Upload folder using huggingface_hub

.dockerignore

@@ -0,0 +1,28 @@
+.git
+.venv
+**/__pycache__
+.pytest_cache
+web/node_modules
+web/.next
+serve
+sams-videos
+data
+.env*
+*.pem
+*.log
+
+web/test-results
+web/playwright-report
+
+web/tests
+web/playwright.config.ts
+# Local credentials must stay out of every build stage, including nested web files.
+**/.env*
+**/*.pem
+**/*.age
+**/*.agekey
+**/*.key
+**/rclone.conf
+backups
+snapshots
+docs

.gitattributes

@@ -35,3 +35,39 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
 or-logo1.png filter=lfs diff=lfs merge=lfs -text
 lambda.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/architecture-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/architecture-laptop-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/architecture-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/architecture-tablet-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/experiments-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/experiments-laptop-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/experiments-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/experiments-tablet-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/library-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/library-laptop-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/library-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/library-tablet-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/search-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/search-laptop-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/search-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+docs/v2-evidence/main/search-tablet-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/architecture-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/architecture-laptop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/architecture-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/architecture-tablet-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/experiments-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/experiments-laptop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/experiments-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/experiments-tablet-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/library-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/library-laptop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/library-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/library-tablet-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/search-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/search-laptop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/search-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/parity.spec.ts-snapshots/search-tablet-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/studio.spec.ts-snapshots/live-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/studio.spec.ts-snapshots/live-mobile-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/studio.spec.ts-snapshots/models-desktop-linux.png filter=lfs diff=lfs merge=lfs -text
+web/tests/studio.spec.ts-snapshots/models-mobile-linux.png filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1,29 @@
+.venv/
+serve/.venv/
+serve/logs/
+__pycache__/
+data/
+sams-videos/
+.research/
+web/node_modules/
+web/.next/
+*.log
+
+# OS / editor
+.DS_Store
+.idea/
+.vscode/
+
+# secrets / local config
+.env
+.env.*
+*.pem
+web/test-results/
+web/playwright-report/
+test-results/
+*.age
+*.agekey
+*.key
+rclone.conf
+/backups/
+snapshots/

.hfignore

@@ -0,0 +1,14 @@
+.git
+data
+serve
+sams-videos
+**/.env*
+**/*.pem
+**/*.key
+**/*.agekey
+**/*.age
+**/node_modules
+**/.next
+**/__pycache__
+web/test-results
+web/playwright-report

Agent.md

@@ -0,0 +1,99 @@
+## 1. Deployment Configuration
+
+### Target Space
+- **Profile:** `Leon4gr45`  
+- **Space:** `openweb`  
+- **Full Identifier:** `Leon4gr45/openweb`  
+- **Frontend Port:** `7860` (mandatory for all Hugging Face Spaces)
+
+### Deployment Method
+Choose the correct SDK based on the app type based on the codebase language:
+
+- **Gradio SDK** — for Gradio applications  
+- **Streamlit SDK** — for Streamlit applications  
+- **Docker SDK** — for all other applications (recommended default for flexibility)
+
+### HF Token
+- The environment variable **`HF_TOKEN` will always be provided at execution time**.
+- Never hardcode the token. Always read it from the environment.
+- All monitoring and log‑streaming commands rely on `HF_TOKEN`.
+
+### Required Files
+- `Dockerfile` (or `app.py` for Gradio/Streamlit SDKs)
+- `README.md` with Hugging Face YAML frontmatter:
+  ```yaml
+  ---
+  title: <APP NAME>
+  sdk: docker | gradio | streamlit
+  app_port: 7860
+  ---
+  ```
+- `.hfignore` to exclude unnecessary files
+- This `Agent.md` file (must be committed before deployment)
+
+---
+
+## 2. API Exposure and Documentation
+
+### Mandatory Endpoints
+Every deployment **must** expose:
+
+- **`/health`**  
+  - Returns HTTP 200 when the app is ready.  
+  - Required for Hugging Face to transition the Space from *starting* → *running*.
+
+- **`/api-docs`**  
+  - Documents **all** available API endpoints.  
+  - Must be reachable at:  
+    `https://HF_PROFILE-openweb.hf.space/api-docs`
+
+### Functional Endpoints
+Document each endpoint here. For every endpoint, include:
+
+- **Method:** GET/POST/PUT/DELETE  
+- **Path:** `/predict`, `/generate`, `/upload`, etc.  
+- **Purpose:** What the endpoint does  
+- **Request Example:** JSON or query parameters  
+- **Response Example:** JSON schema or example payload  
+
+Example format:
+
+```
+### /predict
+- Method: POST
+- Purpose: Run model inference
+- Request:
+  {
+    "text": "hello world"
+  }
+- Response:
+  {
+    "prediction": "…"
+  }
+```
+
+All endpoints listed here **must** appear in `/api-docs`.
+
+---
+
+## 3. Deployment Workflow
+
+Precondition: Use the huggingface hub cli hf to check that the space is empty of files nd delete any which are still in there and not belonging to the project to be uploaded
+
+### Standard Deployment Command
+After any code change, run:
+
+```bash
+hf upload Leon4gr45/openweb --repo-type=space
+---
+
+Scan build and run logs # Get build logs (SSE) curl -N
+-H "Authorization: Bearer HF_TOKEN"
+"https://huggingface.co/api/spaces/Leon4gr45/openweb/logs/build"
+
+Get run logs (SSE) once the build logs succeed
+curl -N
+-H "Authorization: Bearer HF_TOKEN"
+"https://huggingface.co/api/spaces/Leon4gr45/openweb/logs/run" 
+
+after 300 seconds to see if the deployment has been successful, and if not, fix the errors of deployment, and redeploy and monitor in a cycle until the space is running and reacts to the api endpoints you created.

CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changes
+
+## Video RAG · Visual Mentor v2 (2026-10-17, development)
+
+- New main-based branch; original Library landing, cards, Search/Ask, charts,
+  Architecture and timestamped clip workflows preserved. Four-size baseline and
+  current screenshot tests, immutable synthetic sample corpus and playable media.
+- Selective remote backend/security migration; protected private library/media,
+  user/admin roles, strict disabled-by-default YAML profiles and placeholder rejection.
+- Persistent bounded upload/CPU-FFmpeg queue, explicit missing-provider stages,
+  remote transcription and model-isolated atomic text-index revisions.
+- Native Live dual-camera workspace, consent/voice/stale guards, local snapshots,
+  freeze/fullscreen, timeline inspection and isolated session route overrides.
+- Models provider cards, route builder/matrix, YAML draft diff/import/export,
+  validation gating, CAS apply/rollback and synthetic execution trace.
+- Real age encryption, consistent SQLite snapshots, independent media checksums,
+  isolated restore, conservative retention and approval-gated private workflow templates.
+- Private HF Docker package on one port; no inference infrastructure modifications.
+  Production deployment, durability and backup activation remain unqualified gates.

Dockerfile

@@ -0,0 +1,34 @@
+FROM node:24-bookworm-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5 AS web
+WORKDIR /build/web
+ENV NEXT_TELEMETRY_DISABLED=1
+COPY web/package*.json ./
+RUN --mount=type=secret,id=build_ca if [ -f /run/secrets/build_ca ]; then export NODE_EXTRA_CA_CERTS=/run/secrets/build_ca; fi; npm ci --no-audit --no-fund
+COPY web/ ./
+RUN npm run build
+
+# Assemble application assets without repeatedly copying the FFmpeg runtime layer.
+FROM scratch AS bundle
+COPY vrag /app/vrag
+COPY config /app/config
+COPY scripts/cloud-start.py /app/scripts/cloud-start.py
+COPY --from=web /build/web/.next/standalone /app/web/.next/standalone
+COPY --from=web /build/web/.next/static /app/web/.next/standalone/.next/static
+COPY --from=web /build/web/public /app/web/.next/standalone/public
+
+FROM python:3.12-slim-bookworm@sha256:34386ef0cb081344d7ec1c103ba398e6e9f64e9ab3a1509accc92a4e24a07258 AS runtime
+WORKDIR /app
+COPY requirements-runtime.txt ./
+RUN --mount=type=secret,id=build_ca \
+    export http_proxy="$HTTP_PROXY" https_proxy="$HTTPS_PROXY"; \
+    if [ -f /run/secrets/build_ca ]; then export PIP_CERT=/run/secrets/build_ca; fi; \
+    apt-get update && apt-get install -y --no-install-recommends ca-certificates libatomic1 ffmpeg age && \
+    pip install --no-cache-dir -r requirements-runtime.txt && \
+    rm -rf /var/lib/apt/lists/* && \
+    useradd -m -u 1000 mentor && mkdir -p /app/data/videos /app/work && chown -R mentor:mentor /app/data /app/work
+COPY --from=web /usr/local/bin/node /usr/local/bin/node
+COPY --from=bundle --chown=1000:1000 /app /app
+USER mentor
+ENV PYTHONUNBUFFERED=1 NEXT_TELEMETRY_DISABLED=1 VRAG_DATA=/app/work/data VM_STATE_DIR=/app/work/state
+EXPOSE 7860
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:7860/api/health', timeout=4)"
+CMD ["python", "scripts/cloud-start.py"]

README.md

@@ -0,0 +1,62 @@
+---
+title: Video RAG · Visual Mentor
+sdk: docker
+app_port: 7860
+---
+
+# Video RAG · Visual Mentor v2
+
+The original Library, Search, Ask, Experiments, Architecture and clip-player UI,
+with remote inference, a dual-camera Live workspace and Models & Routing studio.
+The landing page is Library. Without a connected private-library token it shows
+an immutable synthetic sample corpus, keyword retrieval and labeled evidence
+extracts. No model inference or benchmark quality is implied by samples.
+
+Run a CPU-only development environment (Python 3.12+, Node 24+, FFmpeg):
+
+```
+python -m venv .venv
+.venv/bin/pip install -r requirements-runtime.txt
+npm --prefix web ci
+PYTHON=.venv/bin/python bash scripts/dev.sh
+```
+
+Open port 7860. FastAPI stays on loopback 8000. Configure independent
+VM_USER_TOKEN/VM_ADMIN_TOKEN (at least 24 random characters), VM_ALLOWED_ORIGINS,
+VRAG_DATA and VM_STATE_DIR in environment settings; never commit values.
+No local inference services are started. For a production container:
+
+```
+docker build -t video-rag-mentor:v2 .
+```
+
+See [HF staging/deployment steps](docs/deployment-hf.md),
+[v2 qualification and remaining gates](docs/v2-release-readiness.md),
+[private backup/restore](docs/backup-restore.md), and
+[porting decisions](docs/v2-porting-plan.md). Private Space deployment, backup
+repository creation, credentials and activation remain approval-gated.
+The base Space disk is ephemeral; local files alone do not establish durability.
+
+Browser uploads are capped at 64 MiB/30 minutes, with one processing worker and
+two simultaneous uploads. Jobs prepare CPU H.264 proxies, keyframes and timestamped
+segments, transcribe via remote Whisper-compatible API and build isolated remote
+text indexes. Missing providers become explicit blocked jobs with retry/manual
+transcript support. Models/routing use strict schema version 1, not the illustrative
+version-2 YAML in the product specification. All example routes start disabled.
+
+Large multimodal inference stays remote. Text adapters cannot encode images,
+video or audio into a shared vector space. Historical MRL/RRF indexes and charts
+remain viewable where compatible; [original research documentation](docs/original-research.md)
+is retained separately and is not this cloud runtime's setup procedure.
+
+Validation:
+
+```
+python -m pytest -q
+npm --prefix web run lint
+npm --prefix web run build
+cd web && CHROMIUM_PATH=/usr/bin/chromium npx playwright test
+```
+
+Install `age` to run actual encrypted backup tests. Test tooling requires pytest,
+pytest-asyncio and Playwright; Python dev dependencies are in the uv dev group.

config/examples/detector-only.yaml

@@ -0,0 +1,23 @@
+version: 1
+profile: detector-only
+providers:
+  detector:
+    adapter: detection-http
+    base_url_env: NVIDIA_DETECTION_BASE_URL
+    api_key_secret: NVIDIA_DETECTION_API_KEY
+    model: replace-with-verified-gateway-model
+    capabilities:
+    - object_detection
+    - bounding_boxes
+    trust: approved_sensitive
+features:
+  live.camera1.detection:
+    strategy: single
+    providers:
+    - detector
+    enabled: false
+  live.camera2.detection:
+    strategy: single
+    providers:
+    - detector
+    enabled: false

config/examples/disabled.yaml

@@ -0,0 +1,17 @@
+version: 1
+profile: local-preview
+providers: {}
+features: {}
+cameras:
+  camera1:
+    analysis_fps: 1
+    width: 640
+    height: 480
+  camera2:
+    analysis_fps: 1
+    width: 640
+    height: 480
+privacy:
+  record_video: false
+  upload_only_on_explicit_start: true
+  require_approved_destination_for_camera: true

config/examples/hybrid.yaml

@@ -0,0 +1,84 @@
+version: 1
+profile: hybrid
+providers:
+  vlm:
+    adapter: openai-chat-vision
+    base_url_env: VLM_BASE_URL
+    api_key_secret: VLM_API_KEY
+    model: replace-with-verified-model-id
+    capabilities:
+    - image_understanding
+    - reasoning
+    - visual_decision
+    trust: approved_sensitive
+    timeout_ms: 10000
+    concurrency: 2
+  detector:
+    adapter: detection-http
+    base_url_env: NVIDIA_DETECTION_BASE_URL
+    api_key_secret: NVIDIA_DETECTION_API_KEY
+    model: replace-with-verified-gateway-model
+    capabilities:
+    - object_detection
+    - bounding_boxes
+    trust: approved_sensitive
+  embeddings:
+    adapter: openai-embeddings
+    base_url_env: EMBEDDINGS_BASE_URL
+    api_key_secret: EMBEDDINGS_API_KEY
+    model: replace-with-embedding-model
+    capabilities:
+    - text_embeddings
+    trust: approved_sensitive
+  whisper:
+    adapter: openai-transcription
+    base_url_env: WHISPER_BASE_URL
+    api_key_secret: WHISPER_API_KEY
+    model: replace-with-whisper-model
+    capabilities:
+    - transcription
+    trust: approved_sensitive
+features:
+  live.camera1.scene:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  live.camera2.scene:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  live.visual_decision:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  rag.reasoning:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  mentor.reasoning:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  live.camera2.detection:
+    strategy: parallel
+    providers:
+    - detector
+    - vlm
+    result_policy: all
+    fusion: spatial_semantic
+    enabled: false
+  rag.text_embeddings:
+    strategy: single
+    providers:
+    - embeddings
+    enabled: false
+  audio.transcription:
+    strategy: single
+    providers:
+    - whisper
+    enabled: false

config/examples/laya-nvidia-hybrid.yaml

@@ -0,0 +1,47 @@
+version: 1
+profile: laya-nvidia-hybrid
+providers:
+  laya:
+    label: Needle Router Laya Vision
+    adapter: laya-vision
+    base_url_env: LAYA_BASE_URL
+    model: thaitea/laya-vision
+    capabilities:
+    - image_understanding
+    - visual_decision
+    trust: approved_sensitive
+    timeout_ms: 60000
+    concurrency: 1
+  detector:
+    adapter: detection-http
+    base_url_env: NVIDIA_DETECTION_BASE_URL
+    api_key_secret: NVIDIA_DETECTION_API_KEY
+    model: replace-with-verified-gateway-model
+    capabilities:
+    - object_detection
+    - bounding_boxes
+    trust: approved_sensitive
+features:
+  live.camera1.scene:
+    strategy: single
+    providers:
+    - laya
+    enabled: false
+  live.camera2.scene:
+    strategy: single
+    providers:
+    - laya
+    enabled: false
+  live.visual_decision:
+    strategy: single
+    providers:
+    - laya
+    enabled: false
+  live.camera2.detection:
+    strategy: parallel
+    providers:
+    - laya
+    - detector
+    result_policy: all
+    fusion: spatial_semantic
+    enabled: false

config/examples/laya-only.yaml

@@ -0,0 +1,30 @@
+version: 1
+profile: laya-only
+providers:
+  laya:
+    label: Needle Router Laya Vision
+    adapter: laya-vision
+    base_url_env: LAYA_BASE_URL
+    model: thaitea/laya-vision
+    capabilities:
+    - image_understanding
+    - visual_decision
+    trust: approved_sensitive
+    timeout_ms: 60000
+    concurrency: 1
+features:
+  live.camera1.scene:
+    strategy: single
+    providers:
+    - laya
+    enabled: false
+  live.camera2.scene:
+    strategy: single
+    providers:
+    - laya
+    enabled: false
+  live.visual_decision:
+    strategy: single
+    providers:
+    - laya
+    enabled: false

config/examples/laya-pending.yaml

@@ -0,0 +1,22 @@
+version: 1
+profile: laya-pending-protocol
+providers:
+  laya:
+    label: Needle router / Laya
+    adapter: laya-vision
+    base_url_env: LAYA_BASE_URL
+    api_key_secret: LAYA_API_KEY
+    model: pending-v1-info-verification
+    capabilities: []
+    trust: approved_sensitive
+features:
+  live.camera1.scene:
+    strategy: single
+    providers:
+    - laya
+    enabled: false
+  live.camera2.scene:
+    strategy: single
+    providers:
+    - laya
+    enabled: false

config/examples/laya-vlm-fallback.yaml

@@ -0,0 +1,42 @@
+version: 1
+profile: laya-vlm-fallback
+providers:
+  laya:
+    label: Needle Router Laya Vision
+    adapter: laya-vision
+    base_url_env: LAYA_BASE_URL
+    model: thaitea/laya-vision
+    capabilities:
+    - image_understanding
+    - visual_decision
+    trust: approved_sensitive
+    timeout_ms: 60000
+    concurrency: 1
+  detector:
+    adapter: detection-http
+    base_url_env: NVIDIA_DETECTION_BASE_URL
+    api_key_secret: NVIDIA_DETECTION_API_KEY
+    model: replace-with-verified-gateway-model
+    capabilities:
+    - object_detection
+    - bounding_boxes
+    trust: approved_sensitive
+  vlm:
+    adapter: openai-chat-vision
+    base_url_env: VLM_BASE_URL
+    api_key_secret: VLM_API_KEY
+    model: replace-with-verified-model-id
+    capabilities:
+    - image_understanding
+    - reasoning
+    - visual_decision
+    trust: approved_sensitive
+    timeout_ms: 10000
+    concurrency: 2
+features:
+  live.camera1.scene:
+    strategy: fallback
+    providers:
+    - laya
+    - vlm
+    enabled: false

config/examples/nvidia-laya-sequential.yaml

@@ -0,0 +1,30 @@
+version: 1
+profile: nvidia-laya-sequential
+providers:
+  laya:
+    label: Needle Router Laya Vision
+    adapter: laya-vision
+    base_url_env: LAYA_BASE_URL
+    model: thaitea/laya-vision
+    capabilities:
+    - image_understanding
+    - visual_decision
+    trust: approved_sensitive
+    timeout_ms: 60000
+    concurrency: 1
+  detector:
+    adapter: detection-http
+    base_url_env: NVIDIA_DETECTION_BASE_URL
+    api_key_secret: NVIDIA_DETECTION_API_KEY
+    model: replace-with-verified-gateway-model
+    capabilities:
+    - object_detection
+    - bounding_boxes
+    trust: approved_sensitive
+features:
+  live.camera1.scene:
+    strategy: sequential
+    providers:
+    - detector
+    - laya
+    enabled: false

config/examples/vlm-only.yaml

@@ -0,0 +1,41 @@
+version: 1
+profile: vlm-only
+providers:
+  vlm:
+    adapter: openai-chat-vision
+    base_url_env: VLM_BASE_URL
+    api_key_secret: VLM_API_KEY
+    model: replace-with-verified-model-id
+    capabilities:
+    - image_understanding
+    - reasoning
+    - visual_decision
+    trust: approved_sensitive
+    timeout_ms: 10000
+    concurrency: 2
+features:
+  live.camera1.scene:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  live.camera2.scene:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  live.visual_decision:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  rag.reasoning:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false
+  mentor.reasoning:
+    strategy: single
+    providers:
+    - vlm
+    enabled: false

config/schema.py

@@ -0,0 +1,141 @@
+"""Strict, bounded configuration. Credentials are references, never YAML values."""
+from typing import Literal
+import re
+import yaml
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+
+Capability = Literal['image_understanding', 'visual_decision', 'object_detection', 'bounding_boxes', 'object_tracking', 'reasoning', 'text_embeddings', 'multimodal_embeddings', 'transcription']
+
+class Strict(BaseModel):
+    model_config = ConfigDict(extra='forbid', frozen=True)
+
+class Provider(Strict):
+    label: str = Field(default='', max_length=100)
+    adapter: Literal['openai-chat-vision', 'openai-embeddings', 'openai-transcription', 'detection-http', 'laya-vision']
+    base_url_env: str = Field(pattern=r'^[A-Z][A-Z0-9_]{0,79}$')
+    api_key_secret: str | None = Field(default=None, pattern=r'^[A-Z][A-Z0-9_]{0,79}$')
+    model: str = Field(min_length=1, max_length=200)
+    capabilities: list[Capability] = Field(max_length=10)
+    trust: Literal['approved_sensitive', 'public_only'] = 'public_only'
+    timeout_ms: int = Field(default=10000, ge=100, le=60000)
+    concurrency: int = Field(default=2, ge=1, le=8)
+    @model_validator(mode='after')
+    def supported(self):
+        if self.api_key_secret and (self.api_key_secret.startswith(('VM_', 'HF_', 'HUGGING_FACE_', 'GITHUB_', 'GH_', 'AWS_', 'RCLONE_', 'AGE_', 'OIC_', 'AZURE_', 'GOOGLE_')) or self.api_key_secret in ('HTTP_PROXY','HTTPS_PROXY','ALL_PROXY')):
+            raise ValueError('provider credentials cannot reference application, infrastructure or recovery secrets')
+        supported = {
+            'openai-chat-vision': {'image_understanding', 'reasoning', 'visual_decision'},
+            'openai-embeddings': {'text_embeddings'},
+            'openai-transcription': {'transcription'},
+            'detection-http': {'object_detection', 'bounding_boxes', 'object_tracking'},
+            # Needle Router imageBase64 + typed noul answers; not generative chat.
+            'laya-vision': {'image_understanding', 'visual_decision'},
+        }
+        if not set(self.capabilities) <= supported[self.adapter]:
+            raise ValueError('capability is not supported by this adapter; use a verified provider protocol')
+        if self.adapter == 'laya-vision' and self.capabilities and set(self.capabilities) != {'image_understanding','visual_decision'}:
+            raise ValueError('Laya image scoring requires image_understanding and visual_decision')
+        if self.adapter == 'detection-http' and set(self.capabilities) & {'object_detection','object_tracking'} and 'bounding_boxes' not in self.capabilities:
+            raise ValueError('detector/tracker contract requires bounding_boxes')
+        return self
+
+class Condition(Strict):
+    field: Literal['camera_id', 'has_detections']
+    equals: str | bool
+    provider: str
+    @model_validator(mode='after')
+    def predicate_type(self):
+        if self.field == 'camera_id' and (not isinstance(self.equals, str) or self.equals not in ('camera1','camera2')):
+            raise ValueError('camera condition requires a logical camera slot')
+        if self.field == 'has_detections' and not isinstance(self.equals, bool):
+            raise ValueError('has_detections requires a boolean')
+        return self
+
+class Route(Strict):
+    strategy: Literal['single', 'fallback', 'parallel', 'sequential', 'conditional'] = 'single'
+    providers: list[str] = Field(min_length=1, max_length=8)
+    enabled: bool = True
+    result_policy: Literal['all', 'first_valid', 'quorum'] = 'all'
+    quorum: int = Field(default=1, ge=1, le=8)
+    fusion: Literal['spatial_semantic'] | None = None
+    fallback_on: list[Literal['timeout', 'provider_error', 'invalid_output']] = Field(default_factory=lambda: ['timeout', 'provider_error', 'invalid_output'])
+    conditions: list[Condition] = Field(default_factory=list, max_length=8)
+    @model_validator(mode='after')
+    def valid(self):
+        if len(set(self.providers)) != len(self.providers):
+            raise ValueError('duplicate providers')
+        if self.strategy != 'parallel' and self.result_policy != 'all':
+            raise ValueError('result_policy is only supported for parallel routing')
+        if self.strategy == 'single' and len(self.providers) != 1:
+            raise ValueError('single requires exactly one provider')
+        if self.quorum > len(self.providers):
+            raise ValueError('quorum exceeds provider count')
+        if self.strategy == 'conditional' and not self.conditions:
+            raise ValueError('conditional requires deterministic conditions')
+        if any(c.provider not in self.providers for c in self.conditions):
+            raise ValueError('condition provider must belong to route')
+        return self
+
+class Camera(Strict):
+    analysis_fps: float = Field(default=1, gt=0, le=2)
+    width: int = Field(default=640, ge=160, le=1920)
+    height: int = Field(default=480, ge=120, le=1080)
+
+class Privacy(Strict):
+    record_video: Literal[False] = False
+    upload_only_on_explicit_start: Literal[True] = True
+    require_approved_destination_for_camera: Literal[True] = True
+
+class Configuration(Strict):
+    version: Literal[1] = 1
+    profile: str = Field(default='unconfigured', min_length=1, max_length=100)
+    providers: dict[str, Provider] = Field(default_factory=dict, max_length=32)
+    features: dict[str, Route] = Field(default_factory=dict, max_length=64)
+    cameras: dict[Literal['camera1', 'camera2'], Camera] = Field(default_factory=lambda: {'camera1': Camera(), 'camera2': Camera()})
+    privacy: Privacy = Field(default_factory=Privacy)
+    @model_validator(mode='after')
+    def references(self):
+        for key in self.providers:
+            if not re.fullmatch(r'[a-zA-Z0-9_-]{1,64}', key):
+                raise ValueError('invalid provider identifier')
+        required = {'rag.text_embeddings': 'text_embeddings', 'audio.transcription': 'transcription', 'rag.reasoning': 'reasoning', 'mentor.reasoning': 'reasoning'}
+        for feature, route in self.features.items():
+            if any(p not in self.providers for p in route.providers):
+                raise ValueError(f'{feature}: unknown provider')
+            if route.enabled:
+                if any(self.providers[p].model.lower().startswith(('replace-with','verified_','your-')) for p in route.providers):
+                    raise ValueError('replace placeholder model identifiers before enabling routes')
+                cap = required.get(feature)
+                caps = {c for p in route.providers for c in self.providers[p].capabilities}
+                if cap and any(cap not in self.providers[p].capabilities for p in route.providers):
+                    raise ValueError(f'{feature}: missing {cap} capability')
+                if feature == 'rag.text_embeddings' and route.strategy != 'single':
+                    raise ValueError('embedding indexes require one explicit provider identity')
+                if feature.endswith('.tracking') and 'object_tracking' not in caps:
+                    raise ValueError('tracking requires a real tracker')
+                if feature.endswith('.detection') and 'bounding_boxes' not in caps:
+                    raise ValueError('detection requires a spatial detector')
+                if feature.startswith('live.') and any(self.providers[p].adapter in ('openai-chat-vision','laya-vision') and 'image_understanding' not in self.providers[p].capabilities for p in route.providers):
+                    raise ValueError('live semantic providers must accept images')
+                if feature.startswith('live.') and any(not set(self.providers[p].capabilities) & {'image_understanding', 'visual_decision', 'object_detection', 'object_tracking'} for p in route.providers):
+                    raise ValueError('live route requires visual capability')
+        return self
+
+def parse_yaml(text: str) -> Configuration:
+    if len(text.encode()) > 65536:
+        raise ValueError('configuration exceeds 64 KiB')
+    # Reject aliases/anchors entirely rather than expanding attacker-controlled graphs.
+    if any(isinstance(t, (yaml.tokens.AliasToken, yaml.tokens.AnchorToken)) for t in yaml.scan(text)):
+        raise ValueError('YAML aliases and anchors are disabled')
+    class UniqueLoader(yaml.SafeLoader):
+        pass
+    def mapping(loader, node):
+        result = {}
+        for k, v in node.value:
+            key = loader.construct_object(k)
+            if key in result:
+                raise ValueError('duplicate YAML key')
+            result[key] = loader.construct_object(v)
+        return result
+    UniqueLoader.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, mapping)
+    return Configuration.model_validate(yaml.load(text, Loader=UniqueLoader))

deploy/backup-repository/inactive-workflows/backup-12h.yml

@@ -0,0 +1,26 @@
+name: Coordinate private Space GitHub checkpoint
+on:
+  schedule:
+    - cron: '17 0,12 * * *'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: backup-production
+  cancel-in-progress: false
+jobs:
+  checkpoint:
+    if: vars.BACKUPS_APPROVED == 'true' && vars.COORDINATOR_VALIDATED == 'true'
+    environment: private-backup
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - run: python -m pip install httpx==0.28.1
+      - name: Verify private Space reachability and completed checkpoint
+        env:
+          VM_SPACE_ID: ${{ vars.VM_SPACE_ID }}
+          VM_SPACE_URL: ${{ vars.VM_SPACE_URL }}
+          HF_SPACE_TOKEN: ${{ secrets.HF_SPACE_TOKEN }}
+          VM_BACKUP_TRIGGER_TOKEN: ${{ secrets.VM_BACKUP_TRIGGER_TOKEN }}
+        run: python scripts/coordinate_backup.py

deploy/backup-repository/inactive-workflows/qualify-private-staging.yml

@@ -0,0 +1,25 @@
+name: Qualify private staging backup manually
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: backup-staging-qualification
+  cancel-in-progress: false
+jobs:
+  qualify:
+    runs-on: ubuntu-24.04
+    environment: private-backup-staging
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - run: python -m pip install httpx==0.28.1
+      - name: Verify private access and a new checkpoint
+        env:
+          VM_SPACE_ID: ${{ vars.STAGING_SPACE_ID }}
+          VM_SPACE_URL: ${{ vars.STAGING_SPACE_URL }}
+          HF_SPACE_TOKEN: ${{ secrets.STAGING_HF_TOKEN }}
+          VM_BACKUP_TRIGGER_TOKEN: ${{ secrets.STAGING_BACKUP_TRIGGER_TOKEN }}
+        run: >-
+          python scripts/qualify_private_space.py
+          --space "$VM_SPACE_ID" --url "$VM_SPACE_URL" --trigger

deploy/hf-staging/README.md

@@ -0,0 +1,67 @@
+# Private staging qualification package (not deployed)
+
+Proposed target: **Leon4gr45/openweb-v2-staging**, private Docker Space, CPU Basic.
+Production `Leon4gr45/openweb` is excluded. A live anonymous HF metadata probe on
+17 October 2026 reported production `private=false`, Docker/CPU Basic/RUNNING and
+no deployed backup-status route (404). This package never changes that Space.
+
+Upload only the application allowlist from docs/deployment-hf.md, using the reviewed
+feature-branch commit and an HF identity authorized to write this staging repository.
+A credential restricted to an existing staging repository is preferred: create the
+private staging repository separately first, then grant write only to that target.
+Creation itself requires repository-creation rights for the Leon4gr45 namespace.
+No deployment command has been executed and no HF credential is currently present.
+
+HF staging Variables:
+
+```
+VM_BACKUP_ENABLED=true
+VM_BACKUP_REPOSITORY=JsonLord/visual-mentor-backups
+VM_BACKUP_NAMESPACE=staging-qualification
+VM_RECOVERY_ROOT=/app/work
+VRAG_DATA=/app/work/data
+VM_STATE_DIR=/app/work/state
+VM_ALLOWED_ORIGINS=https://leon4gr45-openweb-v2-staging.hf.space
+VM_BACKUP_RECIPIENT=<public age recipient>
+```
+
+Secrets: independent VM_USER_TOKEN / VM_ADMIN_TOKEN (>=24 characters),
+VM_BACKUP_TRIGGER_TOKEN (>=32 characters), VM_BACKUP_GITHUB_TOKEN (backup repository
+Contents read/write, Metadata read, API + upload-host access), VM_BACKUP_IDENTITY
+(age private recovery identity, direct HF Secret; do not proxy this value).
+Keep the independent operator recovery key copy. Provider settings remain disabled
+unless an explicitly authorized synthetic-provider test needs them. Source and
+media/index fixtures must come from a separate disposable test namespace.
+
+For a reviewed first initialization of this *new staging namespace only*, temporarily
+set VM_BACKUP_ALLOW_EMPTY=true; remove it after the first verified checkpoint.
+Never use this override to hide a failed restore of a previously initialized root.
+Use synthetic video ingestion or the offline fixture exporter with writers stopped.
+
+After the deployment is ready, execute the read-only private boundary probe:
+
+```
+python scripts/qualify_private_space.py \
+  --space Leon4gr45/openweb-v2-staging \
+  --url https://leon4gr45-openweb-v2-staging.hf.space
+```
+
+It requires HF_SPACE_TOKEN (read access to this private staging repo, plus direct
+private app route access) and VM_BACKUP_TRIGGER_TOKEN from secure settings.
+Add `--trigger` only when ready for an actual new checkpoint; it uses the bounded
+coordinator. It records anonymous denial, authorized status, rejection of a wrong
+trigger token, initial runtime stage, and checkpoint outcome. An already running
+Space cannot establish a sleep/wake claim. Do not call restart/resume/hardware APIs;
+wait for a naturally sleeping staging instance and test the authenticated route.
+
+The backup repository's `inactive-workflows/qualify-private-staging.yml` is a
+**manual-only** test workflow, with separate `private-backup-staging` environment
+and STAGING_* variables/secrets. No production timer is activated. Once staging
+credentials and routing work locally, review and install only this manual workflow,
+dispatch from an actual runner, then record its run URL/checkpoint. The 12-hour
+production workflow stays in inactive-workflows with approval guards unset.
+
+Final drill: delete only this staging test working root, start its clean container,
+and verify restored Library/Search/media/config/index from GitHub + protected key.
+Record initial/final file hashes, SQLite integrity/logical rows, Range response and
+actual media decoding. Production and pre-existing backups/releases remain untouched.

diagnostics/README.md

@@ -0,0 +1,179 @@
+# Standalone GitHub encrypted-release probe
+
+Copy **only `qualify_github_release.py`** to your trusted laptop/server if desired.
+It needs Python 3.10+ and the official `age` / `age-keygen` executables on PATH.
+No Visual Mentor installation, pip packages, GitHub CLI or application models are
+required. It works with Linux and native Windows Python; Windows execution has not
+been tested in this managed Linux environment.
+
+Inject `VM_BACKUP_GITHUB_TOKEN` using your trusted machine's secure secret manager.
+The script reads **only this environment variable** for credentials; it never reads
+GH_TOKEN, credential files or command-line token arguments. Use the same permitted
+credential as in the managed test, not a copied proxy placeholder. Limit it to the
+private JsonLord/visual-mentor-backups repository, Contents read/write and Metadata
+read. Do not paste credentials into command history, reports or chat.
+
+The script keeps the machine's approved proxy/CA/TLS settings. Execute it on the
+independent trusted machine normally; do not disable this managed environment's
+proxy, firewall or certificate checks. Optional `--age` and `--age-keygen` arguments
+accept executable paths when those tools are not on PATH.
+
+## Linux / Debian: standalone upload test
+
+Install the local prerequisites on your trusted Debian/Ubuntu server if needed:
+
+```sh
+sudo apt-get update
+sudo apt-get install --no-install-recommends python3 age ca-certificates
+```
+
+With the credential already injected securely, run from the downloaded script's
+folder (or use its absolute path):
+
+```sh
+python3 qualify_github_release.py --output standalone-upload.json
+```
+
+From the repository checkout the equivalent command is:
+
+```sh
+python3 diagnostics/qualify_github_release.py --output standalone-upload.json
+```
+
+Exit 0 means the new encrypted asset's SHA-256 was verified by downloading it.
+Exit 2 means NO-GO; stop and inspect the sanitized evidence. No request is retried.
+Without `--output`, a unique `github-release-qualification-<UTC timestamp>-<UUID>.json` is written in
+the current directory. `--output /path/to/new.json` selects a new file explicitly;
+an existing file is refused before any network call. Missing tools/credentials
+also fail before creating a release.
+
+## Windows: standalone upload test
+
+Use Python 3.10+ (`py -3`) and PowerShell 7. Install the official pinned age tools
+if they are not already on PATH:
+
+```powershell
+$tools = Join-Path $env:LOCALAPPDATA 'VisualMentorDiagnosticTools'
+New-Item -ItemType Directory -Force -Path $tools | Out-Null
+$zip = Join-Path $tools 'age-v1.2.1-windows-amd64.zip'
+Invoke-WebRequest -Uri 'https://github.com/FiloSottile/age/releases/download/v1.2.1/age-v1.2.1-windows-amd64.zip' -OutFile $zip
+Expand-Archive -Path $zip -DestinationPath $tools -Force
+$env:Path = "$(Join-Path $tools 'age');$env:Path"
+Get-Command age.exe, age-keygen.exe
+```
+
+These commands are for x64 Windows; use the matching official age release for
+other architectures. They contain no credential values. With the dedicated token
+already injected securely into this PowerShell session, run:
+
+```powershell
+py -3 .\qualify_github_release.py --output .\standalone-upload.json
+if ($LASTEXITCODE -ne 0) { throw 'Upload qualification failed; inspect the new JSON evidence.' }
+```
+
+From the application checkout use `py -3 .\diagnostics\qualify_github_release.py --output .\standalone-upload.json`.
+Do not add a token argument. Paths with spaces work with `--age` / `--age-keygen`:
+
+```powershell
+py -3 .\qualify_github_release.py --age "$tools\age\age.exe" --age-keygen "$tools\age\age-keygen.exe"
+```
+
+## What the probe does
+
+1. Generates a small synthetic payload and a disposable age identity in a temporary
+   directory, encrypts the payload, and verifies a local decryption roundtrip.
+2. Confirms the repository is private. Explicit denial of reported push permission
+   stops the run; successful creation of the new test release proves an actual
+   Contents-write operation (no repository file or checkpoint is edited).
+3. Creates exactly one uniquely named `vm-credential-test-*` prerelease.
+4. Validates and uses GitHub's returned upload_url for exactly one encrypted asset.
+5. Downloads the asset by API ID and compares its ciphertext SHA-256 and byte count.
+   Signed release redirects are allowlisted and receive **no Authorization header**.
+6. Saves method, host, status, GitHub request ID, release/asset IDs and hash results.
+   Tokens, plaintext payloads, recovery identities, response bodies and signed URLs
+   are never printed or written to evidence. The temporary identity is destroyed.
+
+Any HTTP rejection stops immediately, including 401/403/404. The unique release
+and any successful synthetic upload remain for inspection; nothing is deleted.
+Existing releases/checkpoints and all workflow settings remain untouched. The
+probe does not dispatch workflows or deploy anything. Its upload GO alone does
+not establish a complete recovery or private-HF staging GO.
+
+## Only after upload GO: complete destructive GitHub recovery
+
+The full existing drill requires the application checkout, Python 3.12, uv, FFmpeg,
+age/age-keygen and the same dedicated credential. It does not require HF access.
+Only the disposable local fixture is destroyed. All previous remote backups remain.
+The commands below reuse the preceding `standalone-upload.json`; they do not create
+another standalone probe release. If you selected a different output filename,
+substitute that filename in the evidence check.
+Its query embedding is a deterministic synthetic stub; index retrieval is real.
+
+**Linux**, from the application checkout:
+
+```sh
+set -e
+if [ -z "${VM_BACKUP_GITHUB_TOKEN:-}" ]; then
+  echo 'Dedicated credential required; refusing integration fallback' >&2
+  exit 2
+fi
+python3 -c 'import json; r=json.load(open("standalone-upload.json")); assert r["status"] == "passed" and r["asset_readback_verified"] and r["credential_source"] == "VM_BACKUP_GITHUB_TOKEN"'
+# set -e stops unless the preceding standalone report proves upload + readback.
+archive=$(mktemp -d "$PWD/docs/evidence/trusted-recovery-XXXXXXXX")
+if [ -f docs/evidence/github-recovery-live.json ]; then
+  cp docs/evidence/github-recovery-live.json "$archive/before.json"
+fi
+set +e
+uv run --frozen --group dev --python 3.12 python tests/live_github_recovery.py
+result=$?
+set -e
+if [ -f docs/evidence/github-recovery-live.json ]; then
+  cp docs/evidence/github-recovery-live.json "$archive/after.json"
+fi
+if [ "$result" -ne 0 ]; then
+  echo "NO-GO: recovery failed; evidence saved under $archive" >&2
+  exit "$result"
+fi
+echo "GitHub recovery GO; evidence saved under $archive"
+```
+
+**Windows PowerShell 7**, from the application checkout with uv, FFmpeg and age on
+PATH and Python 3.12 installed:
+
+```powershell
+if (-not $env:VM_BACKUP_GITHUB_TOKEN) { throw 'Dedicated credential required; refusing integration fallback.' }
+py -3 -c "import json; r=json.load(open('standalone-upload.json')); assert r['status'] == 'passed' and r['asset_readback_verified'] and r['credential_source'] == 'VM_BACKUP_GITHUB_TOKEN'"
+if ($LASTEXITCODE -ne 0) { throw 'NO-GO: upload/readback report missing or failed; do not run recovery.' }
+$archive = Join-Path (Get-Location) ('docs\evidence\trusted-recovery-' + [guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $archive | Out-Null
+$evidence = '.\docs\evidence\github-recovery-live.json'
+if (Test-Path $evidence) { Copy-Item $evidence (Join-Path $archive 'before.json') }
+uv run --frozen --group dev --python 3.12 python tests\live_github_recovery.py
+$result = $LASTEXITCODE
+if (Test-Path $evidence) { Copy-Item $evidence (Join-Path $archive 'after.json') }
+if ($result -ne 0) { throw "NO-GO: recovery failed; evidence saved under $archive" }
+Write-Host "GitHub recovery GO; evidence saved under $archive"
+```
+
+The harness creates another disposable namespace, commits two verified checkpoints,
+checks unchanged incremental dedup, deletes source and staging, recovers using
+GitHub plus the protected test identity, and checks every restored file hash,
+SQLite integrity/logical rows, fresh-process Library/Search/config/index, authorized
+media Range, anonymous media denial and FFmpeg decoding. It never deletes remote
+releases or activates workflows. Archive copies preserve pre-existing local evidence
+before the existing harness writes its fixed report filename.
+
+Return only the new standalone JSON and the archived `after.json` for review.
+Outside success with managed failure implicates host-specific credential/proxy
+handling; matching failures require repository/permission/policy investigation.
+Neither result alone proves whether a proxy strips versus replaces Authorization.
+
+## Recorded managed result
+
+The first standalone run reproduced API write success and upload **404**; full
+recovery was therefore **not run**. See the immutable unique JSON under
+`docs/evidence/standalone-probes/` and the qualification report. No outside-machine
+or Windows live run is claimed. Four stdlib unittest cases validate the mocked
+success/security/failure paths (`python -m unittest discover -s diagnostics/tests -v`).
+Production workflows stay inactive. First private staging deployment remains NO-GO
+until complete live recovery and the remaining private-HF checks are established.

diagnostics/qualify_github_release.py

@@ -0,0 +1,218 @@
+#!/usr/bin/env python3
+"""Standalone release probe: Python stdlib + age/age-keygen; no app imports.
+
+Only VM_BACKUP_GITHUB_TOKEN is read for authentication. Existing releases and
+checkpoints are never changed. Each run creates at most one new test release.
+"""
+import argparse
+from datetime import datetime, timezone
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import ssl
+import subprocess
+import tempfile
+from urllib.error import HTTPError, URLError
+from urllib.parse import urlencode, urlsplit
+from urllib.request import HTTPRedirectHandler, HTTPSHandler, Request, build_opener
+import uuid
+
+LIMIT = 1024 * 1024
+
+
+class Failure(Exception):
+    pass
+
+
+class NoRedirect(HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+class Probe:
+    def __init__(self, repo, token, report, save):
+        self.repo, self.token, self.report, self.save = repo, token, report, save
+        self.base = 'https://api.github.com/repos/' + repo
+        # Preserve the machine's approved proxy settings and CA trust.
+        context = ssl.create_default_context(cafile=os.environ.get('SSL_CERT_FILE') or None)
+        self.opener = build_opener(NoRedirect(), HTTPSHandler(context=context))
+
+    def request(self, method, url, data=None, authenticated=True, redirect=False):
+        parsed = urlsplit(url)
+        hosts = ('api.github.com', 'uploads.github.com') if authenticated else (
+            'release-assets.githubusercontent.com', 'objects.githubusercontent.com')
+        if (parsed.scheme != 'https' or parsed.hostname not in hosts
+                or parsed.username or parsed.password or parsed.port not in (None, 443)
+                or parsed.fragment):
+            raise Failure('destination_denied')
+        headers = {'Accept': 'application/vnd.github+json', 'User-Agent': 'vm-release-credential-probe',
+                   'X-GitHub-Api-Version': '2022-11-28'}
+        if authenticated:
+            headers['Authorization'] = 'Bearer ' + self.token
+        if isinstance(data, dict):
+            data = json.dumps(data).encode()
+            headers['Content-Type'] = 'application/json'
+        elif data is not None:
+            headers['Content-Type'] = 'application/octet-stream'
+        if '/releases/assets/' in parsed.path or not authenticated:
+            headers['Accept'] = 'application/octet-stream'
+        try:
+            response = self.opener.open(Request(url, data=data, headers=headers, method=method), timeout=30)
+        except HTTPError as error:
+            response = error  # Record response metadata only; never print its URL/body.
+        except (URLError, OSError):
+            raise Failure('network_or_tls_failure') from None
+        with response:
+            status = response.code
+            event = {'host': parsed.hostname, 'method': method, 'status': status,
+                     'request_id': response.headers.get('X-GitHub-Request-Id'),
+                     'authenticated': authenticated,
+                     'accepted_permissions': response.headers.get('X-Accepted-GitHub-Permissions')}
+            self.report['http_events'].append(event)
+            self.save()
+            if redirect and status in (301, 302, 303, 307, 308):
+                return status, b'', response.headers.get('Location', '')
+            if not 200 <= status < 300:
+                # No retries, including 401/403/404: preserve the first rejection.
+                raise Failure('authentication_rejected' if status == 401 else 'http_rejected_' + str(status))
+            body = response.read(LIMIT + 1)
+            if len(body) > LIMIT:
+                raise Failure('response_too_large')
+            return status, body, None
+
+    def json_request(self, method, url, data=None):
+        status, body, _ = self.request(method, url, data)
+        try:
+            return status, json.loads(body)
+        except (ValueError, UnicodeError):
+            raise Failure('invalid_json_response') from None
+
+    def run(self, ciphertext, run_id):
+        self.report.update(ciphertext_bytes=len(ciphertext),
+                           expected_sha256=hashlib.sha256(ciphertext).hexdigest())
+        self.save()
+        _, repo = self.json_request('GET', self.base)
+        if repo.get('private') is not True:
+            raise Failure('repository_not_private')
+        self.report['private_repository_verified'] = True
+        push = repo.get('permissions', {}).get('push')
+        self.report['repository_push_permission_reported'] = push
+        if push is False:
+            raise Failure('repository_write_permission_denied')
+        tag = 'vm-credential-test-' + run_id
+        status, release = self.json_request('POST', self.base + '/releases', {
+            'tag_name': tag, 'name': tag, 'prerelease': True, 'draft': False,
+            'body': 'Disposable synthetic encrypted credential probe. No application data.'})
+        if status != 201:
+            raise Failure('release_creation_not_confirmed')
+        release_id = release.get('id')
+        if not isinstance(release_id, int) or isinstance(release_id, bool) or release_id <= 0:
+            raise Failure('invalid_release_id')
+        self.report.update(release_id=release_id, release_tag=tag, contents_write_verified=True)
+        self.save()  # Successful release creation is an actual Contents-write operation.
+        upload = release.get('upload_url', '').split('{', 1)[0]
+        parsed = urlsplit(upload)
+        expected = '/repos/' + self.repo + '/releases/' + str(release_id) + '/assets'
+        if (parsed.scheme != 'https' or parsed.hostname != 'uploads.github.com'
+                or parsed.path != expected or parsed.query or parsed.fragment
+                or parsed.username or parsed.password or parsed.port not in (None, 443)):
+            raise Failure('upload_url_denied')
+        status, asset = self.json_request('POST', upload + '?' + urlencode({'name': 'synthetic.age'}), ciphertext)
+        if status != 201:
+            raise Failure('asset_creation_not_confirmed')
+        asset_id = asset.get('id')
+        if not isinstance(asset_id, int) or isinstance(asset_id, bool) or asset_id <= 0:
+            raise Failure('invalid_asset_id')
+        self.report['asset_id'] = asset_id
+        self.save()
+        status, downloaded, location = self.request('GET', self.base + '/releases/assets/' + str(asset_id), redirect=True)
+        if location is not None:
+            _, downloaded, _ = self.request('GET', location, authenticated=False)
+        expected_hash = hashlib.sha256(ciphertext).hexdigest()
+        actual_hash = hashlib.sha256(downloaded).hexdigest()
+        self.report.update(ciphertext_bytes=len(ciphertext), expected_sha256=expected_hash,
+                           downloaded_sha256=actual_hash)
+        if actual_hash != expected_hash or len(downloaded) != len(ciphertext):
+            raise Failure('asset_readback_mismatch')
+        self.report.update(asset_readback_verified=True, upload_decision='GO',
+                           staging_decision='NO-GO: complete recovery and private HF qualification still required',
+                           status='passed')
+
+
+def encrypt_fixture(age, keygen):
+    with tempfile.TemporaryDirectory(prefix='vm-release-probe-') as scratch:
+        root = Path(scratch)
+        identity, clear, encrypted = root / 'identity.agekey', root / 'synthetic.txt', root / 'synthetic.age'
+        def command(args):
+            try:
+                result = subprocess.run(args, capture_output=True, timeout=30)
+            except (OSError, subprocess.TimeoutExpired):
+                raise Failure('age_tool_failed') from None
+            if result.returncode:
+                raise Failure('age_tool_failed')
+            return result.stdout
+        command([keygen, '-o', str(identity)])
+        identity.chmod(0o600)
+        recipient = command([keygen, '-y', str(identity)]).decode().strip()
+        payload = b'Visual Mentor synthetic release credential qualification; no user data.\n'
+        clear.write_bytes(payload)
+        command([age, '-r', recipient, '-o', str(encrypted), str(clear)])
+        if command([age, '-d', '-i', str(identity), str(encrypted)]) != payload:
+            raise Failure('local_age_roundtrip_failed')
+        ciphertext = encrypted.read_bytes()
+        if not ciphertext.startswith(b'age-encryption.org/v1') or len(ciphertext) >= LIMIT:
+            raise Failure('invalid_encrypted_fixture')
+        return ciphertext  # The disposable test key is destroyed on exit.
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--repo', default='JsonLord/visual-mentor-backups')
+    parser.add_argument('--output', type=Path, help='New evidence file; existing files are refused')
+    parser.add_argument('--age', default='age', help='age executable path')
+    parser.add_argument('--age-keygen', default='age-keygen', help='age-keygen executable path')
+    args = parser.parse_args()
+    if not re.fullmatch(r'[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+', args.repo):
+        parser.error('invalid owner/repository')
+    run_id = datetime.now(timezone.utc).strftime('%Y%m%dT%H%M%SZ') + '-' + uuid.uuid4().hex
+    output = args.output or Path('github-release-qualification-' + run_id + '.json')
+    report = {'run_id': run_id, 'repository': args.repo, 'credential_source': 'VM_BACKUP_GITHUB_TOKEN',
+              'status': 'started', 'upload_decision': 'NO-GO', 'staging_decision': 'NO-GO',
+              'contents_write_verified': False, 'asset_readback_verified': False, 'http_events': [],
+              'recovery_run': False, 'production_or_workflows_changed': False}
+    # Exclusive creation protects all previous evidence. Only this run's new file is updated.
+    try:
+        with output.open('x', encoding='utf-8') as stream:
+            stream.write(json.dumps(report, indent=2) + '\n')
+        output.chmod(0o600)
+    except OSError:
+        print('NO-GO: evidence path unavailable or already exists; no requests made.')
+        return 2
+    def save():
+        output.write_text(json.dumps(report, indent=2) + '\n', encoding='utf-8')
+    try:
+        token = os.environ.get('VM_BACKUP_GITHUB_TOKEN')
+        if not token:
+            raise Failure('dedicated_credential_missing')
+        age, keygen = shutil.which(args.age), shutil.which(args.age_keygen)
+        if not age or not keygen:
+            raise Failure('install_age_and_age_keygen')
+        ciphertext = encrypt_fixture(age, keygen)
+        report['local_age_roundtrip_verified'] = True
+        Probe(args.repo, token, report, save).run(ciphertext, run_id)
+    except Failure as error:
+        report.update(status='failed', failure_code=str(error))
+    except Exception:
+        report.update(status='failed', failure_code='unexpected_local_failure')
+    save()
+    print(json.dumps({'status': report['status'], 'upload_decision': report['upload_decision'],
+                      'evidence': str(output), 'failure_code': report.get('failure_code'),
+                      'asset_id': report.get('asset_id')}))
+    return 0 if report['status'] == 'passed' else 2
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

diagnostics/tests/test_release_probe.py

@@ -0,0 +1,95 @@
+import hashlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import tempfile
+import unittest
+from urllib.error import HTTPError
+from unittest.mock import patch
+
+spec = importlib.util.spec_from_file_location('probe', Path(__file__).parents[1] / 'qualify_github_release.py')
+probe = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(probe)
+
+
+class Response(io.BytesIO):
+    def __init__(self, code, body=b'', headers=None):
+        super().__init__(body)
+        self.code, self.headers = code, headers or {'X-GitHub-Request-Id': 'TEST:SAFE'}
+
+
+class ProbeTests(unittest.TestCase):
+    def make(self):
+        report = {'http_events': []}
+        return probe.Probe('test/private', 'secret-never-log', report, lambda: None), report
+
+    def test_roundtrip_and_stripped_signed_download(self):
+        client, report = self.make()
+        ciphertext = b'age-encryption.org/v1\nsynthetic mock ciphertext'
+        requests = []
+        class Opener:
+            def open(self, req, timeout):
+                requests.append(req)
+                url, method = req.full_url, req.get_method()
+                if url == client.base:
+                    return Response(200, json.dumps({'private': True, 'permissions': {'push': True}}).encode())
+                if url.endswith('/releases'):
+                    return Response(201, json.dumps({'id': 9, 'upload_url': 'https://uploads.github.com/repos/test/private/releases/9/assets{?name,label}'}).encode())
+                if 'uploads.github.com' in url:
+                    self.uploaded = req.data
+                    return Response(201, b'{"id":19}')
+                if '/releases/assets/19' in url:
+                    return Response(302, headers={'Location': 'https://release-assets.githubusercontent.com/object?signature=not-recorded'})
+                assert req.get_header('Authorization') is None
+                return Response(200, self.uploaded)
+        client.opener = Opener()
+        client.run(ciphertext, 'unique')
+        self.assertTrue(report['contents_write_verified'])
+        self.assertTrue(report['asset_readback_verified'])
+        self.assertEqual(report['downloaded_sha256'], hashlib.sha256(ciphertext).hexdigest())
+        self.assertEqual(report['asset_id'], 19)
+        self.assertEqual(len(requests), 5)
+        self.assertNotIn('secret-never-log', json.dumps(report))
+        self.assertNotIn('signature', json.dumps(report))
+        self.assertEqual(sum(r.get_method() == 'POST' and r.full_url.endswith('/releases') for r in requests), 1)
+
+    def test_permanent_failure_stops_without_retry(self):
+        for status in (401, 403, 404, 422):
+            client, report = self.make()
+            calls = []
+            class Opener:
+                def open(self, req, timeout):
+                    calls.append(req)
+                    raise HTTPError(req.full_url, status, 'redacted', {'X-GitHub-Request-Id': 'REJECT'}, io.BytesIO(b'never-record-this-body'))
+            client.opener = Opener()
+            with self.assertRaises(probe.Failure):
+                client.request('POST', 'https://uploads.github.com/endpoint', b'encrypted')
+            self.assertEqual(len(calls), 1)
+            self.assertEqual(report['http_events'][0]['status'], status)
+            self.assertNotIn('never-record', json.dumps(report))
+
+    def test_untrusted_destination_rejected_before_request(self):
+        client, _ = self.make()
+        class Forbidden:
+            def open(self, *args, **kwargs):
+                raise AssertionError('must not send')
+        client.opener = Forbidden()
+        for url in ('http://api.github.com/private', 'https://evil.example/private', 'https://token@api.github.com/private'):
+            with self.assertRaises(probe.Failure):
+                client.request('GET', url)
+
+    def test_missing_dedicated_token_does_not_use_integration_token(self):
+        with tempfile.TemporaryDirectory() as root:
+            output = Path(root) / 'new.json'
+            with patch.dict(probe.os.environ, {'GH_TOKEN': 'never-use'}, clear=True), patch('sys.argv', ['probe', '--output', str(output)]), patch('builtins.print'):
+                self.assertEqual(probe.main(), 2)
+            self.assertEqual(json.loads(output.read_text())['failure_code'], 'dedicated_credential_missing')
+            original = output.read_bytes()
+            with patch('sys.argv', ['probe', '--output', str(output)]), patch('builtins.print'):
+                self.assertEqual(probe.main(), 2)
+            self.assertEqual(output.read_bytes(), original)
+
+
+if __name__ == '__main__':
+    unittest.main()

docs/backup-restore.md

@@ -0,0 +1,167 @@
+# GitHub-native encrypted backup and recovery
+
+The active filesystem is HF CPU Basic ephemeral disk. The private
+`JsonLord/visual-mentor-backups` repository is the sole persistent recovery store.
+No object store, rclone remote, HF paid disk, or independent media copy is required.
+This implementation is prepared for review; production scheduling and HF deployment
+remain disabled. See `github-backup-migration.md` for actual test evidence and gates.
+
+## Recovery protocol (format 2)
+
+The Space pauses ingestion/upload and configuration writes using one asyncio lock,
+then copies its complete recognized data tree and config history into a private
+snapshot directory. SQLite uses the online backup API, integrity check and VACUUM.
+The copied index includes CURRENT and all versioned revisions, manifests, vectors
+and segments. Coverage validates published videos and referenced index media.
+All original videos, proxies, thumbnails, segment frames, transcript files, index
+revisions, experiments/evaluation files, saved answer history, queue DB and configuration history travel
+with the checkpoint. Unknown data/config files, symlinks, unfinished temporary
+files, missing required media, incompatible index layout and capacity violations
+fail the checkpoint. No success is reported for an omitted required file.
+
+Uploads happen after releasing the write lock. Files are split into 16 MiB chunks,
+addressed by plaintext SHA-256 **inside the encrypted manifest**. Identical chunks
+in the same checkpoint and its immediate predecessor reuse existing assets. A
+chunk absent from that predecessor may upload again even if an older checkpoint
+contains it; this is incremental deduplication, not global garbage collection.
+New chunks are age-encrypted before upload. GitHub release asset names are hashes
+of ciphertext. Decryptor/recipient compatibility is checked before publication.
+Existing objects and new uploads are read back and hash-verified. A manifest
+contains file paths, hashes, chunk references, index revision/model space and
+coverage. It is itself encrypted and uploaded as a private release asset.
+
+Only after every referenced object verifies does a unique GitHub Contents commit
+publish `checkpoints/<namespace>/<year>/<timestamp>-<uuid>.json`. That small record
+contains format, creation time, encrypted manifest asset ID/size/hash; it contains
+no media, transcript, config, plaintext hashes or key. GitHub also observes repo,
+release names, object sizes, timing and access. These operational metadata cannot
+be hidden from the storage provider. No plaintext user payload is transmitted.
+The repository record is the atomic commit point. Partial releases are uncommitted
+orphans, not restore points. Existing records/assets are never overwritten or
+pruned. Transient calls retry at most three times; immutable names reconcile
+uncertain responses. Snapshot attempts also retry three times, with 90-second
+lock acquisition bounds. Concurrent triggers coalesce in the one-worker queue.
+Only one application process/replica is supported. Do not run external writers or
+CLI ingestion alongside the serving process; use offline CLI after stopping it.
+
+## Space settings (after deployment approval)
+
+HF Variables:
+
+```
+VM_BACKUP_ENABLED=true
+VM_BACKUP_REPOSITORY=JsonLord/visual-mentor-backups
+VM_BACKUP_NAMESPACE=production
+VM_RECOVERY_ROOT=/app/work
+VRAG_DATA=/app/work/data
+VM_STATE_DIR=/app/work/state
+VM_BACKUP_RECIPIENT=age1<public-recipient>
+```
+
+HF **Secrets**, entered securely in settings:
+
+- `VM_BACKUP_GITHUB_TOKEN`: fine-grained identity limited to the private backup
+  repository, Contents read/write and release asset access. Test both
+  `api.github.com` and `uploads.github.com`. It requires neither repository
+  administration nor Actions permission. Private downloads may redirect to signed
+  GitHub release URLs; the client never forwards its bearer token to that host.
+- `VM_BACKUP_IDENTITY`: age private identity text matching the public recipient.
+  It is materialized with mode 0600 into a temporary file outside the working tree
+  before startup; the raw variable is removed from inherited child environment.
+  Alternatively provide a securely provisioned `VM_BACKUP_IDENTITY_FILE` outside
+  `/app/work`. Protect an independent operator copy of this key: GitHub data alone
+  cannot recover without it. This key is intentionally never backed up to GitHub.
+- `VM_BACKUP_TRIGGER_TOKEN`: independent random >=32-character token. It authorizes
+  backup enqueue/status only, through `X-VM-Backup-Token`. It grants no config,
+  inference, media or isolated-recovery-test privileges. `VM_ADMIN_TOKEN` retains
+  admin access and is never given to the coordinator.
+
+Keep provider credentials and app role tokens as before. They are excluded from
+checkpoints and must be re-provisioned for a recreated Space. Configuration retains
+only secret/endpoint environment-variable references; the environment values are
+not recovered. If using a custom index path, it must equal the covered data/index.
+
+The supervisor runs recovery **before** importing ConfigStore, index or workers.
+On an empty working root it selects the newest committed record, fetches and
+decrypts only GitHub-hosted objects, checks every byte/hash, SQLite, config and
+index coverage, and renames a sibling staging directory into place atomically.
+Failure aborts startup. It never merges into or overwrites nonempty state and never
+silently falls back from a corrupt latest checkpoint. To choose an earlier point,
+use `python scripts/restore_state.py --destination /new/isolated-root --checkpoint
+<checkpoint>` with the same protected environment, then review before promotion.
+
+On a brand-new namespace with no checkpoint, startup refuses by default. A reviewed
+first initialization may temporarily set `VM_BACKUP_ALLOW_EMPTY=true`; remove it
+immediately after the first verified checkpoint. A namespace with prior data must
+never use this escape hatch to conceal a recovery failure.
+
+## Triggers, administration and coordinator
+
+Backup requests occur on startup, accepted media upload, completed ingestion,
+applied/rolled-back configuration, authenticated manual trigger and the resident
+12-hour timer. The timer continues only while the Space process is running. It
+cannot wake a sleeping Space and is **not** an independently durable scheduler.
+The queue reports failure codes, attempt time, pending encrypted uploads, latest
+successful checkpoint, inventory bytes including historical/orphan assets, restore
+points, and last isolated recovery result. `/backups` is the administration panel;
+server routes require administrator or the deliberately limited coordinator token.
+The panel does not claim enqueue acceptance is backup success.
+
+`deploy/backup-repository/inactive-workflows/backup-12h.yml` runs at 00:17 and 12:17
+UTC (02:17/14:17 Berlin summer time; 01:17/13:17 Berlin winter time). It is outside
+`.github/workflows` and cannot run. It also requires both `BACKUPS_APPROVED` and
+`COORDINATOR_VALIDATED` to equal `true`, plus the protected `private-backup`
+environment. No workflow is activated by source upload.
+
+The coordinator verifies Space privacy using the HF API, sends the scoped HF
+bearer token through the private Space access boundary, and sends the independent
+app trigger token in a separate header. It refuses redirects and unexpected URL
+origins. It probes up to ten nominal minutes for a sleeping instance, then triggers
+and waits for a **new completed checkpoint**, not just HTTP acceptance. Network
+calls have timeouts and attempts are bounded; Actions has a 35-minute outer timeout.
+A failed private route/wake/authentication test is a deployment blocker. Do not
+replace it with a public Space, arbitrary proxy, app admin token or unauthenticated
+export. The resident timer is a tested local fallback while awake only; it is not
+claimed as a validated sleeping-Space alternative.
+
+## Limits, retention and recovery point objective
+
+Current application upload limit is 64 MiB/video, 30 minutes, 10k indexed segments.
+Backup plaintext capacity is 20 GiB / 100k files. Capture needs free scratch space
+at least the source size plus 64 MiB; source+snapshot and restore staging compete
+with HF's 50 GB ephemeral allowance. Actual usable capacity is lower after image,
+processing scratch and previous index revisions. Budget below 20 GiB, monitor
+usage and fail explicitly at capacity. Objects are 16 MiB plus age overhead,
+well below GitHub's 2 GiB per-asset limit. Uploads shard at 800 assets per release
+to stay below the 1000-assets/release limit. GitHub release policy, API quotas,
+Acceptable Use and private-account storage entitlements still need operator review;
+release assets must not be assumed an unlimited general-purpose storage service.
+Checkpoint metadata is sharded by namespace/year and refuses a 1000-entry listing;
+rotate to a reviewed namespace before reaching that limit (12h plus event triggers
+can reach it sooner than a year). No destructive retention is automated.
+
+Unchanged chunks cost no new payload assets, but dedup readback downloads referenced
+ciphertext to ensure it still exists. Checkpoints add an encrypted manifest and a
+small repository commit. A 64 MiB original plus 20 MiB proxy, 1 MiB images/transcript
+and a 3 MiB index starts around 88 MiB; compressed media does not shrink under age.
+At 100 similarly sized videos, media is roughly 8.5 GiB plus accumulated indexes.
+A 10k x 768 float32 text matrix is 30.72 MB (29.30 MiB) per revision. Five views are
+153.6 MB (146.48 MiB) per revision. Twenty retained single-view revisions add about
+586 MiB, excluding JSON. Metadata-only edits upload only changed chunks and a new
+manifest; changed full matrix files can upload most chunks again.
+
+Ephemeral disk losses can destroy uncheckpointed uploads. Event triggers reduce
+but do not eliminate that window; backups are asynchronous and a sleeping Space
+cannot expose lost disk to Actions. GitHub downtime, token expiry, key loss, disk
+capacity and quotas can prevent recovery. Require a successful staging drill and
+real sleep/wake run before asserting a 12-hour recovery objective.
+
+## Migration and activation
+
+Retain format-1 archives unchanged. They used external asset coverage and are not
+self-contained format-2 checkpoints. Import their verified full restored data into
+an isolated format-2 root while writers are stopped, then create and independently
+recover a GitHub-native checkpoint before retiring external copies. Never delete
+old assets as part of this refactor. Old helper functions remain only for format-1
+compatibility tests; the exporter and active external-source templates are retired.
+Production activation checklist is in `github-backup-migration.md`.

docs/credential-qualification.md

@@ -0,0 +1,106 @@
+# Dedicated credential qualification: NO-GO (18 October 2026)
+
+The dedicated secure binding is now present and reports ready. Every qualification
+request in this run used **VM_BACKUP_GITHUB_TOKEN**. The integration-managed GH_TOKEN
+was not substituted. No backup architecture or application code was changed.
+
+## Actual live results
+
+| Check | Result |
+| --- | --- |
+| Private backup repository read, api.github.com | 200; private=true, read/write reported |
+| New disposable release creation, api.github.com | 201 |
+| First small age-encrypted asset POST, uploads.github.com | **404**, one attempt |
+| Uploaded assets / committed checkpoints | **0 / 0**, verified by read-only queries |
+| Destructive recovery and incremental checkpoint | Blocked by upload failure |
+| Trusted-machine comparison | Unavailable: no independent trusted machine attached |
+| Secure HF credential | Absent; private staging remains unqualified |
+
+Upload request ID: `FE93:319F8B:36F88A:4FB435:6AD3F6B8`.
+Disposable namespace: `test-recovery-20261017-745d0278` (the harness uses UTC host
+clock naming; this qualification report uses the client Berlin date).
+The new release is uncommitted and empty; no pre-existing release or checkpoint
+was altered or deleted. No recurring workflow or production setting changed.
+
+The client used GitHub's returned upload_url, validated its destination and
+attached the dedicated authorization header. A GitHub response/request ID proves
+an HTTPS service response, not which credential the proxy ultimately forwarded.
+The earlier missing-binding problem is resolved. The former integration-token 401
+is not reused as evidence about this token. The new 404 may conceal a private
+resource/permission rejection or reflect credential propagation differences
+between hosts. **Scope versus injection/proxy attribution remains undetermined.**
+API release creation proves a successful write through that route; it does not
+prove that the same upstream identity was used on the upload route.
+
+Evidence:
+
+- [Dedicated API probe](evidence/dedicated-token-api.json)
+- [Current live upload/recovery attempt](evidence/github-recovery-live.json)
+- [Qualification decision](evidence/credential-qualification.json)
+- [Prior blocked attempt retained](evidence/github-recovery-prior-blocked.json)
+
+## Exact next step: trusted-machine comparison
+
+Use an independently trusted machine outside this managed proxy, provision the
+**same permitted dedicated credential** there from its secure store, and check out
+application branch feature/video-rag-mentor-v2. Do not export a proxy placeholder,
+copy integration-managed credentials, paste credentials into chat, disable TLS,
+or bypass this managed environment's network controls.
+
+With Python 3.12+, uv, FFmpeg and age/age-keygen available, run from the checkout:
+
+```sh
+if [ -z "${VM_BACKUP_GITHUB_TOKEN:-}" ]; then
+  echo 'Dedicated backup credential required' >&2
+  exit 2
+fi
+uv run --frozen --group dev python tests/live_github_recovery.py
+```
+
+The guard prevents the harness's legacy GH_TOKEN fallback. The drill creates a new
+disposable namespace and never deletes existing remote releases. Successful upload
+continues to readback, committed checkpoints, unchanged incremental dedup and full
+recovery after destroying local source/staging state, with fresh-process Library,
+Search, config/index and media checks. Compare sanitized evidence JSON only.
+
+- Outside succeeds while managed fails: managed credential propagation or proxy
+  behavior is implicated; header stripping versus rewriting still needs trusted
+  proxy observability. Do not weaken or work around its security controls.
+- Outside also fails: review the credential's resource owner, selected private
+  repository JsonLord/visual-mentor-backups, Contents read/write, Metadata read,
+  expiry and any applicable organization authorization. Matching failures alone
+  do not conclusively distinguish every GitHub policy/resource issue.
+
+Private staging package remains prepared at deploy/hf-staging/README.md. Secure HF
+credentials are still absent, and the existing public Space remains unchanged.
+**NO-GO for first private staging deployment** until a dedicated-token asset upload
+and complete GitHub-only recovery succeed and private staging access is qualified.
+
+
+## Standalone trusted-machine diagnostic prepared (18 October 2026)
+
+The independent standard-library probe is [qualify_github_release.py](../diagnostics/qualify_github_release.py).
+It needs only Python and age/age-keygen; it imports no application code, reads only
+VM_BACKUP_GITHUB_TOKEN, creates one unique test release, uses the returned validated
+upload_url, and verifies encrypted asset SHA-256 by readback. Permanent HTTP errors
+stop immediately without retries. Its new evidence filename is unique and existing
+files are refused. All prior evidence above has been preserved.
+
+[Exact Linux and Windows instructions](../diagnostics/README.md) include a gated
+full-recovery invocation after upload GO and archival of the existing recovery
+report before the unchanged harness runs. Windows execution and an independent
+trusted machine are not available in this managed Linux session.
+
+Four standalone stdlib unit tests passed: mocked successful readback/hash, removal
+of authorization on signed redirects, no fallback to GH_TOKEN, evidence-overwrite
+refusal, destination validation and permanent-rejection stopping. The managed live
+probe again created a new synthetic test release successfully, but its first asset
+upload returned 404. No asset ID/readback or complete recovery success is claimed.
+The full destructive test was not run because its upload prerequisite did not pass.
+
+New evidence: [standalone probe JSON](evidence/standalone-probes/github-release-qualification-20261017T223752Z-a13651aa74504b7ca9a9a2f1f83e0100.json).
+**Managed upload: NO-GO; full GitHub recovery: not run; first private staging: NO-GO.**
+No backup code was refactored, deployment performed, workflow activated, or existing
+release/checkpoint modified or deleted. The next action is to run this standalone
+script on the trusted laptop/Debian server with the same securely provisioned token
+and return its sanitized JSON, never the token or a proxy placeholder.

docs/deployment-hf.md

@@ -0,0 +1,118 @@
+# Visual Mentor v2: private Hugging Face staging and rollback
+
+**Prepared only. No Space has been created, uploaded or modified.** Current
+production target `Leon4gr45/openweb` is protected by explicit approval and a staging
+UI review. No DGX/Needle/inference infrastructure change is required.
+
+## Local package and evidence
+
+Docker runs Node/Next.js and one FastAPI worker, supervised by `scripts/cloud-start.py`.
+Only port **7860** is exposed. FastAPI binds loopback 8000. One authoritative
+`web/next.config.ts` preserves `/api` and `/media`, with Range seeking and bounded
+65MB proxy buffering for the application's 64MiB upload cap. Node/Python bases are
+pinned. No torch, transformers, Whisper weights, CUDA runtime or GPU device is
+required. FFmpeg/age are CPU media/encryption tools, not inference models.
+
+Build in this managed environment (session CA is mounted only during install):
+
+```
+BUILDX_CONFIG=/tmp/v2-buildx docker --host=unix:///var/run/docker.sock build \
+  --secret id=build_ca,src=/etc/ssl/certs/ca-certificates.crt \
+  -t video-rag-mentor:v2-review .
+python scripts/qualify-release.py --image video-rag-mentor:v2-review
+VM_RUNTIME_IMAGE=video-rag-mentor:v2-review python scripts/measure-runtime.py
+```
+
+These checks publish no host ports, run with network=none and a 2-vCPU/16GiB limit,
+and remove their own containers/volumes. Qualification checks application bearer
+roles, origin rejection, configuration CAS/rollback and volume recreation. A Docker
+volume in a test is not evidence that HF supplies durable storage.
+
+## Configuration before staging
+
+Use HF Settings / Secrets (do not put values in YAML or browser bundles):
+
+- `VM_USER_TOKEN`, `VM_ADMIN_TOKEN`: separate random tokens, >=24 characters.
+  The user token opens private library/capture operations; admin token opens config
+  and backup status only. This is a shared-role app, not per-person accounts/SSO.
+- `VM_ALLOWED_ORIGINS=https://<staging-app-host>`: exact external origin.
+- `VM_ALLOWED_HOSTS`: exact approved inference hostnames only.
+- `VRAG_DATA=/app/work/data`, `VM_STATE_DIR=/app/work/state`; default index under
+  `/app/work/data/index`. Configure GitHub-native backup and protected age identity
+  as documented in backup-restore.md; the working disk remains ephemeral.
+- `LAYA_BASE_URL` is the router root; OpenAI-compatible VLM/embedding/Whisper
+  base URLs generally include `/v1`. Credential environment references are the
+  exact `api_key_secret` fields in the reviewed profile. Do not assume all endpoints
+  share a protocol or that NVIDIA's public API implements this `/detect` gateway.
+- Backup settings, protected trigger and empty-state startup recovery: see
+  [backup-restore.md](backup-restore.md). No plaintext export is exposed.
+- Decide whether answer-history persistence (`VRAG_SAVE_ANSWERS`) is permitted.
+  Persisted answer history is included in encrypted GitHub checkpoints; review its
+  privacy scope and opt out of local history if required.
+
+All profile examples are disabled until model IDs, endpoints, capabilities,
+privacy trust and credentials are explicitly verified. Active placeholder IDs are
+rejected. Load/import YAML, review form/diff, validate, then apply using the current
+revision. Credentials remain server-only references. Transcripts/keyframes uploaded
+through Import may be sent to the selected authorized providers.
+
+## Mandatory approval and external gates
+
+1. Approve a **private staging** Space (proposed `Leon4gr45/openweb-v2-staging`),
+   GitHub backup storage budget and recovery integration. Obtain a fine-grained HF
+   identity limited to intended repos. The current environment has no configured HF
+   identity; openweb source, visibility, settings and screenshots were not inspected.
+2. Before touching production, snapshot the existing Space Git revision, settings
+   inventory (secret names only), private access policy and all data. Verify restore.
+3. Qualify GitHub-native encrypted release assets and repository checkpoints as the
+   sole recovery store. HF CPU Basic has 50GB ephemeral disk; no persistent mount
+   or external object store is required. Complete the live GitHub destructive
+   recovery drill and private Actions sleep/wake test in backup-restore.md.
+4. Review `docs/v2-evidence/main/` against current Playwright screenshots. Confirm
+   original workflows remain recognizable at desktop/laptop/tablet/mobile sizes.
+5. With explicit staging approval, create a private Docker Space and upload the
+   reviewed source, using the official SDK and environment-provisioned HF_TOKEN:
+
+```python
+import os
+from huggingface_hub import HfApi
+api = HfApi(token=os.environ['HF_TOKEN'])
+repo = 'Leon4gr45/openweb-v2-staging'  # approved staging name
+api.create_repo(repo_id=repo, repo_type='space', space_sdk='docker', private=True)
+api.upload_folder(
+    repo_id=repo, repo_type='space', folder_path='.',
+    allow_patterns=['README.md', 'Dockerfile', 'requirements-runtime.txt',
+                    'vrag/**', 'config/**', 'scripts/cloud-start.py', 'web/**'],
+    ignore_patterns=['**/.env*', '**/*.pem', '**/*.key', '**/*.agekey', '**/*.age',
+                     '**/__pycache__/**', '**/node_modules/**', '**/.next/**',
+                     'web/tests/**', 'web/test-results/**', 'web/playwright-report/**'],
+    commit_message='Stage reviewed Video RAG Visual Mentor v2',
+)
+```
+
+6. Configure secrets/variables in staging, select CPU Basic (2 vCPU/16GB), inspect
+   logs and health. Verify actual Space privacy by anonymous page/API/media requests;
+   verify logged-in access with app user/admin roles and no access cross-over.
+   Exercise `/`, `/search`, `/ask`, `/experiments`, `/architecture`, detail/clip Range
+   seeking, `/live` and `/models`. Public sample assets are synthetic but still sit
+   behind the private HF page/access boundary.
+7. From a physical laptop browser over HTTPS, test laptop + USB simultaneous
+   selection, permission denial/contention, disconnect, hidden-tab cleanup and
+   stale results. Verify each real provider and costs using approved media only.
+   Run real upload→Whisper→segments→embeddings→Search/Ask and verify citations/playback.
+8. Recreate staging and restore all media/index/configuration from GitHub alone
+   with the protected age key. Confirm a real recent checkpoint survives Space
+   recreation. Mock transport tests alone do not pass this gate.
+9. Present actual staging screenshots, provider test table, storage/backup/restore
+   history and performance; obtain explicit approval before changing openweb.
+
+## Controlled production switch / rollback
+
+Save the existing production Space commit and tested GitHub checkpoint IDs before
+upload. Obtain UI and deployment approval. Deploy the reviewed v2 source using the
+same procedure targeted at openweb; do not merge the deployment PR wholesale.
+Keep previous image/source and compatible snapshot available. On failure, pause
+writes, restore the previous Space revision and point at an isolated verified
+compatible state snapshot. Do not overwrite current data by automated restore or
+run the legacy `serve/` scripts. Recheck private access, API/media and clips after
+rollback. Production promotion and rollback execution are operator actions.

docs/evidence/backend-tests.txt

@@ -0,0 +1,9 @@
+........................................................................ [ 66%]
+.....................................                                    [100%]
+=============================== warnings summary ===============================
+../visual-mentor-venv/lib/python3.12/site-packages/fastapi/testclient.py:1
+  /workspace/visual-mentor-venv/lib/python3.12/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+109 passed, 1 warning in 9.64s

docs/evidence/browser-administration.txt

@@ -0,0 +1,14 @@
+
+Running 2 tests using 1 worker
+
+(node:65537) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+  ✓  1 tests/backups.spec.ts:3:5 › backup administration distinguishes acceptance from verified completion (2.0s)
+  ✓  2 tests/backups.spec.ts:21:5 › backup administration handles denied access (2.8s)
+
+  2 passed (8.6s)
+npm notice
+npm notice New major version of npm available! 11.9.0 -> 12.2.0
+npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.2.0
+npm notice To update run: npm install -g npm@12.2.0
+npm notice

docs/evidence/browser-regression.txt

@@ -0,0 +1,29 @@
+
+Running 17 tests using 1 worker
+
+(node:63329) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+  ✓   1 tests/live.spec.ts:2:5 › dual simulated previews require explicit transfer and stop on navigation (4.5s)
+  ✓   2 tests/live.spec.ts:63:5 › models studio validates and atomically switches a profile (1.4s)
+  ✓   3 tests/parity.spec.ts:10:7 › original UI desktop (8.3s)
+  ✓   4 tests/parity.spec.ts:10:7 › original UI laptop (6.7s)
+  ✓   5 tests/parity.spec.ts:10:7 › original UI tablet (9.9s)
+  ✓   6 tests/parity.spec.ts:10:7 › original UI mobile (9.5s)
+  ✓   7 tests/parity.spec.ts:48:5 › clip and citation interactions (1.8s)
+  ✓   8 tests/release.spec.ts:11:5 › permission denial shows an error without uploading (878ms)
+  ✓   9 tests/release.spec.ts:19:7 › rejects frame mismatch and permits a later matching observation (1.2s)
+  ✓  10 tests/release.spec.ts:19:7 › rejects config mismatch and permits a later matching observation (1.2s)
+  ✓  11 tests/release.spec.ts:19:7 › rejects dimensions mismatch and permits a later matching observation (1.2s)
+  ✓  12 tests/release.spec.ts:19:7 › rejects box mismatch and permits a later matching observation (1.2s)
+  ✓  13 tests/release.spec.ts:46:5 › stopping a camera discards its delayed result (1.2s)
+  ✓  14 tests/release.spec.ts:59:5 › a pending camera permission grant after navigation stops the returned tracks (3.1s)
+  ✓  15 tests/release.spec.ts:72:5 › device contention is reported and track end stops the preview (1.0s)
+  ✓  16 tests/release.spec.ts:84:5 › hiding the page stops microphone capture without uploading audio (1.1s)
+  ✓  17 tests/release.spec.ts:98:5 › recorder errors release microphone tracks and discard audio (1.0s)
+
+  17 passed (1.0m)
+npm notice
+npm notice New major version of npm available! 11.9.0 -> 12.2.0
+npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.2.0
+npm notice To update run: npm install -g npm@12.2.0
+npm notice

docs/evidence/credential-qualification.json

@@ -0,0 +1,47 @@
+{
+  "observed_at": "2026-10-17T22:10:28.212207+02:00",
+  "application_commit": "c229b819f5f68236781876ad3d7865cd501df16e",
+  "backup_repository_commit": "17fbad6c0bd00d36258f2376d2e8b9547e3727d2",
+  "credential_source_required": "VM_BACKUP_GITHUB_TOKEN",
+  "dedicated_variable_present": true,
+  "saved_credential_binding_present": true,
+  "declared_credential_destinations": [
+    "api.github.com",
+    "uploads.github.com"
+  ],
+  "integration_credential_substituted": false,
+  "api_permission_test": "private repository GET 200; disposable release POST 201",
+  "encrypted_release_asset_test": "uploads.github.com POST 404; one attempt",
+  "trusted_machine_comparison": "not_run_no_attached_trusted_machine",
+  "destructive_live_recovery": "not_run_upload_rejected_before_commit",
+  "attribution": {
+    "established_blocker": "encrypted release asset upload rejected with HTTP 404",
+    "credential_scope": "undetermined across upload destination",
+    "credential_injection": "undetermined",
+    "network_proxy_behavior": "HTTPS response received with GitHub request ID; credential forwarding not observable"
+  },
+  "hf_credential_present": false,
+  "private_staging_preparation": "existing_deploy/hf-staging_package_available; authenticated_qualification_blocked",
+  "staging_deployment_decision": "NO-GO",
+  "recurring_workflows_activated": false,
+  "production_changed": false,
+  "releases_created_modified_or_deleted": false,
+  "architecture_changed": false,
+  "latest_recheck": {
+    "client_date": "2026-10-18",
+    "timezone": "Europe/Berlin",
+    "dedicated_variable_present": true,
+    "saved_credential_binding_present": true,
+    "integration_credential_substituted": false,
+    "api_status": 200,
+    "release_creation_status": 201,
+    "asset_upload_status": 404,
+    "upload_attempts": 1,
+    "uploaded_assets": 0,
+    "committed_checkpoints": 0,
+    "request_id": "FE93:319F8B:36F88A:4FB435:6AD3F6B8"
+  },
+  "checked_on": "2026-10-18",
+  "credential_readiness": "ready",
+  "current_live_evidence": "github-recovery-live.json"
+}

docs/evidence/dedicated-token-api.json

@@ -0,0 +1,28 @@
+{
+  "credential_source": "VM_BACKUP_GITHUB_TOKEN",
+  "http": {
+    "method": "GET",
+    "host": "api.github.com",
+    "status": 200,
+    "headers": {
+      "x-github-request-id": "80E9:137167:4D2D1:F8EC7:6AD3F69C",
+      "x-github-api-version-selected": "2022-11-28",
+      "x-ratelimit-limit": "15000",
+      "x-ratelimit-remaining": "14976",
+      "x-ratelimit-resource": "core",
+      "x-accepted-github-permissions": "metadata=read",
+      "x-oauth-scopes": "",
+      "content-type": "application/json; charset=utf-8",
+      "server": "envoy"
+    },
+    "client_authorization_attached": true
+  },
+  "private": true,
+  "permissions": {
+    "admin": true,
+    "maintain": true,
+    "push": true,
+    "triage": true,
+    "pull": true
+  }
+}

docs/evidence/github-auth-probe.json

@@ -0,0 +1,79 @@
+{
+  "observations": [
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "path": "/user",
+      "credential_source": "GH_TOKEN",
+      "client_authorization_attached": true,
+      "status": 200,
+      "headers": {
+        "x-github-request-id": "9690:32E8B7:DBB396:2C7BB5A:6AD3D3BD",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14923",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "allows_permissionless_access=true",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      }
+    },
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "path": "/repos/JsonLord/visual-mentor-backups",
+      "credential_source": "GH_TOKEN",
+      "client_authorization_attached": true,
+      "status": 200,
+      "headers": {
+        "x-github-request-id": "3DF2:319386:45059D:E020B0:6AD3D3BE",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14922",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "metadata=read",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      }
+    },
+    {
+      "method": "GET",
+      "host": "uploads.github.com",
+      "path": "/",
+      "credential_source": "GH_TOKEN",
+      "client_authorization_attached": true,
+      "status": 302,
+      "headers": {
+        "x-github-request-id": "2E62:2F9DB5:A7FA8:C8D62:6AD3D3BE",
+        "server": "envoy"
+      }
+    },
+    {
+      "method": "GET",
+      "host": "huggingface.co",
+      "path": "/api/spaces/Leon4gr45/openweb",
+      "credential_source": "anonymous",
+      "client_authorization_attached": false,
+      "status": 200,
+      "headers": {
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy",
+        "via": "1.1 eb382ff675fc4a4551773e2e1657c302.cloudfront.net (CloudFront)"
+      }
+    },
+    {
+      "method": "GET",
+      "host": "leon4gr45-openweb.hf.space",
+      "path": "/api/admin/backup-status",
+      "credential_source": "anonymous",
+      "client_authorization_attached": false,
+      "status": 404,
+      "headers": {
+        "content-type": "application/json",
+        "server": "envoy"
+      },
+      "error_code": "remote_error"
+    }
+  ],
+  "proxy_interior_authorization": "not observable; no credential extraction or interception performed"
+}

docs/evidence/github-backup-results.json

@@ -0,0 +1,55 @@
+{
+  "date": "2026-10-17",
+  "backend": {
+    "passed": 109,
+    "encryption": "real age CLI",
+    "sqlite": "real online snapshots",
+    "media": "real FFmpeg-generated video",
+    "github_transport": "mocked for successful recovery tests"
+  },
+  "browser": {
+    "existing_parity_camera_routing_passed": 17,
+    "backup_administration_passed": 2,
+    "providers_and_hardware": "mocked or simulated"
+  },
+  "frontend": {
+    "production_build": "passed",
+    "lint_errors": 0,
+    "existing_lint_warnings": 1
+  },
+  "live_github": {
+    "private_repository_verified": true,
+    "release_creation": "passed",
+    "release_tag": "vm-test-recovery-20261017-deae94ff-20261017T173832-f8cd66db742745159168b741ea1a751e",
+    "asset_upload": "blocked: HTTP 401 Bad credentials from uploads.github.com",
+    "committed_recovery_checkpoints": 0,
+    "complete_github_only_recovery": "NOT VERIFIED",
+    "existing_backups_overwritten": false
+  },
+  "private_space": {
+    "identity": "Leon4gr45/openweb",
+    "origin": "https://leon4gr45-openweb.hf.space",
+    "probe": "blocked by network proxy policy",
+    "hf_test_credential_present": false,
+    "actions_private_reachability": "NOT VERIFIED",
+    "sleep_wake": "NOT VERIFIED",
+    "production_scheduling_activated": false,
+    "deployment_modified": false
+  },
+  "alternative": {
+    "resident_timer": "mock-clock branch and bounded retry/health tests passed",
+    "sleeping_space_wake": "not provided or claimed"
+  },
+  "live_qualification_followup": {
+    "backend_passed": 116,
+    "backup_tests_passed": 20,
+    "upload_url": "GitHub-returned template; validated exact destination",
+    "upload_authentication": "401 once; no retry",
+    "upload_clients": "HTTPX Bearer, HTTPX token, native gh all 401 using GH_TOKEN",
+    "proxy_header_forwarding": "not observable; cannot establish strip versus rewrite",
+    "github_recovery": "blocked; zero assets and no committed checkpoint",
+    "production_space_private": false,
+    "private_staging": "prepared, not deployed; missing HF credential",
+    "production_scheduling_activated": false
+  }
+}

docs/evidence/github-recovery-live.json

@@ -0,0 +1,132 @@
+{
+  "live": true,
+  "status": "blocked",
+  "namespace": "test-recovery-20261017-745d0278",
+  "repository": "JsonLord/visual-mentor-backups",
+  "credential_source": "VM_BACKUP_GITHUB_TOKEN",
+  "http_events": [
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "status": 200,
+      "headers": {
+        "x-github-request-id": "B7AE:25708C:84BF5C:1B16D75:6AD3F6B6",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14958",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "metadata=read",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "status": 404,
+      "headers": {
+        "x-github-request-id": "41CF:1D584D:F1627F:3129345:6AD3F6B6",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14957",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "contents=read",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "status": 404,
+      "headers": {
+        "x-github-request-id": "8F54:18C49:4101B:D3AE7:6AD3F6B6",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14956",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "contents=read",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "POST",
+      "host": "api.github.com",
+      "status": 201,
+      "headers": {
+        "x-github-request-id": "5146:2519A0:67DC3:153C3C:6AD3F6B7",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14989",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "contents=write; contents=write,workflows=write",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "status": 200,
+      "headers": {
+        "x-github-request-id": "41CF:1D584D:F16D27:312B69F:6AD3F6B6",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14988",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "contents=read",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "POST",
+      "host": "uploads.github.com",
+      "status": 404,
+      "headers": {
+        "x-github-request-id": "FE93:319F8B:36F88A:4FB435:6AD3F6B8",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    }
+  ],
+  "fixture_file_hashes": {
+    "state/config-history.json": "fc54a50cefc2d5955a43999a8f287dea13f432a53b379e3620986984a4862d29",
+    "data/jobs.sqlite": "61ea188727defa04c534eb336ee7781ea36583ff97205361f8b182bee574469c",
+    "data/index/CURRENT": "3ba3f5f43b92602683c19aee62a20342b084dd5971ddd33808d81a328879a547",
+    "data/answers/history.jsonl": "24286a82bed379831e51587c4928b22fac236936ae7bdbfaf4af4b65d33cc96c",
+    "data/videos/v1/video.mp4": "bc616d8ada2b297f447e74ba212cc84f05a03345070d4145a62c0bfe3b5cb848",
+    "data/videos/v1/transcript.json": "4a8fb2f5a7707c7e0ae59b3f649c684e186511e32308bed8c608562014894d22",
+    "data/videos/v1/thumb.jpg": "8a2404e720bb32c6430c4772e8d2a866a87662b1969395927c1aeef2b79b7566",
+    "data/videos/v1/segments.json": "016ce6672b25eacc268d418b6d0a161a7fa2a7396cfd3543e53d1938a40a4809",
+    "data/videos/v1/original": "bc616d8ada2b297f447e74ba212cc84f05a03345070d4145a62c0bfe3b5cb848",
+    "data/videos/v1/meta.json": "ec593249ce82f4928a210ae42105d0678c7993847ab52468a37e28263bae6d16",
+    "data/videos/v1/segments/000.jpg": "8a2404e720bb32c6430c4772e8d2a866a87662b1969395927c1aeef2b79b7566",
+    "data/index/revisions/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/text.npy": "770eebe4eb273d2e066dcf9e6085d73c43192b2a4d6a0bd191759e6745bdf507",
+    "data/index/revisions/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/segments.json": "016ce6672b25eacc268d418b6d0a161a7fa2a7396cfd3543e53d1938a40a4809",
+    "data/index/revisions/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/manifest.json": "d380ed784acc1640825dba8528743125483af0f32d1cf327970edcc03b582b70"
+  },
+  "failure_code": "github_request_rejected",
+  "status_code": 404,
+  "failure_host": "uploads.github.com",
+  "request_id": "FE93:319F8B:36F88A:4FB435:6AD3F6B8",
+  "committed_checkpoints": 0,
+  "first_checkpoint": null,
+  "recovery_verified": false,
+  "uncommitted_release_tag": "vm-test-recovery-20261017-745d0278-20261017T222910307870749-6b71d153db4944d590521b43e3cb4eb1",
+  "release_id": 416107443,
+  "asset_count": 0,
+  "namespace_checkpoint_exists": false
+}

docs/evidence/github-recovery-prior-blocked.json

@@ -0,0 +1,115 @@
+{
+  "live": true,
+  "status": "blocked",
+  "namespace": "test-recovery-20261017-937e26ae",
+  "repository": "JsonLord/visual-mentor-backups",
+  "credential_source": "GH_TOKEN",
+  "http_events": [
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "status": 200,
+      "headers": {
+        "x-github-request-id": "8E2E:1BB071:2286C:711C7:6AD3D411",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14921",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "metadata=read",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "status": 404,
+      "headers": {
+        "x-github-request-id": "77B1:3FD457:FABDAE:341D926:6AD3D411",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14920",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "contents=read",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "status": 404,
+      "headers": {
+        "x-github-request-id": "9E38:15CAE4:251FB:79F1E:6AD3D412",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14919",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "contents=read",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "POST",
+      "host": "api.github.com",
+      "status": 201,
+      "headers": {
+        "x-github-request-id": "F605:363BB9:DDC6D8:2CF6533:6AD3D412",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14999",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "contents=write; contents=write,workflows=write",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "GET",
+      "host": "api.github.com",
+      "status": 200,
+      "headers": {
+        "x-github-request-id": "77B1:3FD457:FAC77F:341F981:6AD3D412",
+        "x-github-api-version-selected": "2022-11-28",
+        "x-ratelimit-limit": "15000",
+        "x-ratelimit-remaining": "14998",
+        "x-ratelimit-resource": "core",
+        "x-accepted-github-permissions": "contents=read",
+        "x-oauth-scopes": "",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    },
+    {
+      "method": "POST",
+      "host": "uploads.github.com",
+      "status": 401,
+      "headers": {
+        "x-github-request-id": "FD3D:10E5C1:CD4E9:E9D17:6AD3D414",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true
+    }
+  ],
+  "failure_code": "github_authentication_failed",
+  "status_code": 401,
+  "failure_host": "uploads.github.com",
+  "request_id": "FD3D:10E5C1:CD4E9:E9D17:6AD3D414",
+  "committed_checkpoints": 0,
+  "recovery_verified": false,
+  "uncommitted_release_tag": "vm-test-recovery-20261017-937e26ae-20261017T200121863305766-33b55696676543a781ab99b712d7bf15",
+  "release_id": 416029153,
+  "asset_count": 0,
+  "namespace_checkpoint_lookup_status": 404
+}

docs/evidence/github-upload-client-comparison.json

@@ -0,0 +1,32 @@
+{
+  "observations": [
+    {
+      "method": "POST",
+      "host": "uploads.github.com",
+      "status": 401,
+      "headers": {
+        "x-github-request-id": "4CD7:31E81D:C5069:E70BE:6AD3D43C",
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy"
+      },
+      "client_authorization_attached": true,
+      "client": "httpx",
+      "auth_scheme": "token",
+      "credential_source": "GH_TOKEN"
+    },
+    {
+      "client": "gh",
+      "host": "uploads.github.com",
+      "method": "POST",
+      "status": 401,
+      "exit_code": 1,
+      "headers": {
+        "content-type": "application/json; charset=utf-8",
+        "server": "envoy",
+        "x-github-request-id": "ADAA:355B8B:2A3FE2:3F6FD8:6AD3D43D"
+      },
+      "credential_source": "GH_TOKEN"
+    }
+  ],
+  "conclusion": "Client-side header attachment confirmed for HTTPX; proxy-side header contents are not observable. Current host-scoped credential propagation remains unverified."
+}

docs/evidence/hf-space-observation.json

@@ -0,0 +1,17 @@
+{
+  "production_space": "Leon4gr45/openweb",
+  "metadata_status": 200,
+  "private": false,
+  "sdk": "docker",
+  "sha": "5a12f98129417859ebddae6d7e74ca4a8d3dd5e4",
+  "runtime_stage": "RUNNING",
+  "hardware": {
+    "current": "cpu-basic",
+    "requested": "cpu-basic"
+  },
+  "production_modified": false,
+  "staging_target": "Leon4gr45/openweb-v2-staging",
+  "anonymous_staging_metadata_status": 401,
+  "staging_exists": "unverified without authorized HF access",
+  "staging_deployed": false
+}

docs/evidence/live-qualification-backend-tests.txt

@@ -0,0 +1,9 @@
+........................................................................ [ 62%]
+............................................                             [100%]
+=============================== warnings summary ===============================
+../visual-mentor-venv/lib/python3.12/site-packages/fastapi/testclient.py:1
+  /workspace/visual-mentor-venv/lib/python3.12/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+116 passed, 1 warning in 9.43s

docs/evidence/private-staging-live.json

@@ -0,0 +1,8 @@
+{
+  "status": "blocked",
+  "private_boundary_verified": false,
+  "checkpoint_verified": false,
+  "sleep_wake_verified": false,
+  "failure_code": "missing_secure_staging_credentials",
+  "http_events": []
+}

docs/evidence/standalone-probes/github-release-qualification-20261017T223752Z-a13651aa74504b7ca9a9a2f1f83e0100.json

@@ -0,0 +1,44 @@
+{
+  "run_id": "20261017T223752Z-a13651aa74504b7ca9a9a2f1f83e0100",
+  "repository": "JsonLord/visual-mentor-backups",
+  "credential_source": "VM_BACKUP_GITHUB_TOKEN",
+  "status": "failed",
+  "upload_decision": "NO-GO",
+  "staging_decision": "NO-GO",
+  "contents_write_verified": true,
+  "asset_readback_verified": false,
+  "http_events": [
+    {
+      "host": "api.github.com",
+      "method": "GET",
+      "status": 200,
+      "request_id": "B7D9:353E69:DAF87:2CA245:6AD3F8C0",
+      "authenticated": true,
+      "accepted_permissions": "metadata=read"
+    },
+    {
+      "host": "api.github.com",
+      "method": "POST",
+      "status": 201,
+      "request_id": "E502:35277:C81D0:28AAFC:6AD3F8C0",
+      "authenticated": true,
+      "accepted_permissions": "contents=write; contents=write,workflows=write"
+    },
+    {
+      "host": "uploads.github.com",
+      "method": "POST",
+      "status": 404,
+      "request_id": "8FF6:3E5B5B:35838A:4E7443:6AD3F8C1",
+      "authenticated": true,
+      "accepted_permissions": null
+    }
+  ],
+  "recovery_run": false,
+  "production_or_workflows_changed": false,
+  "local_age_roundtrip_verified": true,
+  "private_repository_verified": true,
+  "repository_push_permission_reported": true,
+  "release_id": 416110789,
+  "release_tag": "vm-credential-test-20261017T223752Z-a13651aa74504b7ca9a9a2f1f83e0100",
+  "failure_code": "http_rejected_404"
+}

docs/github-backup-migration.md

@@ -0,0 +1,294 @@
+# GitHub-native backup migration qualification — 17 October 2026
+
+**Implementation prepared; activation is blocked.** No production Space deployment,
+secret provisioning, scheduling activation, existing-backup overwrite or DGX service
+change was performed. The source changes are on `feature/video-rag-mentor-v2`; backup
+coordinator source is on private backup `main`, outside `.github/workflows`.
+
+## Architectural change
+
+The old design required an immutable external store snapshot plus separately stored
+media. The new runtime operates on HF CPU Basic ephemeral files, creates consistent
+SQLite/config/index/media snapshots, encrypts content-addressed chunks with age,
+and uses private GitHub release assets plus atomic repository checkpoint records
+as its sole persistent recovery source. No S3, R2, rclone or HF persistent disk is
+required. The original Library/Search/Ask/Experiments/Architecture/detail/live/model
+routes remain; a backup admin panel is added at `/backups`.
+
+The backup repository now coordinates the Space instead of fetching external data.
+The Space holds a scoped GitHub writer and age recovery key; Actions holds only a
+scoped HF access token and limited backup-trigger token. This avoids giving the
+coordinator configuration/media/inference administrator privileges. Encryption is
+performed inside the Space before GitHub transmission, including the recovery
+manifest. Only operational ciphertext references/timing/size metadata is public to
+the private repository and GitHub itself.
+
+The activation runbook and estimates are in [backup-restore.md](backup-restore.md).
+Format-1 snapshots are retained unchanged and never automatically reinterpreted.
+Existing data must first be independently restored and imported into a format-2
+working root. No automated pruning or history rewriting is included.
+
+## Evidence and its limits
+
+Machine-readable summary: [github-backup-results.json](evidence/github-backup-results.json).
+
+| Check | Result | Evidence boundary |
+| --- | --- | --- |
+| Backend regression suite | 109 passed | Real CPU media, SQLite and age; provider calls mocked |
+| New backup tests | 13 passed (included above) | Successful GitHub storage transport mocked |
+| Destructive complete-library recovery | Passed locally | Generated video, original/proxy/frame/thumbnail, transcript, segments, SQLite row, saved answer history, config history, versioned vector index; delete source + capture stage, recover only encrypted mock remote assets + key, compare all file hashes |
+| Fresh application startup | Passed locally | Separate Python interpreter loads recovered ConfigStore and index and serves protected library endpoint; no stale in-memory state |
+| Incremental backup | Passed locally | Identical original/proxy chunks share objects; unchanged second checkpoint uploads manifest only |
+| Safety/failure behavior | Passed locally | Partial upload publishes no record, corrupt/missing objects block restore, wrong key publishes nothing, invalid index/unknown state fail, existing roots are not overwritten; mocked documented HTTP endpoints and cross-origin credential stripping pass |
+| Protected administration | Passed locally | Missing/wrong role denied, coordinator token scoped to enqueue/status, browser-origin coordinator rejected |
+| Timer and retries | Passed simulated clock | Exercises 12-hour timeout branch, three snapshot attempts, status and zero pending uploads; does not simulate a platform sleep/wake |
+| Frontend build/lint | Passed | One existing unused-variable warning in Architecture; zero lint errors |
+| Browser parity/camera/routing | 17 passed | Screenshot comparisons and mock API/simulated devices, not physical camera/provider integrations |
+| Backup administration browser | 2 passed | Mock status and trigger endpoints; displays actual reported status and distinguishes acceptance from completion |
+| GitHub private metadata | Passed live | Repository private; release creation succeeds with existing identity |
+| GitHub encrypted asset upload | **Blocked live** | `uploads.github.com` responds 401 Bad credentials; no recovery record committed |
+| Private HF reachability | **Blocked live** | Both HF metadata and `leon4gr45-openweb.hf.space` rejected by current network proxy policy; HF test credential absent |
+| Actions wake/completion | **Not run / not established** | No deployed trigger on staging, no validated private access route, no activated workflow |
+
+The unsuccessful live attempt created one empty, uniquely named test release:
+`vm-test-recovery-20261017-deae94ff-20261017T173832-f8cd66db742745159168b741ea1a751e`.
+It is not a checkpoint. No original user data or private credentials were uploaded.
+The attempted ciphertext upload and a synthetic header-only diagnostic both failed
+with 401. No production namespace was written and old assets were not deleted.
+
+The environment draft now preserves existing domains and adds API/upload/signed
+release hosts plus `huggingface.co` and the exact supplied Space origin. It also
+records scoped `VM_BACKUP_GITHUB_TOKEN` and optional `HF_SPACE_TOKEN` requirements.
+Saving this draft did not apply or publish it, provision credentials, or change HF
+settings. Review/save and publish the environment configuration to apply access.
+Do not paste tokens into chat. GitHub API access alone does not establish upload
+host credentials; both routes must be tested using the same authorized identity.
+
+## Scheduling decision
+
+The inactive Actions template has 00:17/12:17 UTC schedule and manual dispatch,
+concurrency and outer timeout. It requires explicit approval plus validated private
+routing; it checks HF metadata privacy, uses HF bearer authentication and separate
+app trigger header, then polls for a newly completed checkpoint. YAML existence
+and a 202-style enqueue response are never reported as schedule success.
+
+The local resident timer and important-state-change triggers are implemented and
+covered with mock-clock/local tests. They run only while the Space is awake. They
+are useful as a local fallback but cannot meet a sleeping-Space wake guarantee.
+No secure alternative wake path is validated in this environment. Reliable
+12-hour scheduling remains blocked pending a real private staging sleep/wake test.
+The implementation does not create a public endpoint, restart the Space, change
+hardware, buy persistent storage or expose additional ports to evade that blocker.
+
+## Capacity estimate
+
+Example 64 MiB original + 20 MiB proxy + 1 MiB transcript/images + 3 MiB index:
+approximately 88 MiB initial encrypted storage. One hundred similar videos:
+roughly 8.5 GiB media plus index revisions/manifests. A 10k x 768 float32 view is
+29.30 MiB; five views are 146.48 MiB/revision. Twenty single-view revisions add
+about 586 MiB. Age adds small framing overhead and does not compress media.
+A configuration-only change uploads changed chunks and a small encrypted manifest;
+unchanged chunks are reused but read back for coverage. Older removed/reintroduced
+chunks may upload again because the dedup catalog is the preceding manifest.
+
+Enforce 20 GiB / 100k-file plaintext ceiling and source-size + 64 MiB free scratch
+preflight. HF's 50 GB includes app, active files, processing and backup/restore
+staging. Keep operational usage below the theoretical limit. Check GitHub account
+quotas and release-asset acceptable use before treating the estimate as approval.
+GitHub listings fail closed at capacity instead of silently dropping files; rotate
+reviewed namespaces before a year shard reaches 1000 records. No deletion is automatic.
+
+## Activation checklist — requires separate production approval
+
+1. Review the two commits and storage/key policy; keep all existing backup data.
+2. Apply the saved environment network settings. Provision a fine-grained private
+   repository token in secure settings with Contents read/write, authenticated on
+   **both** API and uploads hosts. Provision read-only HF access for the supplied
+   private Space. Do not provide a broad app administrator token to Actions.
+3. Rerun `AGE_BIN=/path/to/age python tests/live_github_recovery.py`. It creates a
+   fresh `test-recovery-*` namespace, backs up real generated video/index/config,
+   checks unchanged dedup, destroys source + snapshot stage, starts a fresh Python
+   application instance and recovers using GitHub + protected ephemeral test key.
+   Require `docs/evidence/github-recovery-live.json` with all hashes matching.
+   The protected test key is deleted at drill end; test assets are disposable and
+   must never be mistaken for production recovery points.
+4. Obtain staging deployment approval. Configure the age identity as an HF Secret,
+   keep an independent protected operator recovery copy, configure roots exactly as
+   documented, and import reviewed existing data with writers stopped. First-start
+   empty authorization is temporary and is forbidden for a failed recovery.
+5. Deploy only to the approved private staging Space. Verify anonymous denial,
+   correct HF identity access, user/admin separation and scoped coordinator access.
+6. Run the coordinator manually against staging with approved secrets. Let staging
+   sleep, then repeat from an actual GitHub Actions runner. Require verified private
+   access, wake, accepted trigger **and a new committed checkpoint**. Record run URL,
+   timestamps and restore-point ID. Do not claim these tests from local mock results.
+7. Destroy staging state and start its clean container. Verify complete library,
+   media/Range, index queries, YAML history and health from GitHub + age key only.
+   Run an isolated admin recovery test and capture its result in `/backups`.
+8. Exercise ingestion-complete and config-apply/rollback triggers, failed uploads,
+   exhausted retries, revoked credentials, capacity failure and stale health.
+   Check the existing inference/camera/routing/UI flows with unchanged providers.
+9. After explicit approval, move the reviewed inactive coordinator into
+   `.github/workflows`, provision the protected environment and set
+   `COORDINATOR_VALIDATED=true` and `BACKUPS_APPROVED=true`. First observe manual
+   completion, then actual scheduled runs. No such activation was performed here.
+10. Obtain a distinct production deployment/scheduling approval before applying any
+    changes to `Leon4gr45/openweb`. Retain a tested previous source and recovery
+    checkpoint; rollback into an isolated root, never overwrite active data.
+
+
+## Subsequent live qualification (17 October 2026)
+
+This section supersedes the earlier network-policy observations above. Fixes are
+based on application `30dbccac29e8056ccffff98f45247515f32edaad` and backup tooling
+`96e6391b303e82ca821937c57da5e03776f3eedc`. No production changes or workflow activation
+were made. Existing checkpoints/releases were neither deleted nor overwritten.
+
+### Phase 1: host-specific 401 diagnosis
+
+Using the **same GH_TOKEN source**, GitHub user/private repository reads return
+200 and new disposable release creation returns 201 on `api.github.com`. The
+uploader now consumes the returned `upload_url`, removes its URI-template suffix,
+and validates HTTPS, exact uploads host, expected repository/release path, no
+userinfo/query/fragment and no redirects before attaching Authorization.
+
+The resulting POST to `uploads.github.com` returns **401**, request ID
+`FD3D:10E5C1:CD4E9:E9D17:6AD3D414`. A separate supported `token` authorization-scheme
+probe returns 401 (`4CD7:31E81D:C5069:E70BE:6AD3D43C`); the native gh CLI using the
+same credential source also returns 401 (`ADAA:355B8B:2A3FE2:3F6FD8:6AD3D43D`). The
+upload-host root's 302 is not an authentication test and is not counted as success.
+
+HTTPX confirms Authorization is attached before the outbound proxy. API responses
+include GitHub request IDs; the server response header is `envoy`. There is no
+available trusted proxy trace that shows the forwarded Authorization value. These
+observations localize the rejection to authentication at the upload destination;
+they do **not** establish whether the proxy stripped, rewrote, or failed to inject
+a credential. No proxy-held credentials were extracted, and no direct connection,
+alternate API route or TLS bypass was attempted. Both HTTPX and gh fail, so this
+is not demonstrated to be an HTTPX-only request-format issue. The declared scoped
+VM_BACKUP_GITHUB_TOKEN binding still has no saved credential, and its variable is
+absent in the running environment. A valid credential on both destinations remains
+the external prerequisite; changing upload_url alone did not fix the 401.
+
+401 and other permanent 4xx requests now raise sanitized GitHubPermanentError,
+without blind upload or outer checkpoint retries. The health report distinguishes
+`github_authentication_failed` from a generic retry exhaustion. Transient upload
+failures still reconcile the immutable asset name before retrying; a test verifies
+that an uncertain 503 with an actually created asset does not produce a duplicate.
+Sanitized diagnostics record method/host/status/GitHub request ID and allowlisted
+response headers, never Authorization values, request bodies, response payloads or
+signed Location URLs. Tests cover destination authorization and credential stripping
+on signed downloads.
+
+Evidence:
+
+- [Host probes](evidence/github-auth-probe.json)
+- [HTTPX / gh comparison](evidence/github-upload-client-comparison.json)
+- [Latest live drill](evidence/github-recovery-live.json)
+
+### Phase 2: attempted real recovery
+
+Namespace `test-recovery-20261017-937e26ae` contains a newly created, uncommitted
+release only. Its first encrypted upload failed once with 401. A read-only check
+confirmed **zero release assets** and no checkpoint namespace (Contents API 404).
+No successful live recovery, incremental checkpoint or file-hash comparison is
+claimed. The report is explicitly `status=blocked`, `recovery_verified=false`.
+All prior recovery successes remain real age/SQLite/FFmpeg with **mocked GitHub**.
+
+The live drill now persists sanitized diagnostics even on authentication failure.
+After credentials work it is ready to record both committed checkpoint IDs, asset
+counts, full restored file hashes before application startup, unchanged incremental
+dedup, SQLite integrity/logical rows, fresh-process Library/Search/config/index,
+authorized media Range and anonymous media denial, and actual FFmpeg media decode.
+Search uses a deterministic synthetic query vector, not a live embedding provider;
+the recovered index and application Search route perform real retrieval. The test
+source and capture stage are deleted before restore, and recovery uses only GitHub
+assets plus the isolated age key. Ephemeral test key destruction is intentional;
+these disposable points are not production recovery assets.
+
+### Phase 3: private HF staging preparation
+
+Network reachability now works for the supplied production origin and HF metadata.
+An anonymous HF metadata response reports **Leon4gr45/openweb private=false**, Docker,
+CPU Basic, RUNNING, revision `5a12f98129417859ebddae6d7e74ca4a8d3dd5e4`. Its backup-status
+route returns 404. This is not a private-boundary qualification and its privacy or
+deployment was not changed. Anonymous metadata access to the proposed separate
+staging target returns 401; existence/access cannot be concluded without credentials.
+
+A concrete [private staging package](../deploy/hf-staging/README.md), restricted
+probe `scripts/qualify_private_space.py`, and manual-only inactive
+`qualify-private-staging.yml` are prepared. The probe rejects production targets,
+requires private metadata, verifies anonymous denial plus correct HF/scoped-trigger
+access and wrong-trigger rejection, and can run the bounded checkpoint coordinator.
+It records an actual Actions run URL when executed on a runner and only claims a
+sleep/wake test when initial runtime was sleeping and the authenticated route plus
+new checkpoint succeeded. No restart/resume/hardware API is called.
+
+The present task authorizes private staging qualification; it does not authorize
+production changes. No HF credential is available, so staging deployment, authorized
+HF access, actual runner dispatch and sleep/wake testing could not proceed. This is
+a missing capability, not a request to reconfirm the task. The manual test workflow
+and 12-hour production workflow both remain outside `.github/workflows`.
+
+Evidence: [HF observation](evidence/hf-space-observation.json) and
+[staging probe result](evidence/private-staging-live.json).
+
+### Exact remaining credential and activation steps
+
+1. In secure cloud environment settings, supply **VM_BACKUP_GITHUB_TOKEN**: a
+   fine-grained GitHub token authorized only for JsonLord/visual-mentor-backups,
+   **Contents read/write and Metadata read**. Configure proxy substitution for both
+   `api.github.com` and `uploads.github.com`; signed release downloads deliberately
+   receive no bearer token. Apply the saved environment configuration and confirm
+   both hosts with the same binding. Never paste values or expose the proxy-held
+   token. The existing integration's API access does not prove upload authentication.
+2. Rerun `AGE_BIN=/path/to/age python tests/live_github_recovery.py`. Require a
+   passed evidence file with real asset readback, two committed checkpoints,
+   incremental manifest-only upload, all pre-startup file hashes equal, and fresh
+   application/media checks. Until then the sole-store live recovery gate fails.
+3. Provision an HF identity with write access to the **separate private staging**
+   repository. Repository creation requires rights in the Leon4gr45 namespace; if
+   avoiding broad creation rights, create the private Docker staging repository
+   first and issue a token limited to its contents/settings. Use the staging package
+   and existing deployment allowlist, not a production upload. Set staging backup
+   namespace, protected key/trigger and independent role tokens in HF settings.
+4. Give the coordinator a **separate read-only HF token** authorized to access the
+   private staging repository and its authenticated app route, plus its own staging
+   trigger token. Add the exact staging origin to allowed network/credential
+   destinations. No paid inference or production-repository write scope is needed.
+   Run the private probe locally, then install only the reviewed manual workflow
+   with its `private-backup-staging` environment, STAGING_SPACE_ID/URL variables and
+   STAGING_HF_TOKEN / STAGING_BACKUP_TRIGGER_TOKEN secrets. Keep workflow permissions
+   at Contents read; GitHub writes occur inside the Space with its scoped writer.
+5. Dispatch the manual workflow, record its run URL and new committed point, then
+   test a naturally sleeping staging instance through the same authenticated route.
+   Destroy only staging working state and verify clean startup recovery. Do not
+   equate an awake run, a local mock, or enqueue acceptance with wake/schedule success.
+6. Leave the production timer inactive and approval guards unset. Production Space
+   deployment or production scheduling still requires explicit approval.
+
+Current follow-up regression: **116 backend tests passed** (20 backup tests),
+including permanent-error retry suppression, transient reconciliation, sanitized
+headers and private staging boundary mocks. These new tests do not convert the
+blocked live gates into passes. No application UI or inference feature was redesigned.
+
+
+## Dedicated credential recheck — 18 October 2026
+
+The dedicated VM_BACKUP_GITHUB_TOKEN is now provisioned and ready. All requests
+in this recheck used it, with no integration GH_TOKEN fallback. Private repository
+read succeeded (200) and a new disposable release was created (201), but its first
+age-encrypted asset upload returned **404** from uploads.github.com. Request ID:
+`FE93:319F8B:36F88A:4FB435:6AD3F6B8`. The permanent rejection was not retried.
+
+Namespace `test-recovery-20261017-745d0278` has zero assets and zero committed
+checkpoints, verified after the failure. Recovery/dedup were not reached. No
+existing remote release/checkpoint was changed. Scope versus host-specific
+credential propagation remains undetermined until the same permitted token is
+compared on an independent trusted machine; none is attached here. No security
+bypass or credential extraction was attempted. HF credentials remain absent.
+
+The first private staging deployment remains **NO-GO**. See
+[credential qualification](credential-qualification.md) for sanitized evidence,
+exact comparison steps and attribution boundaries. Earlier statements that the
+dedicated binding was absent are historical and superseded by this recheck.

docs/original-research.md

@@ -0,0 +1,129 @@
+# Video RAG with EmbeddingGemma 2 + Gemma 4 12B
+
+▶️ **Video walkthrough:** https://youtu.be/Q8T9lvtGFNw
+
+Multimodal RAG over the latest uploads on the channel. Every ~30s segment is embedded by
+[EmbeddingGemma 2](https://huggingface.co/google/embeddinggemma-2) five different ways into one
+shared 768d space, and Gemma 4 12B (QAT, on vLLM) answers questions by *watching* the retrieved
+clips. A Next.js site shows the library, search, RAG answers, and the Matryoshka (MRL) experiments.
+
+```
+sams-videos/*.mp4 ─ ingest ─▶ 480p proxy + YouTube match ─ transcribe ─▶ word-timed transcript
+                                                                         │
+                         segment (~30s, snapped to sentences) ◀──────────┘
+                           │  clip.mp4 · audio.wav · keyframe.jpg
+                           ▼
+            EmbeddingGemma 2 ─▶ text | frame | video | audio | fused   (768d, unit-norm)
+                           │
+     query ─ SearchQuery ──┤  cosine @ 768/512/256/128 (truncate + renormalise)
+                           ▼
+         top-k segments ─▶ Gemma 4 12B (transcript + video frames [+ audio]) ─▶ cited answer
+```
+
+## Embedding views
+
+| view | what is embedded | why |
+|---|---|---|
+| `text` | `title: {video title} \| text: {transcript}` | the classic text-RAG baseline |
+| `frame` | one keyframe from the middle of the segment | cheapest visual signal |
+| `video` | the clip's frames at 1fps (no audio, no text) | what's on screen over time |
+| `audio` | raw 16kHz mono audio (no transcript) | can it replace ASR? |
+| `fused` | transcript + `<\|video\|>` + `<\|audio\|>` interleaved in one input | all signals in a single vector |
+| `hybrid` | reciprocal rank fusion of `text`, `video`, `audio` rankings | multi-vector alternative to `fused` |
+
+Segments target 30s: about 30 frames × 140 tokens + 750 audio tokens + the transcript, which fits
+inside the model's 8,192-token window.
+
+## First results (15 videos, 427 segments, 228 synthetic queries)
+
+recall@5 (exact source segment in top 5):
+
+| view | spoken 768d | visual 768d | all 768d | all 256d | all 128d |
+|---|---|---|---|---|---|
+| text | **0.98** | 0.67 | **0.82** | **0.80** | 0.71 |
+| frame | 0.39 | 0.60 | 0.49 | 0.46 | 0.41 |
+| video | 0.53 | 0.75 | 0.64 | 0.59 | 0.52 |
+| audio | 0.82 | 0.61 | 0.71 | 0.66 | 0.57 |
+| fused | 0.84 | **0.78** | 0.81 | 0.77 | 0.69 |
+| hybrid | 0.84 | 0.69 | 0.77 | 0.74 | **0.72** |
+
+- **Spoken queries favour transcripts.** Text is near-perfect. Raw audio with no ASR reaches 0.82.
+  The spoken queries were written from transcripts, which biases the comparison toward the text view.
+- **Visual queries favour pixels.** Fused (0.78) and video (0.75) beat text (0.67). This is where multimodal embedding pays off.
+- **MRL:** 256d keeps about 95% of 768d quality across views. 128d costs 10 to 15 points, except hybrid,
+  where rank fusion absorbs most of the loss.
+- Caveats: the queries are synthetic, Gemma 4 always produced a "visual" query even for talking-head shots,
+  and some spoken queries are vague. Add real queries to `data/eval/manual.jsonl` and re-run `vrag experiments`.
+
+## Setup
+
+Two separate uv environments, so vLLM's pinned torch/transformers don't clash with the embedding stack:
+
+```bash
+uv sync                     # pipeline + API (torch cu130, transformers 5.19, sentence-transformers 6.1)
+(cd serve && uv sync)       # vLLM 0.23.0 for Gemma 4 12B QAT
+(cd web && npm install)     # Next.js site
+```
+
+## Build the index
+
+Put video files in `sams-videos/`, then:
+
+```bash
+serve/serve.sh --bg --mtp   # Gemma 4 12B QAT on :8001 (needed for evalset + ask)
+uv run vrag build           # ingest -> transcribe -> segment -> embed
+uv run vrag evalset         # Gemma 4 watches sampled segments, writes spoken + visual queries
+uv run vrag experiments     # view x MRL-dim retrieval grid -> data/experiments/results.json
+```
+
+- **ingest** transcodes each file to a 480p proxy and matches it to its YouTube upload by duration
+  (YouTube lists durations rounded up), recovering title, ID, and view count with no per-video requests.
+- **transcribe** uses Gemma 4 12B on the vLLM server by default (`VRAG_ASR=whisper` switches to Whisper
+  large-v3-turbo). Audio is cut at pauses into chunks of 28 seconds or less and padded to exactly 30 seconds.
+  Gemma only hears the first 30 seconds of any clip, and vLLM 0.23 crashes when it batches clips of different lengths.
+  Sentence times are interpolated within each chunk. Chunks that fall into a repetition loop are retried with a
+  repetition penalty. On this corpus it took about 100 seconds for 3.9 hours of audio (Whisper: about 35 minutes),
+  with 4.3% word disagreement between the two. `uv run vrag switch-transcripts gemma|whisper` swaps the transcripts
+  behind the text and fused views while keeping the segment boundaries fixed.
+- `uv run vrag download` is an alternative that pulls straight from YouTube, but YouTube often bot-blocks it.
+
+## Run the app
+
+```bash
+scripts/dev.sh              # vLLM (if not running) + FastAPI :8000 + Next.js :3000
+```
+
+or each separately: `uv run vrag api`, `cd web && npm run dev`. To open the dev site from other
+machines, list their hostnames/IPs in `web/.env.local` as `VRAG_DEV_ORIGINS=host1,host2,*.your-tailnet.ts.net`.
+CLI question answering:
+`uv run vrag ask "what did Sam say about 1.6-bit DeepSeek?"`.
+
+## Gotchas found along the way
+
+- EmbeddingGemma 2 must run in **bf16 or fp32**. fp16 silently produces NaN or degraded vectors.
+- After MRL truncation, vectors **must be re-normalised** (`vrag/index.py:truncate`).
+- Video input in sentence-transformers needs `torchcodec`, because torchvision removed `read_video`.
+- vLLM needs `vllm[audio]`, otherwise audio inputs return "Invalid or unsupported audio file".
+- Gemma 4 treats audio placed before the instruction as a conversation turn. Put the instruction first.
+- Whisper's batched *chunk* timestamps can collapse into 5-minute cues. Word timestamps fix that, but Whisper
+  still invents or duplicates text where its 30-second windows meet, for example "I'll see you next time" mid-video.
+- Gemma 4 occasionally gets stuck in a loop ("thought thought thought…"). These are detected and retried.
+- `serve/serve.sh` carries over the Blackwell/VPN workarounds from `~/projects/gemma-4-qat`.
+
+## Layout
+
+```
+vrag/            pipeline + API (python)
+  ingest.py      local files -> data/videos/<id>/{video.mp4, thumb.jpg, meta.json}
+  transcribe.py  transcript.json
+  segment.py     segments.json + segments/NNN.{mp4,wav,jpg}
+  embedder.py    EmbeddingGemma 2 wrapper, per-view inputs
+  embed.py       data/index/<view>.npy + manifest.json
+  index.py       cosine search, MRL truncation, hybrid RRF
+  rag.py         retrieval + Gemma 4 generation (video_url / audio_url clips)
+  evalset.py     synthetic spoken/visual queries (+ data/eval/manual.jsonl for your own)
+  experiments.py metrics grid
+  api.py         FastAPI for the site
+serve/           vLLM env + serve/stop scripts
+web/             Next.js 16 site (Library, Search, Ask, Experiments)
+```

docs/providers.md

@@ -0,0 +1,53 @@
+# Remote provider contracts and v2 qualification
+
+No large model runs inside this Space. Runtime readiness is not inferred from a
+configured API key, health endpoint, placeholder model ID or mock result.
+
+| Adapter | Request contract | Actual v2 evidence |
+| --- | --- | --- |
+| `laya-vision` | Router root + POST `/v1/system-one`; object `state`, typed `questions`, bare `imageBase64` | Live synthetic image passed 2026-10-17, 22.632s; no real camera |
+| `detection-http` | Gateway `/detect`, normalized boxes plus matching frame/camera IDs and dimensions | Mock contract only; no NVIDIA endpoint/model configured |
+| `openai-transcription` | `/audio/transcriptions`, multipart audio file + model | Mock HTTP and real FFmpeg audio extraction; no live Whisper credentials |
+| `openai-embeddings` | `/embeddings`, model + input; finite nonzero vector | Mock pipeline, version/dimension isolation; no live model configured |
+| `openai-chat-vision` | `/chat/completions`, bounded transcript/text and optional base64 image URLs | Mock answers/citations and image payload safety; no live VLM configured |
+
+Laya source contract was recovered during donor review from
+`JsonLord/laya-inference`, source revision
+`77b324ac6c72efee883c41fd333e84007c55bed0`. The donor fixture/tests preserve that
+source envelope and the observed live `results.answers` alternative. Upstream
+README `image` is not the JSON gateway image field. The historical source had a
+placeholder backend; actual live readiness says placeholder=false, and adapter
+requires backend=laya-vision and model=thaitea/laya-vision. Only a fixed `noul`
+question about image inspectability is implemented. It is not a captioner,
+spatial detector or proof of semantic mentoring quality. No boxes are invented.
+The current runtime had a Laya credential available despite the environment
+configuration inventory not listing one. It was used through the normal adapter
+without reading/logging its value. `authorization_header_sent` records that a
+header was sent; authentication enforcement was not tested.
+
+NVIDIA is an explicit gateway protocol, not an assumption that any NVIDIA/NIM
+model supports spatial detection. A deployment must provide a verified gateway
+matching `vrag/providers.py` or add an upstream-source-verified adapter after
+review. Placeholder IDs cannot be enabled. OpenAI provider base URLs normally
+include `/v1`; Laya uses its router root. Secrets stay in referenced server env vars.
+
+Routing supports single, fallback, parallel (all/first_valid/quorum), sequential
+(typed previous output), conditional predicates and spatial/semantic fusion.
+Quorum failure reports no valid quorum; ordinary partial failures retain successful
+outputs. Per-session overrides reuse configured provider identities/capabilities,
+recheck destinations on dispatch, stop local previews when applied and discard
+in-flight results if routing changes. They do not persist defaults.
+
+Text indexes identify endpoint/model, full dimension, preprocessing, modality,
+segmentation and corpus revision. Only declared MRL dimensions may be used. New
+jobs atomically switch CURRENT after a complete revision, reusing compatible
+unchanged segment vectors. Frame/video/audio/fused embedding adapters remain
+**unimplemented and unavailable**: text similarity is not a substitute. Historical
+compatible index files/charts are retained, not regenerated or requalified here.
+
+Destination policy: exact approved HTTPS hosts, no URL credentials/query/fragment,
+no private/metadata IPs, no redirects, TLS verification, bounded payloads/responses,
+per-provider concurrency/circuit control. Direct requests pin validated public IPs
+with original hostname/SNI. A configured trusted proxy owns DNS on that path and
+must independently enforce public-only DNS/metadata denial. Real deployment egress
+policy is an outstanding staging check.

docs/v2-evidence/backend-tests.txt

@@ -0,0 +1,9 @@
+........................................................................ [ 75%]
+........................                                                 [100%]
+=============================== warnings summary ===============================
+../visual-mentor-venv/lib/python3.12/site-packages/fastapi/testclient.py:1
+  /workspace/visual-mentor-venv/lib/python3.12/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+96 passed, 1 warning in 2.63s

docs/v2-evidence/browser-tests.txt

@@ -0,0 +1,33 @@
+
+Running 21 tests using 1 worker
+
+(node:44947) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+  ✓   1 tests/fullstack.spec.ts:2:5 › real same-origin sample library, search, Ask, playback and Range (5.5s)
+  ✓   2 tests/live.spec.ts:2:5 › dual simulated previews require explicit transfer and stop on navigation (3.7s)
+  ✓   3 tests/live.spec.ts:63:5 › models studio validates and atomically switches a profile (1.3s)
+  ✓   4 tests/parity.spec.ts:10:7 › original UI desktop (6.2s)
+  ✓   5 tests/parity.spec.ts:10:7 › original UI laptop (7.2s)
+  ✓   6 tests/parity.spec.ts:10:7 › original UI tablet (8.8s)
+  ✓   7 tests/parity.spec.ts:10:7 › original UI mobile (6.7s)
+  ✓   8 tests/parity.spec.ts:48:5 › clip and citation interactions (1.7s)
+  ✓   9 tests/release.spec.ts:11:5 › permission denial shows an error without uploading (869ms)
+  ✓  10 tests/release.spec.ts:19:7 › rejects frame mismatch and permits a later matching observation (2.3s)
+  ✓  11 tests/release.spec.ts:19:7 › rejects config mismatch and permits a later matching observation (1.2s)
+  ✓  12 tests/release.spec.ts:19:7 › rejects dimensions mismatch and permits a later matching observation (1.2s)
+  ✓  13 tests/release.spec.ts:19:7 › rejects box mismatch and permits a later matching observation (1.1s)
+  ✓  14 tests/release.spec.ts:46:5 › stopping a camera discards its delayed result (1.1s)
+  ✓  15 tests/release.spec.ts:59:5 › a pending camera permission grant after navigation stops the returned tracks (1.1s)
+  ✓  16 tests/release.spec.ts:72:5 › device contention is reported and track end stops the preview (1.1s)
+  ✓  17 tests/release.spec.ts:84:5 › hiding the page stops microphone capture without uploading audio (1.0s)
+  ✓  18 tests/release.spec.ts:98:5 › recorder errors release microphone tracks and discard audio (926ms)
+  ✓  19 tests/studio.spec.ts:60:7 › native Live and Models desktop (2.6s)
+  ✓  20 tests/studio.spec.ts:60:7 › native Live and Models mobile (1.9s)
+  ✓  21 tests/studio.spec.ts:74:5 › import edits draft, validate gates apply, route form updates YAML (1.4s)
+
+  21 passed (1.1m)
+npm notice
+npm notice New major version of npm available! 11.9.0 -> 12.2.0
+npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.2.0
+npm notice To update run: npm install -g npm@12.2.0
+npm notice

docs/v2-evidence/build.txt

@@ -0,0 +1,120 @@
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 1.89kB done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/python:3.12-slim-bookworm@sha256:34386ef0cb081344d7ec1c103ba398e6e9f64e9ab3a1509accc92a4e24a07258
+#2 DONE 0.0s
+
+#3 [internal] load metadata for docker.io/library/node:24-bookworm-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5
+#3 DONE 0.0s
+
+#4 [internal] load .dockerignore
+#4 transferring context: 396B done
+#4 DONE 0.0s
+
+#5 [web 1/6] FROM docker.io/library/node:24-bookworm-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5
+#5 DONE 0.0s
+
+#6 [runtime 1/6] FROM docker.io/library/python:3.12-slim-bookworm@sha256:34386ef0cb081344d7ec1c103ba398e6e9f64e9ab3a1509accc92a4e24a07258
+#6 DONE 0.0s
+
+#7 [internal] load build context
+#7 transferring context: 24.00kB done
+#7 DONE 0.0s
+
+#8 [web 3/6] COPY web/package*.json ./
+#8 CACHED
+
+#9 [web 2/6] WORKDIR /build/web
+#9 CACHED
+
+#10 [web 4/6] RUN --mount=type=secret,id=build_ca if [ -f /run/secrets/build_ca ]; then export NODE_EXTRA_CA_CERTS=/run/secrets/build_ca; fi; npm ci --no-audit --no-fund
+#10 CACHED
+
+#11 [web 5/6] COPY web/ ./
+#11 DONE 11.3s
+
+#12 [web 6/6] RUN npm run build
+#12 2.338
+#12 2.338 > web@0.1.0 build
+#12 2.338 > next build
+#12 2.338
+#12 2.710 ▲ Next.js 16.4.0 (Turbopack)
+#12 2.748 ✓ Running next.config.ts took 36ms
+#12 2.765 - Cache Components enabled
+#12 2.765 - Partial Prefetching enabled
+#12 2.765 - Experiments (use with caution):
+#12 2.765   · proxyClientMaxBodySize: "65mb"
+#12 2.765   · proxyTimeout: 300000
+#12 2.765
+#12 2.785   Creating an optimized production build ...
+#12 9.207 ✓ Compiled successfully in 6.4s
+#12 9.211   Running TypeScript ...
+#12 12.98   Finished TypeScript in 3.8s ...
+#12 12.98   Collecting page data using 4 workers ...
+#12 13.54   Generating static pages using 4 workers (0/11) ...
+#12 13.91   Generating static pages using 4 workers (2/11)
+#12 13.95   Generating static pages using 4 workers (5/11)
+#12 13.95   Generating static pages using 4 workers (8/11)
+#12 14.04 ✓ Generating static pages using 4 workers (11/11) in 501ms
+#12 14.05   Finalizing page optimization ...
+#12 14.22
+#12 14.22 Route (app)
+#12 14.22 ┌ ○ /
+#12 14.22 ├ ○ /_not-found
+#12 14.22 ├ ○ /architecture
+#12 14.22 ├ ○ /ask
+#12 14.22 ├ ○ /experiments
+#12 14.22 ├ ○ /live
+#12 14.22 ├ ○ /models
+#12 14.22 ├ ○ /search
+#12 14.22 └   /videos/[id]
+#12 14.22   └ ◐ /videos/[id]
+#12 14.22
+#12 14.22
+#12 14.22 ○  (Static)             prerendered as static content
+#12 14.22 ◐  (Partial Prerender)  prerendered as static HTML with dynamic server-streamed content
+#12 14.22
+#12 DONE 14.3s
+
+#13 [bundle 1/6] COPY vrag /app/vrag
+#13 CACHED
+
+#14 [bundle 2/6] COPY config /app/config
+#14 CACHED
+
+#15 [bundle 3/6] COPY scripts/cloud-start.py /app/scripts/cloud-start.py
+#15 CACHED
+
+#16 [bundle 4/6] COPY --from=web /build/web/.next/standalone /app/web/.next/standalone
+#16 DONE 0.1s
+
+#17 [bundle 5/6] COPY --from=web /build/web/.next/static /app/web/.next/standalone/.next/static
+#17 DONE 0.1s
+
+#18 [bundle 6/6] COPY --from=web /build/web/public /app/web/.next/standalone/public
+#18 DONE 0.1s
+
+#19 [runtime 4/6] RUN --mount=type=secret,id=build_ca     export http_proxy="$HTTP_PROXY" https_proxy="$HTTPS_PROXY";     if [ -f /run/secrets/build_ca ]; then export PIP_CERT=/run/secrets/build_ca; fi;     apt-get update && apt-get install -y --no-install-recommends ca-certificates libatomic1 ffmpeg age &&     pip install --no-cache-dir -r requirements-runtime.txt &&     rm -rf /var/lib/apt/lists/* &&     useradd -m -u 1000 mentor && mkdir -p /app/data/videos && chown -R mentor:mentor /app/data
+#19 CACHED
+
+#20 [runtime 2/6] WORKDIR /app
+#20 CACHED
+
+#21 [runtime 3/6] COPY requirements-runtime.txt ./
+#21 CACHED
+
+#22 [runtime 5/6] COPY --from=web /usr/local/bin/node /usr/local/bin/node
+#22 CACHED
+
+#23 [runtime 6/6] COPY --from=bundle --chown=1000:1000 /app /app
+#23 DONE 3.8s
+
+#24 exporting to image
+#24 exporting layers
+#24 exporting layers 0.6s done
+#24 writing image sha256:51259fc8221de63f5b4dfaf9e247e64e1496806ca88ca72f85ec243fae1ef1a3 done
+#24 naming to docker.io/library/video-rag-mentor:v2-review done
+#24 DONE 0.6s

docs/v2-evidence/container.json

@@ -0,0 +1,22 @@
+{
+  "image_id": "sha256:51259fc8221de63f5b4dfaf9e247e64e1496806ca88ca72f85ec243fae1ef1a3",
+  "startup_seconds": 13.009,
+  "network": "none",
+  "published_ports": [],
+  "limits": "2 CPUs / 16 GiB",
+  "checks": {
+    "media_range_and_cookie": "passed",
+    "authentication": "passed",
+    "csrf_origin": "passed",
+    "config_apply_rollback": "passed",
+    "session_ownership": "passed",
+    "disabled_inference": "503 without local fallback",
+    "uid": 1000,
+    "forbidden_packages": [],
+    "model_weights": [],
+    "gpu_devices": []
+  },
+  "persistent_volume": {
+    "recreated_container_config_version": 4
+  }
+}

docs/v2-evidence/laya-live.json

@@ -0,0 +1,70 @@
+{
+  "metadata": {
+    "/health": {
+      "status": "ok"
+    },
+    "/ready": {
+      "status": "ready",
+      "backends": {
+        "laya": {
+          "ready": true
+        },
+        "laya-vision": {
+          "ready": true,
+          "placeholder": false
+        }
+      }
+    },
+    "/v1/info": {
+      "service": "system-one",
+      "inference_endpoint": "/v1/system-one",
+      "routing": {
+        "text_or_structured": "laya",
+        "visual": "laya-vision"
+      },
+      "backends": {
+        "laya": {
+          "device": "cpu",
+          "generative": false,
+          "model": "receptron/laya-onnx",
+          "threads": 2,
+          "max_concurrency": 4
+        },
+        "laya-vision": {
+          "device": "cpu",
+          "generative": false,
+          "model": "thaitea/laya-vision",
+          "parameters": "201M",
+          "runtime": "python/laya",
+          "threads": 1,
+          "max_concurrency": 1,
+          "max_queue": 8
+        }
+      },
+      "capabilities": [
+        "choice",
+        "score",
+        "noul",
+        "vision"
+      ]
+    }
+  },
+  "synthetic_inference_executed": true,
+  "elapsed_s": 22.632,
+  "output": {
+    "detections": [],
+    "decisions": [
+      {
+        "action": "visual_assessment",
+        "reason": "Image inspectability probability: 0.3431 (Laya noul score; advisory, not a spatial detection).",
+        "source": "laya"
+      }
+    ],
+    "text": "",
+    "warnings": [],
+    "embedding": null
+  },
+  "authorization_header_sent": true,
+  "authentication_enforcement_tested": false,
+  "tested_at": "2026-10-17"
+}