Merge pull request #12 from FilipBl4gojevic/feat/mainnet-cutover-docs

Mainnet cutover complete: both hosted instances run the keyless build (deployed 2026-07-31)

README.md

@@ -15,35 +15,41 @@ Hosted instances run on both networks, exposing all 24 tools:
 | Mainnet | `https://mcp.vector.mainnet.apexfusion.org/sse` |
 | Testnet | `https://mcp.vector.testnet.apexfusion.org/sse` |
 
-> **Deployment status differs by network.** Testnet auto-deploys from `main` on every merge, so
+> **Deployment status: both networks are current.** Both hosted instances run today's
-> it tracks this codebase closely. **Mainnet stays on its last custodial image until a
+> completed migration: testnet since the 2026-07-31 morning merges (auto-deployed from
-> deliberate cutover deploy ships** - that deploy is a separate, future step, not automatic and
+> `main`), mainnet since a deliberate cutover deploy the same day (see
-> not implied by any merge (see [docs/architecture/non-custodial-split.md](docs/architecture/non-custodial-split.md),
+> [docs/architecture/non-custodial-split.md](docs/architecture/non-custodial-split.md), section
-> section 11, "Rollout"). Until it ships, treat the mainnet instance's signing tools as
+> 11, "Rollout", for the full history). **Both hosted instances currently require a bearer
-> custodial: assume they may still accept a mnemonic as a tool-call parameter, and prefer
+> token from the operators to connect** - that is an access control, not a custody one:
-> self-hosting this release or the testnet instance instead.
+> neither instance accepts a mnemonic from any caller, token or not. Open public access
+> (per-IP rate limiting, no token required) is a planned follow-up, not yet shipped. Self-host
+> this release for tokenless access today.
 
-Connect from Claude Code in one command (testnet shown - swap in the mainnet URL once the
+Connect from Claude Code in one command. Both hosted instances require a bearer token from the
-cutover deploy described above ships):
+operators (contact the Apex Fusion team for one):
 
 ```bash
-claude mcp add --transport sse vector-mcp https://mcp.vector.testnet.apexfusion.org/sse
+claude mcp add --transport sse vector-mcp https://mcp.vector.mainnet.apexfusion.org/sse \
+  --header "Authorization: Bearer <your-token>"
 ```
 
-> **Security notice: as of this release, the non-custodial migration is complete in this
+Self-hosting (below) needs no token and gives every caller open access to your own instance.
-> codebase.** No tool in this repository accepts a mnemonic, private key, or any other key
+
-> material. Every `build_*` tool constructs an unsigned transaction from a wallet *address*
+> **Security notice: the non-custodial migration is complete, in this codebase and on both
-> only, and every signing operation happens locally on your own machine, through the local
+> hosted instances, as of the 2026-07-31 cutover deploy.** No tool in this repository accepts a
-> signer companion. Broadcast the signed result with `vector_submit_transaction` - your seed
+> mnemonic, private key, or any other key material. Every `build_*` tool constructs an unsigned
-> phrase never leaves your machine, and no server running this release ever holds one. This is
+> transaction from a wallet *address* only, and every signing operation happens locally on your
-> enforced mechanically in the code, not just by convention: the builder's custody boundary test
+> own machine, through the local signer companion. Broadcast the signed result with
-> scans every source file for key-material vocabulary against an allowlist that is now empty and
+> `vector_submit_transaction` - your seed phrase never leaves your machine, and no server
-> pinned at size zero, so a future change cannot silently reintroduce a mnemonic parameter
+> running this release ever holds one. This is enforced mechanically in the code, not just by
-> without failing that test by name.
+> convention: the builder's custody boundary test scans every source file for key-material
-> **This is a claim about the code, not about every deployment of it** - see the deployment
+> vocabulary against an allowlist that is now empty and pinned at size zero, so a future change
-> status note above the connect command, and
+> cannot silently reintroduce a mnemonic parameter without failing that test by name.
+> **This describes this release and the 2026-07-31 deploy specifically** - a later deploy is a
+> separate operational action, not automatically covered by this notice; see the deployment
+> status note above and
 > [docs/architecture/non-custodial-split.md](docs/architecture/non-custodial-split.md) for the
-> full rollout plan.
+> full rollout history.
 
 Self-hosting instructions are below.
 

docs/architecture/non-custodial-split.md

@@ -191,7 +191,7 @@ TDD throughout: failing test before implementation, every PR.
 | **6** | **Family 1 — wallet/tx keyless.** Mnemonics removed; `build_*` tools land ✅ **(landed — this PR)** | **yes** |
 | **7** | **Family 2 — agent registry keyless.** Drops `@ts-nocheck` from `agent-network.ts` ✅ **(landed — this PR)** | yes |
 | **8** | **Family 3 — self-improvement keyless.** Ref-UTxO env config carried over from the custodial code; the suspected CBOR encoding issue closed as no-bug (audit #10, golden-pinned against a live on-chain token) ✅ **(landed — this PR)** | yes |
-| **9** | Mainnet cutover: README, security-page correction, deliberate `workflow_dispatch` | — |
+| **9** | Mainnet cutover: README, security-page correction, deliberate `workflow_dispatch` ✅ **(landed — deployed 2026-07-31)** | — |
 
 **PR 4 is the review that matters.** It is additive, self-contained, and *is* the security boundary. It breaks nothing while it is reviewed.
 
@@ -223,7 +223,7 @@ PR 4 and PR 5 both depend on the workspace split (PR 3) and can proceed in paral
 
 ## 11. Rollout
 
-Testnet auto-deploys on push to `main` (`deploy.yml`) and **is the proving ground** — breaking it from PR 6 onward is expected and useful signal. Mainnet deploys only by manual `workflow_dispatch` and **stays on the last custodial image until PR 9**. This uses the existing CI split as designed; no new infrastructure.
+Testnet auto-deploys on push to `main` (`deploy.yml`) and **is the proving ground** — breaking it from PR 6 onward is expected and useful signal. Mainnet deploys only by manual `workflow_dispatch` and **stayed on the last custodial image until PR 9** ✅ **(cutover deployed 2026-07-31, both networks now run the same image)**. This uses the existing CI split as designed; no new infrastructure.
 
 ## 12. Findings from local verification
 

packages/signer/README.md

@@ -165,10 +165,11 @@ over-counts, which refuses too much rather than too little.
   and the smoke tests above). **Nothing is left open in the code: this was the last custodial
   family.** The non-custodial migration described in
   [`docs/architecture/non-custodial-split.md`](../../docs/architecture/non-custodial-split.md)
-  is complete in this codebase. It is not yet complete on every deployment: the mainnet hosted
+  is complete in this codebase, and as of the 2026-07-31 cutover deploy, on both hosted
-  instance stays on its last custodial image until a deliberate cutover deploy ships (see that
+  instances too: pair this signer with a self-hosted builder, the testnet instance, or the
-  document's rollout section). Until then, pair this signer with a self-hosted or testnet
+  mainnet instance now, since any of them running the 2026-07-31 deploy or later carries the
-  builder if you want the guarantee above to actually hold - not the mainnet one.
+  guarantee above. Both hosted instances currently require a bearer token from the operators
+  to connect - that is an access control, separate from the custody guarantee above.
 
 ## Running it
 
@@ -195,11 +196,10 @@ example):
 ```
 
 Register it alongside the builder so an agent has both sets of tools available. This pairing
-keeps your mnemonic off any server running this release, for every family it exposes: wallet,
+keeps your mnemonic off any server running the 2026-07-31 deploy or later, for every family it
-transaction, smart-contract, agent-registry, and self-improvement alike - as long as that
+exposes: wallet, transaction, smart-contract, agent-registry, and self-improvement alike. Both
-server is actually running this release. The mainnet hosted instance is not, yet: see the
+hosted instances qualify now, and so does any self-hosted deployment of this release. See the
-deployment status note in the root README before assuming this covers it. See the last bullet
+last bullet under Known limitations above for the full evidence.
-under Known limitations above for the full evidence.
 
 ## Testing