Harden public docs gates

This commit is contained in:
jwinterm
2026-07-11 08:59:21 -04:00
parent f0d26933e6
commit d95296da5f
3 changed files with 46 additions and 8 deletions
+5 -3
View File
@@ -1,6 +1,6 @@
# Architecture
> Status: draft | Updated 2026-07-07 | Applies to: AMPG core
> Status: draft | Updated 2026-07-11 | Applies to: AMPG core
AMPG is a compiler plus an ingress manager. The compiler turns one site into a
protocol-neutral content graph, then renders protocol-specific outputs. The ingress
@@ -194,8 +194,10 @@ v1 is static-first, but the architecture reserves a path for interactive applica
Interactivity is declared per route group:
- `static`: files only.
- `forms`: server-rendered actions and full-page responses.
- `sessions`: authenticated flows with strict session policy.
- `interactive-lite`: deterministic games, status lookups, quote forms, and other flows
without account state or payment confirmation.
- `identity`: authenticated sessions, wallet sign-in, or signed capability links.
- `transactional`: server-confirmed orders, deposits, invoices, donations, or payment intents.
- `realtime`: rich browser/admin interfaces; HTTP transports only.
- `internal`: workers, webhooks, private admin APIs; never published automatically.
+9 -5
View File
@@ -1,6 +1,6 @@
# Autodocs And Drift Gates
> Status: draft | Updated 2026-07-05 | Applies to: AMPG generated docs
> Status: draft | Updated 2026-07-11 | Applies to: AMPG generated docs
AMPG should publish concise hand-written docs and generate the parts that can drift from
code. Generated artifacts are committed, then checked in CI by regenerating and diffing.
@@ -38,13 +38,17 @@ git diff --exit-code docs/generated schemas openapi.json
python3 tools/docs_check.py
```
`ampg docs check` should verify:
`python3 tools/docs_check.py` verifies:
- every Markdown file starts with a `> Status:` header.
- internal links resolve.
- generated docs are not edited by hand.
- public docs contain no private keys, onion keys, I2P keys, Reticulum identities, or
local production secrets.
- local links stay inside the repository.
- public docs do not name private fixture targets.
- public docs do not contain obvious private-key blocks, common API tokens, or assigned
secret values.
`python3 -m ampg docs generate --check` verifies that generated docs and schemas match
the code-owned metadata.
## Public/private boundary