Consolidate runtime and deployment tooling with upgrade compatibility

.github/workflows/publish-cli.yml

@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   package:
-    if: github.ref == 'refs/heads/main'
+    if: github.repository == 'yc-software/qm' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     outputs:
       manifest: ${{ steps.pin.outputs.manifest }}

.gitignore

@@ -1,4 +1,4 @@
-node_modules/
+node_modules
 data/
 *.log
 .DS_Store

.husky/install.mjs

@@ -0,0 +1,6 @@
+if (process.env.CI === "true" || process.env.NODE_ENV === "production" || process.env.npm_config_omit === "dev") {
+  process.exit(0);
+}
+
+const husky = (await import("husky")).default;
+console.log(husky());

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

README.md

@@ -44,7 +44,6 @@ isn't tied to any single vendor.
 ## What you can do with it
 
 - Search internal notes, email, documents, databases, and the web together
-- Retrieve information from your company brain
 - Build internal apps, publish them to the right people, and keep their data current
 - Learn your writing voice from past sends, then triage your inbox on a schedule —
   labels and reply drafts included
@@ -69,6 +68,13 @@ flowchart LR
   LOOP <--> SBX
 ```
 
+For durability, set `DATABASE_URL` and `SESSION_STORE=postgres` — without it, sessions
+live in process memory and vanish on restart. To exercise a branch end to end — core,
+Slack, web, admin, portal, against a real model and real Postgres — run
+`npm run dev-instance`.
+
+## Architecture
+
 Every turn runs through a central core, which can use a variety of models and harnesses
 to generate the response. A Postgres persistence layer holds user data, session history,
 and other durable state. The agent has a small, fixed tool surface; one of those tools is

cli/README.md

@@ -69,21 +69,17 @@ pinned sandbox base, mounts the host Docker socket into trusted core, and connec
 core to each sandbox's private network. An explicit `sandbox.image` uses that
 runnable local image instead.
 
-On AWS, `up` snapshots the RDS instance under the deploy lease before its first
-mutation, names the snapshot after the deployment manifest it precedes, and
-records it in that manifest. `rollback` restores code and configuration only,
-so it prints that snapshot as the matching data restore point
-(`aws rds restore-db-instance-from-db-snapshot`). Pre-deploy snapshots are
-pruned to a bounded count; `aws.predeployDbSnapshot: false` opts out.
-
-`sandbox build` is a local validation build. `sandbox publish` pushes through the
-configured OCI registry, resolves the image and base digests, records the base pin in
-the config and the image pin in the config (docker/fly) or the durable AWS deployment
-manifest, syncs the durable deployment layer when core is reachable, and repoints a
-running Fly or AWS core. On AWS it requires `sandbox.backend: "sprites"` and, before
-building anything, an existing deployment manifest and no `sandbox.image` override —
-that override only seeds the first `qm up` and must be removed afterwards. Every
-ordinary `up` also syncs the layer.
+On AWS, `up` verifies under the deploy lease that RDS point-in-time recovery
+is current (its `LatestRestorableTime` must lag by at most
+`QM_AWS_DB_MAX_RESTORE_LAG_MS`, default 10 minutes) and records the pre-deploy
+timestamp in the deployment manifest it precedes. `rollback` restores code and
+configuration only, so it prints that timestamp as the matching data restore
+point (`aws rds restore-db-instance-to-point-in-time`);
+`aws.predeployDbSnapshot: false` opts out.
+
+`sandbox build` is a local validation build of the sandbox layer image. At runtime
+sandboxes boot their platform's stock image; tools and skills arrive through the
+deployment-layer sync, which every ordinary `up` performs.
 
 Auto uses its built-in model classifier unless `qm.config.jsonc` declares one
 `securityScreen` proxy with a provider label, HTTPS endpoint, and `shadow` or
@@ -110,7 +106,6 @@ logs [service] [-f] [--tail n]
 down [--purge]
 rollback [--to revision-or-sha]
 sandbox build [--from image] [--tag tag] [--dry-run]
-sandbox publish [--from image] [--app registry/repo] [--tag tag] [--dry-run]
 ```
 
 ## Administrator login without email