port: from the old factory (tea-mcp/src), as it was, 2026-10-14

README.md

@@ -0,0 +1,42 @@
+# Phast runtime
+
+This directory is the canonical source for the existing `phast-app` Fly app,
+serving `phast.app` and `my.phast.app`. It remains one Python/FastMCP runtime.
+
+## App convention
+
+`phast.json` is the minimal Prephab manifest. Schema version 1 requires a
+stable slug and name, an HTTPS origin, Python as the runtime, `/` as the default
+human route, `/mcp` as the default MCP route, and Prephab shape version 1.
+Registry tools return this same shape.
+
+`my.phast.app` renders its human surface with the installed Prefab UI package.
+Its MCP exposes `apps_list`, `apps_get`, `apps_create`, and `apps_update`, plus
+bounded status and Prefab-app tools. There is intentionally no delete.
+
+## Production blockers
+
+The current Fly app has no volume and Phast has no accepted owner-auth pattern.
+The registry therefore refuses to treat the image filesystem as durable, and
+create/update always fail before writing. Do not deploy this as an enabled
+control plane until both seams are closed:
+
+1. create and attach one Fly volume at `/data`, then set
+   `PHAST_DATA_DIR=/data`; the runtime verifies that the directory is a mount;
+2. reuse an accepted FastMCP owner identity provider and replace the explicit
+   mutation guard with caller identity/authorization checks.
+
+Do not substitute a shared secret in the UI or an environment flag for owner
+authentication. Once both prerequisites exist, exercise list/get/create/update
+through `my.phast.app/mcp`, verify persistence across a Machine replacement,
+then deploy through the existing Phast launch path.
+
+## Local validation
+
+Run `python -m unittest tests.test_phast`. Tests use a temporary SQLite file;
+they do not weaken the production mount or authentication guards.
+
+## On Teahub prod (2026-10-14)
+Ported from the old factory (`tea-mcp/src/phast`, plus `phastacp` as `acp/`) as it was. Phast is a client of Teahub:
+this org owns the code, the site (`phast/site`) and phast.app. The Fly app named in `fly.toml` (`phast-app`) does not
+exist yet; the production blockers above still stand (volume at /data, owner auth via Gitea OAuth).