docs: record P7 publication + live stack (pending VPN)

PROJECT_STATE.md

@@ -7,7 +7,7 @@
 > ThothII per il repository (app + CLI `thothctl`), (3) come usare l'applicazione ThothII di base
 > (sessioni, domande, gate). Il documento userà parole semplici ed esempi; i dettagli tecnici
 > resteranno nei contratti esistenti. Esempio pratico completo: Policlinico San Donato.
- Last updated: 2026-08-13 (P2–P6 accepted; aggregate PASS; P7 repo restructured + validated).
+ Last updated: 2026-08-13 (P2–P6 accepted; P7 published + live stack, pending VPN).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
 ### P3 effective configuration and `.tht-dwh` — implementation complete, automated PASS, manual PASS (2026-08-13)
@@ -146,12 +146,20 @@
 - **Templates:** `deploy/psd/{workspace-bindings,operator,thothii-installation}.env.example` +
   gitignored `secrets/`; operator checklist in `docs/install/psd-workspace-setup.md` (registered in
   MkDocs nav).
-- **Owner-gated (needed to continue):** (1) GitHub remote URL + push credentials for the PSD repo;
-  (2) DWH X-API-Key (+ CA) reuse; (3) LLM provider/model confirmation (default `zai/glm-5.2` already
-  in the descriptor); (4) confirmation of the DWH REST ping (`POST /rpc/ping`, `X-API-Key`) for
-  `diagnostics.dwh_rest`.
-- **Remaining:** Tasks 3–5 of the plan (installation bindings/secrets, stack start +
-  `qwen3-embedding:0.6b` pull, re-embedding/`preprocess run`, live P8 L2 smoke).
+- **Published (2026-08-13):** private repo `https://github.com/mptyl/tht-workspace-psd` (main =
+  `d4f9185`), consumed via SSH deploy key `thothii-psd` (read-write, passphrase-less, generated in
+  `deploy/psd/secrets/`). Real operator config is wired (gitignored): `deploy/psd/operator.env`,
+  `workspace-bindings.env`, `thothii-installation.yaml`, `connector-secrets.yaml` + `secrets/`
+  (DWH X-API-Key reused from the legacy `.env`; no CA — the DWH REST is public HTTPS).
+- **Stack live:** started via `thothctl start` (project `thothii-70417a3e30ea`), all services
+  healthy, `qwen3-embedding:0.6b` present; the registry cloned + activated `psd-clinical`
+  (`ready`); `thothctl workspace inspect` returns `ok` with descriptor/catalog/runtime identities.
+  Gotcha recorded: `thothctl` uses a per-descriptor Compose project name, so the stack must be
+  started with `thothctl start` (not a raw `compose-with-preflight.sh up`).
+- **Blocker:** VPN/DNS — `supabase-aritmolab.policlinicosandonato.it` does not resolve (NXDOMAIN),
+  so DWH `preprocess run` and the live P8 L2 session are pending VPN.
+- **Remaining:** activate VPN → `thothctl … workspace preprocess run --workspace psd-clinical` →
+  live session smoke (P8 L2).
 
 ### Final aggregate P2–P6 verification — automated PASS, manual PENDING (2026-08-13)