autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/pateway-gateway-verification.md

@@ -0,0 +1,40 @@
+# Pateway Gateway Verification Checklist
+
+Session lesson (2026-07-07): the gateway itself can be up while the real task is still incomplete because the key pool is empty. Do not report success from a running process alone.
+
+## Completion Criteria for "сделай шлюз"
+
+Treat the task as DONE only when all of these are true:
+
+1. Gateway process is running.
+2. `GET /health` returns 200.
+3. `keys_loaded > 0` (or the exact expected number of owned keys).
+4. `GET /stats` shows the loaded pool.
+5. At least one real upstream request succeeds through the gateway.
+6. If Hermes integration was requested, the provider entry exists and a real Hermes/provider call is verified.
+
+## What does NOT count as done
+
+- "Title changed to API Keys" in the browser.
+- A local proxy listening on a port with `keys_loaded: 0`.
+- A config entry added to Hermes without a verified routed request.
+- Claimed key extraction without a readable key artifact.
+- "Should work" / "almost ready" / "just need one more step" phrasing after the user asked for execution.
+
+## Required reporting style for this user
+
+If blocked, say exactly what is verified and what is still missing.
+
+Good:
+- `Gateway running, but keys_loaded=0. Not done.`
+- `Hermes provider added, but upstream request not yet verified.`
+
+Bad:
+- `Gateway ready` when no keys are loaded.
+- `Keys extracted` without a saved file or visible proof.
+
+## Pateway-specific notes
+
+- The SPA may show `API Keys - PatewayAI` in the document title while still rendering the public landing page.
+- Browser-local indicators (title/hash/modal state) are weaker than actual auth artifacts.
+- Prefer proof in this order: saved key file -> authenticated API response -> gateway stats -> UI clues.