@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+
+//! Live BoJ-server connection module (async).
+//!
+//! Connects to the BoJ-server gateway at localhost:7700 for real
+//! cartridge invocation, health checks, and topology queries.
+//!
+//! This module parallels `boj::commands` but uses async reqwest via the
+//! shared [`http_client`] module instead of blocking calls. Panels that
+//! need non-blocking BoJ access (v0.2.0+) should prefer these commands.
+
+use crate::http_client::{self, ServiceEndpoint};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+
+// panic-attack:allow insecure-protocol — localhost dev endpoint
+/// Default BoJ-server base URL.
+const DEFAULT_BOJ_URL: &str = "http://localhost:7700";
+
+/// Build the BoJ endpoint, respecting the `BOJ_URL` environment variable
+/// if set, otherwise falling back to [`DEFAULT_BOJ_URL`].
+fn boj_endpoint() -> ServiceEndpoint {
+    let url = std::env::var("BOJ_URL").unwrap_or_else(|_| DEFAULT_BOJ_URL.to_string());
+    ServiceEndpoint::new(&url)
+}
+
+/// BoJ health check response shape.
+///
+/// Mirrors the JSON envelope returned by `GET /health` on the BoJ server.
+/// Optional fields are absent when the server is freshly started or running
+/// in minimal mode.
+#[derive(Debug, Deserialize, Serialize)]
+pub struct BojHealth {
+    /// Top-level status string (e.g. "ok", "degraded").
+    pub status: String,
+    /// Semantic version of the running BoJ server.
+    pub version: Option<String>,
+    /// Number of loaded cartridges.
+    pub cartridges: Option<usize>,
+    /// Human-readable uptime (e.g. "2h 14m").
+    pub uptime: Option<String>,
+}
+
+/// Check BoJ-server health (async).
+///
+/// `GET /health` — returns the full health envelope as a JSON string.
+#[tauri::command]
+pub async fn boj_live_health() -> Result<String, String> {
+    let endpoint = boj_endpoint();
+    let health: BojHealth = http_client::get_json(&endpoint, "/health")
+        .await
+        .map_err(|e| format!("BoJ server unreachable: {}", e))?;
+    serde_json::to_string(&health).map_err(|e| format!("Serialization failed: {}", e))
+}
+
+/// List available cartridges from BoJ-server (async).
+///
+/// `GET /cartridges` — returns the cartridge array as a JSON string.
+#[tauri::command]
+pub async fn boj_live_cartridges() -> Result<String, String> {
+    let endpoint = boj_endpoint();
+    let cartridges: serde_json::Value = http_client::get_json(&endpoint, "/cartridges")
+        .await
+        .map_err(|e| format!("Failed to list cartridges: {}", e))?;
+    serde_json::to_string(&cartridges).map_err(|e| format!("Serialization failed: {}", e))
+}
+
+/// Invoke a BoJ cartridge tool (async).
+///
+/// `POST /cartridges/{cartridge}/invoke` — sends `{"tool": ..., "args": ...}`
+/// and returns the invocation result as a JSON string.
+#[tauri::command]
+pub async fn boj_live_invoke(
+    cartridge: String,
+    tool: String,
+    params: String,
+) -> Result<String, String> {
+    let endpoint = boj_endpoint();
+    let parsed_params: serde_json::Value =
+        serde_json::from_str(&params).unwrap_or(json!({}));
+    let body = json!({
+        "tool": tool,
+        "args": parsed_params,
+    });
+    let result: serde_json::Value = http_client::post_json(
+        &endpoint,
+        &format!("/cartridges/{}/invoke", cartridge),
+        &body,
+    )
+    .await
+    .map_err(|e| format!("Cartridge invoke failed: {}", e))?;
+    serde_json::to_string(&result).map_err(|e| format!("Serialization failed: {}", e))
+}
+
+/// Get BoJ topology / cartridge dependency graph (async).
+///
+/// `GET /topology` — returns the topology matrix as a JSON string.
+#[tauri::command]
+pub async fn boj_live_topology() -> Result<String, String> {
+    let endpoint = boj_endpoint();
+    let topology: serde_json::Value = http_client::get_json(&endpoint, "/topology")
+        .await
+        .map_err(|e| format!("Failed to get topology: {}", e))?;
+    serde_json::to_string(&topology).map_err(|e| format!("Serialization failed: {}", e))
+}
+
+/// Check if BoJ-server is reachable (async health probe).
+///
+/// Returns `{"reachable": bool, "endpoint": "..."}` as a JSON string.
+/// Panels use this for connection-dot indicators in the panel bar.
+#[tauri::command]
+pub async fn boj_live_check() -> Result<String, String> {
+    let endpoint = boj_endpoint();
+    let reachable = http_client::check_health(&endpoint, "/health").await?;
+    let url = std::env::var("BOJ_URL").unwrap_or_else(|_| DEFAULT_BOJ_URL.to_string());
+    Ok(json!({
+        "reachable": reachable,
+        "endpoint": url,
+    })
+    .to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Verify the endpoint builder respects BOJ_URL and strips trailing slashes.
+    #[test]
+    fn boj_endpoint_default_and_override() {
+        std::env::remove_var("BOJ_URL");
+        let ep = boj_endpoint();
+        assert_eq!(ep.base_url, DEFAULT_BOJ_URL);
+
+        std::env::set_var("BOJ_URL", "http://boj.local:9999/v2/");
+        let ep2 = boj_endpoint();
+        assert_eq!(ep2.base_url, "http://boj.local:9999/v2");
+        std::env::remove_var("BOJ_URL");
+    }
+}
@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+
+//! Shared HTTP client for backend service connections.
+//!
+//! Provides a common reqwest-based async HTTP client that all panel backends
+//! use to talk to external services (BoJ-server, VeriSimDB, ECHIDNA, etc.).
+//! Centralises timeout, error handling, and connection pooling.
+
+use serde::de::DeserializeOwned;
+use std::time::Duration;
+
+/// Default timeout for HTTP requests (10 seconds).
+const DEFAULT_TIMEOUT_SECS: u64 = 10;
+
+/// Service endpoint configuration.
+///
+/// Wraps a base URL and request timeout for a single backend service.
+/// Use [`ServiceEndpoint::new`] for defaults or chain [`ServiceEndpoint::with_timeout`]
+/// to customise the deadline per-service.
+pub struct ServiceEndpoint {
+    /// Base URL of the service, without trailing slash.
+    pub base_url: String,
+    /// Per-request timeout applied to every call through this endpoint.
+    pub timeout: Duration,
+}
+
+impl ServiceEndpoint {
+    /// Create a new endpoint with the default 10-second timeout.
+    ///
+    /// Trailing slashes are stripped from `base_url` to prevent double-slash
+    /// issues when paths are appended.
+    pub fn new(base_url: &str) -> Self {
+        Self {
+            base_url: base_url.trim_end_matches('/').to_string(),
+            timeout: Duration::from_secs(DEFAULT_TIMEOUT_SECS),
+        }
+    }
+
+    /// Override the default timeout (builder pattern).
+    pub fn with_timeout(mut self, secs: u64) -> Self {
+        self.timeout = Duration::from_secs(secs);
+        self
+    }
+}
+
+/// Make a GET request to a service endpoint and deserialise the JSON response.
+///
+/// # Errors
+///
+/// Returns a human-readable `String` error on:
+/// - Client construction failure
+/// - Network / timeout errors
+/// - Non-2xx HTTP status codes
+/// - JSON deserialisation mismatches
+pub async fn get_json<T: DeserializeOwned>(
+    endpoint: &ServiceEndpoint,
+    path: &str,
+) -> Result<T, String> {
+    let url = format!("{}{}", endpoint.base_url, path);
+    let client = reqwest::Client::builder()
+        .timeout(endpoint.timeout)
+        .build()
+        .map_err(|e| format!("Failed to create HTTP client: {}", e))?;
+
+    let response = client
+        .get(&url)
+        .send()
+        .await
+        .map_err(|e| format!("Request to {} failed: {}", url, e))?;
+
+    if !response.status().is_success() {
+        return Err(format!("HTTP {} from {}", response.status(), url));
+    }
+
+    response
+        .json::<T>()
+        .await
+        .map_err(|e| format!("Failed to parse response from {}: {}", url, e))
+}
+
+/// Make a POST request with a JSON body and deserialise the JSON response.
+///
+/// # Errors
+///
+/// Same failure modes as [`get_json`], plus serialisation of `body` and
+/// inclusion of the upstream response body in non-2xx error messages.
+pub async fn post_json<B: serde::Serialize, T: DeserializeOwned>(
+    endpoint: &ServiceEndpoint,
+    path: &str,
+    body: &B,
+) -> Result<T, String> {
+    let url = format!("{}{}", endpoint.base_url, path);
+    let client = reqwest::Client::builder()
+        .timeout(endpoint.timeout)
+        .build()
+        .map_err(|e| format!("Failed to create HTTP client: {}", e))?;
+
+    let response = client
+        .post(&url)
+        .json(body)
+        .send()
+        .await
+        .map_err(|e| format!("Request to {} failed: {}", url, e))?;
+
+    if !response.status().is_success() {
+        let status = response.status();
+        let body_text = response.text().await.unwrap_or_default();
+        return Err(format!("HTTP {} from {}: {}", status, url, body_text));
+    }
+
+    response
+        .json::<T>()
+        .await
+        .map_err(|e| format!("Failed to parse response from {}: {}", url, e))
+}
+
+/// Check if a service is reachable (simple health probe).
+///
+/// Uses a short 5-second timeout regardless of the endpoint's configured
+/// timeout — health checks should be fast or not at all.
+///
+/// Returns `Ok(true)` if the endpoint responds with 2xx, `Ok(false)` if
+/// the request fails or returns a non-success status.
+pub async fn check_health(
+    endpoint: &ServiceEndpoint,
+    health_path: &str,
+) -> Result<bool, String> {
+    let url = format!("{}{}", endpoint.base_url, health_path);
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(5))
+        .build()
+        .map_err(|e| format!("Failed to create HTTP client: {}", e))?;
+
+    match client.get(&url).send().await {
+        Ok(resp) => Ok(resp.status().is_success()),
+        Err(_) => Ok(false),
+    }
+}
@@ -92,10 +92,19 @@ mod security;
 /// Routes to ECHIDNA overlay FFI via V-lang adapter at OVERLAY_URL.
 mod overlay;
 
-/// BoJ — Barrel of Jelly cartridge runtime bridge.
+/// BoJ — Barrel of Jelly cartridge runtime bridge (blocking).
 /// Routes to BoJ server at BOJ_URL (default http://localhost:7700/api/v1).
 mod boj;
 
+/// BoJ Live — async BoJ-server connection via shared HTTP client (v0.2.0+).
+/// Async alternative to `boj::commands` using the shared `http_client` module.
+mod boj_live;
+
+/// Shared async HTTP client for backend service connections.
+/// Centralises timeout, error handling, and connection pooling for all
+/// panel backends (BoJ, VeriSimDB, ECHIDNA, Fleet, etc.).
+mod http_client;
+
 /// TypeLL — Type-Level Language server bridge.
 /// Routes to TypeLL server at TYPELL_URL (default http://localhost:7800/api/v1).
 mod typell;
@@ -2156,6 +2165,12 @@ fn main() {
             boj::commands::boj_topology,
             boj::commands::boj_invoke,
             boj::commands::boj_umoja_status,
+            // BoJ Live — async BoJ-server connection (v0.2.0)
+            boj_live::boj_live_health,
+            boj_live::boj_live_cartridges,
+            boj_live::boj_live_invoke,
+            boj_live::boj_live_topology,
+            boj_live::boj_live_check,
             // TypeLL — Type-level language server
             typell::commands::typell_health,
             typell::commands::typell_check,