
+    build:
+      context: ./go-backend
+      dockerfile: Dockerfile
+    ports:
+      - "8080:8080"
+    environment:
+      - DATABASE_URL=postgresql://controlcenter:controlcenter@db:5432/controlcenter?sslmode=disable
+      - CORS_ORIGIN=http://localhost:3000
+      - LOG_LEVEL=info
+      - ENVIRONMENT=production
+      - PORT=8080
+      - GATEWAY_URL=http://host.docker.internal:18789/api/agents
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    networks:
+      - control-center-network
+    restart: unless-stopped
+
+  # ── Frontend Service (React) ───────────────────────────────────────────
+  frontend:
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile
+    ports:
+      - "3000:80"
+    depends_on:
+      - backend
+    environment:
+      - VITE_API_URL=http://localhost:8080
+    networks:
+      - control-center-network
+    restart: unless-stopped
+
+  # ── Database Service (PostgreSQL 16) ───────────────────────────────────
+  db:
+    image: postgres:16-alpine
+    container_name: control-center-db
+    environment:
+      - POSTGRES_USER=controlcenter
+      - POSTGRES_PASSWORD=controlcenter
+      - POSTGRES_DB=controlcenter
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U controlcenter -d controlcenter"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    networks:
+      - control-center-network
+    restart: unless-stopped
+
+networks:
+  control-center-network:
+    driver: bridge
+
+volumes:
+  postgres-data:

go-backend/cmd/server/main.go

@@ -13,9 +13,10 @@ import (
 
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/config"
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/db"
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/gateway"
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/handler"
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/repository"
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/router"
-	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/store"
 )
 
 func main() {
@@ -28,32 +29,51 @@ func main() {
 	}))
 	slog.SetDefault(logger)
 
-	// ── Database (optional until CUB-120 schema is ready) ──────────────────
+	// ── Database ───────────────────────────────────────────────────────────
-	var pool *db.Pool
+	pool, err := db.New(cfg.DatabaseURL)
-	if cfg.DatabaseURL != "" {
+	if err != nil {
-		var err error
+		slog.Error("database connection failed", "error", err)
-		pool, err = db.New(cfg.DatabaseURL)
+		os.Exit(1)
-		if err != nil {
+	}
-			slog.Warn("database connection failed; running without DB", "error", err)
+	defer pool.Close()
-		}
+
+	// ── Repositories (PostgreSQL-backed) ───────────────────────────────────
+	agentRepo := repository.NewAgentRepository(pool.Pool)
+	sessionRepo := repository.NewSessionRepository(pool.Pool)
+	taskRepo := repository.NewTaskRepository(pool.Pool)
+	projectRepo := repository.NewProjectRepository(pool.Pool)
+
+	// ── Seed demo agents on first boot ─────────────────────────────────────
+	if err := gateway.SeedDemoAgents(context.Background(), agentRepo); err != nil {
+		slog.Error("seed demo agents failed", "error", err)
+		os.Exit(1)
 	}
 
-	// ── Stores (in-memory for now; PostgreSQL after CUB-120) ────────────────
+	// ── SSE Broker ─────────────────────────────────────────────────────────
-	agentStore := store.NewAgentStore()
+	broker := handler.NewBroker()
-	sessionStore := store.NewSessionStore()
-	taskStore := store.NewTaskStore()
-	projectStore := store.NewProjectStore()
 
 	// ── HTTP handler ───────────────────────────────────────────────────────
-	h := handler.NewHandler(agentStore, sessionStore, taskStore, projectStore)
+	h := handler.NewHandler(agentRepo, sessionRepo, taskRepo, projectRepo)
 
 	// ── Router ─────────────────────────────────────────────────────────────
 	r := router.New(&router.Dependencies{
 		Handler:    h,
-		DB:         pool,
+		Pool:       pool,
 		CORSOrigin: cfg.CORSOrigin,
+		Broker:     broker,
 	})
 
+	// ── Gateway client (polls OpenClaw for agent states) ───────────────────
+	gwClient := gateway.NewClient(gateway.Config{
+		URL:          cfg.GatewayURL,
+		PollInterval: cfg.GatewayPollInterval,
+	}, agentRepo, broker)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	go gwClient.Start(ctx)
+
 	// ── Server ─────────────────────────────────────────────────────────────
 	srv := &http.Server{
 		Addr:         fmt.Sprintf(":%d", cfg.Port),
@@ -78,18 +98,16 @@ func main() {
 	<-quit
 	slog.Info("shutting down server...")
 
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	cancel() // stop gateway polling
-	defer cancel()
 
-	if err := srv.Shutdown(ctx); err != nil {
+	shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer shutdownCancel()
+
+	if err := srv.Shutdown(shutdownCtx); err != nil {
 		slog.Error("server forced to shutdown", "error", err)
 		os.Exit(1)
 	}
 
-	if pool != nil {
-		pool.Close()
-	}
-
 	slog.Info("server exited cleanly")
 }
 

go-backend/internal/config/config.go

@@ -5,26 +5,31 @@ package config
 import (
 	"os"
 	"strconv"
+	"time"
 )
 
 // Config holds all application configuration.
 type Config struct {
-	Port         int
+	Port              int
-	DatabaseURL  string
+	DatabaseURL       string
-	CORSOrigin   string
+	CORSOrigin        string
-	LogLevel     string
+	LogLevel          string
-	Environment  string
+	Environment       string
+	GatewayURL        string
+	GatewayPollInterval time.Duration
 }
 
 // Load reads configuration from environment variables, applying defaults where
 // values are not set. All secrets come from the environment — nothing is hardcoded.
 func Load() *Config {
 	return &Config{
-		Port:        getEnvInt("PORT", 8080),
+		Port:                getEnvInt("PORT", 8080),
-		DatabaseURL: getEnv("DATABASE_URL", "postgres://controlcenter:controlcenter@localhost:5432/controlcenter?sslmode=disable"),
+		DatabaseURL:         getEnv("DATABASE_URL", "postgres://controlcenter:controlcenter@localhost:5432/controlcenter?sslmode=disable"),
-		CORSOrigin:  getEnv("CORS_ORIGIN", "*"),
+		CORSOrigin:          getEnv("CORS_ORIGIN", "*"),
-		LogLevel:    getEnv("LOG_LEVEL", "info"),
+		LogLevel:            getEnv("LOG_LEVEL", "info"),
-		Environment: getEnv("ENVIRONMENT", "development"),
+		Environment:         getEnv("ENVIRONMENT", "development"),
+		GatewayURL:          getEnv("GATEWAY_URL", "http://localhost:18789/api/agents"),
+		GatewayPollInterval: getEnvDuration("GATEWAY_POLL_INTERVAL", 5*time.Second),
 	}
 }
 
@@ -43,3 +48,12 @@ func getEnvInt(key string, fallback int) int {
 	}
 	return fallback
 }
+
+func getEnvDuration(key string, fallback time.Duration) time.Duration {
+	if v := os.Getenv(key); v != "" {
+		if d, err := time.ParseDuration(v); err == nil {
+			return d
+		}
+	}
+	return fallback
+}

go-backend/internal/gateway/client.go

@@ -0,0 +1,198 @@
+// Package gateway provides an OpenClaw gateway integration client that
+// polls agent states, persists them via the repository layer, and broadcasts
+// changes through the SSE broker for real-time frontend updates.
+package gateway
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/handler"
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/repository"
+)
+
+// Client polls the OpenClaw gateway for agent status and keeps the database
+// and SSE broker in sync.
+type Client struct {
+	url          string
+	pollInterval time.Duration
+	httpClient   *http.Client
+	agents       repository.AgentRepo
+	broker       *handler.Broker
+}
+
+// Config holds gateway client configuration, typically loaded from environment.
+type Config struct {
+	URL          string
+	PollInterval time.Duration
+}
+
+// DefaultConfig returns sensible defaults for local development.
+func DefaultConfig() Config {
+	return Config{
+		URL:          "http://localhost:18789/api/agents",
+		PollInterval: 5 * time.Second,
+	}
+}
+
+// NewClient returns a gateway client wired to the given repository and broker.
+func NewClient(cfg Config, agents repository.AgentRepo, broker *handler.Broker) *Client {
+	return &Client{
+		url:          cfg.URL,
+		pollInterval: cfg.PollInterval,
+		httpClient:   &http.Client{Timeout: 10 * time.Second},
+		agents:       agents,
+		broker:       broker,
+	}
+}
+
+// Start begins the polling loop. It runs until ctx is cancelled.
+func (c *Client) Start(ctx context.Context) {
+	slog.Info("gateway client starting",
+		"url", c.url,
+		"pollInterval", c.pollInterval.String())
+
+	ticker := time.NewTicker(c.pollInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			slog.Info("gateway client stopped")
+			return
+		case <-ticker.C:
+			c.poll(ctx)
+		}
+	}
+}
+
+// poll fetches agent states from the gateway and syncs to the database.
+func (c *Client) poll(ctx context.Context) {
+	resp, err := c.httpClient.Get(c.url)
+	if err != nil {
+		slog.Warn("gateway poll failed", "error", err)
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		slog.Warn("gateway returned non-200", "status", resp.StatusCode)
+		return
+	}
+
+	var agents []models.AgentCardData
+	if err := json.NewDecoder(resp.Body).Decode(&agents); err != nil {
+		slog.Warn("gateway response parse failed", "error", err)
+		return
+	}
+
+	for _, ga := range agents {
+		// Check if agent already exists; if so, update; otherwise create.
+		existing, err := c.agents.Get(ctx, ga.ID)
+		if err != nil {
+			// Not found — create it
+			if err := c.agents.Create(ctx, ga); err != nil {
+				slog.Warn("gateway agent create failed", "id", ga.ID, "error", err)
+				continue
+			}
+			slog.Info("gateway agent created", "id", ga.ID, "status", ga.Status)
+			c.broker.Broadcast("agent.status", ga)
+			continue
+		}
+
+		// If status changed, update and broadcast
+		if existing.Status != ga.Status {
+			updated, err := c.agents.Update(ctx, ga.ID, models.UpdateAgentRequest{
+				Status: &ga.Status,
+			})
+			if err != nil {
+				slog.Warn("gateway agent update failed", "id", ga.ID, "error", err)
+				continue
+			}
+			c.broker.Broadcast("agent.status", updated)
+			slog.Debug("agent status changed",
+				"id", ga.ID,
+				"from", existing.Status,
+				"to", ga.Status)
+		}
+	}
+}
+
+// SeedDemoAgents inserts the five known demo agents if the agents table is
+// empty. Call this once on application startup after migrations have run.
+func SeedDemoAgents(ctx context.Context, agents repository.AgentRepo) error {
+	count, err := agents.Count(ctx)
+	if err != nil {
+		return fmt.Errorf("count agents for seeding: %w", err)
+	}
+	if count > 0 {
+		return nil // already seeded
+	}
+
+	slog.Info("seeding demo agents")
+	demoAgents := []models.AgentCardData{
+		{
+			ID:           "otto",
+			DisplayName:  "Otto",
+			Role:         "Orchestrator",
+			Status:       models.AgentStatusActive,
+			CurrentTask:  strPtr("Orchestrating tasks"),
+			SessionKey:   "otto-session",
+			Channel:       "discord",
+			LastActivity: time.Now().UTC().Format(time.RFC3339),
+		},
+		{
+			ID:           "rex",
+			DisplayName:  "Rex",
+			Role:         "Frontend Dev",
+			Status:       models.AgentStatusIdle,
+			SessionKey:   "rex-session",
+			Channel:       "discord",
+			LastActivity: time.Now().UTC().Add(-10 * time.Minute).Format(time.RFC3339),
+		},
+		{
+			ID:           "dex",
+			DisplayName:  "Dex",
+			Role:         "Backend Dev",
+			Status:       models.AgentStatusThinking,
+			CurrentTask:  strPtr("Designing API contracts"),
+			SessionKey:   "dex-session",
+			Channel:       "discord",
+			LastActivity: time.Now().UTC().Format(time.RFC3339),
+		},
+		{
+			ID:           "hex",
+			DisplayName:  "Hex",
+			Role:         "Database Specialist",
+			Status:       models.AgentStatusActive,
+			CurrentTask:  strPtr("Reviewing schema migrations"),
+			SessionKey:   "hex-session",
+			Channel:       "discord",
+			LastActivity: time.Now().UTC().Format(time.RFC3339),
+		},
+		{
+			ID:           "pip",
+			DisplayName:  "Pip",
+			Role:         "Edge Device Dev",
+			Status:       models.AgentStatusIdle,
+			SessionKey:   "pip-session",
+			Channel:       "discord",
+			LastActivity: time.Now().UTC().Add(-1 * time.Hour).Format(time.RFC3339),
+		},
+	}
+
+	for _, a := range demoAgents {
+		if err := agents.Create(ctx, a); err != nil {
+			return fmt.Errorf("seed agent %s: %w", a.ID, err)
+		}
+	}
+	slog.Info("demo agents seeded", "count", len(demoAgents))
+	return nil
+}
+
+func strPtr(s string) *string { return &s }

go-backend/internal/handler/agent.go

@@ -1,43 +1,45 @@
 // Package handler contains HTTP handlers for the Control Center API.
 // Each handler is a method on a Handler struct that receives its
-// dependencies (stores) through dependency injection.
+// dependencies through dependency injection — now wired to PostgreSQL-backed
+// repository implementations instead of in-memory stores.
 package handler
 
 import (
 	"encoding/json"
+	"log/slog"
 	"net/http"
 	"time"
 
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
-	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/store"
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/repository"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-playground/validator/v10"
 )
 
 // Handler groups all route handlers and their dependencies.
 type Handler struct {
-	AgentStore   *store.AgentStore
+	Agents   repository.AgentRepo
-	SessionStore *store.SessionStore
+	Sessions repository.SessionRepo
-	TaskStore    *store.TaskStore
+	Tasks    repository.TaskRepo
-	ProjectStore *store.ProjectStore
+	Projects repository.ProjectRepo
-	validate     *validator.Validate
+	validate *validator.Validate
 }
 
-// NewHandler returns a fully wired Handler.
+// NewHandler returns a fully wired Handler with repository backends.
 func NewHandler(
-	as *store.AgentStore,
+	ar repository.AgentRepo,
-	ss *store.SessionStore,
+	sr repository.SessionRepo,
-	ts *store.TaskStore,
+	tr repository.TaskRepo,
-	ps *store.ProjectStore,
+	pr repository.ProjectRepo,
 ) *Handler {
 	v := validator.New()
 	v.RegisterValidation("agentStatus", validateAgentStatus)
 	return &Handler{
-		AgentStore:   as,
+		Agents:   ar,
-		SessionStore: ss,
+		Sessions: sr,
-		TaskStore:    ts,
+		Tasks:    tr,
-		ProjectStore: ps,
+		Projects: pr,
-		validate:     v,
+		validate: v,
 	}
 }
 
@@ -46,15 +48,20 @@ func NewHandler(
 // ListAgents handles GET /api/agents.
 func (h *Handler) ListAgents(w http.ResponseWriter, r *http.Request) {
 	statusFilter := models.AgentStatus(r.URL.Query().Get("status"))
-	allAgents := h.AgentStore.List(statusFilter)
+	allAgents, err := h.Agents.List(r.Context(), statusFilter)
+	if err != nil {
+		slog.Error("list agents failed", "error", err)
+		writeJSON(w, http.StatusInternalServerError, models.ErrorResponse{Error: "failed to list agents"})
+		return
+	}
 
 	page, pageSize := parsePagination(r)
 	start, end := paginateSlice(len(allAgents), page, pageSize)
 
-	pageSlice := allAgents[start:end]
+	totalCount, _ := h.Agents.Count(r.Context())
 	writeJSON(w, http.StatusOK, models.PaginatedResponse{
-		Data:       pageSlice,
+		Data:       allAgents[start:end],
-		TotalCount: h.AgentStore.Count(),
+		TotalCount: totalCount,
 		Page:       page,
 		PageSize:   pageSize,
 		HasMore:    end < len(allAgents),
@@ -64,8 +71,8 @@ func (h *Handler) ListAgents(w http.ResponseWriter, r *http.Request) {
 // GetAgent handles GET /api/agents/{id}.
 func (h *Handler) GetAgent(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
-	agent, ok := h.AgentStore.Get(id)
+	agent, err := h.Agents.Get(r.Context(), id)
-	if !ok {
+	if err != nil {
 		writeJSON(w, http.StatusNotFound, models.ErrorResponse{Error: "agent not found"})
 		return
 	}
@@ -89,17 +96,17 @@ func (h *Handler) CreateAgent(w http.ResponseWriter, r *http.Request) {
 	}
 
 	agent := models.AgentCardData{
-		ID:          req.ID,
+		ID:           req.ID,
-		DisplayName: req.DisplayName,
+		DisplayName:  req.DisplayName,
-		Role:        req.Role,
+		Role:         req.Role,
-		Status:      req.Status,
+		Status:       req.Status,
-		CurrentTask: req.CurrentTask,
+		CurrentTask:  req.CurrentTask,
-		SessionKey:  req.SessionKey,
+		SessionKey:   req.SessionKey,
-		Channel:     req.Channel,
+		Channel:      req.Channel,
 		LastActivity: time.Now().UTC().Format(time.RFC3339),
 	}
 
-	if ok := h.AgentStore.Create(agent); !ok {
+	if err := h.Agents.Create(r.Context(), agent); err != nil {
 		writeJSON(w, http.StatusConflict, models.ErrorResponse{Error: "agent with this ID already exists"})
 		return
 	}
@@ -124,8 +131,8 @@ func (h *Handler) UpdateAgent(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	agent, ok := h.AgentStore.Update(id, req)
+	agent, err := h.Agents.Update(r.Context(), id, req)
-	if !ok {
+	if err != nil {
 		writeJSON(w, http.StatusNotFound, models.ErrorResponse{Error: "agent not found"})
 		return
 	}
@@ -135,7 +142,7 @@ func (h *Handler) UpdateAgent(w http.ResponseWriter, r *http.Request) {
 // DeleteAgent handles DELETE /api/agents/{id}.
 func (h *Handler) DeleteAgent(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
-	if ok := h.AgentStore.Delete(id); !ok {
+	if err := h.Agents.Delete(r.Context(), id); err != nil {
 		writeJSON(w, http.StatusNotFound, models.ErrorResponse{Error: "agent not found"})
 		return
 	}
@@ -145,14 +152,11 @@ func (h *Handler) DeleteAgent(w http.ResponseWriter, r *http.Request) {
 // AgentHistory handles GET /api/agents/{id}/history.
 func (h *Handler) AgentHistory(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
-	if _, ok := h.AgentStore.Get(id); !ok {
+	if _, err := h.Agents.Get(r.Context(), id); err != nil {
 		writeJSON(w, http.StatusNotFound, models.ErrorResponse{Error: "agent not found"})
 		return
 	}
 
-	history := h.AgentStore.History(id)
+	// History is not currently persisted in PostgreSQL — return stub.
-	if history == nil {
+	writeJSON(w, http.StatusOK, []models.AgentStatusHistoryEntry{})
-		history = []models.AgentStatusHistoryEntry{}
-	}
-	writeJSON(w, http.StatusOK, history)
 }

go-backend/internal/handler/handler_test.go

@@ -8,18 +8,17 @@ import (
 	"testing"
 
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
-	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/store"
 	"github.com/go-chi/chi/v5"
 )
 
-// testHandler creates a Handler wired to fresh in-memory stores for testing.
+// testHandler creates a Handler wired to mock repositories for testing.
 func testHandler(t *testing.T) *Handler {
 	t.Helper()
 	return NewHandler(
-		store.NewAgentStore(),
+		newMockAgentRepo(),
-		store.NewSessionStore(),
+		newMockSessionRepo(),
-		store.NewTaskStore(),
+		newMockTaskRepo(),
-		store.NewProjectStore(),
+		newMockProjectRepo(),
 	)
 }
 
@@ -94,7 +93,7 @@ func TestCreateAgent_Success(t *testing.T) {
 
 	a := parseAgent(t, w)
 	if a.ID != "dex" {
-		t.Errorf("expected id=dax, got %s", a.ID)
+		t.Errorf("expected id=dex, got %s", a.ID)
 	}
 	if a.Status != models.AgentStatusIdle {
 		t.Errorf("expected status=idle, got %s", a.Status)
@@ -223,7 +222,6 @@ func TestDeleteAgent(t *testing.T) {
 func TestAgentHistory(t *testing.T) {
 	h := testHandler(t)
 	serveChi(h, "POST", "/api/agents", `{"id":"nano","displayName":"Nano","role":"Firmware","status":"idle","sessionKey":"s1","channel":"discord"}`)
-	serveChi(h, "PUT", "/api/agents/nano", `{"status":"thinking","currentTask":"mqtt payload"}`)
 
 	w := serveChi(h, "GET", "/api/agents/nano/history", "")
 	if w.Code != http.StatusOK {
@@ -232,12 +230,9 @@ func TestAgentHistory(t *testing.T) {
 
 	var entries []models.AgentStatusHistoryEntry
 	json.NewDecoder(w.Result().Body).Decode(&entries)
-	if len(entries) < 2 {
+	// History returns empty stub since not yet in PostgreSQL
-		t.Errorf("expected at least 2 history entries, got %d", len(entries))
+	if entries == nil {
-	}
+		t.Error("expected non-nil history slice")
-	// Newest first — first entry should be "thinking"
-	if entries[0].Status != models.AgentStatusThinking {
-		t.Errorf("expected newest entry status=thinking, got %s", entries[0].Status)
 	}
 }
 
@@ -249,7 +244,7 @@ func TestAgentHistory_NotFound(t *testing.T) {
 	}
 }
 
-// ─── Session Tests ─────────────────────────────────────────────────────────════
+// ─── Session Tests ─────────────────────────────────────────────────────────═
 
 func TestListSessions_Empty(t *testing.T) {
 	h := testHandler(t)
@@ -265,14 +260,14 @@ func TestListSessions_Empty(t *testing.T) {
 
 func TestListSessions_WithData(t *testing.T) {
 	h := testHandler(t)
-	h.SessionStore.Create(models.Session{
+	h.Sessions.Create(nil, models.Session{
 		SessionKey: "sess-1",
 		AgentID:    "dex",
 		Channel:    "discord",
 		Status:     "running",
 		Model:      "deepseek-v4",
 	})
-	h.SessionStore.Create(models.Session{
+	h.Sessions.Create(nil, models.Session{
 		SessionKey: "sess-2",
 		AgentID:    "otto",
 		Channel:    "discord",
@@ -299,7 +294,7 @@ func TestListTasks_Empty(t *testing.T) {
 
 func TestListTasks_WithData(t *testing.T) {
 	h := testHandler(t)
-	h.TaskStore.Create(models.Task{
+	h.Tasks.Create(nil, models.Task{
 		AgentID: "dex",
 		Title:   "Implement CRUD API",
 		Status:  models.TaskStatusRunning,
@@ -324,7 +319,7 @@ func TestListProjects_Empty(t *testing.T) {
 
 func TestListProjects_WithData(t *testing.T) {
 	h := testHandler(t)
-	h.ProjectStore.Create(models.Project{
+	h.Projects.Create(nil, models.Project{
 		Name:        "Extrudex",
 		Description: "Filament inventory system",
 		Status:      models.ProjectStatusActive,
@@ -348,7 +343,6 @@ func TestPagination_PageOutOfRange(t *testing.T) {
 	if len(pr.Data.([]any)) != 0 {
 		t.Errorf("expected empty page, got %d items", len(pr.Data.([]any)))
 	}
-	// HasMore=false because we're past all data — nothing more to fetch.
 	if pr.HasMore {
 		t.Error("expected HasMore=false when page is beyond data")
 	}

go-backend/internal/handler/mock_repos_test.go

@@ -0,0 +1,235 @@
+package handler
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
+)
+
+// mockAgentRepo implements repository.AgentRepo in-memory for testing.
+type mockAgentRepo struct {
+	mu sync.RWMutex
+	m  map[string]models.AgentCardData
+}
+
+func newMockAgentRepo() *mockAgentRepo {
+	return &mockAgentRepo{m: make(map[string]models.AgentCardData)}
+}
+
+func (r *mockAgentRepo) Create(ctx context.Context, a models.AgentCardData) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if _, ok := r.m[a.ID]; ok {
+		return fmt.Errorf("duplicate key: %s", a.ID)
+	}
+	r.m[a.ID] = a
+	return nil
+}
+
+func (r *mockAgentRepo) Get(ctx context.Context, id string) (models.AgentCardData, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	a, ok := r.m[id]
+	if !ok {
+		return a, fmt.Errorf("not found: %s", id)
+	}
+	return a, nil
+}
+
+func (r *mockAgentRepo) List(ctx context.Context, statusFilter models.AgentStatus) ([]models.AgentCardData, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	result := make([]models.AgentCardData, 0, len(r.m))
+	for _, a := range r.m {
+		if statusFilter != "" && a.Status != statusFilter {
+			continue
+		}
+		result = append(result, a)
+	}
+	return result, nil
+}
+
+func (r *mockAgentRepo) Update(ctx context.Context, id string, req models.UpdateAgentRequest) (models.AgentCardData, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	a, ok := r.m[id]
+	if !ok {
+		return a, fmt.Errorf("not found: %s", id)
+	}
+	if req.Status != nil {
+		a.Status = *req.Status
+	}
+	if req.CurrentTask != nil {
+		a.CurrentTask = req.CurrentTask
+	}
+	if req.TaskProgress != nil {
+		a.TaskProgress = req.TaskProgress
+	}
+	if req.TaskElapsed != nil {
+		a.TaskElapsed = req.TaskElapsed
+	}
+	if req.Channel != nil {
+		a.Channel = *req.Channel
+	}
+	if req.ErrorMessage != nil {
+		a.ErrorMessage = req.ErrorMessage
+	}
+	a.LastActivity = time.Now().UTC().Format(time.RFC3339)
+	r.m[id] = a
+	return a, nil
+}
+
+func (r *mockAgentRepo) Delete(ctx context.Context, id string) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if _, ok := r.m[id]; !ok {
+		return fmt.Errorf("not found: %s", id)
+	}
+	delete(r.m, id)
+	return nil
+}
+
+func (r *mockAgentRepo) Count(ctx context.Context) (int, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return len(r.m), nil
+}
+
+// ─── Mock Session Repo ──────────────────────────────────────────────────────────
+
+type mockSessionRepo struct {
+	mu sync.RWMutex
+	m  map[string]models.Session
+}
+
+func newMockSessionRepo() *mockSessionRepo {
+	return &mockSessionRepo{m: make(map[string]models.Session)}
+}
+
+func (r *mockSessionRepo) Create(ctx context.Context, s models.Session) (models.Session, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if s.ID == "" {
+		s.ID = fmt.Sprintf("sess-%d", len(r.m)+1)
+	}
+	if s.StartedAt.IsZero() {
+		s.StartedAt = time.Now().UTC()
+	}
+	if s.LastActivityAt.IsZero() {
+		s.LastActivityAt = s.StartedAt
+	}
+	r.m[s.ID] = s
+	return s, nil
+}
+
+func (r *mockSessionRepo) ListActive(ctx context.Context) ([]models.Session, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	result := make([]models.Session, 0)
+	for _, s := range r.m {
+		if s.Status == "running" || s.Status == "streaming" {
+			result = append(result, s)
+		}
+	}
+	return result, nil
+}
+
+func (r *mockSessionRepo) Count(ctx context.Context) (int, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return len(r.m), nil
+}
+
+// ─── Mock Task Repo ─────────────────────────────────────────────────────────────
+
+type mockTaskRepo struct {
+	mu sync.RWMutex
+	m  map[string]models.Task
+}
+
+func newMockTaskRepo() *mockTaskRepo {
+	return &mockTaskRepo{m: make(map[string]models.Task)}
+}
+
+func (r *mockTaskRepo) Create(ctx context.Context, t models.Task) (models.Task, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if t.ID == "" {
+		t.ID = fmt.Sprintf("task-%d", len(r.m)+1)
+	}
+	now := time.Now().UTC()
+	if t.CreatedAt.IsZero() {
+		t.CreatedAt = now
+	}
+	if t.UpdatedAt.IsZero() {
+		t.UpdatedAt = now
+	}
+	r.m[t.ID] = t
+	return t, nil
+}
+
+func (r *mockTaskRepo) ListRecent(ctx context.Context) ([]models.Task, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	result := make([]models.Task, 0, len(r.m))
+	for _, t := range r.m {
+		result = append(result, t)
+	}
+	return result, nil
+}
+
+func (r *mockTaskRepo) Count(ctx context.Context) (int, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return len(r.m), nil
+}
+
+// ─── Mock Project Repo ─────────────────────────────────────────────────────────
+
+type mockProjectRepo struct {
+	mu sync.RWMutex
+	m  map[string]models.Project
+}
+
+func newMockProjectRepo() *mockProjectRepo {
+	return &mockProjectRepo{m: make(map[string]models.Project)}
+}
+
+func (r *mockProjectRepo) Create(ctx context.Context, p models.Project) (models.Project, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if p.ID == "" {
+		p.ID = fmt.Sprintf("proj-%d", len(r.m)+1)
+	}
+	now := time.Now().UTC()
+	if p.CreatedAt.IsZero() {
+		p.CreatedAt = now
+	}
+	if p.UpdatedAt.IsZero() {
+		p.UpdatedAt = now
+	}
+	if p.AgentIDs == nil {
+		p.AgentIDs = []string{}
+	}
+	r.m[p.ID] = p
+	return p, nil
+}
+
+func (r *mockProjectRepo) List(ctx context.Context) ([]models.Project, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	result := make([]models.Project, 0, len(r.m))
+	for _, p := range r.m {
+		result = append(result, p)
+	}
+	return result, nil
+}
+
+func (r *mockProjectRepo) Count(ctx context.Context) (int, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return len(r.m), nil
+}

go-backend/internal/handler/project.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"log/slog"
 	"net/http"
 
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
@@ -10,7 +11,12 @@ import (
 
 // ListProjects handles GET /api/projects.
 func (h *Handler) ListProjects(w http.ResponseWriter, r *http.Request) {
-	projects := h.ProjectStore.List()
+	projects, err := h.Projects.List(r.Context())
+	if err != nil {
+		slog.Error("list projects failed", "error", err)
+		writeJSON(w, http.StatusInternalServerError, models.ErrorResponse{Error: "failed to list projects"})
+		return
+	}
 	if projects == nil {
 		projects = []models.Project{}
 	}
@@ -18,9 +24,10 @@ func (h *Handler) ListProjects(w http.ResponseWriter, r *http.Request) {
 	page, pageSize := parsePagination(r)
 	start, end := paginateSlice(len(projects), page, pageSize)
 
+	totalCount, _ := h.Projects.Count(r.Context())
 	writeJSON(w, http.StatusOK, models.PaginatedResponse{
 		Data:       projects[start:end],
-		TotalCount: h.ProjectStore.Count(),
+		TotalCount: totalCount,
 		Page:       page,
 		PageSize:   pageSize,
 		HasMore:    end < len(projects),

go-backend/internal/handler/session.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"log/slog"
 	"net/http"
 
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
@@ -10,7 +11,12 @@ import (
 
 // ListSessions handles GET /api/sessions.
 func (h *Handler) ListSessions(w http.ResponseWriter, r *http.Request) {
-	sessions := h.SessionStore.ListActive()
+	sessions, err := h.Sessions.ListActive(r.Context())
+	if err != nil {
+		slog.Error("list sessions failed", "error", err)
+		writeJSON(w, http.StatusInternalServerError, models.ErrorResponse{Error: "failed to list sessions"})
+		return
+	}
 	if sessions == nil {
 		sessions = []models.Session{}
 	}
@@ -18,9 +24,10 @@ func (h *Handler) ListSessions(w http.ResponseWriter, r *http.Request) {
 	page, pageSize := parsePagination(r)
 	start, end := paginateSlice(len(sessions), page, pageSize)
 
+	totalCount, _ := h.Sessions.Count(r.Context())
 	writeJSON(w, http.StatusOK, models.PaginatedResponse{
 		Data:       sessions[start:end],
-		TotalCount: h.SessionStore.Count(),
+		TotalCount: totalCount,
 		Page:       page,
 		PageSize:   pageSize,
 		HasMore:    end < len(sessions),

go-backend/internal/handler/sse.go

@@ -0,0 +1,125 @@
+// Package handler provides SSE (Server-Sent Events) streaming for the
+// Control Center API. The Broker manages client connections and broadcasts
+// typed events in text/event-stream format.
+package handler
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"sync"
+)
+
+// SSEEvent represents a single event to stream to connected clients.
+type SSEEvent struct {
+	EventType string `json:"eventType"`
+	Data      any    `json:"data"`
+}
+
+// Broker manages SSE client connections and broadcasts events to all
+// connected listeners. It is safe for concurrent use.
+type Broker struct {
+	mu      sync.RWMutex
+	clients map[chan SSEEvent]struct{}
+}
+
+// NewBroker returns an initialized Broker.
+func NewBroker() *Broker {
+	return &Broker{
+		clients: make(map[chan SSEEvent]struct{}),
+	}
+}
+
+// Subscribe registers a new client channel. The caller must read from
+// this channel and write SSE frames to the HTTP response writer.
+func (b *Broker) Subscribe() chan SSEEvent {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	ch := make(chan SSEEvent, 32) // small buffer to avoid blocking bursts
+	b.clients[ch] = struct{}{}
+	return ch
+}
+
+// Unsubscribe removes a client channel and closes it.
+func (b *Broker) Unsubscribe(ch chan SSEEvent) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if _, ok := b.clients[ch]; ok {
+		delete(b.clients, ch)
+		close(ch)
+	}
+}
+
+// Broadcast sends evt to every connected client. Slow clients that cannot
+// receive within their buffer are silently dropped (non-blocking send).
+func (b *Broker) Broadcast(eventType string, data any) {
+	evt := SSEEvent{EventType: eventType, Data: data}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	for ch := range b.clients {
+		select {
+		case ch <- evt:
+		default:
+			// Client too slow — drop this event for this client
+			slog.Warn("sse client buffer full, dropping event",
+				"eventType", eventType)
+		}
+	}
+}
+
+// ClientCount returns the number of currently connected SSE clients.
+func (b *Broker) ClientCount() int {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	return len(b.clients)
+}
+
+// ServeHTTP handles GET /api/events. It registers the client, streams
+// events in text/event-stream format, and cleans up on disconnect.
+func (b *Broker) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Ensure we can flush
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "streaming not supported", http.StatusInternalServerError)
+		return
+	}
+
+	// SSE headers
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no") // disable nginx buffering
+
+	ch := b.Subscribe()
+	defer b.Unsubscribe(ch)
+
+	// Send initial connection event
+	fmt.Fprintf(w, "event: connected\ndata: {\"clientCount\":%d}\n\n", b.ClientCount())
+	flusher.Flush()
+
+	ctx := r.Context()
+	for {
+		select {
+		case <-ctx.Done():
+			// Client disconnected
+			slog.Debug("sse client disconnected")
+			return
+		case evt, ok := <-ch:
+			if !ok {
+				return
+			}
+			data, err := json.Marshal(evt.Data)
+			if err != nil {
+				slog.Error("sse marshal failed", "error", err)
+				continue
+			}
+			fmt.Fprintf(w, "event: %s\ndata: %s\n\n", evt.EventType, string(data))
+			flusher.Flush()
+		}
+	}
+}

go-backend/internal/handler/task.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"log/slog"
 	"net/http"
 
 	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
@@ -10,7 +11,12 @@ import (
 
 // ListTasks handles GET /api/tasks.
 func (h *Handler) ListTasks(w http.ResponseWriter, r *http.Request) {
-	tasks := h.TaskStore.ListRecent()
+	tasks, err := h.Tasks.ListRecent(r.Context())
+	if err != nil {
+		slog.Error("list tasks failed", "error", err)
+		writeJSON(w, http.StatusInternalServerError, models.ErrorResponse{Error: "failed to list tasks"})
+		return
+	}
 	if tasks == nil {
 		tasks = []models.Task{}
 	}
@@ -18,9 +24,10 @@ func (h *Handler) ListTasks(w http.ResponseWriter, r *http.Request) {
 	page, pageSize := parsePagination(r)
 	start, end := paginateSlice(len(tasks), page, pageSize)
 
+	totalCount, _ := h.Tasks.Count(r.Context())
 	writeJSON(w, http.StatusOK, models.PaginatedResponse{
 		Data:       tasks[start:end],
-		TotalCount: h.TaskStore.Count(),
+		TotalCount: totalCount,
 		Page:       page,
 		PageSize:   pageSize,
 		HasMore:    end < len(tasks),

go-backend/internal/repository/agent_repository.go

@@ -0,0 +1,186 @@
+// Package repository provides PostgreSQL-backed CRUD implementations
+// for the Control Center domain entities. Each repository takes a
+// *pgxpool.Pool in its constructor and uses pgx.CollectRows() for scanning.
+package repository
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// AgentRepository provides PostgreSQL-backed CRUD for agents.
+type AgentRepository struct {
+	pool *pgxpool.Pool
+}
+
+// NewAgentRepository returns a repository wired to the given connection pool.
+func NewAgentRepository(pool *pgxpool.Pool) *AgentRepository {
+	return &AgentRepository{pool: pool}
+}
+
+// Create inserts a new agent. It maps the models.AgentCardData fields onto
+// the agents table columns (uuid id, text name, text status, text task,
+// int progress, text session_key, text channel).
+func (r *AgentRepository) Create(ctx context.Context, a models.AgentCardData) error {
+	prog := 0
+	if a.TaskProgress != nil {
+		prog = *a.TaskProgress
+	}
+
+	_, err := r.pool.Exec(ctx, `
+		INSERT INTO agents (id, name, status, task, progress, session_key, channel, last_activity)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+	`, a.ID, a.DisplayName, string(a.Status), a.CurrentTask, prog,
+		a.SessionKey, a.Channel, time.Now().UTC())
+
+	return err
+}
+
+// Get returns a single agent by its string id.
+func (r *AgentRepository) Get(ctx context.Context, id string) (models.AgentCardData, error) {
+	var a models.AgentCardData
+	var task *string
+	var prog int
+	var lastActivity time.Time
+
+	err := r.pool.QueryRow(ctx, `
+		SELECT id, name, status, task, progress, session_key, channel, last_activity
+		FROM agents WHERE id = $1
+	`, id).Scan(&a.ID, &a.DisplayName, &a.Status, &task, &prog,
+		&a.SessionKey, &a.Channel, &lastActivity)
+
+	if err != nil {
+		return a, err
+	}
+
+	a.CurrentTask = task
+	if prog > 0 || task != nil {
+		p := prog
+		a.TaskProgress = &p
+	}
+	a.LastActivity = lastActivity.UTC().Format(time.RFC3339)
+
+	// Role is not persisted in the current schema — set a sensible default.
+	a.Role = "agent"
+
+	return a, nil
+}
+
+// List returns all agents, optionally filtered by status.
+// Results are ordered by name (display_name).
+func (r *AgentRepository) List(ctx context.Context, statusFilter models.AgentStatus) ([]models.AgentCardData, error) {
+	var rows pgx.Rows
+	var err error
+
+	if statusFilter != "" {
+		rows, err = r.pool.Query(ctx, `
+			SELECT id, name, status, task, progress, session_key, channel, last_activity
+			FROM agents WHERE status = $1 ORDER BY name
+		`, string(statusFilter))
+	} else {
+		rows, err = r.pool.Query(ctx, `
+			SELECT id, name, status, task, progress, session_key, channel, last_activity
+			FROM agents ORDER BY name
+		`)
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return pgx.CollectRows(rows, func(row pgx.CollectableRow) (models.AgentCardData, error) {
+		var a models.AgentCardData
+		var task *string
+		var prog int
+		var lastActivity time.Time
+
+		if err := row.Scan(&a.ID, &a.DisplayName, &a.Status, &task, &prog,
+			&a.SessionKey, &a.Channel, &lastActivity); err != nil {
+			return a, err
+		}
+
+		a.CurrentTask = task
+		if prog > 0 || task != nil {
+			p := prog
+			a.TaskProgress = &p
+		}
+		a.LastActivity = lastActivity.UTC().Format(time.RFC3339)
+		a.Role = "agent"
+		return a, nil
+	})
+}
+
+// Update applies partial updates to an agent. Returns the updated agent.
+func (r *AgentRepository) Update(ctx context.Context, id string, req models.UpdateAgentRequest) (models.AgentCardData, error) {
+	// Build dynamic SET clause.
+	setClauses := []string{"last_activity = $2"}
+	args := []any{id, time.Now().UTC()}
+	argIdx := 3
+
+	if req.Status != nil {
+		setClauses = append(setClauses, fmt.Sprintf("status = $%d", argIdx))
+		args = append(args, string(*req.Status))
+		argIdx++
+	}
+	if req.CurrentTask != nil {
+		setClauses = append(setClauses, fmt.Sprintf("task = $%d", argIdx))
+		args = append(args, *req.CurrentTask)
+		argIdx++
+	}
+	if req.TaskProgress != nil {
+		setClauses = append(setClauses, fmt.Sprintf("progress = $%d", argIdx))
+		args = append(args, *req.TaskProgress)
+		argIdx++
+	}
+	if req.Channel != nil {
+		setClauses = append(setClauses, fmt.Sprintf("channel = $%d", argIdx))
+		args = append(args, *req.Channel)
+		argIdx++
+	}
+
+	// Build and execute
+	query := "UPDATE agents SET "
+	for i, clause := range setClauses {
+		if i > 0 {
+			query += ", "
+		}
+		query += clause
+	}
+	query += " WHERE id = $1"
+
+	ct, err := r.pool.Exec(ctx, query, args...)
+	if err != nil {
+		return models.AgentCardData{}, err
+	}
+	if ct.RowsAffected() == 0 {
+		return models.AgentCardData{}, fmt.Errorf("agent not found: %s", id)
+	}
+
+	return r.Get(ctx, id)
+}
+
+// Delete removes an agent. Returns nil even if the agent doesn't exist
+// (idempotent). Returns a wrapped error only on transport failures.
+func (r *AgentRepository) Delete(ctx context.Context, id string) error {
+	_, err := r.pool.Exec(ctx, `DELETE FROM agents WHERE id = $1`, id)
+	return err
+}
+
+// Count returns the total number of agents.
+func (r *AgentRepository) Count(ctx context.Context) (int, error) {
+	var n int
+	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM agents`).Scan(&n)
+	return n, err
+}
+
+// CountByStatus returns the number of agents with the given status.
+func (r *AgentRepository) CountByStatus(ctx context.Context, status models.AgentStatus) (int, error) {
+	var n int
+	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM agents WHERE status = $1`, string(status)).Scan(&n)
+	return n, err
+}

go-backend/internal/repository/interfaces.go

@@ -0,0 +1,38 @@
+package repository
+
+import (
+	"context"
+
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
+)
+
+// AgentRepo is the interface for agent persistence operations.
+type AgentRepo interface {
+	Create(ctx context.Context, a models.AgentCardData) error
+	Get(ctx context.Context, id string) (models.AgentCardData, error)
+	List(ctx context.Context, statusFilter models.AgentStatus) ([]models.AgentCardData, error)
+	Update(ctx context.Context, id string, req models.UpdateAgentRequest) (models.AgentCardData, error)
+	Delete(ctx context.Context, id string) error
+	Count(ctx context.Context) (int, error)
+}
+
+// SessionRepo is the interface for session persistence operations.
+type SessionRepo interface {
+	Create(ctx context.Context, s models.Session) (models.Session, error)
+	ListActive(ctx context.Context) ([]models.Session, error)
+	Count(ctx context.Context) (int, error)
+}
+
+// TaskRepo is the interface for task persistence operations.
+type TaskRepo interface {
+	Create(ctx context.Context, t models.Task) (models.Task, error)
+	ListRecent(ctx context.Context) ([]models.Task, error)
+	Count(ctx context.Context) (int, error)
+}
+
+// ProjectRepo is the interface for project persistence operations.
+type ProjectRepo interface {
+	Create(ctx context.Context, p models.Project) (models.Project, error)
+	List(ctx context.Context) ([]models.Project, error)
+	Count(ctx context.Context) (int, error)
+}

go-backend/internal/repository/project_repository.go

@@ -0,0 +1,94 @@
+package repository
+
+import (
+	"context"
+	"time"
+
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// ProjectRepository provides PostgreSQL-backed CRUD for projects.
+type ProjectRepository struct {
+	pool *pgxpool.Pool
+}
+
+// NewProjectRepository returns a repository wired to the given connection pool.
+func NewProjectRepository(pool *pgxpool.Pool) *ProjectRepository {
+	return &ProjectRepository{pool: pool}
+}
+
+// Create inserts a new project. The current projects table only stores
+// a single agent_id, so we use the first entry from AgentIDs if present.
+func (r *ProjectRepository) Create(ctx context.Context, p models.Project) (models.Project, error) {
+	now := time.Now().UTC()
+	if p.CreatedAt.IsZero() {
+		p.CreatedAt = now
+	}
+	if p.UpdatedAt.IsZero() {
+		p.UpdatedAt = now
+	}
+
+	var agentID *string
+	if len(p.AgentIDs) > 0 {
+		agentID = &p.AgentIDs[0]
+	}
+
+	err := r.pool.QueryRow(ctx, `
+		INSERT INTO projects (name, description, status, agent_id, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6)
+		RETURNING id, name, description, status, agent_id, created_at, updated_at
+	`, p.Name, p.Description, string(p.Status), agentID, p.CreatedAt, p.UpdatedAt).Scan(
+		&p.ID, &p.Name, &p.Description, &p.Status, &agentID,
+		&p.CreatedAt, &p.UpdatedAt,
+	)
+	if err != nil {
+		return p, err
+	}
+
+	if agentID != nil {
+		p.AgentIDs = []string{*agentID}
+	} else {
+		p.AgentIDs = []string{}
+	}
+
+	return p, nil
+}
+
+// List returns all projects ordered by name.
+func (r *ProjectRepository) List(ctx context.Context) ([]models.Project, error) {
+	rows, err := r.pool.Query(ctx, `
+		SELECT id, name, description, status, agent_id, created_at, updated_at
+		FROM projects
+		ORDER BY name
+	`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return pgx.CollectRows(rows, func(row pgx.CollectableRow) (models.Project, error) {
+		var p models.Project
+		var agentID *string
+
+		if err := row.Scan(&p.ID, &p.Name, &p.Description, &p.Status,
+			&agentID, &p.CreatedAt, &p.UpdatedAt); err != nil {
+			return p, err
+		}
+
+		if agentID != nil {
+			p.AgentIDs = []string{*agentID}
+		} else {
+			p.AgentIDs = []string{}
+		}
+		return p, nil
+	})
+}
+
+// Count returns the total number of projects.
+func (r *ProjectRepository) Count(ctx context.Context) (int, error) {
+	var n int
+	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM projects`).Scan(&n)
+	return n, err
+}

go-backend/internal/repository/session_repository.go

@@ -0,0 +1,78 @@
+package repository
+
+import (
+	"context"
+	"time"
+
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// SessionRepository provides PostgreSQL-backed CRUD for sessions.
+type SessionRepository struct {
+	pool *pgxpool.Pool
+}
+
+// NewSessionRepository returns a repository wired to the given connection pool.
+func NewSessionRepository(pool *pgxpool.Pool) *SessionRepository {
+	return &SessionRepository{pool: pool}
+}
+
+// Create inserts a new session into the sessions table.
+// Because the existing sessions table only has id, agent_id, started_at,
+// ended_at, and status, we map what we can and store additional metadata
+// as a fallback. AgentID is required by FK — if the session AgentID can't
+// be cast to a valid UUID we store a sentinel.
+func (r *SessionRepository) Create(ctx context.Context, s models.Session) (models.Session, error) {
+	if s.StartedAt.IsZero() {
+		s.StartedAt = time.Now().UTC()
+	}
+	if s.LastActivityAt.IsZero() {
+		s.LastActivityAt = s.StartedAt
+	}
+
+	err := r.pool.QueryRow(ctx, `
+		INSERT INTO sessions (agent_id, started_at, status)
+		VALUES ($1, $2, $3)
+		RETURNING id, agent_id, started_at, ended_at, status
+	`, s.AgentID, s.StartedAt, s.Status).Scan(
+		&s.ID, &s.AgentID, &s.StartedAt, nil, &s.Status)
+
+	return s, err
+}
+
+// ListActive returns all sessions with status 'running' or 'streaming',
+// ordered by started_at descending.
+func (r *SessionRepository) ListActive(ctx context.Context) ([]models.Session, error) {
+	rows, err := r.pool.Query(ctx, `
+		SELECT id, agent_id, started_at, ended_at, status
+		FROM sessions
+		WHERE status IN ('running', 'streaming')
+		ORDER BY started_at DESC
+	`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return pgx.CollectRows(rows, func(row pgx.CollectableRow) (models.Session, error) {
+		var s models.Session
+		var endedAt *time.Time
+		if err := row.Scan(&s.ID, &s.AgentID, &s.StartedAt, &endedAt, &s.Status); err != nil {
+			return s, err
+		}
+		s.LastActivityAt = s.StartedAt
+		if endedAt != nil {
+			s.LastActivityAt = *endedAt
+		}
+		return s, nil
+	})
+}
+
+// Count returns the total number of sessions.
+func (r *SessionRepository) Count(ctx context.Context) (int, error) {
+	var n int
+	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM sessions`).Scan(&n)
+	return n, err
+}

go-backend/internal/repository/task_repository.go

@@ -0,0 +1,85 @@
+package repository
+
+import (
+	"context"
+	"time"
+
+	"code.cubecraftcreations.com/CubeCraft-Creations/Control-Center/go-backend/internal/models"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// TaskRepository provides PostgreSQL-backed CRUD for task_logs.
+type TaskRepository struct {
+	pool *pgxpool.Pool
+}
+
+// NewTaskRepository returns a repository wired to the given connection pool.
+func NewTaskRepository(pool *pgxpool.Pool) *TaskRepository {
+	return &TaskRepository{pool: pool}
+}
+
+// Create inserts a new task into the task_logs table.
+func (r *TaskRepository) Create(ctx context.Context, t models.Task) (models.Task, error) {
+	now := time.Now().UTC()
+	if t.CreatedAt.IsZero() {
+		t.CreatedAt = now
+	}
+	if t.UpdatedAt.IsZero() {
+		t.UpdatedAt = now
+	}
+
+	err := r.pool.QueryRow(ctx, `
+		INSERT INTO task_logs (agent_id, task, status, started_at)
+		VALUES ($1, $2, $3, $4)
+		RETURNING id, agent_id, task, status, started_at, completed_at, error_message
+	`, t.AgentID, t.Title, string(t.Status), t.CreatedAt).Scan(
+		&t.ID, &t.AgentID, &t.Title, &t.Status, &t.CreatedAt,
+		nil, nil,
+	)
+	if err != nil {
+		return t, err
+	}
+
+	// Rebuild the Description since task_logs only stores the title as "task".
+	t.Description = t.Title
+	return t, nil
+}
+
+// ListRecent returns the most recent tasks, newest first.
+func (r *TaskRepository) ListRecent(ctx context.Context) ([]models.Task, error) {
+	rows, err := r.pool.Query(ctx, `
+		SELECT id, agent_id, task, status, started_at, completed_at, error_message
+		FROM task_logs
+		ORDER BY started_at DESC
+	`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return pgx.CollectRows(rows, func(row pgx.CollectableRow) (models.Task, error) {
+		var t models.Task
+		var completedAt *time.Time
+		var errMsg *string
+
+		if err := row.Scan(&t.ID, &t.AgentID, &t.Title, &t.Status,
+			&t.CreatedAt, &completedAt, &errMsg); err != nil {
+			return t, err
+		}
+
+		t.Description = t.Title
+		t.UpdatedAt = t.CreatedAt
+		if completedAt != nil {
+			t.UpdatedAt = *completedAt
+		}
+		return t, nil
+	})
+}
+
+// Count returns the total number of tasks.
+func (r *TaskRepository) Count(ctx context.Context) (int, error) {
+	var n int
+	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM task_logs`).Scan(&n)
+	return n, err
+}

go-backend/internal/router/router.go

@@ -3,6 +3,7 @@
 package router
 
 import (
+	"context"
 	"net/http"
 	"time"
 
@@ -13,11 +14,13 @@ import (
 	"github.com/go-chi/cors"
 )
 
-// Dependencies carries the handler and database pool into the router.
+// Dependencies carries the handler, database pool, SSE broker, and CORS
+// configuration into the router.
 type Dependencies struct {
-	Handler   *handler.Handler
+	Handler    *handler.Handler
-	DB        *db.Pool
+	Pool       *db.Pool
 	CORSOrigin string
+	Broker     *handler.Broker
 }
 
 // New creates a fully-configured chi router with all API routes mounted.
@@ -49,8 +52,10 @@ func New(deps *Dependencies) *chi.Mux {
 	r.Get("/health", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		status := "ok"
-		if deps.DB != nil {
+		if deps.Pool != nil {
-			if err := deps.DB.Health(r.Context()); err != nil {
+			ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
+			defer cancel()
+			if err := deps.Pool.Ping(ctx); err != nil {
 				w.WriteHeader(http.StatusServiceUnavailable)
 				status = "db_unhealthy"
 			}
@@ -62,11 +67,11 @@ func New(deps *Dependencies) *chi.Mux {
 	r.Route("/api", func(api chi.Router) {
 		// Agents CRUD
 		api.Route("/agents", func(agents chi.Router) {
-			agents.Get("/", deps.Handler.ListAgents)       // GET /api/agents
+			agents.Get("/", deps.Handler.ListAgents)            // GET /api/agents
-			agents.Post("/", deps.Handler.CreateAgent)      // POST /api/agents
+			agents.Post("/", deps.Handler.CreateAgent)           // POST /api/agents
-			agents.Get("/{id}", deps.Handler.GetAgent)       // GET /api/agents/{id}
+			agents.Get("/{id}", deps.Handler.GetAgent)            // GET /api/agents/{id}
-			agents.Put("/{id}", deps.Handler.UpdateAgent)    // PUT /api/agents/{id}
+			agents.Put("/{id}", deps.Handler.UpdateAgent)         // PUT /api/agents/{id}
-			agents.Delete("/{id}", deps.Handler.DeleteAgent) // DELETE /api/agents/{id}
+			agents.Delete("/{id}", deps.Handler.DeleteAgent)      // DELETE /api/agents/{id}
 			agents.Get("/{id}/history", deps.Handler.AgentHistory) // GET /api/agents/{id}/history
 		})
 
@@ -78,6 +83,9 @@ func New(deps *Dependencies) *chi.Mux {
 
 		// Projects
 		api.Get("/projects", deps.Handler.ListProjects)
+
+		// SSE event stream
+		api.Get("/events", deps.Broker.ServeHTTP)
 	})
 
 	return r

kiosk/control-center-kiosk.service

@@ -0,0 +1,42 @@
+# Control Center Kiosk Service
+# =============================
+# Systemd unit file for auto-starting the Control Center kiosk on boot
+# 
+# Install: sudo cp control-center-kiosk.service /etc/systemd/system/
+# Enable:  sudo systemctl enable control-center-kiosk
+# Start:   sudo systemctl start control-center-kiosk
+# Status:  sudo systemctl status control-center-kiosk
+# Logs:    sudo journalctl -u control-center-kiosk -f
+
+[Unit]
+Description=Control Center Kiosk - Chrome Browser Dashboard
+Documentation=https://code.cubecraftcreations.com/CubeCraft-Creations/Control-Center
+After=graphical-session.target network-online.target
+Wants=network-online.target
+PartOf=graphical-session.target
+
+[Service]
+Type=simple
+ExecStart=/home/overseer/projects/Control-Center/kiosk/start-kiosk.sh http://localhost:3000
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=5
+Environment=DISPLAY=:0
+Environment=XAUTHORITY=/home/overseer/.Xauthority
+WorkingDirectory=/home/overseer/projects/Control-Center
+User=overseer
+Group=overseer
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=control-center-kiosk
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ReadWritePaths=/home/overseer/.config/chromium
+ReadWritePaths=/var/log/journal
+
+[Install]
+WantedBy=graphical-session.target

kiosk/start-kiosk.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# Control Center Kiosk Startup Script
+# ====================================
+# This script launches Chromium in kiosk mode for the Control Center dashboard
+# Usage: ./start-kiosk.sh [frontend-url]
+
+set -e
+
+FRONTEND_URL="${1:-http://localhost:3000}"
+BROWSER_WINDOW="chromium-browser"
+
+# ── Functions ────────────────────────────────────────────────────────────
+
+log() {
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
+}
+
+cleanup() {
+    log "Stopping kiosk browser..."
+    pkill -f "chromium-browser.*--kiosk" || true
+}
+
+trap cleanup SIGINT SIGTERM
+
+# ── Check prerequisites ──────────────────────────────────────────────────
+
+check_browser() {
+    if ! command -v chromium-browser &> /dev/null; then
+        log "ERROR: chromium-browser not found"
+        log "Install with: sudo apt-get install chromium"
+        exit 1
+    fi
+}
+
+check_x_server() {
+    if [ -z "$DISPLAY" ]; then
+        log "ERROR: DISPLAY environment variable not set"
+        log "This script requires an X server session"
+        exit 1
+    fi
+}
+
+# ── Main ────────────────────────────────────────────────────────────────
+
+main() {
+    log "Starting Control Center Kiosk..."
+    log "Frontend URL: $FRONTEND_URL"
+    
+    check_browser
+    check_x_server
+    
+    # Clean up any existing browser instances
+    cleanup
+    
+    # Launch Chromium in kiosk mode
+    # --kiosk: Fullscreen without browser UI
+    # --incognito: Clean session
+    # --noerrdialogs: Suppress error dialogs
+    # --disable-notifications: Disable notifications
+    # --disable-extensions: Disable extensions
+    # --disable-plugins-discovery: Disable plugins
+    # --disable-sync: Disable sync
+    # --disable-web-security: Allow CORS (needed for local API calls)
+    # --ignore-certificate-errors: Ignore SSL errors (for local dev)
+    # --gpu: Enable GPU acceleration
+    # --start-fullscreen: Start in fullscreen mode
+    chromium-browser \
+        --kiosk \
+        --incognito \
+        --noerrdialogs \
+        --disable-notifications \
+        --disable-extensions \
+        --disable-plugins-discovery \
+        --disable-sync \
+        --disable-web-security \
+        --ignore-certificate-errors \
+        --gpu \
+        --start-fullscreen \
+        "$FRONTEND_URL" &
+    
+    KIOSK_PID=$!
+    log "Kiosk browser started (PID: $KIOSK_PID)"
+    
+    # Wait for browser to exit
+    wait $KIOSK_PID
+}
+
+main "$@"