diff --git a/.ai-factory/RULES.md b/.ai-factory/RULES.md
new file mode 100644
index 0000000..b5b96ae
--- /dev/null
+++ b/.ai-factory/RULES.md
@@ -0,0 +1,21 @@
+# Project Rules
+
+- No scope creep: implement only the approved PR goal.
+- One PR solves one bounded problem.
+- Prefer small, reviewable changes over broad rewrites.
+- Do read-only review before implementation for non-trivial, security-sensitive, or risky changes.
+- Implement only after human approval when scope affects governance, security, install flows, public access, CI, changelog, or version policy.
+- Do not run privileged commands unless explicitly requested.
+- Do not use sudo unless explicitly requested.
+- Do not run install scripts during planning or review.
+- Do not start containers during planning or review unless explicitly requested.
+- Do not commit secrets or generated secret files.
+- Do not write generated secrets into tracked config files.
+- Do not use `latest` Compose image tags.
+- Do not exact-pin apt packages by default.
+- Ubuntu 24.04 LTS is the primary and priority baseline.
+- Ubuntu 26.04 LTS is the compatibility and validation target.
+- README.md stays short; detailed guidance belongs in docs/.
+- Beginner-facing docs must stay clear and avoid unnecessary jargon.
+- Risky system changes must include verification and rollback notes.
+- Do not broaden into Supabase scope, public Compose override, CI, changelog, version enforcement, or smoke-test evidence unless that is the approved PR goal.
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
new file mode 100644
index 0000000..3e95e2f
--- /dev/null
+++ b/.github/workflows/quality.yml
@@ -0,0 +1,68 @@
+name: Quality
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  static-quality:
+    name: Static quality
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Whitespace check
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git fetch origin "${{ github.base_ref }}" --depth=1
+            git diff --check "origin/${{ github.base_ref }}...HEAD"
+          elif git rev-parse HEAD^ >/dev/null 2>&1; then
+            git diff --check HEAD^..HEAD
+          else
+            git diff --check --root HEAD
+          fi
+
+      - name: Bash syntax check
+        run: bash -n scripts/*.sh scripts/security/*.sh scripts/lib/*.sh
+
+      - name: ShellCheck
+        run: |
+          if ! command -v shellcheck >/dev/null 2>&1; then
+            echo "::error::ShellCheck is not available on this runner. Decide a tool installation strategy in a separate PR."
+            exit 1
+          fi
+          shellcheck -x --severity=warning scripts/*.sh scripts/security/*.sh scripts/lib/*.sh
+
+      - name: Compose base config
+        working-directory: docker-compose
+        run: docker compose --env-file env.example config >/tmp/install_ubuntu_ci_base.yml
+
+      - name: Compose monitoring config
+        working-directory: docker-compose
+        run: docker compose --env-file env.example -f docker-compose.yml -f docker-compose.monitoring.yml config >/tmp/install_ubuntu_ci_monitoring.yml
+
+      - name: Compose latest image guard
+        run: |
+          if grep -RInE 'image:[[:space:]]*.*:latest|image:[[:space:]]*latest' docker-compose/*.yml; then
+            echo "::error::Compose images must not use latest tags."
+            exit 1
+          fi
+
+      - name: Removed public override guard
+        run: |
+          if grep -RInE 'docker-compose.override.public|override.public|compose.override.public' README.md QUICKSTART.md docs docker-compose PLAN.md; then
+            echo "::error::Removed public Compose override is still referenced."
+            exit 1
+          fi
+
+      - name: Tracked secret-file guard
+        run: |
+          tracked_secret_files="$(git ls-files | grep -E '(^|/)\.env$|docker-compose/\.env$|\.env\.local$|\.secret$|\.secrets$|(^|/)secrets\.' || true)"
+          if [ -n "$tracked_secret_files" ]; then
+            echo "::error::Secret-like local files must not be tracked:"
+            printf '%s\n' "$tracked_secret_files"
+            exit 1
+          fi
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..cab9fcb
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,28 @@
+# Local environment and generated secrets
+.env
+docker-compose/.env
+*.env.local
+*.secret
+*.secrets
+secrets.*
+*.key
+*.pem
+
+# Local AI tool state
+.ai-factory.json
+.opencode/
+.ai-factory/plans/
+
+# Backups and logs
+backups/
+logs/
+*.log
+
+# Local temporary artifacts
+tmp/
+.tmp/
+*.tmp
+*.swp
+*.swo
+*~
+.DS_Store
diff --git a/PLAN.md b/PLAN.md
index 9e3fd02..4183ec0 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -11,6 +11,21 @@ This file stays in the repository root as a project roadmap and quality-gate tra
 - Record quality gates that still require manual validation.
 - Avoid duplicating step-by-step installation docs.
 
+## Current PR-Sized Roadmap
+
+| Phase | Status | Notes |
+|---|---|---|
+| Secrets safety PR | ✅ Completed | Committed as `89ab2bb fix: harden generated secrets handling`. |
+| Project governance baseline | 🔄 Current | Add requirements, version policy, acceptance criteria, and roadmap links. |
+| Ubuntu 26.04 compatibility validation | ⏳ Planned | Validate packages, scripts, Docker, Compose and profile ready checks before compatibility claims. |
+| Supabase scope clarity | 🔄 Current | Narrow docs-only scope: current support is PostgreSQL with selected Supabase-related components; Full Supabase implementation is not approved and deferred. |
+| Public Compose override correctness | 🔄 Current | Remove unsafe direct Compose exposure docs/file; keep SSH tunnel and Nginx/reverse proxy as public access paths. |
+| Version policy enforcement | ⏳ Planned | Align package/image handling with `docs/version-policy.md`. |
+| CI/quality gates | ⏳ Planned | Add automated syntax, lint and documentation checks in a separate PR. |
+| Clean Ubuntu 24.04 VM smoke-test evidence | ⏳ Planned | Capture clean VM evidence for supported profile flows before release readiness claims. |
+| Changelog/release readiness | ⏳ Planned | Decide changelog/release notes format and update process. |
+| ai-factory rules proposal/review | ⏳ Planned | Review project rules separately; do not track `.ai-factory.json` or `.opencode/` without explicit approval. |
+
 ---
 
 # План приведения проекта к лучшим практикам
@@ -129,7 +144,7 @@ This file stays in the repository root as a project roadmap and quality-gate tra
 - `supabase_meta` добавлен, `supabase_studio` связан через `depends_on`
 - `pgbouncer` добавлен для connection pooling
 - Порты: Redis `127.0.0.1:6379`, PostgreSQL `127.0.0.1:54322`, PgBouncer `127.0.0.1:6432`
-- `docker-compose.override.public.yml` — для публичного доступа (опционально)
+- Публичный доступ: SSH tunnel для admin access или Nginx/reverse proxy для reviewed public access; direct Compose exposure не используется
 
 Минимальные проверки:
 ```bash
diff --git a/QUICKSTART.md b/QUICKSTART.md
index 10288d1..c85b39b 100644
--- a/QUICKSTART.md
+++ b/QUICKSTART.md
@@ -10,9 +10,9 @@
 | `proxy` | 512MB-1GB RAM, 10GB disk | база под x-ui/3x-ui/VPN/proxy panel |
 | `docker-host` | 1GB RAM, 10GB disk | маленький Docker host |
 | `web` | 1GB RAM, 15GB disk | web/app VPS с HTTP/HTTPS |
-| `ai-stack` | 4GB RAM, 50GB disk | n8n, Supabase/PostgreSQL, Redis, pgvector, monitoring |
+| `ai-stack` | 4GB RAM, 50GB disk | n8n, PostgreSQL/Supabase-related components, Redis, pgvector, monitoring |
 
-Общее: Ubuntu 22.04 LTS или 24.04 LTS, root/sudo доступ, рабочий SSH. Для bare metal с новым железом сначала проверьте [драйверы и совместимость](docs/08-hardware-drivers.md).
+Общее: Ubuntu 24.04 LTS как primary baseline, root/sudo доступ, рабочий SSH. Ubuntu 26.04 LTS — compatibility/validation target, не fully validated primary support. Для bare metal с новым железом сначала проверьте [драйверы и совместимость](docs/08-hardware-drivers.md).
 
 ## 1. Получите проект
 
@@ -108,7 +108,7 @@ sudo bash scripts/99-ready-checks.sh --profile web
 
 ## 7. AI Automation Stack
 
-Используйте для полного Docker Compose stack: n8n, Supabase/PostgreSQL, Redis, pgvector, PgBouncer, monitoring и backups.
+Используйте для Docker Compose stack: n8n, PostgreSQL with selected Supabase-related components, Redis, pgvector, PgBouncer, monitoring и backups.
 
 ```bash
 sudo bash scripts/00-preflight-check.sh --profile ai-stack
@@ -121,14 +121,14 @@ docker compose ps
 sudo bash ../scripts/99-ready-checks.sh --profile ai-stack
 ```
 
-По умолчанию PostgreSQL, Redis, Supabase Studio и n8n привязаны к `127.0.0.1`. Для внешнего доступа используйте SSH tunnel или [Nginx](docs/07-nginx.md).
+По умолчанию PostgreSQL, Redis, Supabase Studio и n8n привязаны к `127.0.0.1`. Для внешнего доступа используйте SSH tunnel или [Nginx](docs/07-nginx.md); do not expose admin services through direct Compose ports.
 
 Критичные переменные в `docker-compose/.env`:
 
 | Переменная | Назначение |
 |------------|------------|
 | `REDIS_PASSWORD` | пароль Redis |
-| `SUPABASE_DB_PASSWORD` | пароль PostgreSQL/Supabase |
+| `SUPABASE_DB_PASSWORD` | пароль PostgreSQL (`supabase_db`) |
 | `N8N_BASIC_AUTH_PASSWORD` | пароль n8n |
 | `N8N_ENCRYPTION_KEY` | ключ шифрования n8n |
 | `N8N_USER_MANAGEMENT_JWT_SECRET` | JWT secret n8n |
diff --git a/README.md b/README.md
index 0cd4413..90ef947 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ Most self-hosted projects need the same foundation before product work starts:
 
 - hardened SSH access, firewall, fail2ban and security updates;
 - Docker and Docker Compose installed correctly when containers are needed;
-- PostgreSQL/Supabase, Redis and pgvector for AI workflows and RAG on larger hosts;
+- PostgreSQL with selected Supabase-related components, Redis and pgvector for AI workflows and RAG on larger hosts;
 - n8n main/worker setup for automation pipelines on the `ai-stack` profile;
 - Nginx, SSL, monitoring, backups and readiness checks when the selected profile needs them.
 
@@ -24,7 +24,7 @@ This repo turns that foundation into documented steps, scripts and compose files
 |------|----------|
 | Server baseline | Ubuntu hardening, SSH keys, UFW, fail2ban, unattended upgrades |
 | Container runtime | Docker Engine, Docker Compose, daemon configuration |
-| AI automation stack | n8n, Redis, Supabase/PostgreSQL, pgvector, PgBouncer for `ai-stack` |
+| AI automation stack | n8n, Redis, PostgreSQL with selected Supabase-related components, pgvector, PgBouncer for `ai-stack` |
 | Production support | Nginx reverse proxy, SSL path, monitoring, backups, ready checks |
 | Safety | Secret generation, closed local ports, healthchecks, version-pinned compose |
 | Documentation | Step-by-step guides for VPS and local server installation |
@@ -37,7 +37,7 @@ This repo turns that foundation into documented steps, scripts and compose files
 | `proxy` | Base for x-ui/3x-ui/VPN/proxy panel | minimal path + explicit service ports |
 | `docker-host` | Small container host | minimal path + Docker install |
 | `web` | Small web/app server | minimal path + HTTP/HTTPS reverse proxy |
-| `ai-stack` | Full n8n/Supabase/Redis/pgvector stack | Docker, secrets, compose stack, service ready checks |
+| `ai-stack` | n8n, Redis, PostgreSQL/Supabase-related components, pgvector stack | Docker, secrets, compose stack, service ready checks |
 
 `4GB RAM / 50GB disk` belongs to `ai-stack`, not to every VPS. A `1 vCPU / 1GB RAM` server can still be valid for `minimal` or `proxy` with warnings.
 
@@ -71,7 +71,7 @@ For the full installation path, use [QUICKSTART.md](QUICKSTART.md). To understan
 
 - Prepare a VPS for AI assistants and Telegram bots.
 - Run n8n workflows with Redis queue mode and PostgreSQL storage.
-- Build a self-hosted RAG base with Supabase/PostgreSQL and pgvector.
+- Build a self-hosted RAG base with PostgreSQL, selected Supabase-related components and pgvector.
 - Standardize repeatable infrastructure setup for client AI automation projects.
 - Keep deployment knowledge in scripts and docs instead of one-off terminal history.
 
@@ -91,6 +91,9 @@ For the full installation path, use [QUICKSTART.md](QUICKSTART.md). To understan
 | Guide | Description |
 |-------|-------------|
 | [Quick Start](QUICKSTART.md) | End-to-end installation path |
+| [Project Requirements](docs/project-requirements.md) | Scope, baseline and change-control rules |
+| [Version Policy](docs/version-policy.md) | Ubuntu packages, Docker and Compose image version rules |
+| [Acceptance Criteria](docs/acceptance-criteria.md) | Profile-level readiness expectations |
 | [System Requirements](requirements/system-requirements.md) | CPU, RAM, disk and OS requirements |
 | [VPS Profiles](docs/profiles.md) | Minimal, proxy, docker-host, web and ai-stack profiles |
 | [Server Security](docs/01-server-security.md) | SSH, UFW, fail2ban and hardening |
@@ -101,7 +104,7 @@ For the full installation path, use [QUICKSTART.md](QUICKSTART.md). To understan
 | [Infrastructure Setup](docs/03-infrastructure-setup.md) | Stack overview and deployment order |
 | [Architecture](docs/architecture.md) | Runtime components and data flow |
 | [Architecture Operations](docs/architecture-operations.md) | Scaling, backups and performance notes |
-| [Supabase](docs/03-supabase.md) | Self-hosted Supabase setup |
+| [Supabase scope](docs/03-supabase.md) | PostgreSQL with Supabase-related Meta/Studio components |
 | [n8n](docs/04-n8n.md) | n8n main/worker deployment |
 | [Redis](docs/05-redis.md) | Redis setup for queues and caching |
 | [pgvector](docs/06-vector-db.md) | Vector search setup for RAG |
diff --git a/docker-compose/docker-compose.override.public.yml b/docker-compose/docker-compose.override.public.yml
deleted file mode 100644
index 98dee97..0000000
--- a/docker-compose/docker-compose.override.public.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-version: '3.8'
-
-services:
-  n8n:
-    ports:
-      - "5678:5678"
-
-  supabase_studio:
-    ports:
-      - "54323:3000"
-
-  prometheus:
-    ports:
-      - "9090:9090"
-
-  grafana:
-    ports:
-      - "3000:3000"
diff --git a/docs/01-server-security.md b/docs/01-server-security.md
index 52a4e37..84100e6 100644
--- a/docs/01-server-security.md
+++ b/docs/01-server-security.md
@@ -105,7 +105,7 @@ systemctl status unattended-upgrades --no-pager
 ## Источники
 
 - [Ubuntu Security Documentation](https://ubuntu.com/security)
-- [DigitalOcean Security Best Practices](https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-22-04)
+- [Ubuntu Server Documentation](https://documentation.ubuntu.com/server/)
 - [UFW Documentation](https://help.ubuntu.com/community/UFW)
 
 ## See Also
diff --git a/docs/02-docker-installation.md b/docs/02-docker-installation.md
index d673eb9..3669a49 100644
--- a/docs/02-docker-installation.md
+++ b/docs/02-docker-installation.md
@@ -6,7 +6,7 @@
 
 ## Предварительные требования
 
-- Ubuntu 22.04 LTS или Ubuntu 24.04 LTS
+- Ubuntu 24.04 LTS primary baseline. Ubuntu 26.04 LTS is a compatibility/validation target only.
 - Права root или sudo
 - Стабильное интернет-соединение
 
diff --git a/docs/03-infrastructure-setup.md b/docs/03-infrastructure-setup.md
index 205a35e..968c5d7 100644
--- a/docs/03-infrastructure-setup.md
+++ b/docs/03-infrastructure-setup.md
@@ -2,7 +2,7 @@
 
 # Инфраструктура для мультиагентных ассистентов
 
-Это руководство описывает установку и настройку всех компонентов инфраструктуры для мультиагентных ассистентов на базе n8n с Supabase, Redis и pgvector.
+Это руководство описывает установку и настройку компонентов инфраструктуры для мультиагентных ассистентов на базе n8n, PostgreSQL with selected Supabase-related components, Redis и pgvector.
 
 ## Предварительные требования
 
@@ -16,7 +16,7 @@
 
 ## Обзор компонентов
 
-- **Supabase** - Self-hosted база данных PostgreSQL с аутентификацией и API
+- **PostgreSQL/Supabase-related components** - PostgreSQL using Supabase Postgres image, Supabase Meta and Studio where implemented
 - **pgvector** - Расширение PostgreSQL для векторного поиска
 - **PgBouncer** - пул соединений PostgreSQL (для n8n)
 - **Redis** - Кэш и очередь задач
@@ -27,7 +27,7 @@
 
 Каждый компонент имеет отдельное руководство:
 
-1. **[Установка Supabase](03-supabase.md)** - Self-hosted PostgreSQL с pgvector
+1. **[Supabase-related PostgreSQL](03-supabase.md)** - PostgreSQL с Supabase Meta/Studio и pgvector
 2. **[Установка Redis](05-redis.md)** - Кэш и очередь задач
 3. **[Настройка векторной БД](06-vector-db.md)** - pgvector таблицы и функции
 4. **[Установка n8n](04-n8n.md)** - Платформа автоматизации с воркерами
@@ -42,25 +42,31 @@
 
 ## Рекомендуемый порядок установки
 
-1. **Supabase** - базовая инфраструктура БД
+0. **Secrets** - обязательный `.env` для `ai-stack`
+   ```bash
+   sudo bash scripts/12-generate-secrets.sh --profile ai-stack
+   ```
+   См. [13-secrets.md](13-secrets.md) для подробностей.
+
+1. **PostgreSQL with selected Supabase-related components** - базовая инфраструктура БД
    ```bash
    sudo bash scripts/04-setup-supabase.sh
    ```
    См. [03-supabase.md](03-supabase.md) для подробностей
 
-2. **Redis** - очередь задач (можно установить параллельно с Supabase)
+2. **Redis** - очередь задач (можно установить параллельно с PostgreSQL)
    ```bash
    sudo bash scripts/06-setup-redis.sh
    ```
    См. [05-redis.md](05-redis.md) для подробностей
 
-3. **Векторная БД** - настройка pgvector в Supabase
+3. **Векторная БД** - настройка pgvector в PostgreSQL
    ```bash
    sudo bash scripts/07-setup-vector-db.sh
    ```
    См. [06-vector-db.md](06-vector-db.md) для подробностей
 
-4. **n8n** - требует Supabase и Redis
+4. **n8n** - требует PostgreSQL и Redis
    ```bash
    sudo bash scripts/05-setup-n8n.sh
    ```
@@ -76,17 +82,17 @@ cd docker-compose
 docker compose --env-file .env up -d
 ```
 
-Для публичного доступа (опционально):
-```bash
-docker compose -f docker-compose.yml -f docker-compose.override.public.yml up -d
-```
+Не запускайте `scripts/12-generate-secrets.sh` для `minimal`, `proxy`, `docker-host` или `web`: эти профили не используют compose secrets.
+
+Доступ по умолчанию остаётся только через localhost. Для админского доступа используйте SSH tunnel, например `ssh -L 5678:127.0.0.1:5678 user@server`, а для reviewed public access используйте [Nginx/reverse proxy](07-nginx.md).
 
 Примечания:
 - Порты БД и Redis привязаны к `127.0.0.1` для безопасности.
-- Для внешнего доступа используйте SSH‑туннель или reverse proxy.
+- Supabase Studio, n8n, Prometheus и Grafana не должны публиковаться наружу напрямую через direct Compose ports.
+- Для внешнего доступа используйте SSH‑туннель или Nginx/reverse proxy.
 - Supabase Studio требует сервис `supabase_meta` (он включён в compose).
 - n8n подключается к БД через PgBouncer (`localhost:6432` для хоста).
-- n8n по умолчанию доступен только на `127.0.0.1`, для внешнего доступа используйте override.
+- n8n по умолчанию доступен только на `127.0.0.1`; не открывайте его direct Compose port публично.
 - Для production используйте защищённый `.env` или Docker secrets.
 - Рекомендуется регулярная ротация паролей (минимум раз в 90 дней).
 
@@ -145,5 +151,5 @@ docker exec redis redis-cli -a YOUR_PASSWORD --rdb /data/dump.rdb
 ## See Also
 
 - [Architecture](architecture.md) — компоненты и потоки данных.
-- [Supabase](03-supabase.md) — база данных и pgvector foundation.
+- [Supabase scope](03-supabase.md) — PostgreSQL and implemented Supabase-related components.
 - [n8n](04-n8n.md) — automation runtime поверх инфраструктуры.
diff --git a/docs/03-supabase.md b/docs/03-supabase.md
index 8bd12f8..6499092 100644
--- a/docs/03-supabase.md
+++ b/docs/03-supabase.md
@@ -1,199 +1,89 @@
 [← Architecture Operations](architecture-operations.md) · [Back to README](../README.md) · [n8n →](04-n8n.md)
 
-# Установка Supabase (Self-hosted)
+# PostgreSQL With Supabase-Related Components
 
-Supabase предоставляет PostgreSQL базу данных с дополнительными функциями: аутентификация, хранилище, real-time подписки.
+This repository does not currently provide full self-hosted Supabase. The supported scope is PostgreSQL with selected Supabase-related components where they are actually implemented in `docker-compose/docker-compose.yml`.
 
-## Предварительные требования
+## Current Scope
 
-- Docker и Docker Compose установлены ([Этап 2](02-docker-installation.md))
-- Минимум 2 GB RAM для Supabase
-- Порты: 54321 (API), 54322 (DB), 54323 (Studio)
+Implemented for `ai-stack`:
+- PostgreSQL using the Supabase Postgres image (`supabase_db`).
+- `pgvector` setup through `docker-compose/supabase/init.sql` and [pgvector](06-vector-db.md).
+- Supabase Meta (`supabase_meta`) for Studio metadata access.
+- Supabase Studio (`supabase_studio`) as a local admin UI.
+- PgBouncer, Redis, n8n and n8n worker as part of the broader AI automation stack.
 
-## Шаг 1: Установка Supabase CLI
+Not implemented in the current stack:
+- Supabase Auth / GoTrue.
+- PostgREST / REST API.
+- Supabase Realtime.
+- Supabase Storage.
+- Edge Functions.
+- Kong / API gateway.
+- Full self-hosted Supabase platform support.
 
-```bash
-# Установка через npm (требуется Node.js)
-npm install -g supabase
+Full Supabase is deferred and not current support.
 
-# Или через Docker (рекомендуется)
-docker pull supabase/cli:latest
-```
+## Component Matrix
 
-## Шаг 2: Инициализация проекта
+| Component | Current status | Documentation wording |
+|---|---|---|
+| PostgreSQL / Supabase Postgres image | Present | PostgreSQL using Supabase Postgres image |
+| pgvector | Present | pgvector on PostgreSQL |
+| Supabase Meta | Present | selected Supabase-related component for Studio |
+| Supabase Studio | Present | optional local Studio UI |
+| PgBouncer | Present | PostgreSQL connection pooling |
+| Redis | Present | queue/cache component |
+| n8n | Present | automation runtime |
+| Supabase Auth / GoTrue | Not implemented | not part of the current implemented stack |
+| PostgREST / REST API | Not implemented | not part of the current implemented stack |
+| Supabase Realtime | Not implemented | not part of the current implemented stack |
+| Supabase Storage | Not implemented | not part of the current implemented stack |
+| Edge Functions | Not implemented | not part of the current implemented stack |
+| Kong / API gateway | Not implemented | not part of the current implemented stack |
 
-```bash
-# Создаём директорию для проекта
-mkdir -p ~/supabase
-cd ~/supabase
+## Prerequisites
 
-# Инициализируем проект
-supabase init
-```
+- Docker and Docker Compose installed: [Docker Installation](02-docker-installation.md).
+- Generated local secrets in `docker-compose/.env`: [Secrets](13-secrets.md).
+- `ai-stack` resources from [System Requirements](../requirements/system-requirements.md).
 
-## Шаг 3: Настройка конфигурации
+## Startup Path
 
-Редактируем `supabase/config.toml`:
+Use the canonical `ai-stack` flow from [Quick Start](../QUICKSTART.md). The current compose stack starts the implemented services only; it does not start Auth, REST API, Realtime, Storage, Edge Functions or an API gateway.
 
-```toml
-[project]
-# Имя проекта
-name = "my-project"
-
-[auth]
-# Настройки аутентификации
-site_url = "http://localhost:3000"
-additional_redirect_urls = ["https://yourdomain.com"]
-
-[api]
-# Порт API Gateway
-port = 54321
-schemas = ["public", "storage", "graphql_public"]
-extra_search_path = ["public", "extensions"]
-
-[db]
-# Порт PostgreSQL
-port = 54322
-# Пароль для postgres пользователя (ИЗМЕНИТЕ!)
-password = "your-super-secret-password"
-```
-
-Или используйте готовый файл конфигурации: `docker-compose/supabase/config.toml`
-
-## Шаг 4: Запуск Supabase
-
-```bash
-# Запуск через Docker Compose
-supabase start
-
-# Или используя наш скрипт
-sudo bash scripts/04-setup-supabase.sh
-```
-
-## Шаг 5: Получение API ключей
-
-После запуска Supabase выведет информацию о подключении:
+For component scripts, `scripts/04-setup-supabase.sh` starts `supabase_db` only. Use the full compose flow when you need `supabase_meta` and `supabase_studio` as well.
 
-```bash
-supabase status
-```
-
-Сохраните:
-- **API URL**: `http://localhost:54321`
-- **anon key**: публичный ключ для клиентских приложений
-- **service_role key**: секретный ключ для серверных операций
-- **DB URL**: строка подключения к PostgreSQL
-
-## Шаг 6: Настройка pgvector расширения
-
-pgvector уже включён в Supabase. Проверяем:
-
-```bash
-# Подключаемся к базе данных
-psql postgresql://postgres:your-password@localhost:54322/postgres
+## Local Endpoints
 
-# В psql выполняем:
-CREATE EXTENSION IF NOT EXISTS vector;
-\dx  # Проверяем установленные расширения
-\q
-```
+| Service | Local endpoint | Notes |
+|---|---|---|
+| PostgreSQL | `localhost:54322` | Password is `SUPABASE_DB_PASSWORD` in local `.env`; do not print it. |
+| PgBouncer | `localhost:6432` | Used by n8n for PostgreSQL connection pooling. |
+| Supabase Studio | `http://localhost:54323` | Local UI backed by `supabase_meta`. |
 
-Или используйте скрипт настройки векторной БД: [см. установку pgvector](06-vector-db.md)
+These ports are bound to `127.0.0.1` in the default compose file. For external access, use SSH tunnel or a reviewed Nginx/reverse proxy path.
 
-## Шаг 7: Создание начальной схемы БД
+## pgvector
 
-Пример SQL для создания таблицы с векторами (уже включён в `docker-compose/supabase/init.sql`):
+`pgvector` setup is documented in [pgvector](06-vector-db.md). The SQL source of truth is `docker-compose/supabase/init.sql`.
 
-```sql
--- Создаём таблицу для хранения документов с эмбеддингами
-CREATE TABLE documents (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  content TEXT NOT NULL,
-  embedding vector(1536),  -- Размерность для OpenAI embeddings
-  metadata JSONB,
-  created_at TIMESTAMPTZ DEFAULT NOW()
-);
-
--- Создаём индекс для векторного поиска (HNSW)
-CREATE INDEX ON documents 
-USING hnsw (embedding vector_cosine_ops);
-
--- Функция для поиска похожих документов
-CREATE OR REPLACE FUNCTION match_documents(
-  query_embedding vector(1536),
-  match_threshold float DEFAULT 0.7,
-  match_count int DEFAULT 10
-)
-RETURNS TABLE (
-  id UUID,
-  content TEXT,
-  similarity float,
-  metadata JSONB
-)
-LANGUAGE plpgsql
-AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    documents.id,
-    documents.content,
-    1 - (documents.embedding <=> query_embedding) as similarity,
-    documents.metadata
-  FROM documents
-  WHERE 1 - (documents.embedding <=> query_embedding) > match_threshold
-  ORDER BY documents.embedding <=> query_embedding
-  LIMIT match_count;
-END;
-$$;
-```
-
-## Проверка работы
-
-```bash
-# Проверка статуса
-supabase status
-
-# Проверка подключения к БД
-docker exec supabase_db psql -U postgres -c "SELECT version();"
-
-# Доступ к Studio (если включён)
-# http://localhost:54323
-```
-
-## Устранение неполадок
-
-### Проблема: Не удаётся запустить Supabase
-
-```bash
-# Проверьте логи
-docker logs supabase_db
-
-# Проверьте порты
-sudo netstat -tlnp | grep 5432
-```
-
-### Проблема: Ошибки подключения к БД
-
-```bash
-# Проверьте пароль в config.toml
-# Проверьте, что контейнер запущен
-docker ps | grep supabase
-```
-
-## Следующие шаги
-
-После установки Supabase:
-1. Настройте векторную БД: [06-vector-db.md](06-vector-db.md)
-2. Установите Redis: [05-redis.md](05-redis.md)
-3. Установите n8n: [04-n8n.md](04-n8n.md)
-
-## Источники
-
-- [Официальная документация Supabase Self-hosting](https://supabase.com/docs/guides/self-hosting)
-- [Документация pgvector](https://github.com/pgvector/pgvector)
+Safe checks should avoid printing secrets. Prefer commands that use existing environment handling or run through documented scripts instead of pasting passwords into terminal history.
+
+## Troubleshooting
+
+If PostgreSQL is not reachable:
+- Check that the `supabase_db` service is running.
+- Check logs for `supabase_db` without printing `.env` contents.
+- Confirm `docker-compose/.env` exists and was generated through [Secrets](13-secrets.md).
+
+If Studio is not reachable:
+- Check that both `supabase_meta` and `supabase_studio` are running in the compose stack.
+- Confirm access uses `http://localhost:54323` unless a reviewed reverse proxy path is configured.
 
 ## See Also
 
-- [pgvector](06-vector-db.md) — настройка vector search поверх PostgreSQL.
-- [Secrets](13-secrets.md) — управление паролями Supabase и `.env`.
-- [Backups](10-backup-restore.md) — резервное копирование PostgreSQL.
+- [Infrastructure Setup](03-infrastructure-setup.md) — AI stack component order.
+- [pgvector](06-vector-db.md) — vector search setup on PostgreSQL.
+- [Secrets](13-secrets.md) — `.env` generation and rotation.
+- [Backups](10-backup-restore.md) — PostgreSQL backup and restore.
diff --git a/docs/09-monitoring.md b/docs/09-monitoring.md
index afd68a8..95cdf68 100644
--- a/docs/09-monitoring.md
+++ b/docs/09-monitoring.md
@@ -36,6 +36,7 @@ docker compose -f docker-compose.yml -f docker-compose.monitoring.yml ps
 Примечание:
 - Порты мониторинга привязаны к `127.0.0.1`.
 - Для внешнего доступа используйте SSH‑туннель или reverse proxy.
+- Do not expose Prometheus or Grafana through direct Compose ports.
 
 ## 4. Источники метрик
 В базовой конфигурации Prometheus собирает метрики n8n по `/metrics`:
diff --git a/docs/13-secrets.md b/docs/13-secrets.md
index 198e2f6..a74ca0d 100644
--- a/docs/13-secrets.md
+++ b/docs/13-secrets.md
@@ -9,16 +9,15 @@
 cd docker-compose
 cp env.example .env
 nano .env
-```
-
-Ограничьте доступ:
-```bash
 chmod 600 .env
 ```
 
+`docker-compose/.env` является локальным runtime-файлом и игнорируется git. Не добавляйте его в commit.
+
 Рекомендации:
-- Не коммитьте `.env` в git.
-- Храните резервную копию секретов в менеджере паролей.
+- Не коммитьте `.env` или другие generated secret files в git.
+- Храните резервную копию секретов в password manager.
+- Не записывайте сгенерированные secrets в tracked config files, включая `docker-compose/supabase/config.toml`.
 
 ## 2. Генерация секретов
 ```bash
@@ -30,6 +29,8 @@ openssl rand -base64 24 | tr -d "=+/" | cut -c1-32
 sudo bash scripts/12-generate-secrets.sh --profile ai-stack
 ```
 
+`scripts/12-generate-secrets.sh` — канонический генератор secrets для compose stack. Скрипт создаёт или обновляет только локальный `docker-compose/.env`, выставляет права `600` и не пишет реальные secrets в tracked config files.
+
 Скрипт предназначен только для `ai-stack`. Для `minimal`, `proxy`, `docker-host` и `web` файл `docker-compose/.env` не требуется.
 
 ## 3. Ротация секретов
diff --git a/docs/acceptance-criteria.md b/docs/acceptance-criteria.md
new file mode 100644
index 0000000..7775ea2
--- /dev/null
+++ b/docs/acceptance-criteria.md
@@ -0,0 +1,79 @@
+# Acceptance Criteria
+
+[Back to README](../README.md) | [Profiles](profiles.md) | [Quality Checks](12-quality-checks.md) | [Ready Rules](14-ready-rules.md)
+
+## Purpose
+
+This document defines profile-level acceptance criteria. It does not replace [QUICKSTART](../QUICKSTART.md), [Scripts Order](15-scripts-order.md), or detailed component docs.
+
+## Common Criteria
+
+- Ubuntu 24.04 LTS is the clean VM smoke-test baseline.
+- Ubuntu 26.04 LTS compatibility must be validated separately before compatibility claims.
+- Preflight must be run for the selected profile before install steps.
+- Ready checks must be run for the same profile after install steps.
+- Risky changes need rollback or recovery notes.
+- Internal services must remain closed unless a documented public access path exists.
+
+## minimal
+
+- Required preflight: `scripts/00-preflight-check.sh --profile minimal`.
+- Expected installed components: SSH key path, security baseline, firewall, fail2ban, unattended security updates where applicable.
+- Required open ports: SSH only, using the configured SSH port.
+- Ports that must remain closed: HTTP, HTTPS, Docker, database, cache, dashboard, and automation service ports unless explicitly added later.
+- Verification commands: profile ready check, SSH reconnect test, firewall status review, fail2ban status review.
+- Rollback/recovery expectations: keep a working SSH session open during hardening and document how to restore SSH access if key or firewall settings fail.
+- Clean Ubuntu 24.04 VM smoke-test expectations: preflight and ready checks pass for `minimal` without Docker or `.env` requirements.
+- Ubuntu 26.04 compatibility validation expectations: confirm package names, SSH, UFW, fail2ban, and unattended-upgrades behavior before claiming compatibility.
+
+## proxy
+
+- Required preflight: `scripts/00-preflight-check.sh --profile proxy`.
+- Expected installed components: minimal security baseline plus explicit firewall allowance only for chosen proxy/VPN service ports.
+- Required open ports: SSH and the human-approved proxy/VPN service ports.
+- Ports that must remain closed: unknown panel ports, database ports, Docker API, Redis, PostgreSQL, PgBouncer, n8n, monitoring, and dashboards.
+- Verification commands: profile ready check, firewall status review, and manual confirmation that only approved service ports are open.
+- Rollback/recovery expectations: document how to remove an allowed service port and keep SSH recovery available.
+- Clean Ubuntu 24.04 VM smoke-test expectations: proxy baseline can complete without installing a third-party proxy panel.
+- Ubuntu 26.04 compatibility validation expectations: validate firewall and package behavior before documenting compatibility.
+
+## docker-host
+
+- Required preflight: `scripts/00-preflight-check.sh --profile docker-host`.
+- Expected installed components: minimal security baseline, Docker Engine, Docker Compose plugin, Docker service enabled.
+- Required open ports: SSH only by default.
+- Ports that must remain closed: Docker API, database, cache, dashboards, and application ports unless an explicit app deployment opens them.
+- Verification commands: profile ready check, `docker --version`, `docker compose version`, and Docker service status.
+- Rollback/recovery expectations: document how to stop Docker workloads and remove or disable Docker if installation causes system issues.
+- Clean Ubuntu 24.04 VM smoke-test expectations: Docker install and ready checks pass without deploying the AI stack.
+- Ubuntu 26.04 compatibility validation expectations: validate the official Docker stable apt repository flow before claiming compatibility.
+
+## web
+
+- Required preflight: `scripts/00-preflight-check.sh --profile web`.
+- Expected installed components: minimal security baseline and Nginx/reverse proxy path.
+- Required open ports: SSH, HTTP `80/tcp`, and HTTPS `443/tcp` when the web profile is intentionally enabled.
+- Ports that must remain closed: database, cache, Docker API, internal dashboards, and internal automation service ports.
+- Verification commands: profile ready check, Nginx config test, firewall status review, and local HTTP/HTTPS health checks where configured.
+- Rollback/recovery expectations: document how to disable a site, revert an Nginx config, and keep SSH recovery available.
+- Clean Ubuntu 24.04 VM smoke-test expectations: web baseline can expose only HTTP/HTTPS plus SSH and pass profile ready checks.
+- Ubuntu 26.04 compatibility validation expectations: validate Nginx package behavior and service management before claiming compatibility.
+
+## ai-stack
+
+- Required preflight: `scripts/00-preflight-check.sh --profile ai-stack`.
+- Expected installed components: Docker Engine, Docker Compose plugin, generated local secrets, PostgreSQL with selected Supabase-related components where implemented, Redis, pgvector, PgBouncer, n8n, monitoring path, backups, and ready checks.
+- Required open ports: SSH plus Nginx/reverse proxy ports when public access is intentionally configured. SSH tunnel is acceptable for admin access.
+- Ports that must remain closed: PostgreSQL, Redis, PgBouncer, implemented Supabase-related local ports, n8n, Prometheus, Grafana, and direct Compose-published service ports unless an advanced explicit public access mode is reviewed separately.
+- Verification commands: profile ready check, `docker compose config`, `docker compose ps`, service health checks, and backup readiness checks.
+- Rollback/recovery expectations: document how to stop the stack without deleting data, how to avoid `docker compose down -v` unless data removal is intentional, and how to restore from backup.
+- Clean Ubuntu 24.04 VM smoke-test expectations: selected `ai-stack` services start from generated local secrets and pass ready checks without public direct Compose exposure. Full Supabase platform services are not part of the current implemented stack.
+- Ubuntu 26.04 compatibility validation expectations: validate Docker, Compose, service images, health checks, and backup/restore behavior before claiming compatibility.
+
+## Related Docs
+
+- [Scripts Order](15-scripts-order.md)
+- [Quality Checks](12-quality-checks.md)
+- [Ready Rules](14-ready-rules.md)
+- [Secrets](13-secrets.md)
+- [Version Policy](version-policy.md)
diff --git a/docs/profiles.md b/docs/profiles.md
index f486c52..2394a7d 100644
--- a/docs/profiles.md
+++ b/docs/profiles.md
@@ -12,7 +12,7 @@
 | `proxy` | x-ui/3x-ui/VPN/proxy panel base | 512MB-1GB RAM, 10GB disk | minimal flow + явные service ports |
 | `docker-host` | Маленький Docker host | 1GB RAM, 10GB disk | minimal flow + Docker install |
 | `web` | Небольшой web/app VPS | 1GB RAM, 15GB disk | minimal flow + Nginx/reverse proxy |
-| `ai-stack` | n8n/Supabase/Redis/pgvector stack | 4GB RAM, 50GB disk | Docker, secrets, compose stack, ready checks |
+| `ai-stack` | n8n, Redis, PostgreSQL/Supabase-related components, pgvector stack | 4GB RAM, 50GB disk | Docker, secrets, compose stack, ready checks |
 
 ## Optional Swap For Small VPS
 
@@ -109,7 +109,7 @@ docker compose --env-file .env up -d
 sudo bash ../scripts/99-ready-checks.sh --profile ai-stack
 ```
 
-`ai-stack` включает тяжёлые сервисы: Supabase/PostgreSQL, Redis, pgvector, PgBouncer, n8n, monitoring path. Не используйте его как default для маленького VPS.
+`ai-stack` включает тяжёлые сервисы: PostgreSQL with selected Supabase-related components, Redis, pgvector, PgBouncer, n8n, monitoring path. Не используйте его как default для маленького VPS.
 
 ## See Also
 
diff --git a/docs/project-requirements.md b/docs/project-requirements.md
new file mode 100644
index 0000000..d6e7757
--- /dev/null
+++ b/docs/project-requirements.md
@@ -0,0 +1,117 @@
+# Project Requirements
+
+[Back to README](../README.md) | [Profiles](profiles.md) | [Quality Checks](12-quality-checks.md) | [Ready Rules](14-ready-rules.md)
+
+## Purpose
+
+`install_ubuntu` is a staged Ubuntu/VPS bootstrap project. It helps beginner Linux administrators and practical IT administrators prepare servers through visible, reviewable stages. It is not a blind one-command production installer.
+
+## Scope
+
+- Prepare Ubuntu/VPS hosts through documented stages.
+- Keep security hardening, Docker setup, web/proxy setup, and AI stack setup profile-aware.
+- Provide scripts and docs that are understandable before they are run.
+- Prefer official Ubuntu and vendor documentation for system administration decisions.
+- Keep risky system changes small, reviewable, verifiable, and reversible.
+
+## Target Audience
+
+- Beginner Linux administrators learning safe VPS operations.
+- Practical IT administrators who need repeatable bootstrap steps.
+- AI automation builders who need a documented Ubuntu base before running n8n, PostgreSQL with selected Supabase-related components, Redis, pgvector, monitoring, and backups.
+
+## Supported Profiles
+
+The governed profiles are `minimal`, `proxy`, `docker-host`, `web`, and `ai-stack`. Profile behavior and command order live in [VPS Profiles](profiles.md), [Scripts Catalog](scripts-catalog.md), and [Scripts Order](15-scripts-order.md).
+
+Current project docs and claims must not imply full Supabase support. The current supported scope is PostgreSQL with selected Supabase-related components only where implemented: Supabase Postgres image, Supabase Meta, Supabase Studio, pgvector, PgBouncer, Redis and n8n.
+
+## OS Baseline
+
+- Ubuntu 24.04 LTS is the primary and priority baseline.
+- Ubuntu 26.04 LTS is the next compatibility and validation target. It must be validated explicitly before being treated as fully supported.
+- Newer Ubuntu LTS releases require explicit validation before docs or scripts claim support.
+
+## Non-goals
+
+These non-goals keep the project small and safe:
+
+- No blind one-command production installation.
+- No broad rewrites without evidence.
+- No automatic installation of third-party proxy panels.
+- No public exposure of internal databases, cache, dashboards, or automation tools by default.
+- No full Supabase scope claim. Full Supabase implementation is out of scope unless approved as a future advanced phase.
+- No exact package pinning policy inside setup docs; version policy belongs in [Version Policy](version-policy.md).
+
+## Installation Philosophy
+
+- Users choose a profile before running scripts.
+- Each stage should explain what it changes and what to verify afterward.
+- Public access defaults to SSH tunnel or Nginx/reverse proxy. Direct public Compose port publishing is an advanced explicit mode and must be reviewed separately.
+- Beginner-facing docs should prefer links and short checklists over long command walls.
+
+## Safety Principles
+
+- Safe defaults are more important than convenience.
+- Secrets must not be committed, printed unnecessarily, or written into tracked config files.
+- Internal service ports remain local unless a reviewed public access path exists.
+- Risky system changes must include verification and rollback.
+- Privileged commands must be explicit and documented.
+
+## Documentation Principles
+
+- Keep `README.md` short as a landing page.
+- Keep `QUICKSTART.md` focused on profile flows.
+- Put detailed operational notes under `docs/`.
+- Link to existing docs instead of duplicating setup instructions.
+- Use beginner-friendly language and name risks clearly.
+
+## Script Principles
+
+- Scripts should be short, functional, and profile-aware.
+- Top-level wrappers may orchestrate; component scripts should do one clear job.
+- Scripts should fail clearly when required preconditions are missing.
+- Scripts must not generate partial secrets when a canonical secrets generator is required.
+- Script changes need read-only review, syntax checks, and profile-aware verification notes.
+
+## Security Principles
+
+- SSH, firewall, fail2ban, and updates are baseline security concerns.
+- Do not open service ports automatically for `proxy` or internal stack services.
+- Do not use `latest` container tags.
+- Avoid exact apt pins by default; use official Ubuntu LTS repositories unless a vendor repository is justified.
+- Every public access change needs an explicit reason, verification, and rollback.
+
+## Quality Gates
+
+These quality gates define readiness for changes:
+
+- `git diff --check` passes.
+- Bash syntax checks pass for changed shell scripts, when scripts are changed.
+- `shellcheck` is used when available for touched shell scripts.
+- Profile docs and acceptance criteria stay consistent.
+- Clean Ubuntu 24.04 VM smoke-test evidence is required before release readiness claims.
+- Ubuntu 26.04 compatibility claims require separate validation evidence.
+
+## Change-control Rules
+
+The change-control baseline is:
+
+- One PR should solve one bounded problem.
+- Prefer small PR-sized changes.
+- Do read-only review before implementation when scope or safety risk is non-trivial.
+- Implement only after human approval for governance, security, public access, or install-flow changes.
+- Do not run install scripts, privileged commands, or containers during planning or review.
+- Do not broaden scope into Supabase, public Compose override, CI, changelog, or version enforcement unless that is the approved PR goal.
+
+## Links To Related Docs
+
+- [Quick Start](../QUICKSTART.md)
+- [System Requirements](../requirements/system-requirements.md)
+- [VPS Profiles](profiles.md)
+- [Scripts Catalog](scripts-catalog.md)
+- [Scripts Order](15-scripts-order.md)
+- [Quality Checks](12-quality-checks.md)
+- [Ready Rules](14-ready-rules.md)
+- [Version Policy](version-policy.md)
+- [Acceptance Criteria](acceptance-criteria.md)
diff --git a/docs/scripts-catalog.md b/docs/scripts-catalog.md
index ba2c3d8..ce2cc41 100644
--- a/docs/scripts-catalog.md
+++ b/docs/scripts-catalog.md
@@ -14,10 +14,10 @@
 | `scripts/02-security-baseline.sh` | Короткий orchestrator security baseline | `minimal`, `proxy`, `docker-host`, `web`, `ai-stack` | После preflight и SSH keys | Не устанавливает Docker, Nginx, Supabase, Redis или n8n |
 | `scripts/security/swap.sh` | Optional idempotent swapfile для маленьких VPS | `minimal`, `proxy`, `docker-host` | Если preflight показывает малую RAM/no swap | Не пересоздаёт существующий swap без `--force-recreate` |
 | `scripts/03-install-docker.sh` | Устанавливает Docker Engine и Docker Compose | `docker-host`, `ai-stack` | После security baseline, если профиль требует контейнеры | Не нужен для `minimal`/`proxy` по умолчанию и не поднимает compose stack |
-| `scripts/04-setup-supabase.sh` | Готовит Supabase/PostgreSQL компоненты | `ai-stack` | Только в AI stack flow | Не нужен для minimal/proxy VPS |
+| `scripts/04-setup-supabase.sh` | Готовит PostgreSQL (`supabase_db`) | `ai-stack` | Только в AI stack flow | Не поднимает full Supabase platform |
 | `scripts/05-setup-n8n.sh` | Настраивает n8n main/worker | `ai-stack` | После DB/Redis prerequisites | Не ставит Docker и не генерирует secrets |
 | `scripts/06-setup-redis.sh` | Настраивает Redis для очередей/cache | `ai-stack` | До n8n queue mode | Не открывает Redis наружу |
-| `scripts/07-setup-vector-db.sh` | Готовит pgvector таблицы/индексы | `ai-stack` | После PostgreSQL/Supabase | Не заменяет backup/restore процедуры |
+| `scripts/07-setup-vector-db.sh` | Готовит pgvector таблицы/индексы | `ai-stack` | После PostgreSQL | Не заменяет backup/restore процедуры |
 | `scripts/08-setup-nginx.sh` | Настраивает Nginx/reverse proxy path | `web`, `ai-stack`, optional `proxy` | Когда нужен публичный HTTP/HTTPS entry point | Не должен открывать внутренние DB/cache порты |
 | `scripts/09-install-nvidia-drivers.sh` | Устанавливает NVIDIA drivers | optional | Только для GPU hosts | Не нужен для обычного маленького VPS |
 | `scripts/10-backup-postgres.sh` | Выполняет PostgreSQL backup | `ai-stack` | После запуска DB и настройки `.env` | Не настраивает cron сам по себе |
diff --git a/docs/version-policy.md b/docs/version-policy.md
new file mode 100644
index 0000000..3243b1a
--- /dev/null
+++ b/docs/version-policy.md
@@ -0,0 +1,71 @@
+# Version Policy
+
+[Back to README](../README.md) | [Project Requirements](project-requirements.md) | [Quality Checks](12-quality-checks.md)
+
+## Purpose
+
+This policy defines how `install_ubuntu` documents and changes package, Docker, and application versions without making beginner setup brittle.
+
+## Ubuntu Package Policy
+
+- Ubuntu 24.04 LTS is the priority baseline for package and script validation.
+- Ubuntu 26.04 LTS is the next compatibility target and must be validated separately.
+- Use official Ubuntu LTS repositories for Ubuntu packages by default.
+- Use package names and capabilities in docs instead of exact package versions unless a freeze is explicitly required.
+- no exact apt package pins by default.
+
+## Vendor Repository Policy
+
+- A vendor repository is allowed only when the official Ubuntu LTS repository does not provide the required supported component.
+- Vendor repositories must be official, documented, and installed with their signing key and repository configuration.
+- The reason for each vendor repository must be documented near the install flow.
+
+## Docker Engine And Docker Compose Plugin Policy
+
+- Docker Engine and Docker Compose plugin should come from the official Docker stable apt repository.
+- The install flow should follow Docker's official Ubuntu instructions for the validated Ubuntu baseline.
+- Docker package changes must be verified on Ubuntu 24.04 before release claims.
+
+## Exact Package Pinning Policy
+
+- Exact apt package pins are not the beginner default.
+- Exact Docker Engine version installation is an advanced freeze/rollback scenario only.
+- If an exact package version is pinned, the PR must explain why, how to update it, and how to roll back.
+
+## Compose Image Tag Policy
+
+- Docker Compose images must use explicit version tags.
+- `latest` is forbidden for Compose images.
+- Each pinned application or container version needs an update procedure.
+- Image version changes must not be mixed with unrelated script or firewall changes.
+
+## Digest Pinning Policy
+
+- digest pinning is optional production reproducibility mode, not the beginner default.
+- If digest pinning is used, docs must explain how to refresh the digest and verify the new image.
+- Digest pinning must not hide the human-readable application version tag in review context.
+
+## Update Procedure
+
+For every pinned app or container version:
+
+1. Read the upstream changelog or release notes.
+2. Update the version in the smallest possible PR.
+3. Run static validation such as `docker compose config` where relevant.
+4. Run smoke tests for affected services.
+5. Document rollback notes when stateful services are affected.
+
+## Version Bump Acceptance Criteria
+
+- The PR states what changed and why.
+- Review covers upstream changelog or release notes.
+- smoke tests are listed and, when feasible, executed.
+- Release notes or changelog update is included when the project starts maintaining release notes.
+- Clean Ubuntu 24.04 evidence is required before release readiness claims.
+- Ubuntu 26.04 compatibility evidence is required before compatibility claims.
+
+## Emergency Security Update Procedure
+
+- Security fixes may prioritize speed, but still require review of changed versions and affected services.
+- Keep emergency updates narrow: version changes only unless a mitigation requires more.
+- After the emergency change, capture follow-up work for smoke tests, rollback validation, and release notes.
diff --git a/requirements/system-requirements.md b/requirements/system-requirements.md
index 25f3b40..10d7cf2 100644
--- a/requirements/system-requirements.md
+++ b/requirements/system-requirements.md
@@ -6,7 +6,7 @@
 
 | Требование | Значение |
 |---|---|
-| ОС | Ubuntu Server 22.04 LTS или 24.04 LTS |
+| ОС | Ubuntu Server 24.04 LTS primary baseline; Ubuntu 26.04 LTS compatibility/validation target |
 | Архитектура | `x86_64` / `amd64` рекомендуется |
 | Доступ | `sudo` или root для server-side setup scripts |
 | Сеть | Стабильное интернет-соединение для apt/Docker downloads |
diff --git a/scripts/00-preflight-check.sh b/scripts/00-preflight-check.sh
index 588b529..4ad6cdc 100755
--- a/scripts/00-preflight-check.sh
+++ b/scripts/00-preflight-check.sh
@@ -153,13 +153,25 @@ print_profile_matrix() {
 
 check_os_support() {
   if [ "$OS_NAME" != "ubuntu" ]; then
-    log_error "ОС должна быть Ubuntu Server 22.04 LTS или 24.04 LTS (обнаружено: ${OS_NAME} ${OS_VERSION})"
+    log_error "ОС должна быть Ubuntu Server 24.04 LTS primary baseline (обнаружено: ${OS_NAME} ${OS_VERSION})"
     exit 1
   fi
 
-  if [ "$OS_VERSION" != "24.04" ] && [ "$OS_VERSION" != "22.04" ]; then
-    log_warn "Рекомендуется Ubuntu 22.04 LTS или 24.04 LTS (обнаружено: $OS_VERSION)"
-  fi
+  case "$OS_VERSION" in
+    24.04)
+      log_info "Ubuntu 24.04 LTS обнаружена: primary baseline"
+      ;;
+    26.04)
+      log_warn "Ubuntu 26.04 LTS обнаружена: compatibility/validation target, not fully validated primary support"
+      ;;
+    22.04)
+      log_error "Ubuntu 22.04 LTS обнаружена: unsupported legacy; используйте Ubuntu 24.04 LTS primary baseline"
+      exit 1
+      ;;
+    *)
+      log_warn "Ubuntu $OS_VERSION не является primary baseline; Ubuntu 24.04 LTS поддерживается, Ubuntu 26.04 LTS только compatibility/validation target"
+      ;;
+  esac
 }
 
 check_critical_resources() {
diff --git a/scripts/04-setup-supabase.sh b/scripts/04-setup-supabase.sh
index 8105d9f..b7dd672 100755
--- a/scripts/04-setup-supabase.sh
+++ b/scripts/04-setup-supabase.sh
@@ -24,12 +24,6 @@ log_error() {
     echo -e "${RED}[ERROR]${NC} $1"
 }
 
-# Функция генерации безопасного пароля
-generate_password() {
-    # Генерируем пароль длиной 32 символа из букв, цифр и спецсимволов
-    openssl rand -base64 24 | tr -d "=+/" | cut -c1-32
-}
-
 # Проверка Docker
 if ! command -v docker &> /dev/null; then
     log_error "Docker не установлен. Установите Docker сначала."
@@ -58,26 +52,9 @@ cd "$COMPOSE_DIR"
 
 # Проверяем наличие .env файла
 if [ ! -f ".env" ]; then
-    log_info "Файл .env не найден. Создаём с автоматически сгенерированными паролями..."
-    if [ -f "env.example" ]; then
-        # Генерируем пароли
-        REDIS_PASSWORD=$(generate_password)
-        SUPABASE_PASSWORD=$(generate_password)
-        N8N_PASSWORD=$(generate_password)
-        
-        # Создаём .env файл с сгенерированными паролями
-        sed -e "s/your-secure-redis-password-here/${REDIS_PASSWORD}/" \
-            -e "s/your-secure-supabase-password-here/${SUPABASE_PASSWORD}/" \
-            -e "s/your-secure-n8n-password-here/${N8N_PASSWORD}/" \
-            env.example > .env
-        
-        log_info "Файл .env создан с автоматически сгенерированными паролями"
-        log_warn "ВАЖНО: Сохраните пароли из файла .env в безопасном месте!"
-        log_info "Файл: $COMPOSE_DIR/.env"
-    else
-        log_error "Файл env.example не найден!"
-        exit 1
-    fi
+    log_error "Файл .env не найден в $COMPOSE_DIR"
+    log_error "Сначала создайте secrets через: sudo bash scripts/12-generate-secrets.sh --profile ai-stack"
+    exit 1
 fi
 
 # Запуск сервиса Supabase PostgreSQL
@@ -121,5 +98,5 @@ fi
 log_info "Установка Supabase завершена!"
 echo ""
 log_warn "=== ВАЖНО: Сохраните пароли ==="
-log_info "Пароли сохранены в файле: $COMPOSE_DIR/.env"
-log_info "Для просмотра паролей выполните: cat $COMPOSE_DIR/.env | grep PASSWORD"
+log_info "Secrets находятся в локальном файле: $COMPOSE_DIR/.env"
+log_warn "Не выводите secrets в терминал; храните копию в password manager"
diff --git a/scripts/05-setup-n8n.sh b/scripts/05-setup-n8n.sh
index 7e9609e..93c214c 100755
--- a/scripts/05-setup-n8n.sh
+++ b/scripts/05-setup-n8n.sh
@@ -24,11 +24,6 @@ log_error() {
     echo -e "${RED}[ERROR]${NC} $1"
 }
 
-# Функция генерации безопасного пароля
-generate_password() {
-    openssl rand -base64 24 | tr -d "=+/" | cut -c1-32
-}
-
 # Проверка Docker
 if ! command -v docker &> /dev/null; then
     log_error "Docker не установлен. Установите Docker сначала."
@@ -58,51 +53,17 @@ cd "$COMPOSE_DIR"
 # Проверяем наличие .env файла
 if [ ! -f ".env" ]; then
     log_error "Файл .env не найден в $COMPOSE_DIR"
-    log_error "Сначала запустите скрипт установки Supabase (04-setup-supabase.sh)"
-    log_error "Он создаст .env файл с необходимыми паролями"
+    log_error "Сначала создайте secrets через: sudo bash scripts/12-generate-secrets.sh --profile ai-stack"
     exit 1
 fi
 
-# Проверяем, что переменные n8n есть в .env
-if ! grep -q "^N8N_BASIC_AUTH_PASSWORD=" .env 2>/dev/null; then
-    log_warn "Переменная N8N_BASIC_AUTH_PASSWORD не найдена в .env"
-    log_info "Добавляем переменные для n8n в .env..."
-    
-    # Генерируем пароль для n8n
-    N8N_PASSWORD=$(generate_password)
-    N8N_ENCRYPTION_KEY=$(generate_password)
-    N8N_USER_MANAGEMENT_JWT_SECRET=$(generate_password)
-    
-    # Добавляем переменные для n8n в .env
-    cat >> .env <<EOF
-
-# n8n
-N8N_BASIC_AUTH_ACTIVE=true
-N8N_BASIC_AUTH_USER=admin
-N8N_BASIC_AUTH_PASSWORD=${N8N_PASSWORD}
-N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
-N8N_USER_MANAGEMENT_JWT_SECRET=${N8N_USER_MANAGEMENT_JWT_SECRET}
-N8N_WEBHOOK_URL=http://localhost:5678/
-N8N_METRICS=true
-N8N_LOG_LEVEL=info
-N8N_WORKERS_COUNT=2
-EOF
-    
-    log_info "Переменные для n8n добавлены в .env"
-fi
-
-# Добавляем ключи, если отсутствуют
-if ! grep -q "^N8N_ENCRYPTION_KEY=" .env 2>/dev/null; then
-    N8N_ENCRYPTION_KEY=$(generate_password)
-    echo "N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}" >> .env
-    log_info "Добавлен N8N_ENCRYPTION_KEY в .env"
-fi
-
-if ! grep -q "^N8N_USER_MANAGEMENT_JWT_SECRET=" .env 2>/dev/null; then
-    N8N_USER_MANAGEMENT_JWT_SECRET=$(generate_password)
-    echo "N8N_USER_MANAGEMENT_JWT_SECRET=${N8N_USER_MANAGEMENT_JWT_SECRET}" >> .env
-    log_info "Добавлен N8N_USER_MANAGEMENT_JWT_SECRET в .env"
-fi
+for required_secret in N8N_BASIC_AUTH_PASSWORD N8N_ENCRYPTION_KEY N8N_USER_MANAGEMENT_JWT_SECRET; do
+    if ! grep -q "^${required_secret}=" .env 2>/dev/null; then
+        log_error "Переменная $required_secret не найдена в .env"
+        log_error "Обновите secrets через: sudo bash scripts/12-generate-secrets.sh --profile ai-stack"
+        exit 1
+    fi
+done
 
 # Проверяем, что Redis и Supabase запущены
 if ! docker ps --format "{{.Names}}" | grep -q "^redis$"; then
@@ -166,7 +127,7 @@ echo ""
 log_info "n8n доступен по адресу: http://localhost:5678"
 log_info "Логин: admin"
 log_info "Пароль: см. в файле .env (N8N_BASIC_AUTH_PASSWORD)"
-log_info "Для просмотра пароля: grep N8N_BASIC_AUTH_PASSWORD $COMPOSE_DIR/.env"
+log_warn "Не выводите secrets в терминал; храните копию в password manager"
 echo ""
 
 log_info "Установка n8n завершена!"
diff --git a/scripts/06-setup-redis.sh b/scripts/06-setup-redis.sh
index af6d4e8..258087c 100755
--- a/scripts/06-setup-redis.sh
+++ b/scripts/06-setup-redis.sh
@@ -52,57 +52,18 @@ cd "$COMPOSE_DIR"
 
 # Проверяем наличие .env файла
 if [ ! -f ".env" ]; then
-    log_info "Файл .env не найден. Создаём с автоматически сгенерированным паролем..."
-    if [ -f "env.example" ]; then
-        # Функция генерации безопасного пароля
-        generate_password() {
-            openssl rand -base64 24 | tr -d "=+/" | cut -c1-32
-        }
-        
-        # Генерируем пароли
-        REDIS_PASSWORD=$(generate_password)
-        SUPABASE_PASSWORD=$(generate_password)
-        N8N_PASSWORD=$(generate_password)
-        
-        # Создаём .env файл с сгенерированными паролями
-        sed -e "s/your-secure-redis-password-here/${REDIS_PASSWORD}/" \
-            -e "s/your-secure-supabase-password-here/${SUPABASE_PASSWORD}/" \
-            -e "s/your-secure-n8n-password-here/${N8N_PASSWORD}/" \
-            env.example > .env
-        
-        log_info "Файл .env создан с автоматически сгенерированными паролями"
-    else
-        log_error "Файл env.example не найден!"
-        exit 1
-    fi
+    log_error "Файл .env не найден в $COMPOSE_DIR"
+    log_error "Сначала создайте secrets через: sudo bash scripts/12-generate-secrets.sh --profile ai-stack"
+    exit 1
 else
     log_info "Файл .env уже существует"
 fi
 
 # Проверяем, что переменная REDIS_PASSWORD есть в .env
 if ! grep -q "^REDIS_PASSWORD=" .env 2>/dev/null; then
-    log_warn "Переменная REDIS_PASSWORD не найдена в .env"
-    log_info "Добавляем переменную REDIS_PASSWORD в .env..."
-    
-    # Функция генерации безопасного пароля
-    generate_password() {
-        openssl rand -base64 24 | tr -d "=+/" | cut -c1-32
-    }
-    
-    REDIS_PASSWORD=$(generate_password)
-    
-    # Добавляем переменную REDIS_PASSWORD в .env
-    if grep -q "^# Redis" .env; then
-        sed -i "/^# Redis/a REDIS_PASSWORD=${REDIS_PASSWORD}" .env
-    else
-        {
-            echo ""
-            echo "# Redis"
-            echo "REDIS_PASSWORD=${REDIS_PASSWORD}"
-        } >> .env
-    fi
-    
-    log_info "Переменная REDIS_PASSWORD добавлена в .env"
+    log_error "Переменная REDIS_PASSWORD не найдена в .env"
+    log_error "Обновите secrets через: sudo bash scripts/12-generate-secrets.sh --profile ai-stack"
+    exit 1
 fi
 
 # Запуск Redis из основного docker-compose.yml
@@ -135,7 +96,7 @@ log_info "=== Информация о Redis ==="
 log_info "Хост: localhost"
 log_info "Порт: 6379"
 log_info "Пароль: см. в файле .env (REDIS_PASSWORD)"
-log_info "Для просмотра пароля: grep REDIS_PASSWORD $COMPOSE_DIR/.env"
+log_warn "Не выводите secrets в терминал; храните копию в password manager"
 echo ""
 
 log_info "Установка Redis завершена!"
diff --git a/scripts/12-generate-secrets.sh b/scripts/12-generate-secrets.sh
index 4f0e531..6c83584 100755
--- a/scripts/12-generate-secrets.sh
+++ b/scripts/12-generate-secrets.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Скрипт генерации секретов для .env и Supabase config.toml
+# Скрипт генерации секретов для локального docker-compose/.env
 
 set -Eeuo pipefail
 
@@ -31,7 +31,6 @@ PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 COMPOSE_DIR="$PROJECT_ROOT/docker-compose"
 ENV_EXAMPLE="$COMPOSE_DIR/env.example"
 ENV_FILE="$COMPOSE_DIR/.env"
-SUPABASE_CONFIG="$COMPOSE_DIR/supabase/config.toml"
 
 # shellcheck source=lib/common.sh
 . "$SCRIPT_DIR/lib/common.sh"
@@ -64,10 +63,8 @@ case "${PROFILE:-}" in
     ;;
 esac
 
-# Проверка прав root
 if [ "$EUID" -ne 0 ]; then
-  log_error "Пожалуйста, запустите скрипт с правами root или через sudo"
-  exit 1
+  log_info "Secrets будут созданы от имени текущего пользователя"
 fi
 
 generate_password() {
@@ -108,6 +105,24 @@ set_env_value() {
   fi
 }
 
+secure_env_file() {
+  if [ "$EUID" -eq 0 ] && [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ]; then
+    if id "$SUDO_USER" > /dev/null 2>&1; then
+      local target_group
+      target_group="$(id -gn "$SUDO_USER")"
+      chown "$SUDO_USER:$target_group" "$ENV_FILE"
+      log_info "Владелец .env: $SUDO_USER:$target_group"
+    else
+      log_warn "SUDO_USER=$SUDO_USER не найден; .env останется владельцем root"
+    fi
+  elif [ "$EUID" -eq 0 ]; then
+    log_warn "Скрипт запущен напрямую от root; .env останется root-owned и будет доступен только root"
+    log_warn "Запускайте последующие docker compose команды в контексте, который может прочитать .env"
+  fi
+
+  chmod 600 "$ENV_FILE"
+}
+
 if [ ! -f "$ENV_EXAMPLE" ]; then
   log_error "Файл env.example не найден: $ENV_EXAMPLE"
   exit 1
@@ -150,24 +165,9 @@ for key in "${SECRETS[@]}"; do
     log_info "Сохранён существующий $key"
   fi
 done
-
-# Обновляем Supabase config.toml (пароль БД)
-if [ -f "$SUPABASE_CONFIG" ]; then
-  SUPABASE_DB_PASSWORD="$(get_env_value SUPABASE_DB_PASSWORD)"
-  if [ -z "$SUPABASE_DB_PASSWORD" ]; then
-    log_warn "SUPABASE_DB_PASSWORD пустой — config.toml не обновлён"
-  else
-    if grep -q "^password = " "$SUPABASE_CONFIG"; then
-      ESCAPED_SUPABASE_DB_PASSWORD="$(printf '%s' "$SUPABASE_DB_PASSWORD" | sed 's/[&/\\]/\\&/g')"
-      sed -i "s/^password = .*/password = \"${ESCAPED_SUPABASE_DB_PASSWORD}\"/" "$SUPABASE_CONFIG"
-      log_info "Обновлён пароль в config.toml"
-    else
-      log_warn "Не найдена строка password в config.toml"
-    fi
-  fi
-else
-  log_warn "config.toml не найден: $SUPABASE_CONFIG"
-fi
+secure_env_file
 
 log_info "Генерация секретов завершена"
 log_info "Файл: $ENV_FILE"
+log_info "Права доступа .env: 600"
+log_warn "Не записывайте сгенерированные secrets в tracked config files; храните копию в password manager"