SparkN0de-git - /page/commit.mu

Micron Document

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

| SparkN0de-git | SparkN0de |

Node / ReticulumProjects / MeshChatX.git / commits / b5ab7b8

Commit b5ab7b8e7288483eec2c7a767ea3351bc49ee922

󰉖 Browse tree at this commit

Parents : 00f69fe

Author : Ivan <ivan@quad4.io>

Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>

Date : 2026-07-13T08:48:09-05:00

docs: refine language and clarify instructions in various documentation files

Changes

8 files changed, 27 insertions(+), 17 deletions(-)

M docs/en/architecture.md +1 -1

M docs/en/platform-guides/linux-sandbox.md +2 -2

M docs/en/platform-guides/raspberry-pi.md +1 -1

M meshchatx/src/backend/landlock_sandbox.py +12 -2

M meshchatx/src/frontend/public/meshchatx-docs/en/architecture.md +1 -1

M meshchatx/src/frontend/public/meshchatx-docs/en/installation.md +7 -7

M meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md +2 -2

M meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/raspberry-pi.md +1 -1

Diff

diff --git a/docs/en/architecture.md b/docs/en/architecture.md

index 7c9e02a3..db761792 100644

--- a/docs/en/architecture.md

+++ b/docs/en/architecture.md

@@ -140,7 +140,7 @@ Practical extension paths today:

- Database schema changes through migrations

- Generic RNS Link transport over WebSocket (`rns.link.*`) for external consoles and plugins (see [RNS Link API](rns-link-api.md))

-Granted plugin manager capabilities include `destinationPath.read`, `debugLog.read`, `bugReport.*`, and `rnsLink.open` / `identify` / `request` / `send` / `close`. Hooks include `announce.received` and `rns.link.event`. Storage (`storage:isolated`) and outbound HTTP (`network:fetch`) are also grantable; install preview scans plugin files for external URLs and stores the user-selected grant subset.

+Granted plugin manager capabilities include `destinationPath.read`, `debugLog.read`, `bugReport.*`, and `rnsLink.open` / `identify` / `request` / `send` / `close`. Hooks include `announce.received` and `rns.link.event`. Storage (`storage:isolated`) and outbound HTTP (`network:fetch`) are also grantable. The installation preview scans plugin files for external URLs and stores the user-selected grant subset.

When adding features, prefer identity-scoped state, explicit migrations, endpoint tests, and narrowly declared plugin permissions.

diff --git a/docs/en/platform-guides/linux-sandbox.md b/docs/en/platform-guides/linux-sandbox.md

index b8f777e0..52a0b21c 100644

--- a/docs/en/platform-guides/linux-sandbox.md

+++ b/docs/en/platform-guides/linux-sandbox.md

@@ -53,7 +53,7 @@ firejail --noprofile --whitelist="$DATA" \

--reticulum-config-dir="$DATA/.reticulum"

```

-`--noprofile` disables many Firejail restrictions; treat it as a stepping stone, not the final hardening.

+`--noprofile` disables many Firejail restrictions. Treat it as a stepping stone, not the final hardening.

### From source with UV

@@ -89,7 +89,7 @@ Use the device nodes your system actually exposes (`dmesg`, `ls /dev/tty*`).

## Bubblewrap (`bwrap`)

-Bubblewrap does not ship profiles; you list every mount and option. The pattern below keeps the **whole root filesystem read-only**, mounts a **writable tmpfs** on `/tmp`, and makes **only** your data directory writable at its normal path. **Network namespaces are not changed**, so Reticulum and TCP/UDP behave like an unsandboxed process unless you add `--unshare-net` (which usually breaks mesh networking).

+Bubblewrap does not ship profiles, so you must list every mount and option. The pattern below keeps the **whole root filesystem read-only**, mounts a **writable tmpfs** on `/tmp`, and makes **only** your data directory writable at its normal path. **Network namespaces are not changed**, so Reticulum and TCP/UDP behave like an unsandboxed process unless you add `--unshare-net` (which usually breaks mesh networking).

### Installed `meshchatx`

diff --git a/docs/en/platform-guides/raspberry-pi.md b/docs/en/platform-guides/raspberry-pi.md

index a02651b8..9e200a19 100644

--- a/docs/en/platform-guides/raspberry-pi.md

+++ b/docs/en/platform-guides/raspberry-pi.md

@@ -25,7 +25,7 @@ The installer guides you through:

- Optional **cosign** attestation: if a `*.whl.cosign.bundle` is published

next to the wheel, you can verify it. The script uses `cosign` on `PATH` if

present, or downloads a **checksum-verified** official Linux binary to `/tmp`

- (the Sigstore bundle format is not reimplemented in shell; you still use the

+ (the Sigstore bundle format is not reimplemented in shell, so you still use the

real `cosign` to verify, without installing a distro package)

- Storage and Reticulum directories

- Bind host and port (with availability check)

diff --git a/meshchatx/src/backend/landlock_sandbox.py b/meshchatx/src/backend/landlock_sandbox.py

index 29c5c4c4..0d33e415 100644

--- a/meshchatx/src/backend/landlock_sandbox.py

+++ b/meshchatx/src/backend/landlock_sandbox.py

@@ -129,9 +129,19 @@ def _syscall_numbers():

def _libc():

name = ctypes.util.find_library("c")

- if not name:

+ try:

+ if name:

+ libc = ctypes.CDLL(name, use_errno=True)

+ else:

+ # On some systems (like Alpine/musl) find_library("c") fails.

+ # Loading None gives us access to symbols already in the process.

+ libc = ctypes.CDLL(None, use_errno=True)

+ except OSError:

return None

- libc = ctypes.CDLL(name, use_errno=True)

+ if not hasattr(libc, "syscall"):

+ return None

libc.syscall.restype = ctypes.c_long

return libc

diff --git a/meshchatx/src/frontend/public/meshchatx-docs/en/architecture.md b/meshchatx/src/frontend/public/meshchatx-docs/en/architecture.md

index 7c9e02a3..db761792 100644

--- a/meshchatx/src/frontend/public/meshchatx-docs/en/architecture.md

+++ b/meshchatx/src/frontend/public/meshchatx-docs/en/architecture.md

@@ -140,7 +140,7 @@ Practical extension paths today:

- Database schema changes through migrations

- Generic RNS Link transport over WebSocket (`rns.link.*`) for external consoles and plugins (see [RNS Link API](rns-link-api.md))

When adding features, prefer identity-scoped state, explicit migrations, endpoint tests, and narrowly declared plugin permissions.

diff --git a/meshchatx/src/frontend/public/meshchatx-docs/en/installation.md b/meshchatx/src/frontend/public/meshchatx-docs/en/installation.md

index 38baa1f5..5c422c7c 100644

--- a/meshchatx/src/frontend/public/meshchatx-docs/en/installation.md

+++ b/meshchatx/src/frontend/public/meshchatx-docs/en/installation.md

@@ -136,16 +136,16 @@ CI release builds use the clearnet path. Without a bundled copy the Reticulum ta

## Advanced: Optional RNS-only installation (pip-rns)

-MeshChatX includes optional tooling to pull `rns`, `lxmf`, `lxst`, and the Reticulum manual from markqvist's rngit remotes over the mesh instead of clearnet.

+MeshChatX includes optional tooling to pull `rns`, `lxmf`, `lxst`, and the Reticulum manual from markqvist's rngit remotes over the mesh instead of clearnet.

**Note:** Installing Python packages over RNS is significantly slower than PyPI and is intended for use in environments with mesh access but restricted clearnet. PyPI remains the default and recommended path for CI and standard development.

-| Remote | Purpose |

-| ------ | ------- |

-| `rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum` | RNS package |

-| `rns://7649a50d84610232d1416b41d2896aff/reticulum/lxmf` | LXMF package |

-| `rns://7649a50d84610232d1416b41d2896aff/reticulum/lxst` | LXST package |

-| `rns://7649a50d84610232d1416b41d2896aff/reticulum/website` | Manual / website HTML |

+| Remote | Purpose |

+| ------------------------------------------------------------ | --------------------- |

+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum` | RNS package |

+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/lxmf` | LXMF package |

+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/lxst` | LXST package |

+| `rns://7649a50d84610232d1416b41d2896aff/reticulum/website` | Manual / website HTML |

This uses [pip-rns](https://github.com/Quad4-Software/pip-rns) for the Python packages and `git` + `git-remote-rns` for the docs tree. Default aliases live in `scripts/pip-rns/aliases`.

diff --git a/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md b/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md

index b8f777e0..52a0b21c 100644

--- a/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md

+++ b/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/linux-sandbox.md

@@ -53,7 +53,7 @@ firejail --noprofile --whitelist="$DATA" \

--reticulum-config-dir="$DATA/.reticulum"

```

-`--noprofile` disables many Firejail restrictions; treat it as a stepping stone, not the final hardening.

+`--noprofile` disables many Firejail restrictions. Treat it as a stepping stone, not the final hardening.

### From source with UV

@@ -89,7 +89,7 @@ Use the device nodes your system actually exposes (`dmesg`, `ls /dev/tty*`).

## Bubblewrap (`bwrap`)

### Installed `meshchatx`

diff --git a/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/raspberry-pi.md b/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/raspberry-pi.md

index a02651b8..9e200a19 100644

--- a/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/raspberry-pi.md

+++ b/meshchatx/src/frontend/public/meshchatx-docs/en/platform-guides/raspberry-pi.md

@@ -25,7 +25,7 @@ The installer guides you through:

- Optional **cosign** attestation: if a `*.whl.cosign.bundle` is published

next to the wheel, you can verify it. The script uses `cosign` on `PATH` if

present, or downloads a **checksum-verified** official Linux binary to `/tmp`

- (the Sigstore bundle format is not reimplemented in shell; you still use the

+ (the Sigstore bundle format is not reimplemented in shell, so you still use the

real `cosign` to verify, without installing a distro package)

- Storage and Reticulum directories

- Bind host and port (with availability check)

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────