DEPLOY_20260908.md

# Unified deployment — 2026-09-08

This archive is one source tree for both deployments.  It was made from the
audited common revision `f3564275828d9d25ab1c988a03ec0407fc5c0477` and then
contains the multi-day export, read-through fisheries cache, and public-chat
security hardening changes.

## Before deploying

- Keep the two configured fisheries repository identifiers identical on both
  deployments.
- The school host needs outbound access to `huggingface.co` for remote-only
  fallback files. If that connection is blocked, locally mirrored files still
  work, but a missing file cannot be recovered from HF until egress is fixed.
- Do not use `git reset`, force-push, or overwrite a teammate's newer HF work.
  Stop and make a fresh snapshot if `origin/main` no longer equals the audited
  revision below.

## Hugging Face Space — safe update

On the Mac, extract the archive to a temporary source directory. In a clone of
the Space repository, first verify that nobody pushed after this audit:

```bash
git fetch origin main
test "$(git rev-parse origin/main)" = "f3564275828d9d25ab1c988a03ec0407fc5c0477"
```

If that check succeeds, overlay the extracted archive (do not copy `.git`),
then validate and push normally:

```bash
rsync -a --exclude '.git' /absolute/path/to/extracted-unified-source/ ./
PYTHONDONTWRITEBYTECODE=1 python3 scripts/preflight.py
git diff --check
git add -A
git commit -m "fix: unified safe multi-day marine data runtime"
git push origin main
```

If the revision check fails, stop instead of copying files: obtain a fresh HF
snapshot and reapply/review the change on top of the teammate's work.

For the Space, retain the existing connection setting:

```text
MARINE_API_URL=https://subway-unbiased-barcode.ngrok-free.dev/marine
```

## School server — controlled restart

Upload the archive to `/data0/zqyan/audits/`, create a new timestamped app
directory, and extract it there. In an administrator SSH session, run:

```bash
cd /data0/zqyan/<new-app-directory>
chmod +x start.sh deploy/restart-school.sh
export PUBLIC_BASE_URL="https://subway-unbiased-barcode.ngrok-free.dev/marine"
./deploy/restart-school.sh --confirm-restart
curl -fsS http://127.0.0.1:7861/api/status
curl -fsS http://127.0.0.1:7861/marine/health
```

`PUBLIC_BASE_URL` is required for browser-facing Ocean export links. Without
it, the model can only see the private `127.0.0.1:8000` URL. The fixed ngrok
endpoint proxies `/marine/*` to that private API, so the correct public link
has the form `https://subway-unbiased-barcode.ngrok-free.dev/marine/download/<token>`.

The school inventory is local-first. It returns the local mirror immediately
when Hugging Face egress is blocked, and merges remote-only paths when HF is
reachable; a blocked HF connection no longer holds a metadata-only chat until
the request times out.

The restart script automatically uses the known `squid_agent` Python 3.11 path
instead of Ubuntu's legacy `python3`, and checks the existing runtime
configuration from the currently running service *before* it stops that
service. It does not prompt for, print, or store secrets.

## Required security completion on the school server

Install `deploy/systemd/marine-agent.service.template` according to
`deploy/systemd/README.md`. That is the operating-system enforcement that makes
the public app process read-only outside its cache/export directories. Until
the service runs under the unprivileged `marineapp` account, the source code
has strong application safeguards but the current owner account still has its
normal filesystem permissions.