oficina / memoria Public

docs: memoria is live at memoria.bds.oncarlos.com

Deployed to bds/edge as 71bebef. Platform email enabled, so sign-in links
are mailed rather than logged — which the app now refuses to boot without.

memoria.oficina.works is attached to the same route but was pending-dns
with no cert at the time of writing, so MEMORIA_ORIGIN stays on the
oncarlos host: that value is the CSRF yardstick, the cookie scope and
keymail's client_id, and it has to match the host the browser is on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SiWVaR69Vb2Lzc9wgfit1v

Paul Campbell pushed by paul@keymail.dev 1 month ago 617eb2a4a1772ce84b1b087d1e89d4001b9916d0 parent 71bebef

1 file changed, +22 −0

README.md +22 −0

diff --git a/README.md b/README.md

index cac1cb8..129b2ca 100644

--- a/README.md

+++ b/README.md

@@ -27,6 +27,28 @@ assistant on sends **every document in the corpus** to a named provider

once, at indexing time — not just the passages behind an answer. See

§3.2 and §3.6 of the design.

+## Live

+**https://memoria.bds.oncarlos.com** — account `bds`, channel `edge`,

+serving `71bebef`. Sign in with `paul@keymail.dev`, `paul@rslw.com` or

+`paul@tito.io`; real email goes out through the platform's SES, so no

+sign-in link is ever written to a log.

+It starts **empty**. Paste or upload on the front page to fill it — the

+seed tool needs filesystem access to the database, so it only works

+against a local instance.

+`memoria.oficina.works` is attached to the same route but was still

+`pending-dns` with no certificate when this was written, so the origin

+stays on `oncarlos.com`. Switching it later means changing

+`MEMORIA_ORIGIN` and restarting: that value is the CSRF yardstick, the

+cookie scope, and keymail's `client_id`, so it must match the host the

+browser is actually on.

+**The DEK is the whole corpus.** It lives in `carlos secrets` for this

+app, and a copy is at `memoriadrive/DEK-production.txt`. Lose both and the

+data is unreadable — exactly as with `SHEETS_DEK`.

## Trying it locally

```