# Estate Handoff — leaksnipe.win (for Copilot architectural research)
Prepared by Truffle (Muse), 2026-10-25 ~01:40 ET, at Mauro's request.
Everything below is verified against the live account unless marked as a report.
No credentials are in this document; none are needed for research.

## The estate in one paragraph
Mauro Fanelli (solo builder/trader, Fairfield CT) runs a 64-Worker Cloudflare
estate on one account as the edge for: BTC prediction-market trading tooling
(Kalshi/Coinbase/Polymarket data, BRTI), a poker-analytics platform (LeakSnipe),
a multi-agent mesh (Muse "Truffle" on a VM, Grok on his Windows PC "TUF",
Gemini, plus phone/glap nodes on Tailscale), Solana DEX tooling, and small
price trackers. Domain: leaksnipe.win (zone plan: Pro Website). Account ID
f226035af09775dbffd7e6350adc8a12 · zone ID 555da76dd9b791fdb1e6ff8e33c88e5d.

## UVIX — the cross-compatibility framework (load-bearing)
- Every service has a canonical ID `uvix:<slug>`; slug = the host's subdomain
  label(s) under leaksnipe.win, verbatim, hyphen-joined (apex = uvix:apex).
- Registry of record: a JSON manifest in Workers KV (namespace
  9bf773b24d3c40c3b11d34b484007a84, key `uvix:router:universal_mesh_v1`),
  currently v1.3.4, 109 entries: host → worker/tunnel/external target.
- The same ID names the mesh entry, repos, workers, and services across
  GitHub/GitLab/Cloudflare/DNS — new services are born with their slug.
- Human rendering: UVIX_SLUG_REGISTRY.md (served at /registry.md on the
  handoff endpoint). Live copy of the manifest at /manifest.json there.
- A router worker (uvix-edge-router) fronts the mesh hostnames; as of tonight
  it performs NO auth check (see "Tonight" below).

## Worker build standards (mandatory, Mauro's rules)
Smart Placement ON · observability locked ON via settings (logs+traces,
persist, head sampling 1) — never dashboard toggles · cache read-heavy
slow-changing responses at the edge, never per-request decisions or auth'd
responses · storage tiers: KV + live D1 = hot, D1 history = warm, R2 = cold.

## Tonight (2026-10-24 evening) — what changed, all owner-directed
1. ALL Cloudflare Access applications deleted (26) — the estate is currently
   UNGATED at the Access layer. Only Warp Login + App Launcher platform apps
   remain. Auth will be rebuilt later as a fresh design (one service-token
   scheme for agents is the leading candidate). The suite MCP had been locked
   out for agent clients by a browser-login Access app; that was the trigger.
2. UVIX router bearer gate removed in code and redeployed (backup kept;
   key binding retained unused for a future rebuild).
3. New hostnames: dex-direct.leaksnipe.win (clean alias for the DEX rug
   checker), pump.leaksnipe.win (new pump.fun helper, below).
4. A zone cache rule edge-caches ladder.leaksnipe.win GETs for 60s — the
   ladder worker serves a cached window refreshed on a 3-min cron, so polls
   collapse at the edge: invocations fell from ~1,460 to 18 per 20-min window.
5. Dead cron trigger removed (vvv-price-alert; its watched product ended).
6. Manifest swept to match reality: access flags stripped (v1.3.3), dex
   entries added (v1.3.2), pump added (v1.3.4).

## The live architectural problem: surviving the Workers FREE plan
A $84.77 Workers invoice is unpaid; if unpaid by **Oct 26, 2026** the account
drops from Workers Paid to Free. Verified free-plan caps (Cloudflare docs,
"Account plan limits" — all ACCOUNT-scoped, never per-zone):
100k requests/day · 10 ms CPU · 50 subrequests/request · 5 cron triggers per
account · KV 100k reads/1k writes per day · D1 5M reads/100k writes per day ·
DO free: 100k req/day, 13,000 GB-s/day, SQLite-backed classes only ·
R2 10 GB, egress free on all plans.
Measured estate state:
- ~150,700 requests/day before tonight's ladder cache fix → ~47k/day projected
  after. kalshi-ladder-worker alone was ~105,800/day (poll traffic).
- All 7 Durable Object namespaces are already SQLite (`use_sqlite: true`) —
  FeedDO (price proxy), poker WorkflowStatusDOs, MemoryDurableObject,
  ArbitrageDesk, 2× MyContainer. No migrations owed.
- 8 cron triggers remain (ladder 3-min, scalper 1-min, price-proxy 1-min,
  kodak-archiver 1-min, kodak-collector 5-min, muse-mcp 5-min warmer,
  mem-gateway daily, leaksnipe-files hourly). A cut to 5 is staged as a
  script, not fired — it only binds on an actual downgrade.
- dex-rugcheck (Solana rug checker) makes ~136 RPC calls per check — over the
  50-subrequest free cap. Fix is code-side JSON-RPC batching (Grok's worker).
- Containers (2 template workers) are paid-only; non-production.
Full analysis: /plan.md on the handoff endpoint.

## Dead ends — do not re-research these
- "One free zone per subdomain to multiply quotas": quotas are account-level,
  and Cloudflare refuses subdomain zone creation on this account (API error
  1116, verified live; subdomain setup is Enterprise-only). Tested tonight
  with the owner's explicit OK.
- Grok's 14k-char roadmap built on that premise is superseded by /plan.md.
- Workers cannot be hosted "on" a *.ts.net hostname; ts.net is Tailscale's
  zone. The tailnet pattern that works: local services behind
  `tailscale serve` (e.g. the planned svc:grokdex on the TUF fronting the
  rug checker so agent traffic never touches public DNS or the Workers meter).

## Key services (all currently reachable without auth)
- leaksnipe-suite (workers.dev) — 78-tool agent MCP (poker, GitHub/GitLab,
  Cloudflare ops). NOTE: an Oct 20 build had 94 tools incl. Tailscale admin;
  rollback is blocked by a secret-drift guard and is the owner's call.
- muse.leaksnipe.win/mcp — 23-tool BTC market-data bridge (via UVIX router).
- dex.leaksnipe.win + dex-direct.leaksnipe.win — Solana rug checker
  (GET /api/check?q=<mint>, ~45-55s per check, some mints return 422).
- pump.leaksnipe.win — NEW pump.fun helper: /api/new, /api/live,
  /api/coin/<mint> (mcap, ATH distance, bonding-curve progress, DexScreener
  pair). Source: ~/workspace/network/pumpfun-helper/ on Truffle's VM.
- Trackers: tao / near / gtc .leaksnipe.win (oracle-first doctrine: Pyth/DIA,
  no CoinGecko, no CEX tape for spot).
- memgw.leaksnipe.win — claude-mem shared-memory gateway (X-Mem-Key header;
  search returns index rows only). mem.leaksnipe.win and db.leaksnipe.win
  origins run on the TUF and are currently DOWN (530/502) — box-side, not auth.

## Standing constraints for any proposal
- Free / open-source / self-hosted first; complete control of the whole path;
  no new paid services, no new custodians.
- Never edit the WECFM Orchestrator trading code (separate repo, owner's).
- No git push and no Cloudflare write without the owner's OK for that
  specific change; back up before writes; never print secret values.
- Manual trade execution only — nothing in this estate may place trades.
- Data doctrine: Pyth/oracle feeds for spot; settlement on Kalshi/Coinbase
  strike-band BTC = 60-second average of CF BRTI pre-expiry.

## Research questions where Copilot's cycles are welcome
1. Free-plan request economics beyond the ladder fix: which remaining
   pollers (~47k/day projected) can move to push (DO WebSocket hub) or to
   the tailnet without losing freshness that matters?
2. DO alarms as cron substitutes under the 5-trigger cap: patterns,
   failure modes, DO free-budget math (100k req/day, 13k GB-s/day).
3. JSON-RPC batching design for a ~136-call Solana rug check to fit a
   50-subrequest cap (batch endpoints, multicall-style packing).
4. Auth rebuild design: one service-token scheme for heterogeneous agent
   clients (MCP HTTP, curl, browser) that cannot lock agents out the way
   browser-login Access apps did.
5. CPU-10ms survival: which fan-out workers (suite, edge-proxy-gemini)
   risk 1101s on free, and what shedding/caching patterns apply?

— End of handoff. The handoff endpoint itself expires ~2h after issue.