Round 1 is deployed and green — and still dark on purpose

The last few weekly entries were about seams and small tells. This one is about the largest single body of code we've put behind the DCS gateway to date, and the most interesting thing about it is a decision rather than a deploy: it is on the wire and switched off. Round 1 is deployed and green on api.dcsai.ai. It is also running dark — every product flag is at zero — and it will stay that way until there is a person, not an automation, who decides otherwise.

So this is a post about shipping a lot and launching nothing, on purpose. That's the harder discipline to hold, and it's the one I care most about getting on the record.

What went out

Round 1 folded the backlog of gateway work that had been accumulating as uncommitted changes into committed, deployed code. Concretely, the DCS gateway now carries twenty feature routes plus an MCP tool layer, landed with database migrations 023–036. It's the heaviest movement the core has seen in weeks, and it went out green.

Underneath the feature surface, the changes I actually lost sleep over are the boring, load-bearing ones:

• Payment idempotency (migration 021) — so a retried or duplicated payment call can't double-charge.
• Atomic, race-safe Mart purchase (migration 022) — a purchase either happens once or not at all, even under concurrent requests.
• A single source-of-truth entitlements endpoint — one place that answers "what is this account allowed to do," rather than several that can disagree.
• USD wallet, console CORS/CSP, a worker-guard, and Security-Definer view hardening — the database-permission and browser-boundary work that turns "it runs" into "it runs without leaking."

The security pass on that database and header work came back at zero criticals. I'll be precise about what that means below, but the short version is that the Security-Definer views, the worker-guard, and the CORS/CSP posture were reviewed and cleared with nothing rated critical.

The part that makes it more than a push

Anyone can say a deploy is green. What I'd rather point at are the checks that ran against the live deploy and came back clean.

1 · The smoke suite: 8/8 routes

A post-deploy smoke run (POSTDEPLOY_SMOKE.mjs) exercised the live routes and returned 8 of 8 passing. This is the difference between "the build compiled" and "the endpoints answer correctly once they're actually serving traffic."

2 · The money-path authz test: 11/11, no cross-user leak

The one I care about most. An IDOR and authorization test (IDOR_AUTHZ_TEST.mjs) ran against the live deploy with two real users, probing whether one account could reach another's money-adjacent objects. It returned 11 of 11 passing, with no cross-user leak. On a platform where the eventual point is that agents move value, "user A cannot see user B's things" is not a nice-to-have; it's the whole floor.

3 · Monitoring that pages a human

Observability went live alongside the deploy: a Sentry project on the backend for errors, and Grafana Synthetics probing console.trdn.io and the Mart listings endpoint on api.dcsai.ai every minute from three probes, with email alerts wired to the network's default policy. A test alert was fired end-to-end and delivered — so we know the alarm actually rings, not just that it's configured.

4 · TLS and headers, graded

Transport and header posture came back green against external graders: console.trdn.io at SSL A+ / headers A, and api.dcsai.ai at SSL A / headers A, achieved through the Cloudflare zone (minimum TLS 1.2, HSTS, and transform rules for the frame, referrer, and permissions headers).

Three separately audited bugs — dead Copilot buttons, a doubled Compute/Storage header, and a Business-OS price mismatch — were also fixed and deployed on 30 June, so the surface people actually see is cleaner than it was a week ago.

Shipping a lot and switching nothing on is the harder discipline. A green deploy that stays dark is a claim you can check; a green deploy that quietly goes live is a claim you have to trust.

Why it's still dark

Everything above is deployed, but the product flags remain at zero. No money path is live. Autonomy — agents actually executing on their own — is off. The single exception is a narrow one I want to name rather than hide: an Atlas archival pin to Filecoin is switched on (ATLAS_ANCHOR_LIVE=1), and even that is running with settlement still charged:false — no funds move. Nothing else carries a live flag.

The reason is structural. The flips that turn this from a dark deploy into a live product — payments, creator publishing, autonomous execution — are founder-only, and each one is meant to be pulled individually, after a manual review, not as a batch. There is still a short must-do list before any of that: confirming Mind-API persistence, a token-repo dependency audit, and tightening the email DMARC policy before the first launch email goes out. Until those close and the founder decides, the honest description is "deployed, green, and dark."

What is not done yet (and we want you to know it)

The cadence holds

Some weeks the story is a surface going live. This week the story is the opposite and, I'd argue, the more important muscle: a large, verified deploy that we chose to leave switched off. The code is on api.dcsai.ai, the reruns are green, the alarms ring, and the flags are at zero. When one of them flips, it'll get its own honest entry here — with who flipped it and what we checked first.

— Deepak