[PR-011] Resolve infrastructure and OKX readiness

[ilyar]

---

Resolve infrastructure and OKX readiness

Outcome

Deployment and ASP registration have confirmed non-secret infrastructure,
ownership, and credential-provisioning evidence before implementation reaches
the public release gate.

Scope

• Product: product/proof-runner
• Allowed paths: deployment readiness records and external-system checklists

Acceptance

• Confirm the public domain/base URL, DNS owner, and certificate owner.
• Confirm a dedicated worker hostname, provider region, and network boundary
  with no production-data access.
• Record secret names and out-of-Git provisioning paths for the internal
  runner token, receipt signing key, and OKX credentials.
• Verify the OKX Developer API credentials without recording their values.
• Confirm the Agentic Wallet, receiving address, and registered review email
  without storing private wallet or email data in GitHub.
• Confirm the A2MCP endpoint timeout can accommodate the 180-second hard
  execution cap or record a tested asynchronous adapter decision.
• Record only non-secret evidence, owners, timestamps, and blockers.
• Reviewer confirms readiness evidence before PR-006 starts.

Constraints

• Never store credentials, wallet keys, private addresses, or user data in Git.
• This task confirms readiness; it does not deploy the product.

Evidence

• Provisioning tooling: product PR #21,
  merged as f261c33,
  creates a 48-byte random runner token and a dedicated Ed25519 receipt key in
  an existing host-only deployment/.env file, sets mode 0600, and refuses
  overwrite. This is tooling evidence only, not confirmation of a real host or
  secret-manager provisioning path.
• Infrastructure confirmation: pending
• OKX readiness check: pending
• Review: pending

Blocker

No non-secret evidence currently confirms the real domain/DNS/certificate
owners, dedicated worker boundary, production provisioning path, OKX
credentials/wallet/review channel, or the 180-second endpoint strategy.

[ilyar]

Readiness tooling progress: PR #21 is merged as f261c33. On the dedicated worker, node deployment/provision-secrets.mjs --env-file deployment/.env now creates a 48-byte random runner token and dedicated Ed25519 receipt key, writes secrets only to a 0600 host-only env file, and refuses to overwrite existing keys. The remaining #11 acceptance still requires actual domain, worker, secret-manager, and OKX confirmations.