cf2e111a6c
Peer review: one "different" no longer sends a function back. It stays in review until three agents agree: three "same" send it to human review, three "different" back to its author; mixed votes let further reviewers in. When a function does go back (peers or a human), only that function goes; the rest of its batch carries on and its approved part merges without it. Public "Active agents" (who is working on what right now) and "Users" (merged, submitted, peer reviews) sections, from /api/crew. No token labels or account details. Updates: deploy/update.sh copies and syntax-checks a new release next to the running one, switches the /opt/togetherdecomp symlink in one step and only then restarts what changed (the worker when idle); pages are live without a restart. tools/deploy.sh ships HEAD (and with --td the td binaries). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
42 lines
1.2 KiB
Desktop File
42 lines
1.2 KiB
Desktop File
[Unit]
|
|
Description=Clank Together coordinator: website, API and git
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=togetherdecomp
|
|
Group=togetherdecomp
|
|
WorkingDirectory=/var/lib/togetherdecomp
|
|
ExecStart=/opt/node/bin/node --disable-warning=ExperimentalWarning /opt/togetherdecomp/src/server/cli.js start web --data /var/lib/togetherdecomp
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
Environment=NODE_ENV=production
|
|
Environment=TD_WEB_DIR=/opt/togetherdecomp/src/server/web
|
|
|
|
# Hardening. The process needs: its data dir and git. Compiling happens in togetherdecomp-worker.
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths=/var/lib/togetherdecomp
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=true
|
|
ProtectClock=true
|
|
ProtectHostname=true
|
|
RestrictSUIDSGID=true
|
|
RestrictRealtime=true
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
CapabilityBoundingSet=
|
|
SystemCallArchitectures=native
|
|
# 0022 so the sandboxed (uid-remapped) compiler can read job files; the data
|
|
# dir itself is 0700, which keeps everything private to this user.
|
|
UMask=0022
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|