fix: harden and clean the public release

.env.example

@@ -1,17 +1,23 @@
-# Super Proxy — example environment (safe defaults, no real secrets)
+# Super Proxy example environment
+# Copy this file to .env. Never commit .env or real credentials.
 
 NODE_ENV=development
 PORT=8080
 DATABASE_PATH=./data/super-proxy.sqlite
 ADMIN_EMAIL=admin@localhost
 
-# Optional branding used by some upstreams (e.g. OpenRouter headers)
+# Required for Docker Compose and strongly recommended for every deployment.
+# Generate each value independently with: openssl rand -hex 32
+SESSION_SECRET=
+DEV_ADMIN_KEY=
+
+# Optional branding used by some upstreams (for example, OpenRouter headers).
 GATEWAY_NAME=Super Proxy
 GATEWAY_PUBLIC_URL=http://localhost:8080
 OPENROUTER_HTTP_REFERER=http://localhost:8080
 OPENROUTER_APP_TITLE=Super Proxy
 
-# Upstream base URL overrides (optional)
+# Optional upstream base URL overrides.
 ANTHROPIC_UPSTREAM_URL=https://api.anthropic.com
 OPENAI_PLATFORM_UPSTREAM_URL=https://api.openai.com/v1
 OPENAI_UPSTREAM_URL=https://chatgpt.com/backend-api
@@ -25,10 +31,10 @@ DEEPGRAM_UPSTREAM_URL=https://api.deepgram.com/v1
 FISH_UPSTREAM_URL=https://api.fish.audio
 XAI_UPSTREAM_URL=https://api.x.ai/v1
 
-# Provider credentials: configure via dashboard/admin or your SecretStore.
-# Do not put production keys in git.
+# Configure provider credentials through the dashboard/admin API or a SecretStore.
+# Do not put production keys in tracked files.
 
-# Optional features
+# Optional features.
 HEADROOM_ENABLED=false
 NORMALIZE_GLM=false
 NORMALIZE_KIMI=false

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ on:
   push:
     branches: [main]
   pull_request:
+
 jobs:
   verify:
     runs-on: ubuntu-latest
@@ -16,3 +17,27 @@ jobs:
       - run: npm run build
       - run: npm test
       - run: bash scripts/secret-scan.sh
+
+  compose-smoke:
+    runs-on: ubuntu-latest
+    env:
+      SESSION_SECRET: ci-session-secret-not-for-production
+      DEV_ADMIN_KEY: ci-dev-admin-key-not-for-production
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate Compose configuration
+        run: docker compose config --quiet
+      - name: Build and start Compose service
+        run: docker compose up --build --wait --wait-timeout 180
+      - name: Verify health, runtime user, persistence, and notices
+        run: |
+          curl --fail --silent --show-error http://127.0.0.1:8080/health
+          test "$(docker compose exec -T super-proxy id -u)" = "10001"
+          docker compose exec -T super-proxy sh -c 'test -w /app/data && test -f /app/data/super-proxy.sqlite'
+          docker compose exec -T super-proxy sh -c 'test -f /app/LICENSE && test -f /app/NOTICE'
+      - name: Show Compose logs on failure
+        if: failure()
+        run: docker compose logs --no-color
+      - name: Stop Compose service
+        if: always()
+        run: docker compose down --volumes

CODE_OF_CONDUCT.md

@@ -1,30 +1,61 @@
 # Contributor Covenant Code of Conduct
 
-## Our Pledge
+## Our pledge
 
-We pledge to make participation in Super Proxy a harassment-free experience for everyone.
+We pledge to make participation in Super Proxy a harassment-free experience
+for everyone, regardless of age, body size, visible or invisible disability,
+ethnicity, sex characteristics, gender identity and expression, level of
+experience, education, socioeconomic status, nationality, personal
+appearance, race, caste, color, religion, or sexual identity and orientation.
 
-## Our Standards
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
 
-Examples of behavior that contributes to a positive environment:
+## Our standards
 
-- Demonstrating empathy and kindness
-- Being respectful of differing opinions
-- Giving and accepting constructive feedback
-- Focusing on what is best for the community
+Examples of behavior that contributes to a positive environment include:
 
-Unacceptable behavior includes:
+- demonstrating empathy and kindness;
+- respecting differing opinions, viewpoints, and experiences;
+- giving and gracefully accepting constructive feedback;
+- accepting responsibility, apologizing, and learning from mistakes; and
+- focusing on what is best for the community.
 
-- Harassment, trolling, or insulting comments
-- Publishing others' private information
-- Other conduct which could reasonably be considered inappropriate
+Examples of unacceptable behavior include:
+
+- sexualized language or imagery, or unwelcome sexual attention;
+- trolling, insulting or derogatory comments, and personal or political attacks;
+- public or private harassment;
+- publishing another person's private information without permission; and
+- other conduct that could reasonably be considered inappropriate in a
+  professional setting.
+
+## Enforcement responsibilities
+
+Project maintainers are responsible for clarifying and enforcing these
+standards. They may remove, edit, or reject comments, commits, code, issues,
+and other contributions that do not align with this Code of Conduct.
+
+## Scope
+
+This Code of Conduct applies in project spaces and when an individual is
+publicly representing the project or its community.
 
 ## Enforcement
 
-Report incidents to the maintainers via the private security/contact channel listed in `SECURITY.md`.
+Report conduct incidents to the maintainers. When a report must remain
+private, use the repository's
+[private reporting form](https://github.com/Nextbasedev/super-proxy/security/advisories/new)
+and begin the report title with `Code of Conduct`. Do not include secrets or
+unrelated production data.
 
-Maintainers will review and respond as appropriate.
+Maintainers will protect the privacy and safety of reporters as far as
+practical, investigate promptly, and apply a proportionate response. A
+maintainer who is the subject of a report must recuse themselves from handling
+it.
 
 ## Attribution
 
-This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.
+This Code of Conduct is adapted from the
+[Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct.html),
+version 2.1.

Dockerfile

@@ -14,7 +14,7 @@ RUN npm run build
 FROM node:22-bookworm-slim AS runtime
 WORKDIR /app
 ENV NODE_ENV=production \
-    PORT=4580 \
+    PORT=8080 \
     DATABASE_PATH=/app/data/super-proxy.sqlite
 
 COPY package.json package-lock.json ./
@@ -23,23 +23,17 @@ RUN npm ci --omit=dev --no-audit --no-fund && npm cache clean --force
 COPY --from=build /app/dist ./dist
 COPY public ./public
 COPY docs ./docs
-COPY README.md ./.env.example ./
+COPY README.md LICENSE NOTICE .env.example ./
 
-# Create a dedicated non-root user+group with a FIXED uid/gid (10001:10001) to
-# match the thread-agent convention on this box. release-process requires the
-# container to run as non-root.
+# Keep the runtime unprivileged and give its fixed uid/gid ownership of the
+# persistent SQLite directory. A fresh named volume inherits this ownership.
 RUN groupadd --gid 10001 app \
-    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin app
-
-# Ensure the data dir (sqlite lives here) and app tree are owned by the runtime
-# uid:gid so migrations/server can write the DB.
-# NOTE (prod): the host bind mount at /app/data must ALSO be chown'd to
-# 10001:10001 on the host, otherwise the container cannot write its sqlite DB.
-# See docs/HARDENING.md.
-RUN mkdir -p /app/data && chown -R 10001:10001 /app/data /app
-VOLUME ["/app/data"]
-EXPOSE 4580
+    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin app \
+    && mkdir -p /app/data \
+    && chown 10001:10001 /app/data
 
+VOLUME ["/app/data"]
+EXPOSE 8080
 USER 10001:10001
 
 CMD ["sh", "-c", "node dist/db/migrate.js && node dist/server.js"]

NOTICE

@@ -2,4 +2,5 @@ Super Proxy
 Copyright 2026 Super Proxy contributors
 
 This product includes software developed by Super Proxy contributors.
-Licensed under the Apache License, Version 2.0. See LICENSE.
+Licensed under the Apache License, Version 2.0. See the LICENSE file included
+with the source distribution and container image.

OSS-SCOPE.md

@@ -1,84 +1,52 @@
-# Super Proxy — OSS Scope
+# Super Proxy project scope
 
-Working name: **super-proxy**  
-Source baseline: super-proxy `origin/main` @ `787d2dd`  
-Status: **local only** — do not create or push a public GitHub repository until Don explicitly approves.
+Super Proxy is an open-source, self-hosted AI gateway. It provides one
+operator-managed service for routing authenticated client requests to multiple
+model providers.
 
-## Wave 1 (in scope)
+## Included
 
-- Multi-provider AI gateway core
-- OpenAI-compatible and Anthropic-compatible HTTP surfaces
-- Provider adapters / pools / governor
+- OpenAI-compatible and Anthropic-compatible HTTP APIs
 - Streaming and non-streaming request paths
-- API token authentication
+- Provider adapters, account pools, and concurrency controls
+- Gateway API tokens with policy and usage identity
 - SQLite persistence and migrations
-- Usage / cost accounting and basic policy limits
-- Model catalog endpoint(s)
-- Health and metrics endpoints
-- Docker Compose self-host path
-- Operator dashboard (`public/`)
-- Fusion only if it has no private control-plane dependency
+- Usage, cost, health, metrics, and basic policy surfaces
+- Model discovery endpoints
+- Built-in operator dashboard
+- Docker and Docker Compose deployment
+- Small extension contracts for authentication, providers, secrets, and plugins
 
-## Wave 1 (out of scope)
+## Not included
 
-- Aside control plane (`aside*`)
-- OC fleet integration (`oc-fleet*`)
-- Production release-process / host-specific runbooks
-- Company emails, Firebase project IDs, internal domains, account labels
-- Private control-plane UIs only — **operator dashboard in `public/` is in scope**
-- Private git history from production repository
+The public project does not include organization-specific infrastructure,
+host inventories, deployment credentials, proprietary control planes, or
+private operational runbooks. Integrations that require those systems belong
+in separate deployments or plugins and must not be prerequisites for the
+self-hosted gateway.
 
-## Architecture contracts (wave 1)
+Super Proxy is not a hosted service and does not provide provider accounts or
+model-provider credentials. Operators remain responsible for upstream terms,
+network access, data handling, backups, and deployment security.
 
-Prefer a single-package TypeScript gateway:
+## Architecture principles
 
-```text
-src/
-  app.ts              # buildApp()
-  server.ts           # listen only
-  config/
-  core/
-  auth/
-  secrets/
-  providers/
-  routes/             # migrated from proxy/* over time
-  usage/
-  db/
-  monitoring/
-  plugins/
-```
-
-Minimum extension points (keep small and real):
+The project favors a single TypeScript service with explicit Fastify routes,
+provider modules, and SQLite persistence. Public extension points are kept
+small and implementation-driven:
 
 - `GatewayPlugin`
 - `ProviderAdapter`
 - `AuthProvider`
 - `SecretStore`
 
-Do **not** invent unused abstraction layers.
-
-## Agent ownership
-
-| Agent | Owns | Must not touch |
-|---|---|---|
-| A runtime | `src/providers/**`, `src/proxy/**`→routes, `src/normalize/**`, `src/fusion/**`, related tests | docs package metadata beyond need; auth/db ownership files |
-| B platform | `src/auth/**`, `src/db/**`, `src/admin/**`, usage/policy/cost, monitoring sanitize, config defaults | provider transport implementations; marketing docs body |
-| C oss-dx | README, ARCHITECTURE, CONTRIBUTING, LICENSE, SECURITY, .env.example, Docker polish, CI local, secret-scan, examples | runtime business logic |
-
-## Non-negotiable constraints
-
-- Local filesystem only under `projects/super-proxy*`
-- No `gh repo create`, no public visibility change, no push to GitHub
-- No secrets in tree; no real tokens in tests
-- No private markers: aside, oc-fleet, infinitycorp, Daxitdon, ampere project ids, release-process hosts
-- Preserve behavior of public gateway routes where practical
-- All commits signed if agent environment supports signing; otherwise normal commits and parent will re-sign on integrate
-- Fresh git history only (already initialized in super-proxy)
+New abstractions should solve a demonstrated integration need. Public gateway
+routes should remain backward-compatible where practical; pre-1.0 interfaces
+may still evolve with release notes and migration guidance.
 
-## Definition of done (integration)
+## Contribution boundary
 
-- `npm ci && npm run build && npm test` pass
-- Docker health smoke passes
-- Secret/internal-reference scan clean
-- Docs enable clean-machine quickstart
-- Parent reports to Don; still not public
+Contributions must not include live credentials, private customer data,
+internal hostnames, employee-only identifiers, or copied proprietary source
+history. See [`CONTRIBUTING.md`](./CONTRIBUTING.md),
+[`SECURITY.md`](./SECURITY.md), and [`LICENSE`](./LICENSE).