# Services / Request Flow — atheos-blog-lxc

**Stage**: INCEPTION — Application Design (minimal depth)

There is no service layer to design (no application code). What matters is the **two flows** the
guest supports, and where each can break.

## Flow 1 — Operator edits and commits

```
Browser (LAN)
   │  http://<lxc-ip>/
   ▼
nginx (C2, :80)
   │  location ~ \.php$  →  fastcgi_pass unix:<FPM_SOCKET>     [I-1]
   ▼
php-fpm (C3, php83)
   │  executes as the FPM user
   ▼
Atheos (C4, /var/www/atheos)
   ├── reads/writes  workspace/blog/**            [I-2 write contract]
   └── on Commit:  git (C6)
                     │  safe.directory must include workspace/  [I-3]
                     │  identity UNSET by design (Q1=B)
                     ▼
                commit created in the local clone
```

**Break points**: FPM socket mismatch (502) · unwritable `workspace/` (installer/editor errors) ·
dubious-ownership (git refuses) · missing identity (commit refused until operator sets it).

## Flow 2 — Operator pushes (operator-owned path)

```
Atheos Commit  →  operator adds SSH key + sets git identity  →  remote switched to SSH (operator)
                                                                      │
                                                                      ▼
                                                            Gitea (C8) receives the push
```

The **agent builds the path but does not walk it**: it clones over HTTPS, leaves the remote as-is,
and documents the switch. Pushing is the operator's first hands-on act.

## Flow 3 — Build/publish (OUT OF SCOPE — happens elsewhere)

```
Gitea (C8)  →  existing pipeline (NOT on this guest)  →  make html  →  published site
```

Explicitly excluded (Q1=A). No Python, no pelican, no `make` on this guest. If this flow were
expected here, **C-1's risk profile would change materially** — it is not.

## Provisioning order (what must exist before what)

```
U1 guest  →  U2 nginx+php-fpm  →  U3 Atheos  →  U4 git + clone  →  U5 docs + script
                                                                    ▲
                       U4 also depends on U1 (git) ─────────────────┘
```

Each arrow is a real dependency: installing Atheos before php-fpm leaves nothing to serve it;
cloning before Atheos exists has no workspace to clone into.