ops(svos): U13 phase B amendment — full kernel-origin path list, Miranda's env and origin on nh3-dev, enrollment secrets, app-high-seat declared

Per svoperatingsystem dc241f8 u13-svos-edit.md items 1, 4, 5 and 6 (Prime's
go stands): the kernel origin passes exactly the method-pinned list (apps and
Miranda's agent connector; 15 pairs reach the kernel, the rest are Caddy 404);
nh3-dev's apps env is rebuilt as dc241f8 with svos-miranda 0.0.3 and
svos-agent 0.0.3 and gains the svos-miranda origin (nh3-svos only); three
enrollment secrets minted into the vault; app-high-seat declared with one
reload. Also fixes nh3-dev's fleet Caddy sharing admin localhost:2019 with
ttyd-caddy via SO_REUSEPORT (reloads could land on either): now :2021.

servers/nh3-dev/README.md

@@ -185,12 +185,21 @@ The new SVOS kernel runs on nh3-svos; at the U13 edit three of its apps run HERE
   and both 502 until their app listens:
   - `https://svos-seathost.nh3.phasefinal.com` → `127.0.0.1:8404`, app-terminal's listener (unbuffered).
   - `https://svos-highseat.nh3.phasefinal.com` → `127.0.0.1:8773`, app-high-seat (the High Seat's signed-only listener).
-- **Apps env `/opt/svos/current/apps-env`** (→ `releases/afab123`, lkraven-owned): python 3.13.2 copied to
-  `/opt/svos/python/` (so it does not depend on `~/.local/share/uv`), the release's hashed `apps-requirements.txt`, then
-  svos-connector 0.0.7, **svos-postoffice 0.0.2 with its `push` extra satisfied by althing-core 3.7.0** installed
-  (non-editable) from a clean archive of althing `7a2a1c1`, and svos-terminal 0.0.3. ⚠ althing-core's own deps
-  (python-ulid 4.0.1, pyyaml 6.0.3) are resolved, not hash-pinned. No units yet: the bridge and terminal units, their
-  config and their credentials are written at the edit. The kernel is reached at `https://svos-kernel.phasefinal.com`
+  - `https://svos-miranda.nh3.phasefinal.com` → `127.0.0.1:8408`, app-miranda (svos-miranda), which calls the Hermes
+    gateway's API server on `127.0.0.1:8765`. Miranda's agent connector (svos-agent) will listen on `127.0.0.1:8407`,
+    loopback only (the gateway plugin's `connector_url`), with no origin.
+  - ⚠ **The fleet Caddy's admin endpoint is `localhost:2021` since 2026-10-10.** It used to share `localhost:2019` with
+    ttyd-caddy (the stock binary, `~/.config/caddy`) through SO_REUSEPORT, so a `reload` landed on either process: one
+    U13 reload was rejected by the stock caddy ("unknown module dns.providers.cloudflare"), and a ttyd reload could
+    have replaced this config. `ExecReload` reads the address from the Caddyfile, so reloads are deterministic now.
+- **Apps env `/opt/svos/current/apps-env`** (→ `releases/dc241f8`, lkraven-owned; `releases/afab123` is an earlier,
+  unreferenced env): python 3.13.2 copied to `/opt/svos/python/` (so it does not depend on `~/.local/share/uv`), the
+  release's hashed `apps-requirements.txt`, bifrost 1.2.1, svos-connector 0.0.7, **svos-postoffice 0.0.2 with its
+  `push` extra satisfied by althing-core 3.7.0** installed (non-editable) from a clean archive of althing `7a2a1c1`,
+  svos-terminal 0.0.3, **svos-miranda 0.0.3** (built from dc241f8: Miranda's charter with the app-high-seat lines) and
+  svos-agent 0.0.3. ⚠ althing-core's own deps
+  (python-ulid 4.0.1, pyyaml 6.0.3) are resolved, not hash-pinned. No units yet: every app's unit, config and credentials
+  are written at the edit, and none of them starts before it (two live Mirandas never overlap). The kernel is reached at `https://svos-kernel.phasefinal.com`
   (LAN, allowlisted to this box). No input firewall here, so a LAN listener for the bridge needs no rule.
 
 ## Box-wide Playwright / Chromium (2026-06-04)

servers/nh3-svos/README.md

@@ -42,11 +42,23 @@ configuration, enrollment and acceptance.
 - **B2, the kernel's app origin:** drop-in `svos-kernel.service.d/20-app-listen.conf` (`configs/svos-kernel/`) adds
   `--app-listen 127.0.0.1:8410`; Caddy serves `https://svos-kernel.phasefinal.com` on **10.100.50.43 only** (own LE
   cert, DNS-01), no Basic auth, bearer passed, identity headers stripped, **source allowlisted to nh3-dev** (10.100.10.50),
-  paths `/auth/enroll`, `/auth/proofs`, `/auth/kernel-key`, `/registry/*`, `/verbs/*`, `/seats/enroll`, else 404.
-  `/auth/kernel-key` is ADDED to svos-dev's list: every `svos_connector` client fetches it to trust the kernel's
-  signatures, and it is the runbook's B2 check. The three internal AdGuards answer the name with 10.100.50.43.
-  Tested: from nh3-dev `/auth/kernel-key` and `/registry/apps` → **401 `no principal` from the kernel**, `/health` and
-  `/api/health` → 404; from nh3-svos and nh3-docker → 403. Caddyfile backup `/etc/caddy/Caddyfile.pre-kernel-origin`.
+  paths **method-pinned to svoperatingsystem dc241f8 `u13-svos-edit.md` item 1** (the apps' and Miranda's agent
+  connector's calls: GET `/auth/kernel-key` `/auth/whoami` `/registry/apps[/*]` `/principals/*/grants` `/seats` `/events`
+  `/artifacts/resolve`; POST `/auth/enroll` `/auth/proofs` `/seats/enroll` `/registry/apps/*/manifest`; `/verbs/*`), else
+  404. The three internal AdGuards answer the name with 10.100.50.43. Tested from nh3-dev: all 15 allowed method+path
+  pairs → **401 from the kernel** (JSON `detail`); `/health`, `/stream`, `/cards`, POST `/auth/kernel-key`, DELETE
+  `/registry/apps/x`, `/principals/a/b/grants` → Caddy's empty 404; from nh3-svos and nh3-docker → 403. Backups
+  `/etc/caddy/Caddyfile.pre-kernel-origin`, `.pre-kernel-paths`. ⚠ **Validate from a caddy-readable path**
+  (`/etc/caddy/Caddyfile.check`): the first deploy validated `/tmp/svos-stage-*/` (0700 infra-ops), got "permission
+  denied", and a `| tail` hid it. The config was valid (Caddy's own reload accepted it), and the validator was then
+  positive-controlled (a bogus directive → rc 1).
+- **B5 + enrollment secrets (2026-10-10 1654):** `svos-kernel mint-secret` (run as infra-ops without sudo, so no
+  sudo-io copy) minted three tokens straight into the vault, read back by hash: `nh3-svos/app-high-seat-enrollment-secret`,
+  `nh3-svos/app-miranda-enrollment-secret`, `nh3-svos/miranda-persona-enrollment-secret`. Only app-high-seat is
+  declared so far (`[[apps]]` with `enrollment_sha256`, one reload, config_gen `22a05c20e17f93ce` → `1bd948c754e571da`,
+  backup `instance.toml.pre-high-seat`); the other two are declared in the edit.
+- nh3-svos stays on afab123: svoperatingsystem `dc241f8` changes only svos-miranda (0.0.3, the charter), which runs on
+  nh3-dev, so a dc241f8 release here would change nothing that runs.
 - The app-side origins on nh3-dev (`svos-seathost`, `svos-highseat`) and the bridge env are in `servers/nh3-dev/README.md`.
 
 ## Release b588510 (2026-10-09 0540, kernel 0.0.8: the SQLite reader-pool fix)