curriculum-project-hub/.scratch/saas-production-readiness/issues/10-provision-nonroot-service.md

Provision a runnable non-root Hub service

Type: task Status: open

Question

Make clean-host installation create or validate the dedicated service identity, home/cache/state/workspace paths and ownership, generate a complete production configuration, honor the configured bind host, and fail preflight before unit installation when any required value or prerequisite is invalid. The persistent workspace root must be outside all release trees, and preflight must reject any path that overlaps rsync, release switching, rollback, or release pruning.