# Public-domain recovery evidence — 2026-07-30

## Scope
User-authorised recovery/publish work for `news.nurt.cloud`, `boldai-audit.nurt.cloud`, and `baby.nurt.cloud`.

## `boldai-audit.nurt.cloud`
- **Initial symptom:** HTTPS returned `503 no available server`.
- **Root cause:** the live `boldai-auditv4` container was healthy on internal `10.0.1.70:8000`, but its Traefik host rule named only `boldai-auditv4.nurt.cloud`. The old `boldai-audit` route carrier was an exited container.
- **Minimal repair:** in `/home/thoth/stacks/boldai-audit/docker-compose.yml`, expanded the v4 HTTPS and HTTP router host rules to include both `boldai-auditv4.nurt.cloud` and `boldai-audit.nurt.cloud`; rebuilt/recreated only `boldai-auditv4`.
- **Verification:** public `https://boldai-audit.nurt.cloud/` returned HTTP 200 with the expected `boldai · audyt AI` page; `https://boldai-audit.nurt.cloud/health` returned `{"ok":true}`; HTTP redirects to HTTPS.

## `news.nurt.cloud`
- **Initial symptom:** HTTPS returned `503 no available server`; HTTP returned 404. TLS was valid, proving DNS/certificate ownership but no active backend route.
- **Current source validated:** active static Nomads build at `/var/lib/docker/volumes/sw80g8goscokg8888kgoowgo_paperclip-data/_data/workspaces/nomads-news/dist/`; its root `index.html` was modified 2026-07-30 and parsed as `Nomads — Da Nang & Hoi An: live well here`.
- **Minimal repair:** created `/home/thoth/stacks/nomads-news/docker-compose.yml` with one read-only `nginx:alpine` service bind-mounting that current `dist/` tree and a Traefik HTTPS router for `news.nurt.cloud`.
- **Verification:** public `https://news.nurt.cloud/` returned HTTP 200 and the Nomads title; `https://news.nurt.cloud/news/` returned its news index; HTTP redirects to HTTPS.
- **Security note:** this restores the static Nomads site publicly. There is no database, application runtime, credentials, or private dashboard mount in the current `dist/` tree. If the site is meant to be private again, add an explicit new access rule instead of reviving the former inaccessible/removed middleware.

## `baby.nurt.cloud`
- **Initial symptom:** default Traefik certificate plus 503 / 404, with no route.
- **Published artifact:** `/root/.hermes/profiles/tris/workspace/projects/baby-nurt/06_DELIVERY/site/index.html`, a static read-only research cockpit built by Claude Opus 5.
- **Deployment:** project `docker-compose.yml` starts one `nginx:alpine` service binding `./06_DELIVERY/site` read-only and Traefik HTTPS routing for `baby.nurt.cloud`.
- **Verification:** public HTTPS returned HTTP 200; body contains the research cockpit, Research/Market signals/MVP direction/Evidence tabs, and corrected `Live · read-only` status. HTTP redirects to HTTPS. Browser DOM verification confirmed the MVP tab changes selected state and exposes the candidate-hypothesis / council gate content.
- **Safety:** the site contains no forms, inputs, trackers, analytics, cookies, booking, payment, identity verification, waiting-list, or user-data collection.

## Remaining work
- Baby research remains in P1: B2 comparator merge, B3 trust/safety, B4 legal sources, B5 economics, a fuller B6 visual capture, then the prescribed Fable/Opus/Sonnet council and only then an MVP decision.
- The API key supplied in Telegram was deliberately not stored, logged, or tested because its provider/purpose was unspecified.