Prod went live 2026-06-29 on self-hosted AWS EC2 behind the shared
seahaven-com ALB, superseding the on-prem VM model the runbook described.
- Rewrite deploy/seahaven/DEPLOYMENT.md as the canonical end-to-end runbook:
infra CD (CDK stacks + OIDC roles + prod approval gate), config seeding
(put-config.sh, the 13 boot-required prod vars, fetch-config fail-fast),
app artifact deploy (S3 + SSM roll + is-active gate), promotion/rollback,
live prod facts, and a RETAIN secret-shell troubleshooting entry that
cross-references infra/README.md.
- Correct retired *.seahavenind.com hosts to *.seahaven.com throughout and
document the live GitHub/Slack/Linear webhook + OAuth endpoints.
- Add a concise Deployment section to README pointing at the runbook.
- Fix the stale host in the retired on-prem nginx/openswe.conf and mark it
superseded by the AMI template.
PR#7 of the AWS migration. deploy/seahaven/: fetch-config.sh materializes a
service-user-owned 0600 tmpfs .env from Secrets Manager + SSM (fail-fast);
seed_store.sh reseeds the in-memory store; ROTATION.md.
Incorporates T5 /sh-security-review fixes:
- seed_store no longer bash-sources the .env (closes the SH-INJ-001 RCE); uses a
non-eval reader, jq --arg JSON bodies, and a loopback-pinned BASE.
- fetch-config: .env owned by the openswe service user (app no longer runs as
root); DEFAULT_REPO_OWNER hard-pinned; key-identifier validation + flat-namespace
collision detection; dropped SSM --recursive.
shellcheck + bash -n clean.
Captures the stock-LangGraph deployment of this fork at Sea Haven:
- systemd/open-swe.service: langgraph dev (:2024) + store seed ExecStartPost
- seed_store.sh: re-seeds team_settings + user_mappings (in-memory store
resets on restart); env-parameterized, no secrets
- nginx/openswe.conf: dashboard SPA + scoped /dashboard/api proxy (security
boundary; agent API not exposed)
- aegra/: deferred self-hosted-runtime alternative (not active on stock)
- DEPLOYMENT.md: full runbook (models, build, ingress, OAuth callback)
Secrets and internal infra identifiers are intentionally excluded (public
fork); real values live in private IT docs.
