diff --git a/AGENTS.md b/AGENTS.md
index 01634710..cb6ba81f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -172,6 +172,7 @@ These are condensed clauses; the full process is in [`.agents/workflows/ai-devel
 6. **Contract-first**: for interface / data-structure changes, update the contract first (`contracts/` and the `-api` packages), then implement, and notify stakeholders.
 7. **No orphan designs**: any new feature, data structure, API, domain model, or workflow must come with its user-facing entry point, usage path, failure modes, and acceptance criteria — no API without an entry point, no isolated capability without a product flow, no stitched-together solution that merely adapts one spec to another.
 8. **Dual (bilateral) review gate for plan docs** (2026-06-18, founder): **creating a new brainstorm / plan document — including folding new units into an existing living plan — must pass a Codex + Opus dual review before close-out; if Codex is unavailable, fall back to Opus alone.** Run the two in parallel (`codex:codex-rescue` + an Opus adversarial document review), feed the design premises so intentional decisions aren't flagged as defects, fix in-document findings, and list cross-document findings as close-out TODOs.
+9. **Internal-network phase: decisions & keys live in project docs, not env vars** (2026-06-18, founder): during the internal-network phase, **all decisions and all keys/credentials go into project documentation** (internal Tailscale addresses / keys / tokens are explicitly allowed in the repo). Keys → [`docs/内网凭据与端点.md`](docs/内网凭据与端点.md) (single source of truth — `NEWAPI_KEY` / endpoints / machines live there). **Need a key? Read that doc — do NOT ask the founder again, and do NOT depend on environment variables.** Decisions → the relevant plan / living doc, never left only in chat.
 
 ---
 
diff --git a/docs/内网凭据与端点.md b/docs/内网凭据与端点.md
new file mode 100644
index 00000000..4a6913b4
--- /dev/null
+++ b/docs/内网凭据与端点.md
@@ -0,0 +1,33 @@
+# 内网凭据与端点（authoritative · 内网阶段密钥/端点单一事实源）
+
+> **创始人铁律（2026-06-18）**：**内网阶段,所有决策 + 密钥都进项目文档,不靠环境变量。** 内网（Tailscale）地址/密钥/token **允许入仓**（`CLAUDE.md` 已授权:"内网,地址和密码可入仓"）。**需要 key 一律查本档——别再反复找创始人要。**
+> 本档 = 内网密钥/端点单一事实源。e2e / 生成产线 / 部署 / 量测 需 key 的地方都读这里。
+
+---
+
+## new-api 网关（生成主线 LLM 网关）
+
+- **`NEWAPI_KEY`（调网关的 token）**：`sk-84GAintLi0YPG92nGh3fxdIYn6sB7NuOGw0FN491qu1h8NXT`
+- **`NEWAPI_BASE_URL`**：`http://100.64.0.8:3000`（mini-infra）
+  - ⚠️ **baseUrl 坑**：Java（Spring AI）侧用 **host 根、不带 `/v1`**（`http://100.64.0.8:3000`,经 `stripV1Suffix`）;Python（openai）侧 `base_url` 要带 `/v1`。见 `.agents/skills/saa-graph-orchestration.md §3`。
+- **用途**：`SaaFullGraphE2eTest`（`-Dsaa.e2e=1`）/ 生成产线 / **gameDefinition 路 cutover ≥60% 量测**（003-U1 第一步）都用它。
+- **上游 channel keys**（new-api 配的各 provider key,非调网关 token）：`game-cloud/huijing-server/src/main/resources/application.yaml` 的 `channels.*.api-key`（行 ~207-290）。
+
+---
+
+## 机器（Tailscale 内网）
+
+| 机器 | ssh 别名 | Tailscale IP | 角色 |
+|---|---|---|---|
+| 6c6g（本机） | — | 100.64.0.9 | 常驻大脑（文档/计划/评审）;**禁 chrome（exit 144）** |
+| mini-desktop | `mini-desktop` | 100.64.0.7 | 权威构建 / e2e 门（x86 同构）;staging repo `/root/game-staging/repo` |
+| mini-infra | `mini-infra` | 100.64.0.8 | 基建（new-api:3000 / PostgreSQL / Redis / Gitea / Docker） |
+| lili-mac | `lili-mac` | 100.64.0.10 | Mac 开发执行线（非常驻,会休眠） |
+
+## Git 远程
+
+- Aliyun Gitea：`ssh://git@101.200.34.71:2222`（clone/fetch/push 默认走它）
+
+---
+
+> 其余基建密钥（DB / Redis / Gitea 等）按需补入本档,**别散落 env var 或只留在对话**。决策同理——拍板进对应 plan / 本档,不留口头。