D-088 Deployment Status
Run: 5557368d
Decision: MAIC_BLOCKED for server-side classroom generation; the safe app deployment and documentation work completed.
Human acceptance: false.
Evidence root: evidence/2026-09-16-openmaic-showcase-5557368d/.
Outcome
The pinned OpenMAIC application is deployed as container maic and is reachable through its named systemd service and nginx vhost. The container listens only on loopback host port 52300; the deployment overlay binds /home/loca/dev/maic/data to /app/data. (deploy/compose.yml; deploy/maic.service.)
The app edge is TLS-enabled for maic.loca.zone and wiki.maic.loca.zone. The app vhost requires HTTP Basic authentication at server scope, while the wiki vhost is public documentation. (deploy/nginx/maic.loca.zone.conf.) The shared Authelia instance was not used because its configured default policy is bypass; changing that global configuration was outside this run’s authority. (/home/loca/dev/services/authelia/config/configuration.yml.)
Live probes
| Surface or behavior | State | Evidence |
|---|---|---|
| Unauthenticated app home | exercised | evidence/2026-09-16-openmaic-showcase-5557368d/http-probes.txt: HTTP 401 |
Unauthenticated /api/health | exercised | http-probes.txt: HTTP 401 |
| Unauthenticated classroom write | exercised | http-probes.txt: HTTP 401; no probe file remained in the data directory |
| Authenticated home | exercised | http-probes.txt: HTTP 200; screenshots/home.png |
Authenticated /api/health | exercised | http-probes.txt: status ok, version 0.1.0, all optional capabilities false |
| Authenticated provider metadata | exercised | http-probes.txt: empty provider maps |
| Auth header stripping | exercised | header-capture.txt: forwarded headers contain no Authorization field |
| Edge rate limit | exercised | http-probes.txt: burst returned 429 after successful requests |
| Edge request body limit | exercised | http-probes.txt: 40 MiB probe returned 413 against the 32 MiB edge cap |
| HTTPS certificate names | exercised | http-probes.txt: certificate SANs include both exact hostnames |
| HTTP redirect | exercised | http-probes.txt: port 80 returned 301 to HTTPS |
| Host-bound server persistence | exercised | persistence-probe.txt: authenticated classroom POST, GET, service restart, and GET after restart |
| Home first-run surface | exercised | screenshots/home.png and screenshots/home.png.dom: visible setup shell and “Setup required” state |
| Classroom route surface | exercised | screenshots/classroom.png: route rendered its loading state for the temporary probe record |
The persistence probe record and failed generation job were removed after the checks; the deployment data directory is therefore not a bundled lesson or fixture. (evidence/2026-09-16-openmaic-showcase-5557368d/persistence-probe.txt; lib/store/stage.ts:98-111.)
Generation blocker
An authenticated POST /api/generate-classroom with one concise requirement and all optional flags set false returned a queued job. Polling the returned job reached the terminal failed state with the exact error API key required for provider: openai. (evidence/2026-09-16-openmaic-showcase-5557368d/generation-probe.txt; lib/server/resolve-model.ts:30-54; lib/ai/providers.ts:934-947.)
This is an intentional no-spend configuration, not a successful classroom-generation proof. The deployment environment leaves all provider keys and DEFAULT_MODEL empty. (deploy/maic.env.example.) A future admitted run requires an owner-approved legitimate provider key, a matching explicit providerId:modelId, and bounded spend; no credential was requested or copied during this run. (.env.example:8-29; lib/server/resolve-model.ts:23-31.)
Configured versus exercised
- Configured: Node 22 Alpine standalone image, pnpm 10.28.0 build, persistent server data bind mount, named service, TLS certificates, scoped Basic gate, 32 MiB edge body cap and per-IP request zones. (
Dockerfile:2-5,30-51;deploy/compose.yml;deploy/nginx/maic-ratelimit.conf;deploy/nginx/maic.loca.zone.conf.) - Exercised: live edge denial, authorized navigation, metadata and health routes, limits, header stripping, service restart persistence, home screenshot, and the provider-less generation failure described above. (
evidence/2026-09-16-openmaic-showcase-5557368d/.) - Blocked: server-side LLM classroom generation, because there is no approved provider credential or default model in this deployment. (
deploy/maic.env.example;lib/server/resolve-model.ts:30.) - Not claimed: human acceptance, provider generation, media/TTS/video generation, PDF parsing through a remote provider, browser BYOK generation, or complete classroom playback. No runtime evidence for those claims exists in this run. (
evidence/2026-09-16-openmaic-showcase-5557368d/generation-probe.txt;deploy/maic.env.example.)
Final URLs
- Application: maic.loca.zone — served app state is the gated OpenMAIC setup shell, observed at the evidence capture time.
- Wiki: wiki.maic.loca.zone — this vault’s generated site, to be synchronized after the final build.
The machine-readable receipt is evidence/2026-09-16-openmaic-showcase-5557368d/result.json; its current_url_state is updated after the final wiki publication and is the last state transition recorded by the run.