Labyricorn/git-website-engine-control-plane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden control plane boundaries
CI / verify (pull_request) Canceled after 0s
Details

Browse Source
This commit is contained in:
Labyricorn
2026-07-25 10:13:22 -07:00
parent a0a4a21962
commit 72e8b2de91
24 changed files with 1507 additions and 1655 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -2
View File
@@ -19,6 +19,8 @@ The build engine now:
## Development
Requires Node.js 22 or later.
npm is the canonical package manager. CI uses `npm ci` and `package-lock.json`;
other lockfiles are intentionally unsupported.
```bash
npm install
@@ -36,6 +38,15 @@ npm start
The development server listens on port `3000` by default. In the current production deployment, the Node service listens privately on `127.0.0.1:3001`; Nginx exposes the control plane on port 80 and the active rendered release on port 3000.
Gitea discovery is disabled until `GITEA_BASE_URL`, `GITEA_ALLOWED_ORIGINS`,
and a read-only `GITEA_TOKEN` are configured. Discovery uses authenticated
HTTPS requests with an abort deadline and per-client rate limiting. Git
connectivity endpoints accept only configured hosts or local repositories under
`GIT_ALLOWED_LOCAL_ROOTS`; they invoke Git without a shell.
The deterministic renderer has no AI SDK dependency and does not accept model
output as a release input.
## Operations
See [Website Engine Operations](docs/OPERATIONS.md) for the verified private-network topology, deployment procedure, service checks, key fingerprints, credential-handling rules, and recovery guidance. The operations document intentionally contains no passwords, tokens, or private-key material.
@@ -57,7 +68,7 @@ Validation failures produce a failed build record but never publish a partial re
## Current boundaries
- Theme packages are presentation data only; Node, shell, WASM, package-manager scripts, custom Liquid tags, and custom filters are not executed.
- The reference loader resolves the configured site-definition repository and supports separately pinned source snapshots through the typed boundary; source-management UX remains follow-up work.
- Remote rsync deployment is still represented by the existing control-plane simulation and must not be treated as a completed production deploy path.
- The reference loader resolves the configured site-definition repository and supports separately pinned source snapshots through the typed boundary; source-management UX remains follow-up work governed by [ADR 0001](.pandaos/adrs/0001-git-source-management-boundary.md).
- Remote rsync deployment is not implemented. Push and connection-test endpoints fail closed with HTTP 501, and no configuration field can enable execution; see [ADR 0002](.pandaos/adrs/0002-remote-publication-not-implemented.md).
See [docs/OPERATIONS.md](docs/OPERATIONS.md) for snapshot, release, promotion, failure, and rollback procedures.