stackchain/timmy-talking-turd
1
0
Fork 0
Code Issues 41 Pull Requests 6 Actions Packages Projects Releases 15 Wiki Activity

Provision Phase 1 private Timmy staging for Alexander #57

New Issue
Closed
opened 2026-08-21 14:54:41 +00:00 by timmy · 2 comments
timmy commented 2026-08-21 14:54:41 +00:00
Owner
Copy Link

Parent: #53

Human gate: Alexander explicitly requested a private staging deployment for manual release testing and feedback. Provision Phase 1 only from reviewed main 067afaed4c4736c35b9c573e95ce481906b7e739.

  • Dedicated locked user, immutable /opt/timmy-staging release tree, standalone root-owned Node, mode-600 environment/access files, hardened reviewed systemd unit.
  • Authenticated HTTPS route at https://forge.alexanderwhitestone.com/timmy-staging/, preserving /git/ and existing routes.
  • Hermes and vision forced disabled.
  • Promote only a clean gated source archive with verified checksum; health and mobile smoke must pass or rollback.
  • Deliver credentials only to Alexander's private Telegram DM, never this group, source, issue, logs, or release assets.
  • Record exact verification and rollback receipts without secrets.
Parent: #53 Human gate: Alexander explicitly requested a private staging deployment for manual release testing and feedback. Provision Phase 1 only from reviewed main `067afaed4c4736c35b9c573e95ce481906b7e739`. - Dedicated locked user, immutable `/opt/timmy-staging` release tree, standalone root-owned Node, mode-600 environment/access files, hardened reviewed systemd unit. - Authenticated HTTPS route at `https://forge.alexanderwhitestone.com/timmy-staging/`, preserving `/git/` and existing routes. - Hermes and vision forced disabled. - Promote only a clean gated source archive with verified checksum; health and mobile smoke must pass or rollback. - Deliver credentials only to Alexander's private Telegram DM, never this group, source, issue, logs, or release assets. - Record exact verification and rollback receipts without secrets.
timmy added this to the M3 — Private Beta & Longitudinal Value milestone 2026-08-21 14:54:41 +00:00
timmy commented 2026-08-21 15:01:29 +00:00
Author
Owner
Copy Link

Provisioning preflight update (no credentials):

  • Dedicated locked timmy-staging account created.
  • Root-owned standalone Node 22 installed at the reviewed non-home path.
  • Hardened systemd unit installed and parser-verified; service remains stopped with no release selected.
  • Root-only staging access material generated locally; not copied into source/issues/log output.
  • Live Caddy remains unchanged.
  • Preflight discovered strict CSP blocked inline runtime config and progress styles. Issue #58 / PR #59 corrects this without unsafe-inline; exact-CSP mobile acceptance now passes.
  • Initial clean-main release build correctly failed closed on a synthetic test fixture matching the secret scanner; fixture renamed explicitly as test-only and scanner now passes.

Next gates: PR #59 CI/review, merge, fresh clean-main release build, then authenticated Caddy route and atomic promotion with rollback checks.

Provisioning preflight update (no credentials): - Dedicated locked `timmy-staging` account created. - Root-owned standalone Node 22 installed at the reviewed non-home path. - Hardened systemd unit installed and parser-verified; service remains stopped with no release selected. - Root-only staging access material generated locally; not copied into source/issues/log output. - Live Caddy remains unchanged. - Preflight discovered strict CSP blocked inline runtime config and progress styles. Issue #58 / PR #59 corrects this without `unsafe-inline`; exact-CSP mobile acceptance now passes. - Initial clean-main release build correctly failed closed on a synthetic test fixture matching the secret scanner; fixture renamed explicitly as test-only and scanner now passes. Next gates: PR #59 CI/review, merge, fresh clean-main release build, then authenticated Caddy route and atomic promotion with rollback checks.
timmy commented 2026-08-21 15:13:34 +00:00
Author
Owner
Copy Link

Provisioning completed after all gates passed.

Live receipt:

  • URL: https://forge.alexanderwhitestone.com/timmy-staging/
  • unauthenticated request: 401
  • authenticated health: 200, release daily-2026-08-21.1, commit 47294a98aa319d2badb41f817a65e044d2dbfe19
  • Hermes disabled; vision disabled
  • process bound only to 127.0.0.1:4174
  • dedicated timmy-staging user; ProtectHome=yes, ProtectSystem=strict, PrivateTmp=yes, NoNewPrivileges=yes
  • Gitea /git/ remained 200 before and after Caddy reload
  • exact strict CSP active; live mobile staging smoke passed
  • immutable archive SHA-256: f30369e422a9d6c51ed70a0fc44c3a36123b42e7dd73ec134cfba763438718e4
  • release video SHA-256: 92d75e0491cdaa3192ab14fed7f2b2d0a388ecc4a7ad00f975cee5237a38a076
  • uploaded assets downloaded independently; both checksums matched; downloaded MP4 fully decoded
  • automatic/manual rollback tooling remains installed and tested

Authentication material remains root-only and was not copied into this issue, source, release, command output, or logs.

Provisioning completed after all gates passed. Live receipt: - URL: https://forge.alexanderwhitestone.com/timmy-staging/ - unauthenticated request: 401 - authenticated health: 200, release `daily-2026-08-21.1`, commit `47294a98aa319d2badb41f817a65e044d2dbfe19` - Hermes disabled; vision disabled - process bound only to `127.0.0.1:4174` - dedicated `timmy-staging` user; `ProtectHome=yes`, `ProtectSystem=strict`, `PrivateTmp=yes`, `NoNewPrivileges=yes` - Gitea `/git/` remained 200 before and after Caddy reload - exact strict CSP active; live mobile staging smoke passed - immutable archive SHA-256: `f30369e422a9d6c51ed70a0fc44c3a36123b42e7dd73ec134cfba763438718e4` - release video SHA-256: `92d75e0491cdaa3192ab14fed7f2b2d0a388ecc4a7ad00f975cee5237a38a076` - uploaded assets downloaded independently; both checksums matched; downloaded MP4 fully decoded - automatic/manual rollback tooling remains installed and tested Authentication material remains root-only and was not copied into this issue, source, release, command output, or logs.
timmy closed this issue 2026-08-21 15:13:34 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
area/backend

Application API and storage

  
area/data

Dataset and provenance

  
area/frontend

PWA and interaction design

  
area/model

Vision model and inference

  
area/privacy

Privacy and consent

  
area/release

Release engineering and distribution

  
area/safety

Clinical safety boundary

  
blocked

Blocked on an explicit dependency or decision

  
human-gate

Requires explicit human approval

  
priority/P0

Release-critical

  
priority/P1

High priority

  
priority/P2

Planned

  
state:review

   
type/docs

Documentation and evidence

  
type/epic

Roadmap epic

  
type/feature

Product feature

  
type/ops

Infrastructure and operations

  
type/research

Research or evaluation

  
type/security

Security hardening

  
type/test

Verification and quality gate

No Label
area/backend
area/data
area/frontend
area/model
area/privacy
area/release
area/safety
blocked
human-gate
priority/P0
priority/P1
priority/P2
state:review
type/docs
type/epic
type/feature
type/ops
type/research
type/security
type/test
Milestone
Clear milestone
No items
No Milestone
M3 — Private Beta & Longitudinal Value
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/timmy-talking-turd#57
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?