# Configuration Inventory

This inventory defines ownership and persistence boundaries. It intentionally
contains no real host, user, address, account, person, or credential value.

## Committed

| Path | Contents |
|---|---|
| `config/templates/default/` | Empty, public profile template. |
| `config/schemas/` | Profile, private-context, incident, and debug-event schemas. |
| `deploy/systemd/` | Generic service units with no credentials. |
| `deploy/defaults/` | Safe runtime defaults for the generic `jwebot` account. |
| `examples/` | Synthetic SDK and plugin examples. |

## Local Configuration

| Path | Mode | Contents |
|---|---:|---|
| `~/.config/jwebot/` | `0700` | Configuration root. |
| `profiles/<id>/` | `0700` | Source profile package. |
| `profiles/<id>/secrets/` | `0700` | API keys and notification secrets. |
| `profiles/<id>/context/` | `0700` | Private person and bot context. |
| `profiles/<id>/generated/` | `0700` | Atomic runtime output. |
| `current` | symlink | Active profile. |

Generated files are mode `0600`.

## Local State

| Path | Contents |
|---|---|
| `~/.local/state/jwebot/profiles/<id>/debug/sessions/` | Local debugger sessions. |
| `~/.local/state/jwebot/profiles/<id>/incidents/` | Privacy-safe incident records. |
| `~/.local/state/jwebot/profiles/<id>/telemetry/` | Optional bounded telemetry exports. |
| `~/.local/state/jwebot/profiles/<id>/archives/` | Migrated legacy debug/reports. |
| `~/.local/state/jwebot/profiles/<id>/root/` | Protected root-operation evidence. |
| `~/.local/state/jwebot-edge/` | Edge socket and SQLite ledger. |
| `~/.local/state/wechat-adaptive-ocr/` | OCR queue, history, and failed events. |

## Secret Keys

The config compiler recognizes these explicit secrets:

- `JWEBOT_EDGE_DEEPSEEK_API_KEY`;
- `JWEBOT_EDGE_STEAM_API_KEY`;
- `JWEBOT_HEALTH_NOTIFICATION_TOKEN`.

Additional names ending in `_KEY`, `_TOKEN`, `_PASSWORD`, or `_SECRET` are
treated as sensitive by export and scanning tools.

## Runtime Files

| Generated file | Consumer |
|---|---|
| `runtime.env` | Edge, OCR, health monitor, and user services. |
| `root.env` | Bootstrap and coordinated root deployer. |
| `private-context.json` | Kernel identity/alias registry only. |
| `notification.json` | Health notification adapter only. |
| `manifest.json` | Digest and generation metadata. |

Plugins receive none of these files or environment values.

## Never Commit

- populated profiles or generated output;
- debug payloads, incident archives, OCR history, screenshots, or message logs;
- SQLite, WAL, sockets, or process files;
- private person aliases, display names, SteamIDs, or group identifiers;
- host addresses, SSH aliases, usernames, or absolute personal home paths;
- API keys, passwords, tokens, private keys, or signing keys;
- configuration exports created with `--include-private`.