diff options
| author | Doan Luu Duc Tai <doan@luuduct.ai> | 2026-10-31 13:24:37 -0500 |
|---|---|---|
| committer | Doan Luu Duc Tai <doan@luuduct.ai> | 2026-10-31 13:24:37 -0500 |
| commit | 536ead7243a4d2d8d75eb13159a3d00be4624cae (patch) | |
| tree | 14e1ca6796ba97efbc5462d7a0265d592495c10a /docs | |
| parent | a80df869a92c330fbad9695057720b11a18af901 (diff) | |
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/CHAT-PRODUCTION.txt | 8 | ||||
| -rw-r--r-- | docs/CHAT-SECURITY-REVIEW.txt | 4 | ||||
| -rw-r--r-- | docs/LINTING.txt | 2 | ||||
| -rw-r--r-- | docs/OPERATIONS.txt | 6 |
4 files changed, 9 insertions, 11 deletions
diff --git a/docs/CHAT-PRODUCTION.txt b/docs/CHAT-PRODUCTION.txt index cf8fc17..03f5ba4 100644 --- a/docs/CHAT-PRODUCTION.txt +++ b/docs/CHAT-PRODUCTION.txt @@ -115,10 +115,10 @@ DEPLOY AND CREATE THE REAL OWNER FILE Use the release upload/activation instructions in OPERATIONS.txt. Extract the new prebuilt management binary into var/incoming/bootstrap and invoke - it with --root pointing at the current installation. The older three-service - management binary cannot parse the new chat service schema; do not use that - older binary to activate this release. The new binary verifies the archive - and installs packaged chat artifacts before starting services. + it with --root pointing at the current installation. Use the management + binary from that verified release so activation understands its service + schema. It verifies the archive and installs packaged chat artifacts before + starting services. The host needs rootless Podman prerequisites, user linger, low-port permission, DNS A/AAAA records for CHAT_HOST and www.CHAT_HOST, and the normal 80/443 firewall rules. Caddy obtains and renews public certificates automatically. diff --git a/docs/CHAT-SECURITY-REVIEW.txt b/docs/CHAT-SECURITY-REVIEW.txt index 6257f3c..1bb1108 100644 --- a/docs/CHAT-SECURITY-REVIEW.txt +++ b/docs/CHAT-SECURITY-REVIEW.txt @@ -113,9 +113,9 @@ OTHER AUDIT GATES The project check must audit the whole workspace. A root-package-only cargo-deny invocation misses a workspace member that is not a dependency - of the root CLI. The branch changes that invocation to --workspace. + of the root CLI. The audit invocation was updated to use --workspace. -NEXT GATE +GATE AT THE TIME OF THIS REVIEW Retain the fixed algorithms. Resolve the curve-backend dependency through a reviewed upstream-compatible fix or demonstrate an acceptable alternative diff --git a/docs/LINTING.txt b/docs/LINTING.txt index 6185b0d..33084e9 100644 --- a/docs/LINTING.txt +++ b/docs/LINTING.txt @@ -15,8 +15,6 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. STRICT LINT POLICY - Work is on linting/strict, based on the TypeScript migration. Main and - production are separate until this branch is explicitly merged and deployed. Cargo.toml is the workspace policy; all four packages inherit it. Forbid rejects source-level attempts to lower a lint. Deny rejects a diff --git a/docs/OPERATIONS.txt b/docs/OPERATIONS.txt index c646a99..2c9fa53 100644 --- a/docs/OPERATIONS.txt +++ b/docs/OPERATIONS.txt @@ -302,9 +302,9 @@ MAKE AND DEPLOY A RELEASE rm -rf -- var/incoming/bootstrap Use the management binary from the verified new release for activation. - Older binaries can reject a new service schema before installing it. This - bootstrap path handles the upgrade from three services to the chat-enabled - release without installing a compiler or overwriting private configuration. + Older binaries can reject newer service schemas. The verified release + binary handles activation without installing a compiler or overwriting + private configuration. Activation verifies the release and platform, replaces public source and the binary, loads exact images, preserves .env and var/data, and replaces |