drholy/ozone-tech_owl_prime
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ops: finalize production domain and hardware benchmark tooling

Browse Source 
Add /version.json build identity, deploy 16e7930 release markers,
DNS/Named Tunnel prep docs, portable browser benchmark, and replay
stability probe. Keep Quick Tunnel until permanent domain cutover.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Даня Архипов
2026-07-15 22:21:13 +00:00
parent 16e7930304
commit 4fcce5bff9
29 changed files with 1068 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
docs/CLOUDFLARE_NAMED_TUNNEL_SETUP.md Normal file
View File

@@ -0,0 +1,100 @@
# CLOUDFLARE_NAMED_TUNNEL_SETUP
## Goal
Постоянный HTTPS для `arhipovdan.ru` / `www.arhipovdan.ru` → production `http://127.0.0.1:3100` (`owl-web-1`), без открытия 80/443 на OwlPrime.
Quick Tunnel (`*.trycloudflare.com`) **сохранять** до полного PASS постоянного домена.
## Architecture choice
```text
REG.RU = registrar only
Cloudflare = authoritative DNS + Named Tunnel + managed TLS
```
## Current blocker in this environment
```text
cloudflared tunnel list → no origin cert (cert.pem)
CLOUDFLARE_API_TOKEN → unset
```
Named Tunnel **нельзя** создать/привязать DNS из coder без `cloudflared login` или API token.
## Recommended tunnel name
```text
owlprime-sorter-production
```
## Config template (do not commit credentials)
Path suggestion (host, outside git):
```text
~/.cloudflared/config.yml
~/.cloudflared/<TUNNEL_UUID>.json # credentials — chmod 600
```
```yaml
tunnel: <TUNNEL_UUID>
credentials-file: /home/<user>/.cloudflared/<TUNNEL_UUID>.json
ingress:
- hostname: arhipovdan.ru
service: http://127.0.0.1:3100
- hostname: www.arhipovdan.ru
service: http://127.0.0.1:3100
- service: http_status:404
```
Service target assumes cloudflared on **host network namespace** with publish `127.0.0.1:3100` (current). If cloudflared runs in Docker, use `http://host.docker.internal:3100` or shared network alias `http://owl-web-1:80` — never a ephemeral container IP.
## Operator steps (when Cloudflare access available)
1. `cloudflared login` (or set API token with Tunnel + Zone DNS edit).
2. `cloudflared tunnel list` — reuse existing sorter tunnel if present.
3. Else: `cloudflared tunnel create owlprime-sorter-production`
4. Write config (template above). Validate: `cloudflared tunnel ingress validate`
5. Run connector (systemd preferred): `cloudflared tunnel run owlprime-sorter-production`
6. Add domain to Cloudflare → note **exact** assigned nameservers.
7. Import **all** DNS from `DNS_MIGRATION_INVENTORY.md` / REG.RU panel.
8. Create public hostnames / `cloudflared tunnel route dns <tunnel> arhipovdan.ru` (+ www).
9. Remove conflicting A `185.160.137.162` for apex/www in Cloudflare zone.
10. Only then change NS at REG.RU.
11. Keep Quick Tunnel until:
```bash
curl -s https://arhipovdan.ru/version.json
# expected commit from production
PLAYWRIGHT_BASE_URL=https://arhipovdan.ru EXPECTED_COMMIT=<sha> npm run test:e2e:production
```
## Coexistence with Quick Tunnel
| Process | Role |
| ------- | ---- |
| `cloudflared tunnel --url http://127.0.0.1:3100` | Temporary public URL |
| Named Tunnel connector | Permanent hostnames (after CF zone) |
They can run in parallel; different Cloudflare edge bindings.
## Secrets policy
Never commit:
* `*.json` credentials
* `cert.pem`
* API tokens
* tunnel tokens in systemd unit Environment=
## Status
```text
Named Tunnel created: NO (auth missing)
Ingress prepared as docs: YES
Connector healthy: N/A
DNS route: N/A
NS cutover: WAITING_USER
```

1
docs/DEMO_RUNBOOK.md
View File

@@ -5,6 +5,7 @@
**Рабочий публичный URL (временный):** Quick Tunnel — см. `PRODUCTION_DEPLOYMENT_REPORT.md`
**Ожидаемый постоянный домен:** https://arhipovdan.ru/ — **BLOCKED_EXTERNAL** (`PUBLIC_DOMAIN_DIAGNOSTIC.md`)
**Локальный production:** http://127.0.0.1:3100/
**Проверка версии:** `curl -s http://127.0.0.1:3100/version.json`
**Репозиторий:** `/home/coder/arhipovdan/app`
---

78
docs/DNS_MIGRATION_INVENTORY.md Normal file
View File

@@ -0,0 +1,78 @@
# DNS_MIGRATION_INVENTORY
Дата: 2026-07-15
Домен: `arhipovdan.ru`
Источник: публичные `dig` запросы с OwlPrime/coder.
## Текущие authoritative NS
```text
ns1.reg.ru.
ns2.reg.ru.
```
REG.RU = регистратор **и** DNS provider. Cloudflare zone пока **не** создана из этого окружения (нет `cert.pem` / API token).
## Публичные записи
| Type | Name | Current value | TTL (approx) | Must migrate | Purpose |
| ---- | ---- | ------------- | -----------: | ------------ | ------- |
| NS | @ | ns1.reg.ru / ns2.reg.ru | — | Yes (delegation) | Authoritative DNS |
| SOA | @ | ns1.reg.ru. hostmaster… | 10800 | Auto in CF | Zone SOA |
| A | @ | 185.160.137.162 | 21600 | **Replace** with CF tunnel route | Broken openresty (404 / TLS SNI fail) |
| A | www | 185.160.137.162 | — | **Replace** with CF tunnel route | Same broken endpoint |
| AAAA | @ | *(none)* | — | No | — |
| CNAME | @ | *(none)* | — | No | Apex CNAME not used |
| MX | @ | *(none publicly visible)* | — | **Check in REG.RU panel** | Mail may be absent |
| TXT | @ | *(none publicly visible)* | — | **Check in REG.RU panel** | SPF / domain verify |
| TXT | `_dmarc` | *(none)* | — | **Check panel** | DMARC |
| TXT | `default._domainkey` | *(none)* | — | **Check panel** | DKIM |
| CAA | @ | *(none)* | — | Optional | TLS CA policy |
### Subdomain probe (public A)
Many common labels resolve to the **same** `185.160.137.162` (likely REG.RU catch-all / parking):
| Name | A | Notes |
| ---- | - | ----- |
| mail | 185.160.137.162 | Confirm real mail usage in panel |
| smtp | 185.160.137.162 | |
| api | 185.160.137.162 | |
| app | 185.160.137.162 | |
| staging | 185.160.137.162 | |
| blog | 185.160.137.162 | |
| ftp | 185.160.137.162 | |
**Перед сменой NS** откройте панель REG.RU → DNS и перенесите **все** реальные записи (особенно MX/TXT/DKIM), не только A для сайта.
## Что нельзя потерять
1. Любые MX / SPF / DKIM / DMARC (если почта используется).
2. TXT верификации (Google, Yandex, Cloudflare, etc.).
3. Поддомены других сервисов, если отличаются от parking IP.
4. CAA, если планируется нестандартный CA.
## Рекомендуемый target после Cloudflare zone
| Hostname | Type on Cloudflare | Target |
| -------- | ------------------ | ------ |
| `arhipovdan.ru` | Cloudflare Tunnel CNAME / route | Named Tunnel `owlprime-sorter-production` |
| `www.arhipovdan.ru` | same | same tunnel ingress |
Не создавать «A = Named Tunnel» — A принимает только IPv4.
## Сравнение вариантов публикации
| Вариант | Требования | Риск | Рекомендация |
| ------- | ---------- | ---- | ------------ |
| Cloudflare Named Tunnel + NS на CF | Cloudflare zone + миграция всех DNS | Низкий | **Предпочтительно** |
| Direct nginx на OwlPrime :80/:443 | Public IP, NAT, firewall, TLS | Средний/высокий | Не делать автоматически |
| Quick Tunnel | Нет постоянного hostname | Высокий для demo | Только temporary fallback |
## Статус миграции
```text
Inventory: DONE (public)
Cloudflare zone: NOT CREATED (needs user / API login)
NS changed: NO
```

52
docs/FINAL_DEMO_READINESS.md
View File

@@ -1,40 +1,40 @@
# FINAL_DEMO_READINESS
Дата: 2026-07-15
Ветка: `feature/maximum-demo-realism`
Production release (не тронут этим коммитом): `20260715-1712` / `index-ncgt6PBL.js`
## Status board
| Область | Статус | Комментарий |
| ------- | ------ | ----------- |
| Git | PASS | Feature branch clean after commit; no push |
| Production container | PASS | `owl-web-1` на `:3100`, bundle `index-ncgt6PBL.js` |
| Permanent domain | BLOCKED_EXTERNAL | `arhipovdan.ru` → openresty 404 / TLS SNI fail |
| TLS | BLOCKED_EXTERNAL | Нет SNI-сертификата на destination IP |
| Main route | PASS | Local + Quick Tunnel |
| Details route | PASS | SPA fallback 200 |
| Unit tests | PASS | 166 |
| E2E | PASS | 15 (excl. production) |
| Visual regression | PASS | 10 snapshots |
| GPU performance | PARTIAL | SwiftShader/xvfb only; hardware baseline blocked in coder |
| Safety scenarios | PASS | Jam + E-stop e2e |
| Rollback | PASS | Tag `backup/pre-maximum-demo-realism-20260715` + docker rename |
| Agent safety | PASS | Worktree / dry-run / no auto DNS |
| Git | PASS | Feature branch; no push |
| Production container | PASS | `20260715-2215` / `index-AagIOJbd.js` / `version.json` → `16e7930` |
| Permanent domain | BLOCKED_EXTERNAL | REG.RU → openresty; CF Named Tunnel not auth'd |
| TLS (permanent) | BLOCKED_EXTERNAL | SNI fail on 185.160.137.162 |
| Quick Tunnel | PASS | Temporary public URL OK |
| Main / details | PASS | Local + tunnel |
| Unit / E2E / visual | PASS | 166 / 15 / 10 |
| GPU hardware (server) | BLOCKED_BY_DISPLAY_ENVIRONMENT | SwiftShader only |
| Portable benchmark | PASS tooling | `npm run perf:browser` on laptop |
| Replay stability | STABLE | See `REPLAY_RESOURCE_STABILITY.md` |
| Rollback | PASS | docker rename backup |
| Agent / secrets | PASS | no credentials in git |
## Application readiness
```text
READY
```
## Public domain readiness
```text
WAITING — Cloudflare login + NS cutover (see CLOUDFLARE_NAMED_TUNNEL_SETUP.md)
```
## Verdict
```text
READY WITH EXTERNAL DOMAIN BLOCKER
READY FOR LIVE DEMO VIA QUICK TUNNEL
```
Live demo **можно** вести с:
- `http://127.0.0.1:3100/` (локально), или
- актуального Quick Tunnel `https://invitations-based-characters-accent.trycloudflare.com/`
Постоянный домен `https://arhipovdan.ru/` **не готов** до DNS/proxy фикса пользователем (см. `PUBLIC_DOMAIN_DIAGNOSTIC.md`).
## Next deploy note
Новый код (perf overlay, twin layout, visual snapshots) собран как `index-DEbogfOZ.js` в `dist/`, но **не** задеплоен в `owl-web-1`, чтобы не нарушить работающий production. Redeploy — отдельный шаг после доменного фикса или явного запроса.
After user completes Cloudflare zone + NS change → `READY, WAITING FOR NS CUTOVER` then permanent PASS.

58
docs/HARDWARE_BENCHMARK_RUNBOOK.md Normal file
View File

@@ -0,0 +1,58 @@
# HARDWARE_BENCHMARK_RUNBOOK
## Server status (OwlPrime / coder)
```text
GPU devices: NVIDIA GTX 1080 ×2 present (/dev/nvidia*, /dev/dri)
DISPLAY: unset (unless xvfb)
Chromium WebGL in this env: SwiftShader / software
Hardware acceleration for demo metrics: BLOCKED_BY_DISPLAY_ENVIRONMENT
```
Do **not** install a display server or change NVIDIA drivers for benchmark.
## Portable benchmark (presentation laptop)
On the machine that will show the demo to the jury:
```bash
cd /path/to/app
npm ci
npm run build
npx vite preview --host 127.0.0.1 --port 3100
# or point at production / Quick Tunnel:
# export PLAYWRIGHT_BASE_URL=https://<working-url>/
npm run perf:browser
# writes agent/reports/browser-benchmark.json
# and docs/HARDWARE_BROWSER_BENCHMARK_LATEST.md (gitignored)
npm run perf:browser:export # same
```
Requirements:
* Real headed Chrome/Chromium (`DISPLAY` / macOS / Windows)
* **No** forced GPU flags (measures the jury machine as-is)
* Modes: low / medium / high / demo
* Includes playlist seeks + 3 replay cycles
### Manual export from UI
Open `/?perf=1` → button **Export benchmark** downloads JSON locally.
## Acceptance (Demo mode)
| Grade | Avg FPS | Min FPS | p95 |
| ----- | ------: | ------: | --: |
| Excellent | ≥55 | ≥40 | ≤20 ms |
| Acceptable | ≥30 | ≥24 | ≤33 ms |
| Not for live demo | <30 or p95 >40 ms |
Hardware run is valid only if renderer string does **not** contain SwiftShader / llvmpipe / Software.
## Server diagnostic (optional)
```bash
npm run perf:gpu # may re-exec under xvfb; labels software renderers
```

14
docs/HEADED_GPU_PERFORMANCE_REPORT.md
View File

@@ -7,13 +7,15 @@ Display: headed (:99)
Software renderer detected: **YES**
Verdict: **NOT A GPU BASELINE — software renderer (SwiftShader/llvmpipe/etc.)**
## Notes
## Server hardware WebGL re-check (2026-07-15)
- Headed Chromium with GPU-preferring flags.
- PerfCollector only with `?perf=1`; quality forced via `?quality=`.
- Prior headless ~9.6 FPS is labeled software/headless WebGL diagnostic baseline.
- **Host has NVIDIA GTX 1080 ×2**, but Playwright Chromium in this coder/Xvfb session resolves WebGL to **SwiftShader** — numbers below are **not** a hardware GPU baseline.
- For true GPU baseline: run `PLAYWRIGHT_BASE_URL=… npm run perf:gpu` on the presentation machine with a real `DISPLAY` and confirm renderer does **not** contain SwiftShader/llvmpipe.
Tried Chromium flags independently (`--use-gl=egl`, `--use-angle=gl-egl`, `--use-angle=gl`, Vulkan ANGLE) with NVIDIA EGL vendor file present. All resolved to **SwiftShader**.
```text
BLOCKED_BY_DISPLAY_ENVIRONMENT
```
Portable path: `npm run perf:browser` / `docs/HARDWARE_BENCHMARK_RUNBOOK.md`.
## Mode table (after Play)

45
docs/PERFORMANCE_AFTER_MAXIMUM_DEMO.md
View File

@@ -1,38 +1,33 @@
# PERFORMANCE_AFTER_MAXIMUM_DEMO
Measured: 2026-07-15
Commits referenced: `985f7c3` / tooling on current branch
## Production identity
## Bundle (production container, unchanged)
| Метрика | Значение |
| ------- | -------: |
| Main chunk | `index-ncgt6PBL.js` |
| Release | `20260715-1712` |
| Field | Value |
| ----- | ----- |
| Release | `20260715-2215` |
| Bundle | `index-AagIOJbd.js` |
| Commit | `16e7930` (via `/version.json`) |
## software/headless WebGL diagnostic baseline
**Не является характеристикой живой демонстрации.**
**Not a live-demo GPU characteristic.**
```text
Average FPS: 9.6
Minimum FPS: 3.3
p95 frame time: 200 ms
Average FPS: ~8.9–9.6
Renderer: SwiftShader
Status: BLOCKED_BY_DISPLAY_ENVIRONMENT on server
```
Повторено под xvfb/SwiftShader (~8.9 FPS demo) — см. `HEADED_GPU_PERFORMANCE_REPORT.md`.
## Replay geometries
## Headed / GPU tooling
Earlier probe showed +12 geometries after 3 replays under SwiftShader.
Re-run on production (`npm run perf:replay-stability`): **STABLE** (147 geos flat through 10 replays; +3 after GC pause only).
| Item | Status |
| ---- | ------ |
| `?perf=1` overlay | Implemented |
| `?quality=low\|medium\|high\|demo` | Implemented |
| `npm run perf:gpu` | Writes report + JSON |
| Hardware NVIDIA WebGL in coder | **Not available** (Chromium → SwiftShader) |
| True GPU baseline | Run on presentation laptop with DISPLAY + real GPU |
## Tooling
## Notes
- Demo quality keeps `shadows=false` for stable FPS.
- Do not quote SwiftShader FPS to jury as demo capability.
| Command | Purpose |
| ------- | ------- |
| `npm run perf:gpu` | Server/xvfb diagnostic |
| `npm run perf:browser` | Portable headed laptop benchmark |
| `npm run perf:replay-stability` | Geometry/heap plateau check |
| `/?perf=1` → Export benchmark | Local JSON download |

83
docs/PRODUCTION_DEPLOYMENT_REPORT.md
View File

@@ -2,71 +2,60 @@
Дата: 2026-07-15
Ветка: `feature/maximum-demo-realism`
Базовый commit этапа 1: `985f7c3`
Production bundle после этапа 2: `index-ncgt6PBL.js`
## Способ деплоя
Docker-контейнер `owl-web-1` (image `owl-web:<release>`), порт `127.0.0.1:3100→80`.
Docker API: `DOCKER_HOST=tcp://127.0.0.1:2375` (из coder-контейнера).
Compose-файл: `docker-compose.server.yml` (исторически `-p owl`).
Скрипт: `scripts/deploy-production.sh`.
Публичный доступ в этой среде:
- Loopback: `http://127.0.0.1:3100/`
- Quick tunnel cloudflared: `https://invitations-based-characters-accent.trycloudflare.com/`
- `https://arhipovdan.ru/` из контейнера даёт TLS SNI / openresty 404 — DNS/прокси домена вне текущего coder-окружения; проверяйте снаружи.
## Releases
## Current production
| Поле | Значение |
| ---- | -------- |
| Old release container | `owl-web-1-backup-20260715-165347` / `…-1712` |
| Old bundle | `index-CCdZzxPJ.js` |
| New release | `20260715-1712` |
| New image | `owl-web:20260715-1712` |
| New bundle | `index-ncgt6PBL.js` |
| Backup HTML | `releases/backup-pre-*` |
| Container | `owl-web-1` |
| Image | `owl-web:20260715-2215` |
| Bundle | `index-AagIOJbd.js` |
| Version endpoint | `/version.json` |
| Deployed commit (identity) | `16e7930` |
| Release id | `20260715-2215` |
| Publish | `127.0.0.1:3100→80` |
| Backup container | `owl-web-1-backup-20260715-2215` |
## Команды
## Previous
| Поле | Значение |
| ---- | -------- |
| Release | `20260715-1712` |
| Bundle | `index-ncgt6PBL.js` |
| Commit identity | *(pre-version.json)* |
## Public access
| URL | Status |
| --- | ------ |
| `http://127.0.0.1:3100/` | PASS — commit `16e7930` |
| Quick Tunnel | PASS — same commit (kept running) |
| `https://arhipovdan.ru/` | BLOCKED_EXTERNAL — openresty / TLS SNI |
## Deploy command
```bash
export DOCKER_HOST=tcp://127.0.0.1:2375
cd /home/coder/arhipovdan/app
npm test && npm run build
bash scripts/deploy-production.sh 20260715-1712
curl -s http://127.0.0.1:3100/ | grep -Eo 'index-[A-Za-z0-9_-]+\.js'
EXPECTED_COMMIT=16e7930 bash scripts/deploy-production.sh 20260715-2215
```
## Healthcheck
| Check | Result |
| ----- | ------ |
| `GET /` | 200 |
| `GET /details` (SPA) | 200 |
| Bundle | `index-ncgt6PBL.js` |
| Tunnel HTML | same bundle |
| `https://arhipovdan.ru/` | **BLOCKED_EXTERNAL** — `PUBLIC_DOMAIN_DIAGNOSTIC.md` |
## Public smoke
```bash
PLAYWRIGHT_BASE_URL=http://127.0.0.1:3100 npm run test:e2e:production
PLAYWRIGHT_BASE_URL=https://invitations-based-characters-accent.trycloudflare.com/ npm run test:e2e:production
```
Build args inject `BUILD_COMMIT` / `BUILD_BRANCH` / `BUILD_RELEASE` because `.git` is dockerignored.
## Rollback
```bash
export DOCKER_HOST=tcp://127.0.0.1:2375
docker stop owl-web-1 && docker rm owl-web-1
docker rename owl-web-1-backup-20260715-1712 owl-web-1
docker rename owl-web-1-backup-20260715-2215 owl-web-1
docker start owl-web-1
```
Или восстановить HTML из `releases/backup-pre-<release>/`.
## Smoke
## Smoke (tunnel)
```bash
curl -s http://127.0.0.1:3100/version.json
PLAYWRIGHT_BASE_URL=http://127.0.0.1:3100 EXPECTED_COMMIT=16e7930 npm run test:e2e:production
PLAYWRIGHT_BASE_URL=https://invitations-based-characters-accent.trycloudflare.com EXPECTED_COMMIT=16e7930 npm run test:e2e:production
```
Подтверждено: CASE 1/10, Jump to case 1–10, Previous/Next, Present, Play Demo, `/details`.
Both local and Quick Tunnel: **PASS**.

6
docs/PUBLIC_DOMAIN_DIAGNOSTIC.md
View File

@@ -9,7 +9,11 @@
BLOCKED_EXTERNAL
```
Постоянный домен `https://arhipovdan.ru/` **не обслуживается** текущим production-контейнером `owl-web-1`. Приложение на `127.0.0.1:3100` здорово и отдаёт актуальный bundle; проблема на уровне DNS → чужой openresty на публичном IP.
Постоянный домен `https://arhipovdan.ru/` **не** обслуживает `owl-web-1`.
Production на `:3100` и Quick Tunnel обновлены до commit `16e7930` (`/version.json`).
Named Tunnel: **не создан** из этого окружения — нет Cloudflare origin cert / API token.
См. `CLOUDFLARE_NAMED_TUNNEL_SETUP.md` и `DNS_MIGRATION_INVENTORY.md`.
## DNS

21
docs/REPLAY_RESOURCE_STABILITY.md Normal file
View File

@@ -0,0 +1,21 @@
# REPLAY_RESOURCE_STABILITY
Measured: 2026-07-15T22:18:59.976Z
Verdict: **STABLE**
| Cycle | Heap MB | Geometries | Textures | Programs | Canvas |
| ----: | ------: | ---------: | -------: | -------: | -----: |
| 0 (initial) | 14.5 | 147 | 1 | 4 | 1 |
| 1 (after_1_replays) | 14.5 | 147 | 1 | 4 | 1 |
| 3 (after_3_replays) | 14.5 | 147 | 1 | 4 | 1 |
| 5 (after_5_replays) | 14.5 | 147 | 1 | 4 | 1 |
| 10 (after_10_replays) | 14.5 | 147 | 1 | 4 | 1 |
| 10 (after_gc_pause) | 14.5 | 150 | 1 | 4 | 1 |
## Interpretation
- **STABLE** — no meaningful growth.
- **LAZY_ALLOCATION_PLATEAU** — early growth then flat (expected for first-seen assets).
- **POSSIBLE_LEAK / CONFIRMED_LEAK** — investigate dispose paths.
Raw: `agent/reports/replay-stability.json`

31
docs/RISK_REGISTER.md
View File

@@ -1,10 +1,10 @@
# Реестр рисков (Risk Register)
**Проект:** OZON Tech Sorter Simulation
**Дата:** 2026-07-15
**Проект:** OZON Tech Sorter Simulation
**Дата:** 2026-07-15
**Ветка:** `feature/maximum-demo-realism`
Шкала: вероятность / влияние = Low · Medium · High · Critical.
Шкала: вероятность / влияние = Low · Medium · High · Critical.
Статус: Open · Mitigated · Accepted.
---
@@ -13,7 +13,10 @@
| ID | Риск | Вероятность | Влияние | Статус | Митигация |
| -- | ---- | ----------- | ------- | ------ | --------- |
| R01 | Production :3100 / https://arhipovdan.ru/ отдаёт старый dist / домен 404 | High | Critical | Open | Local+tunnel PASS; domain BLOCKED_EXTERNAL — `PUBLIC_DOMAIN_DIAGNOSTIC.md` |
| R01 | Production :3100 / arhipovdan.ru | Medium | Critical | Partially mitigated | Local+tunnel on `16e7930`+version.json; domain still BLOCKED_EXTERNAL |
| R18 | Tunnel/cloudflared outage / permanent DNS | High | Critical | Open | Quick Tunnel kept; Named Tunnel needs CF login — `CLOUDFLARE_NAMED_TUNNEL_SETUP.md` |
| R21 | Hardware GPU baseline недоступен в coder | High | Medium | Accepted | `BLOCKED_BY_DISPLAY_ENVIRONMENT`; portable `perf:browser` |
| R22 | DNS NS cutover теряет MX/TXT | Medium | High | Open | `DNS_MIGRATION_INVENTORY.md` — check REG.RU panel before NS change |
| R02 | Визуальный разрыв `/` vs `/details` путает жюри | Medium | High | Mitigated | `sharedLayout` + routeConsistency tests |
| R03 | Жюри воспринимает кинематику как «фейк» | Medium | High | Mitigated | Proof HUD + честные формулировки; jam/e-stop |
| R04 | Pseudo-CV раскрыт как «обман» | Medium | Medium | Accepted | RULE overlay + confidence; не обещать ML |
@@ -40,15 +43,15 @@
### R01 — Устаревший production dist
**Симптом:** локально proof/hotkeys есть, на https://arhipovdan.ru/ — нет.
**Детектор:** сравнить UI; `demo:health`; hash файлов в контейнере (если доступен docker на хосте).
**Реакция:** ручной redeploy; на показе переключиться на проверенный preview.
**Симптом:** локально proof/hotkeys есть, на https://arhipovdan.ru/ — нет.
**Детектор:** сравнить UI; `demo:health`; hash файлов в контейнере (если доступен docker на хосте).
**Реакция:** ручной redeploy; на показе переключиться на проверенный preview.
**Тип данных о риске:** подтверждён аудитом как **процессный** факт («may still serve OLD dist»).
### R09 — Автономный агент vs production
**Симптом:** гипотетический merge/deploy без человека.
**Текущий контроль:** `forbidMergeToMain`, `forbidProductionDeploy`, нет Implementer auto-patch.
**Симптом:** гипотетический merge/deploy без человека.
**Текущий контроль:** `forbidMergeToMain`, `forbidProductionDeploy`, нет Implementer auto-patch.
**Остаточный риск:** появится при расширении MVP без обновления safety caps.
### R10 — Секреты
@@ -93,11 +96,11 @@
## 6. Триггеры пересмотра реестра
- Смена хоста/GPU/RAM.
- Включение Implementer auto-patch.
- Добавление physics engine.
- Подключение реального CV inference.
- Появление CI e2e.
- Смена хоста/GPU/RAM.
- Включение Implementer auto-patch.
- Добавление physics engine.
- Подключение реального CV inference.
- Появление CI e2e.
- Инцидент на живом показе.
---