Runtime Hosting

Runtime Hosting

The pinned upstream artifact, commit, and SHA-256 checksum are recorded in runtime/runtime-lock.json.

# Requires gh authenticated for downloading GitHub Actions artifacts.
npm run runtime:download
RECESS_ALLOWED_ORIGINS=http://localhost:8894 npm run runtime:prepare
npm run runtime:serve

Set Recess's runtime address to http://localhost:9400/remote.html. For a different local WordPress origin, include it in RECESS_ALLOWED_ORIGINS when preparing the runtime. The server binds only to loopback.

For production, publish the contents of .cache/runtime on a dedicated HTTPS static host, after setting the exact permitted OpenStation origins in recess-runtime.json. Serve .wasm as application/wasm, allow CORS for JavaScript/runtime assets, and give sw.js root scope. Keep HTML, service workers, and configuration on short cache lifetimes; hashed assets can be immutable. Do not deploy .cache/browser-state.json or other testing files.

GitHub Actions artifacts expire. Preserve the downloaded ZIP and lock record for reproducible deployments. Runtime upgrades must retain the origin and pass saved-site restore tests; never silently point existing sites at another runtime host. Runtime assets retain upstream licensing.