docs: record factory zte live state

wiki/factory-zte-live-state.md

@@ -0,0 +1,40 @@
+---
+title: "Factory ZTE live state"
+created: 2026-06-16T09:45:00.000Z
+updated: 2026-06-16T09:45:00.000Z
+confidence: 0.8
+last_updated_by: fable-agent
+status: active
+tags: [factory, zte, rsi, verifier]
+sources: ["live fable-agent factory check", "session memory"]
+---
+
+# Factory ZTE live state
+
+## Verified live facts
+
+- `deploy-webhook` health at `http://77.42.112.29:8098/health` is live and returns `ok`.
+- `factory-status` at `http://77.42.112.29:8099/factory-status` currently returns `404`.
+- `fable-agent factory check` treats missing factory status as `unknown`, not as stale memory.
+- `fable-agent factory gate <task> --repo .` fails closed if live factory status is unavailable.
+- `--diagnostic-only` permits non-deploy diagnostics and writes ZTE receipts during repo verification.
+
+## Memory conflict
+
+Older memory says `git-proxy` serves `/factory-status` and reports 25 containers. Current live checks do not verify that. Live state wins over memory for deploy gates.
+
+## Current fable-agent role
+
+`fable-agent` is the safety cortex for the factory:
+
+1. make ZTE spec
+2. scan prompt/untrusted context
+3. enforce inherited deny policy
+4. run repo verifier
+5. check live factory/deploy health
+6. write ZTE receipt
+7. block deploy unless live gate and auth contract are valid
+
+## Next gap
+
+Restore or relocate the authoritative factory-status endpoint, then update this note and the CLI endpoint config if needed.