[tang-vu]

Ready for independent review (2026-09-15). Candidate 5066ab1a42d6fa4417d631c8f02f6a48528e9f1b has a successful GitHub check rollup and no base-branch conflict at this review snapshot. This supersedes earlier draft-status wording only. All validation gaps, migration requirements, live gates and independent human review requirements below remain in force; this is not a merge-ready approval.

Why this matters

Add a persistent, authenticated transfer workspace for local datasets and generated artifacts. Operators can create separate SFTP/browser accounts without mounting ODS secrets or application databases into a generic file manager. The optional SFTPGo recipe is installable through the existing extension catalog and host-agent lifecycle.

Production contract

• Pin upstream community ghcr.io/drakkan/sftpgo:v2.7.5@sha256:9011fe608d336d3daf6ed6224b16fd40443aab8f3335e0b20853d6a539c58738, inspecting the exact Dockerfile, config, health subcommand and v2 HTTP API.
• Require an initial administrator password, keep the upstream UID/GID 1000 and declare ownership in the manifest. Publish only loopback HTTP 7828 and SFTP 2022; explicitly disable FTP/WebDAV listeners. Health uses the shipped sftpgo ping subcommand.
• Persist the account database/SSH identity in data/sftpgo/state and user files/backups in data/sftpgo/files. The initial environment password never overwrites an existing administrator. File users remain distinct from administrators and receive only operator-assigned permissions.
• Full path: recipe/manifest -> generated catalog -> existing installer mount preparation -> database/account bootstrap -> admin creates transfer user -> authenticated SFTP/browser storage. README explains remote SSH versus HTTPS routing, host-key verification, manual ownership preparation, password changes, stopped backups and rollback with the matching database/image. No existing ODS data or Docker socket is mounted.
• Canonical catalog regeneration also restores the already tracked disabled pixel-inference metadata; it does not activate that service.

Overlap check

Searched open and closed PRs for SFTPGo, SFTP, file transfer and the new production recipe paths: no existing SFTPGo change. #4919 provides direct peer-to-peer PairDrop browser transfer, without persistent server-side user storage/accounts. #4988 diagnoses transfer throughput, without transferring retained user artifacts. Reviewed shared library README/catalog paths; these scopes remain independently useful and their generated entries must be retained together.

Validation

• Exact-image Linux amd64 test: 2 passed (23-live, 356.17 seconds of pytest). Missing-password refusal; healthy installed Compose; anonymous/wrong-admin denial; real admin-token issuance; creation of Alice/Bob through the shipped HTTP API; binary/Unicode SFTP upload and exact download; Bob cannot list/open Alice's file; forced recreation preserves file bytes, both accounts and the exact SSH public host key. Changing bootstrap .env password after recreation leaves the stored administrator password authoritative.
• Fixture ownership preparation uses the same UID/GID declared by the production manifest and only a temporary fixture mount. Containers/network are cleaned up. The upstream image's actual runtime identity is UID/GID 1000.
• 36 library manifests, scoped pre-commit hooks and git diff --check passed. The full local make gate retains the root/WSL no-sudo Docker baseline failure (existing fix(installer): honor unavailable sudo in Docker fallback #3158), so no full local gate success is claimed. Added path-filtered CI runs the actual API/SFTP test using Paramiko 4.0.0.

Review and limitations

Awaiting independent storage/account review and CI. Native Windows/macOS, ARM, actual browser operations, VPN/HTTPS routing, cloud backends, public shares, large transfers and upgrade/downgrade from user databases were not tested. The image advertises multiple architectures, but live evidence is amd64 only. Keep both persistent directories and the pre-upgrade image together for recovery; do not downgrade a migrated database blindly. Account setup and confirmation stay in SFTPGo's own authenticated admin interface.

Final candidate 5066ab1a42d6fa4417d631c8f02f6a48528e9f1b: 33 successful CI checks, 4 conditionally skipped; no pending or failed checks.

Batch integration receipt

This is one of 30 independently branched public-beta PRs. The published synthetic integration head is 61f4c6fccc81bea697f4941683fefb5089ba77f4, built from baseline d49ad4bbc760be319de7f4c9b9a93b1f18fe3922 in this reproducible order:

#4946 → #4948 → #4951 → #4954 → #4972 → #4960 → #4961 → #4957 → #4964 → #4967 → #4968 → #4971 → #4975 → #4976 → #4984 → #4982 → #4990 → #4988 → #4989 → #4997 → #5003 → #5006 → #5007 → #5009 → #5012 → #5011 → #5013 → #5014 → #5020 → #5021

Reconciliation preserved all 146 files owned by a single PR byte-for-byte against their exact candidate heads. The eight shared paths preserve both CLI STT/TTS commands and help, every added Makefile test, both environment schema additions and all Extensions UI behavior. LanguageTool and Kroki both remain headless API entries. Canonical regeneration yields 76 catalog entries and 47 library manifests; all README rows are retained. Shared-file changes need these additive resolutions when merged independently.

Combined validation: 2,852 API tests passed / 1 skipped; 1,082 UI tests passed; 47 manifests passed; all 12 added Makefile commands passed; 12 catalog boundary tests passed / 12 opt-in runtime tests skipped in this combined run. Individual exact-image results remain documented above. UI lint/build, scoped secret hooks, diff checks, four platform smoke tests and installer simulation passed. Compose plans for NVIDIA/AMD/Apple each contain 20 services and no duplicate published bindings across the core plus 12 new recipes; this is static plan evidence, not simultaneous startup or GPU inference.

The first unrestricted UI run timed out in two tests under concurrent load; the complete rerun used --maxWorkers=2 with unchanged assertions and timeouts and passed. ESLint reports zero errors and 603 warnings, including the existing JSX usage-detection pattern. Full local make gate still fails the no-sudo Docker baseline covered by #3158. BATS records 416 passed / 5 failed on this root/WSL host (platform detection, root preflight and a 15 GiB versus 20 GiB free-space expectation). Neither full local gate nor BATS is described as green.

This integration receipt supplements each PR's own regression and does not waive its independent review, live hardware/browser/upgrade gates or rollback requirements. The PRs remain drafts; none was merged upstream.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.