Documentation addresses app authors and operators in the present tense; provenance and history live in git, issues, and decision records. Drops the issue citations from app-ticket and hosting, and replaces the validation section's account of its own earlier wording with the one fact an operator needs: the boot-time warning is benign.
- commit
- 02e056f4180039c7d0907ea669968b33c0c85eca
- parent
- 1b14a9961dff4eceabe2cc88bb1b6f80b9a80e81
- author
- Dami <dami.etoile@gmail.com>
| M | docs/ | 10 | +++++----- |
| M | docs/ | 11 | ++++------- |
@@ -47,8 +47,8 @@ The node's access gate validates the secret (timing-safe, digest vs digest), str
4747 ## Scopes: sync vs provision4848 4949 - **`sync`** (default): transport only. Admin/catalogue-mutating routes (`…/apps/<id>/admin/…`)50- answer the SAME `401 {"error":"invalid_ticket"}` as an unknown secret — nothing to enumerate. This51- is what lofi#109 calls "enrolling a ticket attaches transport only and never mutates the store."50+ answer the SAME `401 {"error":"invalid_ticket"}` as an unknown secret — nothing to enumerate.51+ Enrolling a ticket attaches transport only and never mutates the store.5252 - **`provision`**: a strict superset of sync — everything above PLUS store administration. For5353 provision-scoped HTTP requests the gate **injects the node's `X-Jazz-Admin-Secret` itself** (on5454 `/admin/*` and on catalogue reads like `/schemas` and `/schema/<hash>`, which the merge-deploy@@ -90,9 +90,9 @@ their lineage is.
9090 9191 ## Store-status preflight9292 93-Against a store with **no deployed schema, client writes hang indefinitely** (lofi#109's pinned94-failure surface) — so a sync-only client needs a preflight it can reach without the admin secret.95-Any valid ticket (sync scope included) may call:93+Against a store with **no deployed schema, client writes hang indefinitely** — so a sync-only client94+needs a preflight it can reach without the admin secret. Any valid ticket (sync scope included) may95+call:9696 9797 ```9898 GET <ticket.url>/store-status@@ -48,7 +48,7 @@ app-side flow: [app-ticket.md](app-ticket.md).
4848 A store with no deployed schema is unusable — client writes hang (preflight with4949 `GET <ticket.url>/store-status`, see [app-ticket.md](app-ticket.md)). Two paths publish a schema:5050 51-**Primary — runtime provisioning via a provision ticket** (the lofi#109 opt-in flow): issue51+**Primary — runtime provisioning via a provision ticket**: issue5252 `lofi-node ticket issue --provision --label app-setup` and hand it to the app. On enrollment the app5353 splits it through the scope-down exchange (everyday transport rides a derived sync ticket; admin5454 capability unlocks through a passkey ceremony when provisioning actually runs). The app (or any@@ -106,12 +106,9 @@ build-time env becomes unnecessary — the app enrolls the ticket at runtime ins
106106 - lofi's opt-in browser convergence gate (`tests/convergence_e2e_test.ts`) **passes against107107 lofi-node**: two real Chromium clients with the backup-and-sync election performed, concurrent108108 offline edits, reconnection, full bidirectional convergence — identical results against lofi's own109- managed dev server. (An earlier version of this section reported the gate failing with110- `CatalogueWriteDenied`; that diagnosis was wrong. The gate was not electing sync, so both clients111- ran local-only by design, and the warning — which every browser client logs once at boot on every112- server, converging or not — was misattributed as the cause. lofi's decision record113- `docs/decisions/0002-convergence-verdict.md` carries the evidence.) Headless two-client114- convergence passes as before — see `tests/convergence_test.ts`.109+ managed dev server. Browser clients log one benign `CatalogueWriteDenied` warning at boot on any110+ server; it does not affect sync. Headless two-client convergence also passes — see111+ `tests/convergence_test.ts`.115112 116113 ## Pairing two homes117114