From b874e12af67e04abc53e89d49685400fac3866c7 Mon Sep 17 00:00:00 2001 From: AAA <35992542+TNTcraftHIM@users.noreply.github.com> Date: Fri, 21 Aug 2026 14:09:32 +0800 Subject: [PATCH] docs: record 691863e production deployment [skip ci] Production exactness, rollback, artifact, DB/config/service health, local hygiene, and Actions=0 were independently reviewed. No media canary is claimed for this cutover. --- docs/deployment.md | 46 ++++++++++++++++++++++-------------------- docs/project-memory.md | 9 +++++---- docs/status.md | 21 ++++++++++--------- 3 files changed, 40 insertions(+), 36 deletions(-) diff --git a/docs/deployment.md b/docs/deployment.md index d558e3e..a9bf1e9 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -20,31 +20,33 @@ tracked coturn example remains `stun-only`; the shared host retains its older authenticated-relay daemon configuration and firewall range. The application does not pre-advertise TURN credentials to ordinary peers. -Production currently runs exact `6634cb9fca8278b44d57e5fcddcbaf9f0dc9b137` +Production currently runs exact `691863e1720ebbee1b5368f29e94f05b3710ccf8` on the existing shared public IP, with local/public health 200 and SQLite v3 -integrity. The 957,434-byte artifact has SHA-256 -`89ff05dbd4d642ed8364a1e230b26b6f4e1dab5a879a0d40a14364e3a26a5cf7`. -The 2026-08-21T03:53:23Z UTC cutover held the deployment lock for 2,755.457 ms; -local health returned 551.381 ms after service stop (478.335 ms after the symlink +integrity. The 605,904-byte artifact has SHA-256 +`7e751c0bf7c97bc7d23edb1e37441fb6c55d90a0cd80647b778fdb5b1ee28bae`. +The 2026-08-21T06:00:00Z UTC cutover held the deployment lock for 3,376.021 ms; +local health returned 669.678 ms after service stop (604.174 ms after the symlink switch). Screener, LiveKit, coturn, and nginx are active/running with observed `NRestarts=0`. SQLite v3 contains five rooms including room `1`, with the service owner/mode `screener:screener`/0600 and SHA-256 `aef724ae52c4107be8ec8791e72f8dcaa11b0ec849fb432d022e2cfb9cfe0974`. -`SITE_ACCESS_PASSWORD`, -`/api/site-access`, and the nginx limiter replaced their retired Host-admission -names in the prior access cutover; this release preserved the environment hash -and the old endpoint remains 404. Exact -`ecc794d6f01ff8e90cc07a267d221daaac8da9e1` is the immediate rollback target; -exact `16f6eab27bdfb1c15cdbd814a35864f4f18be767` and -`22119b907d3cf03ce8b06d6fb4596ce1a26fedd7` remain secondary and tertiary. -This release gives active SFU Viewers LiveKit connection state/stats instead of -P2P waiting/ICE-unknown placeholders. Details show P2P or SFU and add TURN only -for an actually selected relay candidate; exact-upstream presence feeds the -on-demand Host topology. The release also requests a 128,000 bit/s screen-audio send -ceiling on P2P/relay and LiveKit SFU, disables SFU DTX, and uses `balanced` for -recommended profiles and advanced defaults. The browser still owns degradation, -and the audio value is a requested/read-back ceiling rather than an audible-quality -or stereo guarantee. The selected-edge UDP tuple remains configured with TTL 120. +The immutable release is `/opt/screener/releases/691863e1720e`; backup +`/opt/screener/backups/691863e1720e-precutover-20260821T060000Z` preserves the +database, environment, artifact digest, and exact previous target. Exact +`6634cb9fca8278b44d57e5fcddcbaf9f0dc9b137` is the immediate rollback target; +exact `ecc794d6f01ff8e90cc07a267d221daaac8da9e1` and +`16f6eab27bdfb1c15cdbd814a35864f4f18be767` remain secondary and tertiary. +This release keeps one stable SFU subscriber stream, clears unavailable SFU +video state, shows authoritative pending/P2P/SFU routes while requiring media +evidence for connected status, and labels TURN only for an actual relay. It adds +the Host local-preview pause notice and suppresses current-edge signals to a +grace-retained offline target. The shared room-entry and adjacent nickname UI, +a generation-bound Host-only P2P diagnostic, and two downstream slots for every +ordinary Web relay are deployed; a third child remains rejected. The production +STUN/SFU/selected-edge configuration and the database were unchanged. +Fresh exact-source acceptance passed typecheck, 32 test files/469 tests, both +builds, repository hygiene, UTF-8 archive verification, and zero cross-release +regular-file inodes. This cutover triggered no browser, media, SFU, TURN, or performance canary and remains exact-source, build, configuration, and deployment evidence. A separate earlier local Screener canary using exact `16f6eab` source and the @@ -132,7 +134,7 @@ ICE. The accepted ladder is direct/peer UDP, then the revision-bound SFU/UDP virtual parent, then optional authenticated TURN for one controller-selected exceptional edge. LiveKit participants receive only revision-bound `sfu-config` URL/token messages and negotiate within LiveKit's separate ICE domain. The -selected-edge TURN config/wire is deployed in the current `6634cb9` release with one +selected-edge TURN config/wire is deployed in the current `691863e` release with one UDP URL and a 120-second credential TTL. It was not exercised by a real media session during this cutover. @@ -516,7 +518,7 @@ Run these checks from real external networks before calling the deployment usabl and the selected-pair stats report a non-relay path when direct ICE succeeds. 3. On a normal room, exhaust a peer route and verify the host plus at most two necessary roots select LiveKit UDP 7882. Peer descendants stay on - ordinary direct UDP and host/relay downstream caps remain two/one. + ordinary direct UDP and host/relay downstream caps remain two/two. 4. Force one controller-eligible edge past SFU/UDP and verify only that edge gets the short-lived TURN server plus relay policy and selects TURN/UDP. Ordinary peer PCs must stay STUN-only. Then block all UDP and verify bounded recovery diff --git a/docs/project-memory.md b/docs/project-memory.md index 43d68d6..215e448 100644 --- a/docs/project-memory.md +++ b/docs/project-memory.md @@ -15,7 +15,7 @@ Last updated: 2026-08-21 - Site access protects room creation, Host publication, and every code-only Viewer entry. A valid room-scoped fragment grant bypasses that site gate; otherwise site access is checked before public-watch or a private room password. Persist neither raw credential; keep accounts, ACLs, users, and session tables out. - Keep decisions, snapshots, research, code, `AGENTS.md`, and `.codex/` in Git; rewrite memory/status in place. Research current primary sources before material work and reject speculative machinery. - Migrate client, server, and deployment atomically. After a canary, delete superseded config/wire/parsers/tests; do not retain compatibility layers, dual writes, or a second architecture without a current consumer. Git history owns the old implementation. -- Autonomously deploy each coherent low-risk milestone after narrow tests, independent review, one full gate, CI and rollback preflight. Keep protocol/database migrations atomic rather than folding them into routine UI/media updates. +- Deploy coherent milestones after narrow tests, independent review, one local full gate, and rollback preflight. Actions are only for a necessary final main/release gate; migrations stay atomic. ## Current Recommendation @@ -43,8 +43,9 @@ Last updated: 2026-08-21 ## Current Implementation - The repository is one npm package using Node.js 24, React, TypeScript, Vite, native WebRTC, `ws`, Zod, Vitest, and separate coturn. -- Production at `https://share.bonfire.icu` is exact `6634cb9fca8278b44d57e5fcddcbaf9f0dc9b137`; its 957,434-byte artifact SHA-256 is `89ff05dbd4d642ed8364a1e230b26b6f4e1dab5a879a0d40a14364e3a26a5cf7`. Cutover was 2,755.457 ms lock/551.381 ms stop-health/478.335 ms switch-health. Rollbacks are `ecc794d`, then `16f6eab` and `22119b9`. -- Active SFU Viewers use LiveKit state/stats, not P2P waiting/ICE-unknown placeholders. Exact route/topology and `balanced` defaults are deployed. Windows Native stays source-only. +- Production is exact `691863e1720ebbee1b5368f29e94f05b3710ccf8`; artifact 605,904 bytes/SHA-256 `7e751c0bf7c97bc7d23edb1e37441fb6c55d90a0cd80647b778fdb5b1ee28bae`; cutover 3,376.021 ms lock/669.678 ms stop-health/604.174 ms switch-health; rollbacks `6634cb9`, `ecc794d`, `16f6eab`. +- Web keeps one SFU stream, clears unavailable video, shows authoritative pending/P2P/SFU and actual-only TURN, labels paused preview, and drops signals to a grace-retained offline current-edge target. Shared entry/nickname UI is live; Native remains source-only. +- Per-share P2P-only debug is generation-bound and blocks SFU/selected TURN. Web relay is cap2 with one upstream; child3 rejects and no UA/visibility split exists. - Four services are active/running at `NRestarts=0`; local/public health are 200. SQLite v3 has five rooms, SHA-256 `aef724ae52c4107be8ec8791e72f8dcaa11b0ec849fb432d022e2cfb9cfe0974`, owner/mode `screener:screener`/0600. - Production keeps ordinary ICE STUN-only, SFU roots <=2, selected-edge UDP TTL 120, and one pending/answered `peer-selected` attempt per room excluding Host ingress. This rollout ran no browser/media/SFU/TURN/performance canary; earlier exact-`16f6eab` evidence proves active Host ingress only. - Production requires the independent site-access secret through `SITE_ACCESS_PASSWORD`. Its stateless cookie authorizes creation/Host and permits code-only Viewer attempts; valid private fragment grants remain direct. Public-watch accepts site access plus code, while private code-only entry additionally requires the room password. The env, endpoint, cookie, and nginx limiter naming migrated atomically; anonymous failures stay neutral, and there are no accounts/JWT/session rows. @@ -52,7 +53,7 @@ Last updated: 2026-08-21 - ADR-0005 rejects `PEER_ASSISTED_ROOM_IDS`; `PEER_ASSISTED_MEDIA=true` enables every room and ordinary peers stay STUN-only. Initial or active Host ingress may consume one bound relay-only grant; ready/abort clears it and failure restores peer baseline. Stale room-ID config fails startup; `screener-v2` is the only deployed wire. - Chrome 151/LiveKit localhost A/B cut failure-to-active/render from 1.481/2.257 seconds to 0.200/0.320; 31 new frames and 25 ms sampling kept host edges at two. It is headless synthetic 720p30 and includes SDK/network prewarm, not public-network evidence. - Deployed Web uses LiveKit 2.22.0 `q,h`. Chrome 151 proves local SFU/UDP and, separately, active selected TURN/UDP Host ingress against production media services with Viewer frame progress and clean stop. Initial/peer-selected relay, BWE, and C+B remain open. -- The current local source candidate gives every ordinary Web Viewer two relay slots. A Chrome 151 synthetic 720p30 run with five Viewers kept Host/relay fanout at two, advanced both children of one relay by 80 decoded frames and about 1.1 MB each, decoded at every Viewer, and stopped without fatal error. This is bounded functional evidence only; production remains one-slot until the candidate ships. +- Chrome 151 five-Viewer 720p30 cap2 evidence: Host/relay fanout two; both relay children +80 decoded frames/~1.1 MB; every Viewer decoded; clean stop. Functional only; resource and heterogeneous-network behavior remain open. ## Provisional Quality Targets diff --git a/docs/status.md b/docs/status.md index 5eedc86..cb0d611 100644 --- a/docs/status.md +++ b/docs/status.md @@ -4,10 +4,10 @@ Last updated: 2026-08-21 ## Phase -Production at `https://share.bonfire.icu` is exact `6634cb9fca8278b44d57e5fcddcbaf9f0dc9b137`; artifact 957,434 bytes, SHA-256 `89ff05dbd4d642ed8364a1e230b26b6f4e1dab5a879a0d40a14364e3a26a5cf7`. -Cutover: 2,755.457 ms lock/551.381 ms stop-health/478.335 ms switch-health. SQLite v3/five rooms has SHA-256 `aef724ae52c4107be8ec8791e72f8dcaa11b0ec849fb432d022e2cfb9cfe0974`, owner/mode `screener:screener`/0600. Four services are active/running at `NRestarts=0`; rollbacks are `ecc794d`, then `16f6eab` and `22119b9`. +Production at `https://share.bonfire.icu` is exact `691863e1720ebbee1b5368f29e94f05b3710ccf8`; artifact 605,904 bytes, SHA-256 `7e751c0bf7c97bc7d23edb1e37441fb6c55d90a0cd80647b778fdb5b1ee28bae`. +Cutover: 3,376.021 ms lock/669.678 ms stop-health/604.174 ms switch-health. SQLite v3/five rooms has SHA-256 `aef724ae52c4107be8ec8791e72f8dcaa11b0ec849fb432d022e2cfb9cfe0974`, owner/mode `screener:screener`/0600. Four services are active/running at `NRestarts=0`; rollbacks are `6634cb9`, then `ecc794d` and `16f6eab`. Ordinary ICE is STUN-only; limits are SFU roots <=2, one `peer-selected` attempt excluding Host ingress, and selected UDP TTL 120. This rollout ran no browser/media/SFU/TURN/performance canary; earlier exact-`16f6eab` Host-ingress proof remains separate. -SFU Viewers use LiveKit state/stats, not P2P waiting/ICE-unknown placeholders; details label P2P/SFU and TURN only for an actual relay. Exact topology, a 128,000 bit/s audio ceiling and `balanced` defaults are deployed. The ceiling is not a quality/stereo guarantee. Native stays source-only; Web defaults VP8. +Stable SFU stream/unavailable state, authoritative pending/P2P/SFU and actual-only TURN are deployed with Host preview notice, entry/nickname UI, P2P-only debug and Web relay cap2. Native is source-only; Web defaults VP8. ## Execution Principle @@ -17,15 +17,16 @@ Flagship; parallel; min run/smoke/rollback; benchmark later. Active UI/config/lo - Capture precedes room creation; source/quality changes and AV pause preserve peers. Recommended profiles and advanced defaults use `balanced`; clarity/fluid remain explicit. The browser chooses degradation; readback/stats report actual behavior. - Production access is `screener-v2`: a valid private fragment grant enters directly; every code-only Viewer must first hold site access, after which public-watch accepts the code and private rooms still require their room password. `SITE_ACCESS_PASSWORD`, `/api/site-access`, and the site-access cookie are deployed atomically; raw credentials are never stored. -- Source UI uses adjacent nickname editing, distinct site/room prompts, and a shared room-code form; production still has the prior UI. Exact upstream may label green P2P/yellow `SFU fallback` before media proof; connected status still needs evidence and TURN stays actual-only. +- Production UI uses adjacent nickname editing, distinct site/room prompts, and a shared room-code form. Exact upstream may label green P2P/yellow `SFU fallback` before media proof; connected status still needs evidence and TURN stays actual-only. - Native v2 is source-only (memory rooms, 300s reclaim); it follows authenticated direct-child assignments up to two and fails unsupported SFU/selected ingress boundedly. -- Production is roots <=2/Web relay <=1; source gives every Web Viewer cap2, one upstream and bounded sticky recovery. Room `1` is historical; HTTPS/WSS is TLS/TCP. +- Production is roots <=2/Web relay <=2; every Web Viewer keeps one upstream and bounded sticky recovery, while child3 is rejected. Room `1` is historical; HTTPS/WSS is TLS/TCP. +- Host advanced settings offer generation-bound P2P-only debug before sharing; it disables SFU/selected TURN and fails clearly after peer recovery. - After an answer, a generation-bound 15s initial-connect deadline enters ICE restart; success/replacement/disposal cancels it. It is deployed but not mobile-verified. -- Room `1` C+B reparenting remains uncalibrated. Deployed admission rescue promotes an unassigned one-slot relay over the oldest childless zero-capacity Host leaf, with no scores or periodic optimization. +- Room `1` C+B reparenting remains uncalibrated. Deployed admission rescue promotes an unassigned relay over the oldest childless zero-capacity Host leaf, with no scores or periodic optimization. ## Verified Evidence -- Chrome 151 synthetic `1/3/5/8` and 720p30 runs kept bounded fanout/decoding. A five-Viewer cap2 run had one relay serve two children (+80 decoded frames/~1.1 MB each), all decoded and no fatal; local typecheck, 31 files/458 tests and both builds pass. Functional only. +- Chrome 151 synthetic `1/3/5/8` and 720p30 runs kept bounded fanout/decoding. A five-Viewer cap2 run had one relay serve two children (+80 decoded frames/~1.1 MB each), all decoded and no fatal. Functional only. - Chrome 151 + local LiveKit 1.13.5/client 2.22.0 SFU/UDP passed after `q,f` -> `q,h`: one root, decoded 3 -> 23, rendered 26, Host edge one, clean leaves, no TURN. Functional only. - Host A+B and authenticated P2P Viewer C are sanitized, generation-bound, read-only, and fail closed for stale, ambiguous, or SFU-fed evidence; no raw media metadata is retained. - The `a11a73d` built-in TURN canary is rejected: local allocation passed, but direct Host/Pion Viewer failed before forced relay. Full rollback restored STUN-only client ICE and zero allocations. @@ -35,16 +36,16 @@ Flagship; parallel; min run/smoke/rollback; benchmark later. Active UI/config/lo - Access protocol/config/HTTP/storage/SQLite/signaling focused tests pass, including commit-first teardown and v1 rollback. - Native wire/session tests enforce at most two authoritative children, no presence-created edge, stale-revision ignore, and one bounded unsupported-route failure per revision. - Production caps pending/answered `peer-selected` at one per room; Host ingress is independent. Focused admission/release/rollback/STUN-only tests pass; earlier Chrome proves active Host-ingress function only. -- Exact `6634cb9` passed typecheck, both builds, hygiene and 31 test files/459 tests from fresh inputs. Deployment preserved configuration hashes; DB, local/public health, root/room/asset/SiteAccess, retired-endpoint 404 and four zero-restart services passed. +- Exact `691863e` passed fresh typecheck, builds, hygiene and 32 files/469 tests. UTF-8 archive/shared-inode/deploy gates preserved config/nft/DB hashes and four zero-restart services. ## Unverified Boundaries -- The `6634cb9` cutover ran no browser/media/SFU/TURN/performance canary. Earlier `16f6eab` proof covers Host ingress only; audible quality, last mile, external cohorts, admission rescue, resources/performance and game blur remain open. +- The `691863e` cutover ran no browser/media/SFU/TURN/performance canary. Earlier `16f6eab` proof covers Host ingress only; audible quality, last mile, external cohorts, admission rescue, resources/performance and game blur remain open. - Mobile is Viewer-only. Its persistent audible media element keeps media/signaling active while the page lives; iOS lock-screen, reclamation and background reconnection remain device gates. AirPlay/system mirroring is local output; live WebRTC `srcObject` has no portable in-app TV-output contract. - Silent partitions can wait 30 to 60 seconds for heartbeat detection before the default 5-second grace; this remains unverified. - The former release reportedly sustained bandwidth-limited blur on a capable LAN; Host refresh recovered while Viewer refresh did not. The new deployment has not yet reproduced or cleared it. - ADR-0006 has one Viewer proof; two-edge/FIFO, hardware, endurance, public/downloaded-package, and browser-diversity proof remain open. -- Production fanout is Host2/Viewer1; source is Host2/Viewer2 and rejects child3. Resource behavior remains open. +- Production fanout is Host2/Viewer2 and rejects child3. Relay resource behavior remains open. - PR #49/#50 BWE is unverified/default-off: test zero-child leaves, then root impact. No local per-leaf UDP shaper; resume with Linux `tc` or public canary, never CDP. Web P2P/SVC shortcuts remain no-go. - Headful fragment-to-sessionStorage consumption, invitation rotation after migration, and request/log leak inspection remain production UX gates. Accounts stay out. - Structure debt: split `HybridMediaRouter`, `HostPage`, `SignalingServer`, and `ViewerPage` only at proven consumer boundaries, never by file length.