Drop the last references to the bot's code living in this repo

switchToClone no longer tries to carry bot/app across a clone, and the compose comment, STATUS row,
README and the plan doc all describe the installed-release model instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -21,7 +21,7 @@ Bundle: `vanguard-stream/` in this repo; live copy at `~/vanguard-stream` on the
 | Authentik (Discord login, groups) at `auth.` | live |
 | Jellyfin at `watch.`, SSO via Authentik, direct play only | live |
 | Vanguard Metadata plugin v0.1 | installed, libraries being switched to Shows |
-| MariaDB (bot database) + `discord-bot` Python container (`bot/app`) | **in bundle, not yet applied** |
+| MariaDB (bot database) + `discord-bot` Python container (release installed in `/srv/bot/app`) | live; first release pending |
 | Gitea (`git.`, MariaDB, ssh 2222) + Actions runner | live (local admin account; Authentik OIDC → Phase 10) |
 
 ## Decisions already made
@@ -223,7 +223,8 @@ Checklist:
 
 ### Discord bot (separate dev) — runtime provided by the stack
 - `mariadb` container, db `vanguardbot` / user `bot`, loopback only (ssh tunnel for dev access)
-- `discord-bot` container: python 3.12 + ffmpeg + yt-dlp baseline; code bind-mounted from `bot/app/`;
+- `discord-bot` container: python 3.12 + ffmpeg + curl, and no bot dependencies — its CI builds a release
+  bundle (code + `vendor/` wheels) that dumpd installs into `/srv/bot/app`, bind-mounted at `/app`;
   env gives token, guild, DB creds, rw `/media/clips`, `/data` scratch; restarts on exit
 - web UI at `bot.` behind Caddy + Authentik forward-auth (first use of the forward-auth pattern that
   Phase 5 applies to copyparty); the bot trusts `X-Authentik-*` headers and implements no login
@@ -232,7 +233,7 @@ Checklist:
 - [ ] CNAME `bot` → main host; `configure.py --full` (asks the hostname, bot token + guild) → `docker compose up -d --build`
 - [ ] Authentik: domain-level Proxy Provider (covers live/bot/main); Caddy requires group `bot-users` on the bot host (`BOT_REQUIRE_GROUP`)
 - [ ] Discord roles → Authentik groups: `authentik/discord-roles-to-groups.py` on both source flows (scope `guilds.members.read`)
-- [ ] dev drops `main.py` into `bot/app/` → `docker compose restart discord-bot`
+- [x] the bot repo's CI builds a release bundle and a push to `main` installs it (signed, via dumpd `/deploy-bot`)
 
 ### Phase 9 — Gitea + Actions runner
 - `gitea` on MariaDB (db/user from `mariadb/init/10-gitea.sh` on first init, else `./createGiteaDb.sh`),

README.md

@@ -523,7 +523,7 @@ Then switch the server folder to a clone (two steps):
     # Gitea → repo → Settings → Deploy Keys → add it, read-only
     ssh -t debian@HOST 'cd ~/vanguard-stream && ./switchToClone.sh clone && cd ~/vanguard-stream && ./configure.py --apply >/dev/null && sudo vanguard-deploy status'
 
-`switchToClone.sh clone` keeps `.env`, the generated configs, the token secret, plugin zips and `bot/app`, and
+`switchToClone.sh clone` keeps `.env`, the generated configs, the token secret and plugin zips, and
 leaves the old copy at `~/vanguard-stream.old` until you delete it. From here on a manual deploy is
 `sudo vanguard-deploy pull` on the server.
 

STATUS.md

@@ -67,7 +67,6 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 | MariaDB | databases for the bot and Gitea; public :3306, root local-only | live |
 | Gitea | git hosting on MariaDB, Actions enabled; holds this repo | live; Discord login via Authentik OIDC **verified**; access = `git-users`/`git-admins` groups; local admin as fallback |
 | act_runner | CI jobs in Docker | **not registered** |
-| discord-bot | Python runtime, idles until `bot/app/main.py` exists | live, no code yet |
 | `bot.` host + Discord bot | the bot's API **and** its web pages on one port (`WEB_SERVE_UI`), behind Authentik forward-auth; Caddy requires `bot-users`, the bot re-checks `bot-users,admins` per request | a push to `main` deploys itself: CI builds a **release bundle** (app + `vendor/` dependencies) and posts it signed to dumpd `POST /deploy-bot` (bridge-only port, no Docker socket in CI) together with the bot's own secrets, which are managed in Gitea; dumpd verifies everything, writes the keys `BOT_ENV_KEYS` allows into `.env` and swaps the bundle into `/srv/bot/app` → `/app`; image installs no bot dependencies | **reviewed + wired 2026-11-02, first install pending** (needs the Authentik app for `bot.`, and `BOT_DEPLOY_SECRET` + `DISCORD_BOT_TOKEN` + `DISCORD_GUILD_ID` set in Gitea) |
 | Live portal (`live/`, `live.` host) | React + dockview multi-stream viewer + browser Go Live (WHIP); MediaMTX HLS/WebRTC/API on loopback; dumpd `/me/stream-key` | live; Go Live verified |
 

docker-compose.yml

@@ -199,7 +199,7 @@ services:
       start_period: 30s
     restart: unless-stopped
 
-  # ---------------------------------------------------------------- Discord bot (python; code lives in ./bot/app)
+  # ------------------------------------------- Discord bot (python; its release is installed in /srv/bot/app)
   discord-bot:
     logging: *vglog
     labels: { vanguard.service: discord-bot, vanguard.category: bot }

switchToClone.sh

@@ -24,9 +24,9 @@ CFG
     git clone --quiet "$REPO_SSH" "$DIR"
     for f in .env Caddyfile mediamtx.yml copyparty.conf stream-token.secret deploy.env; do [[ -f $DIR.old/$f ]] && cp -a "$DIR.old/$f" "$DIR/$f"; done
     mkdir -p "$DIR/jellyfin-plugin-vanguard/dist"; cp -a "$DIR.old"/jellyfin-plugin-vanguard/dist/*.zip "$DIR/jellyfin-plugin-vanguard/dist/" 2>/dev/null || true
-    [[ -d $DIR.old/bot/app ]] && cp -a "$DIR.old/bot/app/." "$DIR/bot/app/" 2>/dev/null || true
     ( cd "$DIR" && sudo -n true 2>/dev/null && sudo install -m 0600 -o root -g root .env /dev/null >/dev/null 2>&1 || true )
-    echo "cloned. kept: .env, generated configs, plugin zips, bot/app. Old copy at $DIR.old (delete when happy)."
+    echo "cloned. kept: .env, generated configs, plugin zips. Old copy at $DIR.old (delete when happy)."
+    echo "  (the Discord bot is not in this repo: its release lives in /srv/bot/app and is untouched by this)"
     echo "next: cd $DIR && ./configure.py --apply   (records nothing new; just confirms generation works from the clone)"
     echo "      then: sudo vanguard-deploy status" ;;
   *) sed -n '2,5p' "$0"; exit 2 ;;