Wire this repository to Veris, once. Re-running skips what is already done.

Setup delivers both a proven application run and the handoff that build and fix consume: .veris/twin.yaml, .veris/NOTES.md, .veris/setup.json, and the two staged ledger helpers. Track those deliverables before starting. A green run alone does not finish setup. Without Git, create the same files and skip only the commits.

Three rules, always:

Never modify the application code, and never point it at a sandbox. The one exception is the direct tier in step 3, where the app already reads each vendor's URL from an environment variable and production sets that same variable. Everywhere else, the container or hosted tier redirects the app's traffic from outside the process, and the code keeps its production hostnames and credentials.
Never print an API key. Login/status output masks platform keys, but data reads can return complete vendor credentials. Redirect credential-bearing data into a protected file and keep values out of commands, reports, and terminal output.
Ask before creating an environment, installing anything, or promoting a sandbox.