Rongsong Shen 27ef506058 docs(apiserver): document security defaults changed by bug-1945..1952 ... deployment.md: auth.yaml now holds bcrypt hashes of the (still public) dev credentials with startup warnings; JWT secret from XCE_JWT_SECRET or a random per-process secret; logout revocation is per process; security.trusted_proxies for reverse proxies. security.md steering: JWT parsing, revocation, secret resolution, trusted proxies, middleware abort rule, bcrypt and role-change rule. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>		2026-10-10 08:58:20 +00:00
..
reviews	docs(review): project and spec review: conflicts, code gaps, priorities	2026-10-10 08:11:08 +00:00
settings	finalize configuration replication	2026-06-09 16:40:13 +08:00
specs	docs(specs): record xce-node-manager interactions with service and provisioning specs	2026-10-10 07:46:24 +00:00
steering	docs(apiserver): document security defaults changed by bug-1945..1952	2026-10-10 08:58:20 +00:00