Operator setup

Deploy the frontend and api/graph.mjs on the existing Vercel project. The graph itself executes in the browser or local runner. Deploy runtime/ as a separate Eve service; this hosts individual simulations, not workflows.

Simulation runtime

Use Node.js 24+, install with npm ci --prefix runtime, and build with npm run build --prefix runtime. The runtime pins Eve independently of historical benchmarks. Vercel builds emit the managed Workflow deployment. Set:

• EVE_MODEL: approved AI Gateway model ID, matching the graph API.
• EVE_RUNTIME_TOKEN: random server-only secret of at least 32 characters.
• AI Gateway authorization through project OIDC or AI_GATEWAY_API_KEY.

The channel verifies the shared secret. Never expose it in browser configuration or runner tokens. The agent may use an isolated, network-denied sandbox to inspect supplied software. It never executes the customer's workflow. Use npm run build:check --prefix runtime only for CI compilation without provider allocation. Production must use the full build to provision sandbox templates; compile-only output cannot execute software and must never be deployed.

Management API

Required configuration:

Units are integer micro-USD simulation credits. Preserve the existing free-account allocation with GRAPH_MAX_ACCOUNT_CREDITS=5000000; choose and publish the invocation tariff and run ceiling explicitly. No paid subscription or automatic overage is enabled. Matching idempotent replays incur no further admission charge.

The frontend uses same-origin /v1/graph by default. NEXT_PUBLIC_XENTROPY_SERVICE_ORIGIN is optional for a separately hosted management API. The configured origin must use HTTPS outside explicit localhost development.

vercel.json routes /v1/graph/* to the serverless handler and schedules authenticated daily maintenance (compatible with the existing Hobby plan). The maintenance operation closes abandoned runs and retries resource cleanup. Sessions expire after 24 hours without a heartbeat; the daily sweep can perform physical cleanup on the following tick. New database tables use the graph_ prefix and leave historical tables untouched. Each run has a transactional row; account quotas use short row locks rather than a process-wide database ownership lock.

To operate the same API locally for development, load configuration securely and run npm run start:service. The local frontend uses npm start. Missing configuration is an explicit error, not a switch to a mock or legacy executor.

Release verification

Run npm run check, npm test, npm run test:benchmark, npm run build, runtime checks/build, and npm run test:ui. The benchmark's optional upstream-binary tests require its pinned reference executables.

For actual inference, configure a saved mixed real/simulated fixture and scoped token, then run npm run test:graph-live. Keep generated evidence separate from unit tests. Verify runtime health, authentication, real model output, session isolation, recovery, and cleanup before calling deployment complete.

The production API loader imports .generated/graph-api.mjs, produced by scripts/build-api.mjs during the site build. Esbuild bundles the complete Eve, AI SDK, Clerk, Fastify, and Postgres JavaScript dependency graph so deployment does not depend on tracing Eve’s internal package imports. Only Node built-ins and the unused optional pg-native driver remain external; production uses the JavaScript Postgres driver. The generated directory is ignored by Git and recreated for each build.

Public search pages

The site build renders homepage, guides, and documentation from the same React components used by the developer frontend. Their HTML includes the complete text; only mobile navigation needs JavaScript on those pages. The gallery index is also prerendered, with React enabling search, template selection, and the trajectory reader after loading. Query variants canonicalize to the gallery index. scripts/build-public-site.mjs supplies per-page canonical and sharing metadata, robots.txt, and the sitemap. Canonicals use the production destination https://www.xentropy.tech. The editor routes are noindex; API and downloadable resource responses use X-Robots-Tag. Crawlers may still fetch those URLs to see the directives.

Run npm run build && npm run test:seo before publishing public-page changes. This checks unique metadata, static content, structured markup, and internal links, downloads, and fragments. CI runs it after the production build. Add new public documents to the document registry and build download list, and update the audit's expected page count intentionally. Keep structured data consistent with visible content; do not add invented reviews, results, or modification dates.

The social card source is scripts/social-card.html; render its 1200×630 viewport to web/social-card.png when changing the identity or wording.

After deployment, submit /sitemap.xml in verified Search Console and Bing Webmaster Tools properties. Inspect representative URLs and track indexing, queries, conversions, and field Core Web Vitals. The October 2026 audit is retained in docs/evidence/seo-audit-2026-10-10.json. Lab checks do not establish search rankings or answer-engine citations.