4 Commits

Include renames

Author	SHA1	Message	Date
jcoffey-dev	5a4e05d4f7	Point links at git.coffeylabs.org after the move from GitHub ... GitHub took the organization's repos and GHCR offline on 2026-09-20. Repo, release, raw-file and clone links now go to Gitea at git.coffeylabs.org, container images to registry.coffeylabs.org, and GitLab-style /-/blob paths to Gitea's /src/branch form. Go module paths are identifiers and stay as they are; links to GitHub issues and pull requests are left as history.	2026-09-22 09:08:40 -07:00
jcoffey-dev	0ee2e9183b	Take multi-tenancy off the roadmap ... Cairn OBS is self-hosted, and the way to separate two environments is to run two installations rather than two tenants inside one. Tenancy is the wrong boundary for that, on three counts this repository demonstrates rather than assumes: chwriter.WriteBatch is all-or-nothing across tenants, so one tenant's failure stalls offset progress for every other; CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT puts every tenant's data behind a single superuser credential, as docker-compose.yml's own comment says; and one binary with one set of migrations moves every tenant together, which is the opposite of what separate environments are for. A whole installation idles at about 1.3 GB, so the sharing buys nothing. The project led with multi-tenant RBAC in the README banner and in PROJECT-SPEC's goal statement. Both now say what it is instead: self-hosted. "Open-core" goes with them -- it was already inaccurate, since CONTRIBUTING states there is no feature gate and no paid tier, and with enterprise/ off the roadmap there will not be one. A second identity provider comes off the list of things standing between this and production-ready. SSO belongs to enterprise/, and a self-hosted deployment is not waiting on it. Terraform's tenant/RBAC resources move from "disclosed future work" to not planned. Nothing is scrubbed from the record. Phase 4 stays shipped, its runbook stays, and its known gaps stay stated -- rewriting that history would contradict the candour the Status section is built on. enterprise/ stays in the tree, AGPLv3 and working, as the answer to a question this project is not asking. Signed-off-by: John Coffey <[email protected]>	2026-09-04 18:31:23 -07:00
jcoffey-dev	b292a070c1	Point at the Coffey-Labs organisation ... The repositories moved off LINUXexpert-org. The old URLs redirect, so nothing was broken, but a redirect is not a correct address to publish.	2026-08-30 15:22:22 -07:00
jcoffey-dev	233e0779b7	Add the community health files ahead of going public ... The repository has carried only a LICENSE and a README, which scores 42% on GitHub's community profile against ihasmail's 85% and, more to the point, leaves someone who finds a vulnerability with nowhere to send it but a public issue. SECURITY.md is the one that matters. It names cross-tenant data exposure as the highest-severity class, since that is the guarantee this project actually sells and the one hardest to be sure of. It also puts the two knowingly unverified areas in front of a reporter -- Phase 4 beyond its audit-logging guarantees, and the Windows agent, which has never run on Windows -- so a finding there is not mistaken for a regression in a path that was ever verified. And it declares the demo credential out of scope explicitly: it is published on purpose, prefilled on the login page and baked into the web bundle, so a report about it costs everyone time. CONTRIBUTING.md is written for this tree rather than adapted loosely from the other one: the storage/query split, PostgreSQL being control-plane only, the enterprise/ module boundary core never imports across, and the fact that the whole repository is AGPLv3 with no feature gate. Setup is the compose path from the README, including COMPOSE_PROFILES, so the two cannot drift into disagreeing. CODE_OF_CONDUCT.md is Contributor Covenant 2.0, copied from ihasmail with one fix: that copy never filled in the contact placeholder, so its reporting sentence ends at "responsible for enforcement at ." -- a code of conduct with no way to report anything. Worth fixing there too. Signed-off-by: John Coffey <[email protected]>	2026-08-29 00:17:48 -07:00