docs: promote no-debug-API principle; make monitoring ports configurable

Bench and flight share one query channel, so debugging exercises the production path daily. Grafana/Prometheus/exporter host ports become env-overridable for shared hosts.
2026-07-08 13:36:29 +01:00
parent 523e15f490
commit e45a34e086
3 changed files with 5 additions and 3 deletions
@@ -15,6 +15,7 @@ This repository describes how to build, deliver, test, and operate that platform
 5. **Zero trust, provisioned ahead.** Keys are issued per device before deployment; nothing joins the swarm at runtime. Dev channels are physically absent from production builds.
 6. **The whole fleet has one version.** A release manifest pins every image digest, model weight, schema, and config. Rollback is atomic.
 7. **SQL is the contract.** Peer data access is read-only DuckDB SQL over SSH forced commands — the query language already lives on both ends, so no service, port, or protocol is invented for it.
+8. **No debug API.** The bench and the flight use the same channel: an engineer debugging on the ground runs the identical query through the identical wrapper, permissions, and output format a peer drone would use. What you test is what flies.

 ## Documentation