lichen.page.october
lichen.page.review from the reviewed point 0b92cb61 to stack eb5a1653, as one PR per subsystem (review set)
Star 0
Fork 0
Watch

product: 16 Docs: SECURITY.md, HOSTS.md, SANDBOX.md, READMEs #63

Closed notplants-bot.bsky.social
targeting oct/15-ci-config from oct/16-docs
Closed opened by and assigned to notplants-bot.bsky.social
targeting oct/15-ci-config from oct/16-docs

superseded by the full set from 09-23, #17–#37

description: Review set for lichen.page.review, 0b92cb61 (reviewed) → eb5a1653 (stack). PR 16 of 16. 6 files, +666/−25. One commit, c285634ce4fa, which sets these files to their content at eb5a1653. Targets #15 (oct/15-ci-config). Tests and generated files are not in any PR; they are in main.

The top-level documents, rewritten for the new design. Two are new.

  • docs/SECURITY.md (new): who may do what to a site, and how the code holds them to it. Modes; how a route is checked (permission groups); the permissions; the principals (owner, share-password guest, full and safe token, scripts, iroh peer, visitor) with each one's full permission list; the code that enforces each; tables generated from the code (who holds what, what each spawn is compiled from, what each permission admits); and "Stated plainly", what is not protected.
  • docs/HOSTS.md (new): the dashboard, a site's edit host and its published host: their roles, the edit host's name, signing in to it (the handoff), what a browser's request must say, framing, the single-site, desktop and no-dashboard cases, and the DNS and certificates to deploy them.
  • SANDBOX.md (+216/−20): how lichen confines a site, now with each process's permissions, the site's own area and its history's backup (the hub), interpreters and child processes, the terminal pair, a call's process group, local mode, and what a script reaches. It states what crosses between the front server and a site process, and why each crossing is kept.
  • README.md, README-extended.md: a single site's server state beside the site; the dashboard and site frontends, and a host-selected dashboard ([dashboard] source); the trusted_proxies and use_shortcodes_cache settings; hot_reload_templates removed; what the storage limit counts.
  • .agents/skills/lichen-mod/SKILL.md: an agent customizing lichen keeps the editor and the dashboard separate.

info: Plans: LICHEN-SANDBOX-AND-PERMISSIONS-2026-10-13.md (L4: the tables generated from the code), SECURITY-TABLE-CONFORMANCE-2026-10-11.md (docs/SECURITY.md is the specification the code conforms to), ADMIN-EDIT-HOST-SPLIT-2026-10-13.md (HOSTS.md; SHB-ORIGIN1), SITE-FRONT-BOUNDARY-2026-10-17.md (SANDBOX.md's crossings), DASHBOARD-REACT-2026-10-07.md (the README's dashboard section). The project's own security posture is machine-docs/SECURITY-DEBT.md in lichen-orchestrator; these documents cite its rows by id (PSP-LOCAL1, ALLOWANCE-STALE1, …).

Files

  • docs/SECURITY.md — new. The generated tables are checked against the code by tests in main.
  • docs/HOSTS.md — new.
  • SANDBOX.md, README.md, README-extended.md, .agents/skills/lichen-mod/SKILL.md.

Moved in: .agents/skills/lichen-mod/SKILL.md (the starting map's CI bucket matched .agents/). Moved out: the components' READMEs went with their code: crates/lichen-sandbox/README.md and crates/lichen-flat-file/README.md to #1, the frontends' and lichen-ts's to #14. frontends/builtin/DESIGN-10.md is in #14 too.

Lives elsewhere

  • Everything these documents describe is in the PRs below this one. Read them after the code, or first as a map.
Commits 0