Evidence Topic: Controlled public deployment repository

Metadata

Date: 2026-07-29
Status: Active
Scope: Source publication and public-server deployment handoff
Confidence: Fact
Source: Local candidate snapshot, automated tests and static configuration checks
Last verified: 2026-07-29
Stale trigger: Any change to Dockerfile, Compose, Caddy, Web processing flags, authentication, dependency pins or public topology

Question

Does the publishable source snapshot open XML processing through both supported container launch paths without exposing local state, credentials or unfinished report claims?

Evidence

Files: Dockerfile, compose.yaml, deploy/Caddyfile, deploy/.env.production.example, deploy/README.md, arr_web/app.py, arr_web/run.py, tests/test_arr_web.py.
Git: initial deployment snapshot commit a701de9f0eff7402fe1785c3b35de5652576152a and XML-entry fix commit ad3d9878c5aa8d956339ef6871322000e694f5ca were pushed to origin/main; independent ls-remote returned the fix SHA before the documentation closeout commit.
Deployment command inspection: Dockerfile default Web CMD and Compose Web command both contain --enable-processing; Compose also contains --secure-cookies. Only Caddy maps host ports 80/443 in the documented Compose topology, while Web and MCP use internal expose ports.
Regression: tests/test_deployment_entrypoints.py parses the Dockerfile JSON CMD, requires --enable-processing, and rejects accidental enablement of monthly, company-report or legacy Agent-writeback mutations.
Tests: Python 3.12 full discovery ran 260 tests successfully; 2 environment-dependent artifact-tool tests were skipped.
Integrity: every entry in CHECKSUMS.sha256 passed and 10 JSON contracts parsed.
Snapshot audit: 271 final candidate files, about 2.0 MiB, zero files over 1 MiB, zero symlinks, eight ZIP/XLSX archives inspected and zero detected secret/private-endpoint hits after documented placeholder allowlisting.
Configuration: Compose YAML parsed and assertions confirmed both required Web flags. Docker/Caddy executables are absent locally, so no image build or public TLS runtime result is claimed.

Finding

The repository snapshot now makes direct Docker-image launches and Compose launches consistent: both request XML processing, while the source CLI remains default-closed and the page opens upload only after the database, guarded OSS, SuperAgent and HMAC runtime initialize. The documented Compose topology protects Web traffic with Caddy HTTPS plus Basic Auth, and MCP retains application bearer authentication.

Authentication Supersession Note — 2026-07-30

The paragraph above remains historical evidence for the 2026-07-29 published snapshot. Current ARR2 deployment no longer uses Caddy Basic Auth or an active MCP surface: Caddy terminates HTTPS, ARR Web owns login/session/CSRF/logout, and Compose injects ARR_WEB_USERNAME / ARR_WEB_PASSWORD. Use the current root and deploy/ runbooks.

Impact

The server must rebuild/redeploy the image; a platform-level CMD override must retain --enable-processing. processing_ready=true remains the deployment prerequisite, but business completion still requires SuperAgent tool rediscovery and an MCP committed/already_committed receipt with matching database facts.

Open Items

Rebuild and start the latest containers on the public Linux server; verify that /api/health reports both database_ready=true and processing_ready=true.
Rebind and republish the SuperAgent MCP configuration against the stable MCP domain.
Execute one no-PII XML end-to-end commit test.
Implement automatic post-commit monthly dispatch and the required TOTAL PRICE formula in separately authorized work.

3.7 KiB Raw Blame History