router
Return an APIRouter serving POST /handoff, POST /escalate, and POST /say. Mount it at the
same prefix as the gateway’s router: the browser derives all three paths from the
one URL it was configured with, so they must be siblings of the gateway’s endpoint.
Each route checks the Origin header against the gateway’s allowlist and answers 403 when it
isn’t allowed. A malformed or unknown nonce answers 404; a missing handle on /escalate answers
400.
Parameters
None.
Returns
fastapi.APIRouter
Example
Use mount() rather than get_app().include_router(), so the new routes aren’t shadowed
by the agent’s catch-all. See HandoffRouter for the full flow.