# /etc/systemd/system/shire-academy-ui.service
[Unit]
Description=SHiRE Academy Local UI
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=ray
Group=ray
WorkingDirectory=/home/shire3d/ARMOR/apps/shire-academy
ExecStart=/usr/bin/python3 /home/shire3d/ARMOR/apps/shire-academy/server/shire_academy_server.py --root /home/shire3d/ARMOR/apps/shire-academy/dist --host 127.0.0.1 --port 8790
Restart=on-failure
RestartSec=3
Environment=PYTHONUNBUFFERED=1
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadOnlyPaths=/home/shire3d/ARMOR/apps/shire-academy
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
LockPersonality=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/shire-academy-ui.service.d/30-stage3a-canary-write-boundary.conf
[Service]
# Stage 3A.2: preserve ProtectSystem=strict; carve out only the canary status directory
# and the network-backed SHiRE Academy evidence tree. No backup-root or practice-state writes.
ReadWritePaths=/home/shire3d/ARMOR/apps/shire-academy/runtime
ReadWritePaths=/mnt/shirevault-network/SHiREVault/SHiREAcademy