# Production physical deployment contract

This project installs the Go Agent and single-active Dispatcher as ordinary
Debian 13 systemd services. The production path is not a Docker Compose stack.

- Version and host pins: `versions.lock.json`.
- Uploadable package: `packages/` after `build-package.sh`.
- Service units: `systemd/`.
- Safe configuration templates: `env/` and `config/`.
- Secrets/PKI/static Cell artifacts: injected by deployment, never packaged.
- Asterisk 22.10.1: separate approved physical Cell installation; this project
  does not rewrite or containerize it.

The package installer deliberately refuses dirty or non-approved manifests for
production. `--allow-nonproduction` exists only for an explicitly labelled
smoke installation and does not change the manifest or claim P1 acceptance.