VEP P1 — Build Log

===================================================================== STOOD UP

Git repo at /root/vep (branch main), .gitignore, pytest.ini, requirements.txt.
Postgres 16 + pgvector (pgvector/pgvector:0.7.0-pg16) container, internal only, with healthcheck. Append-only event_log, dead_letter, actor, tenant tables. Row-level security (RLS) enabled; app connects as least-privilege 'vep_app' so RLS actually applies (superuser bypasses RLS — this was the key fix).
FastAPI app (python:3.12-slim) container on vep_net; /health, /events (GET list, POST ingest with validation -> dead-letter on failure). Provenance fields (actor_id, raw_ref, confidence DOUBLE PRECISION, create_capture) enforced.
Forgejo (codeberg.org/forgejo/forgejo:10.0.3) container, sqlite, on vep_net; published 127.0.0.1:3000 + host 2222->22.
Caddy (host) routes added: git.* -> 3000, api.* -> 8000, preserving erp.* + agent.*.
spine_check.py CI gate + .forgejo/workflows/ci.yml (runs boundary tests + spine-check).

Boundary tests: 4/4 PASS (tenant isolation via RLS, no-unvalidated-row dead-letter, provenance required, append-only privilege layer). Run in-net against postgres:5432.
spine-check: FAILS a code change with no JL justification (exit 1); PASS on clean tree.
Running stack end-to-end (internal + via Caddy with tls internal): /health -> {"status":"ok","product":"VEP","phase":"P1"} POST /events (valid) -> {"id":N,"status":"recorded"} w/ provenance POST /events (no actor_id) -> 422 + dead-letter (no silent loss) /events -> lists recorded events with full provenance git.mangoopsdesign.com -> 200 (Caddy -> forgejo)
ERPNext on 8080 left UNTOUCHED (it is a live service, not a stray container).

DNS: add A records for api.mangoopsdesign.com and git.mangoopsdesign.com -> 177.7.40.244. Once they resolve publicly, Caddy auto-issues Let's Encrypt certs and the edge goes live on real TLS. Until then, Caddy logs ACME NXDOMAIN errors (harmless; retries).
Secrets: .env uses dev passwords. Before any real tenant, set strong PG/vep_app secrets and consider moving Forgejo to postgres at P6.
P0 falsification (gst_p0_falsification.md) still not run — per the spine, P0 should have preceded this. Build proceeded in parallel (user directed "proceed"); if P0 kills an assumption, the build gets pruned, not wasted (it is small + reversible).

Up: cd /root/vep && docker compose up -d
Test: docker run --rm --network vep_vep_net -v /root/vep:/app -w /app
-e DATABASE_URL=postgresql://vep_app:vep_app@postgres:5432/vep
-e DATABASE_ADMIN_URL=postgresql://vep:vep_dev_pass@postgres:5432/vep
python:3.12-slim bash -c "pip install -q -r requirements.txt >/dev/null 2>&1; python -m pytest -q"
Down (keeps data): docker compose down
Down (wipe): docker compose down -v (DESTRUCTIVE — not run; blocked earlier)