commit f850002f1c562838f67cd40ae1403cfb85949203
Author: George Lambert <marchon@gmail.com>
Date:   Mon Sep 14 13:50:45 2026 -0400

    Add developer credentials: URLs, lab keys, NATS token, staff IAM, git

diff --git a/00-sources.md b/00-sources.md
new file mode 100644
index 0000000..25e9d8d
--- /dev/null
+++ b/00-sources.md
@@ -0,0 +1,55 @@
+# Sources (other documentation that names routes)
+
+This inventory is compiled from code and from these docs. Do not invent extra `verae.*` names.
+
+## Master maps
+
+| Path | What it names |
+|------|----------------|
+| `packages/docs-master/modules-and-nats.md` | Module catalog, subject table, HTTPS vs NATS |
+| `packages/docs-master/MESSAGE-FLOWS.md` | Create/wait/includeAttached/batch Merkle |
+| `packages/docs-master/archive-nats.md` | Archive put/query/reply |
+| `docs/02-architecture/nats-subjects.md` | `verae.zapier.*` payloads + streams |
+| `docs/02-architecture/modules-and-nats.md` | Same catalog as docs-master |
+| `docs/02-architecture/overview.md` | Poller / events / webhooks |
+| `packages/overview/03-nats-cluster.md` | Cluster URLs, who may connect |
+| `packages/overview/06-address-routing.md` | Address pattern + plane mapping |
+| `packages/verae-ops/06-linking-services.md` | How services attach |
+| `packages/verae-nats-cluster/scripts/ensure-streams.sh` | Live stream create |
+| `packages/verae-nats-cluster/conf/nats.conf.tmpl` | `:4222` / `:6222` / `:7422` / monitor `:8222` |
+| `packages/verae-nats-cluster/conf/public-edge.conf.tmpl` | Public leaf `:4222`, WS `:14422` |
+| `packages/verae-fleet/overlays/ns1/fleet.json` | Enabled vs in-process workers |
+| `packages/verae-keep` `units.px-worker.json` | Worm/tree on LXC 510 |
+| `packages/verae-zapier-middleware/src/nats/subjects.js` | Product subjects + consumers |
+| `packages/zappier-account-balance/src/subjects.js` | Billing subjects |
+| `packages/verae-access-authz/src/subjects.js` + `policy.js` | Authz + plane allow lists |
+| `packages/zappier/src/billing-nats.ts` | Edge billing client |
+
+## Per-package `NATS.md` (Forgejo module copies also live under `docs-master/modules/`)
+
+| Package | Addresses |
+|---------|-----------|
+| `verae-zapier-middleware` | `jobs.watch` out, `jobs.events` in, archive.query via aggregator |
+| `verae-jobs-events` | `jobs.events`; exclusive → `verae.internal.jobs.events` |
+| `verae-request-splitter` | `archive.put` |
+| `verae-archive-worm` | `archive.put` / `query` / `reply.<id>` |
+| `verae-tree-node` | same, `kind: tree` |
+| `verae-archive-aggregator` | `query` out, `reply.<id>` in |
+| `zappier-account-balance` | `verae.billing.*` |
+| `zappier` (edge) | package `NATS.md` is stale (“does not publish”); **code** publishes usage/payment/credit/customer.put when `NATS_URL` is set. Use `docs-master/modules/zappier/NATS.md` |
+| `zappier-customer-service` | `statement.get`, `balance.adjust` |
+| `zappier-sales-pricing` | `statement.get` |
+| `zappier-accounting-export` | `statement.get` |
+| `zappier-identity` | `identity.bind` / `lookup` |
+| `verae-access-authz` | `authz.check` / `authz.deny` |
+| `verae-access-web` | `access.web.in` / `access.web.billing.*` |
+| `verae-access-api` | `access.api.*` |
+| `verae-access-zapier` | `access.zapier.*` then HTTPS to middleware |
+| `verae-access-leaf` | `access.leaf.in` |
+| `verae-access-staff` | `access.staff.*` |
+| `verae-nats-process` | `verae.example.process.*` (template) |
+| `verae-nats-accounts` | policy only (INTERNAL vs LEAF) |
+| `verae-zapier-simulator` | in-process replay of product addresses |
+| `verae-keep` / `verae-fleet` / `verae-uptime` / `verae-backup` | no product subjects |
+
+Simulator `src/pipeline.js` and `src/monitors.js` list the same product addresses for traces; they are not live subscribers.
diff --git a/01-nats-routes.md b/01-nats-routes.md
new file mode 100644
index 0000000..34a4758
--- /dev/null
+++ b/01-nats-routes.md
@@ -0,0 +1,106 @@
+# Designed vs running NATS routes
+
+**Designed** = named in docs or in code.  
+**Running** = a process on NS1 is subscribed or publishing it **today**, and (for durable work) a JetStream stream exists.
+
+Cluster name `verae`. Internal clients use the three LXC on `vmbr1`. Public edge is a **leaf**, not a second cluster.
+
+Legend: **JS** = JetStream stream; **RR** = core request-reply; **pub** = core or JS fire-and-forget; **Q** = queue group.
+
+## Transport (TCP / leaf / public)
+
+These are NATS **server** routes, not `verae.*` subjects.
+
+| Endpoint | Designed | Running | Who |
+|----------|----------|---------|-----|
+| `10.10.10.21–23:4222` client | yes | **yes** | middleware, access-*, billing, worm/tree, identity, CS/sales/acct |
+| `10.10.10.21–23:6222` cluster routes | yes | **yes** (private `vmbr1` only) | nats-a/b/c to each other |
+| `10.10.10.21–23:7422` leaf hub | yes (public-edge) | **yes** | public edge remotes |
+| `127.0.0.1:8222` monitor on each LXC | yes | **yes** | operators on the guest |
+| `70.88.205.138:4222` public client | yes (token) | **yes** | leaf edge; **not** Zapier |
+| `127.0.0.1:14422` WS on edge | yes | **yes** | Caddy → `wss://nats.zapier.georgelambert.org` |
+| `127.0.0.1:8229` edge monitor | yes | **yes** | host loopback |
+| `:6222` / `:7422` / `:8222` on `vmbr0` | **no** | **must stay closed** | — |
+| Host leftover `127.0.0.1:4222` (docker-proxy) + `10.10.10.1:4222` socat | lab leftover | present | **do not** point product `NATS_URL` here |
+| MQTT `:1883` | study only | **removed** | — |
+
+Internal keep/fleet/middleware URL:
+
+```text
+nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+```
+
+Public (token in `/etc/nats/public-edge.token` on NS1): `nats://<token>@70.88.205.138:4222`. Isolation on the hub is still `$G` + private LAN. nkeys/mTLS sketched in `verae-nats-accounts`, **not** flipped.
+
+## JetStream streams (running)
+
+Created by `verae-nats-cluster/scripts/ensure-streams.sh` (middleware `ensureStreams` also creates the first three).
+
+| Stream | Subjects | Replicas | Storage | Who consumes |
+|--------|----------|----------|---------|--------------|
+| `ZAPIER_JOBS` | `verae.zapier.jobs.watch` | 3 | file | job-poller (in middleware process), Q `job-poller` |
+| `ZAPIER_EVENTS` | `verae.zapier.jobs.events` | 3 | file | middleware wait + webhook router (`event-webhook-router`); optional exclusive `jobs-events` |
+| `ZAPIER_WEBHOOKS` | `verae.zapier.webhooks.deliver` | 3 | file | webhook-deliver (in middleware), Q `webhook-deliver` |
+| `ZAPIER_USAGE` | `verae.zapier.usage` | 3 | file | **no durable consumer** (`USAGE_WRITER` named only) |
+| `VERAE_ARCHIVE` | `verae.archive.>` | 3 | file | worm + tree on LXC 510 (keep); aggregator **not** fleet-enabled |
+
+Billing is **core request-reply / pub**, not a JetStream stream.
+
+## Address inventory
+
+| Address | Kind | Designed | Running | Notes |
+|---------|------|----------|---------|-------|
+| `verae.zapier.jobs.watch` | JS work Q `job-poller` | yes | **yes** | middleware publishes; in-process poller consumes |
+| `verae.zapier.jobs.events` | JS events | yes | **yes** | poller publishes; wait() subscribes; webhook worker routes |
+| `verae.zapier.webhooks.deliver` | JS work Q `webhook-deliver` | yes | **yes** | same Node process as HTTP |
+| `verae.zapier.usage` | JS optional | yes | stream **yes**, consumer **no** | middleware entitlement is **local files** |
+| `verae.internal.jobs.events` | core republish | yes (`jobs-events` exclusive) | **partial** | only if `JOBS_EVENTS_EXCLUSIVE=1` |
+| `verae.billing.statement.get` | RR Q `account-balance` | yes | **yes** | portal, CS, sales, accounting, access-web/api |
+| `verae.billing.balance.get` | RR | yes | **yes** | account-balance |
+| `verae.billing.balance.adjust` | RR | yes | **yes** | CS credits, portal reload |
+| `verae.billing.usage.recorded` | pub | yes | **yes if edge `NATS_URL` set** | `zappier/src/app.ts` `onUsage` → `natsPublish`; account-balance subscribes |
+| `verae.billing.payment.recorded` | pub | yes | **yes if `NATS_URL`** | portal reload (`portal.ts`) |
+| `verae.billing.credit.applied` | pub | yes | **yes if `NATS_URL`** | admin/CS (`admin.ts`) |
+| `verae.billing.customer.put` | pub | yes | **yes if `NATS_URL`** | `ledger.ts`; account-balance applies |
+| `verae.access.authz.check` | RR Q `access-authz` | yes | **yes** | fleet keepFloor |
+| `verae.access.authz.deny` | pub audit | yes | **yes** (on deny) | no SIEM sink |
+| `verae.access.web.in` / `verae.access.web.billing.*` | ingress | yes | **yes** | mapped after authz, e.g. `verae.access.web.billing.statement.get` |
+| `verae.access.api.*` | ingress | yes | **yes** | |
+| `verae.access.zapier.*` | ingress | yes | **yes** | HTTPS plane; Zapier never speaks NATS |
+| `verae.access.leaf.in` / `verae.access.leaf.*` | ingress | yes | **yes** | no billing |
+| `verae.access.staff.*` | ingress | yes | **yes** | CS/sales/accounting |
+| `verae.identity.bind` | RR Q `identity` | yes | **yes** | fleet |
+| `verae.identity.lookup` | RR Q `identity` | yes | **yes** | |
+| `verae.archive.put` | JS (`VERAE_ARCHIVE`) | yes | **partial** | splitter **in-process** in middleware; worm/tree on 510 consume |
+| `verae.archive.query` | broadcast (no Q) | yes | **partial** | live aggregator hook **TBD** in middleware (simulator has it) |
+| `verae.archive.reply.<id>` | replies on bloom hit | yes | **partial** | worm/tree on 510 can reply; aggregator not fleet-enabled |
+| `verae.splitter.in` | future | yes (docs) | **no** | splitter stays a library |
+| `verae.example.process.in` / `.out` / `.reply.*` | template | yes | **no** | `verae-nats-process` is a model |
+| `bench.*` | lab only | n/a | ephemeral | speed studies; not product |
+
+Plane mapping (`verae-access-authz`): internal `verae.billing.statement.get` + plane `web` → ingress `verae.access.web.billing.statement.get`. Planes never publish internal subjects until `authz.check` returns allow.
+
+## Durable consumers (named in middleware)
+
+| Name | Stream / subject | Running |
+|------|------------------|---------|
+| `job-poller` | `ZAPIER_JOBS` / `jobs.watch` | **yes** (in-process) |
+| `event-webhook-router` | `ZAPIER_EVENTS` / `jobs.events` | **yes** (in-process) |
+| `webhook-deliver` | `ZAPIER_WEBHOOKS` / `webhooks.deliver` | **yes** (in-process) |
+| `usage-writer` | `ZAPIER_USAGE` / `verae.zapier.usage` | **no** |
+| `jobs-events-exclusive` | `ZAPIER_EVENTS` | **no** unless `JOBS_EVENTS_EXCLUSIVE=1` |
+
+## Fleet overlay vs in-process
+
+`packages/verae-fleet/overlays/ns1/fleet.json` (2026-09-14):
+
+| Service | fleet `enabled` | Actual lab |
+|---------|-----------------|------------|
+| middleware-http | true | **running**; starts job-poller + webhook workers in-process when `NATS_ENABLED` |
+| job-poller | **false** | covered by middleware; do not spawn a second copy |
+| webhook-deliver | **false** | same |
+| archive-aggregator | **false** | **not** running as a fleet worker |
+| archive-worm / tree-node | **false** on host fleet | **running on LXC 510** via keep `units.px-worker.json` (1 worm + 1 tree) |
+| account-balance, access-*, identity, jobs-events, CS/sales/acct, staff-iam/session, zappier-edge | true keepFloor | keepFloor |
+| zapier-simulator | true, keepFloor false | optional |
+| nats | managed false | 3-node cluster + leftover host loopback |
diff --git a/02-endpoint-io.md b/02-endpoint-io.md
new file mode 100644
index 0000000..38d1e5f
--- /dev/null
+++ b/02-endpoint-io.md
@@ -0,0 +1,154 @@
+# Endpoint I/O
+
+Each product NATS address: **what it is for**, **who sends**, **who receives**, **how to attach**.
+
+Connect with a **long-lived** client (reconnect-per-message is the anti-pattern):
+
+```text
+NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+```
+
+Public edge (token in `/etc/nats/public-edge.token` on NS1): `nats://<token>@70.88.205.138:4222`. Do not put that URL in Zapier or in Verae.
+
+---
+
+## `verae.zapier.jobs.watch`
+
+| | |
+|--|--|
+| For | Work queue: “poll Verae until this `jobId` is terminal.” |
+| In from | middleware `enqueueWatch` after `POST /api/timestamp` (or mock) returns `jobId` |
+| Out to | job-poller worker (queue `job-poller`, durable on `ZAPIER_JOBS`) |
+| Then | poller calls Verae `GET /api/status/{jobId}` over **HTTPS**, not NATS |
+
+Payload: `tenantId`, `veraeUserId`, `jobId`, `tokenRef`, `enqueuedAt`, `attempt`, `maxAttempts`, `intervalMs`, `traceId`. JWT stays in middleware (`tokenRef`); never on Zapier.
+
+**Connect Verae-side:** do **not** subscribe this from `api.veraetime.net`. The poller is the Verae HTTP client. To add another watcher, start another `job-poller` consumer in the same queue group.
+
+---
+
+## `verae.zapier.jobs.events`
+
+| | |
+|--|--|
+| For | Terminal outcomes: `timestamp.completed` / `failed` / `timeout` |
+| In from | job-poller after Verae status is not `pending` |
+| Out to | (1) middleware `waitForJobEvent` (wait HTTP); (2) webhook router → `webhooks.deliver`; (3) optional `verae-jobs-events` mailbox `:3030` |
+
+If `JOBS_EVENTS_EXCLUSIVE=1`, only `verae-jobs-events` is the durable consumer and republishes `verae.internal.jobs.events`. Default lab: middleware wait + webhook worker share the stream.
+
+Payload: `event`, `tenantId`, `jobId`, `status`, `traceId`, `emittedAt`.
+
+---
+
+## `verae.zapier.webhooks.deliver`
+
+| | |
+|--|--|
+| For | HTTPS POST to `hooks.zapier.com` (REST Hook) |
+| In from | webhook worker on completed/failed events |
+| Out to | Zapier cloud **HTTPS**, never NATS |
+
+Payload: `hookId`, `tenantId`, `targetUrl`, `event`, `payload`, `attempt`, `traceId`. Slow consumer: keep replica floors on the worker if you split it out of middleware.
+
+---
+
+## `verae.zapier.usage`
+
+| | |
+|--|--|
+| For | Optional meter of Zap actions on NATS (JetStream) |
+| In from | designed: middleware / edge |
+| Out to | designed: `USAGE_WRITER` → books |
+| Running | **stream exists; no writer; middleware uses local usage files** |
+
+Prepaid meter that **is** wired uses `verae.billing.usage.recorded` (core pub), not this stream. Finish: either publish here from `recordUsage` or drop the stream.
+
+---
+
+## Billing (`verae.billing.*`) — account-balance source of truth
+
+Request-reply unless noted. Queue `account-balance`. **Not** JetStream.
+
+| Address | For | In from | Out to |
+|---------|-----|---------|--------|
+| `statement.get` | prepaid, credits, usage, payments | portal, CS, sales, accounting, access-web/api | reply to requester |
+| `balance.get` | cents only | internal | reply |
+| `balance.adjust` | CS credit or portal reload | CS, access-web (reload kind only) | books + reply |
+| `usage.recorded` | meter pub | zappier-edge `meter()` `onUsage` when `NATS_URL` set | account-balance subscriber (debits prepaid) |
+| `payment.recorded` | reload/invoice pub | portal | books |
+| `credit.applied` | goodwill pub | CS/admin | books |
+| `customer.put` | upsert customer | edge ledger | books |
+
+Authz **must** pass `verae.access.authz.check` before these from a public plane. Leaf plane **cannot** call billing (policy).
+
+Middleware `recordUsage` still writes **local tenant files** and does **not** publish `usage.recorded`. Two meters until that is unified.
+
+---
+
+## Access planes
+
+| Address | For | In | Out |
+|---------|-----|----|-----|
+| `verae.access.authz.check` | allow/deny `{ plane, subject, principal }` | every plane + edge `billing-nats.ts` | `{ allow, reason }`; deny also pubs `authz.deny` |
+| `verae.access.authz.deny` | audit | authz on deny | **nowhere yet** (no SIEM) |
+| `verae.access.web.in` / `verae.access.web.billing.*` | browser portal | access-web HTTP | `statement.get` / `balance.adjust` kind=reload after authz |
+| `verae.access.api.*` | customer `x-api-key` | access-api | statement; HTTPS to middleware for jobs |
+| `verae.access.zapier.*` | Zapier HTTPS only | access-zapier | jobs.watch **via HTTP to middleware**, not Zapier NATS; usage.recorded allowed by policy |
+| `verae.access.leaf.in` | S2S `{ token, target, payload }` | remote leaf | archive + jobs after authz; **never billing** |
+| `verae.access.staff.*` | CS/sales/accounting | access-staff | billing after authz |
+
+Ingress mapping: `accessAddress(plane, 'verae.billing.statement.get')` → `verae.access.<plane>.billing.statement.get`.
+
+---
+
+## Identity
+
+| Address | For | In | Out |
+|---------|-----|----|-----|
+| `verae.identity.bind` | bind email/customerId → `veraeUserId` | portal / middleware | reply |
+| `verae.identity.lookup` | lookup by customerId or veraeUserId | same | reply |
+
+Queue `identity`. Fleet keepFloor.
+
+---
+
+## Archive / tree
+
+| Address | For | In | Out |
+|---------|-----|----|-----|
+| `verae.archive.put` | WORM/tree write (`kind`: publicMeta / privateMeta / file / tree) | splitter (in-process from middleware today) | every worm/tree (JS) |
+| `verae.archive.query` | broadcast lookup | aggregator | **all** worm/tree, **no** queue group |
+| `verae.archive.reply.<correlationId>` | bloom **hit only** | worm/tree | aggregator |
+
+Silence = miss. Chain seal does not wait on archive. Bytes never go to the chain.
+
+---
+
+## Template / unused
+
+| Address | For | In | Out | Running |
+|---------|-----|----|-----|---------|
+| `verae.splitter.in` | future split-out splitter process | middleware | splitter | **no** |
+| `verae.example.process.in` | template worker | any | `example-process` Q | **no** |
+| `verae.example.process.out` | template fan-out | template | peers | **no** |
+| `verae.example.process.reply.<id>` | template reply | template | requester | **no** |
+| `verae.internal.jobs.events` | exclusive mailbox republish | jobs-events | wait/webhook | **no** unless env |
+
+---
+
+## How to connect **Verae API** to NATS
+
+`api.veraetime.net` is **HTTPS**. It does not subscribe. The glue is middleware:
+
+1. Set `VERAE_API_BASE_URL=https://api.veraetime.net` and `MOCK_VERAE=false`.
+2. Middleware login (username/password) → JWT stored as `tokenRef`.
+3. `POST /api/timestamp` → 202 `{ jobId }`.
+4. Publish `verae.zapier.jobs.watch`.
+5. Poller `GET /api/status/{jobId}` until `completed` / `failed`.
+6. Publish `verae.zapier.jobs.events`.
+7. Wait HTTP and/or REST Hook.
+
+Do **not** point Verae at `NATS_URL`. Do **not** put NATS in Zapier env. A new worker that must see seals uses `jobs.events` or HTTP `GET /zapier/v1/status/{jobId}`.
+
+Template for a new addressed process: clone `verae-nats-process`, rename `verae.example.process.*`, add the subject to `verae-access-authz` policy for the plane that may call it.
diff --git a/03-zapier-verae-path.md b/03-zapier-verae-path.md
new file mode 100644
index 0000000..a0c16de
--- /dev/null
+++ b/03-zapier-verae-path.md
@@ -0,0 +1,125 @@
+# Zapier → Verae API → Zapier
+
+How a timestamp job is submitted, watched, and returned. Lab today: `MOCK_VERAE=true`. Live path is the same HTTP contract with `MOCK_VERAE=false`.
+
+## Rule
+
+```text
+Zapier cloud  --HTTPS only-->  zap.zapier.georgelambert.org  (access-zapier)
+                                    |
+                                    v HTTPS
+                              middleware :3100 /zapier/v1
+                                    |
+                    +---------------+----------------+
+                    | HTTPS                         | NATS (private cluster)
+                    v                               v
+            api.veraetime.net              jobs.watch → poller
+            POST /api/timestamp            GET /api/status/{jobId}
+            GET  /api/status/{jobId}              |
+            POST /api/verify                      v
+                                           jobs.events
+                                              |
+                         +--------------------+--------------------+
+                         | wait subscriber                         | webhook-deliver
+                         v                                         v
+                    HTTP response to Zap                    POST hooks.zapier.com
+```
+
+Zapier never has `NATS_URL`. Verae never has `NATS_URL`.
+
+## 1. Submit (async create)
+
+1. Zap action **Create Timestamp** (or curl) `POST https://zap.zapier.georgelambert.org/zapier/v1/timestamp` with portal API key `zmw_…` (not a Verae JWT).
+2. access-zapier / edge: authz, then `meter()` records cents; if `NATS_URL` is set, `natsPublish(verae.billing.usage.recorded)`.
+3. Forwards to middleware `POST /zapier/v1/timestamp`.
+4. Middleware `checkEntitlement` (local plan limits today).
+5. `veraeClient.createTimestamp`:
+   - **Mock:** in-process job, fake `jobId`.
+   - **Live:** `POST https://api.veraetime.net/api/timestamp` with JWT → **202** `{ jobId }`.
+6. Splitter (in-process): hash vs attachments; optional `verae.archive.put` (bytes never go to chain).
+7. `enqueueWatch` → JetStream **`verae.zapier.jobs.watch`**.
+8. HTTP **202** `{ jobId, sha256, existing }` back to Zapier immediately.
+
+Same SHA-256 is idempotent (`existing: true`).
+
+## 2. Monitor (job poller)
+
+The poller is **in the middleware Node process** when `NATS_ENABLED=true` (`startJobPollerWorker`). Fleet does **not** spawn a second copy (`job-poller.enabled: false`).
+
+1. Durable consumer `job-poller` on `ZAPIER_JOBS` / `verae.zapier.jobs.watch`.
+2. Resolve `tokenRef` → tenant Verae password → `POST` login → JWT (stays in middleware).
+3. `GET /api/status/{jobId}` (mock or live timestamp server).
+4. `pending` → `nak` after `intervalMs` (retry).
+5. `completed` → publish `jobs.events` `{ event: timestamp.completed, status, jobId, tenantId, traceId }`.
+6. `failed` → `timestamp.failed`. Too many attempts → `timestamp.timeout`.
+7. `ack` the watch message.
+
+Live OpenAPI: poll until `completed` / `failed`. Hash lookup is **501** on live (`lookupHash`). Map `certificate`, `timestamp`, `blockIndex`, `sha256` into the receipt Zap samples expect.
+
+## 3. Wait (sync Zap step)
+
+**Create Timestamp and Wait** → `POST /zapier/v1/timestamp/wait`.
+
+1. Same as submit (watch is already on NATS).
+2. `waitForJobEvent(jobId, WAIT_TIMEOUT_MS)` subscribes to **`verae.zapier.jobs.events`**.
+3. On matching `jobId` event: return status JSON (certificate / receipt).
+4. On timeout: `{ status: pending, jobId }` so the REST Hook can finish the Zap.
+
+`includeAttached`: after seal, aggregator should `verae.archive.query`; bloom hits merge extra receipts. **Simulator does this; live aggregator hook is TBD.**
+
+## 4. Push back to Zapier
+
+- **Wait response:** HTTP body on the same Zap step.
+- **REST Hook:** Zapier subscribes `POST /zapier/v1/hooks`. On `jobs.events`, middleware enqueues **`verae.zapier.webhooks.deliver`**. Worker POSTs `targetUrl` (`hooks.zapier.com`).
+- **Poll status:** Zap action **Find Job Status** → `GET /zapier/v1/status/{jobId}` → middleware `GET` Verae (or last event).
+
+## 5. Verify
+
+`POST /zapier/v1/verify` → middleware → Verae `POST /api/verify`. No job watch.
+
+## 6. Batch Merkle (designed; same bus)
+
+From `MESSAGE-FLOWS.md`:
+
+1. `POST /v1/timestamp/batch` — one item per line.
+2. Middleware hashes leaves, builds Merkle tree.
+3. Chain seals **only the root** (`POST /api/timestamp` on the root).
+4. Each leaf proof → `verae.archive.put` `kind: tree`.
+5. Central hash lookup of a leaf misses unless `includeTree=true`.
+6. Aggregator broadcasts `verae.archive.query` `kinds=["tree"]`.
+7. Tree node bloom hit → `archive.reply.<id>` with proof.
+
+Live wait path does not yet call the aggregator, so tree-leaf receipts are not merged on NS1.
+
+## Connect live `api.veraetime.net`
+
+Still blocked on operator bind credentials. When ready:
+
+```bash
+# middleware env
+MOCK_VERAE=false
+VERAE_API_BASE_URL=https://api.veraetime.net
+NATS_ENABLED=true
+NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+JETSTREAM_REPLICAS=3
+```
+
+Then: working Verae login, one live seal, confirm 202/status/verify, map receipt fields, REST Hook to a private Zap. See `zapier-decisions/STATUS.md` “Once MOCK_VERAE=false”.
+
+## Billing on this path
+
+| Hop | Designed | Running |
+|-----|----------|---------|
+| Edge meter | `verae.billing.usage.recorded` | **coded**; fires when edge has `NATS_URL` |
+| Account-balance | subscribe + debit prepaid; 402 if empty | **subscriber running**; 402 from books not proven on every Zap |
+| Middleware quota | local files via `recordUsage` | **running**; not NATS |
+| `verae.zapier.usage` | optional JS meter | stream only |
+
+## Connect a new internal process
+
+```bash
+export NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+# clone verae-nats-process, rename subjects, register in verae-fleet
+```
+
+Jobs stay: HTTP in from Zapier → HTTPS to Verae → NATS watch/events → HTTP back to Zapier.
diff --git a/04-gaps-and-finish.md b/04-gaps-and-finish.md
new file mode 100644
index 0000000..4d3ad55
--- /dev/null
+++ b/04-gaps-and-finish.md
@@ -0,0 +1,81 @@
+# Gaps and finish list
+
+Modules and addresses that are designed but **not fully connected, not running as fleet workers, or not on the live Verae/Zapier path**.
+
+## Blocked on the operator (not a NATS bug)
+
+| Item | State | To finish |
+|------|--------|-----------|
+| Zapier Platform `push` | no login | `zapier login` → register → `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org` → push private app |
+| Live Verae | `MOCK_VERAE=true` | credentials; `MOCK_VERAE=false`; prove one seal |
+| nkeys / mTLS | cluster `$G` only | `verae-nats-accounts` sketch; flip only after every `NATS_URL` has creds |
+| Hash lookup on live OpenAPI | 501 | Verae API gap or our store |
+
+## Running on HTTP/NATS but incomplete routing
+
+| Module | Running? | NATS | Gap |
+|--------|----------|------|-----|
+| middleware HTTP + in-process job-poller + webhook-deliver | **yes** | watch/events/deliver | live Verae + Zapier push |
+| account-balance | **yes** | billing RR + `usage.recorded` sub | prove 402 from books on a Zap when prepaid is 0 |
+| zappier-edge | **yes** | `usage.recorded` / `payment.recorded` / `credit.applied` / `customer.put` **if `NATS_URL`** | confirm live process env; Stripe live |
+| access-* + authz | **yes** | authz + ingress | — |
+| identity | **yes** (fleet) | bind/lookup | confirm portal always binds `veraeUserId` |
+| jobs-events mailbox `:3030` | **yes** (fleet) | events counter | exclusive consumer off unless `JOBS_EVENTS_EXCLUSIVE=1` |
+| CS / sales / accounting | **yes** | statement/adjust | staff UX |
+| archive-worm + tree-node | **yes on LXC 510** (keep) | `archive.put/query/reply` | only **1+1** copies; fleet overlay `enabled: false` for extra replicas |
+| archive-aggregator | **no** as fleet worker | query/reply | enable overlay **or** finish in-process hook (`includeAttached` TBD in middleware) |
+| request-splitter | library in middleware | `archive.put` | `verae.splitter.in` not used |
+| `ZAPIER_USAGE` / `USAGE_WRITER` | stream yes | `verae.zapier.usage` | no consumer; middleware usage is local files |
+| fleet job-poller / webhook-deliver **extra** copies | overlay **false** | same subjects | only enable if you want SSH-spread replicas **instead of** in-process (same queue names) |
+
+## Designed, not a live worker
+
+| Module | Address | What to do |
+|--------|---------|------------|
+| `verae-nats-process` | `verae.example.process.*` | template only; clone to add a function |
+| `verae-activate` | none (HTTPS Zapier) | optional tiny app; needs Zapier login |
+| `verae-zapier` (full app) | HTTPS | push after login |
+| simulator | in-process fake NATS | local `:3847`; not production |
+| `verae-nats-accounts` | nkeys policy | not flipped |
+
+## Aux (no product subjects, or HTTP only)
+
+| Module | NATS | Notes |
+|--------|------|-------|
+| `verae-keep` | none | HTTP health; restarts units |
+| `verae-fleet` | none | catalog + keepFloor |
+| `verae-uptime` | none | off-box HTTPS GET of public doors |
+| `verae-backup` | none | disk / JetStream snapshot; no live event subject |
+| `verae-bootstrap` / `verae-deploy` / `verae-proxmox` / `verae-ops` | none | install/link |
+| staff-iam / staff-session / staff-ui | none | HTTP cookies |
+| public NATS edge | leaf, token | **do not** use from Zapier; rotate token; later nkeys LEAF vs INTERNAL |
+
+## Billing triggers and event logging
+
+| Signal | Designed | Running | Finish |
+|--------|----------|---------|--------|
+| Timestamp/verify meter (edge) | `verae.billing.usage.recorded` | **code path exists** (`zappier/src/app.ts` `onUsage`) | Confirm `NATS_URL` on live edge; 402 from account-balance when prepaid empty |
+| Middleware quota | local files `recordUsage` | **yes** | Either publish `usage.recorded` too or drop duplicate quota |
+| Optional JS meter | `verae.zapier.usage` + `USAGE_WRITER` | stream only | Wire or delete |
+| Portal reload | `payment.recorded` + `balance.adjust` | coded | confirm both fire on Stripe/test reload |
+| CS credit | `balance.adjust` + `credit.applied` | coded | confirm applied pub on live |
+| Customer upsert | `customer.put` | coded | — |
+| Authz deny audit | `verae.access.authz.deny` | running on deny | **no SIEM sink** |
+| Job lifecycle log | `jobs.events` | running | mailbox counts only — add structured log/export if needed |
+| Archive put/query | `VERAE_ARCHIVE` | 510 worm/tree | aggregator not in wait path |
+| Public edge | leaf | running | rotate token; do not expose `:6222` |
+
+## Ordered finish for message routing
+
+1. **Do not double-start** job-poller: either in-process **or** fleet copies, same queue `job-poller`.
+2. Confirm edge **`NATS_URL`** so `usage.recorded` actually lands; then 402 from books. Unify or drop middleware local `recordUsage`.
+3. Enable **archive-aggregator** (or in-process equivalent) so `includeAttached` and tree proofs work on wait/status.
+4. Raise worm/tree **replica floors** on 510/more CTs if archive HA is required (fleet overlay min 3).
+5. Operator: Zapier `push` + `MOCK_VERAE=false`.
+6. Prove: Zap create → `jobs.watch` → live `GET /api/status` → `jobs.events` → wait body + REST Hook.
+7. nkeys/mTLS after every client has creds; then lock down the public edge to accounts (LEAF vs INTERNAL).
+8. Optional: exclusive `jobs-events` mailbox; SIEM on `authz.deny` and `jobs.events`; `verae.splitter.in` if splitter is split out; `USAGE_WRITER` or delete `ZAPIER_USAGE`.
+
+## What is already enough for a mock Zap
+
+HTTPS zap/mw → mock create → `jobs.watch` → in-process poller → mock status completed → `jobs.events` → wait returns mock certificate. Archive extras and live chain are the missing middle.
diff --git a/05-developer-credentials.md b/05-developer-credentials.md
new file mode 100644
index 0000000..916afea
--- /dev/null
+++ b/05-developer-credentials.md
@@ -0,0 +1,271 @@
+# Developer credentials and connection info
+
+Lab pack for the Verae Time × Zapier stack on **NS1.GEORGELAMBERT.ORG** (`70.88.205.138`). Values below were checked **2026-09-14**. These are **lab defaults**, not production secrets. Rotate the public NATS token and admin secrets before treating this as a customer environment.
+
+Zapier cloud **never** gets a NATS URL or a Verae password.
+
+## 1. Who you are talking to
+
+| Host | Role |
+|------|------|
+| `70.88.205.138` | NS1 Proxmox. Public HTTPS + public NATS **client** edge |
+| `10.10.10.20` | LXC 510 `verae-px-worker` (worm + tree) |
+| `10.10.10.21–23` | LXC 511–513 `nats-a/b/c` JetStream cluster `verae` |
+
+SSH to the box: `ssh marchon@70.88.205.138`  
+Git SSH: `ssh://git@git.georgelambert.org:2223/marchon/<repo>.git` (port **2223**)
+
+## 2. Public HTTPS doors (live)
+
+Wildcard `*.zapier.georgelambert.org` → `70.88.205.138`.
+
+| URL | Process | Port | Last check |
+|-----|---------|------|------------|
+| https://zapier.georgelambert.org/ | docs catalog | files | 200 |
+| https://git.georgelambert.org/ | Forgejo | :443 / SSH :2223 | 200 |
+| https://portal.zapier.georgelambert.org/ | access-web → `/portal/` | :3021 | 302 → portal |
+| https://api.zapier.georgelambert.org/health | access-api | :3022 | 200 |
+| https://leaf.zapier.georgelambert.org/health | access-leaf | :3023 | 200 |
+| https://zap.zapier.georgelambert.org/health | access-zapier | :3024 | 200 |
+| https://staff.zapier.georgelambert.org/ | access-staff | :3025 | 302 login |
+| https://login.zapier.georgelambert.org/ | staff-session | :3027 | 200 |
+| https://iam.zapier.georgelambert.org/health | staff-iam | :3028 | 200 (`users: 5`) |
+| https://cs.zapier.georgelambert.org/ | customer-service | :3011 | 302 |
+| https://sales.zapier.georgelambert.org/ | sales-pricing | :3012 | 302 |
+| https://acct.zapier.georgelambert.org/ | accounting-export | :3013 | 302 |
+| https://mw.zapier.georgelambert.org/health | middleware | :3100 | 200 `mockVerae:true` `natsConnected:true` |
+| https://fleet.zapier.georgelambert.org/ | fleet console | :3850 | 302 |
+| https://nats.zapier.georgelambert.org/ | NATS WebSocket (Caddy) | 14422 | **400** on GET (expected; it is WS) |
+
+Loopback on NS1 (not public): zappier-edge **`127.0.0.1:13000`** (admin + Stripe + SQLite). Tunnel:
+
+```bash
+ssh -L 13000:127.0.0.1:13000 marchon@70.88.205.138
+# then http://127.0.0.1:13000/admin  and  /docs
+```
+
+Operator console tunnel: `ssh -L 3850:127.0.0.1:3850 marchon@70.88.205.138`
+
+## 3. NATS
+
+### Internal cluster (workers, keep, fleet)
+
+No token. Private `vmbr1` only.
+
+```text
+NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+JETSTREAM_REPLICAS=3
+```
+
+| Port | Bind | Use |
+|------|------|-----|
+| `:4222` | `10.10.10.21–23` | clients |
+| `:6222` | same, `vmbr1` | cluster routes — **do not publish** |
+| `:7422` | same | leaf hubs for the public edge — **do not publish** |
+| `:8222` | `127.0.0.1` on each LXC | monitor |
+
+From a laptop you **cannot** reach `10.10.10.x` unless you are on NS1 or you tunnel:
+
+```bash
+ssh -L 14222:10.10.10.21:4222 -L 14223:10.10.10.22:4222 -L 14224:10.10.10.23:4222 marchon@70.88.205.138
+export NATS_URL=nats://127.0.0.1:14222,nats://127.0.0.1:14223,nats://127.0.0.1:14224
+```
+
+### Public client edge (token)
+
+Live token (file `/etc/nats/public-edge.token` on NS1):
+
+```text
+4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9
+```
+
+```text
+nats://4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9@70.88.205.138:4222
+wss://nats.zapier.georgelambert.org
+```
+
+`CONNECT` with that token returns `PONG` (checked 2026-09-14). `auth_required: true`. Server name `nats-public-edge`. **Do not** put this URL in Zapier. Recreate: `bash packages/verae-nats-cluster/scripts/expose-public.sh` on NS1.
+
+Leftover lab listeners (ignore for new clients): host `127.0.0.1:4222` docker-proxy, `10.10.10.1:4222` socat. zappier-edge process still has `NATS_URL=nats://127.0.0.1:4222` — billing pubs may miss the 3-node cluster until that env is flipped.
+
+nkeys/mTLS: **not** on. Isolation is LAN + token.
+
+## 4. Middleware (jobs)
+
+Live: `MOCK_VERAE=true`, `NATS_ENABLED=true`, cluster URL as above, `ADMIN_SECRET=change-me-admin` (default), `TOKEN_SECRET=dev-secret-change-me` (default).
+
+### Lab tenant (created 2026-09-14 for this pack)
+
+| Field | Value |
+|-------|--------|
+| tenantId | `tenant-dev-lab-local-89ab82de` |
+| plan | free |
+| API key | `zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun` |
+| mock Verae user | `lab-dev` / `lab-dev-pass` |
+| veraeUserId | `vu_20ed6029b99efb2e` |
+
+Proven: `GET /zapier/v1/auth/me` → valid; `POST /zapier/v1/timestamp` → 202 `jobId`; wait → mock certificate `blockIndex: 42`.
+
+```bash
+KEY=zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun
+
+curl -sS -H "x-api-key: $KEY" https://mw.zapier.georgelambert.org/zapier/v1/auth/me
+
+curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
+  -d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
+  https://mw.zapier.georgelambert.org/zapier/v1/timestamp
+
+curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
+  -d '{"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}' \
+  https://mw.zapier.georgelambert.org/zapier/v1/timestamp/wait
+```
+
+Customer API plane (forwards `x-api-key` to middleware):
+
+```bash
+curl -sS -H "x-api-key: $KEY" -H "content-type: application/json" \
+  -d '{"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
+  https://api.zapier.georgelambert.org/v1/timestamp
+```
+
+`https://zap.zapier.georgelambert.org` is the Zapier **plane**. It does **not** currently forward `x-api-key` on timestamp (401 if you curl it with a key). Zapier Platform push is still waiting on login; when it is live, set `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org` and use a `zmw_…` key in the Zap.
+
+Mint another key (mock Verae accepts any username/password):
+
+```bash
+curl -sS -H "content-type: application/json" \
+  -d '{"email":"you@lab.local","name":"You","veraeUsername":"you","veraePassword":"you-pass"}' \
+  https://mw.zapier.georgelambert.org/zapier/v1/signup
+```
+
+Admin list/provision:
+
+```bash
+curl -sS -H "x-admin-secret: change-me-admin" \
+  https://mw.zapier.georgelambert.org/zapier/v1/admin/tenants
+```
+
+## 5. Portal / zappier-edge (billing users)
+
+SQLite `/SSD3/moved/home-marchon/verae-stack/packages/zappier/zappier.db`. Bind `127.0.0.1:13000`.
+
+Seed **customer API keys** (`x-api-key` on edge `/v1/*`, **not** middleware `zmw_`):
+
+| Customer | tier | key |
+|----------|------|-----|
+| Ada (free) | free | `key-ada` |
+| Grace (pro) | pro | `key-grace` |
+| Linus (business) | business | `key-linus` |
+| Docs Capture | free | `key-021851970d8a22c6` |
+
+These keys are for the **edge meter / portal**. Middleware jobs need a `zmw_…` key (section 4).
+
+Seed **admin console** (`/admin`, `x-admin-key` or login):
+
+| username | password |
+|----------|----------|
+| `admin` | `admin-dev-key` |
+| `demo` | `$$$Adm1n###` |
+
+`ZAPPIER_ADMIN_KEY` default on CS/sales/staff processes: `admin-dev-key`.
+
+Stripe: **not** live (lab quotes only). Env `STRIPE_*` unset on the sampled edge process.
+
+Signup more customers at https://portal.zapier.georgelambert.org/portal/
+
+## 6. Staff IAM
+
+https://login.zapier.georgelambert.org/  ·  https://iam.zapier.georgelambert.org/
+
+Seed users (defaults; live IAM has these five):
+
+| username | password | role |
+|----------|----------|------|
+| `admin` | `admin-dev-key` | owner |
+| `cs` | `cs-dev-key` | cs |
+| `sales` | `sales-dev-key` | sales |
+| `accounting` | `acct-dev-key` | accounting |
+| `operator` | `fleet-dev-key` | operator |
+
+`STAFF_KEY` / session fallback: `admin-dev-key`.
+
+## 7. Leaf plane
+
+https://leaf.zapier.georgelambert.org/health → `verae.access.leaf.in`
+
+Live: `LEAF_TOKEN=leaf-dev-token`
+
+```bash
+curl -sS -H "content-type: application/json" \
+  -d '{"token":"leaf-dev-token","target":"verae.archive.put","payload":{},"principal":"dev"}' \
+  https://leaf.zapier.georgelambert.org/
+```
+
+Billing targets are **denied** on this plane.
+
+## 8. Git (Forgejo)
+
+| | |
+|--|--|
+| Web | https://git.georgelambert.org/marchon/ |
+| SSH | `ssh://git@git.georgelambert.org:2223/marchon/<name>.git` |
+| User | `marchon` |
+| Overview of routes | https://git.georgelambert.org/marchon/dev-overview |
+| Monorepo | `master-zapier-plan-draft` |
+| Bootstrap | https://git.georgelambert.org/marchon/verae-bootstrap |
+
+```bash
+GIT_SSH_COMMAND="ssh -p 2223" git clone ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git
+```
+
+Add your SSH public key on Forgejo (user **marchon** or a new account). Do not commit deploy tokens.
+
+Clone-all:
+
+```bash
+git clone ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git
+cd verae-bootstrap
+export VERAE_SRC=$HOME/verae-src
+bash scripts/fetch.sh ns1-all-in-one
+```
+
+## 9. Environment cheat sheet (new worker on the cluster)
+
+```bash
+export NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+export JETSTREAM_REPLICAS=3
+export NATS_ENABLED=true
+export MOCK_VERAE=true          # flip to false only with live Verae login
+export VERAE_API_BASE_URL=https://api.veraetime.net
+export AUTHZ_URL=http://127.0.0.1:3020
+export ZAPPIER_UPSTREAM=http://127.0.0.1:3100
+export ZAPPIER_ADMIN_URL=http://127.0.0.1:13000
+export ZAPPIER_ADMIN_KEY=admin-dev-key
+export LEAF_TOKEN=leaf-dev-token
+export STAFF_IAM_URL=http://127.0.0.1:3028
+```
+
+Template worker: clone `verae-nats-process`, rename `verae.example.process.*`.
+
+## 10. Not issued yet (blocked)
+
+| Item | Why |
+|------|-----|
+| Zapier Platform deploy key / `zapier login` | operator has not logged the CLI in |
+| Live `api.veraetime.net` username/password | `MOCK_VERAE=true`; JWT would stay in middleware |
+| NATS nkeys / account creds | cluster is `$G` + LAN |
+| Stripe live secret | lab only |
+| lan-134 SSH worker | disabled |
+
+When Zapier login exists: `MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org`, auth field `api_key` = `zmw_…`.
+
+When live Verae exists: middleware `MOCK_VERAE=false` + `VERAE_API_BASE_URL=https://api.veraetime.net` + working login. Zapier still never sees that password.
+
+## 11. Related docs
+
+- Routes: [01-nats-routes.md](01-nats-routes.md)
+- Endpoint I/O: [02-endpoint-io.md](02-endpoint-io.md)
+- Job path: [03-zapier-verae-path.md](03-zapier-verae-path.md)
+- Gaps: [04-gaps-and-finish.md](04-gaps-and-finish.md)
+- Ops start: https://zapier.georgelambert.org/packages/verae-ops/GETTING-STARTED.pdf
+- Status: https://zapier.georgelambert.org/packages/zapier-decisions/STATUS.pdf
diff --git a/NATS.md b/NATS.md
new file mode 100644
index 0000000..3af73fb
--- /dev/null
+++ b/NATS.md
@@ -0,0 +1,9 @@
+# NATS — dev-overview
+
+This repo does not subscribe. It documents every `verae.*` address and the cluster TCP/leaf ports.
+
+Cluster (running): `nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222` on `vmbr1`. Cluster routes `:6222`. Leaf hubs `:7422`. Monitor `127.0.0.1:8222`.
+
+Public client edge (token): `nats://70.88.205.138:4222` and `wss://nats.zapier.georgelambert.org`. Zapier cloud still uses **HTTPS only**.
+
+See [01-nats-routes.md](01-nats-routes.md) and [02-endpoint-io.md](02-endpoint-io.md).
diff --git a/README.html b/README.html
new file mode 100644
index 0000000..eccb533
--- /dev/null
+++ b/README.html
@@ -0,0 +1,2518 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+  <meta charset="utf-8" />
+  <meta name="generator" content="pandoc" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
+  <title>dev-overview — NATS routes and developer credentials</title>
+  <style>
+    /* Default styles provided by pandoc.
+    ** See https://pandoc.org/MANUAL.html#variables-for-html for config info.
+    */
+    html {
+      color: #1a1a1a;
+      background-color: #fdfdfd;
+    }
+    body {
+      margin: 0 auto;
+      max-width: 36em;
+      padding-left: 50px;
+      padding-right: 50px;
+      padding-top: 50px;
+      padding-bottom: 50px;
+      hyphens: auto;
+      overflow-wrap: break-word;
+      text-rendering: optimizeLegibility;
+      font-kerning: normal;
+    }
+    @media (max-width: 600px) {
+      body {
+        font-size: 0.9em;
+        padding: 12px;
+      }
+      h1 {
+        font-size: 1.8em;
+      }
+    }
+    @media print {
+      html {
+        background-color: white;
+      }
+      body {
+        background-color: transparent;
+        color: black;
+        font-size: 12pt;
+      }
+      p, h2, h3 {
+        orphans: 3;
+        widows: 3;
+      }
+      h2, h3, h4 {
+        page-break-after: avoid;
+      }
+    }
+    p {
+      margin: 1em 0;
+    }
+    a {
+      color: #1a1a1a;
+    }
+    a:visited {
+      color: #1a1a1a;
+    }
+    img {
+      max-width: 100%;
+    }
+    svg {
+      height: auto;
+      max-width: 100%;
+    }
+    h1, h2, h3, h4, h5, h6 {
+      margin-top: 1.4em;
+    }
+    h5, h6 {
+      font-size: 1em;
+      font-style: italic;
+    }
+    h6 {
+      font-weight: normal;
+    }
+    ol, ul {
+      padding-left: 1.7em;
+      margin-top: 1em;
+    }
+    li > ol, li > ul {
+      margin-top: 0;
+    }
+    blockquote {
+      margin: 1em 0 1em 1.7em;
+      padding-left: 1em;
+      border-left: 2px solid #e6e6e6;
+      color: #606060;
+    }
+    code {
+      font-family: Menlo, Monaco, Consolas, 'Lucida Console', monospace;
+      font-size: 85%;
+      margin: 0;
+      hyphens: manual;
+    }
+    pre {
+      margin: 1em 0;
+      overflow: auto;
+    }
+    pre code {
+      padding: 0;
+      overflow: visible;
+      overflow-wrap: normal;
+    }
+    .sourceCode {
+     background-color: transparent;
+     overflow: visible;
+    }
+    hr {
+      border: none;
+      border-top: 1px solid #1a1a1a;
+      height: 1px;
+      margin: 1em 0;
+    }
+    table {
+      margin: 1em 0;
+      border-collapse: collapse;
+      width: 100%;
+      overflow-x: auto;
+      display: block;
+      font-variant-numeric: lining-nums tabular-nums;
+    }
+    table caption {
+      margin-bottom: 0.75em;
+    }
+    tbody {
+      margin-top: 0.5em;
+      border-top: 1px solid #1a1a1a;
+      border-bottom: 1px solid #1a1a1a;
+    }
+    th {
+      border-top: 1px solid #1a1a1a;
+      padding: 0.25em 0.5em 0.25em 0.5em;
+    }
+    td {
+      padding: 0.125em 0.5em 0.25em 0.5em;
+    }
+    header {
+      margin-bottom: 4em;
+      text-align: center;
+    }
+    #TOC li {
+      list-style: none;
+    }
+    #TOC ul {
+      padding-left: 1.3em;
+    }
+    #TOC > ul {
+      padding-left: 0;
+    }
+    #TOC a:not(:hover) {
+      text-decoration: none;
+    }
+    code{white-space: pre-wrap;}
+    span.smallcaps{font-variant: small-caps;}
+    div.columns{display: flex; gap: min(4vw, 1.5em);}
+    div.column{flex: auto; overflow-x: auto;}
+    div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
+    /* The extra [class] is a hack that increases specificity enough to
+       override a similar rule in reveal.js */
+    ul.task-list[class]{list-style: none;}
+    ul.task-list li input[type="checkbox"] {
+      font-size: inherit;
+      width: 0.8em;
+      margin: 0 0.8em 0.2em -1.6em;
+      vertical-align: middle;
+    }
+    .display.math{display: block; text-align: center; margin: 0.5rem auto;}
+    /* CSS for syntax highlighting */
+    html { -webkit-text-size-adjust: 100%; }
+    pre > code.sourceCode { white-space: pre; position: relative; }
+    pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
+    pre > code.sourceCode > span:empty { height: 1.2em; }
+    .sourceCode { overflow: visible; }
+    code.sourceCode > span { color: inherit; text-decoration: inherit; }
+    div.sourceCode { margin: 1em 0; }
+    pre.sourceCode { margin: 0; }
+    @media screen {
+    div.sourceCode { overflow: auto; }
+    }
+    @media print {
+    pre > code.sourceCode { white-space: pre-wrap; }
+    pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
+    }
+    pre.numberSource code
+      { counter-reset: source-line 0; }
+    pre.numberSource code > span
+      { position: relative; left: -4em; counter-increment: source-line; }
+    pre.numberSource code > span > a:first-child::before
+      { content: counter(source-line);
+        position: relative; left: -1em; text-align: right; vertical-align: baseline;
+        border: none; display: inline-block;
+        -webkit-touch-callout: none; -webkit-user-select: none;
+        -khtml-user-select: none; -moz-user-select: none;
+        -ms-user-select: none; user-select: none;
+        padding: 0 4px; width: 4em;
+        color: #aaaaaa;
+      }
+    pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa;  padding-left: 4px; }
+    div.sourceCode
+      {   }
+    @media screen {
+    pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
+    }
+    code span.al { color: #ff0000; font-weight: bold; } /* Alert */
+    code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
+    code span.at { color: #7d9029; } /* Attribute */
+    code span.bn { color: #40a070; } /* BaseN */
+    code span.bu { color: #008000; } /* BuiltIn */
+    code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
+    code span.ch { color: #4070a0; } /* Char */
+    code span.cn { color: #880000; } /* Constant */
+    code span.co { color: #60a0b0; font-style: italic; } /* Comment */
+    code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
+    code span.do { color: #ba2121; font-style: italic; } /* Documentation */
+    code span.dt { color: #902000; } /* DataType */
+    code span.dv { color: #40a070; } /* DecVal */
+    code span.er { color: #ff0000; font-weight: bold; } /* Error */
+    code span.ex { } /* Extension */
+    code span.fl { color: #40a070; } /* Float */
+    code span.fu { color: #06287e; } /* Function */
+    code span.im { color: #008000; font-weight: bold; } /* Import */
+    code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
+    code span.kw { color: #007020; font-weight: bold; } /* Keyword */
+    code span.op { color: #666666; } /* Operator */
+    code span.ot { color: #007020; } /* Other */
+    code span.pp { color: #bc7a00; } /* Preprocessor */
+    code span.sc { color: #4070a0; } /* SpecialChar */
+    code span.ss { color: #bb6688; } /* SpecialString */
+    code span.st { color: #4070a0; } /* String */
+    code span.va { color: #19177c; } /* Variable */
+    code span.vs { color: #4070a0; } /* VerbatimString */
+    code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
+  </style>
+</head>
+<body>
+<header id="title-block-header">
+<h1 class="title">dev-overview — NATS routes and developer
+credentials</h1>
+</header>
+<h1 id="dev-overview">dev-overview</h1>
+<p>Developer map of the Verae Time × Zapier <strong>NATS message
+fabric</strong>: what was designed, what is actually running on NS1, how
+a Zapier timestamp job reaches <code>api.veraetime.net</code> (or the
+mock) and comes back, and what is still unwired.</p>
+<p><strong>Forgejo:</strong>
+https://git.georgelambert.org/marchon/dev-overview<br />
+<strong>SSH:</strong>
+<code>ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git</code><br />
+<strong>Catalog:</strong>
+https://zapier.georgelambert.org/packages/dev-overview/<br />
+<strong>Date:</strong> 2026-09-14</p>
+<p>Zapier cloud <strong>never</strong> connects to NATS. It talks HTTPS
+to <code>https://zap.zapier.georgelambert.org</code> (access-zapier)
+then middleware. <code>api.veraetime.net</code> is <strong>HTTPS
+only</strong> — middleware is the NATS client.</p>
+<h2 id="contents">Contents</h2>
+<table>
+<colgroup>
+<col style="width: 45%" />
+<col style="width: 54%" />
+</colgroup>
+<thead>
+<tr>
+<th>Doc</th>
+<th>What</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><a href="00-sources.md">00-sources.md</a></td>
+<td>Every other doc that names a NATS address or TCP route</td>
+</tr>
+<tr>
+<td><a href="01-nats-routes.md">01-nats-routes.md</a></td>
+<td>Transport ports + every <code>verae.*</code> address: designed vs
+running</td>
+</tr>
+<tr>
+<td><a href="02-endpoint-io.md">02-endpoint-io.md</a></td>
+<td>Per-address: purpose, inbound from, outbound to, how to connect
+Verae API</td>
+</tr>
+<tr>
+<td><a href="03-zapier-verae-path.md">03-zapier-verae-path.md</a></td>
+<td>Zapier → middleware → Verae timestamp server → poll → events →
+Zapier</td>
+</tr>
+<tr>
+<td><a href="04-gaps-and-finish.md">04-gaps-and-finish.md</a></td>
+<td>Modules not connected; billing/event/aux; ordered finish list</td>
+</tr>
+<tr>
+<td><a
+href="05-developer-credentials.md">05-developer-credentials.md</a></td>
+<td>URLs, tokens, lab API keys, staff/IAM, git, env cheat sheet</td>
+</tr>
+</tbody>
+</table>
+<h2 id="cluster-running">Cluster (running)</h2>
+<pre class="text"><code>nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222</code></pre>
+<p>JetStream streams (replicas=3, file): <code>ZAPIER_JOBS</code>,
+<code>ZAPIER_EVENTS</code>, <code>ZAPIER_WEBHOOKS</code>,
+<code>ZAPIER_USAGE</code>, <code>VERAE_ARCHIVE</code>.</p>
+<p>Public token-gated <strong>client</strong> edge (not cluster routes):
+<code>nats://&lt;token&gt;@70.88.205.138:4222</code>,
+<code>wss://nats.zapier.georgelambert.org</code>. Do not put this in
+Zapier.</p>
+<h1 id="sources-other-documentation-that-names-routes">Sources (other
+documentation that names routes)</h1>
+<p>This inventory is compiled from code and from these docs. Do not
+invent extra <code>verae.*</code> names.</p>
+<h2 id="master-maps">Master maps</h2>
+<table>
+<colgroup>
+<col style="width: 27%" />
+<col style="width: 72%" />
+</colgroup>
+<thead>
+<tr>
+<th>Path</th>
+<th>What it names</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>packages/docs-master/modules-and-nats.md</code></td>
+<td>Module catalog, subject table, HTTPS vs NATS</td>
+</tr>
+<tr>
+<td><code>packages/docs-master/MESSAGE-FLOWS.md</code></td>
+<td>Create/wait/includeAttached/batch Merkle</td>
+</tr>
+<tr>
+<td><code>packages/docs-master/archive-nats.md</code></td>
+<td>Archive put/query/reply</td>
+</tr>
+<tr>
+<td><code>docs/02-architecture/nats-subjects.md</code></td>
+<td><code>verae.zapier.*</code> payloads + streams</td>
+</tr>
+<tr>
+<td><code>docs/02-architecture/modules-and-nats.md</code></td>
+<td>Same catalog as docs-master</td>
+</tr>
+<tr>
+<td><code>docs/02-architecture/overview.md</code></td>
+<td>Poller / events / webhooks</td>
+</tr>
+<tr>
+<td><code>packages/overview/03-nats-cluster.md</code></td>
+<td>Cluster URLs, who may connect</td>
+</tr>
+<tr>
+<td><code>packages/overview/06-address-routing.md</code></td>
+<td>Address pattern + plane mapping</td>
+</tr>
+<tr>
+<td><code>packages/verae-ops/06-linking-services.md</code></td>
+<td>How services attach</td>
+</tr>
+<tr>
+<td><code>packages/verae-nats-cluster/scripts/ensure-streams.sh</code></td>
+<td>Live stream create</td>
+</tr>
+<tr>
+<td><code>packages/verae-nats-cluster/conf/nats.conf.tmpl</code></td>
+<td><code>:4222</code> / <code>:6222</code> / <code>:7422</code> /
+monitor <code>:8222</code></td>
+</tr>
+<tr>
+<td><code>packages/verae-nats-cluster/conf/public-edge.conf.tmpl</code></td>
+<td>Public leaf <code>:4222</code>, WS <code>:14422</code></td>
+</tr>
+<tr>
+<td><code>packages/verae-fleet/overlays/ns1/fleet.json</code></td>
+<td>Enabled vs in-process workers</td>
+</tr>
+<tr>
+<td><code>packages/verae-keep</code>
+<code>units.px-worker.json</code></td>
+<td>Worm/tree on LXC 510</td>
+</tr>
+<tr>
+<td><code>packages/verae-zapier-middleware/src/nats/subjects.js</code></td>
+<td>Product subjects + consumers</td>
+</tr>
+<tr>
+<td><code>packages/zappier-account-balance/src/subjects.js</code></td>
+<td>Billing subjects</td>
+</tr>
+<tr>
+<td><code>packages/verae-access-authz/src/subjects.js</code> +
+<code>policy.js</code></td>
+<td>Authz + plane allow lists</td>
+</tr>
+<tr>
+<td><code>packages/zappier/src/billing-nats.ts</code></td>
+<td>Edge billing client</td>
+</tr>
+</tbody>
+</table>
+<h2
+id="per-package-nats.md-forgejo-module-copies-also-live-under-docs-mastermodules">Per-package
+<code>NATS.md</code> (Forgejo module copies also live under
+<code>docs-master/modules/</code>)</h2>
+<table>
+<colgroup>
+<col style="width: 45%" />
+<col style="width: 55%" />
+</colgroup>
+<thead>
+<tr>
+<th>Package</th>
+<th>Addresses</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>verae-zapier-middleware</code></td>
+<td><code>jobs.watch</code> out, <code>jobs.events</code> in,
+archive.query via aggregator</td>
+</tr>
+<tr>
+<td><code>verae-jobs-events</code></td>
+<td><code>jobs.events</code>; exclusive →
+<code>verae.internal.jobs.events</code></td>
+</tr>
+<tr>
+<td><code>verae-request-splitter</code></td>
+<td><code>archive.put</code></td>
+</tr>
+<tr>
+<td><code>verae-archive-worm</code></td>
+<td><code>archive.put</code> / <code>query</code> /
+<code>reply.&lt;id&gt;</code></td>
+</tr>
+<tr>
+<td><code>verae-tree-node</code></td>
+<td>same, <code>kind: tree</code></td>
+</tr>
+<tr>
+<td><code>verae-archive-aggregator</code></td>
+<td><code>query</code> out, <code>reply.&lt;id&gt;</code> in</td>
+</tr>
+<tr>
+<td><code>zappier-account-balance</code></td>
+<td><code>verae.billing.*</code></td>
+</tr>
+<tr>
+<td><code>zappier</code> (edge)</td>
+<td>package <code>NATS.md</code> is stale (“does not publish”);
+<strong>code</strong> publishes usage/payment/credit/customer.put when
+<code>NATS_URL</code> is set. Use
+<code>docs-master/modules/zappier/NATS.md</code></td>
+</tr>
+<tr>
+<td><code>zappier-customer-service</code></td>
+<td><code>statement.get</code>, <code>balance.adjust</code></td>
+</tr>
+<tr>
+<td><code>zappier-sales-pricing</code></td>
+<td><code>statement.get</code></td>
+</tr>
+<tr>
+<td><code>zappier-accounting-export</code></td>
+<td><code>statement.get</code></td>
+</tr>
+<tr>
+<td><code>zappier-identity</code></td>
+<td><code>identity.bind</code> / <code>lookup</code></td>
+</tr>
+<tr>
+<td><code>verae-access-authz</code></td>
+<td><code>authz.check</code> / <code>authz.deny</code></td>
+</tr>
+<tr>
+<td><code>verae-access-web</code></td>
+<td><code>access.web.in</code> / <code>access.web.billing.*</code></td>
+</tr>
+<tr>
+<td><code>verae-access-api</code></td>
+<td><code>access.api.*</code></td>
+</tr>
+<tr>
+<td><code>verae-access-zapier</code></td>
+<td><code>access.zapier.*</code> then HTTPS to middleware</td>
+</tr>
+<tr>
+<td><code>verae-access-leaf</code></td>
+<td><code>access.leaf.in</code></td>
+</tr>
+<tr>
+<td><code>verae-access-staff</code></td>
+<td><code>access.staff.*</code></td>
+</tr>
+<tr>
+<td><code>verae-nats-process</code></td>
+<td><code>verae.example.process.*</code> (template)</td>
+</tr>
+<tr>
+<td><code>verae-nats-accounts</code></td>
+<td>policy only (INTERNAL vs LEAF)</td>
+</tr>
+<tr>
+<td><code>verae-zapier-simulator</code></td>
+<td>in-process replay of product addresses</td>
+</tr>
+<tr>
+<td><code>verae-keep</code> / <code>verae-fleet</code> /
+<code>verae-uptime</code> / <code>verae-backup</code></td>
+<td>no product subjects</td>
+</tr>
+</tbody>
+</table>
+<p>Simulator <code>src/pipeline.js</code> and
+<code>src/monitors.js</code> list the same product addresses for traces;
+they are not live subscribers.</p>
+<h1 id="designed-vs-running-nats-routes">Designed vs running NATS
+routes</h1>
+<p><strong>Designed</strong> = named in docs or in code.<br />
+<strong>Running</strong> = a process on NS1 is subscribed or publishing
+it <strong>today</strong>, and (for durable work) a JetStream stream
+exists.</p>
+<p>Cluster name <code>verae</code>. Internal clients use the three LXC
+on <code>vmbr1</code>. Public edge is a <strong>leaf</strong>, not a
+second cluster.</p>
+<p>Legend: <strong>JS</strong> = JetStream stream; <strong>RR</strong> =
+core request-reply; <strong>pub</strong> = core or JS fire-and-forget;
+<strong>Q</strong> = queue group.</p>
+<h2 id="transport-tcp-leaf-public">Transport (TCP / leaf / public)</h2>
+<p>These are NATS <strong>server</strong> routes, not
+<code>verae.*</code> subjects.</p>
+<table>
+<colgroup>
+<col style="width: 29%" />
+<col style="width: 29%" />
+<col style="width: 26%" />
+<col style="width: 14%" />
+</colgroup>
+<thead>
+<tr>
+<th>Endpoint</th>
+<th>Designed</th>
+<th>Running</th>
+<th>Who</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>10.10.10.21–23:4222</code> client</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>middleware, access-*, billing, worm/tree, identity,
+CS/sales/acct</td>
+</tr>
+<tr>
+<td><code>10.10.10.21–23:6222</code> cluster routes</td>
+<td>yes</td>
+<td><strong>yes</strong> (private <code>vmbr1</code> only)</td>
+<td>nats-a/b/c to each other</td>
+</tr>
+<tr>
+<td><code>10.10.10.21–23:7422</code> leaf hub</td>
+<td>yes (public-edge)</td>
+<td><strong>yes</strong></td>
+<td>public edge remotes</td>
+</tr>
+<tr>
+<td><code>127.0.0.1:8222</code> monitor on each LXC</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>operators on the guest</td>
+</tr>
+<tr>
+<td><code>70.88.205.138:4222</code> public client</td>
+<td>yes (token)</td>
+<td><strong>yes</strong></td>
+<td>leaf edge; <strong>not</strong> Zapier</td>
+</tr>
+<tr>
+<td><code>127.0.0.1:14422</code> WS on edge</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>Caddy → <code>wss://nats.zapier.georgelambert.org</code></td>
+</tr>
+<tr>
+<td><code>127.0.0.1:8229</code> edge monitor</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>host loopback</td>
+</tr>
+<tr>
+<td><code>:6222</code> / <code>:7422</code> / <code>:8222</code> on
+<code>vmbr0</code></td>
+<td><strong>no</strong></td>
+<td><strong>must stay closed</strong></td>
+<td>—</td>
+</tr>
+<tr>
+<td>Host leftover <code>127.0.0.1:4222</code> (docker-proxy) +
+<code>10.10.10.1:4222</code> socat</td>
+<td>lab leftover</td>
+<td>present</td>
+<td><strong>do not</strong> point product <code>NATS_URL</code>
+here</td>
+</tr>
+<tr>
+<td>MQTT <code>:1883</code></td>
+<td>study only</td>
+<td><strong>removed</strong></td>
+<td>—</td>
+</tr>
+</tbody>
+</table>
+<p>Internal keep/fleet/middleware URL:</p>
+<pre class="text"><code>nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222</code></pre>
+<p>Public (token in <code>/etc/nats/public-edge.token</code> on NS1):
+<code>nats://&lt;token&gt;@70.88.205.138:4222</code>. Isolation on the
+hub is still <code>$G</code> + private LAN. nkeys/mTLS sketched in
+<code>verae-nats-accounts</code>, <strong>not</strong> flipped.</p>
+<h2 id="jetstream-streams-running">JetStream streams (running)</h2>
+<p>Created by <code>verae-nats-cluster/scripts/ensure-streams.sh</code>
+(middleware <code>ensureStreams</code> also creates the first
+three).</p>
+<table>
+<colgroup>
+<col style="width: 15%" />
+<col style="width: 19%" />
+<col style="width: 19%" />
+<col style="width: 17%" />
+<col style="width: 27%" />
+</colgroup>
+<thead>
+<tr>
+<th>Stream</th>
+<th>Subjects</th>
+<th>Replicas</th>
+<th>Storage</th>
+<th>Who consumes</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>ZAPIER_JOBS</code></td>
+<td><code>verae.zapier.jobs.watch</code></td>
+<td>3</td>
+<td>file</td>
+<td>job-poller (in middleware process), Q <code>job-poller</code></td>
+</tr>
+<tr>
+<td><code>ZAPIER_EVENTS</code></td>
+<td><code>verae.zapier.jobs.events</code></td>
+<td>3</td>
+<td>file</td>
+<td>middleware wait + webhook router
+(<code>event-webhook-router</code>); optional exclusive
+<code>jobs-events</code></td>
+</tr>
+<tr>
+<td><code>ZAPIER_WEBHOOKS</code></td>
+<td><code>verae.zapier.webhooks.deliver</code></td>
+<td>3</td>
+<td>file</td>
+<td>webhook-deliver (in middleware), Q <code>webhook-deliver</code></td>
+</tr>
+<tr>
+<td><code>ZAPIER_USAGE</code></td>
+<td><code>verae.zapier.usage</code></td>
+<td>3</td>
+<td>file</td>
+<td><strong>no durable consumer</strong> (<code>USAGE_WRITER</code>
+named only)</td>
+</tr>
+<tr>
+<td><code>VERAE_ARCHIVE</code></td>
+<td><code>verae.archive.&gt;</code></td>
+<td>3</td>
+<td>file</td>
+<td>worm + tree on LXC 510 (keep); aggregator <strong>not</strong>
+fleet-enabled</td>
+</tr>
+</tbody>
+</table>
+<p>Billing is <strong>core request-reply / pub</strong>, not a JetStream
+stream.</p>
+<h2 id="address-inventory">Address inventory</h2>
+<table>
+<colgroup>
+<col style="width: 21%" />
+<col style="width: 14%" />
+<col style="width: 24%" />
+<col style="width: 21%" />
+<col style="width: 17%" />
+</colgroup>
+<thead>
+<tr>
+<th>Address</th>
+<th>Kind</th>
+<th>Designed</th>
+<th>Running</th>
+<th>Notes</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>verae.zapier.jobs.watch</code></td>
+<td>JS work Q <code>job-poller</code></td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>middleware publishes; in-process poller consumes</td>
+</tr>
+<tr>
+<td><code>verae.zapier.jobs.events</code></td>
+<td>JS events</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>poller publishes; wait() subscribes; webhook worker routes</td>
+</tr>
+<tr>
+<td><code>verae.zapier.webhooks.deliver</code></td>
+<td>JS work Q <code>webhook-deliver</code></td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>same Node process as HTTP</td>
+</tr>
+<tr>
+<td><code>verae.zapier.usage</code></td>
+<td>JS optional</td>
+<td>yes</td>
+<td>stream <strong>yes</strong>, consumer <strong>no</strong></td>
+<td>middleware entitlement is <strong>local files</strong></td>
+</tr>
+<tr>
+<td><code>verae.internal.jobs.events</code></td>
+<td>core republish</td>
+<td>yes (<code>jobs-events</code> exclusive)</td>
+<td><strong>partial</strong></td>
+<td>only if <code>JOBS_EVENTS_EXCLUSIVE=1</code></td>
+</tr>
+<tr>
+<td><code>verae.billing.statement.get</code></td>
+<td>RR Q <code>account-balance</code></td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>portal, CS, sales, accounting, access-web/api</td>
+</tr>
+<tr>
+<td><code>verae.billing.balance.get</code></td>
+<td>RR</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>account-balance</td>
+</tr>
+<tr>
+<td><code>verae.billing.balance.adjust</code></td>
+<td>RR</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>CS credits, portal reload</td>
+</tr>
+<tr>
+<td><code>verae.billing.usage.recorded</code></td>
+<td>pub</td>
+<td>yes</td>
+<td><strong>yes if edge <code>NATS_URL</code> set</strong></td>
+<td><code>zappier/src/app.ts</code> <code>onUsage</code> →
+<code>natsPublish</code>; account-balance subscribes</td>
+</tr>
+<tr>
+<td><code>verae.billing.payment.recorded</code></td>
+<td>pub</td>
+<td>yes</td>
+<td><strong>yes if <code>NATS_URL</code></strong></td>
+<td>portal reload (<code>portal.ts</code>)</td>
+</tr>
+<tr>
+<td><code>verae.billing.credit.applied</code></td>
+<td>pub</td>
+<td>yes</td>
+<td><strong>yes if <code>NATS_URL</code></strong></td>
+<td>admin/CS (<code>admin.ts</code>)</td>
+</tr>
+<tr>
+<td><code>verae.billing.customer.put</code></td>
+<td>pub</td>
+<td>yes</td>
+<td><strong>yes if <code>NATS_URL</code></strong></td>
+<td><code>ledger.ts</code>; account-balance applies</td>
+</tr>
+<tr>
+<td><code>verae.access.authz.check</code></td>
+<td>RR Q <code>access-authz</code></td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>fleet keepFloor</td>
+</tr>
+<tr>
+<td><code>verae.access.authz.deny</code></td>
+<td>pub audit</td>
+<td>yes</td>
+<td><strong>yes</strong> (on deny)</td>
+<td>no SIEM sink</td>
+</tr>
+<tr>
+<td><code>verae.access.web.in</code> /
+<code>verae.access.web.billing.*</code></td>
+<td>ingress</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>mapped after authz,
+e.g. <code>verae.access.web.billing.statement.get</code></td>
+</tr>
+<tr>
+<td><code>verae.access.api.*</code></td>
+<td>ingress</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td></td>
+</tr>
+<tr>
+<td><code>verae.access.zapier.*</code></td>
+<td>ingress</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>HTTPS plane; Zapier never speaks NATS</td>
+</tr>
+<tr>
+<td><code>verae.access.leaf.in</code> /
+<code>verae.access.leaf.*</code></td>
+<td>ingress</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>no billing</td>
+</tr>
+<tr>
+<td><code>verae.access.staff.*</code></td>
+<td>ingress</td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>CS/sales/accounting</td>
+</tr>
+<tr>
+<td><code>verae.identity.bind</code></td>
+<td>RR Q <code>identity</code></td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td>fleet</td>
+</tr>
+<tr>
+<td><code>verae.identity.lookup</code></td>
+<td>RR Q <code>identity</code></td>
+<td>yes</td>
+<td><strong>yes</strong></td>
+<td></td>
+</tr>
+<tr>
+<td><code>verae.archive.put</code></td>
+<td>JS (<code>VERAE_ARCHIVE</code>)</td>
+<td>yes</td>
+<td><strong>partial</strong></td>
+<td>splitter <strong>in-process</strong> in middleware; worm/tree on 510
+consume</td>
+</tr>
+<tr>
+<td><code>verae.archive.query</code></td>
+<td>broadcast (no Q)</td>
+<td>yes</td>
+<td><strong>partial</strong></td>
+<td>live aggregator hook <strong>TBD</strong> in middleware (simulator
+has it)</td>
+</tr>
+<tr>
+<td><code>verae.archive.reply.&lt;id&gt;</code></td>
+<td>replies on bloom hit</td>
+<td>yes</td>
+<td><strong>partial</strong></td>
+<td>worm/tree on 510 can reply; aggregator not fleet-enabled</td>
+</tr>
+<tr>
+<td><code>verae.splitter.in</code></td>
+<td>future</td>
+<td>yes (docs)</td>
+<td><strong>no</strong></td>
+<td>splitter stays a library</td>
+</tr>
+<tr>
+<td><code>verae.example.process.in</code> / <code>.out</code> /
+<code>.reply.*</code></td>
+<td>template</td>
+<td>yes</td>
+<td><strong>no</strong></td>
+<td><code>verae-nats-process</code> is a model</td>
+</tr>
+<tr>
+<td><code>bench.*</code></td>
+<td>lab only</td>
+<td>n/a</td>
+<td>ephemeral</td>
+<td>speed studies; not product</td>
+</tr>
+</tbody>
+</table>
+<p>Plane mapping (<code>verae-access-authz</code>): internal
+<code>verae.billing.statement.get</code> + plane <code>web</code> →
+ingress <code>verae.access.web.billing.statement.get</code>. Planes
+never publish internal subjects until <code>authz.check</code> returns
+allow.</p>
+<h2 id="durable-consumers-named-in-middleware">Durable consumers (named
+in middleware)</h2>
+<table>
+<colgroup>
+<col style="width: 18%" />
+<col style="width: 54%" />
+<col style="width: 27%" />
+</colgroup>
+<thead>
+<tr>
+<th>Name</th>
+<th>Stream / subject</th>
+<th>Running</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>job-poller</code></td>
+<td><code>ZAPIER_JOBS</code> / <code>jobs.watch</code></td>
+<td><strong>yes</strong> (in-process)</td>
+</tr>
+<tr>
+<td><code>event-webhook-router</code></td>
+<td><code>ZAPIER_EVENTS</code> / <code>jobs.events</code></td>
+<td><strong>yes</strong> (in-process)</td>
+</tr>
+<tr>
+<td><code>webhook-deliver</code></td>
+<td><code>ZAPIER_WEBHOOKS</code> / <code>webhooks.deliver</code></td>
+<td><strong>yes</strong> (in-process)</td>
+</tr>
+<tr>
+<td><code>usage-writer</code></td>
+<td><code>ZAPIER_USAGE</code> / <code>verae.zapier.usage</code></td>
+<td><strong>no</strong></td>
+</tr>
+<tr>
+<td><code>jobs-events-exclusive</code></td>
+<td><code>ZAPIER_EVENTS</code></td>
+<td><strong>no</strong> unless <code>JOBS_EVENTS_EXCLUSIVE=1</code></td>
+</tr>
+</tbody>
+</table>
+<h2 id="fleet-overlay-vs-in-process">Fleet overlay vs in-process</h2>
+<p><code>packages/verae-fleet/overlays/ns1/fleet.json</code>
+(2026-09-14):</p>
+<table>
+<colgroup>
+<col style="width: 23%" />
+<col style="width: 44%" />
+<col style="width: 31%" />
+</colgroup>
+<thead>
+<tr>
+<th>Service</th>
+<th>fleet <code>enabled</code></th>
+<th>Actual lab</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>middleware-http</td>
+<td>true</td>
+<td><strong>running</strong>; starts job-poller + webhook workers
+in-process when <code>NATS_ENABLED</code></td>
+</tr>
+<tr>
+<td>job-poller</td>
+<td><strong>false</strong></td>
+<td>covered by middleware; do not spawn a second copy</td>
+</tr>
+<tr>
+<td>webhook-deliver</td>
+<td><strong>false</strong></td>
+<td>same</td>
+</tr>
+<tr>
+<td>archive-aggregator</td>
+<td><strong>false</strong></td>
+<td><strong>not</strong> running as a fleet worker</td>
+</tr>
+<tr>
+<td>archive-worm / tree-node</td>
+<td><strong>false</strong> on host fleet</td>
+<td><strong>running on LXC 510</strong> via keep
+<code>units.px-worker.json</code> (1 worm + 1 tree)</td>
+</tr>
+<tr>
+<td>account-balance, access-*, identity, jobs-events, CS/sales/acct,
+staff-iam/session, zappier-edge</td>
+<td>true keepFloor</td>
+<td>keepFloor</td>
+</tr>
+<tr>
+<td>zapier-simulator</td>
+<td>true, keepFloor false</td>
+<td>optional</td>
+</tr>
+<tr>
+<td>nats</td>
+<td>managed false</td>
+<td>3-node cluster + leftover host loopback</td>
+</tr>
+</tbody>
+</table>
+<h1 id="endpoint-io">Endpoint I/O</h1>
+<p>Each product NATS address: <strong>what it is for</strong>,
+<strong>who sends</strong>, <strong>who receives</strong>, <strong>how
+to attach</strong>.</p>
+<p>Connect with a <strong>long-lived</strong> client
+(reconnect-per-message is the anti-pattern):</p>
+<pre class="text"><code>NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222</code></pre>
+<p>Public edge (token in <code>/etc/nats/public-edge.token</code> on
+NS1): <code>nats://&lt;token&gt;@70.88.205.138:4222</code>. Do not put
+that URL in Zapier or in Verae.</p>
+<hr />
+<h2
+id="verae.zapier.jobs.watch"><code>verae.zapier.jobs.watch</code></h2>
+<table>
+<colgroup>
+<col style="width: 50%" />
+<col style="width: 50%" />
+</colgroup>
+<tbody>
+<tr>
+<td>For</td>
+<td>Work queue: “poll Verae until this <code>jobId</code> is
+terminal.”</td>
+</tr>
+<tr>
+<td>In from</td>
+<td>middleware <code>enqueueWatch</code> after
+<code>POST /api/timestamp</code> (or mock) returns
+<code>jobId</code></td>
+</tr>
+<tr>
+<td>Out to</td>
+<td>job-poller worker (queue <code>job-poller</code>, durable on
+<code>ZAPIER_JOBS</code>)</td>
+</tr>
+<tr>
+<td>Then</td>
+<td>poller calls Verae <code>GET /api/status/{jobId}</code> over
+<strong>HTTPS</strong>, not NATS</td>
+</tr>
+</tbody>
+</table>
+<p>Payload: <code>tenantId</code>, <code>veraeUserId</code>,
+<code>jobId</code>, <code>tokenRef</code>, <code>enqueuedAt</code>,
+<code>attempt</code>, <code>maxAttempts</code>, <code>intervalMs</code>,
+<code>traceId</code>. JWT stays in middleware (<code>tokenRef</code>);
+never on Zapier.</p>
+<p><strong>Connect Verae-side:</strong> do <strong>not</strong>
+subscribe this from <code>api.veraetime.net</code>. The poller is the
+Verae HTTP client. To add another watcher, start another
+<code>job-poller</code> consumer in the same queue group.</p>
+<hr />
+<h2
+id="verae.zapier.jobs.events"><code>verae.zapier.jobs.events</code></h2>
+<table>
+<colgroup>
+<col style="width: 50%" />
+<col style="width: 50%" />
+</colgroup>
+<tbody>
+<tr>
+<td>For</td>
+<td>Terminal outcomes: <code>timestamp.completed</code> /
+<code>failed</code> / <code>timeout</code></td>
+</tr>
+<tr>
+<td>In from</td>
+<td>job-poller after Verae status is not <code>pending</code></td>
+</tr>
+<tr>
+<td>Out to</td>
+<td>(1) middleware <code>waitForJobEvent</code> (wait HTTP); (2) webhook
+router → <code>webhooks.deliver</code>; (3) optional
+<code>verae-jobs-events</code> mailbox <code>:3030</code></td>
+</tr>
+</tbody>
+</table>
+<p>If <code>JOBS_EVENTS_EXCLUSIVE=1</code>, only
+<code>verae-jobs-events</code> is the durable consumer and republishes
+<code>verae.internal.jobs.events</code>. Default lab: middleware wait +
+webhook worker share the stream.</p>
+<p>Payload: <code>event</code>, <code>tenantId</code>,
+<code>jobId</code>, <code>status</code>, <code>traceId</code>,
+<code>emittedAt</code>.</p>
+<hr />
+<h2
+id="verae.zapier.webhooks.deliver"><code>verae.zapier.webhooks.deliver</code></h2>
+<table>
+<tbody>
+<tr>
+<td>For</td>
+<td>HTTPS POST to <code>hooks.zapier.com</code> (REST Hook)</td>
+</tr>
+<tr>
+<td>In from</td>
+<td>webhook worker on completed/failed events</td>
+</tr>
+<tr>
+<td>Out to</td>
+<td>Zapier cloud <strong>HTTPS</strong>, never NATS</td>
+</tr>
+</tbody>
+</table>
+<p>Payload: <code>hookId</code>, <code>tenantId</code>,
+<code>targetUrl</code>, <code>event</code>, <code>payload</code>,
+<code>attempt</code>, <code>traceId</code>. Slow consumer: keep replica
+floors on the worker if you split it out of middleware.</p>
+<hr />
+<h2 id="verae.zapier.usage"><code>verae.zapier.usage</code></h2>
+<table>
+<colgroup>
+<col style="width: 50%" />
+<col style="width: 50%" />
+</colgroup>
+<tbody>
+<tr>
+<td>For</td>
+<td>Optional meter of Zap actions on NATS (JetStream)</td>
+</tr>
+<tr>
+<td>In from</td>
+<td>designed: middleware / edge</td>
+</tr>
+<tr>
+<td>Out to</td>
+<td>designed: <code>USAGE_WRITER</code> → books</td>
+</tr>
+<tr>
+<td>Running</td>
+<td><strong>stream exists; no writer; middleware uses local usage
+files</strong></td>
+</tr>
+</tbody>
+</table>
+<p>Prepaid meter that <strong>is</strong> wired uses
+<code>verae.billing.usage.recorded</code> (core pub), not this stream.
+Finish: either publish here from <code>recordUsage</code> or drop the
+stream.</p>
+<hr />
+<h2 id="billing-verae.billing.-account-balance-source-of-truth">Billing
+(<code>verae.billing.*</code>) — account-balance source of truth</h2>
+<p>Request-reply unless noted. Queue <code>account-balance</code>.
+<strong>Not</strong> JetStream.</p>
+<table>
+<colgroup>
+<col style="width: 29%" />
+<col style="width: 16%" />
+<col style="width: 29%" />
+<col style="width: 25%" />
+</colgroup>
+<thead>
+<tr>
+<th>Address</th>
+<th>For</th>
+<th>In from</th>
+<th>Out to</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>statement.get</code></td>
+<td>prepaid, credits, usage, payments</td>
+<td>portal, CS, sales, accounting, access-web/api</td>
+<td>reply to requester</td>
+</tr>
+<tr>
+<td><code>balance.get</code></td>
+<td>cents only</td>
+<td>internal</td>
+<td>reply</td>
+</tr>
+<tr>
+<td><code>balance.adjust</code></td>
+<td>CS credit or portal reload</td>
+<td>CS, access-web (reload kind only)</td>
+<td>books + reply</td>
+</tr>
+<tr>
+<td><code>usage.recorded</code></td>
+<td>meter pub</td>
+<td>zappier-edge <code>meter()</code> <code>onUsage</code> when
+<code>NATS_URL</code> set</td>
+<td>account-balance subscriber (debits prepaid)</td>
+</tr>
+<tr>
+<td><code>payment.recorded</code></td>
+<td>reload/invoice pub</td>
+<td>portal</td>
+<td>books</td>
+</tr>
+<tr>
+<td><code>credit.applied</code></td>
+<td>goodwill pub</td>
+<td>CS/admin</td>
+<td>books</td>
+</tr>
+<tr>
+<td><code>customer.put</code></td>
+<td>upsert customer</td>
+<td>edge ledger</td>
+<td>books</td>
+</tr>
+</tbody>
+</table>
+<p>Authz <strong>must</strong> pass
+<code>verae.access.authz.check</code> before these from a public plane.
+Leaf plane <strong>cannot</strong> call billing (policy).</p>
+<p>Middleware <code>recordUsage</code> still writes <strong>local tenant
+files</strong> and does <strong>not</strong> publish
+<code>usage.recorded</code>. Two meters until that is unified.</p>
+<hr />
+<h2 id="access-planes">Access planes</h2>
+<table>
+<colgroup>
+<col style="width: 39%" />
+<col style="width: 21%" />
+<col style="width: 17%" />
+<col style="width: 21%" />
+</colgroup>
+<thead>
+<tr>
+<th>Address</th>
+<th>For</th>
+<th>In</th>
+<th>Out</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>verae.access.authz.check</code></td>
+<td>allow/deny <code>{ plane, subject, principal }</code></td>
+<td>every plane + edge <code>billing-nats.ts</code></td>
+<td><code>{ allow, reason }</code>; deny also pubs
+<code>authz.deny</code></td>
+</tr>
+<tr>
+<td><code>verae.access.authz.deny</code></td>
+<td>audit</td>
+<td>authz on deny</td>
+<td><strong>nowhere yet</strong> (no SIEM)</td>
+</tr>
+<tr>
+<td><code>verae.access.web.in</code> /
+<code>verae.access.web.billing.*</code></td>
+<td>browser portal</td>
+<td>access-web HTTP</td>
+<td><code>statement.get</code> / <code>balance.adjust</code> kind=reload
+after authz</td>
+</tr>
+<tr>
+<td><code>verae.access.api.*</code></td>
+<td>customer <code>x-api-key</code></td>
+<td>access-api</td>
+<td>statement; HTTPS to middleware for jobs</td>
+</tr>
+<tr>
+<td><code>verae.access.zapier.*</code></td>
+<td>Zapier HTTPS only</td>
+<td>access-zapier</td>
+<td>jobs.watch <strong>via HTTP to middleware</strong>, not Zapier NATS;
+usage.recorded allowed by policy</td>
+</tr>
+<tr>
+<td><code>verae.access.leaf.in</code></td>
+<td>S2S <code>{ token, target, payload }</code></td>
+<td>remote leaf</td>
+<td>archive + jobs after authz; <strong>never billing</strong></td>
+</tr>
+<tr>
+<td><code>verae.access.staff.*</code></td>
+<td>CS/sales/accounting</td>
+<td>access-staff</td>
+<td>billing after authz</td>
+</tr>
+</tbody>
+</table>
+<p>Ingress mapping:
+<code>accessAddress(plane, 'verae.billing.statement.get')</code> →
+<code>verae.access.&lt;plane&gt;.billing.statement.get</code>.</p>
+<hr />
+<h2 id="identity">Identity</h2>
+<table>
+<colgroup>
+<col style="width: 39%" />
+<col style="width: 21%" />
+<col style="width: 17%" />
+<col style="width: 21%" />
+</colgroup>
+<thead>
+<tr>
+<th>Address</th>
+<th>For</th>
+<th>In</th>
+<th>Out</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>verae.identity.bind</code></td>
+<td>bind email/customerId → <code>veraeUserId</code></td>
+<td>portal / middleware</td>
+<td>reply</td>
+</tr>
+<tr>
+<td><code>verae.identity.lookup</code></td>
+<td>lookup by customerId or veraeUserId</td>
+<td>same</td>
+<td>reply</td>
+</tr>
+</tbody>
+</table>
+<p>Queue <code>identity</code>. Fleet keepFloor.</p>
+<hr />
+<h2 id="archive-tree">Archive / tree</h2>
+<table>
+<colgroup>
+<col style="width: 39%" />
+<col style="width: 21%" />
+<col style="width: 17%" />
+<col style="width: 21%" />
+</colgroup>
+<thead>
+<tr>
+<th>Address</th>
+<th>For</th>
+<th>In</th>
+<th>Out</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>verae.archive.put</code></td>
+<td>WORM/tree write (<code>kind</code>: publicMeta / privateMeta / file
+/ tree)</td>
+<td>splitter (in-process from middleware today)</td>
+<td>every worm/tree (JS)</td>
+</tr>
+<tr>
+<td><code>verae.archive.query</code></td>
+<td>broadcast lookup</td>
+<td>aggregator</td>
+<td><strong>all</strong> worm/tree, <strong>no</strong> queue group</td>
+</tr>
+<tr>
+<td><code>verae.archive.reply.&lt;correlationId&gt;</code></td>
+<td>bloom <strong>hit only</strong></td>
+<td>worm/tree</td>
+<td>aggregator</td>
+</tr>
+</tbody>
+</table>
+<p>Silence = miss. Chain seal does not wait on archive. Bytes never go
+to the chain.</p>
+<hr />
+<h2 id="template-unused">Template / unused</h2>
+<table>
+<colgroup>
+<col style="width: 28%" />
+<col style="width: 15%" />
+<col style="width: 12%" />
+<col style="width: 15%" />
+<col style="width: 28%" />
+</colgroup>
+<thead>
+<tr>
+<th>Address</th>
+<th>For</th>
+<th>In</th>
+<th>Out</th>
+<th>Running</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>verae.splitter.in</code></td>
+<td>future split-out splitter process</td>
+<td>middleware</td>
+<td>splitter</td>
+<td><strong>no</strong></td>
+</tr>
+<tr>
+<td><code>verae.example.process.in</code></td>
+<td>template worker</td>
+<td>any</td>
+<td><code>example-process</code> Q</td>
+<td><strong>no</strong></td>
+</tr>
+<tr>
+<td><code>verae.example.process.out</code></td>
+<td>template fan-out</td>
+<td>template</td>
+<td>peers</td>
+<td><strong>no</strong></td>
+</tr>
+<tr>
+<td><code>verae.example.process.reply.&lt;id&gt;</code></td>
+<td>template reply</td>
+<td>template</td>
+<td>requester</td>
+<td><strong>no</strong></td>
+</tr>
+<tr>
+<td><code>verae.internal.jobs.events</code></td>
+<td>exclusive mailbox republish</td>
+<td>jobs-events</td>
+<td>wait/webhook</td>
+<td><strong>no</strong> unless env</td>
+</tr>
+</tbody>
+</table>
+<hr />
+<h2 id="how-to-connect-verae-api-to-nats">How to connect <strong>Verae
+API</strong> to NATS</h2>
+<p><code>api.veraetime.net</code> is <strong>HTTPS</strong>. It does not
+subscribe. The glue is middleware:</p>
+<ol type="1">
+<li>Set <code>VERAE_API_BASE_URL=https://api.veraetime.net</code> and
+<code>MOCK_VERAE=false</code>.</li>
+<li>Middleware login (username/password) → JWT stored as
+<code>tokenRef</code>.</li>
+<li><code>POST /api/timestamp</code> → 202 <code>{ jobId }</code>.</li>
+<li>Publish <code>verae.zapier.jobs.watch</code>.</li>
+<li>Poller <code>GET /api/status/{jobId}</code> until
+<code>completed</code> / <code>failed</code>.</li>
+<li>Publish <code>verae.zapier.jobs.events</code>.</li>
+<li>Wait HTTP and/or REST Hook.</li>
+</ol>
+<p>Do <strong>not</strong> point Verae at <code>NATS_URL</code>. Do
+<strong>not</strong> put NATS in Zapier env. A new worker that must see
+seals uses <code>jobs.events</code> or HTTP
+<code>GET /zapier/v1/status/{jobId}</code>.</p>
+<p>Template for a new addressed process: clone
+<code>verae-nats-process</code>, rename
+<code>verae.example.process.*</code>, add the subject to
+<code>verae-access-authz</code> policy for the plane that may call
+it.</p>
+<h1 id="zapier-verae-api-zapier">Zapier → Verae API → Zapier</h1>
+<p>How a timestamp job is submitted, watched, and returned. Lab today:
+<code>MOCK_VERAE=true</code>. Live path is the same HTTP contract with
+<code>MOCK_VERAE=false</code>.</p>
+<h2 id="rule">Rule</h2>
+<pre class="text"><code>Zapier cloud  --HTTPS only--&gt;  zap.zapier.georgelambert.org  (access-zapier)
+                                    |
+                                    v HTTPS
+                              middleware :3100 /zapier/v1
+                                    |
+                    +---------------+----------------+
+                    | HTTPS                         | NATS (private cluster)
+                    v                               v
+            api.veraetime.net              jobs.watch → poller
+            POST /api/timestamp            GET /api/status/{jobId}
+            GET  /api/status/{jobId}              |
+            POST /api/verify                      v
+                                           jobs.events
+                                              |
+                         +--------------------+--------------------+
+                         | wait subscriber                         | webhook-deliver
+                         v                                         v
+                    HTTP response to Zap                    POST hooks.zapier.com</code></pre>
+<p>Zapier never has <code>NATS_URL</code>. Verae never has
+<code>NATS_URL</code>.</p>
+<h2 id="submit-async-create">1. Submit (async create)</h2>
+<ol type="1">
+<li>Zap action <strong>Create Timestamp</strong> (or curl)
+<code>POST https://zap.zapier.georgelambert.org/zapier/v1/timestamp</code>
+with portal API key <code>zmw_…</code> (not a Verae JWT).</li>
+<li>access-zapier / edge: authz, then <code>meter()</code> records
+cents; if <code>NATS_URL</code> is set,
+<code>natsPublish(verae.billing.usage.recorded)</code>.</li>
+<li>Forwards to middleware <code>POST /zapier/v1/timestamp</code>.</li>
+<li>Middleware <code>checkEntitlement</code> (local plan limits
+today).</li>
+<li><code>veraeClient.createTimestamp</code>:
+<ul>
+<li><strong>Mock:</strong> in-process job, fake <code>jobId</code>.</li>
+<li><strong>Live:</strong>
+<code>POST https://api.veraetime.net/api/timestamp</code> with JWT →
+<strong>202</strong> <code>{ jobId }</code>.</li>
+</ul></li>
+<li>Splitter (in-process): hash vs attachments; optional
+<code>verae.archive.put</code> (bytes never go to chain).</li>
+<li><code>enqueueWatch</code> → JetStream
+<strong><code>verae.zapier.jobs.watch</code></strong>.</li>
+<li>HTTP <strong>202</strong> <code>{ jobId, sha256, existing }</code>
+back to Zapier immediately.</li>
+</ol>
+<p>Same SHA-256 is idempotent (<code>existing: true</code>).</p>
+<h2 id="monitor-job-poller">2. Monitor (job poller)</h2>
+<p>The poller is <strong>in the middleware Node process</strong> when
+<code>NATS_ENABLED=true</code> (<code>startJobPollerWorker</code>).
+Fleet does <strong>not</strong> spawn a second copy
+(<code>job-poller.enabled: false</code>).</p>
+<ol type="1">
+<li>Durable consumer <code>job-poller</code> on <code>ZAPIER_JOBS</code>
+/ <code>verae.zapier.jobs.watch</code>.</li>
+<li>Resolve <code>tokenRef</code> → tenant Verae password →
+<code>POST</code> login → JWT (stays in middleware).</li>
+<li><code>GET /api/status/{jobId}</code> (mock or live timestamp
+server).</li>
+<li><code>pending</code> → <code>nak</code> after
+<code>intervalMs</code> (retry).</li>
+<li><code>completed</code> → publish <code>jobs.events</code>
+<code>{ event: timestamp.completed, status, jobId, tenantId, traceId }</code>.</li>
+<li><code>failed</code> → <code>timestamp.failed</code>. Too many
+attempts → <code>timestamp.timeout</code>.</li>
+<li><code>ack</code> the watch message.</li>
+</ol>
+<p>Live OpenAPI: poll until <code>completed</code> /
+<code>failed</code>. Hash lookup is <strong>501</strong> on live
+(<code>lookupHash</code>). Map <code>certificate</code>,
+<code>timestamp</code>, <code>blockIndex</code>, <code>sha256</code>
+into the receipt Zap samples expect.</p>
+<h2 id="wait-sync-zap-step">3. Wait (sync Zap step)</h2>
+<p><strong>Create Timestamp and Wait</strong> →
+<code>POST /zapier/v1/timestamp/wait</code>.</p>
+<ol type="1">
+<li>Same as submit (watch is already on NATS).</li>
+<li><code>waitForJobEvent(jobId, WAIT_TIMEOUT_MS)</code> subscribes to
+<strong><code>verae.zapier.jobs.events</code></strong>.</li>
+<li>On matching <code>jobId</code> event: return status JSON
+(certificate / receipt).</li>
+<li>On timeout: <code>{ status: pending, jobId }</code> so the REST Hook
+can finish the Zap.</li>
+</ol>
+<p><code>includeAttached</code>: after seal, aggregator should
+<code>verae.archive.query</code>; bloom hits merge extra receipts.
+<strong>Simulator does this; live aggregator hook is TBD.</strong></p>
+<h2 id="push-back-to-zapier">4. Push back to Zapier</h2>
+<ul>
+<li><strong>Wait response:</strong> HTTP body on the same Zap step.</li>
+<li><strong>REST Hook:</strong> Zapier subscribes
+<code>POST /zapier/v1/hooks</code>. On <code>jobs.events</code>,
+middleware enqueues
+<strong><code>verae.zapier.webhooks.deliver</code></strong>. Worker
+POSTs <code>targetUrl</code> (<code>hooks.zapier.com</code>).</li>
+<li><strong>Poll status:</strong> Zap action <strong>Find Job
+Status</strong> → <code>GET /zapier/v1/status/{jobId}</code> →
+middleware <code>GET</code> Verae (or last event).</li>
+</ul>
+<h2 id="verify">5. Verify</h2>
+<p><code>POST /zapier/v1/verify</code> → middleware → Verae
+<code>POST /api/verify</code>. No job watch.</p>
+<h2 id="batch-merkle-designed-same-bus">6. Batch Merkle (designed; same
+bus)</h2>
+<p>From <code>MESSAGE-FLOWS.md</code>:</p>
+<ol type="1">
+<li><code>POST /v1/timestamp/batch</code> — one item per line.</li>
+<li>Middleware hashes leaves, builds Merkle tree.</li>
+<li>Chain seals <strong>only the root</strong>
+(<code>POST /api/timestamp</code> on the root).</li>
+<li>Each leaf proof → <code>verae.archive.put</code>
+<code>kind: tree</code>.</li>
+<li>Central hash lookup of a leaf misses unless
+<code>includeTree=true</code>.</li>
+<li>Aggregator broadcasts <code>verae.archive.query</code>
+<code>kinds=["tree"]</code>.</li>
+<li>Tree node bloom hit → <code>archive.reply.&lt;id&gt;</code> with
+proof.</li>
+</ol>
+<p>Live wait path does not yet call the aggregator, so tree-leaf
+receipts are not merged on NS1.</p>
+<h2 id="connect-live-api.veraetime.net">Connect live
+<code>api.veraetime.net</code></h2>
+<p>Still blocked on operator bind credentials. When ready:</p>
+<div class="sourceCode" id="cb5"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb5-1"><a href="#cb5-1" aria-hidden="true" tabindex="-1"></a><span class="co"># middleware env</span></span>
+<span id="cb5-2"><a href="#cb5-2" aria-hidden="true" tabindex="-1"></a><span class="va">MOCK_VERAE</span><span class="op">=</span>false</span>
+<span id="cb5-3"><a href="#cb5-3" aria-hidden="true" tabindex="-1"></a><span class="va">VERAE_API_BASE_URL</span><span class="op">=</span>https://api.veraetime.net</span>
+<span id="cb5-4"><a href="#cb5-4" aria-hidden="true" tabindex="-1"></a><span class="va">NATS_ENABLED</span><span class="op">=</span>true</span>
+<span id="cb5-5"><a href="#cb5-5" aria-hidden="true" tabindex="-1"></a><span class="va">NATS_URL</span><span class="op">=</span>nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222</span>
+<span id="cb5-6"><a href="#cb5-6" aria-hidden="true" tabindex="-1"></a><span class="va">JETSTREAM_REPLICAS</span><span class="op">=</span>3</span></code></pre></div>
+<p>Then: working Verae login, one live seal, confirm 202/status/verify,
+map receipt fields, REST Hook to a private Zap. See
+<code>zapier-decisions/STATUS.md</code> “Once MOCK_VERAE=false”.</p>
+<h2 id="billing-on-this-path">Billing on this path</h2>
+<table>
+<colgroup>
+<col style="width: 20%" />
+<col style="width: 41%" />
+<col style="width: 37%" />
+</colgroup>
+<thead>
+<tr>
+<th>Hop</th>
+<th>Designed</th>
+<th>Running</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>Edge meter</td>
+<td><code>verae.billing.usage.recorded</code></td>
+<td><strong>coded</strong>; fires when edge has
+<code>NATS_URL</code></td>
+</tr>
+<tr>
+<td>Account-balance</td>
+<td>subscribe + debit prepaid; 402 if empty</td>
+<td><strong>subscriber running</strong>; 402 from books not proven on
+every Zap</td>
+</tr>
+<tr>
+<td>Middleware quota</td>
+<td>local files via <code>recordUsage</code></td>
+<td><strong>running</strong>; not NATS</td>
+</tr>
+<tr>
+<td><code>verae.zapier.usage</code></td>
+<td>optional JS meter</td>
+<td>stream only</td>
+</tr>
+</tbody>
+</table>
+<h2 id="connect-a-new-internal-process">Connect a new internal
+process</h2>
+<div class="sourceCode" id="cb6"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb6-1"><a href="#cb6-1" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">NATS_URL</span><span class="op">=</span>nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222</span>
+<span id="cb6-2"><a href="#cb6-2" aria-hidden="true" tabindex="-1"></a><span class="co"># clone verae-nats-process, rename subjects, register in verae-fleet</span></span></code></pre></div>
+<p>Jobs stay: HTTP in from Zapier → HTTPS to Verae → NATS watch/events →
+HTTP back to Zapier.</p>
+<h1 id="gaps-and-finish-list">Gaps and finish list</h1>
+<p>Modules and addresses that are designed but <strong>not fully
+connected, not running as fleet workers, or not on the live Verae/Zapier
+path</strong>.</p>
+<h2 id="blocked-on-the-operator-not-a-nats-bug">Blocked on the operator
+(not a NATS bug)</h2>
+<table>
+<colgroup>
+<col style="width: 24%" />
+<col style="width: 32%" />
+<col style="width: 44%" />
+</colgroup>
+<thead>
+<tr>
+<th>Item</th>
+<th>State</th>
+<th>To finish</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>Zapier Platform <code>push</code></td>
+<td>no login</td>
+<td><code>zapier login</code> → register →
+<code>MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org</code> →
+push private app</td>
+</tr>
+<tr>
+<td>Live Verae</td>
+<td><code>MOCK_VERAE=true</code></td>
+<td>credentials; <code>MOCK_VERAE=false</code>; prove one seal</td>
+</tr>
+<tr>
+<td>nkeys / mTLS</td>
+<td>cluster <code>$G</code> only</td>
+<td><code>verae-nats-accounts</code> sketch; flip only after every
+<code>NATS_URL</code> has creds</td>
+</tr>
+<tr>
+<td>Hash lookup on live OpenAPI</td>
+<td>501</td>
+<td>Verae API gap or our store</td>
+</tr>
+</tbody>
+</table>
+<h2 id="running-on-httpnats-but-incomplete-routing">Running on HTTP/NATS
+but incomplete routing</h2>
+<table>
+<colgroup>
+<col style="width: 27%" />
+<col style="width: 34%" />
+<col style="width: 20%" />
+<col style="width: 17%" />
+</colgroup>
+<thead>
+<tr>
+<th>Module</th>
+<th>Running?</th>
+<th>NATS</th>
+<th>Gap</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>middleware HTTP + in-process job-poller + webhook-deliver</td>
+<td><strong>yes</strong></td>
+<td>watch/events/deliver</td>
+<td>live Verae + Zapier push</td>
+</tr>
+<tr>
+<td>account-balance</td>
+<td><strong>yes</strong></td>
+<td>billing RR + <code>usage.recorded</code> sub</td>
+<td>prove 402 from books on a Zap when prepaid is 0</td>
+</tr>
+<tr>
+<td>zappier-edge</td>
+<td><strong>yes</strong></td>
+<td><code>usage.recorded</code> / <code>payment.recorded</code> /
+<code>credit.applied</code> / <code>customer.put</code> <strong>if
+<code>NATS_URL</code></strong></td>
+<td>confirm live process env; Stripe live</td>
+</tr>
+<tr>
+<td>access-* + authz</td>
+<td><strong>yes</strong></td>
+<td>authz + ingress</td>
+<td>—</td>
+</tr>
+<tr>
+<td>identity</td>
+<td><strong>yes</strong> (fleet)</td>
+<td>bind/lookup</td>
+<td>confirm portal always binds <code>veraeUserId</code></td>
+</tr>
+<tr>
+<td>jobs-events mailbox <code>:3030</code></td>
+<td><strong>yes</strong> (fleet)</td>
+<td>events counter</td>
+<td>exclusive consumer off unless
+<code>JOBS_EVENTS_EXCLUSIVE=1</code></td>
+</tr>
+<tr>
+<td>CS / sales / accounting</td>
+<td><strong>yes</strong></td>
+<td>statement/adjust</td>
+<td>staff UX</td>
+</tr>
+<tr>
+<td>archive-worm + tree-node</td>
+<td><strong>yes on LXC 510</strong> (keep)</td>
+<td><code>archive.put/query/reply</code></td>
+<td>only <strong>1+1</strong> copies; fleet overlay
+<code>enabled: false</code> for extra replicas</td>
+</tr>
+<tr>
+<td>archive-aggregator</td>
+<td><strong>no</strong> as fleet worker</td>
+<td>query/reply</td>
+<td>enable overlay <strong>or</strong> finish in-process hook
+(<code>includeAttached</code> TBD in middleware)</td>
+</tr>
+<tr>
+<td>request-splitter</td>
+<td>library in middleware</td>
+<td><code>archive.put</code></td>
+<td><code>verae.splitter.in</code> not used</td>
+</tr>
+<tr>
+<td><code>ZAPIER_USAGE</code> / <code>USAGE_WRITER</code></td>
+<td>stream yes</td>
+<td><code>verae.zapier.usage</code></td>
+<td>no consumer; middleware usage is local files</td>
+</tr>
+<tr>
+<td>fleet job-poller / webhook-deliver <strong>extra</strong>
+copies</td>
+<td>overlay <strong>false</strong></td>
+<td>same subjects</td>
+<td>only enable if you want SSH-spread replicas <strong>instead
+of</strong> in-process (same queue names)</td>
+</tr>
+</tbody>
+</table>
+<h2 id="designed-not-a-live-worker">Designed, not a live worker</h2>
+<table>
+<colgroup>
+<col style="width: 27%" />
+<col style="width: 31%" />
+<col style="width: 41%" />
+</colgroup>
+<thead>
+<tr>
+<th>Module</th>
+<th>Address</th>
+<th>What to do</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>verae-nats-process</code></td>
+<td><code>verae.example.process.*</code></td>
+<td>template only; clone to add a function</td>
+</tr>
+<tr>
+<td><code>verae-activate</code></td>
+<td>none (HTTPS Zapier)</td>
+<td>optional tiny app; needs Zapier login</td>
+</tr>
+<tr>
+<td><code>verae-zapier</code> (full app)</td>
+<td>HTTPS</td>
+<td>push after login</td>
+</tr>
+<tr>
+<td>simulator</td>
+<td>in-process fake NATS</td>
+<td>local <code>:3847</code>; not production</td>
+</tr>
+<tr>
+<td><code>verae-nats-accounts</code></td>
+<td>nkeys policy</td>
+<td>not flipped</td>
+</tr>
+</tbody>
+</table>
+<h2 id="aux-no-product-subjects-or-http-only">Aux (no product subjects,
+or HTTP only)</h2>
+<table>
+<colgroup>
+<col style="width: 38%" />
+<col style="width: 28%" />
+<col style="width: 33%" />
+</colgroup>
+<thead>
+<tr>
+<th>Module</th>
+<th>NATS</th>
+<th>Notes</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>verae-keep</code></td>
+<td>none</td>
+<td>HTTP health; restarts units</td>
+</tr>
+<tr>
+<td><code>verae-fleet</code></td>
+<td>none</td>
+<td>catalog + keepFloor</td>
+</tr>
+<tr>
+<td><code>verae-uptime</code></td>
+<td>none</td>
+<td>off-box HTTPS GET of public doors</td>
+</tr>
+<tr>
+<td><code>verae-backup</code></td>
+<td>none</td>
+<td>disk / JetStream snapshot; no live event subject</td>
+</tr>
+<tr>
+<td><code>verae-bootstrap</code> / <code>verae-deploy</code> /
+<code>verae-proxmox</code> / <code>verae-ops</code></td>
+<td>none</td>
+<td>install/link</td>
+</tr>
+<tr>
+<td>staff-iam / staff-session / staff-ui</td>
+<td>none</td>
+<td>HTTP cookies</td>
+</tr>
+<tr>
+<td>public NATS edge</td>
+<td>leaf, token</td>
+<td><strong>do not</strong> use from Zapier; rotate token; later nkeys
+LEAF vs INTERNAL</td>
+</tr>
+</tbody>
+</table>
+<h2 id="billing-triggers-and-event-logging">Billing triggers and event
+logging</h2>
+<table style="width:100%;">
+<colgroup>
+<col style="width: 22%" />
+<col style="width: 28%" />
+<col style="width: 25%" />
+<col style="width: 22%" />
+</colgroup>
+<thead>
+<tr>
+<th>Signal</th>
+<th>Designed</th>
+<th>Running</th>
+<th>Finish</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>Timestamp/verify meter (edge)</td>
+<td><code>verae.billing.usage.recorded</code></td>
+<td><strong>code path exists</strong> (<code>zappier/src/app.ts</code>
+<code>onUsage</code>)</td>
+<td>Confirm <code>NATS_URL</code> on live edge; 402 from account-balance
+when prepaid empty</td>
+</tr>
+<tr>
+<td>Middleware quota</td>
+<td>local files <code>recordUsage</code></td>
+<td><strong>yes</strong></td>
+<td>Either publish <code>usage.recorded</code> too or drop duplicate
+quota</td>
+</tr>
+<tr>
+<td>Optional JS meter</td>
+<td><code>verae.zapier.usage</code> + <code>USAGE_WRITER</code></td>
+<td>stream only</td>
+<td>Wire or delete</td>
+</tr>
+<tr>
+<td>Portal reload</td>
+<td><code>payment.recorded</code> + <code>balance.adjust</code></td>
+<td>coded</td>
+<td>confirm both fire on Stripe/test reload</td>
+</tr>
+<tr>
+<td>CS credit</td>
+<td><code>balance.adjust</code> + <code>credit.applied</code></td>
+<td>coded</td>
+<td>confirm applied pub on live</td>
+</tr>
+<tr>
+<td>Customer upsert</td>
+<td><code>customer.put</code></td>
+<td>coded</td>
+<td>—</td>
+</tr>
+<tr>
+<td>Authz deny audit</td>
+<td><code>verae.access.authz.deny</code></td>
+<td>running on deny</td>
+<td><strong>no SIEM sink</strong></td>
+</tr>
+<tr>
+<td>Job lifecycle log</td>
+<td><code>jobs.events</code></td>
+<td>running</td>
+<td>mailbox counts only — add structured log/export if needed</td>
+</tr>
+<tr>
+<td>Archive put/query</td>
+<td><code>VERAE_ARCHIVE</code></td>
+<td>510 worm/tree</td>
+<td>aggregator not in wait path</td>
+</tr>
+<tr>
+<td>Public edge</td>
+<td>leaf</td>
+<td>running</td>
+<td>rotate token; do not expose <code>:6222</code></td>
+</tr>
+</tbody>
+</table>
+<h2 id="ordered-finish-for-message-routing">Ordered finish for message
+routing</h2>
+<ol type="1">
+<li><strong>Do not double-start</strong> job-poller: either in-process
+<strong>or</strong> fleet copies, same queue
+<code>job-poller</code>.</li>
+<li>Confirm edge <strong><code>NATS_URL</code></strong> so
+<code>usage.recorded</code> actually lands; then 402 from books. Unify
+or drop middleware local <code>recordUsage</code>.</li>
+<li>Enable <strong>archive-aggregator</strong> (or in-process
+equivalent) so <code>includeAttached</code> and tree proofs work on
+wait/status.</li>
+<li>Raise worm/tree <strong>replica floors</strong> on 510/more CTs if
+archive HA is required (fleet overlay min 3).</li>
+<li>Operator: Zapier <code>push</code> +
+<code>MOCK_VERAE=false</code>.</li>
+<li>Prove: Zap create → <code>jobs.watch</code> → live
+<code>GET /api/status</code> → <code>jobs.events</code> → wait body +
+REST Hook.</li>
+<li>nkeys/mTLS after every client has creds; then lock down the public
+edge to accounts (LEAF vs INTERNAL).</li>
+<li>Optional: exclusive <code>jobs-events</code> mailbox; SIEM on
+<code>authz.deny</code> and <code>jobs.events</code>;
+<code>verae.splitter.in</code> if splitter is split out;
+<code>USAGE_WRITER</code> or delete <code>ZAPIER_USAGE</code>.</li>
+</ol>
+<h2 id="what-is-already-enough-for-a-mock-zap">What is already enough
+for a mock Zap</h2>
+<p>HTTPS zap/mw → mock create → <code>jobs.watch</code> → in-process
+poller → mock status completed → <code>jobs.events</code> → wait returns
+mock certificate. Archive extras and live chain are the missing
+middle.</p>
+<h1 id="developer-credentials-and-connection-info">Developer credentials
+and connection info</h1>
+<p>Lab pack for the Verae Time × Zapier stack on
+<strong>NS1.GEORGELAMBERT.ORG</strong> (<code>70.88.205.138</code>).
+Values below were checked <strong>2026-09-14</strong>. These are
+<strong>lab defaults</strong>, not production secrets. Rotate the public
+NATS token and admin secrets before treating this as a customer
+environment.</p>
+<p>Zapier cloud <strong>never</strong> gets a NATS URL or a Verae
+password.</p>
+<h2 id="who-you-are-talking-to">1. Who you are talking to</h2>
+<table>
+<colgroup>
+<col style="width: 50%" />
+<col style="width: 50%" />
+</colgroup>
+<thead>
+<tr>
+<th>Host</th>
+<th>Role</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>70.88.205.138</code></td>
+<td>NS1 Proxmox. Public HTTPS + public NATS <strong>client</strong>
+edge</td>
+</tr>
+<tr>
+<td><code>10.10.10.20</code></td>
+<td>LXC 510 <code>verae-px-worker</code> (worm + tree)</td>
+</tr>
+<tr>
+<td><code>10.10.10.21–23</code></td>
+<td>LXC 511–513 <code>nats-a/b/c</code> JetStream cluster
+<code>verae</code></td>
+</tr>
+</tbody>
+</table>
+<p>SSH to the box: <code>ssh marchon@70.88.205.138</code><br />
+Git SSH:
+<code>ssh://git@git.georgelambert.org:2223/marchon/&lt;repo&gt;.git</code>
+(port <strong>2223</strong>)</p>
+<h2 id="public-https-doors-live">2. Public HTTPS doors (live)</h2>
+<p>Wildcard <code>*.zapier.georgelambert.org</code> →
+<code>70.88.205.138</code>.</p>
+<table>
+<colgroup>
+<col style="width: 15%" />
+<col style="width: 28%" />
+<col style="width: 18%" />
+<col style="width: 37%" />
+</colgroup>
+<thead>
+<tr>
+<th>URL</th>
+<th>Process</th>
+<th>Port</th>
+<th>Last check</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>https://zapier.georgelambert.org/</td>
+<td>docs catalog</td>
+<td>files</td>
+<td>200</td>
+</tr>
+<tr>
+<td>https://git.georgelambert.org/</td>
+<td>Forgejo</td>
+<td>:443 / SSH :2223</td>
+<td>200</td>
+</tr>
+<tr>
+<td>https://portal.zapier.georgelambert.org/</td>
+<td>access-web → <code>/portal/</code></td>
+<td>:3021</td>
+<td>302 → portal</td>
+</tr>
+<tr>
+<td>https://api.zapier.georgelambert.org/health</td>
+<td>access-api</td>
+<td>:3022</td>
+<td>200</td>
+</tr>
+<tr>
+<td>https://leaf.zapier.georgelambert.org/health</td>
+<td>access-leaf</td>
+<td>:3023</td>
+<td>200</td>
+</tr>
+<tr>
+<td>https://zap.zapier.georgelambert.org/health</td>
+<td>access-zapier</td>
+<td>:3024</td>
+<td>200</td>
+</tr>
+<tr>
+<td>https://staff.zapier.georgelambert.org/</td>
+<td>access-staff</td>
+<td>:3025</td>
+<td>302 login</td>
+</tr>
+<tr>
+<td>https://login.zapier.georgelambert.org/</td>
+<td>staff-session</td>
+<td>:3027</td>
+<td>200</td>
+</tr>
+<tr>
+<td>https://iam.zapier.georgelambert.org/health</td>
+<td>staff-iam</td>
+<td>:3028</td>
+<td>200 (<code>users: 5</code>)</td>
+</tr>
+<tr>
+<td>https://cs.zapier.georgelambert.org/</td>
+<td>customer-service</td>
+<td>:3011</td>
+<td>302</td>
+</tr>
+<tr>
+<td>https://sales.zapier.georgelambert.org/</td>
+<td>sales-pricing</td>
+<td>:3012</td>
+<td>302</td>
+</tr>
+<tr>
+<td>https://acct.zapier.georgelambert.org/</td>
+<td>accounting-export</td>
+<td>:3013</td>
+<td>302</td>
+</tr>
+<tr>
+<td>https://mw.zapier.georgelambert.org/health</td>
+<td>middleware</td>
+<td>:3100</td>
+<td>200 <code>mockVerae:true</code> <code>natsConnected:true</code></td>
+</tr>
+<tr>
+<td>https://fleet.zapier.georgelambert.org/</td>
+<td>fleet console</td>
+<td>:3850</td>
+<td>302</td>
+</tr>
+<tr>
+<td>https://nats.zapier.georgelambert.org/</td>
+<td>NATS WebSocket (Caddy)</td>
+<td>14422</td>
+<td><strong>400</strong> on GET (expected; it is WS)</td>
+</tr>
+</tbody>
+</table>
+<p>Loopback on NS1 (not public): zappier-edge
+<strong><code>127.0.0.1:13000</code></strong> (admin + Stripe + SQLite).
+Tunnel:</p>
+<div class="sourceCode" id="cb7"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb7-1"><a href="#cb7-1" aria-hidden="true" tabindex="-1"></a><span class="fu">ssh</span> <span class="at">-L</span> 13000:127.0.0.1:13000 marchon@70.88.205.138</span>
+<span id="cb7-2"><a href="#cb7-2" aria-hidden="true" tabindex="-1"></a><span class="co"># then http://127.0.0.1:13000/admin  and  /docs</span></span></code></pre></div>
+<p>Operator console tunnel:
+<code>ssh -L 3850:127.0.0.1:3850 marchon@70.88.205.138</code></p>
+<h2 id="nats">3. NATS</h2>
+<h3 id="internal-cluster-workers-keep-fleet">Internal cluster (workers,
+keep, fleet)</h3>
+<p>No token. Private <code>vmbr1</code> only.</p>
+<pre class="text"><code>NATS_URL=nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+JETSTREAM_REPLICAS=3</code></pre>
+<table>
+<thead>
+<tr>
+<th>Port</th>
+<th>Bind</th>
+<th>Use</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>:4222</code></td>
+<td><code>10.10.10.21–23</code></td>
+<td>clients</td>
+</tr>
+<tr>
+<td><code>:6222</code></td>
+<td>same, <code>vmbr1</code></td>
+<td>cluster routes — <strong>do not publish</strong></td>
+</tr>
+<tr>
+<td><code>:7422</code></td>
+<td>same</td>
+<td>leaf hubs for the public edge — <strong>do not publish</strong></td>
+</tr>
+<tr>
+<td><code>:8222</code></td>
+<td><code>127.0.0.1</code> on each LXC</td>
+<td>monitor</td>
+</tr>
+</tbody>
+</table>
+<p>From a laptop you <strong>cannot</strong> reach
+<code>10.10.10.x</code> unless you are on NS1 or you tunnel:</p>
+<div class="sourceCode" id="cb9"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb9-1"><a href="#cb9-1" aria-hidden="true" tabindex="-1"></a><span class="fu">ssh</span> <span class="at">-L</span> 14222:10.10.10.21:4222 <span class="at">-L</span> 14223:10.10.10.22:4222 <span class="at">-L</span> 14224:10.10.10.23:4222 marchon@70.88.205.138</span>
+<span id="cb9-2"><a href="#cb9-2" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">NATS_URL</span><span class="op">=</span>nats://127.0.0.1:14222,nats://127.0.0.1:14223,nats://127.0.0.1:14224</span></code></pre></div>
+<h3 id="public-client-edge-token">Public client edge (token)</h3>
+<p>Live token (file <code>/etc/nats/public-edge.token</code> on
+NS1):</p>
+<pre class="text"><code>4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9</code></pre>
+<pre class="text"><code>nats://4743a49383ce2ce86e99d9d41c45c0004fe75eb23ef3a2b9@70.88.205.138:4222
+wss://nats.zapier.georgelambert.org</code></pre>
+<p><code>CONNECT</code> with that token returns <code>PONG</code>
+(checked 2026-09-14). <code>auth_required: true</code>. Server name
+<code>nats-public-edge</code>. <strong>Do not</strong> put this URL in
+Zapier. Recreate:
+<code>bash packages/verae-nats-cluster/scripts/expose-public.sh</code>
+on NS1.</p>
+<p>Leftover lab listeners (ignore for new clients): host
+<code>127.0.0.1:4222</code> docker-proxy, <code>10.10.10.1:4222</code>
+socat. zappier-edge process still has
+<code>NATS_URL=nats://127.0.0.1:4222</code> — billing pubs may miss the
+3-node cluster until that env is flipped.</p>
+<p>nkeys/mTLS: <strong>not</strong> on. Isolation is LAN + token.</p>
+<h2 id="middleware-jobs">4. Middleware (jobs)</h2>
+<p>Live: <code>MOCK_VERAE=true</code>, <code>NATS_ENABLED=true</code>,
+cluster URL as above, <code>ADMIN_SECRET=change-me-admin</code>
+(default), <code>TOKEN_SECRET=dev-secret-change-me</code> (default).</p>
+<h3 id="lab-tenant-created-2026-09-14-for-this-pack">Lab tenant (created
+2026-09-14 for this pack)</h3>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Value</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>tenantId</td>
+<td><code>tenant-dev-lab-local-89ab82de</code></td>
+</tr>
+<tr>
+<td>plan</td>
+<td>free</td>
+</tr>
+<tr>
+<td>API key</td>
+<td><code>zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun</code></td>
+</tr>
+<tr>
+<td>mock Verae user</td>
+<td><code>lab-dev</code> / <code>lab-dev-pass</code></td>
+</tr>
+<tr>
+<td>veraeUserId</td>
+<td><code>vu_20ed6029b99efb2e</code></td>
+</tr>
+</tbody>
+</table>
+<p>Proven: <code>GET /zapier/v1/auth/me</code> → valid;
+<code>POST /zapier/v1/timestamp</code> → 202 <code>jobId</code>; wait →
+mock certificate <code>blockIndex: 42</code>.</p>
+<div class="sourceCode" id="cb12"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb12-1"><a href="#cb12-1" aria-hidden="true" tabindex="-1"></a><span class="va">KEY</span><span class="op">=</span>zmw_pXdwlUUyMHkAvqj3RRoQ2gOG6yAUQlun</span>
+<span id="cb12-2"><a href="#cb12-2" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb12-3"><a href="#cb12-3" aria-hidden="true" tabindex="-1"></a><span class="ex">curl</span> <span class="at">-sS</span> <span class="at">-H</span> <span class="st">&quot;x-api-key: </span><span class="va">$KEY</span><span class="st">&quot;</span> https://mw.zapier.georgelambert.org/zapier/v1/auth/me</span>
+<span id="cb12-4"><a href="#cb12-4" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb12-5"><a href="#cb12-5" aria-hidden="true" tabindex="-1"></a><span class="ex">curl</span> <span class="at">-sS</span> <span class="at">-H</span> <span class="st">&quot;x-api-key: </span><span class="va">$KEY</span><span class="st">&quot;</span> <span class="at">-H</span> <span class="st">&quot;content-type: application/json&quot;</span> <span class="dt">\</span></span>
+<span id="cb12-6"><a href="#cb12-6" aria-hidden="true" tabindex="-1"></a>  <span class="at">-d</span> <span class="st">&#39;{&quot;sha256&quot;:&quot;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&quot;}&#39;</span> <span class="dt">\</span></span>
+<span id="cb12-7"><a href="#cb12-7" aria-hidden="true" tabindex="-1"></a>  https://mw.zapier.georgelambert.org/zapier/v1/timestamp</span>
+<span id="cb12-8"><a href="#cb12-8" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb12-9"><a href="#cb12-9" aria-hidden="true" tabindex="-1"></a><span class="ex">curl</span> <span class="at">-sS</span> <span class="at">-H</span> <span class="st">&quot;x-api-key: </span><span class="va">$KEY</span><span class="st">&quot;</span> <span class="at">-H</span> <span class="st">&quot;content-type: application/json&quot;</span> <span class="dt">\</span></span>
+<span id="cb12-10"><a href="#cb12-10" aria-hidden="true" tabindex="-1"></a>  <span class="at">-d</span> <span class="st">&#39;{&quot;sha256&quot;:&quot;bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb&quot;}&#39;</span> <span class="dt">\</span></span>
+<span id="cb12-11"><a href="#cb12-11" aria-hidden="true" tabindex="-1"></a>  https://mw.zapier.georgelambert.org/zapier/v1/timestamp/wait</span></code></pre></div>
+<p>Customer API plane (forwards <code>x-api-key</code> to
+middleware):</p>
+<div class="sourceCode" id="cb13"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb13-1"><a href="#cb13-1" aria-hidden="true" tabindex="-1"></a><span class="ex">curl</span> <span class="at">-sS</span> <span class="at">-H</span> <span class="st">&quot;x-api-key: </span><span class="va">$KEY</span><span class="st">&quot;</span> <span class="at">-H</span> <span class="st">&quot;content-type: application/json&quot;</span> <span class="dt">\</span></span>
+<span id="cb13-2"><a href="#cb13-2" aria-hidden="true" tabindex="-1"></a>  <span class="at">-d</span> <span class="st">&#39;{&quot;sha256&quot;:&quot;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&quot;}&#39;</span> <span class="dt">\</span></span>
+<span id="cb13-3"><a href="#cb13-3" aria-hidden="true" tabindex="-1"></a>  https://api.zapier.georgelambert.org/v1/timestamp</span></code></pre></div>
+<p><code>https://zap.zapier.georgelambert.org</code> is the Zapier
+<strong>plane</strong>. It does <strong>not</strong> currently forward
+<code>x-api-key</code> on timestamp (401 if you curl it with a key).
+Zapier Platform push is still waiting on login; when it is live, set
+<code>MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org</code>
+and use a <code>zmw_…</code> key in the Zap.</p>
+<p>Mint another key (mock Verae accepts any username/password):</p>
+<div class="sourceCode" id="cb14"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb14-1"><a href="#cb14-1" aria-hidden="true" tabindex="-1"></a><span class="ex">curl</span> <span class="at">-sS</span> <span class="at">-H</span> <span class="st">&quot;content-type: application/json&quot;</span> <span class="dt">\</span></span>
+<span id="cb14-2"><a href="#cb14-2" aria-hidden="true" tabindex="-1"></a>  <span class="at">-d</span> <span class="st">&#39;{&quot;email&quot;:&quot;you@lab.local&quot;,&quot;name&quot;:&quot;You&quot;,&quot;veraeUsername&quot;:&quot;you&quot;,&quot;veraePassword&quot;:&quot;you-pass&quot;}&#39;</span> <span class="dt">\</span></span>
+<span id="cb14-3"><a href="#cb14-3" aria-hidden="true" tabindex="-1"></a>  https://mw.zapier.georgelambert.org/zapier/v1/signup</span></code></pre></div>
+<p>Admin list/provision:</p>
+<div class="sourceCode" id="cb15"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb15-1"><a href="#cb15-1" aria-hidden="true" tabindex="-1"></a><span class="ex">curl</span> <span class="at">-sS</span> <span class="at">-H</span> <span class="st">&quot;x-admin-secret: change-me-admin&quot;</span> <span class="dt">\</span></span>
+<span id="cb15-2"><a href="#cb15-2" aria-hidden="true" tabindex="-1"></a>  https://mw.zapier.georgelambert.org/zapier/v1/admin/tenants</span></code></pre></div>
+<h2 id="portal-zappier-edge-billing-users">5. Portal / zappier-edge
+(billing users)</h2>
+<p>SQLite
+<code>/SSD3/moved/home-marchon/verae-stack/packages/zappier/zappier.db</code>.
+Bind <code>127.0.0.1:13000</code>.</p>
+<p>Seed <strong>customer API keys</strong> (<code>x-api-key</code> on
+edge <code>/v1/*</code>, <strong>not</strong> middleware
+<code>zmw_</code>):</p>
+<table>
+<thead>
+<tr>
+<th>Customer</th>
+<th>tier</th>
+<th>key</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>Ada (free)</td>
+<td>free</td>
+<td><code>key-ada</code></td>
+</tr>
+<tr>
+<td>Grace (pro)</td>
+<td>pro</td>
+<td><code>key-grace</code></td>
+</tr>
+<tr>
+<td>Linus (business)</td>
+<td>business</td>
+<td><code>key-linus</code></td>
+</tr>
+<tr>
+<td>Docs Capture</td>
+<td>free</td>
+<td><code>key-021851970d8a22c6</code></td>
+</tr>
+</tbody>
+</table>
+<p>These keys are for the <strong>edge meter / portal</strong>.
+Middleware jobs need a <code>zmw_…</code> key (section 4).</p>
+<p>Seed <strong>admin console</strong> (<code>/admin</code>,
+<code>x-admin-key</code> or login):</p>
+<table>
+<thead>
+<tr>
+<th>username</th>
+<th>password</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>admin</code></td>
+<td><code>admin-dev-key</code></td>
+</tr>
+<tr>
+<td><code>demo</code></td>
+<td><code>$$$Adm1n###</code></td>
+</tr>
+</tbody>
+</table>
+<p><code>ZAPPIER_ADMIN_KEY</code> default on CS/sales/staff processes:
+<code>admin-dev-key</code>.</p>
+<p>Stripe: <strong>not</strong> live (lab quotes only). Env
+<code>STRIPE_*</code> unset on the sampled edge process.</p>
+<p>Signup more customers at
+https://portal.zapier.georgelambert.org/portal/</p>
+<h2 id="staff-iam">6. Staff IAM</h2>
+<p>https://login.zapier.georgelambert.org/ ·
+https://iam.zapier.georgelambert.org/</p>
+<p>Seed users (defaults; live IAM has these five):</p>
+<table>
+<thead>
+<tr>
+<th>username</th>
+<th>password</th>
+<th>role</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>admin</code></td>
+<td><code>admin-dev-key</code></td>
+<td>owner</td>
+</tr>
+<tr>
+<td><code>cs</code></td>
+<td><code>cs-dev-key</code></td>
+<td>cs</td>
+</tr>
+<tr>
+<td><code>sales</code></td>
+<td><code>sales-dev-key</code></td>
+<td>sales</td>
+</tr>
+<tr>
+<td><code>accounting</code></td>
+<td><code>acct-dev-key</code></td>
+<td>accounting</td>
+</tr>
+<tr>
+<td><code>operator</code></td>
+<td><code>fleet-dev-key</code></td>
+<td>operator</td>
+</tr>
+</tbody>
+</table>
+<p><code>STAFF_KEY</code> / session fallback:
+<code>admin-dev-key</code>.</p>
+<h2 id="leaf-plane">7. Leaf plane</h2>
+<p>https://leaf.zapier.georgelambert.org/health →
+<code>verae.access.leaf.in</code></p>
+<p>Live: <code>LEAF_TOKEN=leaf-dev-token</code></p>
+<div class="sourceCode" id="cb16"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb16-1"><a href="#cb16-1" aria-hidden="true" tabindex="-1"></a><span class="ex">curl</span> <span class="at">-sS</span> <span class="at">-H</span> <span class="st">&quot;content-type: application/json&quot;</span> <span class="dt">\</span></span>
+<span id="cb16-2"><a href="#cb16-2" aria-hidden="true" tabindex="-1"></a>  <span class="at">-d</span> <span class="st">&#39;{&quot;token&quot;:&quot;leaf-dev-token&quot;,&quot;target&quot;:&quot;verae.archive.put&quot;,&quot;payload&quot;:{},&quot;principal&quot;:&quot;dev&quot;}&#39;</span> <span class="dt">\</span></span>
+<span id="cb16-3"><a href="#cb16-3" aria-hidden="true" tabindex="-1"></a>  https://leaf.zapier.georgelambert.org/</span></code></pre></div>
+<p>Billing targets are <strong>denied</strong> on this plane.</p>
+<h2 id="git-forgejo">8. Git (Forgejo)</h2>
+<table>
+<colgroup>
+<col style="width: 50%" />
+<col style="width: 50%" />
+</colgroup>
+<tbody>
+<tr>
+<td>Web</td>
+<td>https://git.georgelambert.org/marchon/</td>
+</tr>
+<tr>
+<td>SSH</td>
+<td><code>ssh://git@git.georgelambert.org:2223/marchon/&lt;name&gt;.git</code></td>
+</tr>
+<tr>
+<td>User</td>
+<td><code>marchon</code></td>
+</tr>
+<tr>
+<td>Overview of routes</td>
+<td>https://git.georgelambert.org/marchon/dev-overview</td>
+</tr>
+<tr>
+<td>Monorepo</td>
+<td><code>master-zapier-plan-draft</code></td>
+</tr>
+<tr>
+<td>Bootstrap</td>
+<td>https://git.georgelambert.org/marchon/verae-bootstrap</td>
+</tr>
+</tbody>
+</table>
+<div class="sourceCode" id="cb17"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb17-1"><a href="#cb17-1" aria-hidden="true" tabindex="-1"></a><span class="va">GIT_SSH_COMMAND</span><span class="op">=</span><span class="st">&quot;ssh -p 2223&quot;</span> <span class="fu">git</span> clone ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git</span></code></pre></div>
+<p>Add your SSH public key on Forgejo (user <strong>marchon</strong> or
+a new account). Do not commit deploy tokens.</p>
+<p>Clone-all:</p>
+<div class="sourceCode" id="cb18"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb18-1"><a href="#cb18-1" aria-hidden="true" tabindex="-1"></a><span class="fu">git</span> clone ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git</span>
+<span id="cb18-2"><a href="#cb18-2" aria-hidden="true" tabindex="-1"></a><span class="bu">cd</span> verae-bootstrap</span>
+<span id="cb18-3"><a href="#cb18-3" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">VERAE_SRC</span><span class="op">=</span><span class="va">$HOME</span>/verae-src</span>
+<span id="cb18-4"><a href="#cb18-4" aria-hidden="true" tabindex="-1"></a><span class="fu">bash</span> scripts/fetch.sh ns1-all-in-one</span></code></pre></div>
+<h2 id="environment-cheat-sheet-new-worker-on-the-cluster">9.
+Environment cheat sheet (new worker on the cluster)</h2>
+<div class="sourceCode" id="cb19"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb19-1"><a href="#cb19-1" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">NATS_URL</span><span class="op">=</span>nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222</span>
+<span id="cb19-2"><a href="#cb19-2" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">JETSTREAM_REPLICAS</span><span class="op">=</span>3</span>
+<span id="cb19-3"><a href="#cb19-3" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">NATS_ENABLED</span><span class="op">=</span>true</span>
+<span id="cb19-4"><a href="#cb19-4" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">MOCK_VERAE</span><span class="op">=</span>true          <span class="co"># flip to false only with live Verae login</span></span>
+<span id="cb19-5"><a href="#cb19-5" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">VERAE_API_BASE_URL</span><span class="op">=</span>https://api.veraetime.net</span>
+<span id="cb19-6"><a href="#cb19-6" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">AUTHZ_URL</span><span class="op">=</span>http://127.0.0.1:3020</span>
+<span id="cb19-7"><a href="#cb19-7" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">ZAPPIER_UPSTREAM</span><span class="op">=</span>http://127.0.0.1:3100</span>
+<span id="cb19-8"><a href="#cb19-8" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">ZAPPIER_ADMIN_URL</span><span class="op">=</span>http://127.0.0.1:13000</span>
+<span id="cb19-9"><a href="#cb19-9" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">ZAPPIER_ADMIN_KEY</span><span class="op">=</span>admin-dev-key</span>
+<span id="cb19-10"><a href="#cb19-10" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">LEAF_TOKEN</span><span class="op">=</span>leaf-dev-token</span>
+<span id="cb19-11"><a href="#cb19-11" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">STAFF_IAM_URL</span><span class="op">=</span>http://127.0.0.1:3028</span></code></pre></div>
+<p>Template worker: clone <code>verae-nats-process</code>, rename
+<code>verae.example.process.*</code>.</p>
+<h2 id="not-issued-yet-blocked">10. Not issued yet (blocked)</h2>
+<table>
+<colgroup>
+<col style="width: 54%" />
+<col style="width: 45%" />
+</colgroup>
+<thead>
+<tr>
+<th>Item</th>
+<th>Why</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>Zapier Platform deploy key / <code>zapier login</code></td>
+<td>operator has not logged the CLI in</td>
+</tr>
+<tr>
+<td>Live <code>api.veraetime.net</code> username/password</td>
+<td><code>MOCK_VERAE=true</code>; JWT would stay in middleware</td>
+</tr>
+<tr>
+<td>NATS nkeys / account creds</td>
+<td>cluster is <code>$G</code> + LAN</td>
+</tr>
+<tr>
+<td>Stripe live secret</td>
+<td>lab only</td>
+</tr>
+<tr>
+<td>lan-134 SSH worker</td>
+<td>disabled</td>
+</tr>
+</tbody>
+</table>
+<p>When Zapier login exists:
+<code>MIDDLEWARE_BASE_URL=https://zap.zapier.georgelambert.org</code>,
+auth field <code>api_key</code> = <code>zmw_…</code>.</p>
+<p>When live Verae exists: middleware <code>MOCK_VERAE=false</code> +
+<code>VERAE_API_BASE_URL=https://api.veraetime.net</code> + working
+login. Zapier still never sees that password.</p>
+<h2 id="related-docs">11. Related docs</h2>
+<ul>
+<li>Routes: <a href="01-nats-routes.md">01-nats-routes.md</a></li>
+<li>Endpoint I/O: <a href="02-endpoint-io.md">02-endpoint-io.md</a></li>
+<li>Job path: <a
+href="03-zapier-verae-path.md">03-zapier-verae-path.md</a></li>
+<li>Gaps: <a href="04-gaps-and-finish.md">04-gaps-and-finish.md</a></li>
+<li>Ops start:
+https://zapier.georgelambert.org/packages/verae-ops/GETTING-STARTED.pdf</li>
+<li>Status:
+https://zapier.georgelambert.org/packages/zapier-decisions/STATUS.pdf</li>
+</ul>
+</body>
+</html>
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..4be046f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,31 @@
+# dev-overview
+
+Developer map of the Verae Time × Zapier **NATS message fabric**: what was designed, what is actually running on NS1, how a Zapier timestamp job reaches `api.veraetime.net` (or the mock) and comes back, and what is still unwired.
+
+**Forgejo:** https://git.georgelambert.org/marchon/dev-overview  
+**SSH:** `ssh://git@git.georgelambert.org:2223/marchon/dev-overview.git`  
+**Catalog:** https://zapier.georgelambert.org/packages/dev-overview/  
+**Date:** 2026-09-14  
+
+Zapier cloud **never** connects to NATS. It talks HTTPS to `https://zap.zapier.georgelambert.org` (access-zapier) then middleware. `api.veraetime.net` is **HTTPS only** — middleware is the NATS client.
+
+## Contents
+
+| Doc | What |
+|-----|------|
+| [00-sources.md](00-sources.md) | Every other doc that names a NATS address or TCP route |
+| [01-nats-routes.md](01-nats-routes.md) | Transport ports + every `verae.*` address: designed vs running |
+| [02-endpoint-io.md](02-endpoint-io.md) | Per-address: purpose, inbound from, outbound to, how to connect Verae API |
+| [03-zapier-verae-path.md](03-zapier-verae-path.md) | Zapier → middleware → Verae timestamp server → poll → events → Zapier |
+| [04-gaps-and-finish.md](04-gaps-and-finish.md) | Modules not connected; billing/event/aux; ordered finish list |
+| [05-developer-credentials.md](05-developer-credentials.md) | URLs, tokens, lab API keys, staff/IAM, git, env cheat sheet |
+
+## Cluster (running)
+
+```text
+nats://10.10.10.21:4222,nats://10.10.10.22:4222,nats://10.10.10.23:4222
+```
+
+JetStream streams (replicas=3, file): `ZAPIER_JOBS`, `ZAPIER_EVENTS`, `ZAPIER_WEBHOOKS`, `ZAPIER_USAGE`, `VERAE_ARCHIVE`.
+
+Public token-gated **client** edge (not cluster routes): `nats://<token>@70.88.205.138:4222`, `wss://nats.zapier.georgelambert.org`. Do not put this in Zapier.
diff --git a/README.pdf b/README.pdf
new file mode 100644
index 0000000..53d9222
Binary files /dev/null and b/README.pdf differ
diff --git a/SUMMARY.md b/SUMMARY.md
new file mode 100644
index 0000000..15ad1b3
--- /dev/null
+++ b/SUMMARY.md
@@ -0,0 +1,8 @@
+# dev-overview
+
+Developer map of **designed vs running** NATS addresses, transport ports, per-endpoint I/O, the Zapier → Verae timestamp path, and what is still unconnected.
+
+**Forgejo:** https://git.georgelambert.org/marchon/dev-overview  
+**Catalog:** https://zapier.georgelambert.org/packages/dev-overview/
+
+Start: [README.md](README.md). Credentials: [05-developer-credentials.md](05-developer-credentials.md).
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..50cd11b
--- /dev/null
+++ b/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "dev-overview",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Developer map of designed vs running NATS routes, Zapier↔Verae job path, and remaining wiring"
+}