Skip to content

Hub QA Operations Runbook

  • Status: CURRENT RUNBOOK
  • Owns: starting CTC QA on the Hub, the local runtime smoke check, and the SSH maintenance boundary
  • Does not own: repository Git/promotion policy (.agents/rules/PROJECT_OPERATIONS.md), Production configuration, Product or Task status
  • Update when: the Hub checkout, the local QA endpoint, the Telegram/Codex bridge or the SSH maintenance procedure changes

Purpose and boundary

The Linux Mint hub is the Telegram/Codex CTC execution and QA machine. It is not a Production server and must not directly modify Production files.

Concrete hostnames, tailnet IPs, usernames and private-key paths are current deployment facts. Keep them in approved local/operator configuration and recheck them when the hub is replaced; they are not portable system design.

Source-code synchronization uses GitHub only. Do not use rsync, Syncthing, manual file copy or direct server-to-server source sync. The repository Git, writer, publish and deployment rules are owned by .agents/rules/PROJECT_OPERATIONS.md and AGENTS.md.

Hub QA start

From the existing CTC checkout, inspect the worktree before beginning. Preserve unrelated work and follow the current repository start-up and Git rules; the hub normally works on qa.

Start the local server from the repository root:

php -S 0.0.0.0:8080 router.php

Smoke checks:

curl -sS -o /dev/null -w "%{http_code}\n" http://localhost:8080/login.php
curl -sS -o /dev/null -w "%{http_code}\n" http://localhost:8080/api/platform/ping

Expected results:

  • /login.php returns 200.
  • /api/platform/ping returns 401 when unauthenticated.

Control Tower QA boundary

The hub may host or assist the initial Control Tower QA flow:

Control Tower draft
  -> validate
  -> QA apply
  -> QA smoke checks
  -> approval record

Production publish support is outside this runbook's first QA validation scope.

SSH maintenance boundary

SSH is an administrator channel for inspection, recovery and direct hub maintenance; normal user work continues through Telegram/Codex. After key-based SSH is verified, keep password login disabled and apply the approved host-security configuration. Do not store production secrets in Git, treat hub .env files as source-controlled configuration, or change Production server configuration from a hub task.

Source: docs/runbooks/HUB_QA_OPERATIONS_RUNBOOK.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged. A user instruction quoted inside the text is kept in its original language.