Deployment profiles

In plain words: Reach: Deployment profiles

Designed 3 min read 7 glossary terms 18 connected pages
The short version written for the Snayu team

Compares three ways to deploy the public Reach bot: all at home, a VPS edge relaying to a home core, or a standalone VPS, and what each means for availability and security.

Why read it: Read this before choosing or building a Reach deployment.
  1. 1Home-only keeps all truth at home but goes silent when home is down.
  2. 2VPS edge plus home core can hold incoming messages while home is offline, at the cost of a two-host protocol.
  3. 3Standalone VPS is independent but a VPS compromise exposes that whole restricted body.

Designed Profiles are designed; none is deployable yet.

Words on this page, decoded click one for its card

In this section 3 pages

Home-only Reach deployment: Home-only The home-only Reach profile: every service, record and credential stays on one home machine with outbound-only connections, so Reach is unavailable whenever home is down. open → VPS edge + home core Reach deployment: VPS edge, home core A split profile where a VPS only holds the Discord connection and a bounded message spool, relaying over a private WireGuard tunnel to home, where all thinking, data and authority stay. open → Standalone VPS Reach deployment: Standalone VPS A standalone restricted Reach on a VPS with its own database and services, plus the shared end-to-end contract for answering one public Discord question from a public docs corpus. open →
The original text Underlined words open their plain-English card.

When home loses power, should Reach go quiet, retain bounded incoming messages elsewhere, or continue as an independent restricted body? That availability choice determines where authority and credentials must live.

Configuration selects one exact immutable profile. The profiles below define its service placement and authority boundaries; State of Work records the implementation prerequisites for deploying them.

Choose the body

Profile Sole application authority Roads and trade-off
reach.home.public@1 Home WardSecurity Desk, VesselEngine Room, Workers, corpus, effect ledger, PhylacteryMemory Vault. All outbound; no Tether/Veil. Durable truth stays home and Reach is unavailable with that host.
reach.edge-home.public@1 The same home authority; VPS has only bounded Discord transport/effect custody. Exact Tether and private home Veil. Bounded offline intake adds a security-critical two-host protocol.
reach.vps.public@1 Independent VPS-local WardSecurity Desk, VesselEngine Room, Workers, corpus, ledger, PhylacteryMemory Vault. Outbound baseline without Tether/Veil. VPS compromise exposes this entire restricted public body.

The one-question E2E contract is shared by all three profiles; its standalone VPS page also explains that profile's particular custody and recovery. Home-only is the default for home durability unless bounded offline intake justifies the edge. A backup elsewhere is recovery material, never a second authority. These are mutually exclusive profiles, not security levels or independent use_vps, trusted, tether, veil, or local_db options.

Tether grants an exact private road, not application power. Veil constrains an admitted HTTP entrance and need not be public. The split profile needs both because VPS initiates private HTTP to home. Later callbacks or A2AAgent-to-Agent Line serving need a different profile revision. Compare authority location, data exposure, home dependency, compromise consequences, complexity, and recovery; no public label, guild membership, tunnel, or VPS ownership proves identity or egress permission.

Invariants across every profile

Every (Discord application, Habitat partition) has one active deployment generation. Its binding identifies the profile revision, ReachAuthorityEpoch, active PhylacteryMemory Vault, ReachEdgeEpoch, Gateway/delivery credential owner, corpus authority, and provider/A2AAgent-to-Agent Line gate. To establish which generation owned any work, pin the per-host manifest digests, service Principals, credentials/routes, and both epochs in every event, attempt, settlement, backup, and migration receipt.

Reject an unknown combination, simultaneous activation, or stale epoch before Bind/admission. PostgreSQL is never WAN-exposed, shared, live-replicated, dual-written, or failed over. A transport journal can witness bytes and effects, but RunJob Record, ContextBriefing Pack, WardSecurity Desk, SigilID Badge, corpus judgment, turn, and terminal truth remain with their owners.

Co-locating services does not remove their separation requirements. Likewise, every remote attempt still needs exact destination/task policy, any required Cut, and a fresh egress decision bound to its payload.

Selection and migration

Changing profile is a quiesced Evolution effect:

  1. Close admission and freeze the target generation.
  2. Drain or classify all provider/A2AAgent-to-Agent Line attempts, delivery intents, UNKNOWN effects, Gateway cursors, and spool rows.
  3. Fence authority/edge epochs, stop the old Gateway owner, and revoke its routes/credentials.
  4. When authority moves, export only the admitted public Reach partition with schema/profile/corpus/source/retention/dedupe/external-effect identity closure; restore transactionally into an inactive body. Never copy the whole home PhylacteryMemory Vault or live-replicate it.
  5. Attest new host manifests, rotate custody-changing bot/provider/Tether/Veil credentials, and enroll service Principals.
  6. Activate the new authority last; reopen admission while rejecting old-generation messages.

Moving between home-only and edge-home retains the home database, but still requires transfer of the Discord edge. A transition involving the standalone profile must refuse if it cannot safely preserve nonterminal or indeterminate effects. Once the new body begins admitting work, rolling back requires another quiesced migration; the old database stays fenced/read-only.

Administrative separation

Application peers, routes, and service credentials cannot authorize SSH, Podman, systemd, deployment, rotation, provider consoles, or magus:*. Infrastructure administration and any later operator VPN peer require separate keys, routes, identity, and authorization.

Home-only · VPS edge + home core · Standalone VPS