Files

cproudlock ad9210b84a Write down the tool that was built, not the one that was tabled

Secure Send shipped on 21 August and nothing outside the code caught up. The
roadmap still listed it under Deferred as "tabled", and gave as the reason that
the tools plugin is browser-only by design with get_blueprint and get_models
both empty - which stopped being true in the same day's commits that gave it a
blueprint, a table, a migration chain, a permission and a setting. A reader
following the roadmap would have concluded the feature does not exist.

The generated API docs were fine: api-inventory.json and openapi.json both
carry /api/tools/secrets, so the contract gates did their job. What was missing
was every word written for a person, and that is the half where the security
properties live.

docs/SECURE-SEND.md is the new page. The parts worth having in prose rather
than inferring from the code: that a lost secret is lost to everybody including
an administrator, which is the same property as "a compromised database yields
nothing" seen from the other side; that the 4096-character limit is the entire
server-side enforcement, because a server that cannot read what it holds cannot
have an opinion about content, so raising it turns a password tool into an
unaudited file transfer; that redeeming is a POST because preview prefetch in
chat and mail clients would otherwise spend a one-view secret before the
recipient ever sees it; and that somebody should send a link to themselves
through their own mail or chat client and confirm the key survives after the #
before a real credential goes through it, because a product that rewrites links
can strip the fragment and nothing on this side can help.

securesend_allow_guests was in the database, on a settings page, and in no
document. It is now in CONFIG.md with what it actually does - an unauthenticated
write endpoint, rate limited per address, failing closed - rather than only its
one-line description.

Also corrected along the way: site_base_url was documented as scheme + host
while the code deliberately tolerates a subpath in it, and the bundled plugin
table in PLUGINS.md had no row for tools at all.

Still missing after this: PLUGINS.md has no row for backups either.

2026-08-24 08:37:25 -04:00

3.5 KiB

Raw Blame History

Start here

ShopDB is a per-site asset platform: one instance per plant, plugins for what each site tracks. These pages document the server, the plugin contract, and the tools that run on shop-floor PCs.

Find yourself below. Each row is the shortest correct path, not everything that exists.

I am standing up ShopDB at a new site

INSTALL-WINDOWS - one offline installer, start to finish.
OPERATE-WINDOWS - restart, logs, backups, upgrades.
CSV-IMPORT if the site's data is in spreadsheets, or IMPORT-API if there is a source database to script against.
FLOOR-MAP - load the site's floor plans and place markers. Also the page to read BEFORE a plan changes: it covers moving every marker onto a redrawn plan without doing it one at a time.

Do not follow INSTALL-WINDOWS-IIS for a new site. That is the manual procedure, kept for hand-built servers that predate the installer, and following it produces a server the installer then refuses to upgrade.

I am deploying the shop-floor tools

Read FLEET-ARCHITECTURE first - it is one page and it is what makes the rest make sense.

Then ADOPTING-AT-ANOTHER-SITE, which has worked examples for Intune, GE-Enforce and manual installation, and says where each artifact comes from.

I am writing a plugin

PLUGIN-QUICKSTART - scaffold and first run.
PLUGIN-HOOKS - the contract. Authoritative.
PLUGIN-LAB-PRINTEDPARTS - a real plugin built end to end, to type along with.
PLUGIN-EXTERNAL-REPO if it lives in its own repository, and CONTRACT-STABILITY before you choose a version pin.

I am integrating with the API

LLM-GUIDE (docs/llms.txt in the repo, also served at /api/docs/llms.txt) - auth, the response envelope, common recipes. Short, and the envelope section is the part people get wrong.
GET /api/docs on any running instance - the full spec, browsable.
API-REFERENCE for prose, COLLECTOR-INTEGRATION if you are feeding data in from a PC.

I have to give somebody a password

SECURE-SEND - a one-view expiring link, instead of a chat message or a sticky note. Read the "Before anybody relies on it" section first: there is one thing to test at your site before the first real credential goes through it.

I am trying to understand why something is built this way

The ADRs. They are the decision record, they say what was rejected and why, and they are the fastest way to avoid relitigating a settled question. PROJECT-MAP lists them all with their status, along with the current versions and every migration head - it is generated, so it is never stale.

Something is broken

Server: OPERATE-WINDOWS, then shopdb-admin.ps1 check -Json.
A PC or a bay: the symptom table at the end of FLEET-ARCHITECTURE says which piece to open first.
A deploy that half-worked: UPGRADE and BACKUP-RESTORE.

I am moving a site to a different server or stack

MIGRATE-TOPOLOGY - Windows/IIS to Docker, Docker to a new host, and back. The data moves cleanly; the URL the fleet points at is the work.

3.5 KiB Raw Blame History