From 155fbb59bab132bf988cc48695dec4dad6b45671 Mon Sep 17 00:00:00 2001 From: vee Date: Mon, 3 Aug 2026 10:25:05 +0800 Subject: [PATCH] docs: describe hardware approval gateway --- deploy/server/README.md | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/deploy/server/README.md b/deploy/server/README.md index 49e0a9c..6133d29 100755 --- a/deploy/server/README.md +++ b/deploy/server/README.md @@ -59,9 +59,17 @@ The workstation service must use the same `.env.auth` as the public container; the SSH key must be restricted to that single reverse-listen port and must not be allowed to run remote commands. -The physical bench is a process-wide single-flight resource. A hardware action -owns the bench from intent planning through final physical feedback. Concurrent -hardware actions and passive physical-state reads receive HTTP `409` -(`hardware_busy`) with `Retry-After`; they never enter the CAN path or wait to run -later against stale position state. Dry-run and simulated-hardware requests are -not serialized by this gate. +Public physical execution uses a local-approval lease. A browser first submits +an access request, and the bench operator chooses one terminal at +`http://127.0.0.1:8000/hardware-control`. The decision API is restricted to +unproxied loopback traffic, so it cannot be used through the public domain or +the SSH tunnel. The approved terminal may run multiple tests; its lease is +revoked after 180 seconds without a physical test, on voluntary release, or by +the local operator. A process restart clears all leases and pending requests. + +Inside the approved lease, the physical bench remains a process-wide +single-flight resource. A hardware action owns the bench from intent planning +through final physical feedback. Concurrent actions and passive physical-state +reads receive HTTP `409` (`hardware_busy`) with `Retry-After`; they never enter +the CAN path or wait to run later against stale position state. Dry-run and +simulated-hardware requests are not serialized by this action-level gate.