fix(agent): harden permissions and startup readiness

2026-08-18 17:10:48 +08:00
parent e8a335d5ba
commit f0bf667d02
6 changed files with 207 additions and 20 deletions
@@ -45,4 +45,13 @@ and UIEnvelope mapping. Tests must not depend on mutable files under `data/`.

 This experimental service has no user authentication. Do not add secrets,
 tokens, passwords, API keys, session dumps, or generated result references to
-the repository.
+the repository. Keep `.env`, `data/`, and `logs/` statically denied in
+`opencode.json`; do not replace those denials with prompt-only guidance. Keep
+arbitrary Bash and edit operations approval-gated and subagents disabled.
+
+## Runtime Readiness
+
+Complete the OpenCode health check, warmup session, and model tool discovery
+before the HTTP server starts listening. A warmup failure must fail startup.
+Once listening, `/health` must expose the `ready` and `warmed_up` readiness
+fields used by deployment checks.