[anth-volk]

Fixes #114

Stacked on #116 (policyengine-api-access), which it points to. Its base is that PR's branch.

Summary

The Public API (api.policyengine.org) is becoming callable only by PolicyEngine's servers. This stops the catalog telling browser code to call it, and points dashboard and app guidance to policyengine-api-access.

Changes

• skills/policyengine-api: says who may call v1 (servers with their own credential) and that pages use the dashboard API; drops "JS frontends" from when to use REST; lists /health and /v2/openapi.json instead of /specification and the liveness and readiness checks, which the Public API removed (policyengine_api/migration_flags.py).
• skills/policyengine-tools: Pattern B is the dashboard API through @policyengine/api-client, with its four operations. A Pattern C backend that calls the Public API needs its own client and cached token; one that runs policyengine in its own process needs neither.
• skills/policyengine-app: the calculator's direct browser calls through BASE_URL are moving to app.policyengine.org's own route, /api/policyengine/{Public API path}, which forwards only the operations in app/src/libs/publicApiRoute/allowList.ts. New calculator code goes through that route.
• targets/claude/agents/dashboard/backend-builder.md and targets/claude/commands/new-tool.md: the Pattern B client wraps @policyengine/api-client instead of fetching https://api.policyengine.org. The types are type aliases, because the client takes Record<string, unknown> and a TypeScript interface is not assignable to it.
• The dashboard planner, scaffold and integrator load policyengine-api-access and describe Pattern B by what the dashboard API offers. The data_pattern value stays policyengine-api, so existing plan.yaml files still validate.
• The policyengine skill, targets/codex/agents/policyengine-app-v2/AGENTS.md and docs/when-to-use.md point to policyengine-api-access; the guide's catalog counts are current (25 skills).

Left as they are

These call the Public API from an analyst's or agent's own machine, not from a browser. None sends a credential, so each stops working once the credential requirement is on:

• targets/claude/agents/microsim-runner.md: Python requests to /us/policy, /us/economy/… and …/budget-window (its default "API path").
• targets/claude/agents/model-corroborator.md: curl to /us/policy and /us/economy/….
• targets/claude/agents/parameter-locator.md: curl to /us/metadata.
• targets/claude/commands/text-to-reform.md: names the Public API as where a user might submit a reform.
• dashboard/src/pages/Guides.tsx: guide text describing microsim-runner's API path; it makes no request.
• analyses/*.md: dated records, kept as written.

Tests

tests/test_public_api_browser_guidance.py: TypeScript and JavaScript examples in skills/, targets/ and docs/ may not name a Public API host (the household API and v2 hosts are not matched); no NEXT_PUBLIC_ or VITE_ variable may be set to one or named like a credential; eleven files that guide dashboard and app work must point to policyengine-api-access; the API skill's public routes; and the tools skill's Pattern B.

• Red, 29b87d2: 15 failed on their assertions, 2 passed (no public-prefix violations existed, and the patterns' self-test); exit code 1.
• Green, b6f3e85: 17 passed; exit code 0.
• CI: the first run, 42885835654, failed tests/pipeline/test_when_to_use_guide.py::test_skills_section_references_real_skills: the guide names policyengine-api-access, and Add policyengine-api-access and stop sending browser code to the Public API #116 had not rebuilt the dashboard manifest that the test reads. Add policyengine-api-access and stop sending browser code to the Public API #116 now rebuilds it, and this branch merges Add policyengine-api-access and stop sending browser code to the Public API #116's branch (e8d9a50).

🤖 Generated with Claude Code