spec(nats): accounts + leaf-topology v0 — adopt the real design (retire the WSL2-hack leaf)

pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md

@@ -1835,3 +1835,9 @@ b8cea26c8\ that added it to the top-level equired\ array). (2) PMOVES-pinokio PR
 - `2026-08-09T22:05:00Z` CLAIM+RELEASE `5090-CLAUDE (Claude Fable 5)` scope: **Signing is a claim — stepped into the lane, swept the grep dirt, and signed for real.** Operator anchor: messages 2026-08-09 17:32-17:33 EDT, 5090 session ("signing is a claim and a lane that may be easy to step into quick with a bunch of grep dirt hanging on... operator claims and quotes need to be anchored... always a reference" — hedged in the next breath to "almost always usually mostly often": a strong default, not dogma). **Discovery that changes the default:** the signing passphrase IS present in this node's shared env and `make -C pmoves sign-trail` works — produced a real `HMAC-SHA256` receipt (kid `chit-signing-v01`, hmac `XlKmNmOhU1YeBXccyFMJElz7/jJuCh3aczySTZaXRN4=`, payload at `pmoves/docs/logs/graphiti_signed_latest.json`). The register's **87 "unsigned-local (no signing passphrase)" disclaimers** are therefore a process gap, not a material gap — at least on 5090, and likely on any node whose env is funneled. Sessions should attempt `sign-trail` before writing the disclaimer. **Grep-dirt survey (identity drift):** 12+ signature-id variants including case splits `4090-CLAUDE`(17)/`4090-claude`(8), `Mavis`(37)/`Mavis-5090`(11), and the order-swap `SPARK-KIMI`(8)/`KIMI-SPARK`(5) — the same agent greps as two. Recommendation (not claimed): canonicalize ACK ids against `pmoves/config/agent_signatures.yaml` casing; `make naming-drift-check` already exists and is the natural home for a warn-only rule. **Fixed this entry:** the 2026-08-08 `Mavis-verifier` row was shell-mangled (backticks -> backslashes/U+0082, leading chars eaten) which made it **invisible to the anchored-bullet pattern both lane sweeps grep for** — repaired in place with a provenance note; visiting-agent append tooling should quote entries or write via a file, never through shell interpolation (the same class that ate part of this wave's own submodule commit message). **Anchoring protocol adopted:** operator claims/quotes carried into docs and memory get a reference (timestamp + session at minimum) — Three-Body's memory body IS the reference, not ceremony; hedge acknowledged. SPARK MCP-audit handoff updated accordingly with message-level anchors. Three-body: delivery=5090-CLAUDE (Claude Fable 5), control=DARKXSIDE (17:32 directive + live steer), memory=this trail + the signed payload + Cipher. CHIT trail **SIGNED** via `make sign-trail` (receipt above). agent_signature: `ACK::5090-CLAUDE-FABLE5::SIGNING-LANE-SWEEP-2026-08-09`.
 
 <!-- GRAPHITI_MARK: 5090-CLAUDE::SIGNING-LANE-SWEEP::2026-08-09 -->
+
+## z890 — NATS accounts + leaf-topology ADOPTION (operator go 2026-08-08)
+
+- `2026-08-08T17:00:00Z` CLAIM `Z890-CLAUDE` scope: **Operator adopted the NATS accounts + leaf-topology v0 spec + wiring the PMOVES-nats-server fork** (decision after a git forensic proved there's no coherent leaf in prod — the March-2026 WSL2-hack leaf ossified via file-persistence; current CATALOG.md topology is standalone brokers + KVM4-2 hub, NOT leaf-federated; the fork was decorative). **Slices landed (draft PRs, operator merge gate):** (1) spec **#2492** (`feat/nats-accounts-leaf-topology`); (2) fork submodule **#2493** (`feat/wire-nats-server-submodule` — registers `PMOVES-nats-server` at repo root, upstream-clean, gitlink d9dd620b); (3) this rollout runbook + claim (`pmoves/docs/operations/NATS_LEAF_TOPOLOGY_ROLLOUT_RUNBOOK.md`, on **#2492**). **Gates (operator/tooling, do NOT bypass):** `nsc` not installed on z890 (Phase-1 mint blocker); custody decision per #1901 (file-mounted Docker secret v0 → CHIT-vault follow-up); `secrets_manifest.yaml` entries via example→manifest→funnel (zero-access, operator adds); Known-Road compose/Dockerfile swap (flag-launched→fork image + 7422 listener + publish 7422); cross-node access for EDGE(jetson)/CLOUD(kvm) leaf attach. **z890 next (actionable, no gate):** `pmoves-nats-mcp` §7b packaging (Dockerfile/compose/examples, creds-optional CHIT-signed publish) + `PMOVES-nats-server` §7a config templates (`conf/pmoves-nats.conf` placeholder resolver, thin Dockerfile) — no secrets, JWTs render at funnel time. **Also this session:** infra.mk `docker-prune-all` parity fix **#2480** (auto-merge armed, needs 1 review approval). **Village Rule — NATS lane is z890-owned; coordinate before overlapping.** Converges with 4090's `validate-command-anchors` ratchet #2488 (guards the documented-command drift this lane must not reintroduce). **Three-body:** delivery=Z890-CLAUDE, control=DARKXSIDE (merge gate + the 5 gates above), memory=this trail + #2492/#2493/#2480 + spec + runbook. **CHIT trail unsigned-local.** agent_signature: `ACK::Z890-CLAUDE::NATS-LEAF-ADOPT-CLAIM-2026-08-08`.
+
+<!-- GRAPHITI_MARK: Z890-CLAUDE::NATS-LEAF-ADOPT-CLAIM-2026-08-08 -->

pmoves/docs/operations/NATS_LEAF_TOPOLOGY_ROLLOUT_RUNBOOK.md

@@ -0,0 +1,77 @@
+# NATS Accounts + Leaf-Topology — Rollout Runbook
+
+**Companion to:** `pmoves/docs/specs/nats-accounts-leaf-topology-v0-spec-2026-08-07.md`
+**Decision:** 2026-08-08 — operator adopted the spec + wiring the `PMOVES-nats-server` fork.
+**Owner:** z890-claude (KEYSTONE, infra). **Merge gate:** DARKXSIDE (Control).
+
+This turns the spec's §9 phases into a gated, independently-testable sequence. Each phase names
+what is **actionable now** vs. what is **operator-gated** and why. Nothing here bypasses a gate.
+
+---
+
+## Why (one paragraph)
+
+A git forensic (2026-08-08) established there is **no coherent leaf in production**: the `nats-leaf`
+pattern was a 2026-03-19 WSL2 Docker-routing workaround (#1034) that was reverted 3 days later
+(`feafffae6`) but whose config files persisted and got copied into every later "leaf" (none ever
+worked — `elder-melchor-leaf.conf` even targets client port 4222, not a 7422 leaf port). The current
+documented topology (`CATALOG.md`) is a hub-and-spoke of **independent standalone brokers on KVM4-2**,
+explicitly **not** leaf-federated. This lane builds the *real* leaf trust model for the first time.
+
+---
+
+## Status board
+
+| Slice | State | Gate |
+|-------|-------|------|
+| Land the design spec (#2492) | **done** (draft PR) | operator merge |
+| Wire fork as submodule (#2493) | **done** (draft PR) | operator merge |
+| This runbook + AGNOTE claim | **done** | operator merge |
+| Phase 1 — mint nsc operator/accounts/users | **blocked** | `nsc` not installed on z890; custody decision (#1901) |
+| Phase 2 — hub: fork config + `leafnodes{7422}` + SYS | blocked on P1 | Known-Road compose/Dockerfile (operator-auth) |
+| Phase 3 — migrate CORE services → `.creds` | blocked on P2 | Known-Road compose |
+| Phase 4 — EDGE leaf (nano-1 @ 7422) | blocked on P2 | cross-node access (jetson) |
+| Phase 5 — CLOUD leaf (KVM) | blocked on P2 | cross-node access (Hostinger) |
+| Phase 6 — `pmoves-nats-mcp` → CORE `.creds` + CHIT-signed publish | **partly actionable** | packaging now; `.creds` wiring on P1 |
+
+---
+
+## The gates (what the operator/tooling must clear before deeper slices)
+
+1. **`nsc` install** — Phase 1 mints Operator `PMOVES` → 4 Accounts (SYS/CORE/EDGE/CLOUD) → user
+   `.creds`. `nsc` is not on z890. Install is the critical-path unblocker for everything after slice 3.
+2. **Custody decision (#1901 precedent)** — spec §3/§8: v0 = **file-mounted Docker secret** for the
+   nsc operator seed + `.creds` (the `_FILE` convention across `pmoves/services/**`); CHIT-vault custody
+   is the documented follow-up. **Final custody choice is the operator's** per #1901 §7 — confirm before minting.
+3. **`secrets_manifest.yaml` entries (§8)** — zero-access under damage-control. Operator adds the new
+   secret IDs via the **example → manifest → funnel** pipeline (never hand-edit `env.shared`).
+4. **Known-Road compose/Dockerfile/config** — the hub service swap (flag-launched → fork image with
+   accounts + 7422), publishing 7422, and the leaf `.conf` edits are operator-authorized Known-Road domains.
+5. **Cross-node access** — Phases 4–5 attach jetson (EDGE) and a KVM (CLOUD) as leaves; needs those nodes.
+
+## Actionable now (no gate)
+
+- **Phase 6a packaging** for `pmoves-nats-mcp` (§7b): add `Dockerfile`, a CORE-bound compose stanza,
+  `examples/` (raw + signed publish, subscribe) — the `.creds` auth path is written creds-optional
+  (back-compat raw publish per spec §7b.2) so it lands before minting; flip to CORE `.creds` at P1.
+- **Fork config templates** in `PMOVES-nats-server` (§7a): `conf/pmoves-nats.conf` with `${...}`
+  placeholders for `resolver_preload` (rendered at funnel time), a thin Dockerfile (stock
+  `nats-server` + baked conf + entrypoint that templates the resolver), `examples/` leaf-attach demo.
+  These carry **no secrets** — the account JWTs are public and render at funnel time; the seeds/`.creds`
+  stay file-mounted secrets.
+
+## Acceptance tests (spec §10 — run per phase)
+
+Leaf handshake at 7422 (4222 refused) · EDGE isolation (CORE-private subject denied) · export
+round-trip (`mesh.gpu.status.v1` ↑, `image.gen.request.v1` ↓) · two-layer trust (signed
+`tokenism.prosodic.bpm.v1` accepted, unsigned crosses transport but fails CHIT verify) · MCP signed
+publish · SYS-guarded monitoring (`:9223` needs SYS creds) · cred rotation emits
+`tokenism.credential.rotated.v1`.
+
+## Coordination
+
+- **z890 (me):** slices 1–3 done; Phase 6a packaging + fork config templates next (actionable).
+- **operator (DARKXSIDE):** install `nsc`, confirm custody (#1901), add manifest entries, authorize the
+  Known-Road compose swap.
+- **4090's anchor ratchet (#2488)** now guards documented-command drift — the hub runbook commands here
+  must resolve (GHOST_TARGET/PATH), which keeps this doc honest as the config lands.