Core local/BYO-host runtime readiness

[mathaix]

Goal

Make the Apache public core runnable by a developer on their own machine or BYO Firecracker host without the hosted OpenClaw overlay.

Rubric gates

• make preflight exists and runs without bespoke environment knowledge.
• Local setup documents the required host packages, KVM checks, Firecracker availability, ports, and expected failures.
• A developer can create/start/stop a minimal machine with local config and local artifacts.
• The local path does not require billing, hosted plan checks, Cloudflare production routing, or private service credentials.

Starting points

• Makefile
• docs/README.md if created, otherwise README.md
• docs/host-enrollment.md
• docs/ovh-host-setup.md
• backend/internal/machines
• backend/internal/api
• scripts/

Expected output

• A working make preflight target or an equivalent target wired into make preflight.
• Clear local/BYO-host docs linked from README.md.
• Any hosted-only checks moved behind explicit deployment profile/config flags.
• Tests or smoke checks for the local path where practical.

Non-goals

• Do not add billing, payments, plan enforcement, or commercial account management.
• Do not require public GitHub PR code to execute on privileged KVM hosts.

[mathaix]

Status update after the public-core scrub and CI setup.

Done:

• make preflight is present and wired to scripts/preflight.sh.
• docs/local-setup.md documents KVM, Firecracker, ports/assets/config expectations, and expected local failures.
• The public core no longer requires billing, hosted plan checks, Cloudflare production routing, or private hosted credentials for the documented local path.

Still open:

• The rubric asks for a developer to create/start/stop a minimal machine with local config and local artifacts. That still needs a KVM-backed validation run.
• The KVM integration lane exists, but runner start/stop secrets are not configured yet, so this issue should stay open until local/BYO machine lifecycle is proven on a KVM host.