Production server implementation plan — vhost tenancy platform

Authority doc (specs only — no execution). Registers the production-server implementation plan on the vault per Young's directive 2026-10-18, and consolidates the five lanes named in the task:

1. Sol's production-server implementation plan (Docker + container tenants, per-tenant vhost, Nuxt sites, Medusa + POS + EVE).
2. Tam + Nova redesign of the Pulse website (public) and the Docs website (private/password-gated) on the youngle tenant vhost.
3. Mira + Echo study of eve.dev/templates, medusajs.com/starters, nuxt.com/templates — new product offerings added to services-pricing-model-aud.md.
4. 2FA + account-management security layer — everyone shares thoughts.
5. Vault recording rule enforced: everything discussed/studied/designed is recorded on the vault in the correct folders.

This doc is the single registration point for that wave. Companion docs (named above) hold the detail; this doc holds the plan shape, ownership, phases, security layer, and the recording rule. Nothing here executes anything on prod.

0. Rulings locked in (Young, 2026-10-18)

1. Production server is the tenancy vhost platform. Docker + container tenants on 161.33.71.67. Pilot tenants: Young Le (youngle.au, Website + EVE) and Yukon IT (yukonit.com.au, Medusa + storefront + EVE + KB + docs vault).
2. Docs website (docs.youngle.au) is taken off and redesigned; only curated data syncs from LAB via git. No vault git repo on production (rule 12).
3. Pulse website moves into the tenant vhost (Tam assists Sol).
4. Tam + Nova redesign the Pulse site (public) and Docs site (private, password-gated) on the youngle tenant vhost.
5. Echo + Mira study Hostinger (and eve.dev/medusajs/nuxt templates) for product offerings and YukonIT plan.
6. Nova + Echo are Brain (Hermes) agents on LAB (ports 8314/8315, Telegram @NovaSolOS_bot / @EchoSolOS_bot) — not Heart Fleet. (See nova-echo-migration-brain-2026-10-18.md.)
7. Admin backend for YukonIT = hybrid: Nuxt UI Pro Dashboard (frontend admin)
   • Medusa V2 Admin (commerce backend) + EVE receptionist + KB. (See yukonit-admin-backend-study.md / admin-backend-choice-yukonit.md.)
8. Vault recording rule: everything discussed/studied/designed must be recorded on the vault in the correct folders (§5).

1. Sol's lane — production server implementation plan

1.1 Target state (prod 161.33.71.67)

Production (161.33.71.67)
├── docs.youngle.au          → Docus/Nuxt (redesigned, content from LAB only, auth-gated)
├── pulse.youngle.au         → Pulse website (tenant vhost, public)
├── yukonit.com.au           → existing hosting business site (theirs, untouched)
│   ├── shop.yukonit.com.au  → Medusa storefront (Next.js) + EVE chat
│   ├── admin.yukonit.com.au → Nuxt UI Pro Dashboard (tailnet by default)
│   └── help.yukonit.com.au  → KB / self-help (Docus)
├── youngle.au (apex)        → Landing page + EVE (showcase, currently HTTP 000 — gap)
└── Tenant containers        → Per-tenant Docker Compose (Medusa + POS + EVE + Hermes)

1.2 Node (measured, not assumed)

Tenant capacity: ~4 full stacks (4.8 GB each) or ~6 small tuned (3 GB each) on 23 Gi ARM. Pilot target 2–3 tenants alongside solos-docs/pulse. 5th tenant = new node (step-function in cost model). Oracle Always Free covers 2 OCPU + 12 GB; our node runs 4/24 — excess billable (~A$40–60/mo if credits expire; OCI console check outstanding, Mira).

1.3 Tenancy model (per-tenant Docker Compose project)

• Per-tenant Compose project, on a per-tenant bridge network, no host port publication. nginx proxies to container names on the tenant network.
• Port collisions become structurally impossible (not a checklist item).
• Admin panels bind to the tailnet interface, not public. Only nginx (80/443) is public; Postgres/Redis publish nothing.

Per-tenant compose shape:

docker network: tenant-<slug>  (bridge, isolated)
  ├── postgres:15-alpine      volume: pg-<slug>
  ├── redis:7-alpine          volume: redis-<slug>
  ├── medusa-server           WORKER_MODE=server,  DISABLE_MEDUSA_ADMIN=false
  ├── medusa-worker           WORKER_MODE=worker,  DISABLE_MEDUSA_ADMIN=true
  ├── storefront              Next.js (or Nuxt per tenant template)
  └── eve-agent               Nitro (self-hosted, eve build → eve start)

Resource ceilings per container (prevent noisy neighbour):

deploy:
  resources:
    limits:   { cpus: "1.0", memory: 2G }   # medusa-server
    # worker 0.5/1G · storefront 0.5/1G · pg 0.5/0.7G · redis 0.25/0.1G · eve 0.25/0.3G

Per-tenant ceiling ≈ 3.0 CPU / 5.1 GiB.

1.4 Four constraints (from docker-systems-design.md)

1. Builds are the real CPU risk — medusa build/Next.js builds spike on 4 shared vCPUs. Build once per template release; one shared image for all tenants; local registry container on the node; tenants pull. Never build per-tenant.
2. Disk is the long-term ceiling — 179 GB free; backups go offsite (node cannot be both host and backup target).
3. Existing services must not be disturbed — tenant vhosts added as new files in sites-enabled/, never editing the existing four (docs.youngle.au, pulse.youngle.au, sol.youngle.au, yukonit.youngle.au). TLS via existing letsencrypt pattern.
4. Tailscale is the private plane — tenant admin panels bind to tailnet by default; public storefront only through nginx.

1.5 Onboarding script (probe-gated, 10 steps)

1. Validate slug, check collisions.
2. Generate secrets (openssl rand -hex 32 × 4: COOKIE, JWT, DB, REDIS) → ~/.solos-tenants/<slug>/secrets.env, chmod 0600.
3. Render compose from template.
4. Create network tenant-<slug>.
5. docker compose up -d.
6. Run predeploy (db:migrate + link sync).
7. Create admin user (generated, stored 0600).
8. nginx vhost + certbot.
9. Health gate: /health OK AND /eve/v1/health OK AND admin loads.
10. Mark tenant live.

Nothing is "live" until step 9 passes. Same rule as Heart worker: a capability with no probe is not a deliverable.

1.6 Per-tenant stack (one template, fleet-managed)

Base: fork medusajs/dtc-starter (MIT). One template repo, version-tagged; all tenants pull.

Per tenant:

• Postgres 15 (own container + volume) — backup cron → offsite.
• Redis 7 (own container).
• Medusa server (WORKER_MODE=server, admin on).
• Medusa worker (WORKER_MODE=worker, admin off).
• Storefront (Next.js or Nuxt, per template).
• EVE agent (self-hosted Nitro, eve build → eve start).
• Agilo POS (client tablets) — client-side, connects to Admin REST API over HTTPS.

Multi-env: staging + production per client = two compose projects, same image tag, separate DBs/Redis. Cutover via cutover.sh (health-gated nginx upstream swap). Update pipeline: git tag → pull → predeploy (auto-migrate) → restart → health re-check. Rollback = prior tag (no schema rollback).

1.7 Secrets + isolation discipline

• .env.secrets.register per tenant, 0600, never in compose, never committed.
• Secrets via openssl rand -hex 32 (JWT, COOKIE, DB, REDIS, ADMIN TOKEN, EVE API KEY); publishable key read-scope, admin token write-scope HIL-gated.
• Per-tenant compose project namespacing (-p cib-<tenant>).
• Port register managed by onboarding script (.infra/ports.json), never hardcoded.
• ARM64 image policy — every image must be linux/arm64 (amd64 on ARM fails late looking like a config bug).
• Backups: nightly pg_dump per tenant → rclone gdrive: dated dir; weekly encrypted tar of infra/tenants/ + node config; restore drill quarterly (a backup never restored is not a backup).

1.8 Phase plan (from docker-implementation-plan.md)

Out of scope (yet): POS payments (Phase 2 of feature spec), POS offline mode, tenant billing/metering, multi-node scaling (5th tenant = new node).

1.9 Feature spec dependencies (Sol's lane, from 3in1-feature-spec-and-prod-prep.md)

Three build items (the ones Young named):

1. POS payments — Medusa Payment Provider module (AU-first Stripe, then second processor); cash + EFTPOS manual path shipped FIRST; card second phase; daily reconciliation job comparing Medusa order totals vs payment captures.
2. POS offline mode — offline queue with deliberate ceiling: held sales only, sync on reconnect, stock marked stale with cache timestamp. No offline card capture (would be a false feature).
3. Tenant provisioning + AI overage metering (Mira's guardrail) — per-tenant compose → seed → keys → EVE agent config → health check; conversation metering
   • per-tenant overage switch (tenant key or metered overage at cost + 20%).

Function backlog (F1–F9): tenant provisioning; backup + restore drill; AI conversation metering + overage switch; manual payment path + daily reconciliation; offline queue + idempotent replay; EVE version pin per tenant + upgrade path; HIL gate as a provable control (F7 — non-negotiable, gets a control, a probe, and a MUST-FAIL test, or it does not ship); alerting per-tenant health; connection pooling + resource ceiling per tenant compose.

1.10 Admin backend (YukonIT) — hybrid

Nuxt UI Pro Dashboard (frontend admin shell) + Medusa V2 Admin (commerce backend) + EVE receptionist + KB self-help + landing/domain/O365 packaging. Three consoles, one backend, zero licence friction. Medusa Admin ships free with the stack; Nuxt UI Pro Dashboard is the branded, sellable operator console (becomes OpsDashboard v2 product). EVE is customer-facing receptionist only (not admin tooling); HIL-gated writes; per-tenant memory scoping.

1.11 Heart Fleet on prod

Heart agents are portable (identity from registry, state = file tree, runtime = Hermes/OpenCode v2). Prod runs v3-heart-prod.service (active). Gap: no A2A listener on prod (83xx refuse) — a2a_server.py/serve.py exist in tree but are not installed as units (Sol/Tam to close). Prod opencode v2.0.27 at /home/ubuntu/.opencode/bin/opencode. Prod holds its own Console credentials → separate workspace billing from LAB (never summed).

1.5 Young's exact nginx vhost layout (authority, 2026-10-18)

nginx is the host-level entrypoint on 80/443 (TLS termination + reverse proxy). Every existing resident moves onto a vhost; sol.service is decommissioned.

Docker per-tenant architecture (no host ports)

nginx proxies by container DNS name on the tenant bridge network — no tenant publishes a host port. Port collisions become structurally impossible.

nginx (host, 80/443)
  |  proxy_pass http://medusa-<tenant>:9000   (container DNS on tenant network)
  v
docker network: tenant-<slug>  (bridge, isolated)
  +-- postgres:15-alpine      volume: pg-<slug>
  +-- redis:7-alpine          volume: redis-<slug>
  +-- medusa-server           WORKER_MODE=server,  DISABLE_MEDUSA_ADMIN=false
  +-- medusa-worker           WORKER_MODE=worker,  DISABLE_MEDUSA_ADMIN=true
  +-- storefront              Next.js (or Nuxt per tenant template)
  +-- eve-agent               Nitro (self-hosted)

nginx connects to tenant networks (docker network connect) and proxies by container name. Per-tenant ceiling: 3.0 CPU / 5.1 GiB — 4 tenants fit the measured budget with headroom. 5th tenant = new node (step-function in cost).

Cross-references

• 2fa-and-account-management.md — Authelia L1 gate + Medusa core MFA + account mgmt
• authelia-optimization.md — Authelia deployment design (Tam)
• docker-implementation-plan.md — Docker implementation steps
• docker-systems-design.md — Docker systems design (per-tenant Compose)
• ssh-access-matrix-security-2026-10-18.md — SSH access matrix + security model

2. Tam + Nova redesign — Pulse (public) and Docs (private) on youngle vhost

2.1 Young's directive (carried)

"Sol and Nova — First we need to take off Docs website docs.youngle.au. Redesign it and only sync data from LAB. No Vault is sync to Production Server."

"Tam assist Sol. Pulse Website will be moving into tenant vhost."

2.2 Docs website redesign (private, password-gated)

• docs.youngle.au is taken off (Sol + Nova + Tam lane).
• Redesign from scratch as a proper product site (not a vault mirror).
• Only sync data from LAB — vault content (markdown) is source of truth.
• NO vault sync to prod — vault git repo (.git, config, secrets) does NOT go to prod. Only rendered/content data (markdown → Docus content/) syncs LAB → prod.
• Password-gated (nginx auth_basic, existing young user) — private.
• Source: curated from LAB, not vault mirror.
• Content lane (verified working end-to-end): LAB vault → git push (solos-vault repo) → docs-site repo (youngframeworks/solos-docs, content/ tracked, 492 files) → prod git pull → sync-docus.sh build → nginx.

2.3 Pulse website redesign (public)

• pulse.youngle.au moves into the tenant vhost pattern (same as docs).
• Per-tenant nginx vhost + Docker container.
• Tam assists Sol.
• Pulse-site.service moves into a Docker container on a tenant network; remove host service.
• Public (not auth-gated).

2.4 Nuxt sites on prod (from prod-services-lane-redesign.md §5)

• docs.youngle.au — Docus (Nuxt 4 + Nuxt Content + Nuxt UI + Tailwind 4), auth-gated (401 by design).
• pulse.youngle.au — Docus (same stack), live, public.
• yukonit.youngle.au — vhost → :8012 (existing site).
• Showcase/apex youngle.au — MISSING (serves nothing); P5 marketing/landing is the gap to close (Nova + Echo lane).

All Nuxt sites are systemd services binding 127.0.0.1; nginx is the only public face. Tenant storefronts reuse the same pattern.

2.5 Lane assignments

3. Mira + Echo — product offerings (eve.dev, medusajs, nuxt)

3.1 Study basis

Young, 2026-10-17/18: study eve.dev/templates, medusajs.com/starters, nuxt.com/templates (and Hostinger) for product offerings. All repos live-verified via GitHub API (stars, licence, push date). Companion: vercel-platform-products-study.md, products-from-vercel-templates.md, hostinger-product-pricing-study.md.

3.2 Template landscape → our product line

Licence notes: Docus MIT; nuxt-ui-pro family MIT; Medusa MIT; Agilo MIT; EVE Apache-2.0 — clean end-to-end, sellable. vercel/ai-chatbot = NOASSERTION (check NOTICE before packaging). vercel/platforms has no LICENSE file — pattern-reference only; do not copy code into client deliverables; write the pattern ourselves in the tenant template. Saleor Paper (FSL-1.1-ALv2) excluded — not resellable as a product; Medusa choice is what makes the bundle sellable. Deliberately excluded: the 14 EVE Slack/iMessage agent templates (sell Slack agents — different product); all Shopify/Salesforce/Wix storefronts (platform lock).

3.3 Product catalogue (7 products, all riding Nuxt + Docker)

1. KnowledgeBase — Nuxt/Docus site + vault-mirror pipeline + domain + email. Client writes markdown (or talks to an EVE agent); we host and publish. Showcase: docs.youngle.au itself.
2. BusinessOnline — Landing (Nuxt UI Pro) + domain + Office365 + contact/agentic chat button. Entry tier.
3. Commerce+POS — Medusa v2 storefront + Agilo POS on tablets + EVE receptionist, per-tenant stack on our Docker design. Showcase: the YukonIT pilot.
4. AIAgent hosting — EVE (or ai-chatbot) instance per client with tenant-scoped memory + HIL gates. Bundled with 2/3; standalone for shops who have a site already.
5. OpsDashboard — Nuxt UI Pro Dashboard for internal fleet dashboards (v1), then client ops dashboards (v2).
6. Pulse/investing site — Docus (same stack as P1). Young's own lane (pulse.youngle.au).
7. Managed hosting — Docker per tenant (prod node). 4 tenants per node.

All seven ride the same stack (Nuxt/Nuxt UI + our Docker/hosting design) — the showcase story is coherent: "everything you see on docs.youngle.au is the same machinery your business runs on."

3.4 Tier ladder (AUD, from business-plan-v2)

3.5 New product offerings added to services-pricing-model-aud.md

See the updated Docs/Projects/vhost/decisions/services-pricing-model-aud.md — new section 8 adds the product offerings surfaced by the Mira + Echo study:

• KnowledgeBase managed hosting (Docus, bundled in Solo; standalone managed hosting at A$5/mo domain + A$1.32/mo storage + A$4–5/mo compute share).
• BusinessOnline landing (Nuxt UI Pro Landing, entry tier — domain + email packaged; A$5/mo domain + A$15/user/mo M365).
• AIAgent hosting standalone (EVE receptionist for shops who already have a site: A$7.29/mo benchmarked against Hostinger managed Hermes (AU page, 24-month term, renews A$17.39; global USD page $4.99/$11.99) — our price anchor A$49–79/mo tenant-tuned, POS-adjacent).
• OpsDashboard v2 (Nuxt UI Pro Dashboard, sellable client ops dashboard — pricing TBD at v2, internal v1 first).
• Pulse/investing site (Docus, Pulse lane — internal, not a sellable product).
• Managed hosting (P7) (Docker per tenant, A$5/mo domain + add-ons).

Add-on pricing for the new offerings is recorded in section 8 of the pricing model doc (domain A$5/mo, M365 A$15/user/mo, storage 20 GB A$1.32/mo, bandwidth A$0.00, compute A$4–5/tenant/mo shared, AI A$1.55–3.10/tenant/mo shared GO).

3.6 Hostinger benchmark (Mira + Echo, 2026-10-18)

🟠 Corrected 2026-10-21 (Echo) — see [hostinger-pricing-reverification-2026-10-21](hostinger-pricing-reverification-2026-10-21). Our figures came from Hostinger's global page while being labelled AU, and every price has since moved (Black Friday). AU entry is A$3.49 (renews A$15.89, 4.6×) and managed Hermes is A$7.29 (renews A$17.39) on the AU page.

Hostinger is the shape Yukon IT is trying to be. Key numbers: entry A$3.49/mo (3 websites on the entry plan, 48-month lock-in, renewal A$15.89 — 4.6×). Managed Hermes Agent hosting A$7.29/mo (24-month term, renews A$17.39; generic, no code customisation — corrected 2026-10-18 from $19.99, then corrected 2026-10-21 from $5.99, see [hostinger-managed-ai-verification](hostinger-managed-ai-verification)). We do not compete on raw hosting price (~34× their entry hosting; ~16× their agent entry); we sell an outcome (shop + POS + AI receptionist). Positioning correction: Solo must not be sold as "hosting"; sold as "a shop + POS + AI receptionist, running on infrastructure we manage." Full study: hostinger-product-pricing-study.md.

4. 2FA + account management security layer — everyone shares thoughts

4.1 Status

Specs only. The docker-implementation-plan.md references a separate note 2fa-and-account-management.md (to be created). This section captures the shared-thoughts baseline so the spec can be written. All lanes contribute.

4.2 Shared thoughts (recorded, not decided)

Sol (engineering):

• 2FA must be a provable control, not a convention — same discipline as F7 (HIL gate). Provisioning must be able to show it is armed; MUST-FAIL test or it does not ship.
• Per-tenant admin surfaces bind to tailnet by default; public exposure is an explicit opt-in decision, not a default.
• Secrets per tenant: .env mode 0600, never in compose, never committed; generated via openssl rand -hex 32. Publishable key read-scope; admin token write-scope HIL-gated.
• EVE auth: placeholderAuth() default rejects browser traffic; OIDC/JWT/Basic required for prod. Per-tenant memory scoping (file provider) so conversations do not leak between tenants.
• Medusa EE (RBAC) is commercial — we run on MIT core for pilot; RBAC is a feature a fleet-operated shop eventually wants. Plan for the licence boundary.

Mira (finance/commercial):

• Account management is a cost line: onboarding labour (2 hrs/tenant) is the real COGS, not infra. 2FA setup + recovery flows must be scripted into the onboarding script (step 7 "create admin user" + recovery runbook) or they become unbounded support load.
• Per-tenant M365 seats (A$15/user/mo) are the account-management surface for email; our Nuxt UI Pro Dashboard does not manage M365 — it links out to the M365 admin centre. We do not build an email admin surface.
• Billing/account lifecycle (suspend, downgrade, offboard) needs a defined runbook before tenant #1 goes live; otherwise offboarding is ad-hoc and risks data loss.

Nova (UI/UX):

• 2FA UX must be designed before build: enrolment flow, recovery codes, device management, session list, "sign out everywhere". These are the screens YukonIT staff actually touch; a generic Medusa /app admin is not enough for the operator experience we are promising.
• Admin console (Nuxt UI Pro Dashboard) is the account-management surface for YukonIT staff: tenants, support tickets, agent/fleet health, onboarding, revenue view. Must be branded (their logo/colours), not a generic admin.
• Auth-gated surfaces: admin.yukonit.com.au tailnet by default; docs.youngle.au nginx auth_basic (existing young user) for the private docs site.

Echo (marketing):

• Account security is a trust signal in marketing copy: "your data stays yours", per-tenant isolation, HIL-gated AI writes. The security layer is part of the pitch, not an afterthought.
• Public-facing comms must not overstate: EVE is beta (pin versions); POS payments manual path first; Oracle free-tier excess billable. Honesty in marketing = fewer support tickets later.

Tam (research):

• EVE's placeholderAuth() default rejects browser traffic; OIDC/JWT/Basic required for prod. This is the single most likely silent failure for a tenant storefront chat — must be in the health gate.
• Per-tenant memory scoping (file provider, tenant-scoped) is the SaaS hook; verify no cross-tenant leakage in the demo tenant before pilot.
• 2FA/account management should be studied against Hostinger's managed-agent isolation (their Hermes/OpenClaw offering) as a feature benchmark — not a security design spec.

4.3 What the spec must resolve (open, not decided)

1. 2FA method: TOTP (authenticator app) vs WebAuthn/passkeys vs both. Mobile-first for POS tablets (Agilo) implies TOTP at minimum.
2. Recovery flow: recovery codes (one-time, stored hashed) vs admin-reset via support ticket. Must not lock a tenant out permanently.
3. Account lifecycle: create (onboarding step 7) · suspend (non-payment) · offboard (data export + deletion, GDPR-adjacent even though AU-focused).
4. Session management: per-device sessions, "sign out everywhere", session expiry.
5. Audit log: who did what, when — needed for HIL-gated money movement and for compliance. Medusa core has basic; EE RBAC/audit is commercial (we are not using it at pilot). Decide whether we build a lightweight audit log ourselves.
6. Where the 2FA state lives: per-tenant (in their Postgres) vs central (our fleet). Recommendation: per-tenant, so a tenant's auth data is theirs and portable; central only for our own operator accounts.
7. Integration with M365: M365 admin is Microsoft's, not ours. We do not build an email 2FA surface; we rely on Microsoft's and document the link-out.

4.4 Recording obligation

The 2FA + account-management spec, when written, must be recorded on the vault in the correct folder (Docs/Projects/vhost/decisions/ or implementation/) and cross-linked from this doc. Until then, this section is the authority record of the shared thoughts.

5. Vault recording rule — enforced

5.1 Rule (Young's taxonomy, 2026-10-18)

From vault-structure-authority-2026-10-18.md and VAULT-INDEX.md rules 1–13:

1. Pulse/ = market trading and research only. No project docs, no SolOS V3, no client data.
2. Docs/ = everything else — SolOS V3 product, projects, vhosts, clients, infrastructure.
3. Docs/SolOSV3/ = our product only. No client data, no Pulse, no projects mixed in.
4. Docs/Projects// = one subfolder per client. Young Le and Yukon IT each get their own subfolder with their services.
5. Docs/SolOS/ = infrastructure only. Hosts, Subscription, Agents.
6. Docs/Projects/vhost/ = the tenancy platform — research, decisions, implementation. (Rule 11.)
7. No vault git repo on Production. Only rendered/content data syncs LAB → prod. (Rule 12.)
8. English only, in every document and every agent reply.
9. Nothing restated. A fact lives in one place; everything else derives. Restated facts are what drifted in both legacy SolOS and V2.
10. Never hand-edit a doc that a timer generates.
11. One live home per fact. Where two documents say the same thing, the richer one survived and the other moved to archive with its unique content folded in first.

5.2 Folder placement for this wave

5.3 Enforcement statement

Everything discussed, studied, or designed in this wave is recorded on the vault in the folders above. No spec, decision, study, or design lives only in chat, A2A messages, or agent memory. If a lane produces a new artifact (study, spec, decision, pricing update, security note), it lands in the correct folder before the lane reports "done". Min registers; Mira consolidates; Echo verifies. The recording rule is the gate, not a courtesy.

5.4 Verification

Echo's independent verification (vault-restructure-verification-2026-10-18.md) confirmed the restructure is real (git mv, history preserved) and flagged three unresolved items (vHost two homes, Fleet vs SolOSV3 naming, stale Docs/index.md nav, plus a live API key in a world-readable unit file on prod). Those remain open and are tracked separately; they do not block this registration.

6. Open items (not decided here)

1. OCI console check — trial credits vs PAYG, actual monthly burn (Mira).
2. youngle.au apex — DNS vs hosting (unverified HTTP 000).
3. YukonIT coexistence with their current platform (Sol integration question).
4. A2A listeners on prod — install a2a_server.py/serve.py units (Sol/Tam).
5. Wildcard vs per-domain TLS cert decision (Sol).
6. POS payments + offline mode (Sol feature spec; manual path first).
7. EVE beta hardening — pin @workflow/* per tenant (Sol spec; Ace builds).
8. MCP ruling — Young (OPEN-DECISIONS item 4).
9. 2FA + account-management spec — to be written (§4).
10. 2fa-and-account-management.md note creation (referenced by docker-implementation-plan.md §"Security layer").
11. Nova + Echo Hermes profiles creation + Telegram bot setup (Sol).
12. Hostinger managed-Hermes feature-set verification beyond public page (Echo). ✅ CLOSED 2026-10-18 — [hostinger-managed-ai-verification](hostinger-managed-ai-verification). Feature set verified (AI credits included, Telegram/WhatsApp connectivity, 24/7 isolated env, BYO ChatGPT subscription). Found and corrected a 3.3× price error: Hostinger managed Hermes/OpenClaw is $5.99/mo (24-mo term, renews $11.99), not $19.99. Corrected in this doc, the Hostinger study, and services-pricing-model-aud.md §8.3/§8.9.

    🟠 And corrected again 2026-10-21 (Echo) — re-verification found the $5.99 figure is itself gone: live price is $4.99 (global) / A$7.29 (AU, renews A$17.39), and our "AU pricing" figures had been read off the global page all along (AU entry is A$3.49, not A$4.39). Full audit: [hostinger-pricing-reverification-2026-10-21](hostinger-pricing-reverification-2026-10-21).

7. Register note

This doc registers the production-server implementation plan on the vault: Docker + container tenants, per-tenant vhost, Nuxt sites, Medusa + POS + EVE; Tam + Nova redesign of Pulse (public) and Docs (private/password-gated) on the youngle tenant vhost; Mira + Echo product-offerings study (eve.dev/templates, medusajs.com/starters, nuxt.com/templates) with new offerings added to services-pricing-model-aud.md; 2FA + account-management security layer shared thoughts; and the vault recording rule enforced. Specs only — no execution.

Companion: docker-implementation-plan.md (phases), prod-redesign-pilots-2026-10-18.md (authority), vercel-platform-products-study.md (template landscape), yukonit-admin-backend-study.md (hybrid backend), hostinger-product-pricing-study.md (benchmark).

Lane: Min registers · Sol builds · Mira finances · Nova designs · Echo markets · Tam researches. Young rules.