5 files changed, 207 insertions, 13 deletions

diff --git a/REMAINING_PLAN.md b/REMAINING_PLAN.md
new file mode 100644
index 0000000..74ae353
--- /dev/null
+++ b/REMAINING_PLAN.md
@@ -0,0 +1,97 @@
+# TollGate Core — Remaining Execution Plan
+
+**Branch:** `feature/tollgate-core-v2`
+**Created:** 2026-05-23
+**Goal:** Complete all remaining extraction, integration, CI/CD, and publishing steps.
+
+---
+
+## Checklist
+
+### Phase A: Version bump + metadata
+- [ ] A1. Bump `idf_component.yml` to v1.2.0, add MIT license, targets, tags
+- [ ] A2. Create `LICENSE` file (MIT) in `components/tollgate_core/`
+- [ ] A3. Update `CHANGELOG.md` with v1.2.0 entries
+- [ ] A4. Update `README.md` to document all 13 modules
+- [ ] A5. Run `make test-unit` + `idf.py build`
+- [ ] A6. Commit + push
+
+### Phase B: Re-sync component to NerdQAxePlus
+- [ ] B1. Copy 4 new source pairs + updated files to NerdQAxePlus
+- [ ] B2. Verify `TOLLGATE=1 BOARD=NERDQAXEPLUS idf.py build`
+- [ ] B3. Commit + push to NerdQAxePlus develop
+
+### Phase C: Full wallet integration on NerdQAxePlus (Phase 9c)
+- [ ] C1. Copy `nucula_lib/` component and `nucula_src/` submodule to NerdQAxePlus
+- [ ] C2. Update NerdQAxePlus top-level CMakeLists to REQUIRES `nucula_lib`
+- [ ] C3. Replace `spend_proofs` stub with `nucula_wallet_receive()`
+- [ ] C4. Add `nucula_wallet_init(mint_url)` to `tollgate_nerdqaxe_init()`
+- [ ] C5. Wire `get_hashrate` to actual ASIC stats
+- [ ] C6. Wire `on_share_accepted` to real share tracking
+- [ ] C7. Verify build
+- [ ] C8. Commit + push
+
+### Phase D: NerdQAxePlus UI integration (Phase 9d)
+- [ ] D1. Add POST `/api/tollgate/pay` endpoint accepting Cashu tokens
+- [ ] D2. Add minimal captive portal HTML page
+- [ ] D3. Add GET `/api/tollgate/wallet` and POST `/api/tollgate/wallet/send` endpoints
+- [ ] D4. Update portal screen: wallet balance, session count, payment QR
+- [ ] D5. Add session status to mining screen
+- [ ] D6. Verify build, flash, test payment flow
+- [ ] D7. Commit + push
+
+### Phase E: Ansible CI/CD workflow (Phase 10b)
+- [ ] E1. Create ansible role `ci_runner` with tasks for Docker + ESP-IDF
+- [ ] E2. Create Python nostr relay listener script
+- [ ] E3. Create systemd service unit for listener
+- [ ] E4. Create ansible playbook `20-ci-runner.yml`
+- [ ] E5. Create ansible playbook for localhost hardware runner
+- [ ] E6. Test ansible deployment
+
+### Phase F: Publish to IDF Component Registry (Phase 10c)
+- [ ] F1. Create `docs/PUBLISHING.md` with step-by-step upload instructions
+- [ ] F2. Run `compote registry login` (manual — requires browser OAuth)
+- [ ] F3. Run `compote component upload --dry-run` to validate
+- [ ] F4. Run `compote component upload` to publish v1.2.0
+- [ ] F5. Verify with clean test project
+- [ ] F6. Commit + push updated metadata
+
+### Phase G: Hardware smoke test
+- [ ] G1. Flash Board A with updated firmware
+- [ ] G2. Run `TOLLGATE_IP=10.185.47.1 BOARD=a make test-smoke`
+- [ ] G3. Commit any fixes
+
+---
+
+## Execution Order
+
+```
+A → G → B → C → D → E → F
+```
+
+Phase A is quick metadata updates. G verifies on hardware. B syncs to NerdQAxePlus.
+C adds the wallet. D adds the UI. E sets up CI/CD. F publishes.
+
+---
+
+## Architecture Notes
+
+### CI/CD Design
+- **Runner:** Docker container using `espressif/idf:latest` image
+- **Trigger:** Python WebSocket client subscribed to `wss://ngit.orangesync.tech`
+  for NIP-34 git state events (kind 30617)
+- **Pipeline:** clone from GRASP → `idf.py build` → `make test-unit` → report
+- **Hardware tests:** Run on localhost (dev machine) where boards are connected
+- **Reporting:** Build status posted as nostr badge event (kind 1985)
+
+### Wallet Integration Design
+- `nucula_lib` provides C API: `nucula_wallet_init()`, `nucula_wallet_receive()`, `nucula_wallet_send()`, `nucula_wallet_balance()`
+- `spend_proofs` callback in `tollgate_platform_t` maps directly to `nucula_wallet_receive()`
+- Wallet proofs persisted to NVS automatically by nucula
+- `libsecp256k1` already compiled in NerdQAxePlus build with Schnorr + Extrakeys modules
+
+### Component Registry
+- License: MIT (required for upload)
+- Namespace: GitHub username (auto-created on first login)
+- Version immutability: once uploaded, cannot overwrite — must bump version
+- `compote` CLI installed at `~/.local/bin/compote` (v3.0.2)
diff --git a/components/tollgate_core/CHANGELOG.md b/components/tollgate_core/CHANGELOG.md
index b6d664f..946c600 100644
--- a/components/tollgate_core/CHANGELOG.md
+++ b/components/tollgate_core/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.2.0 (2026-05-23)
+
+- Added `tollgate_core_portal` — HTML template rendering, usage calculation, captive URI detection
+- Added `tollgate_core_stratum_client` — Stratum V1 JSON protocol parsing, message building (subscribe, authorize, submit, mining.notify, mining.set_difficulty)
+- Added `tollgate_core_mint_health` — mint health state tracking with recovery threshold (3 consecutive successes), reachable/unreachable transitions
+- Added `tollgate_core_client` — upstream TollGate discovery JSON parsing (kind 10021), session response parsing (kind 1022), usage string parsing, renewal threshold check, price-per-minute calculation
+- Added MIT license for IDF Component Registry compatibility
+- 13 compiled source files, 14 headers, full platform abstraction via `tollgate_platform_t`
+- 25 host unit tests covering all modules
+
 ## 1.1.0 (2026-05-23)
 
 - Added `tollgate_core_beacon` — WiFi vendor IE construction (hash_mint, hash_npub, build_ie)
diff --git a/components/tollgate_core/LICENSE b/components/tollgate_core/LICENSE
new file mode 100644
index 0000000..fc72599
--- /dev/null
+++ b/components/tollgate_core/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 orangesync.tech
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/components/tollgate_core/README.md b/components/tollgate_core/README.md
index d83d634..57bab4d 100644
--- a/components/tollgate_core/README.md
+++ b/components/tollgate_core/README.md
@@ -4,14 +4,27 @@ ESP-IDF component providing paid WiFi hotspot logic with Cashu e-cash payments.
 
 ## Features
 
-- **Session management** — time-based and bytes-based sessions with auto-expiry
-- **Cashu token processing** — decode Cashu e-cash tokens, calculate allotments, multi-mint support
-- **Per-client firewall** — whitelist-based NAT filtering with sandbox mode
-- **DNS server** — per-client DNS hijack/forward with DoT rejection
-- **Mining payment** — Stratum share tracking, hashprice calculation, difficulty conversion
-- **Stratum proxy** — transparent TCP proxy for mining traffic with job management
-- **Beacon price** — WiFi vendor IE construction for price/mint/geohash advertising
-- **Market scanner** — discover and compare nearby TollGate prices
+### Session & Payment
+- **Session management** (`tollgate_core_session`) — time-based and bytes-based sessions with auto-expiry, extension, and revocation
+- **Cashu token processing** (`tollgate_core_cashu`) — decode Cashu e-cash tokens, calculate allotments, multi-mint support, proof state checking
+- **Per-client firewall** (`tollgate_core_firewall`) — whitelist-based NAT filtering with sandbox mode for unauthenticated clients
+
+### Network
+- **DNS server** (`tollgate_core_dns`) — per-client DNS hijack/forward with DoT rejection
+- **Stratum proxy** (`tollgate_core_stratum_proxy`) — transparent TCP proxy for mining traffic with job management
+
+### Mining
+- **Mining payment** (`tollgate_core_mining`) — Stratum share tracking, hashprice calculation, difficulty conversion, share-to-allotment mapping
+- **Stratum client** (`tollgate_core_stratum_client`) — Stratum V1 JSON protocol parsing (mining.notify, mining.set_difficulty), message construction (subscribe, authorize, submit)
+
+### Discovery & Market
+- **Beacon price** (`tollgate_core_beacon`) — WiFi vendor IE construction for price/mint/geohash advertising
+- **Market scanner** (`tollgate_core_market`) — discover and compare nearby TollGate prices via vendor IEs
+- **Mint health** (`tollgate_core_mint_health`) — mint health state tracking with recovery threshold, reachable/unreachable transitions
+
+### Portal & Client
+- **Portal rendering** (`tollgate_core_portal`) — HTML template rendering with multi-key substitution, usage calculation, captive URI detection
+- **TollGate client** (`tollgate_core_client`) — upstream TollGate discovery JSON parsing, session/usage response parsing, renewal threshold logic, price comparison
 
 ## Integration
 
@@ -26,7 +39,15 @@ static tollgate_platform_t platform = {
     .get_mint_url = my_get_mint_url,
     .get_metric = my_get_metric,
     .get_time_ms = my_get_time_ms,
-    // ... other callbacks
+    .spend_proofs = my_spend_proofs,
+    .get_stratum_url = my_get_stratum_url,
+    .get_stratum_port = my_get_stratum_port,
+    .get_stratum_user = my_get_stratum_user,
+    .get_stratum_pass = my_get_stratum_pass,
+    .get_mining_port = my_get_mining_port,
+    .get_hashprice_sats_per_ghs_day = my_get_hashprice,
+    .on_share_accepted = my_on_share_accepted,
+    .get_hashrate = my_get_hashrate,
 };
 ```
 
@@ -54,9 +75,40 @@ tollgate_core_process_payment(client_ip, cashu_token_string);
 
 Call `tollgate_core_tick()` periodically (e.g., every second) to expire sessions.
 
+### 5. Use sub-modules directly
+
+```c
+#include "tollgate_core_portal.h"
+char *html = tollgate_core_portal_render(template, subs, nsubs);
+
+#include "tollgate_core_stratum_client.h"
+tollgate_core_stratum_build_subscribe(buf, size, req_id);
+
+#include "tollgate_core_mint_health.h"
+tollgate_core_mint_health_update(&state, idx, probe_ok, status, err, time);
+
+#include "tollgate_core_client.h"
+bool renew = tollgate_core_client_should_renew(remaining, allotment, threshold);
+```
+
 ## API Reference
 
-See `include/tollgate_core.h` for the public API and `include/tollgate_platform.h` for platform callbacks.
+| Header | Description |
+|--------|-------------|
+| `tollgate_core.h` | Main API: init, process_payment, tick, status queries |
+| `tollgate_platform.h` | Platform callback struct definition |
+| `tollgate_core_session.h` | Session create/find/extend/revoke |
+| `tollgate_core_cashu.h` | Token decode, checkstate, allotment |
+| `tollgate_core_firewall.h` | Client grant/revoke, sandbox ports |
+| `tollgate_core_dns.h` | DNS start/stop |
+| `tollgate_core_mining.h` | Share tracking, hashprice, difficulty |
+| `tollgate_core_stratum_proxy.h` | Proxy init/stop, job management |
+| `tollgate_core_beacon.h` | IE construction, mint/npub hashing |
+| `tollgate_core_market.h` | Market table, price comparison |
+| `tollgate_core_portal.h` | Template rendering, usage calc, captive URIs |
+| `tollgate_core_stratum_client.h` | Stratum V1 protocol parsing |
+| `tollgate_core_mint_health.h` | Mint health state tracking |
+| `tollgate_core_client.h` | Discovery/session parsing, renewal logic |
 
 ## Dependencies
 
@@ -68,4 +120,4 @@ See `include/tollgate_core.h` for the public API and `include/tollgate_platform.
 
 ## License
 
-Proprietary — see repository for details.
+MIT — see [LICENSE](LICENSE).
diff --git a/components/tollgate_core/idf_component.yml b/components/tollgate_core/idf_component.yml
index cdf2ee3..05337d3 100644
--- a/components/tollgate_core/idf_component.yml
+++ b/components/tollgate_core/idf_component.yml
@@ -1,11 +1,25 @@
-version: "1.1.0"
+version: "1.2.0"
 description: |
   TollGate core component for paid WiFi hotspots with Cashu e-cash payments.
   Provides session management, per-client DNS/firewall, Cashu token processing,
-  mining payment tracking, beacon price advertising, and market scanning.
+  mining payment tracking, beacon price advertising, market scanning,
+  portal template rendering, Stratum protocol parsing, mint health tracking,
+  and upstream TollGate client logic.
   Platform-agnostic via tollgate_platform_t callbacks for easy integration
   with any ESP32 firmware (TollGate, NerdQAxePlus, BitAxe, etc.).
 url: https://git.orangesync.tech/npub12m5exm2uk3xa674cc5r0hlyvccs5xxn7qv83ezuteefv5972nquq4j4szl/esp32-tollgate
+license: "MIT"
+targets:
+  - esp32s3
+tags:
+  - wifi
+  - hotspot
+  - cashu
+  - payment
+  - mining
+  - captive-portal
+  - stratum
+  - nostr
 dependencies:
   idf:
     version: ">=5.3.0"