# Operator guide

## Environment variables

- `HASP_HOME`
- `HASP_MASTER_PASSWORD`
- `HASP_BACKUP_PASSPHRASE`

## Release trust path

Verify a packaged release before install:

```bash
./scripts/hasp-verify-release.sh <tarball>
./scripts/hasp-install-release.sh --verify <tarball> <install-dir>
```

The packaged installer verifies the signed checksum manifest, the tarball signature, and the packaged binary signature before it stages the install tree.

## Repo guardrails

Bulk-adopt local git repos into HASP-managed project bindings:

```bash
./bin/hasp project adopt --under /path/to/workspaces --preview
./bin/hasp project adopt --under /path/to/workspaces
```

Behavior:

- scans under the given directory for git-backed project roots
- skips non-project directories
- uses machine defaults for hook installation and default capture policy
- does not require background crawling or always-on discovery

Packaged helpers:

- `./scripts/hasp-pre-commit.sh`
- `./scripts/hasp-pre-push.sh`
- `./scripts/hasp-deploy.sh`

Manual repo scan:

```bash
./bin/hasp check-repo --project-root /path/to/repo
```

Audited override:

```bash
./bin/hasp check-repo --project-root /path/to/repo --allow-managed-secrets
HASP_ALLOW_MANAGED_SECRETS=1 ./scripts/hasp-deploy.sh /path/to/repo -- <deploy command...>
```

## Upgrade and uninstall

- `./scripts/hasp-upgrade-release.sh` stages a new release tree and swaps it into the target prefix only after verification succeeds.
- `./scripts/hasp-uninstall-release.sh` removes the release tree only by default.
- `HASP_HOME` stays untouched unless the operator passes an explicit purge flag.
- repo hooks stay untouched unless the operator passes explicit repo paths for cleanup.

## Threat-model limits

- V1 reduces accidental exposure and common local leaks on a normal developer machine.
- V1 does not provide strong same-user local isolation.
- V1 does not defend against malicious same-user local processes.
- shell exports and pasted values remain operator hygiene risks, not a protected boundary.
