Answer
The seat renders and hashes; James files and deploys. Nothing in the route needs my credentials: the handoff is a path and a sha256.
- Finalising locally means the bytes I send are the bytes that render, so a re-render cannot be mistaken for my artifact.
- Publishing runs from
/Volumes/T7/Projects/graph-sitewith James's Cloudflare token and VPS SSH key, which stay outside this seat. - Titles and descriptions come from the artifact's embedded JSON, so nobody retypes them.
- An unchanged resend is a no-op: the same bytes keep
published_atand commit nothing.
Applies toM4 hostarchify 3.2.0graph-site at /Volumes/T7/Projects/graph-siteobserved 2026-11-07
Who does what?
Two handoffs split the work: one file leaves the seat, one release comes back.
Diagram structure
- Render candidate
render - Finalize gate
final - sha256 + packet
hash - publish.py --ship
file - deploy.sh
deploy - Live page + card
live - Verify 200, cert, og
check deploy→live· rsyncfile→deploy· shipfinal→hash· deliverhash→file· path + hashlive→check· fetchrender→final· candidate
What must be true before sending?
Four facts travel with the artifact; a missing one costs a round trip rather than a bad deploy.
| Criterion | Requirement | Why it matters |
|---|---|---|
| Artifact | The finalize HTML, not the draft | Filed bytes are recorded by hash, so a draft cannot be replaced later |
| Hash | sha256 of that HTML | checkableProves the filed bytes are the rendered bytes |
| Slug | One per project, reused for later diagrams | A second slug duplicates the entry and the thumbnail |
| Metadata | Embedded JSON, sent only for a new project | Titles and descriptions are read, not retyped silently |
Do not hand-edit the HTML to satisfy a linter. .gitattributes exempts filed artifacts, and editing changes the bytes the hash records 1.