- api: /chat route runs runAgent (session-required, 503 when unconfigured) - api: index.ts builds OpenRouterLlmClient + WpRestExecutor from env; loads .env - web: useChat calls /chat with mock fallback; proxy /chat+/sites+/health - .env.example: DATABASE_URL empty by default (in-memory dev) - 111 unit tests green; smoke-tested signup+chat
- session store + requireSession middleware (signup persists session) - PairingService (8-char code, 5-min TTL, 5-attempt lockout, single-use, https check) - POST /sites/pair, /sites/redeem, /sites/:id/confirm, GET /sites/:id - PluginClient signs HMAC (timestamp+method+path+body-hash), token in Authorization - ADR 0016; 58 api tests green
- PostgresUserStore (Queryable) + migration + env-gated wiring - DockerodeClient behind injected DockerEngine - ImageManager, WarmPool, Dockerfile.wordpress, docker-compose - POST /sessions spins up sandbox (503 when unconfigured) - ADRs 0014-0015; 68 unit tests green