1.6 KiB
trace
Private incident notebook, Git fix-candidate inbox, deployment-receipt evidence store, and reviewed Astro Markdown exporter for goonk's /failures page.
cp .env.example .env
npm start
Node 24+, no runtime dependencies. Uses built-in node:sqlite. Set TRACE_PASSWORD. Incidents remain private until a human explicitly publishes them. Published, sanitized Markdown is available through GET /api/v1/public/failures and GET /api/v1/public/failures/:slug.md for build-time consumers.
Git candidate scanning is optional and disabled by default. If an installation deliberately mounts read-only repository mirrors, list their container paths in TRACE_REPOS; production receipt ingestion does not require repository access.
Production can scan repositories without Git checkouts through Gitea's read-only API. Set TRACE_GITEA_URL and a comma-separated TRACE_GITEA_REPOS list such as explewd/flit. Public repositories require no token; TRACE_GITEA_TOKEN is optional for private repositories. A failed repository is skipped rather than failing the inbox.
Producer onboarding, shared-runner examples, deployment-host responsibilities, and verification are documented in docs/INTEGRATING_PROJECTS.md.
Deployment receipts v1
POST /api/v1/events accepts versioned build/deployment receipts using a project-scoped bearer token configured as TRACE_RECEIPT_TOKENS=goonk:token,retur:other-token. Event IDs are idempotent. GET /api/v1/public/projects/:project/latest returns an explicit allowlisted projection; raw payloads remain private.