To remove need for CORS, we will inject code from the v1host-hosted MetaTrain into the DOM of a page served directly from an instance. This pages should be extremely thin and delegate all responsibilities to the injected code. It's job is simply to reach out and grab the scripts and load them into the page.
See the examples of CommitStream, Estimably, Cashier, etc for prior art.