@intentius/behold 0.28.0 → 0.29.0

package/README.md

@@ -385,6 +385,33 @@ proxy's name with `--allow-host <name>` (or `BEHOLD_ALLOWED_HOSTS`); `--host`
 (or `BEHOLD_HOST`) binds another address, which then needs `--allow-host` for
 the names it is reached by.
 
+`behold serve --public` is for a host anyone may load (#569). behold builds no
+op runner at all, refuses every method but GET, HEAD and OPTIONS with 405,
+refuses with 403 every read that runs a command or uses its credentials and
+isn't part of the view (the op tools, the live overlay, plans, diffs, CI,
+doctor, substrates and more; the docs' terragucci page lists them), and the
+page shows no control that writes or asks for those reads. It serves one
+project directory and can't be combined with `--env`, `--poll`, `--local` or
+`--auto-sync`. It still binds 127.0.0.1, so put a
+proxy in front that forwards the public name in `Host`, and pass that name:
+
+```sh
+npx @intentius/behold serve . --public --allow-host demo.example.com \
+  --terragucci s3://acme-terragucci-reports
+```
+
+With `--terragucci`, the poll defaults to 10 seconds under `--public`
+(`--terragucci-poll` still sets it). The credentials behold runs with should
+be read-only too: `GetObject` on the reports bucket, and a read-only key for
+the repo's `origin`, which `chant/lifecycle` is fetched from.
+
+`/kiosk` follows terragucci's looping demo (#569): it reads the `demo.json`
+the demo's driver writes beside `index.json`, and narrates the scenario, the
+step and the driver's next action with a countdown, next to the newest run of
+that step (the pull request's plan, then the merge's waves) and back to the
+start when the loop resets. It needs `--terragucci`, asks only GETs, and has
+no control. The docs' terragucci page says what it shows.
+
 In a declared workspace, the gates waiting on a person come from
 `chant workspace status <env> --json`, keyed `member/op/gate` the way arugula's
 workspace block keys them, so the two show the same set. Standalone, a gate's