stackchain/timmy-talking-turd
2
0 Fork 0
Code Issues 21 Pull Requests 7 Actions 4 Packages Projects Releases 41 Wiki Activity

Provision Phase 1 private Timmy staging for Alexander #57

New Issue
Closed
opened 2026-08-21 14:54:41 +00:00 by timmy · 2 comments
timmy commented 2026-08-21 14:54:41 +00:00
Owner
Copy link
Copy source

Parent: #53

Human gate: Alexander explicitly requested a private staging deployment for manual release testing and feedback. Provision Phase 1 only from reviewed main 067afaed4c4736c35b9c573e95ce481906b7e739.

  • Dedicated locked user, immutable /opt/timmy-staging release tree, standalone root-owned Node, mode-600 environment/access files, hardened reviewed systemd unit.
  • Authenticated HTTPS route at https://forge.alexanderwhitestone.com/timmy-staging/, preserving /git/ and existing routes.
  • Hermes and vision forced disabled.
  • Promote only a clean gated source archive with verified checksum; health and mobile smoke must pass or rollback.
  • Deliver credentials only to Alexander's private Telegram DM, never this group, source, issue, logs, or release assets.
  • Record exact verification and rollback receipts without secrets.
Parent: #53 Human gate: Alexander explicitly requested a private staging deployment for manual release testing and feedback. Provision Phase 1 only from reviewed main `067afaed4c4736c35b9c573e95ce481906b7e739`. - Dedicated locked user, immutable `/opt/timmy-staging` release tree, standalone root-owned Node, mode-600 environment/access files, hardened reviewed systemd unit. - Authenticated HTTPS route at `https://forge.alexanderwhitestone.com/timmy-staging/`, preserving `/git/` and existing routes. - Hermes and vision forced disabled. - Promote only a clean gated source archive with verified checksum; health and mobile smoke must pass or rollback. - Deliver credentials only to Alexander's private Telegram DM, never this group, source, issue, logs, or release assets. - Record exact verification and rollback receipts without secrets.
timmy added this to the M3 — Private Beta & Longitudinal Value milestone 2026-08-21 14:54:41 +00:00
timmy commented 2026-08-21 15:01:29 +00:00
Author
Owner
Copy link
Copy source

Provisioning preflight update (no credentials):

  • Dedicated locked timmy-staging account created.
  • Root-owned standalone Node 22 installed at the reviewed non-home path.
  • Hardened systemd unit installed and parser-verified; service remains stopped with no release selected.
  • Root-only staging access material generated locally; not copied into source/issues/log output.
  • Live Caddy remains unchanged.
  • Preflight discovered strict CSP blocked inline runtime config and progress styles. Issue #58 / PR #59 corrects this without unsafe-inline; exact-CSP mobile acceptance now passes.
  • Initial clean-main release build correctly failed closed on a synthetic test fixture matching the secret scanner; fixture renamed explicitly as test-only and scanner now passes.

Next gates: PR #59 CI/review, merge, fresh clean-main release build, then authenticated Caddy route and atomic promotion with rollback checks.

Provisioning preflight update (no credentials): - Dedicated locked `timmy-staging` account created. - Root-owned standalone Node 22 installed at the reviewed non-home path. - Hardened systemd unit installed and parser-verified; service remains stopped with no release selected. - Root-only staging access material generated locally; not copied into source/issues/log output. - Live Caddy remains unchanged. - Preflight discovered strict CSP blocked inline runtime config and progress styles. Issue #58 / PR #59 corrects this without `unsafe-inline`; exact-CSP mobile acceptance now passes. - Initial clean-main release build correctly failed closed on a synthetic test fixture matching the secret scanner; fixture renamed explicitly as test-only and scanner now passes. Next gates: PR #59 CI/review, merge, fresh clean-main release build, then authenticated Caddy route and atomic promotion with rollback checks.
timmy commented 2026-08-21 15:13:34 +00:00
Author
Owner
Copy link
Copy source

Provisioning completed after all gates passed.

Live receipt:

  • URL: https://forge.alexanderwhitestone.com/timmy-staging/
  • unauthenticated request: 401
  • authenticated health: 200, release daily-2026-08-21.1, commit 47294a98aa319d2badb41f817a65e044d2dbfe19
  • Hermes disabled; vision disabled
  • process bound only to 127.0.0.1:4174
  • dedicated timmy-staging user; ProtectHome=yes, ProtectSystem=strict, PrivateTmp=yes, NoNewPrivileges=yes
  • Gitea /git/ remained 200 before and after Caddy reload
  • exact strict CSP active; live mobile staging smoke passed
  • immutable archive SHA-256: f30369e422a9d6c51ed70a0fc44c3a36123b42e7dd73ec134cfba763438718e4
  • release video SHA-256: 92d75e0491cdaa3192ab14fed7f2b2d0a388ecc4a7ad00f975cee5237a38a076
  • uploaded assets downloaded independently; both checksums matched; downloaded MP4 fully decoded
  • automatic/manual rollback tooling remains installed and tested

Authentication material remains root-only and was not copied into this issue, source, release, command output, or logs.

Provisioning completed after all gates passed. Live receipt: - URL: https://forge.alexanderwhitestone.com/timmy-staging/ - unauthenticated request: 401 - authenticated health: 200, release `daily-2026-08-21.1`, commit `47294a98aa319d2badb41f817a65e044d2dbfe19` - Hermes disabled; vision disabled - process bound only to `127.0.0.1:4174` - dedicated `timmy-staging` user; `ProtectHome=yes`, `ProtectSystem=strict`, `PrivateTmp=yes`, `NoNewPrivileges=yes` - Gitea `/git/` remained 200 before and after Caddy reload - exact strict CSP active; live mobile staging smoke passed - immutable archive SHA-256: `f30369e422a9d6c51ed70a0fc44c3a36123b42e7dd73ec134cfba763438718e4` - release video SHA-256: `92d75e0491cdaa3192ab14fed7f2b2d0a388ecc4a7ad00f975cee5237a38a076` - uploaded assets downloaded independently; both checksums matched; downloaded MP4 fully decoded - automatic/manual rollback tooling remains installed and tested Authentication material remains root-only and was not copied into this issue, source, release, command output, or logs.
timmy closed this issue 2026-08-21 15:13:34 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
area/backend
Application API and storage
 area/data
Dataset and provenance
 area/frontend
PWA and interaction design
 area/model
Vision model and inference
 area/privacy
Privacy and consent
 area/release
Release engineering and distribution
 area/safety
Clinical safety boundary
 blocked
Blocked on an explicit dependency or decision
 human-gate
Requires explicit human approval
 priority/P0
Release-critical
 priority/P1
High priority
 priority/P2
Planned
 state:review
type/docs
Documentation and evidence
 type/epic
Roadmap epic
 type/feature
Product feature
 type/ops
Infrastructure and operations
 type/research
Research or evaluation
 type/security
Security hardening
 type/test
Verification and quality gate
No labels area/privacy area/release human-gate priority/P0 type/ops type/security
Milestone
No items
No Milestone M3 — Private Beta & Longitudinal Value
Projects
Clear projects
No projects
Assignees
Clear assignees
timmy (Timmy · the Wizard Mind) zephyrus-sparkborn (Zephyrus Sparkborn)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: stackchain/timmy-talking-turd#57