73 lines
2.8 KiB
Markdown
73 lines
2.8 KiB
Markdown
# Configuration Inventory
|
|
|
|
This inventory defines ownership and persistence boundaries. It intentionally
|
|
contains no real host, user, address, account, person, or credential value.
|
|
|
|
## Committed
|
|
|
|
| Path | Contents |
|
|
|---|---|
|
|
| `config/templates/default/` | Empty, public profile template. |
|
|
| `config/schemas/` | Profile, private-context, incident, and debug-event schemas. |
|
|
| `deploy/systemd/` | Generic service units with no credentials. |
|
|
| `deploy/defaults/` | Safe runtime defaults for the generic `jwebot` account. |
|
|
| `examples/` | Synthetic SDK and plugin examples. |
|
|
|
|
## Local Configuration
|
|
|
|
| Path | Mode | Contents |
|
|
|---|---:|---|
|
|
| `~/.config/jwebot/` | `0700` | Configuration root. |
|
|
| `profiles/<id>/` | `0700` | Source profile package. |
|
|
| `profiles/<id>/secrets/` | `0700` | API keys and notification secrets. |
|
|
| `profiles/<id>/context/` | `0700` | Private person and bot context. |
|
|
| `profiles/<id>/generated/` | `0700` | Atomic runtime output. |
|
|
| `current` | symlink | Active profile. |
|
|
|
|
Generated files are mode `0600`.
|
|
|
|
## Local State
|
|
|
|
| Path | Contents |
|
|
|---|---|
|
|
| `~/.local/state/jwebot/profiles/<id>/debug/sessions/` | Local debugger sessions. |
|
|
| `~/.local/state/jwebot/profiles/<id>/incidents/` | Privacy-safe incident records. |
|
|
| `~/.local/state/jwebot/profiles/<id>/telemetry/` | Optional bounded telemetry exports. |
|
|
| `~/.local/state/jwebot/profiles/<id>/archives/` | Migrated legacy debug/reports. |
|
|
| `~/.local/state/jwebot/profiles/<id>/root/` | Protected root-operation evidence. |
|
|
| `~/.local/state/jwebot-edge/` | Edge socket and SQLite ledger. |
|
|
| `~/.local/state/wechat-adaptive-ocr/` | OCR queue, history, and failed events. |
|
|
|
|
## Secret Keys
|
|
|
|
The config compiler recognizes these explicit secrets:
|
|
|
|
- `JWEBOT_EDGE_DEEPSEEK_API_KEY`;
|
|
- `JWEBOT_EDGE_STEAM_API_KEY`;
|
|
- `JWEBOT_HEALTH_NOTIFICATION_TOKEN`.
|
|
|
|
Additional names ending in `_KEY`, `_TOKEN`, `_PASSWORD`, or `_SECRET` are
|
|
treated as sensitive by export and scanning tools.
|
|
|
|
## Runtime Files
|
|
|
|
| Generated file | Consumer |
|
|
|---|---|
|
|
| `runtime.env` | Edge, OCR, health monitor, and user services. |
|
|
| `root.env` | Bootstrap and coordinated root deployer. |
|
|
| `private-context.json` | Kernel identity/alias registry only. |
|
|
| `notification.json` | Health notification adapter only. |
|
|
| `manifest.json` | Digest and generation metadata. |
|
|
|
|
Plugins receive none of these files or environment values.
|
|
|
|
## Never Commit
|
|
|
|
- populated profiles or generated output;
|
|
- debug payloads, incident archives, OCR history, screenshots, or message logs;
|
|
- SQLite, WAL, sockets, or process files;
|
|
- private person aliases, display names, SteamIDs, or group identifiers;
|
|
- host addresses, SSH aliases, usernames, or absolute personal home paths;
|
|
- API keys, passwords, tokens, private keys, or signing keys;
|
|
- configuration exports created with `--include-private`.
|