Operations
Operational knowledge lives primarily in docs/operations/ and release hygiene
artifacts under docs/releases/. Use these sources before changing deploy,
incident, SLO, threat, release, or runbook behavior.
The system wiki should point agents to the right operational source files. It should not duplicate whole runbooks or stale live-state claims.
The operations threat/failure docs now also pin the runtime Authentik-header
boundary: x-forwarded-for is metadata only, the real socket peer is modeled in
regression tests, and configured dashboard-to-runtime calls require the
internal hop credential before trusted x-authentik-* headers are accepted.
docs/operations/container-runbook.md is the operational source for private
compose runtime-token handling. Current compose starts use the ephemeral token
wrapper rather than creating persistent /etc/agent-vault/*.token files on the
Steelmoth VPS.
Edge nginx snippets live under ops/nginx/. They are repo-tracked operational
templates and still need host-level installation, certificate issuance, syntax
validation, and reload on the target machine.
The optional systemd wiki updater lives under ops/systemd/ and runs
scripts/system-wiki-hourly-update.sh. The script fingerprints tracked and
untracked non-wiki source files, serializes with flock, invokes Codex with
the system-wiki refresh prompt when the fingerprint changes, then runs the wiki
checker before recording the new fingerprint.
Maintenance Notes
Section titled “Maintenance Notes”- Update this page when runbooks, SLOs, threat models, failure modes, or release checks change.
- Update this page when tracked nginx vhosts or public docs exposure rules change.
- For live deployable surfaces, pair docs with current container/process inspection before acting.
Known Unknowns
Section titled “Known Unknowns”- This page does not state current live health or release readiness.