Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

docs/sphinx/repos/verae-access-api.md

@@ -0,0 +1,11 @@
+# verae-access-api
+
+**Direct customer API** plane (`x-api-key`). Separate from the Zapier Platform app.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-api
+
+Address path: `verae.access.api.*` → `verae.access.authz.check` → `verae.billing.statement.get` / `verae.zapier.jobs.watch` (HTTPS to middleware, not a Zapier NATS client).
+
+Cannot `balance.adjust` or `archive.put`.
+
+Port `:3022`.

docs/sphinx/repos/verae-access-authz.md

@@ -0,0 +1,34 @@
+# verae-access-authz
+
+Authorization step on the NATS **address path**. Zapier is only **one** access plane. Direct web, customer API, and server-to-server leaf nodes are separate, and each is default-deny against internal subjects.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-authz  
+**Catalog:** https://zapier.georgelambert.org/packages/verae-access-authz/README.pdf
+
+## Address path
+
+```text
+client
+  → verae.access.<plane>.<area>.<resource>.<action>     (ingress, that plane only)
+  → verae.access.authz.check                            (allow / deny)
+  → verae.<area>.<resource>.<action>                    (internal bus)
+```
+
+Internal subjects (`verae.billing.*`, `verae.archive.*`, `verae.zapier.jobs.*`) stay stable. Planes never publish them until `authz.check` returns `allow`.
+
+| Plane | Who | May reach |
+|-------|-----|-----------|
+| `zapier` | Zapier Platform HTTPS | jobs.*, webhooks.deliver, billing.usage.recorded |
+| `web` | Customer browser portal | statement.get, balance.adjust kind=reload\|payment |
+| `api` | Customer `x-api-key` (not Zapier) | statement.get, usage.recorded, jobs.watch |
+| `leaf` | S2S NATS leaf / mTLS | archive.*, jobs.*, webhooks — **not billing** |
+| `staff` | CS / sales / admin | statement, balance.adjust (credits) |
+
+A leaf node cannot credit an account. A Zapier hop cannot read a customer statement. A browser cannot `archive.put`.
+
+```bash
+NATS_URL=nats://127.0.0.1:4222 PORT=3020 npm start
+curl -s http://127.0.0.1:3020/policy
+curl -s -X POST http://127.0.0.1:3020/check -H 'content-type: application/json' \
+  -d '{"plane":"leaf","subject":"verae.billing.balance.adjust"}'
+```

docs/sphinx/repos/verae-access-leaf.md

@@ -0,0 +1,13 @@
+# verae-access-leaf
+
+**Server-to-server leaf node** access plane. Remote machines connect as NATS leaf nodes (or POST `/forward` with a leaf token). They never get the core billing subjects.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-leaf
+
+```text
+remote leaf  →  verae.access.leaf.in  →  authz.check  →  verae.archive.put | jobs.*
+```
+
+Denied: `verae.billing.balance.adjust`, `verae.billing.statement.get`. A compromised WORM/leaf cannot credit customers.
+
+`LEAF_TOKEN` required. Port `:3023`. Do not publish NATS `4222` to the internet; leaf nodes use a private leafnode port / tunnel.

docs/sphinx/repos/verae-access-web.md

@@ -0,0 +1,15 @@
+# verae-access-web
+
+**Direct web** access plane. Customer browsers hit this process, not Zapier and not the NATS port.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-web
+
+Every NATS hop is `verae.access.web.*` → `verae.access.authz.check` → internal `verae.billing.statement.get` (reload only, not CS credits).
+
+| Route | Job |
+|-------|-----|
+| `GET /health` | `{ plane: "web" }` |
+| `GET /statement/:id` | Authz then statement |
+| `POST /reload` | Authz then `balance.adjust` kind=reload |
+
+Port `:3021`.

docs/sphinx/repos/verae-access-zapier.md

@@ -0,0 +1,9 @@
+# verae-access-zapier
+
+**Zapier is one access plane**, not the only one. This process is the Zapier HTTPS front door: timestamp/wait/hash into middleware. No customer portal, no admin, no leaf.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-access-zapier
+
+Zapier cloud never opens NATS. This process may request `verae.access.authz.check` for `verae.zapier.jobs.watch` and `verae.billing.usage.recorded` only.
+
+Port `:3024`.