Record DTD hosting verdict (C: keep local, defer deploy; Option A when remote need is concrete)

b98ec593cf92bf49beb8ed93208a20d2cfa56448 · 2026-06-26 11:34:11 -0700 · Steve

Files touched

M README.md

Diff

commit b98ec593cf92bf49beb8ed93208a20d2cfa56448
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Jun 26 11:34:11 2026 -0700

    Record DTD hosting verdict (C: keep local, defer deploy; Option A when remote need is concrete)
---
 README.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/README.md b/README.md
index 5cf60bc..eb9cef1 100644
--- a/README.md
+++ b/README.md
@@ -63,3 +63,20 @@ $0); 519 lack a room shot (full Gemini run ≈ **$1.56**).
 
 `.deploy.conf` targets pm2 `quadrille-showroom` on Kamatera `:7690`. Deploy is
 Steve-gated (`/deploy`).
+
+## Hosting decision — DTD verdict (2026-06-26)
+
+Run through `/officer-yolo` (panel decides · vp-dw-commerce owns · gates hold).
+
+**Verdict: C — keep LOCAL on Mac2 `:7690` for now. Do not deploy / no DNS change.**
+Vote 2–1 (Codex C, Qwen C, Claude A-dissent). Rationale: it's a basic-auth-gated
+internal/sales tool, not a public storefront — no confirmed remote-access need yet,
+and a new always-on Kamatera service adds pm2-fleet fragility + attack surface for no
+gain. **Escalation rule:** when remote sharing becomes concrete, deploy via **Option A**
+— Cloudflare-proxied `quadrille-showroom.designerwallcoverings.com` behind basic-auth
+(origin IP hidden, CF absorbs scans, basic-auth = 2nd gate). **Never Option B** (raw
+`IP:7690` open port — exposes the Node origin, violates Cloudflare-first + minimize-
+attack-surface). That deploy is a GATED action (DNS + Kamatera) — draft to
+`pending-approval/` for Steve when the need arises; never auto-run.
+
+Run locally: `node server.js` → http://127.0.0.1:7690 (admin / DWSecure2024!).

← 6ae51b8 Image-model pipeline: $0 local seamless tiles + Gemini room · back to Quadrille Showroom · Wall-cladding: focused/perused wing renders its pattern onto 98df95d →