feat: serialize public hardware execution

2026-08-03 09:25:38 +08:00
parent a6d974cb29
commit 85b4740d29
10 changed files with 308 additions and 16 deletions
@@ -49,3 +49,19 @@ systemctl status caddy
 Never place `.env`, `.env.auth`, API keys, login passwords, or SSH credentials
 inside the image or source control. Updating the application uses the same
 source synchronization followed by `docker compose ... up -d --build`.
+
+## Public physical-bench gateway
+
+When the physical T2G bench is attached to a separate trusted workstation,
+Caddy may prefer a restricted reverse-SSH upstream on `127.0.0.1:18512` and
+retain the container on `127.0.0.1:8511` as the unavailable-bench fallback.
+The workstation service must use the same `.env.auth` as the public container;
+the SSH key must be restricted to that single reverse-listen port and must not
+be allowed to run remote commands.
+
+The physical bench is a process-wide single-flight resource. A hardware action
+owns the bench from intent planning through final physical feedback. Concurrent
+hardware actions and passive physical-state reads receive HTTP `409`
+(`hardware_busy`) with `Retry-After`; they never enter the CAN path or wait to run
+later against stale position state. Dry-run and simulated-hardware requests are
+not serialized by this gate.