bg-coolify-migrate 1.0.0__tar.gz

bg_coolify_migrate-1.0.0/.gitignore

@@ -0,0 +1,83 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+
+# Distribution / packaging
+build/
+dist/
+*.egg-info/
+.eggs/
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Testing / coverage
+.pytest_cache/
+.coverage
+.coverage.*
+coverage.xml
+htmlcov/
+.hypothesis/
+.benchmarks/
+
+# Type checking / linting
+.mypy_cache/
+.ruff_cache/
+
+# Docs
+/site
+
+# IDE
+.vscode/
+.claude/
+.idea/
+
+# Secrets & local config — NEVER commit these.
+# A Coolify root token can read every secret of every project in the team.
+.env
+.env.*
+!.env.example
+!.env.template
+.pypirc
+
+# Runtime state. Migration journals contain resource UUIDs and host addresses;
+# they belong in the user state dir (platformdirs), never in the repo. This entry
+# only catches accidental --state-dir=. runs.
+/state/
+*.journal.jsonl
+
+# Integration rig: throwaway keys, generated on demand by
+# tests/integration/prepare.py. They authorise nothing but two local containers,
+# but a key in git is a key in git.
+tests/integration/keys/
+
+# ── e2e rig artefacts ───────────────────────────────────────────────────────
+# Minted per run and every one of them is a credential. The rig is reproducible
+# from prepare.py + bootstrap.py, so there is nothing here worth keeping.
+tests/e2e/keys/
+tests/e2e/rig.json
+tests/e2e/coolify.env
+tests/e2e/.probe.json
+
+# Lockfile — deliberately absent, not merely unwritten
+# ---------------------------------------------------
+# Nothing here would read it. All three CI workflows install with
+# `pip install -e ".[dev]"`, consumers get a PyPI wheel and resolve the ranges in
+# pyproject.toml themselves, and even our own setup instructions use `uv pip
+# install`, which is the pip-compatible interface and ignores a lock (only
+# `uv sync`/`uv run` consume one).
+#
+# A lock nothing consumes is worse than none: it claims a reproducibility that
+# does not exist, and it is a second source of truth beside pyproject.toml that
+# drifts in silence. Dependabot already maintains the pip ecosystem weekly from
+# pyproject; a lock would need its own update path or quietly fossilise.
+#
+# To reverse this, the lock is the small part — the work is consuming it: move
+# the workflows to `uv sync --locked`, add setup-uv, and arrange for the lock to
+# be updated. Committing a lock while CI still runs pip is the worst of both:
+# all of the cost, none of the benefit.
+uv.lock

bg_coolify_migrate-1.0.0/CHANGELOG.md

@@ -0,0 +1,3 @@
+# CHANGELOG
+
+<!-- This file is managed by python-semantic-release. Do not hand-edit below this line. -->

bg_coolify_migrate-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BAUER GROUP
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bg_coolify_migrate-1.0.0/PKG-INFO

@@ -0,0 +1,157 @@
+Metadata-Version: 2.4
+Name: bg-coolify-migrate
+Version: 1.0.0
+Summary: BAUER GROUP Coolify migration toolkit — failsafe, resumable project and instance migration with byte-exact volume mirroring
+Project-URL: Homepage, https://github.com/bauer-group/IP-CoolifyMigration
+Project-URL: Source, https://github.com/bauer-group/IP-CoolifyMigration
+Project-URL: Issues, https://github.com/bauer-group/IP-CoolifyMigration/issues
+Project-URL: Changelog, https://github.com/bauer-group/IP-CoolifyMigration/blob/main/CHANGELOG.md
+Author-email: "BAUER GROUP (Karl Bauer)" <karl.bauer@bauer-group.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: coolify,devops,docker,migration,paas,rsync,self-hosted
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: System :: Archiving :: Mirroring
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Utilities
+Requires-Python: >=3.12
+Requires-Dist: asyncssh<3.0.0,>=2.18.0
+Requires-Dist: dnspython<3.0.0,>=2.7.0
+Requires-Dist: httpx<1.0.0,>=0.28.1
+Requires-Dist: platformdirs<5.0.0,>=4.3.0
+Requires-Dist: pydantic-settings<3.0.0,>=2.14.1
+Requires-Dist: pydantic<3.0.0,>=2.10.0
+Requires-Dist: pyyaml<7.0.0,>=6.0.0
+Requires-Dist: questionary<3.0.0,>=2.0.0
+Requires-Dist: rich<16.0.0,>=13.7.0
+Requires-Dist: structlog<26.0.0,>=24.4.0
+Requires-Dist: typer<1.0.0,>=0.15.0
+Provides-Extra: dev
+Requires-Dist: build>=1.0.0; extra == 'dev'
+Requires-Dist: hypothesis<7.0.0,>=6.100.0; extra == 'dev'
+Requires-Dist: mypy>=1.13.0; extra == 'dev'
+Requires-Dist: pre-commit>=3.5.0; extra == 'dev'
+Requires-Dist: pytest-asyncio<2.0.0,>=0.24.0; extra == 'dev'
+Requires-Dist: pytest-cov<8.0.0,>=6.0.0; extra == 'dev'
+Requires-Dist: pytest<10.0.0,>=8.3.0; extra == 'dev'
+Requires-Dist: python-semantic-release>=9.0.0; extra == 'dev'
+Requires-Dist: respx<1.0.0,>=0.22.0; extra == 'dev'
+Requires-Dist: ruff>=0.7.0; extra == 'dev'
+Requires-Dist: twine>=5.0.0; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0.0; extra == 'dev'
+Provides-Extra: docs
+Requires-Dist: mkdocs-material>=9.5.0; extra == 'docs'
+Requires-Dist: mkdocs>=1.6.0; extra == 'docs'
+Requires-Dist: mkdocstrings[python]>=0.26.0; extra == 'docs'
+Description-Content-Type: text/markdown
+
+<!-- AUTO-GENERATED FILE. DO NOT EDIT. Edit docs/README.template.MD instead. Generated 2026-07-16. -->
+# BAUER GROUP - Coolify Migration Toolkit
+
+[![PyPI](https://img.shields.io/pypi/v/bg-coolify-migrate.svg)](https://pypi.org/project/bg-coolify-migrate/)
+[![Python](https://img.shields.io/pypi/pyversions/bg-coolify-migrate.svg)](https://pypi.org/project/bg-coolify-migrate/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Tests](https://github.com/bauer-group/IP-CoolifyMigration/actions/workflows/tests.yml/badge.svg)](https://github.com/bauer-group/IP-CoolifyMigration/actions/workflows/tests.yml)
+
+> **Today, Tomorrow, Together** | Building Better Software Together
+
+Moves a Coolify **project — with its data —** between servers, and relocates a
+whole Coolify instance to a new host. Failsafe, resumable, and rollback-capable.
+
+Coolify can clone a resource to another server but deliberately will not move the
+data. `VolumeCloneJob` and `CloneMe`'s `cloneVolumeData` flag exist upstream, but
+PR #4777 shipped them **disabled**. The maintainer's stated blockers — permission
+damage, job-queue spam at 50+ resources, no progress tracking, large-volume
+failures — are all consequences of running inside Coolify's Laravel queue. An
+external orchestrator has none of those constraints. That is what this is.
+
+## Repository Information
+
+- **Version:** 0.1.0
+- **Repository:** bauer-group/IP-CoolifyMigration
+- **Branch:** main
+- **Architecture:** Pure-logic cores with thin IO shells; saga engine with a
+  crash-safe journal
+
+## Features
+
+- **Application-unaware mirroring** — a cleanly stopped stack makes a volume just
+  bytes. No per-engine logic, no supported-database allowlist. Postgres, MySQL,
+  MariaDB, MongoDB, Redis, KeyDB, Dragonfly, ClickHouse and anything else you run
+  are all handled the same way, because none of them are special once stopped.
+- **Byte-exact** — `rsync -aHAXS --numeric-ids`, parallelised, with SHA-256 and
+  metadata verification on both sides. Never `chown`.
+- **Failsafe** — every step has a compensating action, journalled to disk. The
+  source is never destroyed until you explicitly say so, so rollback is always
+  available. `resume` reconciles against reality, not against the journal.
+- **DNS gate** — extracts every Traefik/Caddy hostname and refuses to start the
+  target while DNS still resolves to the old server, with an actionable cutover
+  checklist.
+- **Honest about drift** — the target is built exactly as the source is
+  configured, but a tag is a pointer and a branch moves. We detect a floating
+  `latest` that could cross a database major, or a HEAD that has moved, and put
+  the concrete question to you rather than deciding for you.
+- **Server migration** — relocate the whole Coolify instance, with the `APP_KEY`
+  treated as a first-class, asserted artifact rather than a lucky side effect.
+- **Proven, not assumed** — an integration rig of two real sshd containers
+  asserts that uid 999, hardlinks, xattrs, sparse files and symlinks survive an
+  actual rsync, and that a wrong `chown` is caught by verification.
+
+## Architecture
+
+| Layer | Role |
+| ----- | ---- |
+| `domain/` | Pure logic: classification, compose analysis, volume pairing, drift, state machine |
+| `api/` | Coolify REST client with per-endpoint request whitelists |
+| `discovery/` | Docker + API reconciliation; the label-based quiesce gate |
+| `transfer/` | asyncssh, rsync planning, checksum verification |
+| `journal/` | Append-only crash-safe state |
+| `dns/` | FQDN extraction, authoritative resolution, cutover gate |
+| `ui/` | Rich dashboard, wizard, and a plain non-TTY fallback |
+
+> **Requires the instance API switched on (Settings > API — off by default) and a
+> token with `root` or `read:sensitive`.** Without the switch every call is
+> `403 "API is disabled."`, which looks like a token problem but is not. Without
+> the scope, Coolify's `ApiSensitiveData` middleware silently omits `value`,
+> `real_value` and `docker_compose_raw` from responses — no error, no redaction
+> marker. The tool checks both at startup and fails closed.
+
+## Quick start
+
+```bash
+pip install bg-coolify-migrate
+
+export COOLIFY_URL="https://coolify.example.com"
+export COOLIFY_TOKEN="..."          # root or read:sensitive
+
+coolify-migrate doctor              # verify token scope + server reachability
+coolify-migrate plan my-project --to target-server   # dry run: no changes
+coolify-migrate run  my-project --to target-server
+```
+
+Interrupted? `coolify-migrate resume <id>`. Regret it? `coolify-migrate rollback <id>`.
+
+## Server migration
+
+```bash
+coolify-migrate server plan --to new-host.example.com
+coolify-migrate server run  --to new-host.example.com
+```
+
+## Documentation
+
+See [`docs/`](docs/): installation, configuration, cli, architecture, safety,
+server-migration, troubleshooting.
+
+## License
+
+MIT © BAUER GROUP

bg_coolify_migrate-1.0.0/README.MD

@@ -0,0 +1,101 @@
+<!-- AUTO-GENERATED FILE. DO NOT EDIT. Edit docs/README.template.MD instead. Generated 2026-07-16. -->
+# BAUER GROUP - Coolify Migration Toolkit
+
+[![PyPI](https://img.shields.io/pypi/v/bg-coolify-migrate.svg)](https://pypi.org/project/bg-coolify-migrate/)
+[![Python](https://img.shields.io/pypi/pyversions/bg-coolify-migrate.svg)](https://pypi.org/project/bg-coolify-migrate/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Tests](https://github.com/bauer-group/IP-CoolifyMigration/actions/workflows/tests.yml/badge.svg)](https://github.com/bauer-group/IP-CoolifyMigration/actions/workflows/tests.yml)
+
+> **Today, Tomorrow, Together** | Building Better Software Together
+
+Moves a Coolify **project — with its data —** between servers, and relocates a
+whole Coolify instance to a new host. Failsafe, resumable, and rollback-capable.
+
+Coolify can clone a resource to another server but deliberately will not move the
+data. `VolumeCloneJob` and `CloneMe`'s `cloneVolumeData` flag exist upstream, but
+PR #4777 shipped them **disabled**. The maintainer's stated blockers — permission
+damage, job-queue spam at 50+ resources, no progress tracking, large-volume
+failures — are all consequences of running inside Coolify's Laravel queue. An
+external orchestrator has none of those constraints. That is what this is.
+
+## Repository Information
+
+- **Version:** 0.1.0
+- **Repository:** bauer-group/IP-CoolifyMigration
+- **Branch:** main
+- **Architecture:** Pure-logic cores with thin IO shells; saga engine with a
+  crash-safe journal
+
+## Features
+
+- **Application-unaware mirroring** — a cleanly stopped stack makes a volume just
+  bytes. No per-engine logic, no supported-database allowlist. Postgres, MySQL,
+  MariaDB, MongoDB, Redis, KeyDB, Dragonfly, ClickHouse and anything else you run
+  are all handled the same way, because none of them are special once stopped.
+- **Byte-exact** — `rsync -aHAXS --numeric-ids`, parallelised, with SHA-256 and
+  metadata verification on both sides. Never `chown`.
+- **Failsafe** — every step has a compensating action, journalled to disk. The
+  source is never destroyed until you explicitly say so, so rollback is always
+  available. `resume` reconciles against reality, not against the journal.
+- **DNS gate** — extracts every Traefik/Caddy hostname and refuses to start the
+  target while DNS still resolves to the old server, with an actionable cutover
+  checklist.
+- **Honest about drift** — the target is built exactly as the source is
+  configured, but a tag is a pointer and a branch moves. We detect a floating
+  `latest` that could cross a database major, or a HEAD that has moved, and put
+  the concrete question to you rather than deciding for you.
+- **Server migration** — relocate the whole Coolify instance, with the `APP_KEY`
+  treated as a first-class, asserted artifact rather than a lucky side effect.
+- **Proven, not assumed** — an integration rig of two real sshd containers
+  asserts that uid 999, hardlinks, xattrs, sparse files and symlinks survive an
+  actual rsync, and that a wrong `chown` is caught by verification.
+
+## Architecture
+
+| Layer | Role |
+| ----- | ---- |
+| `domain/` | Pure logic: classification, compose analysis, volume pairing, drift, state machine |
+| `api/` | Coolify REST client with per-endpoint request whitelists |
+| `discovery/` | Docker + API reconciliation; the label-based quiesce gate |
+| `transfer/` | asyncssh, rsync planning, checksum verification |
+| `journal/` | Append-only crash-safe state |
+| `dns/` | FQDN extraction, authoritative resolution, cutover gate |
+| `ui/` | Rich dashboard, wizard, and a plain non-TTY fallback |
+
+> **Requires the instance API switched on (Settings > API — off by default) and a
+> token with `root` or `read:sensitive`.** Without the switch every call is
+> `403 "API is disabled."`, which looks like a token problem but is not. Without
+> the scope, Coolify's `ApiSensitiveData` middleware silently omits `value`,
+> `real_value` and `docker_compose_raw` from responses — no error, no redaction
+> marker. The tool checks both at startup and fails closed.
+
+## Quick start
+
+```bash
+pip install bg-coolify-migrate
+
+export COOLIFY_URL="https://coolify.example.com"
+export COOLIFY_TOKEN="..."          # root or read:sensitive
+
+coolify-migrate doctor              # verify token scope + server reachability
+coolify-migrate plan my-project --to target-server   # dry run: no changes
+coolify-migrate run  my-project --to target-server
+```
+
+Interrupted? `coolify-migrate resume <id>`. Regret it? `coolify-migrate rollback <id>`.
+
+## Server migration
+
+```bash
+coolify-migrate server plan --to new-host.example.com
+coolify-migrate server run  --to new-host.example.com
+```
+
+## Documentation
+
+See [`docs/`](docs/): installation, configuration, cli, architecture, safety,
+server-migration, troubleshooting.
+
+## License
+
+MIT © BAUER GROUP

bg_coolify_migrate-1.0.0/docs/README.template.MD

@@ -0,0 +1,100 @@
+# BAUER GROUP - Coolify Migration Toolkit
+
+[![PyPI](https://img.shields.io/pypi/v/bg-coolify-migrate.svg)](https://pypi.org/project/bg-coolify-migrate/)
+[![Python](https://img.shields.io/pypi/pyversions/bg-coolify-migrate.svg)](https://pypi.org/project/bg-coolify-migrate/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Tests]({{REPO_URL}}/actions/workflows/tests.yml/badge.svg)]({{REPO_URL}}/actions/workflows/tests.yml)
+
+> **Today, Tomorrow, Together** | Building Better Software Together
+
+Moves a Coolify **project — with its data —** between servers, and relocates a
+whole Coolify instance to a new host. Failsafe, resumable, and rollback-capable.
+
+Coolify can clone a resource to another server but deliberately will not move the
+data. `VolumeCloneJob` and `CloneMe`'s `cloneVolumeData` flag exist upstream, but
+PR #4777 shipped them **disabled**. The maintainer's stated blockers — permission
+damage, job-queue spam at 50+ resources, no progress tracking, large-volume
+failures — are all consequences of running inside Coolify's Laravel queue. An
+external orchestrator has none of those constraints. That is what this is.
+
+## Repository Information
+
+- **Version:** {{VERSION}}
+- **Repository:** {{REPO_FULL_NAME}}
+- **Branch:** {{CURRENT_BRANCH}}
+- **Architecture:** Pure-logic cores with thin IO shells; saga engine with a
+  crash-safe journal
+
+## Features
+
+- **Application-unaware mirroring** — a cleanly stopped stack makes a volume just
+  bytes. No per-engine logic, no supported-database allowlist. Postgres, MySQL,
+  MariaDB, MongoDB, Redis, KeyDB, Dragonfly, ClickHouse and anything else you run
+  are all handled the same way, because none of them are special once stopped.
+- **Byte-exact** — `rsync -aHAXS --numeric-ids`, parallelised, with SHA-256 and
+  metadata verification on both sides. Never `chown`.
+- **Failsafe** — every step has a compensating action, journalled to disk. The
+  source is never destroyed until you explicitly say so, so rollback is always
+  available. `resume` reconciles against reality, not against the journal.
+- **DNS gate** — extracts every Traefik/Caddy hostname and refuses to start the
+  target while DNS still resolves to the old server, with an actionable cutover
+  checklist.
+- **Honest about drift** — the target is built exactly as the source is
+  configured, but a tag is a pointer and a branch moves. We detect a floating
+  `latest` that could cross a database major, or a HEAD that has moved, and put
+  the concrete question to you rather than deciding for you.
+- **Server migration** — relocate the whole Coolify instance, with the `APP_KEY`
+  treated as a first-class, asserted artifact rather than a lucky side effect.
+- **Proven, not assumed** — an integration rig of two real sshd containers
+  asserts that uid 999, hardlinks, xattrs, sparse files and symlinks survive an
+  actual rsync, and that a wrong `chown` is caught by verification.
+
+## Architecture
+
+| Layer | Role |
+| ----- | ---- |
+| `domain/` | Pure logic: classification, compose analysis, volume pairing, drift, state machine |
+| `api/` | Coolify REST client with per-endpoint request whitelists |
+| `discovery/` | Docker + API reconciliation; the label-based quiesce gate |
+| `transfer/` | asyncssh, rsync planning, checksum verification |
+| `journal/` | Append-only crash-safe state |
+| `dns/` | FQDN extraction, authoritative resolution, cutover gate |
+| `ui/` | Rich dashboard, wizard, and a plain non-TTY fallback |
+
+> **Requires the instance API switched on (Settings > API — off by default) and a
+> token with `root` or `read:sensitive`.** Without the switch every call is
+> `403 "API is disabled."`, which looks like a token problem but is not. Without
+> the scope, Coolify's `ApiSensitiveData` middleware silently omits `value`,
+> `real_value` and `docker_compose_raw` from responses — no error, no redaction
+> marker. The tool checks both at startup and fails closed.
+
+## Quick start
+
+```bash
+pip install bg-coolify-migrate
+
+export COOLIFY_URL="https://coolify.example.com"
+export COOLIFY_TOKEN="..."          # root or read:sensitive
+
+coolify-migrate doctor              # verify token scope + server reachability
+coolify-migrate plan my-project --to target-server   # dry run: no changes
+coolify-migrate run  my-project --to target-server
+```
+
+Interrupted? `coolify-migrate resume <id>`. Regret it? `coolify-migrate rollback <id>`.
+
+## Server migration
+
+```bash
+coolify-migrate server plan --to new-host.example.com
+coolify-migrate server run  --to new-host.example.com
+```
+
+## Documentation
+
+See [`docs/`](docs/): installation, configuration, cli, architecture, safety,
+server-migration, troubleshooting.
+
+## License
+
+MIT © BAUER GROUP

bg_coolify_migrate-1.0.0/docs/SECURITY.template.MD

@@ -0,0 +1,68 @@
+# Security Policy
+
+> **{{COMPANY_NAME}}** | {{REPO_FULL_NAME}}
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+{{SUPPORTED_VERSIONS_TABLE}}
+
+## Reporting a Vulnerability
+
+Report security issues privately to **security@bauer-group.com** or via
+[GitHub Security Advisories]({{REPO_URL}}/security/advisories/new).
+
+Please do not open a public issue for a vulnerability. We aim to acknowledge
+within 2 business days and to ship a fix or mitigation within 30 days.
+
+## Threat model
+
+This tool is operated by an administrator against infrastructure they already
+control. It is not a multi-tenant service and has no privilege boundary of its
+own. That said, it handles material worth protecting:
+
+- **A Coolify API token with `root` / `read:sensitive`** can read every secret of
+  every project in the team. The tool requires such a token by design (Coolify
+  silently omits secret values otherwise), which makes the token the single most
+  sensitive input.
+- **SSH access to both servers**, effectively as root.
+- **`APP_KEY`** during instance migration, which decrypts Coolify's entire
+  credential store.
+
+## Security invariants
+
+These are enforced in code and must never be weakened. See `AGENTS.md`.
+
+1. **Never `chown`.** Ownership is preserved numerically (`--numeric-ids`).
+   Coolify's own clone hardcodes `chown -R 1000:1000` and that is precisely what
+   corrupts postgres/mysql/redis (uid 999) and clickhouse (uid 101) volumes.
+2. **Never route volume data through the operator's workstation filesystem.**
+3. **Never disable host-key checking.** No `StrictHostKeyChecking=no`.
+4. **Never write SQL to `coolify-db`.** The REST API is the only write path.
+5. **Never log secrets** — environment variable values, private keys, `APP_KEY`.
+   Redaction is a structlog processor and is applied additively.
+6. **Never start a target whose FQDN still resolves to the source.**
+7. **Never delete the source before verification passes.**
+8. **Never swallow a stop failure**, and never trust a stop endpoint — poll the
+   Docker daemon.
+9. **Never string-replace a UUID to derive a volume name.** Pair by `mount_path`.
+
+## Credential handling
+
+- Secrets are read from the environment or a `.env` file; never hardcoded, never
+  committed, never written to the journal.
+- Ephemeral SSH keys minted for a direct transfer are revoked in a guaranteed
+  cleanup step, and the revocation is journalled so a crashed run still cleans up
+  on the next invocation.
+- The journal stores resource UUIDs and host addresses. It never stores secret
+  values.
+
+## Scanning
+
+Secret scanning (gitleaks + GitGuardian) runs on every push via the
+`security-management` reusable workflow. Dependencies are monitored by Dependabot.
+
+---
+
+_Last updated: {{LAST_UPDATED}}_