Skip to main content
Use Quickstart for the hosted product path. This page is for self-hosted AXON operators deploying their own Decision API and dashboard.

​
Database (Supabase)

  1. Ensure Row Level Security (RLS) is enabled on all tables
  2. Add your production domain under Authentication > URL Configuration
  3. If you use the kill switch, ensure you have a manual SQL unfreeze path

​
Platform (Frontend)

The frontend is a Vite + React SPA.

​
Build

​
Deploy to Vercel / Netlify

  1. Connect your repository
  2. Set Root Directory to platform
  3. Add environment variables:
    • VITE_SUPABASE_URL
    • VITE_SUPABASE_ANON_KEY
    • VITE_AXON_DECISION_API_URL

​
Decision Daemon (Backend)

The backend runtime is the Decision daemon. It serves /health, /ready, and /v1/* on port 3030.

​
Configuration

Local development reads axon-402-mcp/.env if present. Start from the checked-in example:
Hosted deployments should provide the same keys via the host environment or a secret manager.

​
Minimum Live Configuration

Add MASTER_MNEMONIC when AXON_SIGNING_MODE=full. If you need static operator routes such as /v1/metrics, /v1/webhooks/dispatch, or /v1/operator/mcp, also set AXON_DECISION_API_KEY.

​
Start

​
Cloud Run

Use the supported deploy script:
The script intentionally uses gcloud run deploy --update-env-vars, not --set-env-vars, so out-of-band tuning and opt-in worker flags survive deploys. For a fresh service, seed required live env vars such as AXON_MCP_PUBLIC_URL before first traffic.

​
Health Gate

Only proceed if /ready returns 200, checks.auth.ok is true, checks.supabase.ok is true, and config_issues is empty or warn-only. For a fresh deployment, expect /ready to stay non-ready until the default wallet and mandate exist. The supported path is to bootstrap first, then re-check readiness.

​
Docker

​
End-to-End Test Plan

  1. Create the first operator account in Supabase Auth, or sign in with your configured browser auth flow
  2. Complete the onboarding wizard at /onboarding
  3. Verify the vault is created in the Vault page
  4. Verify the first agent pocket exists in Workforce
  5. Mint a runtime key or register AXON in your MCP/OpenClaw client
  6. Run one low-risk governed fetch
  7. Run one approval-required flow
  8. Confirm axon-op auth whoami works with an org-wide operator key

​
Security Checklist

  • Verify user_organizations isolation with a second test account
  • Ensure SUPABASE_SERVICE_KEY is never used in the frontend
  • Verify the daemon refuses to start when both AXON_DECISION_API_KEY and AXON_PLATFORM_AUTH_ENABLED=true are absent
  • Verify /ready is green before exposing
  • Treat server-held mnemonic custody as a high-trust deployment: use a secret manager, isolate the host, and start with low treasury balances until you have exercised approval, freeze, and recovery paths