Files

T

wmj e87e329731 docs: resolve both governance gates (OPEN-01, Horizon 2 Phase 0)

OPEN-01 (scholarly-review-log.md): ruled NOT subject to the one-third
cap for an inter-vivos waqf made in health. The existing
FamilyWaqfDesignator logic already applied no health-state cap absent a
marad al-mawt trigger, so no behavior change — only the open-question
framing in the exported deed, InfoPanel copy, on-screen note, and source
comments moved from "open" to "resolved."

Horizon 2 Phase 0 (legal opinion + signed institutional partner
agreement): both now signed. This clears the PRD's gate to begin real
institutional-integration engineering, but that integration hasn't been
built yet — the Claims module (DigitalClaims.svelte, claims.js) still
ships as a local, non-custodial demonstration only, and the pilot banner
is updated to say so precisely rather than implying the module itself
is now production-ready.

Updated README.md and deploy/DEPLOY.md to match.

2026-10-23 10:40:26 +08:00

2.8 KiB

Raw Blame History

Nur Falah — Estate & Waqf Suite · Deployment Guide

Target: moslem04.falahos.my Stack: Svelte 5 + Vite PWA (static SPA), same pattern as moslem03.falahos.my Server: Docker Swarm (nginx:alpine) on the Contabo VPS, Traefik + Let's Encrypt

1. Build & push image

docker build -t git.falahos.my/wmj/nur-falah-prevention:latest .
docker push git.falahos.my/wmj/nur-falah-prevention:latest

2. Deploy to the swarm

docker stack deploy -c deploy/docker-stack.yml nur-falah-prevention

Traefik picks up the labels in deploy/docker-stack.yml and routes moslem04.falahos.my to the service automatically, issuing a Let's Encrypt certificate on first request.

3. DNS

Point moslem04.falahos.my at the same VPS IP already serving moslem03.falahos.my (A/AAAA record, or CNAME if using a CDN in front).

4. Verify

curl -sI https://moslem04.falahos.my/ | grep -i "cache-control"
# index.html: cache-control: no-cache, must-revalidate

curl -sI https://moslem04.falahos.my/sw.js | grep -i "cache-control"
# sw.js: cache-control: no-cache, no-store, must-revalidate

https://moslem04.falahos.my/ returns 200
Service worker activates (DevTools → Application → Service Workers)
App installs as PWA
All 6 modules load without console errors: Faraid, Assets, Wassiyah, Hibah, Family Waqf, Claims (H2)

5. Rollback

docker service update --rollback nur-falah-prevention_web

Known gaps before this is production-grade (not blocking this deploy, tracked for follow-up)

Encryption at rest: storage.js currently uses plain localStorage. Horizon 1 PRD §10 requires encrypted-at-rest for Asset Registry / wassiyah / hibah / waqf drafts. WebCrypto AES-GCM wrapping is the next hardening step.
PDF export: current export is plain-text download + browser print dialog, not a dedicated PDF pipeline. PRD §11 calls for "a single, reusable document-generation pipeline (PDF and plain text)" — plain text ships now, a real PDF renderer is a follow-up.
Horizon 2 PRD's Phase 0 gate (legal opinion + signed institutional partner agreement) is now resolved — both are signed. This clears PRD §Phase-0 to begin real institutional-integration engineering. The claims module itself remains a local, non-custodial demo — see the in-app banner and src/lib/horizon2/claims.js — since no institutional integration has actually been built yet. Do not represent this screen to any real user as a live programme until that integration ships.
Family Waqf Designator — scholarly-review-log.md OPEN-01 is resolved: ruled NOT subject to the one-third cap. Matches the module's existing implementation (no health-state cap absent a marad al-mawt trigger); only documentation/in-app copy updated, no logic change required.

2.8 KiB Raw Blame History