kiosk-server is the host-side surface for Kiosk. The full surface ships: - The controllers — the per-verb wire (GET <endpoint>/<query-name>, POST <endpoint>/<action-name>) and the reserved endpoints (/kiosk/schema, /kiosk/pay), a derived OpenAPI description of both, the register/login proof-of-possession auth plane, JWKS, the KYC attestation endpoint, agents.txt / agents.json / kiosk.json discovery, and the account-binding ceremony (RFC 8628-shaped device authorization, the possession-proof-gated token poll, the verify and «Link an assistant» pages). - Kiosk::Server::Executor — dispatches a resolved command to the queries and actions the host registered. - Agent registration and login, with a pluggable agent-IdP. - The PoW gate that enforces a kiosk-reputation policy's challenge (soft dependency; zero overhead when no policy is set). - A Rack middleware injecting the Kiosk-Server-Version / Kiosk-API-Version / Kiosk-Min-Client response headers, a pure-Ruby builder for the discovery documents, SQL generators for the canonical schema migrations, and a `kiosk:install` generator that lays down the initializer and the migrations. The Rails engine serves that whole surface from one `kiosk` block in config/routes.rb, which mounts it at Kiosk.configuration.mount_path — drawing the wire/auth/JWKS/KYC/binding routes under the mount and installing the root-relative discovery routes (agents.txt, .well-known) into the host — then one route per query and action the block names. It also auto-injects the headers middleware.