DEPLOY_20260908.md

Unified deployment — 2026-09-08

This archive is one source tree for both deployments. It was made from the audited common revision f3564275828d9d25ab1c988a03ec0407fc5c0477 and then contains the multi-day export, read-through fisheries cache, and public-chat security hardening changes.

Before deploying

• Keep the two configured fisheries repository identifiers identical on both deployments.
• The school host needs outbound access to huggingface.co for remote-only fallback files. If that connection is blocked, locally mirrored files still work, but a missing file cannot be recovered from HF until egress is fixed.
• Do not use git reset, force-push, or overwrite a teammate's newer HF work. Stop and make a fresh snapshot if origin/main no longer equals the audited revision below.

Hugging Face Space — safe update

On the Mac, extract the archive to a temporary source directory. In a clone of the Space repository, first verify that nobody pushed after this audit:

git fetch origin main
test "$(git rev-parse origin/main)" = "f3564275828d9d25ab1c988a03ec0407fc5c0477"

If that check succeeds, overlay the extracted archive (do not copy .git), then validate and push normally:

rsync -a --exclude '.git' /absolute/path/to/extracted-unified-source/ ./
PYTHONDONTWRITEBYTECODE=1 python3 scripts/preflight.py
git diff --check
git add -A
git commit -m "fix: unified safe multi-day marine data runtime"
git push origin main

If the revision check fails, stop instead of copying files: obtain a fresh HF snapshot and reapply/review the change on top of the teammate's work.

For the Space, retain the existing connection setting:

MARINE_API_URL=https://subway-unbiased-barcode.ngrok-free.dev/marine

School server — controlled restart

Upload the archive to /data0/zqyan/audits/, create a new timestamped app directory, and extract it there. In an administrator SSH session, run:

cd /data0/zqyan/<new-app-directory>
chmod +x start.sh deploy/restart-school.sh
export PUBLIC_BASE_URL="https://subway-unbiased-barcode.ngrok-free.dev/marine"
./deploy/restart-school.sh --confirm-restart
curl -fsS http://127.0.0.1:7861/api/status
curl -fsS http://127.0.0.1:7861/marine/health

PUBLIC_BASE_URL is required for browser-facing Ocean export links. Without it, the model can only see the private 127.0.0.1:8000 URL. The fixed ngrok endpoint proxies /marine/* to that private API, so the correct public link has the form https://subway-unbiased-barcode.ngrok-free.dev/marine/download/<token>.

The school inventory is local-first. It returns the local mirror immediately when Hugging Face egress is blocked, and merges remote-only paths when HF is reachable; a blocked HF connection no longer holds a metadata-only chat until the request times out.

The restart script automatically uses the known squid_agent Python 3.11 path instead of Ubuntu's legacy python3, and checks the existing runtime configuration from the currently running service before it stops that service. It does not prompt for, print, or store secrets.

Required security completion on the school server

Install deploy/systemd/marine-agent.service.template according to deploy/systemd/README.md. That is the operating-system enforcement that makes the public app process read-only outside its cache/export directories. Until the service runs under the unprivileged marineapp account, the source code has strong application safeguards but the current owner account still has its normal filesystem permissions.