Soften product docs: miner-first capacity wording.

Drop marketed no-Verda adapter slogans from README and docs; keep protocol never constraints and allow scripts/qa factual names.

Author: echobt

README.md

@@ -23,7 +23,7 @@
 
 Hypercluster is a [Base Intelligence](https://github.com/BaseIntelligence/base) challenge service. Miners can **supply** GPU/CPU capacity (register nodes, list offers, host pods) and **demand** Modal-like multi-node jobs (browse offers, rent, submit work). The challenge owns marketplace lifecycle, topology-aware InfiniBand/NCCL planning (local simulator in default CI), optional dstack TEE offline verification, optional **non-TEE SSH GPU host probe** (FakeSsh in default CI), and a four-factor scoring engine that emits **raw hotkey weights** to Base master.
 
-Hypercluster scores marketplace honesty and execution quality. It is **not** a commercial cloud broker and **does not ship** a Verda (or other cloud) product adapter. You do **not** need a commercial GPU broker account to mine. Self-owned SSH fleets and inventory registered through the home-grown APIs are the product path. Multi-node fabric validation defaults to a deterministic local simulator; GPU probe gates use FakeSsh offline; live single-GPU rent + RealSSH probe are optional maintainer tooling under `scripts/qa/` outside the product package tree. Challenge never calls `set_weights`; formula stays `correctness × efficiency × fabric_gate × tee_bonus`.
+Hypercluster scores marketplace honesty and execution quality. Miners bring self-owned SSH fleets or other inventory and register it through the home-grown marketplace APIs. Capacity obtained out-of-band (including commercial rentals) can feed those same APIs; commercial cloud clients stay ops tooling and are not required to mine. Multi-node fabric validation defaults to a deterministic local simulator; GPU probe gates use FakeSsh offline; live single-GPU rent + RealSSH probe are optional maintainer helpers under `scripts/qa/`. Challenge never calls `set_weights`; formula stays `correctness × efficiency × fabric_gate × tee_bonus`.
 
 Trust model: **cryptographically-anchored trust-but-audit**. Signed miner/provider writes, digest-pinned jobs, fabric gates, optional TEE multipliers, integrity zeros on spoof paths. Multi-node InfiniBand is not an encrypted confidentiality fabric under GPU CC/TDX; TEE bolsters collocated honest compute, not wire secrecy across ranks.
 
@@ -119,13 +119,13 @@ Copy `.env.example` for `CHALLENGE_*` / `HYPER_*` knobs. Never commit tokens.
 
 ## Validation quick reference
 
-Default gates are local only (unit, integration, sim). They never auto-load commercial cloud credentials. GitHub Actions runs the same quality bar (lint, format, mypy, no-verda fence, pytest with coverage, Docker build/publish) on every push; see [`.github/workflows/ci.yml`](.github/workflows/ci.yml).
+Default gates are local only (unit, integration, sim). Gated tests do not require cloud credentials. GitHub Actions runs the same quality bar (lint, format, mypy, import-boundary audit, pytest with coverage, Docker build/publish) on every push; see [`.github/workflows/ci.yml`](.github/workflows/ci.yml).
 
 ```bash
 uv run ruff check .
 uv run ruff format --check .
 uv run mypy
-uv run python scripts/check_no_verda.py
+uv run python scripts/check_no_verda.py   # import-boundary / dep audit
 uv run pytest -q -m "not live_verda and not integration" --cov=hypercluster --cov-fail-under=70
 uv run hypercluster sim doctor --offline
 uv run hypercluster sim run-scenario --name smoke --url http://127.0.0.1:3200
@@ -140,7 +140,7 @@ Canonical sim scenario order: `smoke` → `marketplace` → `nccl` → `tee-offl
 ```text
 src/hypercluster/     # FastAPI app, domain, fabric, attest, scoring, CLI, sim
 tests/                # unit, API, CLI, fabric, attest, docker (serial)
-scripts/qa/           # external maintainer-only live ops helpers (not product adapters)
+scripts/qa/           # maintainer-only live helpers (serial rent/probe; optional)
 docs/                 # product documentation
 docker/               # vendor wheel staging for image builds
 Dockerfile            # healthchecked challenge image on :8000

docs/architecture.md

@@ -59,7 +59,7 @@ flowchart TB
 | Component | Responsibility |
 | --- | --- |
 | **API layer** | Base `/health` `/ready` `/version`, public `/v1/*` routes, signed write auth, `get_weights` hook |
-| **Marketplace** | Providers, nodes, offers, leases, pods; hard price/lifetime guards; home-grown (not a cloud adapter) |
+| **Marketplace** | Providers, nodes, offers, leases, pods; hard price/lifetime guards; first-party marketplace |
 | **Jobs** | Admit → place → provision/bind → run → collect → score → teardown; CAS-style queue claims |
 | **Fabric** | FabricReport discovery, pack/spread placement, NCCL env matrix, multi-node launch contract, honesty injects in sim |
 | **GPU probe** | Non-TEE SSH allowlist inventory + open CUDA microbench; FakeSsh default in CI; evidence APIs/CLI; integrity hooks only |
@@ -109,7 +109,7 @@ Host proxy form under Base: `/challenges/hypercluster/...`. Relative paths above
 - Ordered fatal/advisory SSH checks (`nvidia-smi`, UUID uniqueness, open CUDA microbench, optional docker runtime).
 - **FakeSsh** is the default transport for gated CI; production refuses silent fake.
 - Private keys: **file/env `key_ref` only**; SQLite stores fingerprints/refs — never PEM.
-- Live commercial rent + host probe remains external maintainer tooling (`scripts/qa/*`); not a product cloud adapter.
+- Live commercial rent + host probe remain external maintainer tooling (`scripts/qa/*`).
 - Full table and security notes: [GPU probe](gpu-probe.md).
 
 ## Jobs and marketplace handoff
@@ -123,20 +123,20 @@ Score → weight snapshot → push to master
 Teardown lease policy on terminal or terminate
 ```
 
-## Local vs product paths
+## Default gated CI vs operator runtime
 
-| Path | Default CI | Product runtime |
+| Path | Default gated CI | Operator runtime |
 | --- | --- | --- |
 | Self inventory / SSH fleets | Simulated | Yes |
 | Multi-node IB/NCCL | **Local sim required** | Real fabrics when operators supply them |
 | GPU host probe | **FakeSsh fixture matrix** | RealSSH allowlist when operators supply hosts/keys |
 | TEE offline fixtures | Required | Enabled when proofs present |
 | Live TEE hardware | Optional skip | Optional (`HYPER_TEE_LIVE`) |
-| Commercial cloud rental | Forbidden in gated tests | Not a product dependency; optional external capacity behind a hotkey |
+| Commercial cloud rental | Forbidden in gated tests | Optional external capacity behind a hotkey; clients stay out of band |
 
 ## Out of scope (product)
 
-- First-party Verda / commercial broker SDK or OAuth client
+- First-party third-party cloud broker integration (optional future)
 - Challenge-side `set_weights` or chain UID mapping
 - Full R=2 multi-node re-execution as default honesty
 - Claiming InfiniBand encryption from GPU CC/TDX alone

docs/gpu-probe.md

@@ -2,10 +2,10 @@
 
 Hypercluster can verify that a provider host has real GPU inventory and can perform a
 minimal open CUDA smoke **without TEE**. The pipeline is Lium-inspired (ordered fatal
-vs advisory SSH checks) and is **owned by the challenge**: no closed job provers,
-no SN51 collateral markets, and **no commercial-cloud product adapter**.
+vs advisory SSH checks) and is **owned by the challenge**: open CUDA / allowlist SSH;
+no closed job provers; no SN51 collateral markets.
 
-## Formula and chain fences
+## Formula and chain boundary
 
 ```text
 composite = correctness × efficiency × fabric_gate × tee_bonus
@@ -80,7 +80,7 @@ Exit codes: **0** passed, **2** failed checks, **3** transport/error, **1** usag
 | No PEM in API bodies or evidence JSON | Operator keys live on disk (`0600`) or env |
 | Allowlist SSH only | Unknown `command_id` abandoned; no free-form remote shell |
 | Redacted raw | Response/store redaction + output caps |
-| No Verda in product | Live cloud rent remains external `scripts/qa/*` only |
+| Live rent path | Optional maintainer scripts under `scripts/qa/` |
 
 ## Live maintainers path (optional)
 

docs/live-qa.md

@@ -4,13 +4,13 @@
 **Default CI and `pytest`:** never run live commercial rentals; never auto-load broker credentials. GPU probe gates in CI use **FakeSsh only**.  
 **Miners:** you do **not** need a commercial GPU broker account. Self-owned inventory through the home-grown marketplace is enough.
 
-This protocol proves that Hypercluster's **product marketplace APIs** still accept a real single-GPU host when an operator provides capacity obtained out-of-band, and (optionally) that a **RealSSH GPU probe** yields `host_probe.json` / product evidence. It is **not** multi-node InfiniBand validation (that remains local sim). It does **not** authorize a product Verda adapter, does **not** call `set_weights`, and does **not** change the four-factor scoring formula.
+This protocol proves that Hypercluster marketplace APIs accept a real single-GPU host when an operator provides capacity obtained out-of-band, and (optionally) that a **RealSSH GPU probe** yields `host_probe.json` / product evidence. It is **not** multi-node InfiniBand validation (that remains local sim). It does **not** call `set_weights` and does **not** change the four-factor scoring formula.
 
 ## Hard boundaries
 
 | Rule | Policy |
 | --- | --- |
-| Product package | No Verda/SDK/OAuth client; no `api.verda.com` adapter in `src/hypercluster` |
+| Product package | Commercial request clients are not part of the `src/hypercluster` package |
 | Gated tests | Local unit/integration/sim + **FakeSsh GPU probe** only |
 | Shape | **One** small **single-GPU** instance |
 | Concurrency | Serial only |
@@ -23,7 +23,7 @@ This protocol proves that Hypercluster's **product marketplace APIs** still acce
 
 ## Tooling layout
 
-External-only helpers live under `scripts/qa/` (outside the product adapter surface:
+Optional maintainer rent tooling under `scripts/qa/`:
 
 | Module | Role |
 | --- | --- |
@@ -38,7 +38,7 @@ Default hard caps in the smoke runner are intentionally tight (rate and total bu
 ## Operator sequence
 
 1. **Start challenge API without commercial-cloud credentials in process env.**  
-   Challenge must remain free of `VERDA_*` so product isolation audits hold.
+   Do not put commercial credentials in the challenge process environment.
 2. **In a separate ops shell**, load external credentials from an **out-of-tree** file owned by the operator (mode-restricted). Do not write those values into the repo, docker-compose, or challenge settings.
 3. **Run catalog availability at order time** (prices and stock drift). Prefer cheapest available single GPU that still can complete a short smoke.
 4. **Deploy one instance only** via ops tooling (not product package imports used for production APIs).
@@ -51,14 +51,14 @@ Default hard caps in the smoke runner are intentionally tight (rate and total bu
 Example command shape (placeholders; adjust paths for your environment):
 
 ```bash
-# API shell: no VERDA_*
+# API shell: no commercial broker credentials
 export CHALLENGE_SHARED_TOKEN=dev-token
 export CHALLENGE_DATABASE_URL=sqlite+aiosqlite:////tmp/hypercluster-live/challenge.sqlite3
 export HYPER_COMBINED_WORKER=true
 mkdir -p /tmp/hypercluster-live
 uv run hypercluster serve --host 127.0.0.1 --port 3200
 
-# Ops shell: credentials loaded privately else where; never committed
+# Ops shell: credentials loaded privately elsewhere; never committed
 uv run python scripts/qa/verda_single_gpu_smoke.py \
   --base-url http://127.0.0.1:3200 \
   --evidence-dir ./.docs-evidence/live-qa
@@ -77,7 +77,7 @@ Use a **gitignored** evidence directory (for example `.docs-evidence/`). Do not
 
 | Artifact | Content |
 | --- | --- |
-| Product audit | Clean no-Verda product tree audit lines |
+| Product audit | Clean import-boundary / dep audit lines for `src/hypercluster` |
 | Rental summary | Instance type, location, $/hr (no tokens) |
 | Product ids | Provider/node/offer/lease/pod identifiers |
 | Job terminal state | Job id and terminal status summary |
@@ -96,7 +96,7 @@ Use a **gitignored** evidence directory (for example `.docs-evidence/`). Do not
 ## What success does **not** claim
 
 - Does not replace sim gates for multi-node fabric.
-- Does not authorize embedding commercial SKUs into first-party product adapters.
+- Does not make commercial cloud SDKs part of the first-party miner path.
 - Does not change scoring formula or emission math (`set_weights` remains off-limits to the challenge).
 - Does not require miners to create commercial broker accounts.
 - Does not treat product sim job success alone as silicon-green without host probe evidence when M9 silicon is claimed.

docs/marketplace.md

@@ -1,6 +1,6 @@
 # Marketplace
 
-Hypercluster implements a **home-grown**, Lium-shaped marketplace entirely inside the challenge. Product code does not call commercial broker APIs. Capacity is whatever providers register (self fleets, lab clusters, or capacity a provider obtained out-of-band).
+Hypercluster implements a **home-grown**, Lium-shaped marketplace entirely inside the challenge. Capacity is whatever providers register (self fleets, lab clusters, or capacity a provider obtained out-of-band). Commercial broker clients, if any, stay outside the product path.
 
 ## Objects
 

docs/operations/README.md

@@ -48,7 +48,7 @@ Container listens **8000** internally; compose maps host **3250**. SQLite /data
 
 ## Configuration
 
-See `.env.example` for `CHALLENGE_*` and `HYPER_*` knobs. Prefer secret files for tokens. Never place commercial broker credentials in the challenge process environment for product isolation guarantees.
+See `.env.example` for `CHALLENGE_*` and `HYPER_*` knobs. Prefer secret files for tokens. Do not place third-party broker credentials in the challenge process env.
 
 ## Quality gate
 

docs/provider/README.md

@@ -1,6 +1,6 @@
 # Provider guide (supply)
 
-Providers advertise compute capacity into Hypercluster’s home-grown marketplace. Capacity can be self-owned SSH fleets, lab clusters, or hardware obtained outside the product (commercial rentals remain **ops-owned**, never a product SDK dependency).
+Providers advertise compute capacity into Hypercluster’s home-grown marketplace. Capacity may be self-owned or obtained ops-side; miners only need the marketplace APIs (self fleets, lab clusters, or inventory offered by a provider hotkey).
 
 ## Prerequisites
 

docs/security.md

@@ -23,7 +23,7 @@ Incomplete or invalid signatures are rejected. CLI helpers must not print tokens
 | Product knobs | `HYPER_*` | Separate from Base `CHALLENGE_*` prefix |
 | Provider SSH material | Operator-managed outside public payloads | Do not store plaintext secrets in git; GPU probe persists **fingerprint / key_ref only** (never PEM in SQLite or evidence JSON) |
 | GPU probe FakeSsh | Tests / explicit allow only | Production must not silently fake silicon (`HYPER_SSH_TRANSPORT=real` default path fails closed without keys) |
-| Commercial cloud QA secrets | Outside product process and outside default pytest | Never required for miners; never product Verda adapter |
+| Commercial cloud QA secrets | Outside product process and outside default pytest | Never required for miners; not injected into challenge process env by default |
 
 Product documentation and `.env.example` use placeholders only.
 
@@ -32,7 +32,7 @@ Product documentation and `.env.example` use placeholders only.
 - Challenge SQLite on `/data` is the only durable store for marketplace/jobs/scores.
 - Challenge never writes Base master Postgres and never executes validator `set_weights`.
 - Raw weights are finite non-negative floats; NaN/Inf/negative weights are invalid.
-- Outbound product policy denies commercial Verda control-plane hosts; optional maintainer tooling under `scripts/qa/` runs **outside** the challenge package import graph for product audits.
+- Outbound product policy restricts commercial control-plane hosts used by optional QA helpers; maintainer tooling under `scripts/qa/` runs outside the challenge package import graph.
 
 ## Integrity and scoring
 
@@ -55,7 +55,7 @@ Self-deal and spam soft penalties can damp aggregated hotkey mass without invent
 | No PEM storage | SQLite and public evidence expose at most key fingerprint / ref kind+name |
 | Redaction | Evidence stores redacted short raw; secrets scrubbed from messages |
 | FakeSsh boundary | Default gated CI uses FakeSsh fixtures; production refuses silent fake |
-| Live cloud ops | External `scripts/qa/*` only; product package remains free of Verda SDK/OAuth |
+| Live cloud ops | External `scripts/qa/*` only; product package has no embedded commercial broker SDK/OAuth client |
 
 See [GPU probe](gpu-probe.md) for the ordered fatal/advisory table.