Home-only
Reach sleeps when home sleeps. reach.home.public@1 keeps its Ward, Vessel, Workers, corpus, effect ledger, and Phylactery in one home-local ApplicationDeploymentManifest@1, with no VPS, Tether, Veil, public listener, callback, or inbound A2A road.
This profile is Designed, not deployable. State of Work records Reach’s delivery boundary.
The profile admits public corpus/Context and guest effects. Its separated services narrow parser and credential compromise, but do not isolate the body from home-account or Vessel compromise, which may expose private home truth and resident credentials.
Services and roads
Discord edge holds bot token and Gateway/event/delivery observations, without provider credentials, corpus writer, database secret, policy, or ambient Sigil. Core/Ward/Workers hold admissions, task Sigils, Runs, turns, and policy, without bot/provider bearers, non-local listeners, or host control. Corpus refresher holds allowlisted HTTPS and staging custody; the Portal/A2A gate holds only its exact destination credential/attempt custody. Phylactery owns canonical Core/Reach records without a non-local listener or replica.
Gateway WSS and Discord REST, source HTTPS, and exact provider/A2A HTTPS are outbound. Authenticated typed local ports connect services; other ingress is closed. The standalone E2E contract supplies the same corpus, fresh egress, quarantine, turn, nonce, and known/unknown delivery law. Every canonical record commits at home.
Failure and recovery
Reboot resumes safe pre-submit work from Run/outbox truth and reconciles uncertain provider/Discord effects. Reconnect recovers only events Discord still supplies; older missed events have no promised recovery. Power or Internet loss means no cognition, provider/A2A work, or delivery.
Home compromise closes admission, revokes bot/provider/A2A/database/service credentials, and reconciles external identities. Recovery follows the clean-rebuild contract: rebuild a trusted body, restore only independently verified non-secret records from an admitted backup, and reenroll from zero authority before activating a fresh epoch. An off-host backup cannot operate as a second Phylactery.
Acceptance
Prove two-boot public turn, dedupe, corpus citations, per-attempt egress, provider/A2A and Discord uncertainty, service-secret/network isolation, zero non-local listeners, restore, and refusal of private Context, consequential effects, callbacks, inbound peers, or simultaneous epochs.