mwiegand c446f6c8eb spec(deployment-responsibility): design — symlink hardening drop-ins, sudoers, sysctl, helpers ... Conservative reshape coming out of the brainstorm: application-shape static artifacts move to left4me/deploy/ and are delivered to the target via bw symlink items pointing into /opt/left4me/src/deploy/... (safe because the runtime-state relocation made the checkout root-owned). Per-host shape — base unit bodies, slice CPU pinning, env templates, nginx/timers/nftables metadata — stays bw-managed in ckn-bw. Moves: hardening drop-ins (new), sudoers (dedup mirror), sysctl drop-in (dedup mirror + absorb ptrace_scope metadata entry), privileged scripts (relocate scripts/ to deploy/scripts/, replace install-action with symlinks). Five-step migration with sysctl consolidation as the canary, then hardening drop-ins, sudoers, scripts, cleanup. Lands before the build-overlay-unit refactor so that work can ship its hardening drop-in inline using this pattern. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-15 18:48:13 +02:00
..
2026-05-05-l4d2-host-smoke-test-design.md	chore(l4d2): flatten component layout	2026-05-05 23:47:06 +02:00
2026-05-06-l4d2-install-logging-design.md	fix(deploy): add venv to PATH in left4me-web systemd service	2026-05-06 20:45:37 +02:00
2026-05-06-l4d2-web-auth-pages-design.md	fix(l4d2-web): reject encoded unsafe redirects	2026-05-06 13:24:04 +02:00
2026-05-06-l4d2-web-ui-design.md	docs(l4d2-web): plan functional web ui	2026-05-06 11:34:23 +02:00
2026-05-06-l4d2host-step-logging-design.md	fix(deploy): add venv to PATH in left4me-web systemd service	2026-05-06 20:45:37 +02:00
2026-05-06-left4me-deployment-design.md	feat(deploy): add production-like test deployment	2026-05-06 19:30:10 +02:00
2026-05-07-l4d2-global-map-overlays-design.md	feat(l4d2-web): managed global map overlays with daily refresh	2026-05-08 08:05:14 +02:00
2026-05-07-l4d2-workshop-overlays-design.md	docs(workshop): spec and plan for steam workshop overlays	2026-05-07 16:25:13 +02:00
2026-05-08-kernel-overlayfs-helper-design.md	docs(specs): kernel overlayfs migration design + plan	2026-05-08 12:19:26 +02:00
2026-05-08-l4d2-blueprint-overlay-picker-design.md	docs(specs): blueprint overlay picker — drag-list + add-dropdown	2026-05-08 21:32:45 +02:00
2026-05-08-l4d2-script-overlays-design.md	docs: correct stale bubblewrap references in v1 spec + live docstring	2026-05-15 12:12:31 +02:00
2026-05-08-l4d2-script-sandbox-v2-systemd.md	docs(specs): script sandbox v2 — systemd-only design + plan	2026-05-08 16:46:13 +02:00
2026-05-08-l4d2-script-sandbox-v3-egress-filter.md	docs(specs): script sandbox v3 — egress filter design + plan	2026-05-08 17:08:47 +02:00
2026-05-08-overlay-file-tree-design.md	fix(l4d2-web): file tree fetches in plain JS — vendored htmx is a stub	2026-05-08 20:23:04 +02:00
2026-05-08-server-id-as-host-identifier-design.md	feat(l4d2-web): server identity by id, name as display label	2026-05-08 19:22:09 +02:00
2026-05-09-files-overlay-design.md	feat(files-overlay): user-managed file content as a third overlay type	2026-05-09 18:59:32 +02:00
2026-05-09-l4d2-cpu-isolation-design.md	docs(specs): l4d2 cpu isolation — design	2026-05-09 11:03:37 +02:00
2026-05-09-l4d2-cpu-pinning-decision.md	docs(specs): l4d2 cpu pinning — decision record (deferred)	2026-05-09 12:41:40 +02:00
2026-05-09-l4d2-server-host-perf-baseline-design.md	docs(specs): perf baseline — fix transient-service phrasing	2026-05-09 09:39:12 +02:00
2026-05-09-l4d2-server-lifecycle-reboot-and-drift-design.md	docs(specs): perf baseline lifecycle — premise check on system vs user units	2026-05-09 12:25:34 +02:00
2026-05-10-l4d2-network-shaping-design.md	docs(specs): l4d2 network shaping & marking — design	2026-05-10 00:05:44 +02:00
2026-05-11-profile-password-change-design.md	docs: design for profile page with self-service password change	2026-05-11 22:21:40 +02:00
2026-05-11-workshop-auto-download-design.md	docs: design for workshop auto-download	2026-05-11 22:28:20 +02:00
2026-05-12-server-live-state-display-design.md	refactor(rcon): harden _parse_duration; surface fixture handler errors	2026-05-12 21:39:32 +02:00
2026-05-13-rcon-password-display-design.md	docs: add rcon password display design spec	2026-05-13 11:35:46 +02:00
2026-05-13-server-hostname-design.md	docs: add server hostname cvar design spec	2026-05-13 14:19:57 +02:00
2026-05-15-build-overlay-unit-design.md	refactor(sandbox): collapse l4d2-sandbox user into left4me	2026-05-15 15:50:57 +02:00
2026-05-15-deploy-dir-rethink-design.md	spec(deploy-dir-rethink): plan + mark adjacent specs resolved	2026-05-15 12:05:53 +02:00
2026-05-15-deployment-responsibility-design.md	spec(deployment-responsibility): design — symlink hardening drop-ins, sudoers, sysctl, helpers	2026-05-15 18:48:13 +02:00
2026-05-15-handoff-deployment-responsibility.md	spec(deployment-responsibility): handoff for brainstorming the deploy split	2026-05-15 15:56:38 +02:00
2026-05-15-handoff-noneditable-install.md	refactor(deploy): venv + steam now under /var/lib/left4me	2026-05-15 17:56:32 +02:00
2026-05-15-hardening-defenses-survey.md	spec(hardening): threat model + defenses survey + test plan; pivot handoff	2026-05-15 13:07:40 +02:00
2026-05-15-hardening-refactor-design.md	refactor(sandbox): collapse l4d2-sandbox user into left4me	2026-05-15 15:50:57 +02:00
2026-05-15-hardening-test-plan.md	spec(hardening-test-plan): fix four bugs surfaced by executor	2026-05-15 14:58:46 +02:00
2026-05-15-hardening-threat-model.md	refactor(sandbox): collapse l4d2-sandbox user into left4me	2026-05-15 15:50:57 +02:00
2026-05-15-janitorial-cleanup.md	spec(janitorial): mark items 8, 9 resolved after on-host verification	2026-05-15 12:14:34 +02:00
2026-05-15-runtime-state-relocation-design.md	refactor(deploy): venv + steam now under /var/lib/left4me	2026-05-15 17:56:32 +02:00
2026-05-15-session-handoff.md	spec(deployment-responsibility): handoff for brainstorming the deploy split	2026-05-15 15:56:38 +02:00
2026-05-15-user-uid-split-design.md	refactor(sandbox): collapse l4d2-sandbox user into left4me	2026-05-15 15:50:57 +02:00