# UVIX Slug Registry — leaksnipe.win

**Status:** LIVE. Manifest v1.3.3 in Workers KV (v1.2.0 written 2026-10-21 under Mauro's directive; v1.3.2 added uvix:dex + uvix:dex-direct 2026-10-24; v1.3.3 stripped all access flags after the Access de-gate).
**KV location:** namespace `9bf773b24d3c40c3b11d34b484007a84`, key `uvix:router:universal_mesh_v1`, account `f226035af09775dbffd7e6350adc8a12`.
**Pre-slug backup (live v1.0.0, 25 entries):** `~/workspace/network/uvix-manifest-backup-pre-slug-2026-10-21.json`.
**Evidence base:** 2026-10-19 estate inventory + 2026-10-20 zone DNS/route pulls, as distilled in the v1.1.0 reissued draft (`~/workspace/goals/nail-down-every-loose-end-today/files/uvix-manifest-reissued-2026-10-20.json`, diff doc beside it). No target in v1.2.0 was invented; every target traces to that evidence.

## The convention

- **Slug formation:** the host's subdomain label(s) under `leaksnipe.win`, lowercased, verbatim. `kodak.leaksnipe.win` → slug `kodak`. Multi-label hosts hyphen-join their labels: `jpgs.web3.leaksnipe.win` → `jpgs-web3`, `x.ai.leaksnipe.win` → `x-ai`.
- **One special case:** the apex host `leaksnipe.win` itself takes slug **`apex`** (it has no label; `apex` is the DNS term of art and cannot collide with a subdomain label in this zone).
- **Canonical ID form:** `uvix:<slug>` — e.g. `uvix:kodak`, `uvix:apex`, `uvix:muse`. This is the cross-system identifier: the same string names the mesh entry, and is the name new repos, workers, and services should carry from birth so GitHub/GitLab/Cloudflare/DNS all resolve from one ID (Mauro's cross-compatibility goal).
- **Where the slug is authoritative:** the KV manifest is the registry of record for slug → host → target. This document is a human-readable rendering of the verified KV read-back (generated 2026-10-21 from the live v1.2.0 value). If this file and the KV value ever disagree, the KV value wins and this file gets regenerated — the same rule as the inventory vs. the old manifest: the live layer is truth, documents render it.
- **Entry shape (v1.2.0):** each `subdomain_mesh` entry keeps the legacy fields (`worker`, `slug_path`, `protocols`) untouched and adds `slug`, `canonical_id`, and `target` — an object `{kind: worker|tunnel|external|placeholder, name/id_prefix/service/cname_target, …}` derived only from evidence. As of manifest v1.3.3 (2026-10-24) no mesh host is Access-gated — all Access apps were deleted at the owner's order and the flags were stripped; if auth is rebuilt, gated hosts again carry `access: "cloudflare-access"` and `access_gated: true`. The legacy `worker` string and the `target` object state the same fact twice on purpose: old consumers read the string, slug-aware consumers read the object.
- **What a target means:** the physical thing that actually serves the host today — a worker script name, a cloudflared tunnel (stored as ID prefix, exactly as the inventory recorded it), an external platform service (AI Gateway, Google's `ghs.googlehosted.com`, youtube.com…), or `placeholder` for the two bare-label CNAMEs (`asi1ai`, `payments`) where DNS exists but no verified service sits behind it.

## Slug → host → physical target map (102 entries, verified read-back)

| Canonical ID | Slug | Host | Physical target |
|---|---|---|---|
| `uvix:admin` | admin | admin.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:adobe` | adobe | adobe.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:agentverse` | agentverse | agentverse.leaksnipe.win | worker `edge-proxy-gemini` |
| `uvix:ai` | ai | ai.leaksnipe.win | external `cloudflare-ai-gateway` |
| `uvix:aisearch` | aisearch | aisearch.leaksnipe.win | external `cloudflare-ai-search` |
| `uvix:apex` | apex | leaksnipe.win | worker `leaksnipe` |
| `uvix:api` | api | api.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:arbitrage` | arbitrage | arbitrage.leaksnipe.win | worker `leaksnipe-arbitrage` |
| `uvix:asi1` | asi1 | asi1.leaksnipe.win | external `cloudflare-ai-gateway` |
| `uvix:asi1ai` | asi1ai | asi1ai.leaksnipe.win | placeholder — CNAME → bare label `asi1ai` (no verified service) |
| `uvix:auth` | auth | auth.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:azure` | azure | azure.leaksnipe.win | worker `azure-gateway` |
| `uvix:bridge` | bridge | bridge.leaksnipe.win | worker `edge-proxy-jdwalka` |
| `uvix:btc` | btc | btc.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:cal` | cal | cal.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:calendar` | calendar | calendar.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:claude` | claude | claude.leaksnipe.win | external `cloudflare-ai-gateway` |
| `uvix:connect` | connect | connect.leaksnipe.win | worker `leaksnipe-connect` |
| `uvix:cursor` | cursor | cursor.leaksnipe.win | worker `cursor-agent-mcp` |
| `uvix:d1` | d1 | d1.leaksnipe.win | worker `cloudflare-mcp-d1-connector` [workers-custom-domain] |
| `uvix:db` | db | db.leaksnipe.win | tunnel `63000efe…` (cloudflared, hostname db.leaksnipe.win) |
| `uvix:dev` | dev | dev.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:dex` | dex | dex.leaksnipe.win | worker `dex-rugcheck` (added to manifest v1.3.2, 2026-10-24 — worker live since Oct 23) |
| `uvix:dex-direct` | dex-direct | dex-direct.leaksnipe.win | worker `dex-rugcheck` (alias hostname created 2026-10-24 for Grok/agent access; manifest v1.3.2) |
| `uvix:dia` | dia | dia.leaksnipe.win | worker `dia-proxy` |
| `uvix:docs` | docs | docs.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:doge` | doge | doge.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:drive` | drive | drive.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:eth` | eth | eth.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:gamd` | gamd | gamd.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:gauth` | gauth | gauth.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:gdocs` | gdocs | gdocs.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:gdrive` | gdrive | gdrive.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) — zone routes to worker 'leaksnipe' exist but are never reached (DNS-only) |
| `uvix:gemachine` | gemachine | gemachine.leaksnipe.win | tunnel `36a309a2…` (cloudflared, hostname gemachine.leaksnipe.win) |
| `uvix:gemini` | gemini | gemini.leaksnipe.win | worker `edge-proxy-gemini` |
| `uvix:git` | git | git.leaksnipe.win | external `cloudflare-ai-gateway` |
| `uvix:gitlab` | gitlab | gitlab.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:glap` | glap | glap.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:goog` | goog | goog.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:google` | google | google.leaksnipe.win | worker `edge-proxy-gemini` |
| `uvix:grok` | grok | grok.leaksnipe.win | worker `grok-bot` |
| `uvix:grokbot` | grokbot | grokbot.leaksnipe.win | worker `grok-gateway` |
| `uvix:groups` | groups | groups.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:home` | home | home.leaksnipe.win | worker `leaksnipe-home` |
| `uvix:hub` | hub | hub.leaksnipe.win | worker `wecryp-hub` |
| `uvix:hud` | hud | hud.leaksnipe.win | worker `edge-proxy-gemini` |
| `uvix:hype` | hype | hype.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:inj` | inj | inj.leaksnipe.win | worker `inj-market-info` |
| `uvix:jdwalka` | jdwalka | jdwalka.leaksnipe.win | tunnel `2732a8d6…` (cloudflared, hostname jdwalka.leaksnipe.win) |
| `uvix:jdwalkaz` | jdwalkaz | jdwalkaz.leaksnipe.win | tunnel `f8ed4f91…` (cloudflared, hostname jdwalkaz.leaksnipe.win) |
| `uvix:jpgs-web3` | jpgs-web3 | jpgs.web3.leaksnipe.win | external `cloudflare-ipfs-gateway` |
| `uvix:kodak` | kodak | kodak.leaksnipe.win | worker `kodak-market-archiver` |
| `uvix:ladder` | ladder | ladder.leaksnipe.win | worker `kalshi-ladder-worker` |
| `uvix:landscape` | landscape | landscape.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:lemonade` | lemonade | lemonade.leaksnipe.win | tunnel `63000efe…` (cloudflared, hostname lemonade.leaksnipe.win) |
| `uvix:linear` | linear | linear.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:link` | link | link.leaksnipe.win | worker `leaksnipe-link` |
| `uvix:linux` | linux | linux.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:localhost` | localhost | localhost.leaksnipe.win | tunnel `63000efe…` (cloudflared, hostname localhost.leaksnipe.win) |
| `uvix:mail` | mail | mail.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:mar-web3` | mar-web3 | mar.web3.leaksnipe.win | external `cloudflare-ethereum-gateway` |
| `uvix:maurotufgamingp` | maurotufgamingp | maurotufgamingp.leaksnipe.win | tunnel `2732a8d6…` (cloudflared, hostname maurotufgamingp.leaksnipe.win) |
| `uvix:mcp` | mcp | mcp.leaksnipe.win | worker `leaksnipe-mcp` |
| `uvix:mcproute` | mcproute | mcproute.leaksnipe.win | external `cloudflare-agents-gateway` |
| `uvix:mem` | mem | mem.leaksnipe.win | tunnel `wecrypto` → his claude-mem worker (localhost:37777) |
| `uvix:memgw` | memgw | memgw.leaksnipe.win | worker `mem-gateway` |
| `uvix:metrics` | metrics | metrics.leaksnipe.win | tunnel `63000efe…` (cloudflared, hostname metrics.leaksnipe.win) |
| `uvix:muse` | muse | muse.leaksnipe.win | worker `muse-mcp` |
| `uvix:notion` | notion | notion.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:openclaw` | openclaw | openclaw.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:oracle` | oracle | oracle.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:osmo` | osmo | osmo.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:payments` | payments | payments.leaksnipe.win | placeholder — CNAME → bare label `payments` (no verified service) |
| `uvix:perplexity` | perplexity | perplexity.leaksnipe.win | worker `perplexity-mcp` |
| `uvix:poker` | poker | poker.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:price` | price | price.leaksnipe.win | worker `wecryp-price-proxy` |
| `uvix:pump` | pump | pump.leaksnipe.win | worker `pumpfun-helper` (pump.fun helper, added 2026-10-24; manifest v1.3.4) |
| `uvix:proxy` | proxy | proxy.leaksnipe.win | tunnel `63000efe…` (cloudflared, hostname proxy.leaksnipe.win) |
| `uvix:public` | public | public.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:rails` | rails | rails.leaksnipe.win | worker `leaksnipe-rails` |
| `uvix:scalper` | scalper | scalper.leaksnipe.win | worker `scalper-market-data` |
| `uvix:singularity` | singularity | singularity.leaksnipe.win | tunnel `63000efe…` (cloudflared, hostname singularity.leaksnipe.win) |
| `uvix:sites` | sites | sites.leaksnipe.win | external `ghs.googlehosted.com` (DNS-only) |
| `uvix:sol` | sol | sol.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:strk` | strk | strk.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:sui` | sui | sui.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:suite` | suite | suite.leaksnipe.win | worker `leaksnipe-suite` (CNAME to workers.dev hostname (not a registered custom domain)) |
| `uvix:tao` | tao | tao.leaksnipe.win | worker `tao-tracker` |
| `uvix:temp` | temp | temp.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:truffle` | truffle | truffle.leaksnipe.win | tunnel `f8ed4f91…` (cloudflared, hostname truffle.leaksnipe.win) |
| `uvix:trufflehype` | trufflehype | trufflehype.leaksnipe.win | worker `hypedog` |
| `uvix:ubuntu` | ubuntu | ubuntu.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:updown` | updown | updown.leaksnipe.win | worker `we-updown-hud` |
| `uvix:vvv` | vvv | vvv.leaksnipe.win | worker `vvv-price-alert` [workers-custom-domain] |
| `uvix:we` | we | we.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:web` | web | web.leaksnipe.win | tunnel `63000efe…` (cloudflared, hostname web.leaksnipe.win) |
| `uvix:wecryp` | wecryp | wecryp.leaksnipe.win | tunnel `63000efe…` (cloudflared, hostname wecryp.leaksnipe.win) |
| `uvix:wecrypto` | wecrypto | wecrypto.leaksnipe.win | worker `wecrypto-px-edge` paths /cascade*, /px*; fallback `wecrypto-cloudflare` |
| `uvix:worker` | worker | worker.leaksnipe.win | worker `leaksnipe` |
| `uvix:www` | www | www.leaksnipe.win | external `home.leaksnipe.win` (301 redirect) |
| `uvix:x` | x | x.leaksnipe.win | worker `leaksnipe` |
| `uvix:x-ai` | x-ai | x.ai.leaksnipe.win | worker `leaksnipe` |
| `uvix:xrp` | xrp | xrp.leaksnipe.win | worker `wecrypto-cloudflare` (catch-all route *.leaksnipe.win/*) |
| `uvix:yt` | yt | yt.leaksnipe.win | external `youtube.com` (CNAME proxy) |
| `uvix:zao` | zao | zao.leaksnipe.win | worker `poker-coach` |

## APPLIED tonight (2026-10-21)

- **KV backup:** live v1.0.0 manifest value saved verbatim to `~/workspace/network/uvix-manifest-backup-pre-slug-2026-10-21.json` before any write.
- **Manifest v1.2.0 written to KV** under the same key (`uvix:router:universal_mesh_v1`), built from the v1.1.0 reissued draft (99 resolving hosts; the 3 phantoms from the old manifest — `uvix`, `chatgpt`, `analyze` — stay out: no host, no entry).
- **Slugs:** all 102 entries carry an explicit `slug` + `canonical_id` (`uvix:<slug>`); slugs verified unique on read-back.
- **Targets:** all 102 entries carry an evidence-backed `target` (62 worker · 22 external · 13 tunnel · 2 placeholder; 0 null / 0 unverified). The 27 alias-farm hosts resolve to the `wecrypto-cloudflare` catch-all (`*.leaksnipe.win/*`); `wecrypto` itself records its split routing (`wecrypto-px-edge` on `/cascade*`, `/px*`, catch-all fallback); `d1` and `vvv` are flagged `workers-custom-domain` (bound without zone routes, per the Oct 20 route pull).
- **Access gates noted:** 9 entries flagged `access_gated` (claude, db, grok, home, jdwalkaz, ladder, lemonade, maurotufgamingp, mcp) — the gate is part of the entry's state, not hidden by the target.
- **Verified read-back:** after the write, the KV value was re-read and checked — valid JSON, version 1.2.0, 102 entries, every entry slugged, counts as above, semantically identical to the written manifest. (First read-back at +2s still showed v1.0.0 — KV eventual consistency; the +60s read-back confirmed v1.2.0.)
- **This registry** written from that verified read-back.

## DEFERRED — with reasons

1. **GitHub / GitLab repo renames & slug alignment — BLOCKED on Mauro's re-auth.** Both GitHub paths return 401 bad credentials (connector and LeakSnipe suite) and the suite's GitLab token is expired (verified 2026-10-21). No repo could even be listed, let alone renamed. When auth is restored: inventory the repos, record each repo's slug in this registry, rename only repos whose name ≠ their service's slug — and treat renames as their own change, with redirects checked, never batched silently into a data-layer pass.
2. **Worker script renames — DELIBERATELY NOT DONE.** Cloudflare has no script rename: a "rename" is deploy-new + swap every route/binding/secret + delete-old, and it risks breaking live routes across a 47-worker fleet (the Oct 21 zone-emptying accident is the standing lesson in what transfer-style operations cost). Instead, this registry + the manifest map each slug to the script name that actually serves it (e.g. `uvix:kodak` → script `kodak-market-archiver`, `uvix:tao` → `tao-tracker`, `uvix:home` → `leaksnipe-home`). New workers should be named by slug from birth; existing scripts get renamed only when already open for other surgery.
3. **UVIX router deployment — not touched.** The slug layer makes the manifest router-ready (the expanded router resolves targets from `target`-family fields, which v1.2.0 now supplies), but deploying the router worker and pointing any host at it is a separate, explicit decision for Mauro. Nothing was deployed tonight.
4. **The maurofanellijr zones (.store/.shop) — out of scope, untouched.** Their hosts are not leaksnipe.win mesh members; if Mauro wants them registered, they get slugs in a future entry under their own zone convention.
5. **Orphaned `analyze.leaksnipe.win/*` route and the `uvix.leaksnipe.win` front door — unchanged.** Both were Mauro's calls in the Oct 20 diff doc and remain so; the manifest simply doesn't list hosts that don't resolve.