2.8 KiB
2.8 KiB
Configuration Inventory
This inventory defines ownership and persistence boundaries. It intentionally contains no real host, user, address, account, person, or credential value.
Committed
| Path | Contents |
|---|---|
config/templates/default/ |
Empty, public profile template. |
config/schemas/ |
Profile, private-context, incident, and debug-event schemas. |
deploy/systemd/ |
Generic service units with no credentials. |
deploy/defaults/ |
Safe runtime defaults for the generic jwebot account. |
examples/ |
Synthetic SDK and plugin examples. |
Local Configuration
| Path | Mode | Contents |
|---|---|---|
~/.config/jwebot/ |
0700 |
Configuration root. |
profiles/<id>/ |
0700 |
Source profile package. |
profiles/<id>/secrets/ |
0700 |
API keys and notification secrets. |
profiles/<id>/context/ |
0700 |
Private person and bot context. |
profiles/<id>/generated/ |
0700 |
Atomic runtime output. |
current |
symlink | Active profile. |
Generated files are mode 0600.
Local State
| Path | Contents |
|---|---|
~/.local/state/jwebot/profiles/<id>/debug/sessions/ |
Local debugger sessions. |
~/.local/state/jwebot/profiles/<id>/incidents/ |
Privacy-safe incident records. |
~/.local/state/jwebot/profiles/<id>/telemetry/ |
Optional bounded telemetry exports. |
~/.local/state/jwebot/profiles/<id>/archives/ |
Migrated legacy debug/reports. |
~/.local/state/jwebot/profiles/<id>/root/ |
Protected root-operation evidence. |
~/.local/state/jwebot-edge/ |
Edge socket and SQLite ledger. |
~/.local/state/wechat-adaptive-ocr/ |
OCR queue, history, and failed events. |
Secret Keys
The config compiler recognizes these explicit secrets:
JWEBOT_EDGE_DEEPSEEK_API_KEY;JWEBOT_EDGE_STEAM_API_KEY;JWEBOT_HEALTH_NOTIFICATION_TOKEN.
Additional names ending in _KEY, _TOKEN, _PASSWORD, or _SECRET are
treated as sensitive by export and scanning tools.
Runtime Files
| Generated file | Consumer |
|---|---|
runtime.env |
Edge, OCR, health monitor, and user services. |
root.env |
Bootstrap and coordinated root deployer. |
private-context.json |
Kernel identity/alias registry only. |
notification.json |
Health notification adapter only. |
manifest.json |
Digest and generation metadata. |
Plugins receive none of these files or environment values.
Never Commit
- populated profiles or generated output;
- debug payloads, incident archives, OCR history, screenshots, or message logs;
- SQLite, WAL, sockets, or process files;
- private person aliases, display names, SteamIDs, or group identifiers;
- host addresses, SSH aliases, usernames, or absolute personal home paths;
- API keys, passwords, tokens, private keys, or signing keys;
- configuration exports created with
--include-private.