makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add Phase 2B contained runtime artifacts

Browse source
This commit is contained in:
makearmy 2026-07-12 21:01:17 -04:00
parent a9fec0d83d
commit 82e64cec43
35 changed files with 5177 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/le-app-database-migration/implementation-plan.md
View file

@ -1,6 +1,6 @@
# Laser Everything database transition implementation plan
Status: revised pre-implementation plan. Work stops at the Milestone 0 host-runtime approval gate.
Status: Phase 2A complete; Phase 2B contained-runtime artifacts are review-only. Work stops at the Milestone 0 Phase 2B approval gate.
## Milestone 0 — complete reproducible application environment
@ -10,16 +10,15 @@ Status: revised pre-implementation plan. Work stops at the Milestone 0 host-runt
2. **Host runtime gate — requires human approval/provisioning**
- Preserve the completed inert `le_app_codex` Phase 1 identity/workspace; do not rerun bootstrap artifacts.
- Preserve the provisional Path A selection: prepare a scheduled complete Arch host upgrade, but require separate approval for the final transaction and reboot; never perform a partial Arch upgrade or install the unmodified AUR extras package.
- Record Phase 2A host maintenance as complete and verified; its former provisional package-maintenance gate is superseded. Do not rerun it or install the unmodified AUR extras package.
- Use a version-matched, checksum-pinned Moby launcher and a genuine per-user Docker service managed through root-controlled `user@1200.service`; never enable lingering or run `dockerd` from a system service with `User=le_app_codex`.
- Apply containment and the proposed `user-1200.slice` limits to the complete user manager; accept only `unix:///run/user/1200/docker.sock`.
- Create an IPv4-only root-owned namespace with default-deny egress and explicit host/LAN/WireGuard/metadata/private/loopback/bridge/SMTP/IPv6 denial after DNS and complete address inventories are approved.
- Restrict production environment files currently readable to `sol6_vi`; verify the development account cannot traverse production paths.
- Use deterministic CPU BGBye initially; defer optional rootless GPU provisioning.
- Approve browser-profile-scoped local CA trust for HTTPS testing.
- Resolve authentication and disk-quota policy separately; confirm nonproduction storage/capacity locations.
- Use the refreshed post-NoMachine 220-package checksummed baseline; require exact disposition of the reviewed 234 DrKonqi desktop crash-processing failures and hard-stop on any fingerprint change or other failed unit.
- Verify the repaired `/.snapshots` Btrfs subvolume and create, number, and independently verify an explicit pre-upgrade Snapper snapshot; do not enable Btrfs quotas or treat unavailable quota accounting as snapshot failure.
- Resolve authentication separately. Defer hard disk-growth enforcement without treating mandatory filesystem visibility and CPU/memory/task limits as a storage quota or Phase 2B installation blocker; confirm nonproduction storage/capacity locations.
- Preserve Phase 2A evidence: successful Zen 7.1.3 boot, dual-kernel NVIDIA DKMS, NoMachine removal, stale DKMS cleanup, repaired Snapper pre/post snapshots, protected archive verification, retired Directus disposition, runner cleanup, HTTP 200, and no unexpected failed units.
- Execute every inert positive and negative preflight in `host-runtime-plan.md` before starting the user manager, Docker, Codex, or application work.
3. **Reversible canonical-path consolidation — separately approval-gated**