port: from the old factory (tea-mcp/src/persimmons + human_vault), as it was, 2026-10-14

README.md

@@ -0,0 +1,16 @@
+# Persimmons — app
+
+Ported from the old factory (`tea-mcp/src/persimmons` + `tea_mcp/human_vault.py`, vendored) on 2026-10-14, as it was.
+Persimmons is a client of Teahub: this org owns its code, its site (`persimmons/site`) and its domain, persimmons.app.
+
+## What it is
+A Starlette host for vaults backed by Gitea repos, with "juice" (per-vault secrets and variables) and a human vault
+(human_vault.py) that the browser extension (`persimmons/extension`) talks to.
+
+## Seam before it can run on prod
+It signs people in with a Gitea username + password (`gitea.authenticate`). Teahub prod has no passwords — login is
+GitHub (nostr next). So sign-in must move to Gitea OAuth (the Green Tea MCP already does this with FastMCP's
+OAuthProxy; reuse that shape) before this app is deployed against `https://teahub.xyz`. Until then persimmons.app
+serves a holding page from `persimmons/site`.
+
+Env: `PERSIMMONS_GITEA_ORIGIN` (default https://teahub.xyz), `PERSIMMONS_DATA` (/data), `PERSIMMONS_HUMAN_VAULT_DB`.