Complete the external v0.2.0 release and production deployment gates

[kubet]

The repository hardening is merged at verified commit 3506ace45ca1516ca519566a88be01e2325f7a58, and exact-SHA CI/CodeQL passed. These remaining gates require maintainer-controlled external systems and must be completed before tagging/publishing/deploying:

• Configure npm trusted publishing for @compify/cli with owner kubet, repository compify, workflow package-release.yml, environment npm-release, and publish permission.
• Decide and execute a reviewed, short-lived 2FA bootstrap for the currently nonexistent @compify/storybook package, then configure the same trusted publisher; otherwise leave it unpublished.
• Register the maintainer SSH public key as a GitHub signing key. The source commits were SSH-signed locally but GitHub reported unknown_key; PR Harden the verified Storybook-to-shadcn handoff #43 therefore required an admin squash. The final squash commit itself is GitHub-verified.
• Provide the private production deployment target/runbook/credentials for compify.app and api.compify.app, or explicitly retire those legacy hosts. The repository and GitHub currently configure no production target.
• Deploy the aligned site/API and verify TLS, readiness, migrations, backup/restore, monitoring, bundler/runtime asset policy, and the full black-box distribution journey on the real domains.
• Only then create protected repository/package tags, run package workflow dry-runs/publications, and attach checksums, SBOMs, image scan reports/digests, and package integrity/provenance to the GitHub release.

Do not weaken OIDC, branch protection, immutable tags, or the documented evidence boundary to bypass these gates.

[kubet]

Deployment update (2026-08-08): the validated 3506ace45ca1516ca519566a88be01e2325f7a58 web/API source is now deployed to the authorized VPS target behind compify.app and api.compify.app. Production schema was backed up, baselined against the initial migration, and migrations 1786121078242/8243 were applied. /health, /ready, OpenAPI, docs, and the public shadcn registry pass live read-only checks. Rollback artifacts remain on the VPS.

At the owner’s request, repository-wide GitHub Actions execution is now disabled to avoid GitHub Actions cost. The required-status-check sub-rule on main was removed because disabled checks cannot complete; signature, linear-history, PR/conversation, no-force-push, and admin enforcement remain. There are no active runs. npm trusted publication/package workflows will require Actions to be deliberately re-enabled later. Remaining operational/package/PMF gates in this issue still apply.

[kubet]

No-cost production hardening update (2026-08-08):

• Merged PR Harden the no-cost production boundary #45 as GitHub-verified 679adcb2593cb56001af1b0da6c0a784a640d7f3 after local API/web lint, builds, 23 suites / 155 tests, zero-vulnerability Bun audits, formatting, release metadata, supply-chain, and Sandpack provenance checks. Hosted Actions remained disabled and no workflow ran.
• Deployed that exact SHA. API, web, PostgreSQL, and MinIO now bind only to loopback; app services run as the unprivileged compify user and MinIO as minio-user under hardened systemd units. Root PM2 was retired.
• Upgraded MinIO to the checksum-verified RELEASE.2025-09-07T16-13-09Z build and applied pending Debian security updates, including the kernel. Rebooted successfully onto 6.1.0-52-arm64 and verified all Compify and Verse services recovered.
• Replaced the warning-producing nginx layout, reject unknown hosts/methods, kept TLS 1.2/1.3, added loopback proxying/security headers, and verified live web/docs/API/registry/images/bundler after reboot.
• Added daily 14-day PostgreSQL + MinIO + config backups with checksums and a successful restore test (13 users, 22 components, 3 migrations, 235 MinIO files). Added a daily verified off-host pull to the maintainer Mac and five-minute external health monitoring with desktop transition alerts.
• Repaired Certbot by archiving two expired no-DNS Cenatik renewal definitions; dry-run renewal passes for all five active Compify/Verse certificates.
• Enabled security-only unattended upgrades without automatic reboot, added a persistent 2 GiB swapfile, rate-limited SSH, disabled SSH passwords/X11/agent forwarding, and added five-minute server-side checks for services, readiness, DB, MinIO, TLS expiry, disk, and backup age.

GitHub Actions remains repository-wide disabled for cost control. Remaining external gates are npm trusted-publisher/bootstrap approval and real adoption/runtime-fidelity evidence; publishing still requires deliberate Actions re-enablement. The local SSH signing key also still needs the GitHub admin:ssh_signing_key OAuth scope to register, although both current main commits are GitHub-verified.

[kubet]

Final source alignment: PR #46 documented the production HOST binding and was squash-merged as GitHub-verified 6a360f01d06f55d407e8858caa6b687cd7d89102. The VPS checkout and final verified local/off-host backup now reference that exact main SHA; runtime artifacts are unchanged from the validated #45 build and all live/server health checks remain green.

[kubet]

Source hardening is now committed and pushed in draft PR #63 at exact SHA caf127328caa094bb583db6e9a41edad64036054.

Local exact-commit evidence is recorded in the PR: PostgreSQL legacy conversion plus separate fresh least-privilege Compose ordering, negative ACL/drift/idempotence/rotation checks, CLI/addon/package tests, pinned shadcn synthetic + licensed external build evidence, web unit/lint/build/Playwright, self-host/distribution smoke, and real API E2E all pass.

No release action was taken. PR #63 remains draft because Actions is repository-wide disabled and the SHA has no remote CI/CodeQL result. The live landing/llms.txt and GitHub repository description also remain stale. Per RELEASING.md, do not merge/tag/publish/deploy/announce until Actions is deliberately re-enabled, required exact-SHA gates pass, npm publication controls are complete, and public surfaces are atomically deployed/aligned and black-box verified.

[kubet]

Manual all-jobs validation is complete and the hardening is merged to main.

• Harden experimental Storybook handoff release #63 merged as verified squash 1e3f633e9c729e0c9213c4208e918bf3dbfacbb5.
• Exact-main image scanning then found remediable HIGH/CRITICAL findings missed by package audits: stale OpenSSL/libcap in the Bun Debian runtime base and vulnerable unused npm packages bundled by the Node base.
• Reject remediable runtime image vulnerabilities #64 remediated those findings and merged as verified squash 70f87e1b1355db378650def590e64ad67c77cbbc (current origin/main). The API now uses the pinned bookworm+Bun ABI used for builds, all final images remove unused npm/Corepack/Yarn/pnpm clients, and CI contains a pinned multiarch Trivy fail-closed gate.

Manual matrix executed because Actions remains disabled: frozen installs and audits; every web/API/CLI/addon/compify-pack/template lint/typecheck/test/build/package check; 247 API tests; migrations up/revert/revert/up; 61 CLI tests; 35 web unit tests; package dry-runs; pinned shadcn synthetic + external build smoke; Gitleaks full-history scan; release/supply-chain/provenance/ShellCheck/Compose checks; PostgreSQL legacy conversion/negative ACL/drift/idempotence/password-rotation coverage; separate fresh least-privilege Compose bootstrap→migrate→grant→verify; self-host lifecycle; 3 browser journeys; distribution smoke; 8 real AppModule API E2E tests; no-cache image builds; CycloneDX SBOM generation; and pinned Trivy scans.

Final image result on the exact main tree: zero remediable HIGH/CRITICAL findings and zero secrets for API, migration, and web. Full reports still list identical Debian bookworm upstream-unfixed findings; those are retained for release risk review rather than hidden. Branch protections remain enabled (signed commits, admin enforcement, linear history, no force-push/delete). Working tree is clean.

No tag, npm publication, production deployment, or announcement occurred. npm publishing controls and atomic live landing/llms.txt/API/GitHub-description alignment remain separate release gates.

[kubet]

Production source deployment is now aligned to current verified main SHA 70f87e1b1355db378650def590e64ad67c77cbbc.

Deployment controls/evidence:

• pre-deploy PostgreSQL custom-format dump and runtime/environment rollback archive created with checksums under a root-only backup directory
• production .env files preserved at mode 0640 root:compify
• exact SHA built in an isolated server worktree first; API frozen install/audit/build and web frozen install/audit/lint/35 tests/44-page production build passed on the VPS
• API and web cut over under their existing hardened systemd units with automatic rollback armed
• local API /health and /ready, web home, nginx, PostgreSQL, MinIO, and both service states passed; no recent API/web error signatures
• external https://compify.app, /llms.txt, compatibility docs, API health/readiness/OpenAPI/registry, security headers, and two non-mutating live Playwright journeys passed
• stale universal landing/llms language is gone; GitHub description is now the aligned narrow experimental CSF→shadcn wording
• deployment worktree removed; production checkout is clean and exact

Important infrastructure boundary: this VPS continues to use its pre-existing systemd + PostgreSQL 15 installation and the API's legacy PostgreSQL superuser credential. It is not the new PostgreSQL 16 least-privilege Compose topology; converting/upgrading that state is a separate reviewed infrastructure migration and was not improvised during this source deployment.

No tag, npm publication, or release announcement occurred. npm trusted-publisher/bootstrap and final release artifacts remain open gates.

[kubet]

Corrective production deployment completed at exact main SHA b0d0945c9b406c201d80528616715b699822ad03 via PR #65.

• restored the pre-Harden experimental Storybook handoff release #63 visual landing experience (hero, features, demo, pricing, gallery, CTAs) per maintainer direction while retaining the current accessible local video, reduced-motion handling, main landmark, and safe auth forwarding
• fixed the reproduced intermittent nav defect: App Router useRouter() has no pathname, so the old hash handler turned repeat clicks on an unchanged hash into router no-ops
• removed the hydration gap where nav links began as []; account and direct CTAs are now real links available in SSR before JavaScript
• anonymous nav hashes now target the restored section IDs
• added exact regression for same hash → scroll away without changing URL → click same nav item again, plus distinct hash, route, mobile, native href, and page-error coverage
• server frozen install/audit/lint/35 tests/production build passed; root-only rollback archive checksum passed
• live old-design screenshot visually checked; three non-mutating live Playwright journeys passed; API remained ready and no recent web service error signatures were found

The prior narrow /llms.txt, docs, and GitHub description remain unchanged. Because the restored historical landing copy contains broader marketing language, public-copy alignment remains an explicit release gate even though the requested visual restoration and navigation reliability fix are live.