85d495dd16
- add batch-scoped reconcile_runs persistence and queries - route batch detail and reconcile writes through batch_id/host_id - refresh production boards with host-scope acceptance artifacts - include latest real-host acceptance evidence for self_service and subscription
2026-05-18 redeploy host validation
Host redeploy
- Host root: /tmp/sub2api-host-validation-redeploy
- Secure credentials file: /tmp/sub2api-host-validation-redeploy/credentials.env
- Secure init note: /tmp/sub2api-host-validation-redeploy/INIT.md
- App URL: http://127.0.0.1:18087
- CRM validation server URLs: http://127.0.0.1:18088 and http://127.0.0.1:18089
Initialization facts
- Admin email is fixed as admin@sub2api.local
- This redeploy used an explicit ADMIN_PASSWORD (stored only in credentials.env), not auto-generated-once logging
- Fresh host init did not create normal users; Hermes created dedicated relay-self / relay-sub ordinary users after admin login
Verification matrix
- Fresh self_service import with ordinary user key still failed initially
- Evidence: 01-self-import-initial.json / 02-self-access-preview-initial.json / 03-self-access-status-initial.json
- Result: /v1/models returned 403 while the key had no group binding and the user had zero balance
- After binding the ordinary self key to the imported standard group and setting user balance=10
- Evidence: 04-self-after-balance.headers.txt / 05-self-after-balance.body.json
- Result: /v1/models returned 200
- For subscription validation, Hermes created a dedicated subscription-type group by copying accounts from the imported openai group, assigned a subscription to the ordinary relay-sub user, then bound the relay-sub key to that group
- Evidence: 08-subscription-group-state.json
- Result: /v1/models returned 200 with zero user balance
- Evidence: 06-subscription-after-assign.headers.txt / 07-subscription-after-assign.body.json
Conclusion
- Fresh host initialization alone is insufficient; ordinary users and their keys must be created explicitly
- Probe success depends on the full tuple: ordinary user + key/group binding + a valid billing path
- For standard/self_service groups, a funded user balance was required in this redeploy
- For subscription groups, an active user subscription plus key/group binding was sufficient in this redeploy