Sync docs, add verae-bootstrap, and run the full stack on NS1.

Docs match current modules: public portal is access-web /portal/,
IAM and keep are listed, edge is loopback. Bootstrap clones every
Forgejo repo and installs deps per server type. Fleet starts IAM
and staff-session. NS1 all-in-one uses edge :13000 because :3000
is taken; archive workers stay with keep.

packages/docs-master/README.md

@@ -27,6 +27,9 @@ Summaries, NATS contracts, and message flows for every Verae Time × Zapier modu
 | verae-nats-process | https://git.georgelambert.org/marchon/verae-nats-process |
 | **zapier-docs-master** (this repo) | https://git.georgelambert.org/marchon/zapier-docs-master |
 | **verae-ops** | https://git.georgelambert.org/marchon/verae-ops |
+| verae-staff-iam | https://git.georgelambert.org/marchon/verae-staff-iam |
+| verae-keep | https://git.georgelambert.org/marchon/verae-keep |
+| verae-bootstrap | https://git.georgelambert.org/marchon/verae-bootstrap |
 
 Clone (SSH port 2223):
 

packages/docs-master/modules-and-nats.md

@@ -51,6 +51,9 @@ Zapier cloud **never** connects to NATS. Internal services do: middleware worker
 | zapier-user-docs | `zapier-user-docs` | Static | — | catalog `/user-docs/` |
 | verae-chain-client | `verae-chain-client` | Library | — | HTTPS `api.veraetime.net` or MOCK |
 | fleet | `verae-fleet` | Local HTTP :3850 | operator | keepFloor + SSH hosts |
+| staff-iam | `verae-staff-iam` | :3028 | staff login | none (HTTP) |
+| keep | `verae-keep` | :3860 / :3861 | host supervisor | none |
+| bootstrap | `verae-bootstrap` | clone/install | — | — |
 | overview | `overview` | Static | — | high-level map |
 | nats-process | `verae-nats-process` | Template worker | `verae.example.process.in` | `.out` / `.reply.*` |
 | docs-master | `zapier-docs-master` | Static | — | published on zapier.georgelambert.org |

packages/docs-master/modules/verae-bootstrap/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-bootstrap
+
+None. Install-time only.

packages/docs-master/modules/verae-bootstrap/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-bootstrap
+
+Clone Forgejo modules and install npm deps. Server types under `types/`.

packages/docs-master/modules/verae-keep/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-keep
+
+None. HTTP probes only.

packages/docs-master/modules/verae-keep/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-keep
+
+Host keep-alive. Restarts crashed units unless fleet paused or stopped them.

packages/docs-master/modules/verae-staff-iam/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-staff-iam
+
+None. HTTP `:3028`.

packages/docs-master/modules/verae-staff-iam/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-staff-iam
+
+Named internal staff accounts, roles, permissions, JSON sessions, login rate-limit.

packages/overview/02-modules-and-repos.md

@@ -36,6 +36,8 @@ Each runtime piece is its **own git repo** on Forgejo (`git.georgelambert.org`,
 | **verae-staff-session** | `packages/verae-staff-session` | Shared staff cookie login for department HTML |
 | **verae-staff-ui** | `packages/verae-staff-ui` | Shared staff review HTML (CS + access-staff) |
 | **verae-staff-iam** | `packages/verae-staff-iam` | Internal staff users, roles, permissions, audit |
+| **verae-keep** | `packages/verae-keep` | Host keep-alive + watch + guard (honors admin pause/stop) |
+| **verae-bootstrap** | `packages/verae-bootstrap` | Clone every repo and install deps for each server type |
 | **zapier-docs-master** | `packages/docs-master` | Per-module `SUMMARY.md` + `NATS.md` |
 | **verae-ops** | `packages/verae-ops` | Docker, Proxmox, VMs, dedicated hardware, linking services |
 

packages/overview/10-docs-sync.md

@@ -0,0 +1,29 @@
+# Documentation sync (2026-09-11)
+
+Validated against the module list in `packages/` and Forgejo repos.
+
+## Current public doors
+
+| Door | Bind | Notes |
+|------|------|--------|
+| Customer portal | access-web `:3021/portal/` | Static + `/portal/api` → loopback edge |
+| Customer API | access-api `:3022` | |
+| S2S leaf | access-leaf `:3023` | No billing subjects |
+| Zapier | access-zapier `:3024` | Only Zapier HTTPS |
+| Staff plane | access-staff `:3025` | After IAM |
+| zappier-edge | loopback `:3000` (NS1 all-in-one `:13000`) | Admin, Stripe, not a public portal |
+| Operator console | fleet `:3850` on `0.0.0.0` | Pause/stop honored by keep |
+| Staff IAM | `:3028` | Named users, roles, sessions |
+| Keep | `:3860` + watch `:3861` + `guard.sh` | Restart unless paused/stopped |
+
+## New modules since the last catalog pass
+
+- `verae-staff-iam`, `verae-staff-session`, `verae-staff-ui`
+- `verae-keep`
+- `verae-bootstrap` (clone + npm per server type)
+
+## Still blocked (not closable here)
+
+- Live `api.veraetime.net` (`MOCK_VERAE=false`)
+- NATS nkeys/mTLS three-node cluster
+- Zapier Platform `push`

packages/ui-docs/WALKTHROUGH.md

@@ -98,7 +98,7 @@ Invoices empty state until you **Generate** a period.
 
 ## 10. Customer portal
 
-**http://127.0.0.1:3000/portal/** — create an account or sign in.
+**http://127.0.0.1:3021/portal/** — public customer door (access-web). Loopback edge still has `/portal` on `:3000`. Create an account or sign in.
 
 ![Portal login](screenshots/16-portal-login.png)
 

packages/verae-bootstrap/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-bootstrap
+
+Bootstrap clones git repos and runs `npm install`. It does not open NATS ports. NATS is a **runtime** dependency of the `ns1-archive` and `ns1-all-in-one` server types (`127.0.0.1:4222` only).

packages/verae-bootstrap/README.md

@@ -0,0 +1,44 @@
+# verae-bootstrap
+
+Clone every Verae Time × Zapier **module repo** from Forgejo and install Node dependencies. Each **server type** has its own directory under `types/` (repos list + README + start notes).
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-bootstrap  
+**SSH:** `ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git`
+
+## Host requirements
+
+| Need | Why |
+|------|-----|
+| Node 20+ (`node`, `npm`) | All HTTP and worker processes |
+| Git + SSH to Forgejo **port 2223** | `git clone ssh://git@git.georgelambert.org:2223/marchon/<name>.git` |
+| `nats-server -js` on **127.0.0.1:4222** | Archive / billing types only — never a public bind |
+| `curl` | Health probes |
+
+Zapier cloud never talks to NATS. Do not publish `:4222`.
+
+## Fetch
+
+```bash
+git clone ssh://git@git.georgelambert.org:2223/marchon/verae-bootstrap.git
+cd verae-bootstrap
+export VERAE_SRC=$HOME/verae-src
+bash scripts/fetch.sh                 # every repo
+bash scripts/fetch.sh ns1-all-in-one  # one server type
+```
+
+`scripts/clone.sh` pulls `main`. `scripts/install-deps.sh` runs `npm install` **on the target OS** (then `npm rebuild`). Do not copy `node_modules` from macOS onto Linux — native addons such as `better-sqlite3` will fail with `invalid ELF header`.
+
+## Server types
+
+| Type | Directory | What that host runs |
+|------|-----------|---------------------|
+| **ns1-all-in-one** | `types/ns1-all-in-one/` | Control plane + archive workers + keep (NS1 / 70.88.205.138) |
+| **control-plane** | `types/control-plane/` | Fleet, edges, IAM, billing HTTP (no worm/tree floor) |
+| **ns1-archive** | `types/ns1-archive/` | NATS + worm ×3 + tree-node ×3 + poller + webhook + aggregator + keep |
+| **lan-worker** | `types/lan-worker/` | Extra SSH worker (tree-node, archive-worm). Keep disabled until SSH works (`lan-134`). |
+
+Each type has `repos.txt` (subset of the master list) and `README.md`.
+
+## NS1 all-in-one notes
+
+`:3000` on 70.88.205.138 is already a public app. zappier-edge on that box binds **127.0.0.1:13000**. Public portal remains **access-web `:3021/portal/`**. Archive workers are owned by **verae-keep**; fleet does not double-spawn them.

packages/verae-bootstrap/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-bootstrap
+
+Downloads every Forgejo module and Node dependencies. Server types (each documented under `types/`): `ns1-all-in-one`, `control-plane`, `ns1-archive`, `lan-worker`.

packages/verae-bootstrap/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "verae-bootstrap",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Clone Verae Time × Zapier git repos and install dependencies for each server type",
+  "scripts": {
+    "clone": "bash scripts/clone.sh",
+    "deps": "bash scripts/install-deps.sh",
+    "fetch": "bash scripts/fetch.sh",
+    "test": "bash scripts/test.sh"
+  }
+}

packages/verae-bootstrap/repos.txt

@@ -0,0 +1,35 @@
+zappier-edge
+verae-middleware
+verae-zapier-app
+verae-activate
+verae-request-splitter
+verae-archive-worm
+verae-archive-aggregator
+zapier-docs-master
+verae-tree-node
+verae-zapier-simulator
+zapier-user-docs
+verae-fleet
+overview
+verae-nats-process
+verae-ops
+zappier-account-balance
+zappier-customer-service
+zappier-sales-pricing
+zappier-accounting-export
+verae-access-authz
+verae-access-web
+verae-access-api
+verae-access-leaf
+verae-access-zapier
+verae-access-staff
+zappier-identity
+verae-jobs-events
+verae-nats-accounts
+zapier-decisions
+UI-Docs
+verae-staff-session
+verae-staff-ui
+verae-staff-iam
+verae-keep
+verae-bootstrap

packages/verae-bootstrap/scripts/clone.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Clone Forgejo modules listed in a repos file.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+GITSSH="${GITSSH:-ssh://git@git.georgelambert.org:2223/marchon}"
+DEST="${VERAE_SRC:-$HOME/verae-src}"
+LIST="${1:-$ROOT/repos.txt}"
+export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o StrictHostKeyChecking=accept-new -p 2223}"
+mkdir -p "$DEST"
+while read -r name; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  if [[ -d "$DEST/$name/.git" ]]; then
+    echo "fetch $name"
+    git -C "$DEST/$name" fetch --prune origin
+    git -C "$DEST/$name" checkout -q main 2>/dev/null || git -C "$DEST/$name" checkout -q master
+    git -C "$DEST/$name" pull --ff-only || true
+  else
+    echo "clone $name"
+    git clone "$GITSSH/${name}.git" "$DEST/$name"
+  fi
+done < "$LIST"
+echo "cloned into $DEST"

packages/verae-bootstrap/scripts/fetch.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+TYPE="${1:-}"
+LIST="$ROOT/repos.txt"
+if [[ -n "$TYPE" ]]; then
+  LIST="$ROOT/types/$TYPE/repos.txt"
+  [[ -f "$LIST" ]] || { echo "unknown type $TYPE" >&2; exit 1; }
+fi
+bash "$ROOT/scripts/clone.sh" "$LIST"
+bash "$ROOT/scripts/install-deps.sh"
+echo "fetch done type=${TYPE:-all}"

packages/verae-bootstrap/scripts/install-deps.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# npm install in every cloned package that has package.json.
+set -euo pipefail
+DEST="${VERAE_SRC:-$HOME/verae-src}"
+if [[ ! -d "$DEST" ]]; then
+  echo "missing $DEST — run scripts/clone.sh first" >&2
+  exit 1
+fi
+command -v node >/dev/null
+command -v npm >/dev/null
+find "$DEST" -maxdepth 2 -name package.json ! -path '*/node_modules/*' | while read -r pkg; do
+  dir="$(dirname "$pkg")"
+  echo "npm install $dir"
+  (cd "$dir" && npm install --no-audit --no-fund && npm rebuild --no-audit --no-fund >/dev/null)
+done
+echo "deps installed under $DEST"

packages/verae-bootstrap/scripts/test.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+test -f "$ROOT/repos.txt"
+test -f "$ROOT/types/ns1-all-in-one/repos.txt"
+test -f "$ROOT/types/control-plane/repos.txt"
+test -f "$ROOT/types/ns1-archive/repos.txt"
+test -f "$ROOT/types/lan-worker/repos.txt"
+# every type list is a subset of the master list
+while read -r name; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  grep -qx "$name" "$ROOT/repos.txt" || { echo "type repo not in master: $name" >&2; exit 1; }
+done < <(cat "$ROOT"/types/*/repos.txt)
+echo OK