zapier-decisions/LOG.md

Action log

2026-09-11 — bootstrap

• Created this repo to record decisions while executing cleanup items 1–5 (and a second pass on 2–5).
• Assumption: single developer, lab only; breaking changes allowed.

Step 1 — account-balance is the prepaid source of truth

• Persist books to BOOKS_PATH (atomic JSON).
• Mutations go through balance.adjust / usage.recorded; edge cache balanceCents is updated from the books reply only.
• Local cache mutate only when NATS_URL and ACCOUNT_BALANCE_URL are both unset (tests).

Step 2 — identity join

• zappier-identity mailbox: verae.identity.bind / verae.identity.lookup.
• Portal + middleware tenants store veraeUserId; JWT never public.

Step 3 — access planes are the public doors

• zappier-edge binds loopback (127.0.0.1:3000).
• Public: access-web :3021, access-api :3022, access-leaf :3023, access-zapier :3024, access-staff :3025.

Step 4 — leaf hardening

• verae-nats-accounts holds nats.conf + subject policy.
• Leaf token required; billing subjects denied in policy file and access-leaf.

Step 5 — fleet spawn

• Prefer local machines for HTTP spawn.command services.
• Disable lan-134 unless FLEET_ENABLE_LAN134=1.
• SSH spawn timeout 8s; failed hosts skipped.

Second pass (2–5)

• Identity used from portal when IDENTITY_URL set.
• Leaf loads allow-list from nats-accounts policy.json.
• Staff plane is a first-class mailbox (verae-access-staff).
• jobs.events mailbox process verae-jobs-events (passthrough + count).