# WG Paid / MGTS — Current State

**Updated:** 2026-08-24  
**Purpose:** first-read source for every new chat. This file contains current truth only; history is non-normative and stored separately on VM130.

## Reading order

1. `00_WG_PAID_MGTS_CURRENT_STATE.md`
2. `01_WG_PAID_MGTS_ARCHITECTURE_AND_MACHINES.md`
3. `03_WG_PAID_MGTS_CURRENT_LOCAL_PLAN.md`
4. `04_WG_PAID_MGTS_WORKING_RULES.md`
5. `05_WG_PAID_MGTS_PROVEN_INVARIANTS.md`
6. `02_WG_PAID_MGTS_GLOBAL_PLAN.md` when wider project direction is needed.

## Current project position

```text
P26C4K  real production mail -> browser -> session proof: PASS
P27A    production/monitoring read-only baseline: PASS
P27B    VM103 open-onboarding monitoring remediation: PASS
P27C0   trusted-user prerequisites: PASS
P27C    first trusted durable production user: FUNCTIONALLY PASS
P27CH   VM130 bootstrap post-PASS hardening: PASS
P27C R07/R08: read-only closure-harness failures only; no production mutation
```

P27C functional production state is accepted and must not be rolled back or recreated merely for proof.

## P27C accepted functional state

The production system currently has the first trusted real user and the intended durable onboarding state:

```text
USER_ROWS=1
ACCESS_GRANT_ROWS=1
CONNECTION_PROFILE_ROWS=1
PEER_CREDENTIAL_ROWS=1
PROVISIONING_JOB_ROWS=1
INVITE_ROWS=1
INVITE_REDEMPTION_ROWS=1
MAGIC_LINK_TOKEN_ROWS=1
AUTH_SESSION_ROWS=1
BUSINESS_ROWS=8

PROFILE_ACTIVE=true
PROVISIONING_JOB_COMPLETED=true
REAL_BROWSER_AUTH_ROWS_PRESERVED=true
HELPER_AUTH_ROWS_PRESENT=0
VM100_RUNTIME_PEER_PRESENT=true
AUTHENTICATED_PROFILE_CONFIG_DELIVERY=PASS
CONFIG_CACHE_CONTROL_NO_STORE=PASS
```

Do not repeat real invite, real email, browser magic-link consume, profile creation, peer creation or config-delivery proof merely to close P27C documentation.

## Current unresolved items

1. **Project Sources reset** — in progress now. Replace the old overlapping 14-file set with this six-file canonical set and archive the old set on VM130.
2. **P27C procedural closure** — decide, after the reset, whether R06 is sufficient as functional P27C PASS or whether one minimal read-only formal continuation is still required. No new mechanism is allowed merely to manufacture closure evidence.
3. **VM100 selector semantics** — current implementation balances total registered selector population and may move idle peers. Intended architecture is to balance **active peers only**. This is a separate VM100 task and must not be mixed into P27C closure.

## Runtime change freeze

Until the Project Sources replacement is complete:

```text
NO VM100/VM101/VM103/VM121 runtime mutation
NO P27C R09
NO selector implementation change
NO repeat Class C onboarding
```

VM130 may later receive only the agreed documentation/history publication change for this source reset.

## Current machine baselines

| Machine | Commit | Tree | Files |
|---|---|---|---:|
| VM100 | `8c5d11b7e4b119757ea16b46775b26e0ac903d7c` | `f25aab0f1886647b52a11ccebe080894bd06542a` | 34 |
| VM101 | `d0fcf8d22d6d4b897de7b7fee53c2f062d51b936` | `b1f9bde032609e406e387e8e169ff441413df5df` | 59 |
| VM103 | `1ce14d61450d1a07756606b46e370b5c8456e6aa` | `a665626439d9830e4510514bbf067f6a5613b2fa` | 12 |
| VM121 | `e07bcad6285cd06c3f995e06e9657baa2c0da3d1` | `1fa5958324fa6e14ecd921622ce2662849d90412` | 53 |
| VM130 | `3d27b6c3ac578afeecfb9b1c538f1f4458301f03` | `70b0c65399077232a2b43a172e3a089b541ce5c1` | 82 |

VM130 baseline changed in P27CH R01; older `73d425...` references are historical and non-current.

## Current canonical working snapshot

```text
LATEST_ARCHIVE=WG_PAID_MGTS_LATEST_20260823-212834.zip
LATEST_ARCHIVE_SHA256=d1af92f85d49768ac1258d84c433c8ca8a68b9c5e8371537ec4c366a3696be05
LATEST_MEMBER_COUNT=122
```

This Latest contains the current canonical Git source publications for VM100/101/103/121/130 plus the canonical access map and current report/evidence objects. Use it as the working source picture before querying production for static information.

## Current public/product state

```text
EXTERNAL_ONBOARDING_ACTIVE=true
ADMIN_AUTH_CONFIGURED=true
ADMIN_AUTH_SOURCE=file
PLAN_CODE=trusted-pilot
PLAN_ACTIVE=true
PLAN_WIREGUARD_LIMIT=1
PLAN_AMNEZIAWG_LIMIT=0
```

Public path:

```text
Internet 95.165.105.4
  -> VM101
     -> UDP 51830 -> VM100 wg_paid
     -> TCP 80/443 -> VM103 Caddy
        -> reports.secret-studio.ru
        -> reports001.secret-studio.ru
        -> access.secret-studio.ru -> VM121 auth/account API
```

Canonical magic-link template:

```text
https://access.secret-studio.ru/auth/magic#token={token}
```

## One fact — one canonical home

- current status, current baselines, unresolved work: **this file**;
- architecture, machine roles, access and selector model: `01_...ARCHITECTURE_AND_MACHINES.md`;
- global goals: `02_...GLOBAL_PLAN.md`;
- current work package/checklist: `03_...CURRENT_LOCAL_PLAN.md`;
- release/process rules: `04_...WORKING_RULES.md`;
- already proven facts and retest conditions: `05_...PROVEN_INVARIANTS.md`.

Do not duplicate long historical narratives across active Project Sources.