go-sip/deploys/physical-deployment.md

Production physical deployment contract

This project installs the Go Agent and single-active Dispatcher as ordinary Debian 13 systemd services. The production path is not a Docker Compose stack.

• Version and host pins: versions.lock.json.
• Uploadable package: packages/ after build-package.sh.
• Service units: systemd/.
• Safe configuration templates: env/ and config/.
• Secrets/PKI/static Cell artifacts: injected by deployment, never packaged.
• Asterisk 22.10.1: separate approved physical Cell installation; this project does not rewrite or containerize it.

The package installer deliberately refuses dirty or non-approved manifests for production. --allow-nonproduction exists only for an explicitly labelled smoke installation and does not change the manifest or claim P1 acceptance.