kiosk-server is the host-side surface for Kiosk. The full surface ships: - The controllers — the per-verb wire (GET /, POST /) and the reserved endpoints (/kiosk/schema, /kiosk/pay), a derived OpenAPI description of both, OAuth client registration (RFC 7591) and the token endpoint (private_key_jwt client assertions, DPoP), JWKS, the KYC attestation endpoint, agents.txt / agents.json / kiosk.json discovery, and the account-binding ceremony (RFC 8628 device authorization and token poll, the verify and «Link an assistant» pages). - Kiosk::Server::Executor — dispatches a resolved command to the queries and actions the host registered. - Client registration and authentication, with a pluggable agent-IdP. - The PoW gate that enforces a kiosk-reputation policy's challenge (soft dependency; zero overhead when no policy is set). - A Rack middleware injecting the Kiosk-Server-Version / Kiosk-API-Version / Kiosk-Min-Client response headers, a pure-Ruby builder for the discovery documents, SQL generators for the canonical schema migrations, and a `kiosk:install` generator that lays down the initializer and the migrations. The Rails engine serves that whole surface from one `kiosk` block in config/routes.rb, which mounts it at Kiosk.configuration.mount_path — drawing the wire/auth/JWKS/KYC/binding routes under the mount and installing the root-relative discovery routes (agents.txt, .well-known) into the host — then one route per query and action the block names. It also auto-injects the headers middleware.