[Innei]

Summary

Document mandatory encryption and configuration migration in the unreleased v18 branch, with published v17.0.4 guidance explicitly versioned.

• Put check and short-JWT maintenance before runtime startup.
• Explain source development startup without a configured field key: generate and atomically persist tmp/dev-encryption.key with mode 0600, reuse it across restarts/workers and prefer explicit keys. Preserve the local key with the development database. Production builds remain strict even under NODE_ENV=development; standalone diagnostics and database promotion need the original effective key explicitly.
• Mark removal of ENCRYPT_ALGORITHM, CLI --encrypt_algorithm and YAML encrypt_algorithm as breaking: old values are rejected, field writes are fixed to AES-256-GCM, and historical reads use the default AES-256-ECB only. Custom legacy algorithms must be converted on the prior version with the original key/algorithm before upgrading.
• Require stopping old writers before migrate.mjs; explain mandatory configuration, credential and AI-metric migrations and the configuration startup ledger guard.
• Remove independent prepare/dry-run instructions and preparation markers. Use migrate followed by read-only check; the new v18 credential migration also runs after a recorded historical opt-in backfill. Update historical restore guidance and the public agent reference.
• Map retired GitHub/Dodo/image/TTS/nested SMTP fields to the canonical configuration, explain transaction rollback and conflict resolution before the new runtime starts.
• Document removal of runtime conversion and old config sections, strict declared fields, retained partial updates/blank-secret behavior and opaque freeform records.
• Explain the matching SDK major-version type contract without inventing published tool/client tags.
• Preserve original-secret/backup recovery requirements, historical migration guides and the quoted Compose mapping/copy fixes.

Companion implementation: mx-space/core#2914

Validation

• 3 configuration-generation tests, including literal dollar-sign preservation through a temporary Compose container.
• Build, Astro check, link check, pangu and ESLint.
• Generated llms content includes mandatory release migration, no separate preparation marker, maintenance cutover, current-only configuration rules, the removed algorithm option/custom-algorithm upgrade requirements, and the development-key lifecycle/production boundary.

One existing Astro hint and one classified dead link remain. No site deployment or release performed.

[safedep]

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
yaml @ 2.9.1 pnpm-lock.yaml				🔗

View complete scan results →

_{This report is generated by SafeDep GitHub App}

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T14:34:21.695090Z	0719e79	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0719e79659

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the upgrade procedure to account for pinned image tags

For installations following this new version-pinning instruction, the Docker update procedure in content/docs/use/update.mdx:16–22 no longer upgrades Core: it only runs docker compose pull && docker compose up -d, leaving both services pinned to 17.0.4. Docker documents that pull fetches the image “associated with a service defined in a compose.yaml file,” not a newer release tag (command reference). Keep the explicit pins, but update the upgrade guide to require selecting a target release and changing both app and mx-migrate tags before pulling; otherwise users following the documented update flow remain on the old release.

Useful? React with 👍 / 👎.