Add var.ui_gateway_url so config.js can target the Fusion listener instead of the backend /demo. Set to the Fusion /tokenize endpoint; the browser now runs the full flow through the gateway (guardrail -> tokenize -> agent -> restore). Requires Fusion to return CORS for the CloudFront origin (done). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>