Session handoff — state of the build (2026-09-16, pre-compaction)

Read this first after context loss. Everything below is verified unless marked otherwise. Decision log: DECISIONS.md (D001–D042). Architecture: docs/multiuser.md, PLAN.md.

Live right now

Surface	Where	Status
Site + docs + favicon	`https://aquila.exaflair.com` (Vercel, CI from `main`)	✅ 200
Relay VPS	`root@139.84.174.202` (fresh, dedicated) — Caddy + wildcard on-demand TLS	✅ installed (`deploy/relay/install-relay.sh`)
Reverse tunnel	dev machine → relay: `deploy/relay/tunnel.sh` (uses exaflair key, `IdentitiesOnly`)	✅ relay→manager 200
POC stack	this machine: `manager` (healthy), `gateway` (LiteLLM), `gateway-admin`, `telegram` (poll, @AquilaAssistantBot), `searxng`, bot `aquila-bot-day1check` (~30MB)	✅
Inference	OpenCode Zen primary (`deepseek-v4.1-flash`, `x-opencode-session` headers) → OpenRouter free fallback; per-bot keys + ₹ budgets + spend log	✅ live-verified
Wildcard DNS	`*.aquila` still points at the OLD relay (`139.84.146.236`)	⏳ Bhavya: change A record to `139.84.174.202`

After the DNS change: first visit to https://<digits>.aquila.exaflair.com issues the cert on demand (Caddy → manager /internal/tls-ask allowlist → Let's Encrypt HTTP-01). Verify with: curl -sI https://919876543210.aquila.exaflair.com/ then the welcome page.

Credentials (locations only; values in gitignored `.env`)

.env on this machine: TELEGRAM_BOT_TOKEN, TELEGRAM_BOT_USERNAME=AquilaAssistantBot, OPENCODE_GO_API_BASE=https://opencode.ai/zen/go/v1 + key, OPENROUTER_API_KEY (fallback), AQUILA_INTERNAL_TOKEN, SESSION_SECRET, AQUILA_ENCRYPTION_KEY, demo IMAP (bhavya13sharma01@gmail.com app password — demo tenant only, see D037).
Relay access: ssh -i ~/.ssh/id_ed25519_exaflair root@139.84.174.202 (Bhavya's key; no new keys).
Old relay 139.84.146.236: abandoned; my additive changes reverted (Caddy stopped, ufw rules removed). No tunnel points there.

Verified checkpoints

Day-1: bot → gateway → upstream chat, SSE streaming, spend attribution. All suites green: core 67, gateway 56+e2e, manager 99 (+5 tls-ask), telegram 96+23 e2e.
Telegram bot live (getMe ok, health 200). OpenCode Zen chat live (reasoning model noted: give it token headroom or set reasoning effort where supported).
Manager UI v2 + favicon + English-only copy product-wide (D035).
Relay chain: tunnel 200, tls-ask allow 200 / deny 403, HTTP→HTTPS 308 on the new box.

Next actions (in order)

Bhavya: Hostinger → *.aquila A record → 139.84.174.202. Then the live link works.
Verify cert + welcome + full OTP flow from a phone; report the live link.
Bhavya: authorize this machine's id_ed25519_exaflair.pub key on node-b2 (cnsku-18@100.113.233.14) → migrate stack + tunnel there as systemd units (D042); it becomes the always-on host. Then retire the dev-machine tunnel.
Day 3: density test (≥10 bots on an 8GB slice) + docs/economics.md (₹/bot verdict at ₹250).
Day 4: demo script + recording (docs/demo-script.md), K8s mapping handoff for Rohan.
Post-POC: WhatsApp official notification-only; UPI billing; deepseek direct paid for production.

Operational notes / lessons