From c61fbfd87fd8dac955fc389f88c921fdebb98844 Mon Sep 17 00:00:00 2001
From: Public Source Publisher <public-source@itworx.tech>
Date: Thu, 1 Oct 2026 15:50:03 +0000
Subject: [PATCH] Publish curated Unraid-AppOps-Gateway source from
 68f71e9a7b501c59867df29ccbc18ffecd836b9d

---
 PUBLIC_SOURCE_EXPORT.md     |  2 +-
 PUBLIC_SOURCE_MANIFEST.json |  6 +++---
 README.md                   | 14 ++++++++++++++
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index 343bcef..ca3db85 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `32a6eece0e3e1276946abdc04196c819daf02e2a`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `68f71e9a7b501c59867df29ccbc18ffecd836b9d`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index 81ca805..2063abf 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "32a6eece0e3e1276946abdc04196c819daf02e2a",
+  "sourceRevision": "68f71e9a7b501c59867df29ccbc18ffecd836b9d",
   "files": [
     {
       "path": ".dockerignore",
@@ -39,8 +39,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "f637f498b0da533b687c3bd196b1bb7faa07197406799ef57e52f056c3ca05f4",
-      "bytes": 3270
+      "sha256": "bc2bc88b92e2b14c8bdb4b91854b9ccd3e304d435d4e4c2a9de88b9af23d139d",
+      "bytes": 4076
     },
     {
       "path": "SECURITY.md",
diff --git a/README.md b/README.md
index 5f315c3..cdc1b89 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,20 @@ Open `http://localhost:1216/setup`. Keep the operator token and encryption key p
 
 Before production use, put the application behind a trusted authenticated TLS reverse proxy or VPN. Never expose it directly to the internet. Preserve both `/data` and its encryption key, test restore, and review every connector's permissions. See [Security policy](SECURITY.md).
 
+## First operator workflow
+
+Configure one connector, inspect its health and review the discovered application inventory. Deliberately select the applications to manage, then inspect the available typed actions and their policies before executing an operation. Check the recorded outcome in the activity history.
+
+Missing optional connectors mean partial coverage. Do not interpret a successful gateway health check as proof that every application is reachable. Keep connector scope narrow and investigate a denied operation before changing policy.
+
+```mermaid
+flowchart LR
+  Operator[Authenticated operator] --> Gateway[AppOps API and policies]
+  Gateway --> Connectors[Configured typed connectors]
+  Connectors --> Targets[Managed applications]
+  Gateway --> State[SQLite state and activity history]
+```
+
 ## Development
 
 React 19, TypeScript, Vite, Tailwind and TanStack Query form the frontend. FastAPI provides the backend and serves the built frontend; SQLite persists state. Python dependencies are pinned in `backend/requirements.txt`.