[ZASI v33 P0] Normalize runtime truth and establish one authoritative control-plane entrypoint #9

Objective

Establish the trustworthy baseline for ZASI — Zero-Entropy Autonomous Superintelligence Infrastructure v33 before adding more autonomous capability.

Source-grounded findings

• backend/server.py is the active standard-library HTTP/WebSocket server and allows ZASI_API_KEY to be empty.
• src/api_server.py is a second HTTP server with a hard-coded default bearer token and public bind behavior.
• main.py still prints v30/168-subsystem status while README/docs advertise v32/176.
• /api/status, telemetry, README badges, and several JARVIS responses use hard-coded operational claims such as 176 Online.
• Current docs mix implemented modules, simulations, research prototypes, and speculative capability names.

Scope

• Select one authoritative ASGI application as the production runtime owner.
• Move legacy servers behind explicit compatibility/development adapters.
• Add dependency-aware /ready and /health semantics.
• Define typed immutable runtime configuration and fail closed for production auth/CORS/bind errors.
• Add capability maturity + runtime state + evidence state to the subsystem registry.
• Replace hard-coded all online/operational claims with registry-derived evidence-backed state.
• Normalize version/subsystem-count reporting across CLI, API, installer, README, changelog, and cockpit.

Acceptance criteria

• Exactly one production entrypoint and port owner.
• Production cannot start with missing authentication material or wildcard CORS.
• Readiness distinguishes process-alive from dependency-ready.
• No operator-facing claim says 176 online without evidence for each relevant capability.
• Simulation/research capabilities render simulated, research_only, unavailable, or unknown as appropriate.
• Compatibility routes are documented and cannot become a second production control plane.
• Tests prove startup fails on duplicate runtime ownership or unsafe production configuration.

Priority

P0 / release blocker for v33.