docs: reconcile PRDs with current architecture (post-reorg)

[AlienWalker1995]

Reconciles the 16 PRDs under docs/product requirements docs/ with the current repo (post services/ reorg, single-network consolidation, ops-api split, digest pins). Verified each drift against the live repo (out/docker-compose.yml, ordo/, services/ops-api/main.py, services/edge/, test tree) before editing. Forward-looking roadmap/open-question content left intact.

Docs only — rendered out/docker-compose.yml sha unchanged (654cead5…), ruff clean, pytest tests/ unchanged (559 passed, 4 skipped). Operator WIP (catalog/models.yaml, services/comfyui/plugin.yaml) untouched.

HIGH — false host-port instruction

• milestones Test Plan: model-gateway is not host-published (no ports:; only Caddy publishes host ports). Removed the curl http://127.0.0.1:11435/... step; replaced with an in-network docker compose exec dashboard curl http://model-gateway:11435/... check + the external Caddy :443/llm bearer route.

Cluster: registry.json → registry-custom.yaml

The file the gateway wrapper actually merges (confirmed in ordo/render.py, data/mcp/). Fixed: index, architecture (principle 6, ASCII diagram MCP-gateway box, MCP-gateway component, G2 evidence, gaps row), rollback #3, security outputSchema, risks allow_clients, milestones M3. Kept the dashboard diagram box's registry.json — that genuinely is the dormant optional app.py metadata path (absent, falls back to MCP_CATALOG).

Cluster: two-network → single ordo-net

Confirmed single top-level ordo-net in compose. Fixed: index L40, architecture Compose-Hardening table (was self-contradicting L142) + gaps row, milestones M4 summary/section + M6 acceptance criterion, security threat row, and component-rag-pipeline Qdrant dependency (a stale "backend network" the audit missed).

Cluster: ops-controller → ops-api

Container lifecycle (start/stop/restart/logs/pull), audit log, and the bearer-gated docker.sock belong to ops-api (services/ops-api/main.py), not the ordo serve scheduler. Fixed: architecture components/G3/data-flows, index capability rows, rollback #2, security threat row + correlation flow + stack-secrets note. Added an explicit ops-controller (auth-free scheduler) component entry so the prose matches the already-correct diagram.

Cluster: localhost:11435 from host

No host port on model-gateway. Fixed: model-gateway client-compat row, rollback #8, quality-bar break-glass #4 (+ the HIGH).

Minors

• Test count 57 (34+23) → 62 (37+25) (recounted; per-area breakdown re-derived — orchestration was overstated at 5, real 4; new files categorized; substrate +build_contexts/+cli_render_guard).
• .env.example → ordo.example.yaml + out/secrets.env.example; UPGRADE.md (nonexistent) repointed to CHANGELOG.md/operator guide.
• risks open-webui:v0.8.4 → running v0.10.1.

Deliberately left alone

• reliability-and-contracts.md, component-future.md, and genuinely future roadmap milestones / open questions.
• index L3/L18 stale dates (LOW; not re-asserting an audit date).
• component-mcp-gateway (authoritative, CLEAN) and its servers.txt default (gitignored operator runtime state).
• appendix-env-vars EMBED_MODEL short-name nit (LOW, not in scope).

🤖 Generated with Claude Code