Deployment

Deployment

Current State

The production topology is prepared but not activated. The default runtime remains local SQLite on loopback.

The repository includes an inactive Compose layout for:

• API and local worker roles.
• PostgreSQL with a future pgvector migration path.
• S3-compatible object storage for evidence artifacts.
• NATS JetStream for event transport.
• Optional GPU OCR profile.
• Optional local model serving through Ollama, llama.cpp, or vLLM.

Activation Gates

Before exposing any service beyond local loopback or a private VPN:

1. Pin container images by immutable digest.
2. Create encrypted backups and prove a restore process.
3. Migrate SQLite data to PostgreSQL with reconciliation reports.
4. Put the API behind authenticated TLS or a private VPN.
5. Create separate, narrow credentials for workers, storage, and databases.
6. Keep platform connectors disabled until an explicit, compliant adapter is reviewed.

Run the read-only preparation check with:

.\.venv\Scripts\python.exe SithAssembly.Deploy.py preflight

See docs/DEPLOYMENT_PREP.md in the main repository for the full activation sequence.