[inureyes]

Summary

Release documentation for the bundled WebUI, written against the UI as it is on main now that every other child of #1910 has merged, plus --webui in --help on both server entry points.

• CLI help: --webui / --no-webui are declared as visible arguments under a per-argument WebUI Options heading, with --ui / --no-ui as hidden aliases. Every other b10621 UI, tools, MCP, proxy, and agent argument stays hidden and keeps its startup diagnostic. Both after_help blocks gain a short WebUI pointer. The manifest's --ui entry now records hidden: false, the --ui-config notes no longer claim mlxcel ships no UI, and tests/llama_compat_manifest.rs checks hidden claims in both directions.
• Docs: new docs/webui/README.md entry point, user-guide.md / user-guide.ko.md (quickstarts, keys, library sources and the empty-start rule, single-model and offline modes, TLS and reverse-proxy access, lifecycle, settings scopes and privacy, deferred limits, troubleshooting, evidence links), and contributing.md / contributing.ko.md. Linked from README.md, docs/README.md, docs/server-features.md, and docs/llama-server-compat.md.
• NOTICE: adds the @lablup/ui-common section with its NOTICE carried forward verbatim (its compiled code is in the bundle and its license was only in third-party-licenses.txt). React and the backend.ai-go glass-theme entries were already present; glass.css keeps its per-file derivation header. The bundle CSS has no @font-face or url(), only system font names, and no Apple design-kit asset is shipped.
• Integration matrix: the "Bundle budgets and deterministic assets" row moves from not-run to the CI WebUI bundle job on this branch (build_bundle.py --verify, digest b4087a93...) with the manifest's source digest, measured sizes, and the SHA-256 of the binaries that embed it, so the guide links to recorded evidence.
• The final deferred-items checklist is posted on epic: ship a bundled macOS-style model control interface #1834: epic: ship a bundled macOS-style model control interface #1834 (comment)

Verification

Host: GB10 (CUDA). Built with cargo build --profile test-fast --features cuda --bin mlxcel-server --bin mlxcel from this branch (source identical to the final commits). Artifacts: mlxcel-server SHA-256 575f67ed7a87e7afb3bcdd431247d64d2e93e2295b2777816700a7d8675efcaa, mlxcel SHA-256 3ca9cdd875d5bb676346c8b6627bb531deb0bf2c4db014d4b4e15a9fe5cd6a17. UI bundle: manifest source_digest_sha256 1ebf0921089e00db6bf288cdd66fb2ba6265f9ee43a4224a07d483f1201d79c8, manifest file SHA-256 6e4906b0f599df320401c1d0fa2bc271363f27b1a0c220c8785824b7832e9013. Both binaries embed the bundle (hashed asset names and source digest present in the binary).

• mlxcel-server --help and mlxcel serve --help list --webui and --no-webui; --help | grep -E -- '--ui-config|--tools|--mcp-servers|--ui-mcp-proxy|--agent' prints nothing on both.
• Real checkpoint ~/models/mlx/qwen3-0.6b-4bit, for mlxcel-server --webui and mlxcel serve --webui (each with --api-key-file, --models-dir ~/models/mlx, --metrics --settings --props, under gpu-lock): 192 catalog entries and none loaded at start; a chat to the unloaded model returned 400 "model is not loaded" and left it unloaded; load via POST /ui-api/v1/model-actions was 202, cancelling it 422 unsupported, Ready after 2 s; one streaming /v1/chat/completions?autoload=false chat finished with stop, [DONE], content "Hello! 🌞"; unload 202, unloaded after 1 s; clean exit; key never in the log.
• Every troubleshooting message in the docs was captured from these binaries: no key without a terminal, Unix socket, non-loopback without TLS, missing --models-dir, missing --model-store-root and MLXCEL_MODELS_DIR, --ui-config, the 401 body, and the 403 Host header is not allowed body for a 0.0.0.0 TLS bind. The UI-not-compiled message was reproduced on a --no-default-features --features cuda,surgery build of both binaries.
• Quickstarts exercised: generated key on a pty (one key line, mlxcel_webui_ prefix, accepted by bootstrap) for both entry points; key file; absent default store gives an empty library; single-model mode reports read-only actions with the documented reasons; --offline disables download with "offline mode is enabled"; direct TLS on the LAN address; --api-prefix /lab serves /lab/webui/ with / still the health check.
• New tests fail with the fix reverted (re-hiding the pair): cli::ui_compat_args::tests::help_lists_only_the_webui_pair_under_its_heading, tests/webui_cli_help.rs::webui_pair_is_listed_and_the_rest_of_the_group_stays_hidden, and tests/llama_compat_manifest.rs::manifest_option_claims_hold_on_both_server_binaries. All pass on the branch, as do webui_enable_disable_resolves_with_last_flag_winning, tests/cli_help_consistency.rs (27), make verify-llama-compat, check_llama_compat_manifest_test.sh, clippy (--lib --tests -D warnings, cuda), fmt, and the repository contract checks.

Changes during review

pr-reviewer found that the guide described a typed DELETE confirmation (the dialog actually asks for the model's opaque id), misattributed the non-loopback diagnostic to a missing key, listed nohup as terminal-less, called tool calls copyable, and pointed string edits at catalog.ts only. All are fixed in both languages.

Not run here: the workspace-wide test suite (left to CI), and the reverse-proxy section was checked against scripts/webui/verify_reverse_proxy.py rather than a real nginx. Observed but out of scope: a single-model server started from a non-interactive shell with & ignored SIGINT and needed SIGTERM; router mode exited on SIGINT.

Part of #1910.

Closes #1900

[inureyes]

Implementation Review Summary

Intent

Make --webui / --no-webui visible in both server --help surfaces while the rest of the b10621 UI group stays hidden and refused, and ship the English and Korean WebUI user and contributor docs.

Findings Addressed

• Delete confirmation was documented as typing DELETE; the shipped dialog requires the opaque mdl_ model ID (dialogs.tsx, models.library.confirm_name). Fixed in both guides in 4326ae3. (HIGH)

Remaining Items

• user-guide.md:150 (and .ko.md): the non-loopback message only appears when a key is set but TLS is not. A non-loopback bind without a key gets the "interactive loopback terminal" message from row 148, whose fix ("start the server from a terminal") does not help there. Symptom columns of rows 148 and 150 need adjusting. (MEDIUM)
• user-guide.md:182: the "Bundle budgets and deterministic assets" matrix row is still not-run, so the bundle hash and size are not linked to final evidence as the issue asks. The CI WebUI bundle job passes on this PR and could be cited, or the row updated by whoever owns the evidence. (MEDIUM)
• contributing.md:21 (and .ko.md): make verify-webui-contract uses WEBUI_CONTRACT_PY (default python3); it is isolated only when pointed at the venv architecture.md describes. (MEDIUM)
• user-guide.md:31: nohup from an interactive shell keeps /dev/tty, so the server still generates and prints a key. (LOW)
• user-guide.md:136: tool calls are displayed and marked not executed, but there is no copy control for them. (LOW)
• contributing.md:28: most strings live in webui/src/features/*/strings.ts, which catalog.ts aggregates. (LOW)

Verification

• All stated requirements implemented
• No placeholder/mock code remaining
• Integrated into project code flow
• Project conventions followed
• Existing modules reused where applicable
• No unintended structural changes
• Tests pass (static review only on a shared GPU host: manifest gate and both --help outputs checked; cargo tests left to CI)