Document the key an operator cannot start beta without

[adamjohnwright]

The key exchange happened today — the website generated a keypair, sent the public half, and it is installed and verified on beta. This closes the documentation gap that left behind.

The gap

.env.beta is gitignored, so deploy/beta/env.beta.template is the only tracked record of what the environment needs. It did not mention CALLER_TOKEN_PUBLIC_KEY_PATH — the one variable whose absence stops the container from starting. Neither did the README.

Someone setting beta up from these docs would have got a container that refuses to boot, with nothing in the documentation explaining why. The refusal is deliberate and well argued in the code; it was undiscoverable from the place an operator actually reads.

What changed

• env.beta.template gains the variable, with why it exists and why a missing key takes /chat down too.
• README.md gains a section covering where the public half comes from, that this host holds only the public half and therefore cannot mint, the 644 mode requirement (the image runs as appuser), and that rotation is a file write plus a restart.
• It also says to delete any private half once a real key is installed. On the verifying side a signing key is pure liability — it quietly gives back exactly what choosing an asymmetric algorithm bought. That was this repo's own mistake until today.

State after the exchange

installed on beta	the website's public key
our signing key	deleted — no key that can mint for this path exists on this host
our old token	now refused (this is the proof the swap took)
/chat	HTTP 200, untouched
reversible	previous public key backed up outside the repo

Full positive verification — a token they mint being accepted — needs their proxy, which does not exist yet. What is verified here is that the key changed, that the service is healthy, and that refusals still behave.

🤖 Generated with Claude Code