what runs here now
One FastAPI reference deployment.
The public website, canonical demo pages, verification APIs,
and several developer surfaces are served by the same application. That makes the
evidence clickable and the project easy to inspect. It is a reference topology, not
a claim that every surface belongs in one production trust boundary.
Co-located reference system
production target
Separate public, demo, verification, and operator planes.
A hardened deployment should isolate the static public site,
disposable demo workloads, customer verification APIs, operator controls, durable
signing keys, replay state, and evidence storage. Tenant isolation, rate limits,
observability, key rotation, and governed trust-anchor updates belong at those
boundaries.
Architecture direction, not deployed claim