Joakim Persson
29e660e18f
Staging default moves out of ~/.cache to <palace-root>/pi-stage (pi) and <palace-root>/opencode-stage (opencode), resolved with mempalace's own palace-path precedence ($MEMPALACE_PALACE_PATH -> $MEMPAL_PALACE_PATH -> ~/.mempalace/config.json -> ~/.mempalace/palace), then dirname. Why: the convos miner keys dedup on the *staged* path, so a wiped stage plus a sync scoped to include it prunes the drawers mined from those sources -- deleting memories, not a cache. Under ~/.cache that state was reachable by anything treating a cache as disposable. Staging inside the palace makes the coupling structural: the stage cannot be wiped without touching the palace itself. Overrides ($MEMPALACE_PI_STAGE / $MEMPALACE_SESSION_STAGE, --stage) are unchanged. Note the old default had never been created on any host, so this closed a latent hazard, not a live one. Measured, and the docs now claim only this much: sync prunes only within the scope it is given -- wing-only, 1299 scanned / 1299 out of scope / 0 removed; scoped at the palace root, 651 kept / 648 out of scope. The previous blanket "sync prunes every drawer" wording overstated it, which is a liability: the next reader disproves the overstatement and discards the real constraint with it. Also in this change: - cron log dir ~/.cache/mempalace-session -> ~/.cache/mempalace-logs. The stage left that namespace, so the old name now read as "the stage". - AGENTS.md: the convos miner *does* check mtime (verified against upstream convo_miner.py); the previous "no mtime check" claim was wrong. - smoke-test assertions use `mktemp -d` for --sessions-dir. One pointed at /tmp, which still held earlier synthetic transcripts, so a --dry-run exported a fake session into the real stage: --dry-run skips the mine, not the export. docs/phase-1-exposure-runbook.md -- the newt/DNS/auth step that RFC 001 and the synlig runbook leave open (runbook section 4, items 2 and 5). Port 8765 at /mcp, newt targets 172.17.0.1, and the authentication is the single shared bearer token (RFC 6.2, decided 2026-08-09) rather than per-device proxy users. The latter cannot work today: mempalace validates exactly one token, and Pangolin's SSO/PIN/password are browser-shaped while every client here is a headless JSON-RPC POST -- enabling that protection breaks the clients it protects. The per-device axis that *does* exist is the feeder's SSH key + per-device inbox. New finding recorded there: a loopback bind does not merely 403 behind a tunnel (already known, runbook 2.4) -- it also silently starts the server with no token at all, because auto-minting is gated on the bind being non-loopback. extensions/pi/README.md: the HTTP transport IS authenticated as of mempalace 3.6.0; the "sessionless and unauthenticated" note dated from the v1.3.0 era. Closes the RFC section 8 Phase-0 hygiene item.
39 lines
1.9 KiB
Plaintext
39 lines
1.9 KiB
Plaintext
# Sample crontab entry for mempalace-session inside a long-running
|
|
# opencode-devbox container, scheduled from the DOCKER HOST (not inside
|
|
# the container — containers typically don't run cron).
|
|
#
|
|
# Host-side cron runs `docker exec` against the running container once a
|
|
# week. Requires:
|
|
# - Container is long-lived (compose up, restart: unless-stopped, etc.)
|
|
# - User running cron has rights to talk to the docker socket
|
|
# (usually means being in the `docker` group, or on macOS having
|
|
# Docker Desktop running for the current login session)
|
|
# - `mempalace-session` is already installed inside the container
|
|
# (opencode-devbox bakes it in via cli_utils → mempalace-toolkit)
|
|
#
|
|
# Install:
|
|
# # Replace CONTAINER / USER / HOST_USER to match your setup, then:
|
|
# (crontab -l 2>/dev/null; cat contrib/cron/mempalace-session-devbox.cron) | crontab -
|
|
#
|
|
# Adjust CONTAINER and USER below before installing.
|
|
#
|
|
# Design notes:
|
|
# - `docker ps --filter name=... --filter status=running` makes the job a
|
|
# no-op if the container is down, so the timer is harmless on machines
|
|
# where the devbox is currently stopped. No mail/warning/noise.
|
|
# - Exec runs as `developer` (the opencode-devbox user). Change `-u`
|
|
# if you named your user something else.
|
|
# - Output is captured in a log under the HOST user's home, not inside
|
|
# the container — so you can inspect it from outside.
|
|
|
|
CONTAINER=opencode-devbox
|
|
CONTAINER_USER=developer
|
|
|
|
# HOST_USER is used only to anchor the log path. Replace with your host
|
|
# username (or leave the $HOME substitution if your cron implementation
|
|
# expands it — most do).
|
|
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
|
|
# m h dom mon dow command
|
|
0 3 * * 1 /bin/sh -c 'docker ps --filter "name=^/${CONTAINER}$" --filter "status=running" -q | grep -q . && docker exec -u "${CONTAINER_USER}" "${CONTAINER}" mempalace-session >> "$HOME/.cache/mempalace-logs/cron-devbox.log" 2>&1'
|