# TeXise R14.28.14 service audit

Date: 2026-08-20

This audit records the disposition of the production services around the consolidated `www.texise.com` deployment. Uploaded daemon source was inspected where available. Migration remains non-destructive: old units/source trees are preserved as rollback material even when a service is no longer active.

## `texise-console-gateway.service` — ACTIVE: Linux Terminal · Pro

The supplied Console Gateway source was incorporated under `texise-services/console-gateway/` and hardened as a first-class Pro service. It is no longer a retirement candidate.

The trusted `texise.service` owns account authentication and server-authoritative Pro entitlement. Browsers create sessions and transfer/list/download files only through `/api/terminal/...`; the private gateway secret never reaches browser JavaScript. The API issues a short-lived websocket credential and the browser supplies it through `Sec-WebSocket-Protocol`, not the request URL, so Apache access logs do not receive a bearer token. Gateway tokens are one-time and session-bound.

Each session launches an isolated Docker terminal from the dedicated `TEXISE_CONSOLE_IMAGE`, defaulting to `texlive/texlive-console:pro`. The container runs non-root, drops all capabilities, applies CPU/memory/PID limits and `no-new-privileges`, receives only its session workspace, and never receives the Docker socket or `/etc/texise`. `host` networking is refused. Normal Docker bridge egress is retained for GitHub/Python/scientific workflows; host/internal service exposure must remain protected by loopback service binds and the production host firewall.

Project transfer is explicit. A Linux Terminal session starts empty; **Send project** copies browser-selected project files into that temporary server workspace. File downloads are brokered through the authenticated trusted API. Real-path confinement rejects symlink escapes, aggregate workspace/file quotas are enforced while commands run, and expired/ended sessions remove their Docker container and workspace.

The systemd service runs as dedicated `texise-console` with Docker supplemental-group access. It is installed/enabled/restarted and production-certified during deployment.

## `texise-latex-compile.service` — ACTIVE: Cloud Compile · Pro

The supplied compiler source is shipped under `texise-services/cloud-compile/` and uses the independent `TEXISE_CLOUD_COMPILE_IMAGE`, defaulting to `texlive/texlive:latest`. Its runtime policy is intentionally stricter: non-interactive Docker execution, `--network none`, no shell escape, read-only input, isolated output, dropped capabilities, non-root container UID, CPU/memory/PID/time/input/output/concurrency limits, cancellation and abandoned-job cleanup.

The trusted API exposes `/api/compile/cloud` only after server-authoritative Pro entitlement/quota checks. Worker traffic stays loopback and is authenticated with a private shared secret. The service now runs as dedicated `texise-compile`; Apache/PHP `www-data` is not granted Docker authority.

## `texise-collab.service` — LEGACY ROLLBACK

The supplied `node-collab-server` is a Hocuspocus/Yjs daemon whose persistence/auth flow calls the historical Laravel `/api/v1` backend. Current TeXise collaboration instead uses browser Yjs with the same-origin `/collab-live` transient document/awareness relay from `texise.service`; `/collab-signal` is compatibility-only for older y-webrtc clients. No current browser consumer of `/collab-ws` remains.

Disposition: disable only after the modern API/frontend/collaboration/Cloud Compile/Linux Terminal health checks pass. Preserve the old unit/source for rollback.

## `texise-reverb.service` — LEGACY ROLLBACK

The production unit runs Laravel Reverb on localhost port 8080. The authoritative modern source contains no Laravel `artisan` application and no current Echo/Reverb/Pusher consumer of `/app/*` or `/apps/*`.

Disposition: remove those routes from the canonical Apache surface and disable Reverb only after successful modern health checks. Preserve the unit and old Laravel tree for rollback.

## Final service topology

Active after successful R14.28.14 activation:

- `texise.service` — trusted API, accounts/CMS/licensing/AI and current collaboration signaling.
- `texise-latex-compile.service` — private Docker-isolated Cloud Compile · Pro worker.
- `texise-console-gateway.service` — authenticated Docker-isolated Linux Terminal · Pro gateway.

Legacy rollback units disabled after successful activation:

- `texise-collab.service`
- `texise-reverb.service`