The Nexus exposes its capabilities over HTTP/WebSocket. There are two separate listeners — two planes — never merged: the authenticated control plane (Workbooks.Web) and the anonymous, GET-only content plane (Workbooks.PublicWeb). RCP (the Runtime-Connect Protocol) is the token-authed verb subset of the control plane the thin wbx CLI drives against a running engine.

Every fact below is anchored at :SRC: a real file:line. Routes are listed verbatim from the routers; nothing is paraphrased.

Each plane is a distinct Bandit listener bound to a distinct port. The public plane never shares the authed router or its pipeline — that isolation is the whole point of the split (public_web.ex:1-20).

Ports are overridable: PORT / PUBLIC_PORT / PUBLIC_TLS_PORT (application.ex:241-243). The desktop daemon (WB_DESKTOP=1) implies the control plane bound on a fixed desktop port with a single-acceptor IPv4 listener (application.ex:142-156). All non-desktop planes listen dual-stack IPv4+IPv6 (application.ex:195-196).

The content plane is anonymous by construction: it has no Workbooks.Auth plug, only GET clauses (any other method falls to 404), no Dock / commands / build / agent / secret routes, and the page it serves carries no call-home script — published content is static bytes only (public_web.ex:8-20, public_web.ex:181-188).

Workbooks.Auth runs after CORS and before :match=/:dispatch= (web.ex:15-18). First match wins; it assigns :identity (%{user_id, tenant_id, session_id}) and :tenant (auth.ex:102-106).

No-credential behavior (auth.ex:51-57): a locked deploy (WB_PUBLIC_BEARER set) → 401, no fallback. Multi-tenant (unlocked) → 401 (isolation can't rest on a spoofable header). Dev / single-tenant (unlocked) → x-tenant fallback.

Public allowlist — always open, no tenant data (auth.ex:28):

/gk/* is not in @public but is treated as public here because the groundskeeper bridge enforces its own credential and fails closed (auth.ex:37, web.ex:104).

The :cors plug runs before Workbooks.Auth so the credential-less preflight isn't rejected (web.ex:15-16). Headers set on every response: access-control-allow-origin: *, allow-methods: GET, POST, PUT, DELETE, OPTIONS, allow-headers: authorization, content-type, x-tenant, max-age: 86400. An OPTIONS request short-circuits to 204 (web.ex:28-32). Origin is wildcarded because the local engine binds loopback / a boot-token-gated guest, not the public internet (web.ex:9-14).

The handshake doc (capabilities.ex:32-44) returns: rcp ("1"), runtime (app vsn), tenancy ("single" | "multi"), auth (rung "trusted" | "oidc-jwt" derived from tenancy; issuer; jwks_url), transports (http, ws both true), and capabilities [oql, workflow, instances, workbook, agent, library, search, publish, browse, telemetry]. A client reads this before presenting a credential to learn the required rung (capabilities.ex:2-23).

/api/workflow encode-safes error tuples instead of 500ing, and 500s on an internal rescue (web.ex:167-172).

exec on /api/run is a TRUST grant (host-brokered git/publish tools, OS workdir for fs tools) — it grants no native execution, and is honored ONLY for the trusted local case (single-tenant/desktop) or explicit WB_AGENT_EXEC=1; never for arbitrary/multi-tenant callers (web.ex:254-262).

These mirror the escript's local Library.* / Toolkits.* calls but are token-authed so the thin Rust CLI can drive a running engine. Tenant comes from the credential, not a path (web.ex:435-437). Working-tree bytes cross the wire base64'd in the :zip Workbooks.Bundle format because the engine usually runs in a container on another machine (web.ex:449-454).

RCP toolkit verbs (text in/out; task execution stays server-side gated by WB_TOOLKIT_EXEC, web.ex:510-514):

mode for /api/search/:tenant is one of hybrid (default) / semantic / literal (web.ex:723). /api/browse dispatches on mode: fetch (default), crawl, search; as ∈ json (default) / org (web.ex:849-872).

/internal/secrets/refresh is not public — Workbooks.Auth runs first, so only the local shell holding the per-boot token can set env keys (web.ex:39-45).

Any unmatched route on the control plane → 404 "not found" (web.ex:821-823).

Anonymous, GET-only. The app id is resolved from the request HOST via the Workbooks.Domains registry (registered host wins, else the leftmost DNS label) (public_web.ex:294-296). Every response carries an x-served-by: workbooks-runtime header (public_web.ex:190-191) and HTML bodies get an inline <!-- Served by the Workbooks runtime … --> marker (public_web.ex:29, public_web.ex:286-292).

Static serving (public_web.ex:215-243): pages are clean-URL (/learn/workbook → learn/workbook.html), directories default to index.html, inbound .html URLs 301 to the clean form. Path-traversal safe: .. segments rejected and the resolved path is contained within the site dir (public_web.ex:274-284). Non-GET methods never match a get clause → fall through to 404 (public_web.ex:181, public_web.ex:186-188).

The content plane has no Dock, no /w/:id/call, no commands/build/agents, no secret access — none of those routes exist here (public_web.ex:8-16).

Server-side compute for public apps and the full custom-domain / TLS provisioning story are intended but not the current shipped behavior. The public plane today is static content + read-only /_changes and /_activity feeds.

• The Dock & capabilities — the membrane the runtime brokers.

• Dock capabilities reference — the capability grants.

• wbx CLI reference — the verbs that drive the RCP surface.

• runtime/docs/RUNTIME-CONNECT-PROTOCOL.org — the RCP handshake spec (:SRC: for /.well-known/workbooks-runtime).