**Note** from Bead: Create Webdav Server · [canonical source](https://redfish.acequia.io/guerin/.agents/a0a6f25a-53ef-4fd5-bfc8-a4b982420312/2026-06-18/notes/00-orientation.md) · session 2026-06-18 · discussion: Talk: Create Webdav Server
*Read this first. It is the captured vantage of the opening session (CV, for Stephen, 2026-06-18). It tells a denovo agent what this bead is for, the methodological frame, what each skill must contain, and how the pieces fit together.*
## The frame The acequia ecology assumes a **WebDAV origin is reachable everywhere**. The bookmarklet editor, the Liaison Officer, the bead docks (`request/`→`response/`, `inbox/`⇄`uploads/`), `webdav-sync.js`, and the whole "namespace-as-primitive" architecture all speak WebDAV verbs (GET, PUT, PROPFIND, MKCOL, MOVE, COPY, LOCK). Two implementations have already been *inspected* and recorded: - the **Node nephele** server — bead [`1bd0d6c3`](https://redfish.acequia.io/guerin/.agents/1bd0d6c3-4483-4364-8a57-780c0e32df7d/about.md) (`localWebDAV`, package `acequiaWebDAV`), - the **in-browser** server — bead [`bb39886e`](https://redfish.acequia.io/guerin/.agents/bb39886e-f0bc-48d5-9b4e-23e4b8a457b7/about.md) (BrowserDAV, File System Access API), both sitting on the liveness ladder from [`fe7fbaf5`](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/about.md) (static → SW → node) and sharing the chain-token auth model from [`9b2fcc1c`](https://redfish.acequia.io/guerin/.agents/9b2fcc1c-8960-49fb-ab6d-28b331a4e179/about.md). What was missing is the **how-to**: a parciante lands on a substrate that is *not* "our Node stack" — a Windows Server with IIS, a cPanel/shared host with PHP, a Python shop, a bare box — and needs the shortest correct path to a working WebDAV server speaking the same protocol. **This bead is that cookbook.** It does not redesign the protocol or the auth; it makes a server *appear* on whatever the parciante already has.
## Scope: five runtimes, one protocol WebDAV (RFC 4918, extending HTTP) is the constant. The runtimes differ in how much you build vs. configure, how locking and auth are handled, and whether CORS (needed for browser-origin acequia clients) is even possible. The five skills: 1. **`iis-webdav`** — Windows. Enable the **WebDAV Publishing** role/feature + the IIS management UI, add authoring rules, set authentication. Almost pure configuration, zero code. The native answer on any Windows box that already runs IIS. 2. **`node-vanilla-webdav`** — a **from-scratch** WebDAV handler in Node core `http` (no framework), implementing the minimal verb set (OPTIONS/PROPFIND/GET/PUT/MKCOL/DELETE/MOVE/COPY and a stub LOCK) over a directory. This is the teaching implementation and the most portable. Ships runnable `server.mjs`. 3. **`python-webdav`** — **WsgiDAV** on the Cheroot WSGI server (the de-facto Python WebDAV server), with a simple-DC auth config; plus the stdlib-only fallback note. 4. **`php-webdav`** — **SabreDAV** (`sabre/dav`) served by **Apache**, **nginx (php-fpm)**, and **LiteSpeed/OpenLiteSpeed**. The shared-hosting answer. Per-web-server vhost/rewrite config is the bulk of the work; the PHP app is one front controller. 5. **`nephele-acequia-webdav`** — install instructions for the **private** `realtime.earth/localWebDAV` nephele build. This is the real acequia origin (JWT + chain tokens + WebRTC peers). Owners-only; targets the clone under `sites/github.com/RedfishGroup/realtime.earth/localWebDAV`. Plus the **`webdav-installer-mcp`** server (an MCP that exposes each recipe as a tool: `list_runtimes`, `get_recipe`, `detect_environment`, `install_plan`), and the **`install.html`** artifact that detects Windows vs macOS in the browser and routes the human to the right recipe — including a **VSCode + Copilot/Claude/Gemini** hand-off that copies a ready-made agent prompt so the editor's coding agent performs the download + install.
## What every skill MUST contain (the recipe contract) So the skills are uniform and agent-runnable, each `SKILL.md` has these sections: - **When to use / prerequisites** — OS, privileges, what must already be installed. - **Install** — exact commands (copy-paste, with the elevation/privilege noted). Windows uses PowerShell/DISM; *nix uses the package manager + composer/pip/npm. - **Serve a directory** — the minimal config to expose one folder over WebDAV on a port/vhost. - **Auth** — the runtime's native mechanism (Windows auth, htpasswd/Basic, WsgiDAV simple-DC, SabreDAV BasicAuth backend) and a pointer to the acequia chain-token model in `9b2fcc1c` for the ecology-native posture. Default recipes are minimal; production hardening is referenced. - **CORS** — whether/how to enable cross-origin so browser acequia clients can reach it (critical: several hosts cannot, which is exactly the save-relay problem the ecology keeps hitting). - **Verify** — a `curl` PROPFIND + PUT + GET round-trip that proves the server works, and a note on mapping it as a drive/Finder share. - **Gotchas** — the per-runtime traps (IIS WebDAV vs request filtering, nginx `dav_ext` limits, Windows BasicAuth-over-HTTP registry switch, etc.). - **Status** — VERIFY-PENDING until run on real hardware; note what was tested.
## Methodology / posture - **Think in WebDAV first** (per `.ai/remote-access.md`): the deliverable is the protocol working, not a bespoke file API. Verify with raw `curl` verb calls, not a GUI, so the proof is portable. - **Minimal-then-reference**: each recipe gets you to a *working, insecure-by-default* server fast, then points at the hardening (TLS, real auth, the chain-token model) rather than inlining a production deployment. Production acequia auth is `9b2fcc1c`'s domain, not duplicated here. - **Agent-runnable**: commands are literal and idempotent where possible, because the MCP server and the VSCode hand-off both hand these to an agent to execute. Prefer commands an agent can run unattended; flag the steps that genuinely need a human (UAC prompts, hosting control panels). - **Cite vendor source by path**, never re-author it (git-and-beads). The nephele recipe targets the clone; it does not copy `server.mjs` into the bead.
## Pointers (load-bearing prior beads) - [`1bd0d6c3` acequia-nephele](https://redfish.acequia.io/guerin/.agents/1bd0d6c3-4483-4364-8a57-780c0e32df7d/2026-06-17/notes/00-nephele-model.md) — what the Node nephele server is; the `nephele-acequia-webdav` skill is its install side. - [`bb39886e` BrowserDAV](https://redfish.acequia.io/guerin/.agents/bb39886e-f0bc-48d5-9b4e-23e4b8a457b7/2026-06-17/notes/00-browserdav.md) — the browser rung; an alternative to running any of these five when a tab will do. - [`fe7fbaf5` bead-as-webdav-handler](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/about.md) — the liveness ladder these origins sit on. - [`9b2fcc1c` acequia-authorization](https://redfish.acequia.io/guerin/.agents/9b2fcc1c-8960-49fb-ab6d-28b331a4e179/about.md) — the chain-token auth every recipe points at for ecology-native auth. - Local clone: `sites/github.com/RedfishGroup/realtime.earth/localWebDAV/` (and `acequia2/` sibling).
## What the denovo agent should do 1. Read `agent.md`, then this note, then `01-flavors-matrix.md`. 2. To answer "stand up WebDAV on X": open `skills/<x>-webdav/SKILL.md` and follow it; or call the MCP tool `get_recipe(runtime)`. 3. To extend: add a new `skills/<runtime>-webdav/SKILL.md` following the recipe contract above, add a row to the matrix, register it in `webdav-installer-mcp/recipes.json`, and add a card to `install.html`. 4. Record install results from real hardware into the matching skill's **Status** section and the Session Log in `about.md`. Write the chat log in `chats/` as you go. 5. Do not write outside this bead's subtree; do not re-author vendor source.
## References (bead cross-links) - Bead: Acequia Nephele · [canonical](https://redfish.acequia.io/guerin/.agents/1bd0d6c3-4483-4364-8a57-780c0e32df7d/) - Bead: BrowserDAV · [canonical](https://redfish.acequia.io/guerin/.agents/bb39886e-f0bc-48d5-9b4e-23e4b8a457b7/) - Bead: As Webdav Handler · [canonical](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/) - Bead: Acequia Authorization · [canonical](https://redfish.acequia.io/guerin/.agents/9b2fcc1c-8960-49fb-ab6d-28b331a4e179/)