Rongsong Shen
27ef506058
deployment.md: auth.yaml now holds bcrypt hashes of the (still public) dev credentials with startup warnings; JWT secret from XCE_JWT_SECRET or a random per-process secret; logout revocation is per process; security.trusted_proxies for reverse proxies. security.md steering: JWT parsing, revocation, secret resolution, trusted proxies, middleware abort rule, bcrypt and role-change rule. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| api-standards.md | ||
| build-deployment.md | ||
| config-design.md | ||
| error-handling.md | ||
| ha-async-io.md | ||
| job-config-layering.md | ||
| persistence.md | ||
| product.md | ||
| resource-accounting.md | ||
| roadmap.md | ||
| scheduler-driver-equivalence.md | ||
| security.md | ||
| structure.md | ||
| tech.md | ||
| testing.md | ||