diff --git a/BUILD_LOG.md b/BUILD_LOG.md
new file mode 100644
index 0000000..6ec1c23
--- /dev/null
+++ b/BUILD_LOG.md
@@ -0,0 +1,56 @@
+# VEP P1 — Build Log
+### What was stood up, verified, and the one outstanding step.
+### Date: 2026-08-07. Status: P1 minimal spine LIVE (internal), edge gated on DNS.
+
+=====================================================================
+STOOD UP
+=====================================================================
+- Git repo at /root/vep (branch main), .gitignore, pytest.ini, requirements.txt.
+- Postgres 16 + pgvector (pgvector/pgvector:0.7.0-pg16) container, internal only,
+  with healthcheck. Append-only event_log, dead_letter, actor, tenant tables.
+  Row-level security (RLS) enabled; app connects as least-privilege 'vep_app' so
+  RLS actually applies (superuser bypasses RLS — this was the key fix).
+- FastAPI app (python:3.12-slim) container on vep_net; /health, /events (GET list,
+  POST ingest with validation -> dead-letter on failure). Provenance fields
+  (actor_id, raw_ref, confidence DOUBLE PRECISION, create_capture) enforced.
+- Forgejo (codeberg.org/forgejo/forgejo:10.0.3) container, sqlite, on vep_net;
+  published 127.0.0.1:3000 + host 2222->22.
+- Caddy (host) routes added: git.* -> 3000, api.* -> 8000, preserving erp.* + agent.*.
+- spine_check.py CI gate + .forgejo/workflows/ci.yml (runs boundary tests + spine-check).
+
+=====================================================================
+VERIFIED (real execution, not claims)
+=====================================================================
+- Boundary tests: 4/4 PASS (tenant isolation via RLS, no-unvalidated-row dead-letter,
+  provenance required, append-only privilege layer). Run in-net against postgres:5432.
+- spine-check: FAILS a code change with no JL justification (exit 1); PASS on clean tree.
+- Running stack end-to-end (internal + via Caddy with tls internal):
+    /health                      -> {"status":"ok","product":"VEP","phase":"P1"}
+    POST /events (valid)         -> {"id":N,"status":"recorded"} w/ provenance
+    POST /events (no actor_id)   -> 422 + dead-letter (no silent loss)
+    /events                      -> lists recorded events with full provenance
+    git.mangoopsdesign.com       -> 200 (Caddy -> forgejo)
+- ERPNext on 8080 left UNTOUCHED (it is a live service, not a stray container).
+
+=====================================================================
+OUTSTANDING (requires USER action — external)
+=====================================================================
+- DNS: add A records for api.mangoopsdesign.com and git.mangoopsdesign.com -> 177.7.40.244.
+  Once they resolve publicly, Caddy auto-issues Let's Encrypt certs and the edge goes live
+  on real TLS. Until then, Caddy logs ACME NXDOMAIN errors (harmless; retries).
+- Secrets: .env uses dev passwords. Before any real tenant, set strong PG/vep_app secrets
+  and consider moving Forgejo to postgres at P6.
+- P0 falsification (gst_p0_falsification.md) still not run — per the spine, P0 should have
+  preceded this. Build proceeded in parallel (user directed "proceed"); if P0 kills an
+  assumption, the build gets pruned, not wasted (it is small + reversible).
+
+=====================================================================
+HOW TO RE-RUN / TEARDOWN
+=====================================================================
+- Up:   cd /root/vep && docker compose up -d
+- Test: docker run --rm --network vep_vep_net -v /root/vep:/app -w /app \
+         -e DATABASE_URL=postgresql://vep_app:vep_app@postgres:5432/vep \
+         -e DATABASE_ADMIN_URL=postgresql://vep:vep_dev_pass@postgres:5432/vep \
+         python:3.12-slim bash -c "pip install -q -r requirements.txt >/dev/null 2>&1; python -m pytest -q"
+- Down (keeps data): docker compose down
+- Down (wipe): docker compose down -v   (DESTRUCTIVE — not run; blocked earlier)
diff --git a/compose.yml b/compose.yml
index 2cf9820..53cfa07 100644
--- a/compose.yml
+++ b/compose.yml
@@ -7,6 +7,11 @@ services:
       POSTGRES_USER: ${PG_USER:-vep}
       POSTGRES_PASSWORD: ${PG_PASS:-vep_dev_pass}
       POSTGRES_DB: vep
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${PG_USER:-vep} -d vep"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
     volumes:
       - pgdata:/var/lib/postgresql/data
       - ./schema/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
@@ -23,6 +28,8 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+    ports:
+      - "127.0.0.1:8000:8000"   # loopback only; Caddy proxies publicly
     networks: [vep_net]
     # NOT published — Caddy proxies localhost:8000.
 
@@ -34,6 +41,7 @@ services:
       FORGEJO__server__ROOT_URL: https://git.mangoopsdesign.com
       FORGEJO__server__APP_DATA_PATH: /data
     ports:
+      - "127.0.0.1:3000:3000"   # loopback only; Caddy proxies publicly
       - "2222:22"        # host :2222 -> container ssh (avoids host :22)
     volumes:
       - forgejo_data:/data