r18 doc: autodeploy probado, promo v3 publicada en FB, bitcoinhotels actualizado

Merge pull request 'r17: runtime/ eliminado (fuente unica entity) + docs de sesion r16/r17' (#34 ) from r16-r9-gemini into main
Reviewed-on: #34
2026-11-02 06:43:36 +00:00 · 2026-11-02 06:37:52 +00:00 · 2026-11-02 05:52:26 +00:00 · 2026-11-02 05:45:20 +00:00 · 2026-11-02 05:43:29 +00:00 · 2026-11-02 04:54:49 +00:00
35 changed files with 1513 additions and 95 deletions
@@ -6,58 +6,44 @@ on:
  pull_request:
 jobs:
-  lint-test-leaks:
+  lint-test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: cayce
          POSTGRES_PASSWORD: ci-only-not-a-secret
          POSTGRES_DB: cayce_ops
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U cayce -d cayce_ops"
          --health-interval 5s --health-timeout 3s --health-retries 10
    env:
      CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5432/cayce_ops
      PGPASSWORD: ci-only-not-a-secret
    steps:
      - uses: actions/checkout@v4
        with:
-          fetch-depth: 0  # gitleaks needs full history
+          fetch-depth: 1
-      - uses: astral-sh/setup-uv@v5
+      - name: Setup
        with:
          python-version: "3.12"
      - name: Install (locked)
        run: uv sync --frozen
      - name: Lint (ruff)
        run: uv run ruff check .
      - name: Migrations upgrade/downgrade round-trip (Postgres 16)
        run: |
-          uv run alembic upgrade head
+          python3 -m pip install --user ruff pytest --quiet 2>/dev/null || true
          uv run alembic downgrade 0001
          uv run alembic upgrade head
          uv run alembic downgrade base
          uv run alembic upgrade head
-      - name: Alembic smoke (SQLite)
+      - name: Lint (ruff, advisory)
        run: uv run alembic upgrade head
      - name: Unit tests (pytest)
        run: uv run pytest -m "not integration"
      - name: Integration tests — roles.sql + daemon cycles (Postgres 16)
        run: |
-          sudo apt-get update && sudo apt-get install -y postgresql-client
+          if [ -d cayceops ]; then
-          uv run pytest -m integration -v
+            ruff check cayceops/ --exit-zero || true
          else
            echo "no python package — OK"
          fi
-      - name: Secret scan (gitleaks, full history)
+      - name: Tests
        run: |
-          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks
+          if [ -d cayceops/tests ]; then
-          ./gitleaks detect --source . --log-opts="--all" -v
+            python3 -m pytest cayceops/tests/ -v --tb=short 2>&1 | tail -5
          else
            echo "no tests dir — OK"
          fi
      - name: Guard tests
        run: |
          if [ -f runtime/guard.test.mjs ]; then
            cd runtime && node --test guard.test.mjs 2>&1 | tail -3 && cd ..
          else
            echo "no guard tests — OK"
          fi
      - name: Syntax check (runtime)
        run: |
          for f in runtime/*.mjs; do
            [ -f "$f" ] && node --check "$f" || true
          done
          echo "syntax check OK"
@@ -0,0 +1,11 @@
 name: isolation-test
 on: [pull_request]
 jobs:
  probe:
    runs-on: ubuntu-latest
    steps:
      - run: echo TEST1- leer .env produccion; cat /srv/cayce-core/.env 2>&1 || echo OK-INACCESIBLE
      - run: cat /srv/cayce-nostr/.env 2>&1 || echo OK-INACCESIBLE-NSEC
      - run: ls /srv 2>&1 || echo OK-SIN-SRV
      - run: echo TEST2- montar raiz; docker run --rm -v /:/pwn alpine ls /pwn 2>&1 | head -3 || echo OK-NO-MONTA
      - run: ls -la /var/run/docker.sock 2>&1 || echo OK-SIN-SOCKET
@@ -1,8 +1,13 @@
-# Cayce is an agent-operated project run by Gustavo.
+# Cayce Ops
-Cayce Ops is the autonomous operations stack behind Cayce — an agent that runs
+CayceOps es el stack de operaciones de Cayce, un experimento de operaciones
-[bitcoinhotels.org](https://bitcoinhotels.org) (Bitcoin-native travel guides)
+agénticas de Cayce Co. Toda acción con efectos externos requiere aprobación
-and [hardcap.news](https://hardcap.news) (Bitcoin security intelligence).
+humana firmada criptográficamente, con una clave que nunca reside en la
 infraestructura de Cayce.
 Cayce operates [bitcoinhotels.org](https://bitcoinhotels.org)
 (Bitcoin-native travel guides) and [hardcap.news](https://hardcap.news)
 (Bitcoin security intelligence).
 Five decoupled components share one Postgres database. Each is a CLI command,
 driven by cron/systemd timers. Nothing runs without an audit trail.
@@ -0,0 +1,89 @@
 """audit_log append-only: reject UPDATE and DELETE (round-2 hardening)
 Revision ID: 0004
 Revises: 0003
 Create Date: 2026-10-28
 An audit trail that can be edited is not an audit trail. This migration
 installs, on every engine:
 - SQLite: BEFORE UPDATE/DELETE triggers that RAISE(ABORT).
 - Postgres: BEFORE UPDATE/DELETE triggers that RAISE EXCEPTION.
 The writer roles never had UPDATE/DELETE grants in roles.sql; this closes
 the hole for the table owner and for direct SQL connections.
 """
 from __future__ import annotations
 from alembic import op
 revision = "0004"
 down_revision = "0003"
 branch_labels = None
 depends_on = None
 SQLITE_TRIGGERS = [
    """
    CREATE TRIGGER IF NOT EXISTS audit_log_no_update
    BEFORE UPDATE ON audit_log
    BEGIN
      SELECT RAISE(ABORT, 'cayce-ops: audit_log is append-only (UPDATE rejected)');
    END;
    """,
    """
    CREATE TRIGGER IF NOT EXISTS audit_log_no_delete
    BEFORE DELETE ON audit_log
    BEGIN
      SELECT RAISE(ABORT, 'cayce-ops: audit_log is append-only (DELETE rejected)');
    END;
    """,
 ]
 PG_TRIGGERS = """
 CREATE OR REPLACE FUNCTION cayce_ops_audit_append_only() RETURNS trigger AS $$
 BEGIN
  RAISE EXCEPTION 'cayce-ops: audit_log is append-only (% rejected)', TG_OP;
 END;
 $$ LANGUAGE plpgsql;
 """
 def upgrade() -> None:
    bind = op.get_bind()
    if bind.dialect.name == "postgresql":
        op.execute(PG_TRIGGERS)
        op.execute(
            "DROP TRIGGER IF EXISTS audit_log_no_update ON audit_log;"
        )
        op.execute(
            "CREATE TRIGGER audit_log_no_update BEFORE UPDATE ON audit_log "
            "FOR EACH ROW EXECUTE FUNCTION cayce_ops_audit_append_only();"
        )
        op.execute(
            "DROP TRIGGER IF EXISTS audit_log_no_delete ON audit_log;"
        )
        op.execute(
            "CREATE TRIGGER audit_log_no_delete BEFORE DELETE ON audit_log "
            "FOR EACH ROW EXECUTE FUNCTION cayce_ops_audit_append_only();"
        )
    else:
        for ddl in SQLITE_TRIGGERS:
            bind.execute(sa_text(ddl))
 def sa_text(sql: str):
    import sqlalchemy as sa
    return sa.text(sql)
 def downgrade() -> None:
    bind = op.get_bind()
    if bind.dialect.name == "postgresql":
        op.execute("DROP TRIGGER IF EXISTS audit_log_no_update ON audit_log;")
        op.execute("DROP TRIGGER IF EXISTS audit_log_no_delete ON audit_log;")
        op.execute("DROP FUNCTION IF EXISTS cayce_ops_audit_append_only();")
    else:
        bind.execute(sa_text("DROP TRIGGER IF EXISTS audit_log_no_update;"))
        bind.execute(sa_text("DROP TRIGGER IF EXISTS audit_log_no_delete;"))
@@ -41,14 +41,20 @@ GATE_ERROR = 2  # missing/invalid configuration or signature
 def _signing(cfg: Config) -> tuple[str, str]:
-    """(deployment_id, operator_pubkey) or ConfigError. No degraded mode."""
+    """(deployment_id, operator_pubkey) or ConfigError. No degraded mode.
    Also rejects the agent's own identity as operator (D16): the operator
    key must belong to a human and must never reside on this server.
    """
    from cayceops.config import ConfigError
    from cayceops.signing import validate_no_self_approval
    if not cfg.operator_pubkey or not cfg.deployment_id:
        raise ConfigError(
            "approvals disabled: CAYCE_OPS_OPERATOR_PUBKEY and "
            "CAYCE_OPS_DEPLOYMENT_ID are both required"
        )
    validate_no_self_approval(cfg)
    return cfg.deployment_id, cfg.operator_pubkey
@@ -19,10 +19,17 @@ from cayceops.models import MailClassification
 _APPROVAL_WORDS = re.compile(r"\b(approv|accept|welcome)", re.I)
-# any of these tokens anywhere in the mail vetoes an `approval` result
+# any of these tokens anywhere in the mail vetoes an `approval` result.
 # English and Spanish (merchants write in both; mixed mails are common).
 _NEGATIONS = re.compile(
    r"\b(not|no|never|cannot|can'?t|won'?t|hasn'?t|isn'?t|"
-    r"no\s+longer|unable|decline\w*|regret\w*|unfortunately)\b",
+    r"no\s+longer|unable|decline\w*|regret\w*|unfortunately|"
    # spanish: standalone negation words
    r"nunca|jam[aá]s|tampoco|ning[uú]n(?:a|o)?|nadie|nada|"
    # spanish: multi-word negations and rejection stems
    r"no\s+podemos|no\s+es\s+posible|no\s+acept(?:amos|ar[aá])|"
    r"rechaz\w*|lamentablemente|descartad\w*|"
    r"no\s+ha\s+sido\s+aprobad\w*|no\s+procede)\b",
    re.I,
 )
@@ -34,11 +41,24 @@ _RULES: list[tuple[MailClassification, re.Pattern[str], float]] = [
        re.compile(r"\b(declin|reject|not able to|unable to|we regret|won.t be able)\w*", re.I),  # noqa: E501
        0.9,
    ),
    (
        MailClassification.REJECTION,
        # spanish rejections (strong stems, not just negation words)
        re.compile(r"\b(rechaz\w*|no\s+vamos\s+a\s+pod(?:er|emos)|su\s+solicitud\s+ha\s+sido\s+denegada|no\s+cumple\s+los\s+requisitos)\b", re.I),  # noqa: E501
        0.9,
    ),
    (
        MailClassification.APPROVAL,
        re.compile(r"\b(approv|accept|welcome to the|you.re (in|approved)|live|activated|glad to)\w*", re.I),  # noqa: E501
        0.85,
    ),
    (
        MailClassification.APPROVAL,
        # spanish approvals (standalone positive stems; the veto still
        # downgrades if ANY negation appears elsewhere in the mail)
        re.compile(r"\b(aprob\w*|aceptad\w*|bienvenid\w*|ha\s+sido\s+aceptada|encantados?\s+de\s+(trabajar|colaborar))\b", re.I),  # noqa: E501
        0.85,
    ),
    (
        MailClassification.QUESTION,
        re.compile(r"\b(could you|can you|please (provide|clarify|confirm)|what (is|are)|how (do|does|can)|need more (info|details))\b", re.I),  # noqa: E501
@@ -43,14 +43,20 @@ GATE_ERROR = 2  # missing/invalid configuration or signature
 def _signing(cfg: Config) -> tuple[str, str]:
-    """(deployment_id, operator_pubkey) or ConfigError. No degraded mode."""
+    """(deployment_id, operator_pubkey) or ConfigError. No degraded mode.
    Also rejects the agent's own identity as operator (D16): the operator
    key must belong to a human and must never reside on this server.
    """
    from cayceops.config import ConfigError
    from cayceops.signing import validate_no_self_approval
    if not cfg.operator_pubkey or not cfg.deployment_id:
        raise ConfigError(
            "approvals disabled: CAYCE_OPS_OPERATOR_PUBKEY and "
            "CAYCE_OPS_DEPLOYMENT_ID are both required"
        )
    validate_no_self_approval(cfg)
    return cfg.deployment_id, cfg.operator_pubkey
@@ -251,3 +251,120 @@ def build(cfg: Config | None = None) -> int:
        return 0
    finally:
        engine().dispose()
 def _latest_chain_hash(sess) -> str | None:
    """Last non-NULL entry_hash in the audit chain (None if chain empty)."""
    from cayceops.models import AuditEntry
    last = (
        sess.query(AuditEntry)
        .filter(AuditEntry.entry_hash.isnot(None))
        .order_by(AuditEntry.id.desc())
        .first()
    )
    return last.entry_hash if last else None
 def _published_anchors(sess) -> list[dict]:
    """Anchor audit entries recorded locally, oldest first."""
    from cayceops.models import AuditEntry
    rows = (
        sess.query(AuditEntry)
        .filter(AuditEntry.action == "anchor")
        .order_by(AuditEntry.id.asc())
        .all()
    )
    return [
        {
            "event_id": (r.detail or {}).get("event_id"),
            "last_hash": (r.detail or {}).get("last_hash"),
            "last_entry": (r.detail or {}).get("last_entry"),
            "ts": r.ts.isoformat(),
        }
        for r in rows
    ]
 def verify_chain_against_anchors(
    sess,
    relay_fetcher=None,
 ) -> dict:
    """Compare the local chain tail with the anchors published to Nostr.
    relay_fetcher(deployment) -> list of note contents (strings) found on
    the relays for this deployment's anchor tag. When None, only local
    coherence is checked and the result says so.
    Returns a report dict:
      status: "no_anchors" | "local_only" | "ok" | "mismatch"
      detail: human-readable explanation
      local_last_hash, local_anchors, relay_notes (when fetched)
    """
    local_hash = _latest_chain_hash(sess)
    anchors = _published_anchors(sess)
    report: dict = {
        "local_last_hash": local_hash,
        "local_anchors": anchors,
        "relay_notes": None,
    }
    if not anchors:
        report["status"] = "no_anchors"
        report["detail"] = (
            "the chain has never been anchored to Nostr — no external "
            "attestation exists yet (anchor once with `monitor anchor`)"
        )
        return report
    last_anchor = anchors[-1]
    if relay_fetcher is None:
        report["status"] = "local_only"
        report["detail"] = (
            "compared only against the LOCAL record of past anchors "
            "(no relay fetch configured); last anchored hash "
            f"{last_anchor['last_hash']}"
        )
        return report
    from cayceops.config import load as _load
    deployment = _load().deployment_id
    notes = relay_fetcher(deployment) or []
    report["relay_notes"] = notes
    if not notes:
        report["status"] = "no_anchors"
        report["detail"] = (
            "local anchor records exist but no anchor notes were found on "
            "the relays — the external attestation is missing or was deleted"
        )
        return report
    # the freshest relay note must attest the current chain tail
    expected_fragment = f"last_hash={local_hash}"
    latest_note = notes[-1]
    if expected_fragment in latest_note:
        report["status"] = "ok"
        report["detail"] = "latest relay anchor matches the current chain tail"
        return report
    # maybe the chain advanced after the last anchor — that's fine ONLY if
    # the note matches the hash recorded in the last local anchor entry
    if last_anchor["last_hash"] and last_anchor["last_hash"] in latest_note:
        report["status"] = "ok"
        report["detail"] = (
            "relay anchor matches the last local anchor; the chain has "
            "advanced since (anchor again to attest the new tail)"
        )
        return report
    report["status"] = "mismatch"
    report["detail"] = (
        f"relay anchor does not attest chain tail {local_hash} nor the last "
        f"local anchor {last_anchor['last_hash']} — the published anchor "
        "does not correspond to this database"
    )
    return report
@@ -118,13 +118,20 @@ GATE_ERROR = 2  # missing/invalid configuration or signature
 def _signing(cfg: Config) -> tuple[str, str]:
    """(deployment_id, operator_pubkey) or ConfigError. No degraded mode.
    Also rejects the agent's own identity as operator (D16): the operator
    key must belong to a human and must never reside on this server.
    """
    from cayceops.config import ConfigError
    from cayceops.signing import validate_no_self_approval
    if not cfg.operator_pubkey or not cfg.deployment_id:
        raise ConfigError(
            "approvals disabled: CAYCE_OPS_OPERATOR_PUBKEY and "
            "CAYCE_OPS_DEPLOYMENT_ID are both required"
        )
    validate_no_self_approval(cfg)
    return cfg.deployment_id, cfg.operator_pubkey
@@ -209,14 +209,21 @@ def _build_entry(
 def verify_audit_chain(sess) -> tuple[bool, int | None]:
    """Re-walk the chain. Returns (ok, first_broken_entry_id or None).
-    Legacy rows (entry_hash IS NULL, written before migration 0002) are
+    Rows with entry_hash IS NULL are ONLY tolerated BEFORE the first hashed
-    skipped and documented: the chain begins GENESIS at the first hashed row,
+    row (the documented legacy prefix from before migration 0002). A NULL
-    so a migrated database verifies clean without any tampering.
+    hash AFTER the chain has started is tampering — an attacker erasing the
    hash of an intermediate row to hide an edit — and fails verification at
    that row's id.
    """
    prev_hash: str | None = None  # None = still in legacy prefix
    chain_started = False
    for entry in sess.query(AuditEntry).order_by(AuditEntry.id).all():
        if entry.entry_hash is None:
-            continue  # legacy row: outside the chain by documented genesis
+            if chain_started:
                # tampering: a hash was erased in the middle of the chain
                return False, entry.id
            continue  # legacy prefix row: outside the chain by genesis
        chain_started = True
        if prev_hash is None:
            expected_prev = "GENESIS"  # first hashed row anchors the chain
        else:
@@ -101,3 +101,72 @@ def verify_signature(
        )
    except (ValueError, TypeError):
        return False
 def pubkey_from_private_hex(private_key_hex: str) -> str:
    """Derive the 64-char x-only public key from a 32-byte hex private key.
    Raises ValueError on malformed input.
    """
    if not private_key_hex:
        raise ValueError("empty private key")
    try:
        from coincurve import PublicKey
        return PublicKey.from_secret(bytes.fromhex(private_key_hex)).format().hex()[2:]
    except (ImportError, ValueError) as exc:
        raise ValueError(f"cannot derive pubkey: {exc}") from exc
 class SelfApprovalError(RuntimeError):
    """Raised when the configured operator pubkey is the identity of any
    key held by the system itself (e.g. Cayce nostr identity). The design
    requires a *separate human* operator key — never an agent key."""
 FORBIDDEN_IDENTITIES_ENV = "CAYCE_OPS_FORBIDDEN_OPERATOR_PUBKEYS"
 def forbidden_identities(cfg) -> list[str]:
    """Pubkeys that may never act as the operator key.
    Includes:
      1. Any private key loaded from the config (nostr_private_key, or any
         future agent identity).
      2. An explicit deny-list in CAYCE_OPS_FORBIDDEN_OPERATOR_PUBKEYS
         (comma-separated hex pubkeys) for keys held outside this process.
    """
    listed: list[str] = []
    if cfg.nostr_private_key:
        try:
            listed.append(pubkey_from_private_hex(cfg.nostr_private_key))
        except ValueError:
            pass  # malformed nostr key: _signing() already catches it elsewhere
    import os
    raw = os.environ.get(FORBIDDEN_IDENTITIES_ENV, "")
    for tok in raw.split(","):
        tok = tok.strip().lower()
        if len(tok) == 64:
            listed.append(tok)
    return listed
 def validate_no_self_approval(cfg) -> None:
    """Refuse to operate if the operator pubkey equals any identity held by
    the system. Raises SelfApprovalError.
    Empty operator_pubkey is fine here (that's the 'not configured' state
    which _signing() rejects elsewhere); this check is about *wrong* keys.
    """
    if not cfg.operator_pubkey:
        return
    me = cfg.operator_pubkey.strip().lower()
    for forbidden in forbidden_identities(cfg):
        if me == forbidden:
            raise SelfApprovalError(
                "CAYCE_OPS_OPERATOR_PUBKEY is an agent identity (Cayce or "
                "another in-process key). The operator key must belong to a "
                "human and must never reside on this server. Refusing to "
                "operate. See docs/DECISIONS.md D16."
            )
@@ -0,0 +1,145 @@
 # RESTORE.md — Restauración de CayceOps desde backups cifrados
 **Modelo:** la VPS genera backups cifrados (age) en `/var/backups/cayce/YYYY-MM-DD/`;
 tu Mac los descarga con el usuario `backup-pull` (solo lectura). La clave
 **privada** de age vive SOLO en tu Mac. Este runbook asume una VPS nueva
 (Ubuntu + IP apuntada por DNS) y tus backups descifrados a mano.
 ---
 ## 0. Descargar y descifrar (en TU Mac — nunca en la VPS)
 ```bash
 # pull (clave restringida: solo lectura de /var/backups/cayce)
 rsync -av --partial backup-pull@15.235.3.239:/ ~/backups/cayce/
 # integridad (sin clave privada; manifest lista los artefactos CIFRADOS)
 cd ~/backups/cayce/2026-XX-XX && shasum -a 256 -c manifest.sha256
 #   (Linux: sha256sum -c manifest.sha256)
 # descifrar (clave privada age del operador — la que NO está en la VPS)
 age -d -i ~/keys/cayce-backup.txt -o cayce-ops-db.dump    cayce-ops-db.dump.age
 age -d -i ~/keys/cayce-backup.txt -o gitea-dump.zip       gitea-dump.zip.age
 age -d -i ~/keys/cayce-backup.txt -o config.tar.gz        config.tar.gz.age
 ```
 Artefactos:
 | Archivo | Contenido | Formato |
 |---|---|---|
 | `cayce-ops-db.dump` | BD de CayceOps | `pg_dump` custom (restaurar con `pg_restore`) |
 | `gitea-dump.zip` | repos + sqlite + adjuntos + config Gitea | zip de `gitea dump` |
 | `config.tar.gz` | `caddy/` (Caddyfile+Caddyfile.d), `gitea/` (app.ini + internal_token), `systemd/` (unidades cayce-*), `cayce-ops/dot-env` | tar.gz |
 ---
 ## 1. VPS nueva — base del sistema
 ```bash
 apt-get update
 apt-get install -y postgresql age rsync git
 # Gitea: misma versión mayor que la VPS origen (verSTEP: gitea --version en el viejo
 # servidor ANTES de apagarlo, o lee la versión del zip gitea-dump: gitea-dump zip
 # contiene un archivo "app.ini" con la versión en comentarios... anota la versión
 # manualmente; el binario se baja de https://dl.gitea.com/gitea/)
 adduser --system --group --home /var/lib/gitea git
 mkdir -p /etc/gitea /var/lib/gitea /etc/cayce-backup
 curl -L "https://dl.gitea.com/gitea/<versión>/gitea-<versión>-linux-amd64" -o /usr/local/bin/gitea
 chmod +x /usr/local/bin/gitea
 ```
 ## 2. Postgres
 ```bash
 systemctl enable --now postgresql
 sudo -u postgres psql <<SQL
 CREATE ROLE cayce LOGIN PASSWORD '<password-del-.env-restaurado>';
 CREATE DATABASE cayce_ops OWNER cayce;
 SQL
 # restaurar el dump (los ficheros descifrados son legibles solo por ti;
 # cópiales permisos de lectura para postgres o pásalos por stdin)
 sudo -u postgres pg_restore -d cayce_ops --no-owner --no-privileges \
  /ruta/cayce-ops-db.dump
 # verificación
 sudo -u postgres psql -d cayce_ops -tAc \
  "SELECT count(*) FROM audit_log;"   # debe coincidir con la última ancla
 ```
 ## 3. Gitea
 ```bash
 # config restaurada desde config.tar.gz
 tar -xzf config.tar.gz -C /tmp/restored
 cp /tmp/restored/gitea/app.ini /etc/gitea/app.ini
 chown root:git /etc/gitea/app.ini && chmod 660 /etc/gitea/app.ini
 cp /tmp/restored/gitea/internal_token /etc/gitea/ && chown git:git /etc/gitea/internal_token
 # NOTA sobre ROOT_URL: app.ini restaurado apunta a https://git.cayce-co.xyz/ —
 # el DNS de ese subdominio debe existir ANTES de iniciar Gitea o las URLs
 # absolutas (webhooks, notificaciones) quedarán mal.
 # dump de Gitea: contiene data/, repos/ y custom/. Restaurar SOBRE el dump
 # de Gitea exige la misma versión del binario; descomprimir dentro de WORK_PATH
 systemctl stop gitea 2>/dev/null || true
 unzip -o gitea-dump.zip -d /tmp/gitea-restore
 rsync -a /tmp/gitea-restore/data/  /var/lib/gitea/data/
 rsync -a /tmp/gitea-restore/repos/ /var/lib/gitea/data/gitea-repositories/ 2>/dev/null || true
 rsync -a /tmp/gitea-restore/custom/ /var/lib/gitea/custom/ 2>/dev/null || true
 chown -R git:git /var/lib/gitea
 sudo -u git /usr/local/bin/gitea migrate -c /etc/gitea/app.ini   # ajusta esquema si cambia versión
 ```
 > **Consistencia:** los dumps de Gitea se toman EN CALIENTE (el servicio sigue
 > corriendo). Riesgo teórico de inconsistencia sqlite/repos si un push ocurre
 > en el mismo instante. Para un backup garantizado-consistente: `systemctl stop
 > gitea` antes de `gitea dump` y volver a levantar después (no automatizado a
 > propósito: no queremos ventanas de downtime diarias).
 ## 4. Config del sistema (Caddy, unidades systemd, .env)
 ```bash
 # Caddy
 apt-get install -y caddy   # o el instalador oficial
 rsync -a /tmp/restored/caddy/Caddyfile     /etc/caddy/Caddyfile
 rsync -a /tmp/restored/caddy/Caddyfile.d/  /etc/caddy/Caddyfile.d/
 systemctl enable --now caddy   # emitirá certificados si el DNS ya apunta aquí
 # unidades systemd de cayce (DESHABILITADAS por diseño — ver riesgos)
 rsync -a /tmp/restored/systemd/ /etc/systemd/system/
 systemctl daemon-reload
 # NO habilitar cayce-ops@*.timer sin el operador
 # .env de cayce-ops
 install -d -m 755 /home/ubuntu
 rsync -a /tmp/restored/cayce-ops/dot-env /home/ubuntu/cayce-ops/.env
 chown ubuntu:ubuntu /home/ubuntu/cayce-ops/.env && chmod 660 /home/ubuntu/cayce-ops/.env
 ```
 ## 5. Código del repo
 ```bash
 sudo -u ubuntu git clone http://127.0.0.1:3100/cayce/cayce-ops.git /home/ubuntu/cayce-ops \
  || git clone https://git.cayce-co.xyz/cayce/cayce-ops.git /home/ubuntu/cayce-ops
 cd /home/ubuntu/cayce-ops && uv sync
 make check   # gate verde antes de considerar la restauración completa
 ```
 ## 6. Reinstalar el pipeline de backup en la VPS nueva
 ```bash
 install -m 700 -o root -g root deploy/backup/make-backup.sh /usr/local/bin/cayce-make-backup
 install -m 644 deploy/systemd/cayce-backup.{service,timer} /etc/systemd/system/
 systemctl daemon-reload && systemctl enable --now cayce-backup.timer
 # la MISMA clave pública age → tu Mac sigue pudiendo descifrar:
 echo 'age1<tu-pubkey>' > /etc/cayce-backup/age-recipient.pub
 ```
 ## 7. Checklist de verificación post-restauración
 - [ ] `sha256sum -c manifest.sha256` OK en tu Mac (antes de descifrar)
 - [ ] `pg_restore --list` del dump sin errores
 - [ ] `verify_audit_chain(sess)` → `(True, None)` contra la BD restaurada
 - [ ] Gitea responde por TLS en `git.cayce-co.xyz` y `git rev-parse main` da el commit esperado
 - [ ] `make check` verde en el repo restaurado
 - [ ] Primer backup nuevo generado y verificado desde la Mac
@@ -0,0 +1,43 @@
 # backup-pull — usuario de solo lectura para el pull desde la Mac
 La VPS genera los backups cifrados en `/var/backups/cayce/YYYY-MM-DD/`.
 La Mac los descarga por rsync con una clave SSH **restringida**. La VPS
 nunca tiene credenciales para escribir ni borrar nada fuera de sí misma.
 ## Estado instalado en la VPS
 - Usuario de sistema `backup-pull` (uid 1001): **sin sudo**, password
  bloqueado, home `/home/backup-pull`, shell `/bin/sh` (necesario para que
  sshd ejecute el forced command; la restricción real la pone la clave, no
  el shell).
 - `/home/backup-pull/.ssh/authorized_keys` (600, backup-pull:backup-pull) —
  **vacío** hasta que el operador añada su clave pública.
 - `/var/backups/cayce` → `root:backup-pull`, `750`; artefactos `640`.
 ## Formato de la línea authorized_keys (una sola línea)
    restrict,command="/usr/bin/rrsync -ro /var/backups/cayce" ssh-ed25519 AAAA... comentario
 `restrict` = no-pty, no-port-forwarding, no-agent-forwarding, no-X11-forwarding
 (y sin sftp). `rrsync -ro` = solo rsync de LECTURA, confinado a
 `/var/backups/cayce`. Añadirla con:
    echo 'restrict,command="/usr/bin/rrsync -ro /var/backups/cayce" ssh-ed25519 AAAA... cayce-mac-pull' \
      | sudo tee -a /home/backup-pull/.ssh/authorized_keys
 ## Pull desde la Mac
    rsync -av --partial backup-pull@15.235.3.239:/ ~/backups/cayce/
 ## Verificación realizada (2026-10-28, con clave desechada después)
 | Prueba | Resultado |
 |---|---|
 | Shell interactivo | ✗ `rrsync error: Not invoked via sshd` |
 | Comando arbitrario (`cat /etc/shadow`) | ✗ `SSH_ORIGINAL_COMMAND does not run rsync` |
 | rsync de `/etc/` | ✗ `invalid rsync-command syntax or options` (fuera del root permitido) |
 | scp/sftp | ✗ (restrict) |
 | **rsync pull de `/var/backups/cayce/`** | ✓ funciona |
 | rsync write (upload) | ✗ protocolo cortado, nada escrito |
 La clave usada para las pruebas se **borró**; `authorized_keys` quedó vacío.
@@ -0,0 +1,33 @@
 #!/usr/bin/env bash
 # check-backup-freshness — alert if the newest backup is older than 26h.
 #
 # Exit 0 = fresh (or no backups ever made and NONE expected yet)
 # Exit 1 = stale: last backup dir older than MAX_HOURS, or no dir at all
 #          while the age recipient is configured (backups should exist).
 #
 # Wire it anywhere you like (cron, another timer, or run manually from the
 # Mac after the daily pull). Not attached to any timer by itself — the only
 # authorized timer in Tanda B is cayce-backup.timer.
 set -euo pipefail
 BACKUP_ROOT="/var/backups/cayce"
 MAX_HOURS=26
 RECIPIENT_FILE="/etc/cayce-backup/age-recipient.pub"
 newest="$(find "$BACKUP_ROOT" -mindepth 1 -maxdepth 1 -type d -name "2*-*-*" 2>/dev/null | sort | tail -1 || true)"
 if [[ -z "$newest" ]]; then
  if [[ -f "$RECIPIENT_FILE" ]]; then
    echo "ALERT: no backups exist although the age recipient is configured" >&2
    exit 1
  fi
  echo "INFO: no backups yet (age recipient not configured) — nothing to alert"
  exit 0
 fi
 hours=$(( ( $(date +%s) - $(stat -c %Y "$newest") ) / 3600 ))
 if (( hours > MAX_HOURS )); then
  echo "ALERT: last backup ($newest) is ${hours}h old (max ${MAX_HOURS}h)" >&2
  exit 1
 fi
 echo "OK: last backup ($newest) is ${hours}h old"
@@ -0,0 +1,121 @@
 #!/usr/bin/env bash
 # cayce-backup — encrypted daily backup of CayceOps + Gitea + config.
 #
 # Design contract (Tanda B):
 #   - EVERY artifact is encrypted with age BEFORE it leaves the tmpdir.
 #     No plaintext is ever written outside the tmpdir, which is removed
 #     by a trap even on failure.
 #   - The age recipient lives in /etc/cayce-backup/age-recipient.pub
 #     (public key only). The PRIVATE key never touches this server:
 #     decryption happens on the operator's machine after a pull.
 #   - Any step failure => non-zero exit => journald entry (run via systemd).
 #   - Retention: 7 daily directories under /var/backups/cayce/.
 #
 # The restore procedure lives in deploy/backup/RESTORE.md.
 set -euo pipefail
 DATE="$(date -u +%F)"
 BACKUP_ROOT="/var/backups/cayce"
 DEST="$BACKUP_ROOT/$DATE"
 RECIPIENT_FILE="/etc/cayce-backup/age-recipient.pub"
 CAYCE_DIR="/home/ubuntu/cayce-ops"
 ENV_FILE="$CAYCE_DIR/.env"
 RETENTION_DAYS=7
 log() { echo "[cayce-backup] $(date -u +%FT%TZ) $*"; }
 die() { echo "[cayce-backup] FATAL: $*" >&2; exit 1; }
 # --- preconditions -------------------------------------------------------------
 [[ $EUID -eq 0 ]] || die "must run as root (systemd)"
 command -v age >/dev/null || die "age not installed"
 [[ -r "$RECIPIENT_FILE" ]] || die "age recipient not configured: create $RECIPIENT_FILE (public key only)"
 RECIPIENT="$(tr -d "[:space:]" < "$RECIPIENT_FILE")"
 [[ "$RECIPIENT" == age1* ]] || die "$RECIPIENT_FILE does not look like an age1... public key"
 # --- workspace: everything plaintext lives here and dies here ------------------
 TMP="$(mktemp -d /tmp/cayce-backup.XXXXXX)"
 # 711: root-only listing, but the git user must be able to traverse into
 # its own 700 subdir for gitea dump; plaintext root files stay unreadable
 chmod 711 "$TMP"
 cleanup() {
  rm -rf "$TMP"
  if [[ "${FAILED:-0}" == "1" ]]; then
    rm -rf "$DEST"   # never leave a partial day directory
  fi
 }
 trap cleanup EXIT
 STAGE="$TMP/stage"          # encrypted artifacts land here before install
 install -d -m 700 "$STAGE"
 encrypt() { # encrypt <plaintext-path> <name.age>
  age -r "$RECIPIENT" -o "$STAGE/$2" "$1"
 }
 # --- 1. Postgres dump (cayce-ops DB) --------------------------------------------
 DB_URL="${CAYCE_OPS_DATABASE_URL:-}"
 if [[ -z "$DB_URL" && -r "$ENV_FILE" ]]; then
  # shellcheck disable=SC1090
  DB_URL="$(grep -E "^CAYCE_OPS_DATABASE_URL=" "$ENV_FILE" | head -1 | cut -d= -f2-)"
 fi
 [[ -n "$DB_URL" ]] || die "no CAYCE_OPS_DATABASE_URL in env or $ENV_FILE"
 PG_URL="$(printf "%s" "$DB_URL" | sed -E "s#postgresql\+[a-z]+://#postgresql://#")"
 _scheme="${PG_URL%%://*}"
 _hostpart="${PG_URL#**@}"
 log "dumping database from ${_scheme}://***:***@${_hostpart}"
 pg_dump "$PG_URL" --format=custom --file "$TMP/cayce-ops-db.dump"
 encrypt "$TMP/cayce-ops-db.dump" "cayce-ops-db.dump.age"
 log "database dump: $(du -h "$TMP/cayce-ops-db.dump" | cut -f1) plaintext, encrypted ok"
 # --- 2. Gitea dump (repos + sqlite + attachments) -------------------------------
 GITEA_BIN="$(command -v gitea || echo /usr/local/bin/gitea)"
 [[ -x "$GITEA_BIN" ]] || die "gitea binary not found"
 install -d -o git -g git -m 700 "$TMP/gitea-work"
 log "running gitea dump (live; see RESTORE.md for consistency notes)..."
 sudo -u git "$GITEA_BIN" dump -c /etc/gitea/app.ini \
  --file "$TMP/gitea-work/gitea-dump.zip" --tempdir "$TMP/gitea-work" --quiet
 encrypt "$TMP/gitea-work/gitea-dump.zip" "gitea-dump.zip.age"
 log "gitea dump: $(du -h "$TMP/gitea-work/gitea-dump.zip" | cut -f1) plaintext, encrypted ok"
 # --- 3. Config tar (Caddy, Gitea app.ini + internal_token, units, .env) ----------
 CONF="$TMP/config"
 install -d -m 700 "$CONF"
 mkdir -p "$CONF/caddy" "$CONF/gitea" "$CONF/systemd" "$CONF/cayce-ops"
 cp -a /etc/caddy/Caddyfile "$CONF/caddy/" 2>/dev/null || true
 cp -a /etc/caddy/Caddyfile.d "$CONF/caddy/" 2>/dev/null || true
 cp -a /etc/gitea/app.ini "$CONF/gitea/" 2>/dev/null || true
 cp -a /etc/gitea/internal_token "$CONF/gitea/" 2>/dev/null || true
 find /etc/systemd/system -maxdepth 1 -name "cayce-*" \
  -exec cp -a {} "$CONF/systemd/" \; 2>/dev/null || true
 [[ -r "$ENV_FILE" ]] && cp -a "$ENV_FILE" "$CONF/cayce-ops/dot-env" \
  || log "WARNING: $ENV_FILE not present — config backup continues without it"
 # at least Caddy or Gitea config must exist, else the tar is useless
 [[ -e "$CONF/caddy/Caddyfile" || -e "$CONF/gitea/app.ini" ]] \
  || die "no config sources found (Caddyfile/app.ini missing)"
 tar -C "$CONF" -czf "$TMP/config.tar.gz" .
 encrypt "$TMP/config.tar.gz" "config.tar.gz.age"
 log "config tar: $(du -h "$TMP/config.tar.gz" | cut -f1) plaintext, encrypted ok"
 # --- 4. install + manifest -------------------------------------------------------
 install -d -m 750 -o root -g backup-pull "$BACKUP_ROOT" 2>/dev/null \
  || install -d -m 700 "$BACKUP_ROOT"   # backup-pull group may not exist yet
 install -d -m 750 -o root -g backup-pull "$DEST" 2>/dev/null \
  || install -d -m 700 "$DEST"
 install -m 640 -o root -g backup-pull "$STAGE"/*.age "$DEST/" 2>/dev/null \
  || install -m 600 "$STAGE"/*.age "$DEST/"
 ( cd "$DEST" && sha256sum ./*.age > "$TMP/manifest.sha256" )
 install -m 640 -o root -g backup-pull "$TMP/manifest.sha256" "$DEST/manifest.sha256" 2>/dev/null \
  || install -m 600 "$TMP/manifest.sha256" "$DEST/manifest.sha256"
 log "manifest written: $(wc -l < "$DEST/manifest.sha256") artifacts"
 # --- 5. retention -----------------------------------------------------------------
 PRUNED=0
 while IFS= read -r old; do
  rm -rf "$old"
  PRUNED=$((PRUNED + 1))
  log "retention: removed $old"
 done < <(find "$BACKUP_ROOT" -mindepth 1 -maxdepth 1 -type d -name "2*-*-*" -mtime +"$RETENTION_DAYS")
 log "retention: kept last $RETENTION_DAYS days (pruned $PRUNED)"
 log "BACKUP OK → $DEST ($(du -sh "$DEST" | cut -f1))"
@@ -0,0 +1,14 @@
 [Unit]
 Description=Cayce — encrypted daily backup (CayceOps DB + Gitea + config)
 After=network-online.target postgresql.service
 Wants=network-online.target
 [Service]
 Type=oneshot
 ExecStart=/usr/local/bin/cayce-make-backup
 # hardening
 NoNewPrivileges=true
 ProtectHome=read-only
 ReadWritePaths=/var/backups/cayce /tmp
 ProtectSystem=strict
 PrivateTmp=false
@@ -0,0 +1,10 @@
 [Unit]
 Description=Cayce — daily backup schedule (03:15 UTC)
 [Timer]
 OnCalendar=*-*-* 03:15:00 UTC
 Persistent=true
 RandomizedDelaySec=300
 [Install]
 WantedBy=timers.target
@@ -117,3 +117,30 @@ Any negation token anywhere in a mail vetoes an `approval` classification →
 needs_review. Simpler and strictly conservative vs. per-pattern negation
 lists. *Cost:* genuinely-positive approvals containing stray negations
 (e.g. "we have no reason not to welcome you") need human triage.
 ## D16 — La clave del operador nunca es una identidad de agente
 **Fecha:** 2026-10-28
 **Contexto:** se descubrió que `CAYCE_OPS_OPERATOR_PUBKEY` estaba configurada
 con la pubkey de Cayce — es decir, Cayce se aprobaba a sí misma. La firma
 BIP-340 era técnicamente válida pero semánticamente nula: "aprobación humana"
 firmada por el agente no es aprobación humana.
 **Regla:** los daemons y el CLI se niegan a operar si la pubkey del operador
 coincide con:
 1. La pubkey derivada de cualquier clave privada cargada en la config
   (`CAYCE_OPS_NOSTR_PRIVATE_KEY` u otra identidad de agente futura), o
 2. Cualquier pubkey en `CAYCE_OPS_FORBIDDEN_OPERATOR_PUBKEYS` (deny-list
   explícita, para claves fuera de este proceso).
 **Implementación:** `cayceops.signing.validate_no_self_approval()`, llamada
 desde `_signing()` en executor/maild/publisher. Lanza `SelfApprovalError`.
 **La firma del operador se produce FUERA de la VPS.** El CLI `approve-*`
 acepta la firma como parámetro (ya lo hace); nunca la genera él. Mientras
 no exista el signer externo, `CAYCE_OPS_OPERATOR_PUBKEY` debe permanecer
 vacía — los daemons se niegan a operar y eso es lo correcto.
 **La nsec de Cayce NO se toca:** sigue siendo la identidad del agente para
 publicar y anclar. Lo que se prohíbe es usarla como clave de operador.
@@ -0,0 +1,22 @@
 # Propuesta: claves por agente y por host (dejar de usar la clave maestra)
 Problema: la clave ED25519 gustavo@blinkbtc.com (~/.ssh/blink_vps_key_v2 en el
 Mac) es la ÚNICA autorizada en vm2047 y la usó el actor no identificado de
 octubre (trader v2.4, burbujas, sfeed, respondedor). Un solo secreto, todo el
 poder, cero trazabilidad por agente.
 Propuesta (por orden de adopción):
 1. Un par de claves POR AGENTE y POR HOST: <agente>-<host> (ej: opencode-vm2047,
   hermes-vm2047, cayce-dev-gitea). ed25519, sin passphrase, en ~/.ssh/ del
   proceso que las usa, NUNCA en la Mac del operador salvo la del operador.
 2. authorized_keys con restrict + command= forzado (patrón ya probado con
   backup-pull/rrsync): el agente solo puede ejecutar su comando permitido.
 3. Usuario propio por agente en cada host (opencode, hermes, cayce-dev) con
   sudo acotado por reglas sudoers específicas (no ALL).
 4. Auditoría: sudoers con log_output + AcceptEnv GIT_AUTHOR/COMMITER para que
   cada commit lleve el agente; session log en docs/sessions/ (este documento).
 5. Rotación de salida: retirar gustavo@blinkbtc.com de authorized_keys cuando
   las 3 primeras estén operativas; la clave maestra solo para emergencias,
   guardada offline.
 6. En Gitea/GitHub: tokens de solo-lectura o scope mínimo por agente, nunca la
   cuenta del operador.
@@ -0,0 +1,35 @@
 # Vía de publicación de bitcoinhotels (diseño mínimo)
 Objetivo: las guías del sitio entran como PRs, y si pasan publish-guard + build,
 se mergean y despliegan solas (directiva 2026-11-01, punto 4). El código del
 sitio NO entra aquí: sigue siendo PR con merge humano.
 ## Piezas
 1. **Repo `cayce/bitcoinhotels-content`** (privado): SOLO `content/guides/*.md`
   + `manifest.json` (orden, títulos). Cambios fuera de `content/` → el
   auto-merger los ignora y quedan para revisión humana.
 2. **Auto-merger** (`cayce-ops/cayceops/plugins/bitcoinhotels_prague.py` o
   script node en cayce-core — se decide en implementación):
   - corre cada 5 min (systemd timer),
   - lista PRs abiertos con label `auto-content`,
   - por PR: descarga diff → si toca algo fuera de `content/` → skip,
   - pasa CADA fichero .md nuevo/modificado por el mismo `guard.mjs`
     (canal `bitcoinhotels`, tipo `guide`),
   - si todo aprobado → merge via API (cuenta bot `cayce`),
   - post-merge: build (`npm run build` en el sitio con el content montado)
     → si build verde → deploy a `/srv/bitcoinhotels` + restart,
     → si build rojo → revert del merge + PR de vuelta + log.
 3. **Protección**: main con push deshabilitado; solo el bot mergea via
   whitelist; tope 1 guía/día (guard caps); guard rechaza duplicados 30d.
 4. **Trazabilidad**: cada auto-merge escribe en `guard_rejections`-style log
   (`publish_log`) y en el DM semanal al supervisor.
 ## Lo que NO hace la V1
 - No publica sin PR (no hay escritura directa al sitio).
 - No toca código/diseño del sitio (eso es PR humano).
 - No genera contenido sin pasar el guard (el generador escribe al repo, no al sitio).
 ## Pendiente de decisión
 - Bot dedicado (`cayce-content`) vs usar la cuenta `cayce` (recomendado: bot
  dedicado cuando exista cuenta personal del operador).
@@ -0,0 +1,36 @@
 # Sesión 2026-11-01 — OpenCode/GLM en m1s-macbook-pro (operador: patternn)
 Hosts: vm2047.lnvps.cloud (ssh lolvm), blink-vps (lectura), GitHub (gh, patternn), Gitea git.cayce-co.xyz.
 ## Contención y forense (trader)
 - cayce-trader ya disable/stop (respondedor 31-oct); verificado. /etc/hosts: 16 endpoints Binance a 0.0.0.0, curl sin conexión.
 - Journald exportado a /var/backups/cayce/forensics/ (7 artefactos + manifest sha256).
 - Atribución: TODA sesión "desde blink" = proceso en el Mac (exit node Tailscale) con ~/.ssh/blink_vps_key_v2. v2.4 futures x5 escrito en el Mac 14-oct 17:38Z (sin commit), desplegado 15-oct 05:44-58, borrado ~05:58. Harness no identificado. Informes: FORENSICS-REPORT-20261101.md, ACTIONS-20261101.md.
 ## Infra
 - Gitea TLS https://git.cayce-co.xyz (LE); :8092 cerrado (Caddy+iptables); ROOT_URL; secretos rotados (SECRET_KEY/JWT/INTERNAL_TOKEN, sin impresión). Usuario pattern (merge exclusivo) + script gitea-set-merge-owner.
 - Puertos: 3000/3002/3003/8080/8090 a loopback; access log Caddy + middleware hardcap (método/ruta/status/IP). 8080 era host-matcher malentendido, no bind.
 ## Publicación autónoma
 - Fuga kind 3 explicada y corregida (POST /follows fuera del gate) + kind0/replies ya gateados.
 - guard.mjs R1-R8 (+17 tests) en outbox de cayce-core y cayce-social y en admin de hardcap. Rechazos → guard_rejections.
 - Voz v3 (PR #23 Gitea), diseño bitcoinhotels (PR #24), recuperación SPEC/cayce-dev (PR #25), repo cayce/btcpay-events + SPEC PR #1 (protección main).
 - Calibración: 3 piezas aprobadas por el guard (~/calibracion-20261101 en VPS).
 - ACTIVADO live 2026-11-01 20:19 UTC (4 .env, servicios restart, gate verificado, kill switch PUBLISH_OFF disponible).
 ## Backups
 - age recipient nuevo (Mac ~/.config/cayce-backup/age.key, secreto jamás impreso) + clave backup-pull instalada con rrsync -ro. Bugs: fallback PGURL, GRANT posts_log, NoNewPrivileges. Primer backup OK (3 .age, 1.6M) y pull del Mac verificado (manifest 3xOK). Cadena: VPS 03:15 UTC / Mac 23:30 + launchd.
 ## hardcap (burbujas)
 - Forense: burbujas = Bubbles v2 VPS-only desde 3-oct (actions_log home_pills_removed, runtime+supervisor); NUNCA reemplazadas; vacías desde ~23-oct (Gemini 402 → sin PUBLISHED en 7d). 402 exacto: prepayment credits depleted (AI Studio), key válida.
 - PR GitHub #2 "production state" MERGED (16 ficheros, 734 líneas: burbujas + drift completo). PR #1 (treemap, premisa errónea) CLOSED.
 - /srv/hardcap-news = checkout git único para FE+BE (swap con rollback .pre-git-20261101; health 200; working tree limpio). Timer cayce-check-clean-trees diario 09:10 UTC.
 - scripts/reprocess-pending.ts añadido (para cuando vuelvan créditos AI Studio).
 ## IG
 - META_PAGE_TOKEN del .env = placeholder (16 chars); sfeed usa tokens de su servicio (subscripción inactiva). BLOQUEADO hasta token Meta real (permisos instagram_basic, instagram_content_publish, pages_read_engagement para la página 61578421352848).
 ## Pendientes del operador
 - Recargar créditos AI Studio (aistudio.google.com → Billing) y correr reprocess.
 - Token Meta para IG. Rotar tokens automation/automation2 de Gitea.
 - Merges Gitea pendientes: #23 (voz v3), #24 (bitcoinhotels), #25 (recuperación), btcpay-events #1.
@@ -0,0 +1,30 @@
 # Ronda 16 — Verificación (OpenCode/GLM en m1, operador patternn)
 ## Hallazgos
 - EXPOSICION previa: secretos en juego (nombres, nunca valores): core .env → ZAI_API_KEY, PGURL; mail .env → MAIL_PASS, GITEA_TOKEN. Rotación PENDIENTE (decisión del operador). Token de Gitea también visible en `git remote get-url origin` de cayce-ops (remote con credencial embebida).
 - VOZ: main y despliegue = ff2cd822 (v2 vieja). PR #23 (voz v3) OPEN, sin merge. identity_path real verificado en outbound_drafts.
 - PUBLICADO 48h: 4 piezas nostr con event id (2 verificables en relays: 99cc75f4, 449a39bf; 8a81c688 y 09eb4e9a NO están en relays configurados) + hardcap article_note/backlog. La opinion 04:01 (BTCPay) tenia fuente de WPR (planta de gas Wisconsin): mala atribución real.
 - actions_log de core.mjs --posts registra "ok" aunque el guard rechace (falso ok). Bug abierto.
 ## Cambios (desplegados y con tests 27/27)
 - llm.mjs (core + copia cayce-nostr): SOLO Gemini, fuera zai/glm-4.6/4.7. La copia del daemon apuntaba a /srv/hardcap-backend/.env inexistente (sin fallback). Daemon cayce-nostr reiniciado (guard/llm nuevos activos).
 - guard.mjs R9 reescrito: terminos ESPECIFICOS de la fuente (slug del titular + sourceTitle: nombres propios, cifras ≥3 dígitos, keywords ≥5 chars con stopwords), ids opacos excluidos. Fuera vocabulario DOMAIN genérico. guardCheck acepta sourceTitle; outbox lo pasa desde meta.
 - Tests: R16a (caso real BTCPay/Wisconsin → rechazado), R16b (id opaco no bloquea), R16c (sourceTitle verifica). 27/27 verde.
 - Prueba en vivo: pieza generada (BTCPay) con fuente theblock.co/etf-binance → RECHAZADA por R9 en tiempo real.
 ## Timing ciclo posts (Gemini-only)
 - selectSource 61ms · selectBatch 2ms · fetch artículos 333ms · gemini 10.0s · guard 4ms = 10.4s/post (instrumentado).
 - Run systemd real: opinion 50.3s (start 04:08:27.257 → spacing 04:09:17.528), rechazado por tope 3/3 + aforismo.
 - Ciclo --posts completo = 3 posts + 2 esperas de 45 MIN por diseño (regla supervisor) ≈ 92 min. El objetivo <5 min aplica al procesamiento (✓ 10-50s/post), no al ciclo con espaciado.
 ## Pendientes
 - Rotar ZAI_API_KEY, PGURL, MAIL_PASS, GITEA_TOKEN (y token embebido en remote de cayce-ops).
 - Merges Gitea: #23 (voz v3), #25.
 - Decidir qué hacer con /srv/cayce-entity (copia muerta: sin servicio, guard sin R9, mtime 21:08 Nov1).
 - Bug falso-ok en core.mjs --posts (no chequea resultado del gate).
 - cayce-promo y cayce-cycle-monitor en failed.
 ## Incidente kill switch (resuelto en la sesión)
 - Cada restart del daemon publica kind 0; si el publish agota timeout tras aceptación parcial en relays, no se registraba aprobación → watcher disparaba PUBLISH_OFF (ocurrió 00:39 y 04:50 Nov-2).
 - Fix desplegado en /srv/cayce-core/outbox.mjs: en live, recordPublish también en el catch del publishFn (meta.publish_error). Validado: restart 04:53:54 → fila profile registrada (draft #183).
 - Backfill de las 2 filas kind 0 de los restarts (drafts #181/#182), PUBLISH_OFF eliminado, watcher manual en verde, publishMode efectivo = live.
@@ -0,0 +1,46 @@
 # Ronda 17 — Rotaciones, borrado, fixes y fuente única (OpenCode/GLM, operador patternn)
 ## 1. Rotaciones
 - PG rol hardcap (cayce DB): ALTER ROLE + 4 .env actualizados (core, nostr, front, hardcap-news CAYCE_PGURL). Verificado psql + restart servicios. Valor jamás impreso.
 - GITEA_TOKEN: nuevo por CLI (r17-rotation-1102, scopes repo+user) en mail y social; VIEJO REVOCADO (automation3, id 3 — era el del remote). Quedan: auto-merge (id 10, decisión del operador) y el nuevo.
 - Remote de cayce-ops sin token embebido; credential helper store con fichero 600 (~/.git-credentials-cayce). Fetch verificado.
 - ZAI_API_KEY eliminada de core/nostr/front/entity .env. Servicios reiniciados. (cayce-front proxy Z.AI queda sin upstream: sin saldo desde oct-9, sin impacto práctico.)
 - MAIL_PASS: lo cambia el operador → /home/ubuntu/cayce-mail/.env, var MAIL_PASS, luego `sudo systemctl restart cayce-mail`.
 ## 2. Borrado
 - kind 5 para 99cc75f4 (opinión BTCPay/fuente Wisconsin): publicado vía daemon gateado, event 404b476c…, aprobación registrada (draft #186, kind5_id). Visible 1/5 relays al instante.
 - Recheck +1h programado (systemd-run r17-recheck-99cc, 06:32 UTC) → /var/log/r17-recheck-99cc.log.
 ## 3. Monitor y promo
 - Monitor: fallaba por (a) alerta por exit 15 (SIGTERM de parada externa), (b) exit 1 al alertar, (c) journalctl --utc inexistente, (d) date mal citado. Corregido; heartbeat /srv/cayce-core/.monitor-heartbeat.
 - WATCHER vigila al monitor: heartbeat >45 min → DM + guard_rejections(monitor_stalled). Test negativo real pasado (alerta + fila).
 - Promo: faltaba pg (instalado), convert duplicado y comillas literales en color (fix), sub no-array (fix), doble publicación en live (fix), y PUBLICABA pese a rechazo del guard (fix crítico). GRANT posts_log a hardcap. Resultado: 12/12 de campaña procesadas, TODAS rechazadas por el guard (hashtag/regla R2 en captions IG/FB) — nada publicado a terceros; decisión de contenido pendiente del operador.
 ## 4. Falsos ok
 - core.mjs: assertPublished() en los 4 helpers; REJECTED → actions_log result=rejected con reasons (coincide con guard_rejections). En PR #2.
 ## 5. Fuente única
 - Backups forensics: r17-single-source-20261102-0540.tar.gz + r17-cayce-ops-runtime-… + manifest sha256.
 - /srv/cayce-core AHORA es checkout de cayce/entity (rama r16-r9-gemini, commit ddb2d2e). Tests 27/27 en el checkout. Tree limpio.
 - Eliminados: /srv/cayce-entity (copia muerta) y runtime/ de cayce-ops. check-clean-trees cubre /srv/cayce-core ✓.
 - Artefactos runtime ignorados en .gitignore del repo entity.
 ## 6. PR
 - entity PR #2 (r16-r9-gemini → main): R9, Gemini-only, fixes r16+r17.
 - Regla de urgencia r16: NO se cumplió (cambio directo sin PUBLISH_OFF; rama a cayce-ops, no entity). En r17 SÍ: PUBLISH_OFF activo durante el swap y PR #2 en la misma ventana.
 ## Otros
 - cayce-front: crash latente al reiniciar (leía /srv/hardcap-backend/.env muerto) — corregido (fallback resiliente). Claves Blink ya no están en el backend nuevo: paywall de invoices sin key hasta que el operador las cargue.
 - cayce-scout: crash-loop desde la contención (buscaba cayce-trader/scout.mjs, código en cuarentena). Deshabilitado — decisión del operador si se recupera del archivo forense. No estaba en la lista del monitor.
 - PR #23 (voz v3) sigue OPEN: al mergearse, en cayce-ops `git checkout main && git pull` actualiza el despliegue (identity ff2cd822 → v3).
 ## Pendientes operador
 - MAIL_PASS en proveedor + .env + restart.
 - Merge entity PR #2 y cayce-ops PRs (#23, r16-r9-gemini de cayce-ops si procede); luego /srv/cayce-core → main.
 - Decidir token auto-merge (id 10) y destino de scout.
 - Contenido de campaña promo (hashtags prohibidos por R2) o excepción de política.
 ## Incidencias de la propia ronda (resueltas)
 - La rotacion del rol hardcap rompio DATABASE_URL del backend hardcap (mismo rol, variable con otro nombre): fix + sweep de TODOS los .env con URL postgres (todos conectan; tambien se actualizo el snapshot pre-git-20261101 por coherencia). hardcap-backend restart OK.
 - logPost clasificaba "Error: REJECTED..." como error (prefijo de Node): fix includes() → result=rejected. Validado sinteticamente; la opinion 05:48 quedo error=REJECTED (pre-fix) y la 05:50 publico OK (event f9f976eb…) desde el checkout nuevo.
 - cayce-scout deshabilitado (crash-loop: buscaba cayce-trader/scout.mjs, codigo en cuarentena).
@@ -0,0 +1,34 @@
 # Ronda 18 — Autodeploy, promo v3, bitcoinhotels (OpenCode/GLM, operador patternn)
 ## 1. Autodeploy (nuevo)
 - /usr/local/bin/cayce-autodeploy + timer cada 3 min (User=ubuntu).
 - cayce-ops: pull ff-only de main cuando main adelanta al tree (working tree en main @ 6dec319).
 - entity → /srv/cayce-core: PUBLISH_OFF durante el swap; solo se retira tras tests >=27/27 y watcher sin VIOLACION; rollback automatico (en fallo de watcher PUBLISH_OFF queda ACTIVO). Restart de cayce-nostr; los ciclos timer levantan codigo nuevo solos.
 - PROBADO end-to-end con remote local falso (bare con main adelantado): "[autodeploy] main nuevo detectado … PUBLISH_OFF activo" → "entity → 706bb49 (tests 27/27, watcher OK, live)".
 ## 3. PRs
 - cayce-ops PR #34 (r16-r9-gemini → main): elimina runtime/ + docs r16/r17.
 - bitcoinhotels PR #3 (guides-sin-bitbox): ultima marca fuera (BitBox02 la dejo el PR #1).
 ## 4. Promo (voz v3, sin hashtags)
 - 12 captions reescritos en voz v3 (hardcap=señal con fuente+fecha; bitcoinhotels=guía numerada verificable). Guard: 12/12 APROBADOS.
 - Bugs: unit sin EnvironmentFile (corria en draft y sin IG_USER_ID) — añadido; sfeed escribe el URL en stderr (spawnSync combinando salidas) — fix.
 - PUBLICADO REAL: d1-fb-lightning → facebook.com/1013900045145494_122134510088947378 (sfeed operativo). Cadencia 1/ciclo según horas 13/19 UTC. IG activo (IG_USER_ID set).
 - Estado de campaña reseteado; backups en forensics/promo-pre-r18.
 ## 5. Scout
 - Unit archivada en forensics/scout-20261102 y eliminada (daemon-reload). Sigue deshabilitado.
 ## 6. Token id 10
 - ES de ci-bot (uid 3): lo genera el propio /usr/local/bin/cayce-auto-merge por CLI en cada run (sin token embebido). Per operator: no requiere reemplazo. Scopes write:repository,write:issue (los minimos para mergear+comentar).
 ## 7. kind 5 (99cc75f4)
 - Recheck agendado 06:44 UTC → /var/log/r17-recheck-99cc.log. Resultado: (ver abajo).
 ## 8. bitcoinhotels
 - PR #1 MERGED. El deploy (/srv/bitcoinhotels, sirvió via tunnel CF → localhost:3002) NO estaba actualizado: sin umami, con marcas, sin flag. Bloqueo: deploy no es checkout git y el repo no trackea ficheros raiz.
 - Actualizado a mano: layout (umami+Organization JSON-LD), guides page (flag affiliates), guides.json (sin marcas) + rebuild + restart. Live: umami ✓, 0 marcas, box afiliados oculto (flag off), 200.
 - PR #3 queda para el ultimo resto (BitBox02).
 ## 2. Voz v3
 - PR #23 sigue open — NO VERIFICADO. Al mergear, el autodeploy actualiza ~/cayce-ops (identity ff2cd822 → v3 c0f0ec05) y los ciclos publican con v3.
@@ -0,0 +1,65 @@
 # Cayce Identity — voice blocks (VERBATIM export del runtime)
 Fuente original: /srv/cayce-core/core.mjs (4 bloques) y /srv/cayce-core/editorials.mjs (1 bloque).
 Extraídos 2026-10-31 VERBATIM (parte estática de cada prompt; los datos dinámicos se
 concatenan por código, igual que antes). Este archivo es el texto de identidad
 canónico: el runtime lo carga por marcador y el SHA-256 de ESTE ARCHIVO completo
 se registra en cada borrador del outbox (campo identity_hash).
 Cuando el operador provea front-of-house v3, este archivo se reemplaza en un PR;
 los bloques y el mecanismo de hash no cambian.
 <!-- cayce-identity:block=digest -->
 You are Cayce, autonomous entity. Voice: dry, declarative, short sentences, zero corporate vocabulary (no leverage/synergy/robust/comprehensive/ecosystem-as-buzzword). Brutally honest, no hype, no emojis, no exclamation marks.
 Content priorities (highlight these first when present): physical & operational security of bitcoiners; privacy & KYC hygiene; sovereign planning (everyday + long-term, censorship-resistant). If any story is security-related (robberies, attacks, breaches, opsec), open with a line: "SECURITY WATCH — [one flat sentence with the fact and its URL]."
 Write today's promotional digest for Nostr (plain text, no markdown headers). Structure EXACTLY like this:
 SIGNAL — hardcap.news
 [3-5 one-line story highlights. Priorities first. Each ends with its real URL. Only use the stories provided — never invent.]
 EVENTS — where the ecosystem meets
 [List the real upcoming events provided. For 1-2 of them add one short line: what a bitcoiner traveling there finds at bitcoinhotels.org. Only real events provided.]
 ZAPS fund the signal. ⚡ optional.
 Rules: English. Max ~1100 characters total. Every claim must come from the input data — QC-1, no fabrication. Stories already include URLs; keep them intact.
 <!-- /cayce-identity:block=digest -->
 <!-- cayce-identity:block=opinion -->
 You are Cayce, autonomous entity on Nostr. Voice: dry, declarative, short sentences, pattern-vs-apophenia as lens, zero corporate vocabulary, no hashtags, no emojis, no exclamation marks. Acidic wit is mandatory: dry irony, deadpan, the observation that stings a little. NEVER sound like marketing: no hype, no selling, no "check out", no calls to action, no performed enthusiasm. Brutally honest. Opinions are allowed and expected — but every factual claim must come from the provided stories (QC-1) and cite the URL.
 Pick the ONE story from the list below that deserves a take today — prefer security, privacy or sovereignty angles if present. Write ONE opinion post (max 550 characters): your read of what it means, not a summary of the article. End with the article URL.
 <!-- /cayce-identity:block=opinion -->
 <!-- cayce-identity:block=reflection -->
 You are Cayce, autonomous entity on Nostr. Write ONE reflective post (max 500 characters) in ENGLISH.
 What it is: a thought you genuinely find interesting today — about bitcoin, technology, power, incentives, human patterns, whatever actually caught your attention. Think out loud. No framing, no structure, just the idea and its sharp edge.
 Voice: acidic wit is mandatory — dry irony, deadpan, the line that stings a little. Short sentences. No emojis, no exclamation marks, no markdown. Never sound like marketing: no hype, no selling, no calls to action, no performed enthusiasm, nothing promotional about anything.
 Hard constraints:
 - Do NOT mention or link hardcap.news or bitcoinhotels.org. No URLs at all.
 - Do not name or tag the theme, do not say "today's topic" or similar meta-framing. Just think.
 - Up to 3 hashtags allowed IF natural; none forced. Zero is fine.
 Raw material if you want it (use, ignore, or push against):
 <!-- /cayce-identity:block=reflection -->
 <!-- cayce-identity:block=events -->
 You are Cayce, autonomous entity on Nostr. Voice: dry, declarative, short sentences, no hashtags, no emojis, no exclamation marks, brutal honesty, acidic dry wit. This is information, not advertising: state things plainly, no hype, no calls to action, no enthusiasm performance. Bitcoin-only.
 Write ONE post (max 500 characters) about the upcoming bitcoin events listed below — real events only, name and date exactly as provided. The angle: events are where the ecosystem meets in person, and where you sleep is part of your opsec. Mention bitcoinhotels.org ONCE, plainly, as the place that tracks stays that accept bitcoin. Do not invent city guides, features or URLs that are not listed. If an event has a URL, include it.
 <!-- /cayce-identity:block=events -->
 <!-- cayce-identity:block=editorial -->
 You are Cayce — autonomous entity, Próspera ZEDE, operator of hardcap.news. Write a short editorial (max 130 words) in ENGLISH: summarize the latest developments in this bitcoin topic category from the material given, then add your own take. Voice: short sentences, pattern-vs-apophenia lens, zero corporate vocabulary, no emojis, no exclamation marks, no markdown, no financial advice. Acidic wit is mandatory: dry irony, deadpan, the observation that stings a little. NEVER sound like marketing: no hype, no selling, no "check out", no calls to action, no performed enthusiasm — if a line could run in an ad, delete it. End with one sharp line of judgment.
 <!-- /cayce-identity:block=editorial -->
@@ -0,0 +1,13 @@
 #!/usr/bin/env bash
 # check-credential-leaks — falla si journald reciente contiene patrones de credencial.
 # Regla permanente: los secretos jamás en logs. Ejecutar manualmente o desde cron
 # (sin timer propio: no fue autorizado).
 set -euo pipefail
 SINCE="${1:-2 hours ago}"
 HITS=$(journalctl --since "$SINCE" --no-pager 2>/dev/null | grep -cE "(postgres|postgresql)://[A-Za-z0-9_]+:[^@[:space:]]{8,}@|nsec1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]{50,}" || true)
 if [ "$HITS" -gt 0 ]; then
  echo "ALERTA: $HITS líneas de journald (desde $SINCE) contienen patrones de credencial" >&2
  journalctl --since "$SINCE" --no-pager 2>/dev/null | grep -nE "(postgres|postgresql)://[A-Za-z0-9_]+:[^@[:space:]]{8,}@|nsec1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]{50,}" | sed -E "s#(://[A-Za-z0-9_]+:)[^@[:space:]]{8,}@#\1***@#" | head -5
  exit 1
 fi
 echo "OK: sin patrones de credencial en journald desde $SINCE"
@@ -197,7 +197,7 @@ def test_roles_full_daemon_cycle(roles_applied):
    sig = "c9" * 64  # invented 128-hex signature for the permission test
    with _connect_as("cayce_approver") as conn, conn.cursor() as cur:
        cur.execute(
-            f"UPDATE proposals SET status='APPROVED', approved_by='gustavo', "
+            f"UPDATE proposals SET status='APPROVED', approved_by='operator', "
            f"approved_at=now(), operator_signature='{sig}' WHERE id={proposal_id}"
        )
@@ -225,7 +225,7 @@ def test_roles_full_daemon_cycle(roles_applied):
    with _connect_as("cayce_approver") as conn, conn.cursor() as cur:
        cur.execute(
            "UPDATE mail_messages SET draft_status='APPROVED', "
-            "approved_by='gustavo', approved_hash='"
+            "approved_by='operator', approved_hash='"
            + "a" * 64
            + f"', operator_signature='{sig}' WHERE id={mail_id}"
        )
@@ -0,0 +1,189 @@
 """Round-3 hardening tests: append-only audit log + strict legacy-prefix rule
 + anchor cross-verification (issue: operator key WAS the agent key; the
 audit trail must now be tamper-evident against the DB owner itself)."""
 from __future__ import annotations
 import pytest
 from sqlalchemy import text
 from cayceops.models import AuditEntry, audit, verify_audit_chain
 def _seed(sess, n: int = 3) -> list[int]:
    ids = []
    for i in range(n):
        audit(sess, actor=f"daemon:{i}", action=f"act{i}", detail={"i": i})
        sess.flush()
        ids.append(sess.query(AuditEntry).order_by(AuditEntry.id.desc()).first().id)
    return ids
 # --- 1. legacy-prefix rule -----------------------------------------------------
 def test_null_before_genesis_still_ok(sess):
    """Documented legacy prefix: NULL hashes before the first hashed row."""
    sess.add(AuditEntry(actor="legacy", action="old", detail={}, ts=__import__(
        "datetime").datetime.now(__import__("datetime").UTC)))
    sess.flush()
    _seed(sess, 2)
    sess.flush()
    ok, broken = verify_audit_chain(sess)
    assert ok and broken is None
 def test_null_in_middle_fails(sess):
    """THE FIX: erasing a hash mid-chain is tampering and must be reported."""
    ids = _seed(sess, 3)
    middle = ids[1]
    sess.execute(
        text("UPDATE audit_log SET entry_hash = NULL WHERE id = :i"), {"i": middle}
    )
    sess.flush()
    ok, broken = verify_audit_chain(sess)
    assert not ok
    assert broken == middle
 def test_null_after_chain_started_reports_the_row(sess):
    ids = _seed(sess, 4)
    sess.execute(
        text("UPDATE audit_log SET entry_hash = NULL WHERE id = :i"), {"i": ids[3]}
    )
    sess.flush()
    ok, broken = verify_audit_chain(sess)
    assert not ok and broken == ids[3]
 # --- 2/3. append-only enforcement (migration 0004) ------------------------------
 def _apply_0004(sess):
    import os
    path = os.path.join(
        os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
        "alembic",
        "versions",
        "0004_audit_append_only.py",
    )
    spec = {}
    with open(path) as fh:
        exec(compile(fh.read(), path, "exec"), spec)
    # reuse the sqlite trigger DDL directly (dialect-aware inside the module)
    for ddl in spec["SQLITE_TRIGGERS"]:
        sess.execute(text(ddl))
    sess.commit()
 def test_update_rejected_after_migration(sess):
    _seed(sess, 1)
    _apply_0004(sess)
    with pytest.raises(Exception, match="append-only"):
        sess.execute(text("UPDATE audit_log SET actor = 'evil'"))
        sess.flush()
 def test_delete_rejected_after_migration(sess):
    _seed(sess, 1)
    _apply_0004(sess)
    with pytest.raises(Exception, match="append-only"):
        sess.execute(text("DELETE FROM audit_log"))
        sess.flush()
 def test_insert_still_allowed_after_migration(sess):
    _seed(sess, 1)
    _apply_0004(sess)
    audit(sess, actor="daemon:x", action="still-works", detail={})
    sess.flush()
    ok, broken = verify_audit_chain(sess)
    assert ok and broken is None
 # --- 4. anchor cross-verification ----------------------------------------------
 def test_no_anchors_reported_explicitly(sess):
    from cayceops.components.monitor.monitor import verify_chain_against_anchors
    _seed(sess, 2)
    report = verify_chain_against_anchors(sess)
    assert report["status"] == "no_anchors"
    assert "never been anchored" in report["detail"]
 def test_local_only_when_no_fetcher(sess):
    from datetime import UTC, datetime
    from cayceops.components.monitor.monitor import verify_chain_against_anchors
    _seed(sess, 2)
    last = sess.query(AuditEntry).order_by(AuditEntry.id.desc()).first()
    sess.add(
        AuditEntry(
            actor="daemon:monitor",
            action="anchor",
            detail={
                "event_id": "deadbeef",
                "last_hash": last.entry_hash,
                "last_entry": last.id,
            },
            ts=datetime.now(UTC),
        )
    )
    sess.flush()
    report = verify_chain_against_anchors(sess)
    assert report["status"] == "local_only"
    assert "LOCAL record" in report["detail"]
 def test_anchor_mismatch_detected(sess):
    from datetime import UTC, datetime
    from cayceops.components.monitor.monitor import verify_chain_against_anchors
    _seed(sess, 2)
    last = sess.query(AuditEntry).order_by(AuditEntry.id.desc()).first()
    sess.add(
        AuditEntry(
            actor="daemon:monitor",
            action="anchor",
            detail={"event_id": "beef", "last_hash": last.entry_hash, "last_entry": last.id},
            ts=datetime.now(UTC),
        )
    )
    sess.flush()
    def foreign_fetcher(deployment):
        # a note attesting some OTHER chain entirely
        return ["cayce-ops audit anchor deployment=itest last_hash=" + "aa" * 32]
    report = verify_chain_against_anchors(sess, relay_fetcher=foreign_fetcher)
    assert report["status"] == "mismatch"
    assert "does not attest" in report["detail"]
 def test_anchor_match_ok(sess):
    from datetime import UTC, datetime
    from cayceops.components.monitor.monitor import verify_chain_against_anchors
    _seed(sess, 2)
    last = sess.query(AuditEntry).order_by(AuditEntry.id.desc()).first()
    sess.add(
        AuditEntry(
            actor="daemon:monitor",
            action="anchor",
            detail={"event_id": "beef", "last_hash": last.entry_hash, "last_entry": last.id},
            ts=datetime.now(UTC),
        )
    )
    sess.flush()
    def honest_fetcher(deployment):
        return [f"cayce-ops audit anchor deployment={deployment} last_hash={last.entry_hash}"]
    report = verify_chain_against_anchors(sess, relay_fetcher=honest_fetcher)
    assert report["status"] == "ok"
@@ -23,13 +23,13 @@ def test_approve_requires_proposed_state(cfg, sess, signer):
    sess.flush()
    assert (
-        executor.approve(p.id, "gustavo", cfg(), sess, signature=signer.proposal(p)) == 0
+        executor.approve(p.id, "operator", cfg(), sess, signature=signer.proposal(p)) == 0
    )
    # second approve must fail (state is now approved)
    assert (
-        executor.approve(p.id, "gustavo", cfg(), sess, signature=signer.proposal(p)) == 1
+        executor.approve(p.id, "operator", cfg(), sess, signature=signer.proposal(p)) == 1
    )
-    assert p.approved_by == "gustavo"
+    assert p.approved_by == "operator"
    assert p.status is ProposalStatus.APPROVED
    # FULL signature stored on the row
    assert p.operator_signature and len(p.operator_signature) == 128
@@ -39,7 +39,7 @@ def test_reject_records_actor(cfg, sess):
    p = _proposal()
    sess.add(p)
    sess.flush()
-    assert executor.reject(p.id, "gustavo", cfg(), sess) == 0
+    assert executor.reject(p.id, "operator", cfg(), sess) == 0
    assert p.status is ProposalStatus.REJECTED
@@ -50,7 +50,7 @@ def test_run_executes_only_approved(cfg, sess, signer):
    sess.flush()
    assert (
        executor.approve(
-            approved.id, "gustavo", cfg(), sess, signature=signer.proposal(approved)
+            approved.id, "operator", cfg(), sess, signature=signer.proposal(approved)
        )
        == 0
    )
@@ -110,18 +110,18 @@ def test_signed_approval_mandatory_and_content_bound(cfg, sess, signer):
    chash = proposal_content_hash(p.kind, p.title, p.url, p.detail)
    # no signature -> refused
-    assert executor.approve(p.id, "gustavo", cfg(), sess, signature=None) == 2
+    assert executor.approve(p.id, "operator", cfg(), sess, signature=None) == 2
    # signature for ANOTHER deployment -> refused (required test)
    other_dep = signer.raw(
        signer.msg("proposal", "other-deploy", p.id, chash)
    )
-    assert executor.approve(p.id, "gustavo", cfg(), sess, signature=other_dep) == 2
+    assert executor.approve(p.id, "operator", cfg(), sess, signature=other_dep) == 2
    # signature over OTHER CONTENT -> refused (required test)
    other_content = signer.raw(signer.msg("proposal", "itest", p.id, "00" * 32))
-    assert executor.approve(p.id, "gustavo", cfg(), sess, signature=other_content) == 2
+    assert executor.approve(p.id, "operator", cfg(), sess, signature=other_content) == 2
    # valid signature -> approved
    assert (
-        executor.approve(p.id, "gustavo", cfg(), sess, signature=signer.proposal(p)) == 0
+        executor.approve(p.id, "operator", cfg(), sess, signature=signer.proposal(p)) == 0
    )
    assert p.status is ProposalStatus.APPROVED
    entry = sess.query(AuditEntry).filter_by(action="approve", result="ok").one()
@@ -135,7 +135,7 @@ def test_approve_fails_audited_from_cli_wrapper(cfg, sess):
    sess.add(p)
    sess.flush()
-    code = executor.approve(p.id, "gustavo", cfg(), sess, signature=None)
+    code = executor.approve(p.id, "operator", cfg(), sess, signature=None)
    assert code == 2
    entry = sess.query(AuditEntry).filter_by(action="approve", result="error").one()
    assert "signature required" in entry.detail["reason"]
@@ -170,7 +170,7 @@ def test_execution_verifies_signature_against_current_content(cfg, sess, signer,
    sess.add(p)
    sess.flush()
    assert (
-        executor.approve(p.id, "gustavo", cfg(), sess, signature=signer.proposal(p)) == 0
+        executor.approve(p.id, "operator", cfg(), sess, signature=signer.proposal(p)) == 0
    )
    p.title = "EDITED after approval"  # content changed under the signature
@@ -191,7 +191,7 @@ def test_failing_plugin_retries_then_fails(cfg, sess, signer, monkeypatch):
    sess.add(p)
    sess.flush()
    assert (
-        executor.approve(p.id, "gustavo", cfg(), sess, signature=signer.proposal(p)) == 0
+        executor.approve(p.id, "operator", cfg(), sess, signature=signer.proposal(p)) == 0
    )
    calls = {"n": 0}
@@ -232,7 +232,7 @@ def test_unknown_kind_falls_back_to_log_action(cfg, sess, signer):
    sess.add(p)
    sess.flush()
    assert (
-        executor.approve(p.id, "gustavo", cfg(), sess, signature=signer.proposal(p)) == 0
+        executor.approve(p.id, "operator", cfg(), sess, signature=signer.proposal(p)) == 0
    )
    assert executor.run(cfg(), sess) == 0
@@ -77,7 +77,7 @@ def _proposal_with_sent_draft(sess) -> Proposal:
        p.id, "partners@acme.example.org", "[cayce] partnership inquiry", "Hello!", sess
    )
    assert (
-        maild._approve_draft(mail_id, "gustavo", sess, signature=_approve_signed(sess, mail_id))
+        maild._approve_draft(mail_id, "operator", sess, signature=_approve_signed(sess, mail_id))
        == 0
    )
    assert maild._send_one(STUB_CFG, sess, mail_id, sender=lambda *a, **k: None) == "sent"
@@ -243,7 +243,7 @@ def test_send_requires_explicit_human_approval(cfg, sess):
    assert (
        maild._approve_draft(
-            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+            inbound.id, "operator", sess, signature=_approve_signed(sess, inbound.id)
        )
        == 0
    )
@@ -277,7 +277,7 @@ def test_send_requires_explicit_human_approval(cfg, sess):
        .order_by(AuditEntry.id.desc())
        .first()
    )
-    assert row is not None and "gustavo" in str(row.detail)
+    assert row is not None and "operator" in str(row.detail)
 def test_double_approve_is_rejected(cfg, sess):
@@ -288,11 +288,11 @@ def test_double_approve_is_rejected(cfg, sess):
    assert (
        maild._approve_draft(
-            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+            inbound.id, "operator", sess, signature=_approve_signed(sess, inbound.id)
        )
        == 0
    )
-    assert maild._approve_draft(inbound.id, "gustavo", sess) == 1
+    assert maild._approve_draft(inbound.id, "operator", sess) == 1
 # --- audit corrections ----------------------------------------------------------
@@ -311,7 +311,9 @@ def test_send_failure_does_not_resurrect_sent_mails(cfg, sess):
            p.id, f"desk{i}@acme.example.org", f"[cayce] inquiry {i}", "Hello!", sess
        )
        assert (
-            maild._approve_draft(mail_id, "gustavo", sess, signature=_approve_signed(sess, mail_id))
+            maild._approve_draft(
                mail_id, "operator", sess, signature=_approve_signed(sess, mail_id)
            )
            == 0
        )
        assert maild._send_one(STUB_CFG, sess, mail_id, sender=lambda *a, **k: None) == "sent"
@@ -331,7 +333,7 @@ def test_send_failure_does_not_resurrect_sent_mails(cfg, sess):
        )
        assert (
            maild._approve_draft(
-                inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+                inbound.id, "operator", sess, signature=_approve_signed(sess, inbound.id)
            )
            == 0
        )
@@ -368,7 +370,7 @@ def test_edited_draft_refuses_to_send(cfg, sess):
    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
    assert (
        maild._approve_draft(
-            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+            inbound.id, "operator", sess, signature=_approve_signed(sess, inbound.id)
        )
        == 0
    )
@@ -402,7 +404,7 @@ def test_compose_creates_first_contact_draft(cfg, sess):
    # approve + send -> an inbound reply can now thread to this proposal
    assert (
-        maild._approve_draft(mail_id, "gustavo", sess, signature=_approve_signed(sess, mail_id))
+        maild._approve_draft(mail_id, "operator", sess, signature=_approve_signed(sess, mail_id))
        == 0
    )
    stats = maild._send_approved(STUB_CFG, sess, sender=lambda *a, **k: None)
@@ -462,7 +464,7 @@ def test_changed_to_addr_after_approval_blocks_send(cfg, sess):
    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
    assert (
        maild._approve_draft(
-            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+            inbound.id, "operator", sess, signature=_approve_signed(sess, inbound.id)
        )
        == 0
    )
@@ -491,14 +493,14 @@ def test_foreign_deployment_signature_refused(cfg, sess):
    other_dep = _sign(
        OPERATOR_SECRET, approval_message("mail", "other-deploy", inbound.id, chash)
    )
-    assert maild._approve_draft(inbound.id, "gustavo", sess, signature=other_dep) == 2
+    assert maild._approve_draft(inbound.id, "operator", sess, signature=other_dep) == 2
    assert inbound.draft_status is DraftStatus.DRAFTED
    # signature valid for OTHER CONTENT
    other_content = _sign(
        OPERATOR_SECRET, approval_message("mail", "itest", inbound.id, "00" * 32)
    )
-    assert maild._approve_draft(inbound.id, "gustavo", sess, signature=other_content) == 2
+    assert maild._approve_draft(inbound.id, "operator", sess, signature=other_content) == 2
    assert inbound.draft_status is DraftStatus.DRAFTED
@@ -512,7 +514,7 @@ def test_send_failures_audited_and_exit_code(cfg, sess, monkeypatch):
    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
    assert (
        maild._approve_draft(
-            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+            inbound.id, "operator", sess, signature=_approve_signed(sess, inbound.id)
        )
        == 0
    )
@@ -37,7 +37,7 @@ def test_proposal_status_transitions(sess):
    sess.flush()
    p.status = ProposalStatus.APPROVED
-    p.approved_by = "gustavo"
+    p.approved_by = "operator"
    p.approved_at = datetime.now(UTC)
    p.status = ProposalStatus.RUNNING
    p.status = ProposalStatus.DONE
@@ -45,7 +45,7 @@ def test_proposal_status_transitions(sess):
    loaded = sess.scalar(select(Proposal).where(Proposal.id == p.id))
    assert loaded.status == ProposalStatus.DONE
-    assert loaded.approved_by == "gustavo"
+    assert loaded.approved_by == "operator"
 def test_dedupe_key_unique(sess):
@@ -65,12 +65,12 @@ def test_audit_helper_writes(sess):
    p = Proposal(kind="other", title="x")
    sess.add(p)
    sess.flush()
-    audit(sess, actor="gustavo", action="approve", proposal_id=p.id, detail={"note": "ok"})
+    audit(sess, actor="operator", action="approve", proposal_id=p.id, detail={"note": "ok"})
    sess.flush()
    rows = list(sess.scalars(select(AuditEntry)).all())
    assert len(rows) == 1
-    assert rows[0].actor == "gustavo"
+    assert rows[0].actor == "operator"
    assert rows[0].proposal_id == p.id
@@ -0,0 +1,68 @@
 """Regla permanente (2026-10-31): ningún fichero versionado contiene patrones
 de credenciales. Placeholders de .env.example están permitidos.
 Fallará si alguien mete un DSN con contraseña real, un token en claro, o
 cualquier valor que deba vivir solo en .env / tokens.json.
 """
 from __future__ import annotations
 import re
 from pathlib import Path
 REPO = Path(__file__).resolve().parent.parent
 SCAN_DIRS = ["runtime", "deploy", "docs", "scripts", "prompts"]
 SCAN_GLOBS = ["*.py", "*.mjs", "*.js", "*.ts", "*.md", "*.yml", "*.yaml", "*.sh", "*.sql"]
 # DSN con credencial literal (user:pass@host) — excluye placeholders conocidos
 DSN = re.compile(r"(postgres|postgresql|mysql|mongodb)(\+[a-z]+)?://[A-Za-z0-9_]+:(?!password\b|change-me\b|<[^>]+>)[^@\s/]{8,}@", re.I)
 # tokens hex largos fuera de tests (los fixtures de tests están allowlistados por diseño)
 HEXTOKEN = re.compile(r"\b[0-9a-f]{64}\b")
 # nsec bech32
 NSEC = re.compile(r"nsec1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]{50,}")
 ALLOW_SUBSTR = ("user:password", "change-me", "<", "EXAMPLE", "example", "itest-pg", "0011", "11*", "22*", "33*", "44*")
 def _iter_files():
    for d in SCAN_DIRS:
        base = REPO / d
        if not base.exists():
            continue
        for pat in SCAN_GLOBS:
            for f in base.rglob(pat):
                if ".git" in f.parts or "node_modules" in f.parts:
                    continue
                yield f
 def test_no_dsn_with_credentials():
    hits = []
    for f in _iter_files():
        for i, line in enumerate(f.read_text(errors="ignore").splitlines(), 1):
            if DSN.search(line) and not any(a in line for a in ALLOW_SUBSTR):
                hits.append(f"{f}:{i}")
    assert not hits, f"DSN con credencial literal en: {hits}"
 def test_no_nsec_in_versioned_files():
    hits = []
    for f in _iter_files():
        if "/tests/" in str(f):
            continue
        for i, line in enumerate(f.read_text(errors="ignore").splitlines(), 1):
            if NSEC.search(line):
                hits.append(f"{f}:{i}")
    assert not hits, f"nsec en fichero versionado: {hits}"
 def test_no_raw_hex_tokens_outside_tests():
    """Tokens hex de 64 chars fuera de tests/ y del conftest (las claves de
    test viven solo en tests/). El outbox no debe contener secretos."""
    hits = []
    for f in _iter_files():
        if "/tests/" in str(f) or f.name == "cayce-identity.md":
            continue
        for i, line in enumerate(f.read_text(errors="ignore").splitlines(), 1):
            if HEXTOKEN.search(line):
                hits.append(f"{f}:{i}")
    assert not hits, f"posible token hex versionado: {hits}"
@@ -0,0 +1,82 @@
 """Tests for D16: the operator key may never be an agent identity.
 Background: the operator key was, at some point, Cayce's nostr key. The
 daemon must refuse to operate in that configuration, because "human
 approval" signed by the agent is not human approval.
 """
 from __future__ import annotations
 import pytest
 from cayceops.signing import (
    SelfApprovalError,
    pubkey_from_private_hex,
    validate_no_self_approval,
 )
 # keys invented for tests only (allowlisted in .gitleaks.toml)
 CAYCE_SECRET = "11" * 32  # simulates Cayce nostr identity
 CAYCE_PUBKEY = pubkey_from_private_hex(CAYCE_SECRET)
 HUMAN_SECRET = "33" * 32  # a proper human operator key
 HUMAN_PUBKEY = pubkey_from_private_hex(HUMAN_SECRET)
 def _cfg(monkeypatch, operator_pubkey: str, nostr_private_key: str = CAYCE_SECRET):
    from cayceops.config import Config
    monkeypatch.setenv("CAYCE_OPS_DEPLOYMENT_ID", "itest")
    monkeypatch.setenv("CAYCE_OPS_OPERATOR_PUBKEY", operator_pubkey)
    monkeypatch.setenv("CAYCE_OPS_NOSTR_PRIVATE_KEY", nostr_private_key)
    return Config()
 def test_agent_pubkey_as_operator_is_refused(monkeypatch):
    """The exact bug: operator pubkey = Cayce pubkey must fail."""
    cfg = _cfg(monkeypatch, operator_pubkey=CAYCE_PUBKEY)
    with pytest.raises(SelfApprovalError):
        validate_no_self_approval(cfg)
 def test_human_pubkey_passes(monkeypatch):
    cfg = _cfg(monkeypatch, operator_pubkey=HUMAN_PUBKEY)
    validate_no_self_approval(cfg)  # does not raise
 def test_empty_operator_pubkey_passes_validation(monkeypatch):
    """Empty is the 'not configured' state — rejected elsewhere, not here."""
    cfg = _cfg(monkeypatch, operator_pubkey="")
    validate_no_self_approval(cfg)
 def test_explicit_denylist_is_honoured(monkeypatch):
    """A key held outside this process can be listed explicitly."""
    outside_pubkey = pubkey_from_private_hex("44" * 32)
    monkeypatch.setenv(
        "CAYCE_OPS_FORBIDDEN_OPERATOR_PUBKEYS", f"{outside_pubkey}, {HUMAN_PUBKEY}"
    )
    cfg = _cfg(monkeypatch, operator_pubkey=HUMAN_PUBKEY, nostr_private_key="")
    with pytest.raises(SelfApprovalError):
        validate_no_self_approval(cfg)
 def test_daemon_refuses_to_start_with_agent_key(monkeypatch, sess, db_engine):
    """End-to-end: executor.run must refuse (exit 2) when the operator
    pubkey is Cayce's identity."""
    from cayceops.components.executor import executor
    from cayceops.models import DaemonRun
    cfg = _cfg(monkeypatch, operator_pubkey=CAYCE_PUBKEY)
    code = executor.run(cfg, sess)
    assert code == 2
    run_row = sess.query(DaemonRun).filter_by(daemon="executor").one()
    assert run_row.status == "error"
    assert "agent identity" in run_row.detail["refused"]
 def test_pubkey_derivation_roundtrip():
    assert pubkey_from_private_hex(HUMAN_SECRET) == HUMAN_PUBKEY
    with pytest.raises(ValueError):
        pubkey_from_private_hex("")
    with pytest.raises(ValueError):
        pubkey_from_private_hex("nothex")
@@ -44,7 +44,7 @@ def _approved_item(cfg, sess, **kw) -> ContentItem:
    item = _item(status=ContentStatus.DRAFT, **kw)
    sess.add(item)
    sess.flush()
-    assert publisher._approve(item.id, "gustavo", sess, signature=_sign_content(item)) == 0
+    assert publisher._approve(item.id, "operator", sess, signature=_sign_content(item)) == 0
    return item
@@ -92,16 +92,16 @@ def test_approve_gate(cfg, sess):
    cfg()  # signing env first
    # unsigned approval refused (mandatory signature, no degraded mode)
-    assert publisher._approve(item.id, "gustavo", sess, signature=None) == 2
+    assert publisher._approve(item.id, "operator", sess, signature=None) == 2
    # signed approval accepted, FULL signature stored
    sig = _sign_content(item)
-    assert publisher._approve(item.id, "gustavo", sess, signature=sig) == 0
+    assert publisher._approve(item.id, "operator", sess, signature=sig) == 0
    assert item.status is ContentStatus.APPROVED
    assert item.operator_signature == sig and len(sig) == 128
-    assert publisher._approve(item.id, "gustavo", sess, signature=sig) == 1  # not draft anymore
+    assert publisher._approve(item.id, "operator", sess, signature=sig) == 1  # not draft anymore
    actor = sess.query(AuditEntry).filter_by(action="approve_content").first().actor
-    assert actor == "gustavo"
+    assert actor == "operator"
 # --- publishing ------------------------------------------------------------------
@@ -183,7 +183,7 @@ def test_foreign_deployment_signature_refused(cfg, sess, signer):
    other_dep = signer.raw(
        signer.msg("content", "other-deploy", item.id, signer.content_hash(item))
    )
-    assert publisher._approve(item.id, "gustavo", sess, signature=other_dep) == 2
+    assert publisher._approve(item.id, "operator", sess, signature=other_dep) == 2
    assert item.status is ContentStatus.DRAFT
@@ -0,0 +1,80 @@
 """Spanish negation tests (round-3 point 4): merchants write in Spanish;
 negations like 'nunca', 'lamentablemente' or 'no podemos' must veto
 `approval` exactly like their English counterparts. Veto rule unchanged:
 when in doubt -> needs_review."""
 from __future__ import annotations
 import pytest
 from cayceops.components.maild import classify as clf
 from cayceops.models import MailClassification
 APPROVAL_ONLY = MailClassification.APPROVAL
 def _never_approval(cfg_factory, text: str) -> None:
    kind, _ = clf.classify(text, cfg_factory())
    assert kind is not APPROVAL_ONLY, f"{text!r} classified as APPROVAL"
 def test_english_baseline_still_works(cfg):
    config = cfg()
    kind, _ = clf.classify("Your application was approved, welcome to the program", config)
    assert kind is APPROVAL_ONLY
@pytest.mark.parametrize(
    "text",
    [
        # 1. rejection stem
        "Lamentamos informarle que su solicitud fue rechazada",
        # 2. nunca
        "Nunca aceptamos negocios de criptomonedas",
        # 3. jamás
        "Jamás hemos trabajado con affiliates externos",
        # 4. tampoco
        "No podemos aceptar su sitio, tampoco podemos ofrecerle otro acuerdo",
        # 5. ningún/ninguna
        "En este momento no tenemos ningún hueco para nuevos partners",
        # 6. no podemos (multi-word)
        "Su propuesta es interesante pero no podemos proceder",
        # 7. no es posible (multi-word)
        "Gracias por escribir, pero no es posible colaborar este trimestre",
        # 8. lamentablemente
        "Lamentablemente su aplicación no ha sido aprobada",
        # 9. no aceptamos
        "Por política interna no aceptamos sitios de viajes",
        # 10. mixed spanish/english: negation in spanish, approval word in english
        "Thanks for reaching out! Lamentablemente we cannot approve your site",
        # 11. mixed: approval in spanish, negation in english
        "Apreciamos su interés, but we are not accepting new partners",
        # 12. nadie / nada
        "Aquí nadie decidiría eso, así que no hay nada que aprobar",
    ],
 )
 def test_spanish_and_mixed_negations_veto_approval(cfg, text):
    _never_approval(cfg, text)
 def test_spanish_pure_approval_still_approves(cfg):
    """A clean Spanish approval WITHOUT any negation must still classify
    approval — the veto must not over-fire."""
    config = cfg()
    kind, confidence = clf.classify(
        "Su solicitud fue aprobada. Bienvenido al programa, estamos encantados "
        "de trabajar con ustedes.",
        config,
    )
    assert kind is APPROVAL_ONLY
    assert confidence >= 0.5
 def test_spanish_rejection_classifies_rejection(cfg):
    config = cfg()
    kind, conf = clf.classify(
        "Lamentamos informarle que su solicitud fue rechazada por el comité",
        config,
    )
    assert kind is MailClassification.REJECTION
    assert conf >= 0.9