Closed alpha operating notes.

Chrome on Windows only in this phase. No Edge package, no macOS, no native messaging host. The extension talks only to http://127.0.0.1:3000.

Without an OriginUnlock, the extension may only request:

• http://localhost:3000
• http://127.0.0.1:3000
• http://localhost:3101
• http://127.0.0.1:3101
• https://mymonkey.ai
• https://www.mymonkey.ai

Fixtures: /sandbox/billing, /sandbox/fixtures/unsubscribe. Both labelled SANDBOX · NO REAL ACCOUNTS.

A real origin is unlocked only after fixture gates are met and recorded server-side. The unlock is an Ed25519-signed local record (mymonkey.origin-unlock.v2) stored in extension storage — not a cloud flag and not an unkeyed hash. The extension verifies the signature and expiry before granting host permission for origins outside the fixture list.

• ≥3 successful fixture runs
• 0 unauthorized consequential actions
• Kill switch exercised once
• Receipt verified on /verify

Choose one named SaaS billing host with the first partners. Do not ship a generic crawler. Issue the unlock via the local BFF once criteria pass (see POST /api/alpha/unlockwith a Bearer token; gate counters come from server progress, not the request body).

Default: ONTOGONY_MODE=sandbox — no Docker. Willing partners run .\scripts\alpha-ontogony.ps1 to bring up postgres + Kanon (:5081) + Allagma (:5083), write .env.local, and start the BFF in live mode. Do not customize ALLAGMA_SERVICE_TOKEN away from the compose default without also setting Allagma's Allagma:Api:Auth:ServiceToken binder — the compose env key Allagma__Authentication__ServiceToken is a known no-op quirk.

1. npm run alpha:local
2. Load unpacked extension/dist
3. Fixture teach → compile → run → approve → receipt
4. Verify seal on /verify (popup re-checks the seal)
5. Kill switch: Esc Esc on the page, Alt+Shift+K, or popup KILL — three states reported (revoke-and-report, not instant global halt)
6. (Optional) alpha-ontogony.ps1 + live health
7. (Optional) seal OriginUnlock for one real origin via the popup Unlock section (permissions.request runs in the popup gesture)

• Live mode is partner-local only — never Vercel.
• Waitlist form writes .alpha/waitlist.jsonl on the local BFF only; on Vercel it refuses with an honest error instead of a fake success.
• Allagma run-start POST is best-effort; audit enrich may still be empty if the write API is absent.
• Live Ontogony: rebuild kanon-api if agent-access routes are missing; wipe the compose volume on mutated migration hashes; .\scripts\alpha-live-smoke.ps1 asserts evaluate/revoke 200 after alpha-ontogony.ps1.
• No WebAuthn yet — grants are session-bound.
• Receipts are sealed, not cryptographically signed.