--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit 627b6efc4228ec75399c51f0cf1466c388da2366
Parents : 7731ff9
Author : Ivan <ivan@quad4.io>
Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>
Date : 2026-07-12T17:31:33-05:00
docs(installation): update docs
Changes
9 files changed, 89 insertions(+), 14 deletions(-)
Diff
diff --git a/docs/agents/overview.md b/docs/agents/overview.md
index d0266d8e..5130a4a6 100644
--- a/docs/agents/overview.md
+++ b/docs/agents/overview.md
@@ -109,6 +109,13 @@ task run
task dev
```
+Optional RNS/rngit tooling (requires mesh reachability, can sometimes be significantly slower than PyPI):
+
+```bash
+task deps:backend:rns
+task docs:rns
+```
+
Useful focused commands:
```bash
diff --git a/docs/en/identity-and-security.md b/docs/en/identity-and-security.md
index 97edef09..7463ab7f 100644
--- a/docs/en/identity-and-security.md
+++ b/docs/en/identity-and-security.md
@@ -86,7 +86,7 @@ Policy:
- Unsigned packages are allowed
- Present but invalid signatures hard-block install
- Valid signers can be added to a user trusted-publishers list (ignored if the list file is tampered outside MeshChatX)
-- Installed plugin trees get an integrity hash; on-disk changes disable the plugin as tampered
+- Installed plugin trees get an integrity hash, on-disk changes disable the plugin as tampered
Sideband Python plugins are opt-in via a master danger switch. They are not ZIP-permission gated. Optional per-file `.py.rsg` signatures are verified over script bytes.
diff --git a/docs/en/installation.md b/docs/en/installation.md
index 0204cf0e..5c422c7c 100644
--- a/docs/en/installation.md
+++ b/docs/en/installation.md
@@ -126,13 +126,47 @@ CLI flags override environment variables when both are set.
## Reticulum manual bundle
-The Reticulum HTML manual is fetched from the upstream website **master** branch at build time. There is no in-app clearnet refresh. After cloning the repository, or before packaging a release, run:
+The Reticulum HTML manual is fetched from the upstream website **master** branch at build time by default (clearnet ZIP). There is no in-app clearnet refresh. After cloning the repository, or before packaging a release, run:
```bash
pnpm run build-docs
```
-That command always re-fetches (`--force`) into `meshchatx/public/reticulum-docs-bundled/current/`. CI release builds run the same step. Without a bundled copy the Reticulum tab may show an upload prompt until you build docs or upload a manual ZIP offline.
+CI release builds use the clearnet path. Without a bundled copy the Reticulum tab may show an upload prompt until you build docs or upload a manual ZIP offline.
+
+## Advanced: Optional RNS-only installation (pip-rns)
+
+MeshChatX includes optional tooling to pull `rns`, `lxmf`, `lxst`, and the Reticulum manual from markqvist's rngit remotes over the mesh instead of clearnet.
+
+**Note:** Installing Python packages over RNS is significantly slower than PyPI and is intended for use in environments with mesh access but restricted clearnet. PyPI remains the default and recommended path for CI and standard development.
+
+| Remote | Purpose |
+| ------------------------------------------------------------ | --------------------- |
+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum` | RNS package |
+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/lxmf` | LXMF package |
+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/lxst` | LXST package |
+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/website` | Manual / website HTML |
+
+This uses [pip-rns](https://github.com/Quad4-Software/pip-rns) for the Python packages and `git` + `git-remote-rns` for the docs tree. Default aliases live in `scripts/pip-rns/aliases`.
+
+**Bootstrap note:** pip-rns needs a working Reticulum stack to reach the remotes. Install `rns` once from PyPI, a wheel, or an existing environment, then use the mesh path for updates.
+
+```bash
+# Optional: Install/update rns, lxmf, lxst into the uv environment over RNS
+task deps:backend:rns
+
+# Optional: Bundle the Reticulum manual from the rngit website remote
+task docs:rns
+```
+
+Equivalent direct commands:
+
+```bash
+bash scripts/pip-rns-deps.sh
+python scripts/build/fetch_reticulum_manual.py --force --via-rns
+```
+
+Set `PIP_RNS_CONFIG` to point at another aliases directory if needed. `MESHCHATX_RETICULUM_DOCS_URL=rns://...` also works for a custom website remote.
## Identity bootstrap
diff --git a/docs/en/platform-guides/linux-sandbox.md b/docs/en/platform-guides/linux-sandbox.md
index 812f691b..b8f777e0 100644
--- a/docs/en/platform-guides/linux-sandbox.md
+++ b/docs/en/platform-guides/linux-sandbox.md
@@ -4,14 +4,14 @@ This page shows how to run **`meshchatx`** under **Firejail** or **Bubblewrap**
These tools do **not** replace a full virtual machine or hardware-enforced boundary. They reduce exposure of your home directory and other paths the process can write to, when you configure them with tight whitelists or bind mounts.
-**Containers:** If you already run MeshChatX with Docker or Podman, that is a different isolation model; this document is aimed at **host-installed** `meshchatx` (or `meshchat`).
+**Containers:** If you already run MeshChatX with Docker or Podman, that is a different isolation model, this document is aimed at **host-installed** `meshchatx` (or `meshchat`).
## Prerequisites
Install one or both from your distribution:
- **Firejail:** package name is usually `firejail`.
-- **Bubblewrap:** package name is usually `bubblewrap`; the binary is `bwrap`.
+- **Bubblewrap:** package name is usually `bubblewrap`, the binary is `bwrap`.
You need a working **`meshchatx`** on your `PATH` (for example after `pipx install`, `pip install --user`, or a distro package). The **`meshchat`** command is the same binary if both entry points are installed.
@@ -113,7 +113,7 @@ exec bwrap \
Notes:
-- If `meshchatx` lives only inside a venv that is **not** under `$DATA`, the read-only root still allows **reading** that path; you do not have to bind-mount the venv separately unless you also need writes there.
+- If `meshchatx` lives only inside a venv that is **not** under `$DATA`, the read-only root still allows **reading** that path, you do not have to bind-mount the venv separately unless you also need writes there.
- Distributions that merge `/` and `/usr` (merged-usr) still work with `--ro-bind / /` on typical glibc setups. If `bwrap` fails with missing library paths, add the extra `--ro-bind` lines your distro documents (for example `/lib64`).
### From source with UV
diff --git a/docs/en/platform-guides/quest-sidequest.md b/docs/en/platform-guides/quest-sidequest.md
index 7d7bb7d5..db7264a7 100644
--- a/docs/en/platform-guides/quest-sidequest.md
+++ b/docs/en/platform-guides/quest-sidequest.md
@@ -15,7 +15,7 @@ MeshChatX opens as a **2D panel** inside your VR environment. It is not a native
Download the latest signed Android APK from the [MeshChatX releases page](https://github.com/Quad4-Software/MeshChatX/releases). Release assets are named like `meshchatx-*-release-signed.apk`.
-You can also build the APK yourself; see [`android/README.md`](../android/README.md).
+You can also build the APK yourself, see [`android/README.md`](../android/README.md).
## Enable Developer Mode
diff --git a/meshchatx/src/frontend/public/meshchatx-docs/en/identity-and-security.md b/meshchatx/src/frontend/public/meshchatx-docs/en/identity-and-security.md
index 97edef09..7463ab7f 100644
--- a/meshchatx/src/frontend/public/meshchatx-docs/en/identity-and-security.md
+++ b/meshchatx/src/frontend/public/meshchatx-docs/en/identity-and-security.md
@@ -86,7 +86,7 @@ Policy:
- Unsigned packages are allowed
- Present but invalid signatures hard-block install
- Valid signers can be added to a user trusted-publishers list (ignored if the list file is tampered outside MeshChatX)
-- Installed plugin trees get an integrity hash; on-disk changes disable the plugin as tampered
+- Installed plugin trees get an integrity hash, on-disk changes disable the plugin as tampered
Sideband Python plugins are opt-in via a master danger switch. They are not ZIP-permission gated. Optional per-file `.py.rsg` signatures are verified over script bytes.
diff --git a/meshchatx/src/frontend/public/meshchatx-docs/en/installation.md b/meshchatx/src/frontend/public/meshchatx-docs/en/installation.md
index 0204cf0e..38baa1f5 100644
--- a/meshchatx/src/frontend/public/meshchatx-docs/en/installation.md
+++ b/meshchatx/src/frontend/public/meshchatx-docs/en/installation.md
@@ -126,13 +126,47 @@ CLI flags override environment variables when both are set.
## Reticulum manual bundle
-The Reticulum HTML manual is fetched from the upstream website **master** branch at build time. There is no in-app clearnet refresh. After cloning the repository, or before packaging a release, run:
+The Reticulum HTML manual is fetched from the upstream website **master** branch at build time by default (clearnet ZIP). There is no in-app clearnet refresh. After cloning the repository, or before packaging a release, run:
```bash
pnpm run build-docs
```
-That command always re-fetches (`--force`) into `meshchatx/public/reticulum-docs-bundled/current/`. CI release builds run the same step. Without a bundled copy the Reticulum tab may show an upload prompt until you build docs or upload a manual ZIP offline.
+CI release builds use the clearnet path. Without a bundled copy the Reticulum tab may show an upload prompt until you build docs or upload a manual ZIP offline.
+
+## Advanced: Optional RNS-only installation (pip-rns)
+
+MeshChatX includes optional tooling to pull `rns`, `lxmf`, `lxst`, and the Reticulum manual from markqvist's rngit remotes over the mesh instead of clearnet.
+
+**Note:** Installing Python packages over RNS is significantly slower than PyPI and is intended for use in environments with mesh access but restricted clearnet. PyPI remains the default and recommended path for CI and standard development.
+
+| Remote | Purpose |
+| ------ | ------- |
+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum` | RNS package |
+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/lxmf` | LXMF package |
+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/lxst` | LXST package |
+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/website` | Manual / website HTML |
+
+This uses [pip-rns](https://github.com/Quad4-Software/pip-rns) for the Python packages and `git` + `git-remote-rns` for the docs tree. Default aliases live in `scripts/pip-rns/aliases`.
+
+**Bootstrap note:** pip-rns needs a working Reticulum stack to reach the remotes. Install `rns` once from PyPI, a wheel, or an existing environment, then use the mesh path for updates.
+
+```bash
+# Optional: Install/update rns, lxmf, lxst into the uv environment over RNS
+task deps:backend:rns
+
+# Optional: Bundle the Reticulum manual from the rngit website remote
+task docs:rns
+```
+
+Equivalent direct commands:
+
+```bash
+bash scripts/pip-rns-deps.sh
+python scripts/build/fetch_reticulum_manual.py --force --via-rns
+```
+
+Set `PIP_RNS_CONFIG` to point at another aliases directory if needed. `MESHCHATX_RETICULUM_DOCS_URL=rns://...` also works for a custom website remote.
## Identity bootstrap
diff --git a/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md b/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md
index 812f691b..b8f777e0 100644
--- a/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md
+++ b/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md
@@ -4,14 +4,14 @@ This page shows how to run **`meshchatx`** under **Firejail** or **Bubblewrap**
These tools do **not** replace a full virtual machine or hardware-enforced boundary. They reduce exposure of your home directory and other paths the process can write to, when you configure them with tight whitelists or bind mounts.
-**Containers:** If you already run MeshChatX with Docker or Podman, that is a different isolation model; this document is aimed at **host-installed** `meshchatx` (or `meshchat`).
+**Containers:** If you already run MeshChatX with Docker or Podman, that is a different isolation model, this document is aimed at **host-installed** `meshchatx` (or `meshchat`).
## Prerequisites
Install one or both from your distribution:
- **Firejail:** package name is usually `firejail`.
-- **Bubblewrap:** package name is usually `bubblewrap`; the binary is `bwrap`.
+- **Bubblewrap:** package name is usually `bubblewrap`, the binary is `bwrap`.
You need a working **`meshchatx`** on your `PATH` (for example after `pipx install`, `pip install --user`, or a distro package). The **`meshchat`** command is the same binary if both entry points are installed.
@@ -113,7 +113,7 @@ exec bwrap \
Notes:
-- If `meshchatx` lives only inside a venv that is **not** under `$DATA`, the read-only root still allows **reading** that path; you do not have to bind-mount the venv separately unless you also need writes there.
+- If `meshchatx` lives only inside a venv that is **not** under `$DATA`, the read-only root still allows **reading** that path, you do not have to bind-mount the venv separately unless you also need writes there.
- Distributions that merge `/` and `/usr` (merged-usr) still work with `--ro-bind / /` on typical glibc setups. If `bwrap` fails with missing library paths, add the extra `--ro-bind` lines your distro documents (for example `/lib64`).
### From source with UV
diff --git a/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/quest-sidequest.md b/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/quest-sidequest.md
index 7d7bb7d5..db7264a7 100644
--- a/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/quest-sidequest.md
+++ b/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/quest-sidequest.md
@@ -15,7 +15,7 @@ MeshChatX opens as a **2D panel** inside your VR environment. It is not a native
Download the latest signed Android APK from the [MeshChatX releases page](https://github.com/Quad4-Software/MeshChatX/releases). Release assets are named like `meshchatx-*-release-signed.apk`.
-You can also build the APK yourself; see [`android/README.md`](../android/README.md).
+You can also build the APK yourself, see [`android/README.md`](../android/README.md).
## Enable Developer Mode
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────