Install & deploy

This is the deployment overview. Exact, current commands live in each repo’s README on github.com/zkmkarlsruhe — treat this as the map, not the script.

Two services

Service	Repo	Role	Needs
rvmc (research workbench)	research-vm-controller	clone & boot VMs, workbench UI, agent	libvirt/KVM
autopsy (analysis)	artwork-autopsy	analyze bundles as jobs, write reports	PostgreSQL

Both are Python services; rvmc serves a React SPA for the workbench. They talk over HTTP — rvmc dispatches autopsy jobs and reads the deliverables back.

Self-hosted (single user)

The minimal path:

1. Host with KVM/libvirt.
2. RVMC_AUTH_MODE=local rvmc serve (see Auth modes).
3. For analysis: PostgreSQL + the autopsy API and a runner, with your storage backend and AI configuration.

See the self-host quickstart.

Server (multi-tenant)

• RVMC_AUTH_MODE=forward behind a reverse proxy (e.g. Traefik) + Authentik forward-auth.
• Control-plane stacks are best deployed via GitOps: keep the app source in one repo and the compose/deployment in a separate gitops repo, deploy tag-pinned images from your container registry with git-poll or webhook redeploys.
• The SPA build (web/) is produced by CI or at deploy time; the workbench serves the built assets.

CI / build

The repositories carry a container build in CI that produces the workbench image; the SPA is built with Vite (see below). Point it at whatever registry and dependency-update tooling you use.

Web lint/format uses Biome

The workbench SPA lints and formats with Biome (not eslint + prettier). This is deliberate and must not be reverted: the project runs TypeScript 7, and typescript-eslint hard-caps typescript < 6.1.0, so it cannot run on TS 7 (no release supports it) — and downgrading TypeScript is not an option. Biome is Rust-based and TS7-native.

• npm run check — the CI gate (biome ci: lint + format).
• npm run typecheck — tsc, the type gate.
• npm run build — the Vite production build.

The CI web job runs those three; npm run lint / npm run format are the local conveniences.

Deliverables & durability

Autopsy writes its deliverables (manifest, runbook, suggestions, KB docs) to the project’s storage (local dir, artwork drive, or S3). The disk record is the source of truth — a job’s artifacts survive a restart of either service, and old reports remain readable independently of the tooling.