docs(P00): clarify — 4 ambiguities auto-resolved (full autonomy)

D-027: VMID=auto (fresh allocation via pve_nextid)
D-028: Docker installed inside CT via apt (no PVE host Docker)
D-029: Image built inside CT (clone repo + docker build)
D-030: CT network=vmbr0 DHCP only (no proxy/TLS for pilot)

---ci---
project: praxis
phase: 0
milestone: v0.2
status: clarify
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,8 +1,14 @@
 {
   "phase": 0,
-  "stage": "specify",
+  "stage": "clarify",
   "milestone": "v0.2",
   "phase_role": "pre_execution",
   "attempts": 0,
-  "updated_at": "2026-08-01T14:00:00Z"
+  "updated_at": "2026-08-01T14:05:00Z",
+  "clarifications": {
+    "D-027": "VMID=auto (fresh allocation)",
+    "D-028": "Docker installed inside CT via apt",
+    "D-029": "Image built inside CT (clone repo + docker build)",
+    "D-030": "CT network=vmbr0 DHCP only (no proxy/TLS)"
+  }
 }

.ciagent/PROJECT.md

@@ -93,6 +93,10 @@ v0.2 deploys praxis into a Proxmox LXC container, reusing and adapting the battl
 | D-024 | Voice-service keys = **infrastructure-only** for v0.2 | User-directed. Server starts and `/health` passes even without CARTESIA/OLLAMA keys (v0.1 graceful degradation). Keys provisioned in a later milestone. Only GITEA_TOKEN + DEEPGRAM_API_KEY are in `.env.secrets`. | 0.90 | Provision all keys in v0.2 (premature — deploy infra first) |
 | D-025 | Image distribution = **host-build → `pct push` tarball** (research decision, see RESEARCH.md) | The LXC CT may not route to the internet (coreci pattern: host-fetch → pct push). Build the Docker image on the PVE host (Docker available on Proxmox host) and `docker save | pct exec -- docker load`, or `pct push` a tarball. Avoids needing a container registry. | 0.75 | Gitea container registry (requires registry setup), Docker Hub (external dependency) |
 | D-026 | Proxmox secrets sourced from **`~/coreci/.ciagent/.env.secrets`** | Same Proxmox cluster, same operator. PROXMOX_API_URL/TOKEN/NODE/STORAGE/TEMPLATE_VOLID already provisioned there. Praxis's `.env.secrets` adds GITEA_TOKEN + DEEPGRAM_API_KEY. The deploy script sources both. | 0.90 | Duplicate proxmox secrets in praxis (drift risk) |
+| D-027 | VMID = **`auto`** (fresh allocation via `pve_nextid`) | CLARIFY auto-decide (full autonomy). Don't reuse coreci's fixed PROXMOX_LXC_VMID — praxis gets its own CT on the same cluster. | 0.95 | Reuse coreci's VMID (collision), hardcode a new fixed VMID (manual allocation) |
+| D-028 | Docker installed **inside the CT** via apt (CT has network via vmbr0 DHCP) | CLARIFY auto-decide. Avoids needing Docker on the PVE host. The debian-12 template + nesting=1 supports Docker-in-LXC. firstboot hook runs `pct exec` to install `docker.io` + `docker-compose-v2`. | 0.90 | Docker on PVE host (extra host dependency), pre-baked template (custom template maintenance) |
+| D-029 | Image built **inside the CT** (clone repo from Gitea, `docker build`, `docker compose up`) | CLARIFY auto-decide. Self-contained — CT fetches its own source + builds. No image transfer needed. Slower first-boot (~3-5 min for build) but simpler and reproducible. | 0.80 | Build on PVE host + pct push tarball (host Docker dependency), pre-built image from registry (external dependency) |
+| D-030 | CT network = **vmbr0 DHCP only** (pilot, no vmbr1, no Traefik proxy) | CLARIFY auto-decide. v0.2 is infrastructure-only pilot. Direct bridge IP access for health-check. Proxy/TLS deferred to a later milestone. | 0.90 | vmbr1 + Traefik proxy (over-scoped for pilot) |
 
 ### Confidence updates from research