Skip to content

Last 1 Enterprises — Internal Docs Infrastructure Specification

Version: 0.3 FINAL
Status: Canonical (Phase 0 execution)
Owner: Ryan Curry
Last updated: 2026-08-23
Audience: Engineering, operations, counsel (read-only where noted)
Entity: shared

Purpose

Last 1 Enterprises operates multiple products on sovereign and hybrid infrastructure. Documentation is scattered across product repos (lastvet-gates, last.vet-api, API/web/iOS trees, Muster items, etc.). This spec defines a two-property docs architecture: an auth-gated internal wiki for all entities, and a public LastVet-only surface for veteran-facing trust pages.

Phase 0 delivers the internal shell plus a mass copy of LastVet markdown. Phase 1+ triage, deprecate, and canonicalize without deleting source-repo files.

Two properties

Property Host Repo Auth Audience
Internal wiki internal-docs.last1.enterprises thelast1org/last1-internal-docs (private) Cloudflare Access Last 1 staff, counsel, approved contractors
Public LastVet docs docs.last.vet lastvet-gates (public subtree, future) None Veterans, partners, App Store reviewers

Rule: Internal content never ships to docs.last.vet without explicit export review. Sync is one-way from product repos into internal-docs; never delete or rewrite source repos from the aggregator.

Tooling

  • Generator: MkDocs Material with deliberate theme overrides (not stock theme).
  • Hosting: Cloudflare Pages (build: pip install -r requirements.txt && mkdocs build, output: site/).
  • Internal auth: Cloudflare Access (self-hosted application on internal-docs.last1.enterprises).
  • Aggregation: Scheduled GitHub Actions running scripts/sync-content.sh — not git submodules.

MkDocs plugins (internal repo)

Plugin Role
mkdocs-material Theme, search, navigation
mkdocs-material[imaging] Social / meta cards
mkdocs-glightbox Image lightbox
mkdocs-git-revision-date-localized-plugin Last modified from git
mkdocs-awesome-pages-plugin Flexible nav via .pages files
mkdocs-macros-plugin Variables in markdown (entity name, base URLs)

Frontmatter schema

Every markdown file under content/ must include YAML frontmatter:

---
title: Human-readable page title
entity: lastvet          # see entity list
status: draft            # canonical | historical | deprecated | draft
owner: ryan                # GitHub handle or email local-part
last_updated: 2026-08-23   # ISO date
audience: engineering      # optional: engineering | operations | counsel | all-staff
tags: [security, r940]     # optional list
supersedes: old-slug       # optional
superseded_by: new-slug    # optional
external_slug: null        # optional public slug if exported to docs.last.vet
---

Validation

scripts/validate-frontmatter.py runs in CI on every PR and main build. Missing required fields or invalid status / entity values fail the build.

Content status enum

Status Meaning
canonical Current source of truth for this topic
historical Accurate for a past state; kept for audit
deprecated Do not use for new work; replacement linked
draft Imported or WIP; not yet reviewed

Entity list (flat peers)

Entities are peers, not a hierarchy. Cross-cutting docs use entity: shared.

Entity key Product
lastvet LastVet (veteran health sovereignty)
meridian Meridian (eval / advisor track)
sovereign Sovereign (local inference stack)
angel Angel (encrypted health intelligence)
onset Onset
last1-id last1.id identity
horizon Horizon (ecosystem verification, parked)
realoutcomes RealOutcomes
radiocheck RadioCheck
last1-app last1.app
shared Cross-entity infrastructure, legal, ops

Information architecture (top-level nav)

  1. Getting Started — onboarding, tool access, how to use this wiki
  2. Entities — one section per entity key above
  3. Shared Infrastructure — R940, BWS naming, consolidation plan, observability
  4. Operations — runbooks, deploy procedures, incident response
  5. Legal & Compliance — HIPAA framing, CARIN, counsel decisions (internal)
  6. Archive — deprecated and historical bundles

Navigation is generated/curated via scripts/generate-navigation.py and .pages files for the awesome-pages plugin.

Aggregation (sync) rules

scripts/sync-content.sh:

  1. Pull or use local clones of configured source repos.
  2. Copy *.md (and optional assets) into content/entities/<entity>/ with repo prefix paths:
Source repo Target prefix
lastvet-gates content/entities/lastvet/gates/
last.vet-api content/entities/lastvet/api/
last.vet-web content/entities/lastvet/web/
last.vet-ios content/entities/lastvet/ios/
  1. Conflict: If the same relative path would be written from two sources, exit with error (explicit mapping required).
  2. Frontmatter: Preserve existing frontmatter; if missing, inject baseline (entity: lastvet, status: draft, owner: unknown, last_updated from file mtime).
  3. Idempotent: Safe to re-run; overwrites synced copies only under entity sync prefixes.
  4. Never delete files in source repos.

Phase 0 sync scope: LastVet only (four repos above). Other entities remain placeholder landing pages until Phase 2.

Cloudflare Pages (internal)

  • Project: last1-internal-docs
  • Custom domain: internal-docs.last1.enterprises (CNAME → Pages target; Ryan configures DNS)
  • Build: Python 3.11+, mkdocs build --strict
  • HTTPS: Automatic via Cloudflare; HSTS via Cloudflare SSL/TLS settings

Deploy gate: Cloudflare Access must protect the hostname before custom domain is advertised internally. Default deny; explicit email allow list.

Cloudflare Access (v0.3)

  • Application: self-hosted, internal-docs.last1.enterprises
  • Session: 24 hours
  • IdP: Google Workspace SSO (if configured) and/or one-time PIN email
  • Policy: Allow emails on Ryan-maintained list; placeholders for Robert, WSGR (John, Nguyen), Matt Miclette, Dr. Adam Haim

Ryan updates the allow list; automation does not commit identities to git.

GitHub Actions

Workflow Trigger Actions
sync-nightly.yml Daily 03:00 UTC Run sync, commit if changed
build-deploy.yml Push to main Validate frontmatter, generate nav, mkdocs build --strict, deploy Pages
validate-pr.yml Pull request Same validation/build, no deploy; preview comment when Pages PR previews enabled

Secrets (GitHub repo settings, not in git):

  • CLOUDFLARE_API_TOKEN — Pages deploy
  • CLOUDFLARE_ACCOUNT_ID
  • SYNC_PAT or GitHub App — cross-repo read for nightly sync

Execution phases

Phase Scope Exit criteria
0 (this) Spec, repo shell, MkDocs polish, LastVet mass copy, CI, Pages + Access ready for Ryan DNS test Ryan browses internal site, search works, LastVet section populated
1 LastVet triage: canonical vs draft vs archive Top 20 docs marked canonical; broken links fixed
2 Shared infrastructure + operations nav populated from gates R940, BWS, runbooks indexed
3 Second entity (Meridian or Sovereign) sync + triage Entity landing + canonical set
4 Public docs.last.vet export pipeline Counsel-approved public subset only
5 Nightly sync all entities; deprecation workflow All product repos in sync config

Brand (MkDocs theme)

Internal wiki uses Last 1 Enterprises visual language aligned with last1.org / LastVet deck:

  • Primary teal: #0f766e, deep #0b3f37
  • Accent gold: #d2bd58
  • Slate backgrounds: #2b3a42, #233038
  • Light surface: #f7f5f0
  • Body font: Inter; code: JetBrains Mono

Overrides live in overrides/ in last1-internal-docs.

References

Phase 0 stop line

Automation stops after repo + CI + deploy configuration. Ryan must explicitly approve before:

  1. DNS CNAME for internal-docs.last1.enterprises
  2. Cloudflare Access allow-list production cutover

Until then, use the *.pages.dev preview URL for review.