From 344b41afc80e520f4c4055febaf70dfd57cc51c4 Mon Sep 17 00:00:00 2001
From: SkateSpots <skatespots>
Date: Fri, 30 Oct 2026 18:47:43 +0700
Subject: [PATCH] docs: record 1.7.55 operator dashboard and TLS hardening

---
 AGENTS.md | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 4587416..916af5b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2228,7 +2228,7 @@ session with **no other memory of this project**. So:
   instead of showing the error boundary.
 - **Baselines** (verified 2026-10-29): `npm test` → **0 errors, 0 warnings**,
   **156 tests**, build ok. The gate also type-checks the CVM server
-  (`tsc -p cvm-server/tsconfig.json`). `package.json` version **1.7.54**.
+  (`tsc -p cvm-server/tsconfig.json`). `package.json` version **1.7.55**.
   - ✅ Lint is **clean**: `no-explicit-any` = 0 · `react-hooks/exhaustive-deps` = 0
     · `no-unused-vars` = 0 · `react-refresh` = 0. Non-component exports were
     **split into their own modules** (`contexts/language.ts`, `lib/sortOptions.ts`,
@@ -2771,6 +2771,11 @@ Rules:
       hourly backstop, 20 GB relay cap), app-side image/type/size guard and clear
       errors; uploads use only our Blossom (mirrors are read-only fallbacks).
       APK sha256 `f554d934…`, versionCode 10754. Web live at `465683c`.
+    - **1.7.55 (2026-10-30):** private read-only `/ops` status page for the two
+      relay admins, NIP-98-signed status endpoint fed by the host health timer;
+      admin link in Settings → Advanced. Added HSTS to relay/blossom and CAA
+      records limiting their certificates to Let’s Encrypt. APK sha256
+      `1142c425…`, versionCode 10755. Web live at `52a8447`.
 
 ### Relay archive (dataset backup)
 - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**
@@ -3136,6 +3141,13 @@ The community relay moved off the hosted relay.tools instance
   service, and >18 GiB media. App uploads now use **only** our Blossom; public
   mirrors are read-side fallbacks only, so a quota rejection cannot silently
   land on a third party. No video upload support was added.
+  **2026-10-30 — transport/ops hardening:** HSTS is set on `relay.` and
+  `blossom.` (`max-age=31536000; includeSubDomains`); CAA records restrict
+  issuance for those two hosts to `letsencrypt.org`. The health timer writes an
+  aggregate `/home/ubuntu/skatespots-quota/status.json`; the quota proxy serves
+  it at `https://relay.skate-spots.org/ops` only for a NIP-98-signed request
+  from one of the two admin pubkeys. `/ops` is a read-only app page linked from
+  Settings → Advanced (AdminReviewCard). No restart/config actions are exposed.
 - **Cordn coordinator (2026-10-12):** the relay also runs Newlay's **embedded Cordn
   coordinator** for crew MLS chat (`[cordn] enabled`, `mode = "embedded"`,
   `data_dir = /var/lib/newlay/data/cordn` inside the volume, `relay_url =