feat(recovery): add C06 qualification demo and Arc Subgraph

[SuPuHe]

Summary

Adds the C06 recovery qualification bundle, deployable synthetic recovery viewer, fail-closed production Graph/model defaults, and Arc Testnet USDC Subgraph source. It also incorporates merged PR #32 without allowing its assets-only A05 frontend to replace the recovery deployment. Live Privy, Arc, and Subgraph MCP/model evidence remains explicitly NOT VERIFIED.

Scope and acceptance criteria

• Synthetic recovery demo is persistently labeled and exposes no payment/retry action.
• Production recovery fails closed when live MCP/model ports are absent.
• Subgraph build generates ignored types before compiling on clean CI checkouts.
• Wrangler builds packages/recovery-ui/site-dist before deploy.
• A05 intent/status UI remains available as @oneshot/web but is not deployed before a reachable API is configured.

Product and security invariants

• Tenant isolation, sponsor authorization, auditability, and caps remain fail-closed.
• Recipients cannot modify sponsor controls.
• No secrets, tokens, production identifiers, or personal data are committed.

Recovery remains zero-submit; unavailable, malformed, contradictory, or non-live evidence cannot unlock settlement. Studio deployment is reported only and is not qualification evidence.

Validation

pnpm lint: PASS
pnpm typecheck: PASS
pnpm test: PASS — 46 files / 585 tests
pnpm --filter @oneshot/arc-subgraph build: PASS — codegen runs first
pnpm --filter @oneshot/web build: PASS
pnpm exec wrangler deploy --dry-run: PASS — recovery assets selected
GitHub Stack lint: PASS
GitHub repository-policy: PASS
Cloudflare Workers Builds: PASS on 89eaea3

Deployment review of PR #32

PR #32 was merged into develop while this PR was open. Its assets-only Worker deployed apps/web, but /health and /v1 had no API backend; SPA fallback returned HTML for those API paths. This branch resolves the overlap by retaining the C06 recovery viewer as the Worker asset target. apps/web documentation now requires a reachable VITE_ONESHOT_API_BASE_URL before production deployment.

Independent review evidence

Previous Gate A

• Reviewed tree: 5e682a8fb2933c48c826d76ce0c8560345d5f7c6
• Reviewer: free-pi-cli / glm-5.3-flash
• Verdict: PASS; no blocking findings.
• Status: invalidated by the CI fix and merge of updated develop.

Current remote candidate

• Base commit: 4afd70916a84946aa3230cd29ccd3b68a2b2da58
• Remote head commit: 89eaea366158d6afb13afe178d8068e40a842cac
• Remote head tree: 682b58305bb2270d5ecf2cbbda00c30786de6c18
• Required PR CI passes.
• Current remote tree receives final independent review.

Risk and rollback

Privy, Arc, and The Graph remain NOT VERIFIED; canonical immutable deployment/allocation and live MCP/model/receipt evidence are still missing. The A05 frontend must not become the Worker asset target until its API base URL is live. Roll back by reverting this PR.

Human merge

• A human owner reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	89eaea3	Sep 08 2026, 01:59 PM