makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

correct contained Codex runtime plan

Browse source
This commit is contained in:
makearmy 2026-07-12 15:02:29 -04:00
parent 0e3d5ea5ca
commit 13ec935e87
3 changed files with 275 additions and 512 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/le-app-database-migration/implementation-plan.md
View file

@ -9,13 +9,16 @@ Status: revised pre-implementation plan. Work stops at the Milestone 0 host-runt
- Review `architecture-proposal.md`, `environment-parity.md`, and host prerequisites.
2. **Host runtime gate — requires human approval/provisioning**
- Provision the dedicated `le_app_codex` account and a rootless Docker context owned only by it.
- Preserve the completed inert `le_app_codex` Phase 1 identity/workspace; do not rerun bootstrap artifacts.
- Select the Phase 2 package path separately; never perform a partial Arch upgrade or install the unmodified AUR extras package.
- Use a version-matched, checksum-pinned Moby launcher and a genuine per-user Docker service managed through root-controlled `user@1200.service`; never enable lingering or run `dockerd` from a system service with `User=le_app_codex`.
- Apply containment and the proposed `user-1200.slice` limits to the complete user manager; accept only `unix:///run/user/1200/docker.sock`.
- Create an IPv4-only root-owned namespace with default-deny egress and explicit host/LAN/WireGuard/metadata/private/loopback/bridge/SMTP/IPv6 denial after DNS and complete address inventories are approved.
- Restrict production environment files currently readable to `sol6_vi`; verify the development account cannot traverse production paths.
- Use deterministic CPU BGBye initially; defer optional rootless GPU provisioning.
- Approve browser-profile-scoped local CA trust for HTTPS testing.
- Confirm nonproduction storage/capacity locations.
- Verify forbidden production paths and sockets are inaccessible.
- Execute every positive and negative preflight in `host-runtime-plan.md` before application work.
- Resolve authentication and disk-quota policy separately; confirm nonproduction storage/capacity locations.
- Execute every inert positive and negative preflight in `host-runtime-plan.md` before starting the user manager, Docker, Codex, or application work.
3. **Reversible canonical-path consolidation — separately approval-gated**
- Inventory the transitional Git roots, symlinks, credential filenames, rootful disposable containers, and volumes without reading secret values.