No required central server. Not there yet.

What runs in the wallet today, what still needs a hosted server and why, and the route to no required central server. Every function listed.

ZERO-SERVER READINESS

CAPPZ does not claim "zero servers". Hosted functions remain wherever a secret, a third-party webhook, a privacy boundary, or a timer requires a server. Everything else is moving to the browser, the owning wallet or an operator's edge node, one release at a time. The claim it is working toward is no required central server: any operation runs in the wallet, on a peer, or on any operator's runtime, and the hosted relay is one replaceable option among them.

Where the work runs now.

Today the platform is not there. v15-01-00 moved 28 functions off hosted infrastructure: 26 now run in the browser and 2 keep their records in the owning wallet; 21 with no callers were retired. 70 still run hosted: 24 hold a third-party secret and are ported last, and 46 were planned for this release but moved to vNext, each with the reason it could not move whole. 17 route AI requests through the chosen residency; no in-wallet placeholder answers in place of a hosted function. Each of the 119 functions is registered as its own account with an identity key and content-addressed versions, and registry batches are stamped on the XRP Ledger testnet. Message sync is peer-path. Behind firewalls, copies dial out to a relay node an operator runs; it carries sealed frames it cannot read. Sign-in/admin may still be hosted. Shared administrative records may still use the hosted path while wallet message payloads use peer paths. This page lists every function, what it still needs a host for, and the route to removing that dependency.

Moved to the browser or wallet

Still run hosted

Hosted because they hold a secret

119

Functions registered as accounts

PLACE 1

In the wallet

26 functions in the browser · 2 with their records in the owning wallet · 17 AI requests routed by residency · no placeholders

PLACE 2

On a peer

Message sync is peer-path. Behind firewalls, copies dial out to a relay node an operator runs; it carries sealed frames it cannot read. Sign-in/admin may still be hosted.

PLACE 3

On an operator's runtime

A standalone Deno edge node owns the TCP/QUIC peer sockets and can run BPMN timers and secret-free webhooks as signed TXs. AI inference can also follow the chosen residency.

PLACE 4

On the hosted relay

70 functions still run hosted (24 hold a third-party secret; 46 move in vNext), plus shared administrative records and legacy account routes. Local wallet-proof sign-in is separate. Discovery and offline pickup may optionally use a relay.

What stays hosted, and why.

Holds a third-party secret · 24

Payment ramps, AI keys, SMS, calendar OAuth, XRPL signing and similar keys stay on a runtime that can hold them. Ported last, to operator runtimes the owner chooses.

Moved to vNext — agents · 9

agent_passports, mcp_registered_servers and chainlets are shared across the agent/MCP functions; they move together.

Moved to vNext — ai-vaults · 5

project_vaults, contributor_allocations and revenue_events are shared across the AI-vault and royalty functions; they move together.

Moved to vNext — healthcare · 5

Validation and simulated mode already run in the browser; the live forward needs a CORS relay, which moves to the edge node with the healthcare domain.

Moved to vNext — rap · 5

rap_licenses and rap_events are shared by the five RAP functions; they move together.

Moved to vNext — calendaring · 4

Calendaring state moves as one domain (healthcare_appointments and calendar_config_escrow are shared across these functions).

Moved to vNext — dms · 4

DMS state moves as one domain (dead_man_switches is shared by dms-api, the heartbeat timer, the oracle webhook and foa-api).

Moved to vNext — admin-substrate · 3

Usage partitions live on the same admin chain; moves with admin-users.

Moved to vNext — staking · 3

cappz_stakes, ratings and reputation_scores are shared by staking, rating and dispute functions; they move together. Scheduled by the edge node since v15-36-07 (StakeUnlockTick, hourly; signed tick or administrator only); the work moves with the staking domain.

Moved to vNext — securities · 3

Exchange records settle against the treasury; moves with the settlement domain.

Moved to vNext — insurance · 2

Fraud score RPC reads insurance claim tables; moves with insurance-claim-submit.

Moved to vNext — refdata · 1

Reference-data lists move with the RefData Management skill wallets.

Moved to vNext — replicator · 1

Anonymous public posts have no signer; a hosted table is their home until signed public posting exists (v14-01-00).

Moved to vNext — repoz-notary · 1

cappz_repositories is also written by cappzRepoService, whose heads point into hosted content_versions; moves with the content-lifecycle tables.

Hostless message path. Hosted platform work remains.

The Replicator has a hostless wallet-message path, not a hostless platform. Discovery whispers on the LAN; across firewalls, copies ask. Peers find each other by UDP beacon, a TX bid/ask rendezvous with a relay node, pairing code or wallet breadcrumbs, then move the same checksummed frames over TCP, QUIC, a WebSocket bridge, an outbound relay ladder (WebTransport, WebSocket, HTTPS keep-alive, long-poll) or a USB bundle; nodes pull missing bodies by content hash. No inbound port behind a firewall, no browser required. The standalone Deno edge node owns TCP and QUIC sockets: a signed UDP beacon announces heads on the local network and a verified beacon makes the node dial; pairing codes work anywhere. Every copy holds a signed member table — where each copy's devices accept connections, on a site network or at a public address — and dials peers directly from it; a node answering a TX bid/ask returns its own member record. Only when a peer accepts no connection the copy can reach does it use a relay, and a relay is an operator's edge node, not a hosted service. Every path carries the same frames over the fastest rung the network allows (WebTransport, WebSocket, an HTTPS keep-alive stream, then long-poll). Every connection opens with an Ed25519-signed hello, checked against the device key the wallet declared; peers then exchange inventory and pull missing bodies by content hash in checksummed CPZ1 frames. A browser reaches peers through a relay node or the node's local WebSocket bridge, and is not required for edge networking. Available transports are declared by TransportCapabilityDeclared transactions on the node wallet, not a static table. Wallet-proof sign-in can be unlocked locally. Hosted functions and older account routes still run on hosted services. Function inventory is currently read from a hosted projection of signed function records, not independently from a cold-boot MDM wallet.

What the skill numbers mean.

Every page, guide and machine-readable file takes these numbers from the skill catalog. The site build refuses to ship a page that states a different one.

Skills declared in the catalog

Marked live (at least one operation marked Live)

Callable by name today (hosted relay or real in-wallet handler)

A skill can be marked live without being callable: it then runs only as library code inside the app, with no operation an outside agent can call. Activated on-chain is a live figure — see the current count at https://cappz.ai/ai-agents.

Six things between here and no required host.

Each one lists what happens today and what has to be true instead.

Operations with no fixed host

Today: Every operation is published as a hosted address with a bearer key. Outside agents are told to call one host.

Needs: Operations described by name and schema, with a list of places each one can run: in the wallet, on a peer, on an operator's runtime, or on the hosted relay.

State that lives in wallets

Today: Shared records are read from and written to one hosted database. 59 functions use administrator database access. Chainlet blocks are stamped on the XRP Ledger testnet in Merkle batches, so each one can be proven — but the blocks themselves still live in the hosted database.

Needs: Each owner's records held in their wallet partition and exchanged between peers, with the hosted database kept only as an optional mirror.

Devices that sync directly

Today: Wallet-message peers exchange missing blocks directly over Replicator paths. A standalone edge node owns TCP/QUIC sockets and pulls missing bodies by content hash; signed UDP beacons announce heads, not payloads. Copies dial each other from a signed member table (site network, then public address); only a peer that accepts no reachable connection is reached through an operator's relay node, verified on one machine end to end.

Needs: Prove the relay ladder and TCP/QUIC between separate sites and real corporate proxies, list production relay origins for cappz.ai, and verify recovery from an independently held copy while the hosted service is unavailable.

Identity that belongs to the user

Today: A wallet-proof session can be unlocked locally from a recovery phrase or encrypted device copy. Email, Google, legacy wallet connection, cloud data and administrative access still use hosted account paths.

Needs: Make every required account and privileged action accept verified wallet authority without a hosted account; preserve access for existing users.

Secrets on runtimes the user chooses

Today: 24 functions hold third-party keys (AI, payments, email, data providers) on the hosted runtime.

Needs: The same keys held on any operator's runtime — the owner's machine, a partner node, or the hosted relay — selected by residency.

Somewhere to receive calls from outside

Today: 7 functions receive callbacks from outside services (payments, wallet sign requests, scheduling).

Needs: Any always-on operator node able to receive those callbacks. A browser tab cannot, so this one always needs some online runtime — just not a fixed one.

In order, smallest step first.

Each step removes one reason a hosted server is required. None of them is claimed as done until it ships.

Say what is true

Skill numbers come from one source (92 declared, 71 marked live, 22 callable by name), operations list where they can run, and this inventory is regenerated on every build.

Every function is an account; no placeholders

The placeholder handlers that answered instead of the real hosted function are gone. Each of the 119 functions has its own account, identity key and RepoZ versions, recorded by FunctionCreated / FunctionAmended and stamped on the testnet ledger.

Peer-path Replicator transport

A standalone edge node offers signed UDP discovery, TCP/QUIC transfer with body pull, and a relay for copies behind firewalls (TX bid/ask, then WebTransport, WebSocket, HTTPS stream or long-poll), all with verified signed hellos and checksummed CPZ1 frames. The in-browser demos show copies in one browser or through a local relay; cross-site deployment is a separate path.

Move no-secret compute and notary records off the host

v15-01-00: 26 pure-compute functions run in the browser and 2 keep their records in the owning wallet's partition; existing hosted rows are imported once and left read-only. Each move is a FunctionPorted record correlated with FunctionRetired for the hosted copy. The edge node can now run BPMN timers and secret-free webhooks as signed TXs.

Move the remaining no-secret domains whole

The 46 secret-free functions moved to vNext share tables across their domain (admin chain, DMS, calendaring, agents and MCP, staking, AI vaults, RAP and the healthcare, insurance and securities apps). Each domain moves in one step, so no function reads a half-moved table.

Run on the operator's own runtime

Let the 28 functions that hold keys or receive callbacks run on any operator node, selected by the same residency setting that already routes AI.

Move shared records into wallets

Rebuild the 43 database-backed functions on wallet partitions and peer exchange, with the hosted database as an optional mirror.

Owned identity and hosted-service independence

Extend local wallet proof across legacy account gates and move function lookup and shared admin records to verified wallet replay. Hostless message sync alone does not make the entire platform hostless.

What each one needs a host for.

All 119 functions, grouped by where they run now and the route away from a fixed host. Regenerated on every build; machine-readable at /.well-known/function-inventory.json.

Function
Runs on
In the wallet
Hosted copy
Still needs a host for
Route
agent-skills-agent
Browser
AI, by residency
No
Move into the wallet
ai-schedule-assistant
Browser
AI, by residency
No
Move into the wallet
analyze-document
Browser
AI, by residency
No
Move into the wallet
analyze-feedback
Browser
AI, by residency
No
Move into the wallet
bible-agent
Browser
AI, by residency
No
Move into the wallet
btc-bridge-api
Browser
Real
No
Move into the wallet
build-log-agent
Browser
AI, by residency
No
Move into the wallet
cappz-metatron-agent
Browser
AI, by residency
No
Move into the wallet
cappz-verify
Browser
Real
No
Move into the wallet
design-principles-agent
Browser
AI, by residency
No
Move into the wallet
execReadSelfTest
Browser
Real
No
Move into the wallet
execWriteSelfTest
Browser
Real
No
Move into the wallet
factory-codegen
Browser
AI, by residency
No
Move into the wallet
generate-thumbnail
Browser
Real
No
Move into the wallet
generate-whitepaper-pdf
Browser
Real
No
Move into the wallet
geocode-address
Browser
Real
No
Move into the wallet
healthcare-ai-diagnosis
Browser
AI, by residency
No
Move into the wallet
healthcare-ai-search
Browser
AI, by residency
No
Move into the wallet
healthcare-calculate-drive-time
Browser
Real
No
Move into the wallet
insurance-ai-assistant
Browser
AI, by residency
No
Move into the wallet
iso20022-validate
Browser
Real
No
Move into the wallet
mdm-agent
Browser
AI, by residency
No
Move into the wallet
network-promotion
Browser
Real
No
Move into the wallet
patent-agent
Browser
AI, by residency
No
Move into the wallet
repoz-merge-assist
Browser
Real
No
Move into the wallet
smart-schedule-assistant
Browser
AI, by residency
No
Move into the wallet
agent-session-key
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
ai-inference
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
cappz-issuer-grant
Hosted
None
Yes
Holds a third-party key; Reads or writes the hosted database
Any operator's runtime
create-calendar-event
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
dms-duress-alert
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
dms-oracle-webhook
Hosted (vNext, moved from v15-01-00)
None
Yes
Receives calls from outside; Administrator database access
Any operator's runtime
dms-trigger-executor
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
ehr-inbound-call
Hosted
None
Yes
Receives calls from outside; Holds a third-party key; Administrator database access
Any operator's runtime
feedback
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
function-registry
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
insurance-gold-prices
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
ipfs-pin
Hosted
Real
Yes
Holds a third-party key
Any operator's runtime
ipfs-pin-build
Hosted
Real
Yes
Holds a third-party key
Any operator's runtime
marketplace-payments
Hosted
None
Yes
Receives calls from outside; Holds a third-party key; Administrator database access
Any operator's runtime
mcv-get-availability
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
mcv-google-calendar-connect
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
passkey-sign-transaction
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
realtime-scheduler
Hosted
None
Yes
Holds a third-party key
Any operator's runtime
repoz-github-mirror
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
schedule-reminders
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
send-calendar-invite
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
send-sms-reminder
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
unified-calendar-connect
Hosted
None
Yes
Holds a third-party key; Administrator database access
Any operator's runtime
xaman-webhook
Hosted
None
Yes
Receives calls from outside; Holds a third-party key; Administrator database access
Any operator's runtime
xrpl-anchor-cid
Hosted
Real
Yes
Holds a third-party key
Any operator's runtime
charm-api-proxy
Hosted (vNext, moved from v15-01-00)
Real
Yes
Nothing — can move into the wallet
Move into the wallet
prescription-api
Hosted (vNext, moved from v15-01-00)
None