[dskvr]

The normal entrypoint now boots a provider-neutral CVM service from mounted configuration and secrets. The repository supplies portable container definitions, configuration examples, migrations and verification tools. Host inventories and deployment automation belong in an operator-owned repository.

Changes

• Reuses existing funding, metering, continuation, worker, verification, preview and publication services.
• Adds explicit canonical migrations and immutable separation of test and real-money databases.
• Supports receive-only Lightning funding, allowlisted Cashu mints and metered OpenAI Responses usage.
• Provides a single-host Compose stack with PostgreSQL, relay, gVisor build engine and optional TLS ingress, plus backup/isolated restore tooling.
• Packages the required runtime assets, preview dependencies, Docker CLI and pinned Chromium. Startup diagnostics preserve the missing-config error while redacting arbitrary exception text; health checks use /health.
• Retains generated compiler failures and sends the exact failed source plus bounded diagnostic back for one separately metered correction within the signed maximum. A signed revision can explicitly approve recovery when more budget is required; uncertain provider calls are never retried.
• Uses the pinned Paja host composition for live OUTBOX and browser-backed preview domains, with reachable host controls and artifact-scoped state. A failed revision refresh preserves the existing iframe.
• Gives both API and OAuth generation actual callable napplet skill resources and read-only Nostrbook MCP tools through a bounded conversation. Confirmed turns retain immutable usage evidence; cumulative limits and uncertainty fences cover the entire operation.
• Adds pinned, licensed GSAP/Three.js guidance and frozen offline worker dependencies, with a real sandboxed visual test. OAuth's new profile explicitly includes the output allowance for tool continuations in its displayed approval maximum.
• Documents portable installation and configuration without private repositories, machine names or operator commands. Machine-specific runtime overlays and live smoke tests are maintained outside this repository.

Validation
The authoring update passes 81 focused tests (416 assertions), pinned TypeScript, four real PostgreSQL migration/evidence checks, four SQL proposal/receipt integration checks, real compiled Nostrbook documentation reads, and a fully offline Three.js/GSAP worker plus artifact/Chromium test. OAuth, interrupted-generation recovery and returning-project browser journeys pass with real relay, SQL, Docker worker and Paja components; model transport is deterministic in these tests. The application revision passes eleven hosted checks. The GUI rerun includes corrected legacy gross/net Cashu funding fixtures; all remaining browser cases also pass in an isolated Linux runtime. Hosted checks are running for the test update. These results do not establish real-money launch readiness.

Remaining launch gaps / review focus

• Pricing refresh changes identifiers required by pending-action resume; retained pricing and recovery across refresh/interrupted calls need verification.
• Admission currently has no finite slot limit. Bounded capacity and acceptance-to-isolation p95 require implementation and concurrent-load proof.
• Each operator must configure encrypted off-host backup collection and verify scheduled restoration.
• Real-money operation requires actual receive-only payment credentials, two real mints, public ingress and a fresh real-realm database, followed by a bounded verified flow.