# DNS and deploy steps

**Status:** EXECUTED (Worker config on `main`; live publish is the OAuth deploy, not this VM)  
**Schema:** `aziel.unseal-site.v1`  
**Shell:** `TimeToUnsealTheBook.html`  
**Author:** Aziel Eliab  
**License:** Apache-2.0  
**Date noted:** 2026-10-24  
**Config committed:** 2026-10-31  

The domain is purchased. This repository now carries the Cloudflare Workers Static Assets config. `decryption_complete` stays false. The first public test tip stays **open**. The prep chain head is the existing receipt tip (count 60). This note does not append a public test anchor and does not mark decryption complete.

Cap-7 is not an ICANN registration (`public_icann` is not a field in this repo). Paid satellite stays held. No IP gate. No Node Gate.

## Host facts

| Fact | Value |
| --- | --- |
| Zone | `TimeToUnsealTheBook.net` |
| Nameservers | `mustafa.ns.cloudflare.com`, `virginia.ns.cloudflare.com` |
| Worker name | `timetounsealthebook` |
| Config | `wrangler.jsonc` |
| Assets | Repository root (`.`). `index.html` is a symlink to `TimeToUnsealTheBook.html` |
| Custom domains | `timetounsealthebook.net`, `www.timetounsealthebook.net` (`custom_domain: true`) |
| TLS | Cloudflare Custom Domains (certificate when the hostname attaches) |
| Publish | Not run from this VM. Cos / VoynichBot: `env -u CLOUDFLARE_API_TOKEN wrangler deploy` |

Hostnames in Wrangler are lowercase. The DNS zone name may display as `TimeToUnsealTheBook.net`.

## 1. Domain

Purchased. Registrant identity on any public WHOIS stays **Aziel Eliab / GodLock.AZ**. No legal name. No personal or county location. This repository did not buy the name and does not spend money.

## 2. DNS

Nameservers for the zone are `mustafa.ns.cloudflare.com` and `virginia.ns.cloudflare.com`. Custom Domains on the Worker create the apex and `www` records at deploy time. This commit does not call the Cloudflare API.

No extra names for gates, panels, or operator tools.

## 3. How the shell is served

Cloudflare Workers with Workers Static Assets. Not Pages.

`wrangler.jsonc` sets `assets.directory` to the repo root so `/TimeToUnsealTheBook.html`, `data/`, `corpus/`, and `receipts/` are the same paths the shell already reads. `/` serves `index.html`, which points at `TimeToUnsealTheBook.html`. `src/worker.mjs` runs first for the HTML shell, `GET /v1/unseal-counters`, and `GET /receipts/sources/*`. It counts those hits when the optional `UNSEAL_HITS` KV binding is present. It does not proxy mesh JSON, does not open a lattice wrap, and has no IP gate and no Node Gate panel. Without the KV binding the counter route returns `complete: false` and invents no number.

Local preview is still:

```bash
python3 -m http.server 43123
```

Open `http://127.0.0.1:43123/TimeToUnsealTheBook.html`. That loopback server is not the public deploy.

## 4. First public test chain

The lattice tip stays **open** until both of these are true:

1. `TimeToUnsealTheBook.net` resolves and serves the shell.
2. The first public test is chained.

Until then, `TimeToUnsealTheBook.html` keeps `ledger_entry_hash` empty and `tip` at `open`. This document does not append an anchor. Receipt-index flags `domain_launched`, `dns_changed`, and `deploy_executed` stay false. The shell treats those flags as a chain error. `decryption_complete` stays false.

When that first run is actually chained, it is an existing `aziel.lattice.anchor.v1` object:

| Field | Value |
| --- | --- |
| `schema` | `aziel.lattice.anchor.v1` |
| `kind` | `timetounsealthebook.test_run` |
| `author` | `Aziel Eliab` |
| `carrier` | `AzielTether` |
| `unseal.site_schema` | `aziel.unseal-site.v1` |
| `unseal.decryption_complete` | `false` |

Before that run executes, re-read every earlier public receipt the test cites (`GET /receipt/{id}` and, when a library record is named, `GET /v1/document-chain?record_id=`). If a run for that `test_id` already exists, the anchor’s `next_test` names a different test. The confidence percent is structural progress only. The overclaim cap stays on the anchor:

> Tests advance structural progress; they do not assert decryption complete.

Active-node counts are not written into the anchor. The public count remains the live `live_nodes` read.

## 5. Do not

These stay in force through purchase, DNS, hosting, and the first chain:

- Do not add an IP gate.
- Do not add a Node Gate panel.
- Do not read, show, or store `node_gate` or `get_is_node_gate`.
- Do not add operator tooling on the public surface.
- Do not set `decryption_complete` to true, and do not claim decryption is complete.
- Do not invent user counts. Show `live_nodes` from `GET https://www.azielcorpuslibrary.net/v1/mesh` (mirror: `GET /runtime/v1/mesh`) or leave the count unavailable.
- Do not publish a legal name or a personal or county location. Public identity is Aziel Eliab / GodLock.AZ.
- Do not create a private store for views, downloads, tests, or lattice entries.
- Do not treat Cap-7 as an ICANN name or a public egress address. Paid satellite stays held.
- Do not treat a local preview as a live site.

## What this note did

Recorded the purchased zone, nameservers, Worker name, and custom-domain config. The live `wrangler deploy` is still the OAuth step. The first public test tip is still open.