feat: add remote workspaces and verified deliverables

2026-07-26 12:58:04 +08:00
parent 37f83eaac7
commit 0b4d799216
30 changed files with 1595 additions and 55 deletions
@@ -0,0 +1,75 @@
+# Infrastructure map
+
+This document separates shared infrastructure from the parts that define
+K1412 Agent behavior.
+
+## Request path
+
+```text
+Internet
+  -> DNS / TLS
+  -> Nginx Proxy Manager
+  -> Unraid NAS : K1412 web stack
+  -> Tailscale + SSH
+  -> home-node-itx : per-user Docker workspaces
+```
+
+## Shared infrastructure
+
+These services make the application reachable or deployable, but changing
+them does not change the Agent loop:
+
+| Service | Responsibility |
+| --- | --- |
+| `git.k1412.top` | Public source repository |
+| `docker.k1412.top` | Private immutable container images |
+| Nginx Proxy Manager | HTTPS entry and reverse proxy |
+| k1412 homepage | Service discovery entry |
+| Tailscale | Private NAS-to-execution-host network |
+| Unraid Compose Manager | Application lifecycle on the NAS |
+
+Other NAS applications are independent tenants. They are not dependencies of
+K1412 Agent merely because they share the host.
+
+## K1412 platform services on the NAS
+
+| Container | Responsibility | Agent core? |
+| --- | --- | --- |
+| `k1412-agent-web` | Open WebUI auth, RBAC, history, UI, Chat loop | Product shell |
+| `k1412-agent-runtime` | Work loop and provider gateway | Yes |
+| `k1412-agent-gateway` | Identity, execution policy, workspace lifecycle | Yes |
+| `k1412-agent-postgres` | Open WebUI and Runtime durable state | State |
+| `k1412-agent-redis` | Open WebUI coordination/cache | State |
+| `k1412-agent-bootstrap` | Idempotent admin/tool bootstrap job | Operations |
+
+Only Web publishes a host port. Runtime, Gateway, PostgreSQL, and Redis stay on
+private Compose networks.
+
+## Physical execution host
+
+`home-node-itx` is a dedicated, replaceable Docker execution node:
+
+- Intel Core i3-12100F, 4 cores / 8 threads;
+- approximately 14 GiB usable RAM;
+- 120 GB NVMe system disk;
+- 500 GB SSD formatted ext4 and mounted at `/srv/k1412-data`;
+- Docker root at `/srv/k1412-data/docker`;
+- user workspace volumes stored on the same data disk.
+
+The NAS Gateway connects with a dedicated Ed25519 key and strict host-key
+checking. The execution host stores no web/database secrets. Replacing it
+requires migrating Docker volumes and changing SSH configuration, not changing
+the Agent loop.
+
+## Agent core
+
+The code intended for continuous experimentation is:
+
+- `agent_platform/runtime/loop.py`: loop and evidence policy;
+- `agent_platform/runtime/context.py`: context policy;
+- `agent_platform/runtime/tools.py`: tools and scheduling metadata;
+- `agent_platform/store.py`: events, plans, mode state, memory;
+- `agent_platform/gateway/`: isolated execution providers.
+
+Frontend branding, reverse proxy configuration, and registry automation are
+important product/operations work, but they are not Agent intelligence.