Document package advisory and external-network behavior before alpha release

[Joncallim]

Goal

Make DockerMap's package advisory, registry, and other external-network behavior explicit before the private-alpha release.

Plain-English Context

A server owner should know whether DockerMap ever talks to package registries, security advisory services, or outside APIs. This issue makes the project spell out what happens by default so reviewers can tell whether DockerMap stays local-only, needs opt-in network access, or has any release-blocking behavior to fix.

Roadmap Source

• docs/planning/ROADMAP.md -> Now: Private Alpha Hardening -> Document package and advisory network behavior.
• docs/release/RELEASE_CHECKLIST.md -> Execute After Next Commit -> decide and document package advisory, registry, or other external-network behavior.

Recommended Agent

Primary: docs-operator

Handoff note: if inspection finds code that performs registry, advisory, or external API calls by default, stop and hand off to runtime-provider or security-readonly for a code fix before documenting release readiness.

Scope

Target areas:

• docs/deployment/DEPLOYMENT.md
• docs/deployment/REVERSE_PROXY.md if network exposure or proxy behavior matters
• docs/security/THREAT_MODEL.md
• docs/testing/TESTING_PLAN.md
• docs/release/RELEASE_CHECKLIST.md
• release notes location if one already exists
• provider code inspection only to verify the documented claim

Direction

1. Inspect current npm/package, advisory, external API, Tailscale/Headscale, reverse-proxy, and DNS provider behavior.
2. Identify whether any provider performs network egress by default.
3. Document the default behavior in operator-facing terms: disabled, local-only, opt-in, or explicitly enabled.
4. If any lookup is opt-in, document the setting, token handling, and expected network destination without including secrets.
5. If any lookup is enabled by default and not already accepted by the roadmap/security model, open or note a blocking follow-up instead of presenting it as release-ready.
6. Keep examples secret-free and avoid inline auth URLs.

Acceptance Criteria

• Deployment and security docs state whether package registry, advisory, or external API calls are disabled, opt-in, or enabled by default.
• Release checklist has a clear evidence item for the provider-network behavior note.
• Testing docs explain how to verify provider-network behavior without relying on external secrets.
• Any unresolved ambiguity is called out as a release blocker or follow-up, not buried in prose.
• No docs example contains tokens, credentials, inline auth URLs, or real host-specific secrets.

Validation Commands

Run or record the narrowest useful checks:

• rg -n "advisory|registry|external|network|Tailscale|Headscale|token|auth" docs crates apps packages
• npm run test:js only if docs examples or scripts affect tested behavior

State any skipped commands and why.

Closure Evidence

When resolved, post a comment using the repository evidence format:

## Resolution Evidence
- What changed:
- Why this resolves the issue:
- How I checked it:
- Remaining risk or follow-up:

Recommendation: This issue appears resolved and can be closed by a maintainer.

Do not close the issue automatically.

[Joncallim]

Resolution Evidence

• What changed: PR [codex] Document runtime network behavior #20 documented DockerMap's runtime external-network behavior in the deployment, security, testing, release-checklist, reverse-proxy, and architecture docs. The docs now separate build/maintenance network use from runtime behavior, and call out package/advisory lookup status, delegated Tailscale/Headscale CLI behavior, remote-daemon opt-in behavior, reverse-proxy side effects, and Google-hosted browser fonts.
• Why this resolves the issue: A reviewer or operator can now see that DockerMap runtime does not currently perform package registry, package advisory, DNS-provider API, Cloudflare API, or generic external-API lookups. The docs also avoid overclaiming: Tailscale/Headscale are described as fixed local CLI calls that may use the operator's configured control plane, and Google Fonts browser egress is explicitly called out.
• How I checked it: I inspected the runtime provider code and API daemon URL handling, ran the issue's grep checks plus a targeted network-client grep, ran npm run test:api and npm run test:rust:daemon, completed QA/Security/Adversarial reviews, rebased PR [codex] Document runtime network behavior #20 onto latest main, and waited for GitHub TypeScript, Rust, Playwright smoke, and GitGuardian checks to pass before merging.
• Remaining risk or follow-up: Release notes still need to carry the provider-network behavior note. The release checklist keeps decisions visible for Tailscale/Headscale delegated CLI behavior and Google-hosted fonts in the private review environment.

Recommendation: This issue appears resolved by PR #20 and can be closed by a maintainer.