DARK FLOW CRYPTO GUARDIAN - VPS MIGRATION PACKAGE v1.1.0
=========================================================

COMPONENTS
----------
CRM         : v0.4.6
Guardian    : v1.5.0
Sentinel    : v2.4.0
UI Smoke    : V23
Self-Heal   : v1.1
Schedule    : every 15 minutes + Windows startup
Managed repo: C:\dark-flow-cloud

PURPOSE
-------
Move the Dark Flow Crypto Guardian read-only Binance balance relay + Cloudflare Tunnel + fixed Sentinel maintenance bridge + Auto Self-Heal to a new Windows VPS with the smallest possible manual workflow.

SAFETY BOUNDARY
---------------
This package does NOT contain Binance API keys, Binance API secrets, ChatGPT Guardian keys, Cloudflare certs, relay tokens, passwords, Make credentials, or any live trading credentials.
The Guardian relay exposes account-read forwarding plus fixed allowlisted Sentinel diagnostics and explicitly confirmed maintenance only.
Auto Self-Heal may perform only safe infrastructure recovery such as relay/tunnel/stack restart, UI-smoke retry, browser/runtime recovery, live-API retry and maintenance-only Sentinel self-update.
It does NOT expose or auto-run Binance BUY, SELL, transfer, withdrawal, fund-moving reconciliation, Make LIVE mutation, production deploy, destructive git reset or secret/token replacement.

MANAGED REPOSITORY
------------------
The v1.1.0 installer runs the active system from C:\dark-flow-cloud\crypto-spot-crm.
If C:\dark-flow-cloud is missing, the bootstrap installer clones the main branch of the Dark Flow Cloud repository and relaunches from that managed copy.
If C:\dark-flow-cloud already exists as the expected Git repository, it only allows a safe main-branch fast-forward update. It refuses to overwrite a non-Git folder.
This managed repository is required so CHECK_UPDATE and SELF_UPDATE_SENTINEL continue to work after a clean VPS migration.
Local Playwright/node_modules runtime, Sentinel logs/runtime and private credentials are ignored/excluded from source and deployment packages.

FAST INSTALL
------------
1. Open Administrator PowerShell on the new VPS.
2. Extract the Full VPS Package v1.1.0, or use the one-command web install below.
3. Run:
   powershell -ExecutionPolicy Bypass -File .\INSTALL_CRYPTO_GUARDIAN_VPS.ps1
4. The installer creates/updates C:\dark-flow-cloud and relaunches from the managed Crypto project when needed.
5. Complete Cloudflare browser authorization if prompted.
6. Confirm all three scheduled tasks exist: Guardian Relay, Guardian Tunnel and Crypto Self-Heal.
7. Confirm Self-Heal policy v1.1, every 15 min + startup.
8. After install, replace the OLD trusted IP with the NEW VPS IP only on Binance API key: DARK-FLOW-CRYPTO-GUARDIAN.
9. Keep Enable Reading ON and every trading/transfer/withdraw permission OFF.
10. Do NOT edit DARK-FLOW-CRYPTO-LIVE.
11. Run in ChatGPT: Crypto Guardian full audit

ONE-COMMAND WEB INSTALL
-----------------------
Run from Administrator PowerShell:
  $p="$env:TEMP\df-crypto-guardian-web.ps1"; Invoke-WebRequest -UseBasicParsing "https://crypto.forextamil.com/INSTALL_CRYPTO_GUARDIAN_FROM_WEB.ps1" -OutFile $p; powershell -ExecutionPolicy Bypass -File $p

SERVICE NAMES
-------------
DarkFlowCryptoGuardianRelay
DarkFlowCryptoGuardianTunnel
DarkFlowCryptoSelfHeal

HEALTH CHECK
------------
powershell -ExecutionPolicy Bypass -File .\CHECK_CRYPTO_GUARDIAN_VPS.ps1

Expected Self-Heal output includes:
- policy v1.1
- every 15 min + startup
- HEALTHY / HEALED when operational
- soak IN_PROGRESS until the 48-hour clean soak completes

SAFE SERVICE REPAIR
-------------------
powershell -ExecutionPolicy Bypass -File .\REPAIR_CRYPTO_GUARDIAN_VPS.ps1

UNINSTALL SERVICE TASKS
-----------------------
powershell -ExecutionPolicy Bypass -File .\UNINSTALL_CRYPTO_GUARDIAN_VPS.ps1

The uninstall removes Relay, Tunnel and Self-Heal scheduled tasks but intentionally leaves Cloudflare tunnel/DNS objects and the Binance Guardian key untouched.

EXPECTED HEALTH
---------------
Guardian Relay: Running
Guardian Tunnel: Running
DarkFlowCryptoSelfHeal: Ready or Running
Self-Heal latest: HEALTHY or HEALED
UI runner: NODE_DIRECT_CRYPTO_UI_V23
UI bad_tabs: []
UI fatal_error: ""
Local relay health: PASS
Public Cloudflare Tunnel health: PASS
Bridge diagnose: PASS
Guardian audit: HEALTHY
Binance balance transport: VPS_RELAY
Money-moving actions: FALSE

MIGRATION NOTE
--------------
Install and verify the new VPS first. Confirm Guardian + Sentinel + Self-Heal health, then update the Binance Guardian read-only trusted IP. Only after the new Guardian full audit is HEALTHY should you retire the old VPS Guardian Relay/Tunnel/Self-Heal tasks.
