FINBOT LOCATION-AGNOSTIC SERVER — 2.2.0

DELIVERY SCOPE
server.py is a new compatible public-tunnel entrypoint built from the delivered
FinBot client package. The recovered package contained finbot_client.py and
gated_client.py, not the privately installed server.py named in the request.
It is not an asserted byte-for-byte patch of an unseen server. No deployment,
external probe, broker action, credential access or trading interruption occurred.

REMOTE ACCESS
The founder can use the configured HTTPS address from a phone or laptop anywhere.
The Mac-side tunnel privately forwards to port 8870; the founder's device never
needs the Mac's loopback address. The origin server remains privately bound;
public hostname checks are entirely configurable and not tied to that bind IP.

Launch after your offline audit, using your existing local verifier module:
python3 server.py --gate-provider YOUR_LOCAL_VERIFIER_MODULE --public-url https://qzotic-gateway.sotality.com

Replace the module name with your existing trusted host implementation.
For an assigned temporary Cloudflare tunnel, use its exact HTTPS hostname:
python3 server.py --gate-provider YOUR_LOCAL_VERIFIER_MODULE --public-url https://YOUR-ASSIGNED-NAME.trycloudflare.com

--public-url is repeatable. It authorizes that hostname and its browser origin.
For a separately hosted frontend use --trusted-origin followed by its exact HTTPS
origin. These can instead be listed in public_urls/trusted_origins in
server_config.json. No credentials belong in that configuration.

The package accepts assigned public URLs, not every trycloudflare tenant.
host_valid() checks configured names; it does not return True globally.
do_POST() uses the configured origin policy, not a loopback-only origin test.
Preflight OPTIONS permits GET/POST and Content-Type/X-FinBot-Session for configured
origins only. Missing Origin on nonbrowser requests never bypasses authentication.
Forged X-Forwarded-Host is not trusted automatically. CORS is not authentication.

SHARED PUBLIC HOST ROUTING
Keep the existing host snapshot route /api/snapshot mapped to your existing
private gateway. Route the client dashboard assets, /api/auth, /api/logout,
/api/gate-status and /api/client/snapshot to this client server on port 8870.
The client uses /api/client/snapshot to avoid masking the host snapshot route.
If the tunnel maps the upstream snapshot back into this client by mistake, a
bridge-hop guard returns UPSTREAM_ROUTE_LOOPS_TO_CLIENT instead of recursing.
A separate dedicated dashboard hostname is another supported arrangement.
Your tunnel/router configuration is not installed or modified by this ZIP.

AUTHORIZATION BOUNDARY
Your existing local provider must expose:
verify_primary(username, password, totp): return principal string only when all
  three checks succeed. The host owns Google Authenticator and replay policy.
verify_host_secret(principal, secret): return exactly True after checking the
  independent host secret. No permissive provider or credentials are included.

The 15-second hold and 180-second deadline apply only to pending login.
Host approval before the deadline cancels the pending-login timer. Approved
access is not timed out at 180 seconds. Logout/revocation remain available.
An expired unverified login clears only its own state and tracked connection.
No trading-engine process, broker order, existing broker session, or financial
database is stopped or modified. The client remains read-only.

DATA HANDLING
No missing balance is changed to zero. Source freshness is unknown unless the
host supplies a timezone-aware captured_at. Last received financial values are
host reports, not independently reconciled fills. Secrets are not logged/stored.
Application state and controlled byte buffers can be cleared; physical-RAM,
swap and runtime-copy erasure is not guaranteed by Python/browser code.

TESTS / VERIFICATION
python3 -m unittest discover -s . -v
node test_monitor.cjs

47 Python tests and 8 monitor scenarios passed. Tests include assigned public
hosts, public-origin POST, configured CORS preflight, unassigned tunnel denial,
forwarded-host spoof denial, authentication enforcement, login deadlines,
preservation of approved sessions, and gateway recursion prevention.
Syntax/compilation, manifest SHA-256 and ZIP CRC checks passed.
Browser visual rendering, your private verifier, actual tunnel routing and Mac
installation remain unverified. This is source for your audit, not a claim that
your publicly running server has already been changed.
