Mesh cell deploy runbook

GAMP 5: Run scripts/gamp5_mesh_deploy_iq.sh before any production push. Spec: cells/xcode/docs/MESH_SUBSTRATE_DEPLOY_GAMP5.md.

---

Canonical pipeline (substrate edge)

Step	Command
IQ gate	`scripts/gamp5_mesh_deploy_iq.sh`
Stage content	`scripts/stage_mesh_root.sh`
Deploy each cell	`cells/python/tools/deploy_mesh_edge.sh <cell-ip>`
Smoke test (required)	`scripts/mesh_deploy_smoke_test.sh` — `/`, `/wiki/`, `/downloads/*.dmg` + `.sha256`
DNS-01 alternate	`cells/python/tools/deploy_substrate_mesh.sh <cell-ip>`

Remote path: /opt/gaiaftcl-mesh · Container: gaiaftcl-edge · SSH key: ~/.ssh/ftclstack-unified

---

Nine cells

Label	IPv4
hel1-01	77.42.85.60
hel1-02	135.181.88.134
hel1-03	77.42.32.156
hel1-04	77.42.88.110
hel1-05	37.27.7.9
nbg1-01	37.120.187.247
nbg1-02	152.53.91.220
nbg1-03	152.53.88.141
nbg1-04	37.120.187.174

gaiaftcl.com round-robins these hosts.

---

Static TLS (deploy_mesh_edge)

Place operator cert/key in cells/python/tools/mesh-edge/tls/ (see tls/README.md). Keys are gitignored.

---

Supplementary — not the substrate edge

scripts/deploy_mesh_cells.sh — SSH preflight, optional git pull on cells, MkDocs site/ rsync to apex. Use after IQ passes; does not replace deploy_mesh_edge.sh.

---

MkDocs / dual-channel site

For v1/v2 download channels and full MkDocs site:

scripts/build_production_site.sh
python3 -m mkdocs build --clean --strict

Merge into staging or apex rsync per release policy; mesh edge serves render_wiki.py substrate wiki at /wiki/*.

Federation cosignature: pending operator signing host (v26). Witness (sha256 of rendered body): f616784949739b984318f1c0a12736ec0f75964c49888f164f4df21a784baabe. This page serves with a substrate-honest pending-signature notice until the operator's Franklin signer cosigns it.