Publish curated Unraid-AppOps-Gateway source from 68f71e9a7b501c59867df29ccbc18ffecd836b9d

PUBLIC_SOURCE_EXPORT.md

@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `32a6eece0e3e1276946abdc04196c819daf02e2a`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `68f71e9a7b501c59867df29ccbc18ffecd836b9d`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.

PUBLIC_SOURCE_MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "32a6eece0e3e1276946abdc04196c819daf02e2a",
+  "sourceRevision": "68f71e9a7b501c59867df29ccbc18ffecd836b9d",
   "files": [
     {
       "path": ".dockerignore",
@@ -39,8 +39,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "f637f498b0da533b687c3bd196b1bb7faa07197406799ef57e52f056c3ca05f4",
-      "bytes": 3270
+      "sha256": "bc2bc88b92e2b14c8bdb4b91854b9ccd3e304d435d4e4c2a9de88b9af23d139d",
+      "bytes": 4076
     },
     {
       "path": "SECURITY.md",

README.md

@@ -27,6 +27,20 @@ Open `http://localhost:1216/setup`. Keep the operator token and encryption key p
 
 Before production use, put the application behind a trusted authenticated TLS reverse proxy or VPN. Never expose it directly to the internet. Preserve both `/data` and its encryption key, test restore, and review every connector's permissions. See [Security policy](SECURITY.md).
 
+## First operator workflow
+
+Configure one connector, inspect its health and review the discovered application inventory. Deliberately select the applications to manage, then inspect the available typed actions and their policies before executing an operation. Check the recorded outcome in the activity history.
+
+Missing optional connectors mean partial coverage. Do not interpret a successful gateway health check as proof that every application is reachable. Keep connector scope narrow and investigate a denied operation before changing policy.
+
+```mermaid
+flowchart LR
+  Operator[Authenticated operator] --> Gateway[AppOps API and policies]
+  Gateway --> Connectors[Configured typed connectors]
+  Connectors --> Targets[Managed applications]
+  Gateway --> State[SQLite state and activity history]
+```
+
 ## Development
 
 React 19, TypeScript, Vite, Tailwind and TanStack Query form the frontend. FastAPI provides the backend and serves the built frontend; SQLite persists state. Python dependencies are pinned in `backend/requirements.txt`.