# docs
Documentation
Nineteen documents in six groups, generated from the repository at v1.9.1. Start with the Quickstart.
# start
# quickstartQuickstartFrom
npm install rayspec to a reference application deployed from its bundle, in about ten commands and with no build of RaySpec.# getting-startedGetting startedFrom a fresh clone to a running RaySpec backend and a real authenticated request, building RaySpec from source.# conceptsConceptsThe mental model: the spec and its two profiles, stores, routes, agents, tools, triggers, capabilities, the run journal, tenancy.# build
# spec-referenceSpec referenceEvery section of the two document profiles, field by field.# cli-referenceCLI referenceEvery
rayspec command with its flags, output and exit codes, and rayspec-serve, the boot server.# v1-postureThe v1 postureThe closed capability, operation and trigger sets a product document may declare, and what v1 does not do yet.# architectureArchitectureHow one spec becomes a running, tenant-isolated backend: the layers, the three structural guarantees, the security model, runtime control.# ship
# packingPacking an applicationWhat
rayspec pack puts in a .ray bundle, what never goes in, how to fix each refusal, and how to sign a bundle.# self-hosted-deploymentDeploying a bundle on your own serverOne bundle from inspection to a served, updated and recovered deployment: inspect, bind, review, apply, readiness, update, recovery.# operate
# runtime-operationsRuntime operationsWhat the runtime records when it changes an environment, how apply, quiesce and resume fit together, and recovery from an interrupted operation.# exportExporting a deploymentMoving a self-hosted deployment out as one encrypted migration bundle: the downtime, what it carries, what the target resets, recovery.# importImporting a deploymentRestoring a migration bundle into a new, empty target: preparing it, the dry run, the cutover token, the recovery window.# runtime-imageThe runtime imageThe linux/amd64 runtime image definition: what it holds, how to run a bundle deploy in it, the host settings, how it is built.# upgrading-to-1-9Upgrading to 1.9From 1.8.x: what changes without opting in, the migrations that run, turning on the hardened posture, the new commands, going back.
# security
# hardened-postureHosting in the hardened postureRole separation, single-tenant mode and the managed posture: turning it on, checking it, certifying it, and what it does not protect against.# database-isolationDatabase roles and row-level securityThe three database roles, forced row-level security under the tenant chokepoint, how to turn it on and what it does not do.# threat-modelThreat modelBoundaries, adversaries, what the runtime enforces, what the host must enforce, and every residual risk this release accepts.# security-policySecurity policyHow to report a vulnerability privately (security@rayspec.dev), and the security model: what is built in, what is opt-in, what is not in the core.