AkurAI-EC2 / README.md

Latest change 1812db66bd54bca3e7125b216a5a8a07efcd53c9 - OLI-13: gate every release mode; clippy/test cover the workspace with --locked; Node projects use their own gates by Ólafur Búi Ólafsson

# akurai-ec2

Documentation lives in AkurAI Notes, notebook **AkurAI-EC2** (ID 35) —
see `AkurAI-EC2 — Project Index` (note 117). Secrets live in AkurAI-PassVault,
never in this repo.

Canonical release modes: `akurai-ec2 release --mode update|publish|release`
with `--bump patch|minor|major` for release mode; `patch|minor|major|publish|ec2`
remain supported as legacy shorthand.

Every mode (`update`, `publish`, `release`, and `propagate` for the Framework
build) runs the gates first: rustfmt, clippy `--workspace --all-targets --locked
-D warnings`, and `cargo test --workspace --locked` for Cargo projects; the
`lint`/`typecheck`/`check` and `test` scripts for `package.json` projects (a
`gate_test = true` project without a `test` script fails). Gates are disabled
per manifest with `gate_fmt|gate_clippy|gate_test = false`, or for a single
emergency run with `--skip-gates` (prints a warning; leave no trace of it in
manifests). `tests/test_release_gates.sh` covers this.

## Bunfork operations

`akurai-ec2 deploy-bunfork` installs an inventory-verified immutable Bunfork
release while preserving encrypted state. `akurai-ec2 bunfork-backup
install|run|verify [retention]` manages its hardened persistent daily backup
timer, bounded ciphertext retention, and isolated recovery drill. The default
retention is 14 successful backups.

`akurai-ec2 bunfork-monitor` manages install, run, and verify operations for a
hardened persistent 15-minute HTTPS readiness and TLS-expiry monitor. Failures
stay visible in systemd and trigger at most one owner mail alert per six-hour
outage window; the expiry threshold defaults to 30 days.