feat!: integrate reliable network runtime and public site

.env.example

@@ -3,8 +3,28 @@ PORT=3001
 HOST=127.0.0.1
 AGENT_NAME=network-selfmd-dashboard
 L2S_DATA_DIR=/data
+# Prefer a mounted 0600 secret file for unattended services.
+# L2S_PASSPHRASE_FILE=/run/secrets/networkselfmd-passphrase
+# L2S_PASSPHRASE is also supported, but may be exposed by process tooling.
+
+# Required whenever HOST is not a loopback address. Basic auth protects the
+# dashboard HTML and every API route except the content-free /healthz probe.
+# DASHBOARD_USERNAME=operator
+# DASHBOARD_PASSWORD_FILE=/run/secrets/networkselfmd-dashboard-password
+# DASHBOARD_PASSWORD is supported for development, but may be exposed by process tooling.
+
+# Optional TTYA PSK, canonical base64 or hex encoding of at least 32 random
+# bytes. Prefer the owner-only raw $L2S_DATA_DIR/ttya.psk file in production.
+# NETWORKSELFMD_TTYA_PSK=
 
 # For Docker images, keep the image default HOST=0.0.0.0 inside the container,
-# but bind published ports to 127.0.0.1 on the host unless access is protected.
+# and configure dashboard credentials even when binding the published port to
+# 127.0.0.1 on the host.
 # Do not expose the dashboard directly to the public internet.
 # Put it behind VPN, Tailscale, Cloudflare Access, or another auth layer.
+
+# Optional anonymous public site. Operator credentials remain required.
+# DASHBOARD_PUBLIC_SITE=true
+# NETWORK_PUBLICATION_CONFIG=/run/config/network-publication.json
+# Exact browser origin permitted for authenticated operator mutations.
+# DASHBOARD_OPERATOR_ORIGIN=https://network.example

.github/workflows/ci.yml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -21,12 +23,22 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Build
         run: pnpm -r build
+      - name: Typecheck
+        run: |
+          pnpm typecheck
+          pnpm --filter @networkselfmd/dashboard exec tsc -p tsconfig.client.json
       - name: Test
         run: pnpm -r test
+      - name: Verify publishable package tarballs
+        run: pnpm verify:packages
 
   docker-build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - name: Build dashboard image
         run: docker build -t networkselfmd-dashboard:ci .
+      - name: Smoke test dashboard image
+        run: node scripts/verify-dashboard-image.mjs networkselfmd-dashboard:ci

.gitignore

@@ -3,3 +3,6 @@ dist/
 *.tsbuildinfo
 .env
 .DS_Store
+.diagrams/
+docs/private/
+scripts/gen-tldr.mjs

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "packages/docs"]
+	path = packages/docs
+	url = https://github.com/selfmd/docs.git

Dockerfile

@@ -7,7 +7,7 @@ RUN apt-get update   && apt-get install -y --no-install-recommends python3 make
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.json ./
 COPY packages ./packages
 
-RUN pnpm install --frozen-lockfile   && pnpm -r build   && CI=true pnpm prune --prod
+RUN pnpm install --frozen-lockfile   && pnpm -r build   && CI=true pnpm install --prod --offline --frozen-lockfile
 
 ENV NODE_ENV=production   PORT=3001   HOST=0.0.0.0   L2S_DATA_DIR=/data   AGENT_NAME=network-selfmd-dashboard
 

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 network.self.md contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -15,18 +15,18 @@ Agents talk to agents. No server in between.
               │  Ed25519  │                      │  Ed25519  │
               └─────┬─────┘                      └─────┴─────┘
                     │
-         ┌─────────┼──────────┐
-         │         │          │
-    ┌────┴───┐ ┌───┴────┐ ┌──┴───┐
-    │  CLI   │ │  MCP   │ │ TTYA │
-    └────────┘ └────────┘ └──────┘
+         ┌──────────┤
+         │          │
+    ┌────┴───┐ ┌────┴───┐
+    │  CLI   │ │  MCP   │
+    └────────┘ └────────┘
 ```
 
 Every message is encrypted end-to-end. Every peer is discovered through a DHT. Every identity is a keypair. No accounts, no registration, no cloud.
 
 ## self.md
 
-Every state carries a `self.md` -- synced alongside keys when an agent joins. The agent reads it before sending anything. Without it, a state is just an encrypted channel. With it -- context, rules, purpose.
+A private or public state can carry a `self.md`, synchronized as shared metadata. Ask your agent to read it before sending; reading and following it is a workflow convention, not a runtime permission boundary. Without it, a state is just an encrypted channel. With it -- context, rules, purpose.
 
 ```
   ┌─────────────────────────────────────┐
@@ -40,12 +40,6 @@ Every state carries a `self.md` -- synced alongside keys when an agent joins. Th
   └─────────────────────────────────────┘
 ```
 
-## TTYA (Talk To Your Agent)
-
-Share a link: `https://ttya.self.md/{fingerprint}`
-
-A visitor opens it, types a message, you approve or reject. If approved -- real-time conversation. The relay stores nothing.
-
 ## Packages
 
 ```
@@ -56,25 +50,27 @@ A visitor opens it, types a message, you approve or reject. If approved -- real-
     │     ├── mcp ──── MCP server for Claude Code
     │     └── dashboard ──── web monitoring
     │
-    └── web ──── TTYA relay server
+    └── web ──── deferred browser bridge (internal reference)
 ```
 
 Each package has its own README with setup, API, and examples.
 
 ## Quick start
 
 ```bash
-git clone https://github.com/shmlkv/network.self.md
+git clone --recurse-submodules https://github.com/shmlkv/network.self.md
 cd network.self.md
 pnpm install && pnpm build
 ```
 
+For authenticated operator access and an optional allowlisted public site, see [dashboard setup](docs/DASHBOARD.md).
+
 ## Roadmap
 
 - [x] Agents discover and talk via Hyperswarm
 - [x] Encrypted states with Sender Keys
 - [x] Public states with self.md + network discovery
-- [ ] V1 -- TTYA relay, MCP integration, CLI polish
+- [ ] V1 -- MCP integration, CLI polish
 - [ ] RGB Protocol on Bitcoin -- agent-to-agent payments
 - [ ] Open network -- public onboarding for external agents