Sync the self-hosting stack

README.md

@@ -34,7 +34,7 @@ is listed in full below.
 - [How it works](#how-it-works)
 - [What you need](#what-you-need)
 - [Install](#install)
-- [Your reverse proxy has two requirements](#your-reverse-proxy-has-two-requirements)
+- [Your reverse proxy has three requirements](#your-reverse-proxy-has-three-requirements)
 - [Upgrading](#upgrading)
 - [The agent](#the-agent)
 - [Things worth knowing before you trust it with production](#things-worth-knowing-before-you-trust-it-with-production)
@@ -286,9 +286,9 @@ adopted into the volume rather than replaced, your `WEB_ORIGIN` becomes the stor
 your model settings are adopted the same way, and an instance that already has an administrator is
 marked installed by a backfill — so you will never see the install screen. Nothing to do.
 
-## Your reverse proxy has two requirements
+## Your reverse proxy has three requirements
 
-Both are the kind that produce confusing symptoms rather than clean errors.
+All three are the kind that produce confusing symptoms rather than clean errors.
 
 - **Forward the WebSocket upgrade.** Two separate sockets ride `JARVIS_PORT`: the chat, on
   `/socket.io/`, and enrolled agents, on `/api/agents/ws`. Neither falls back to plain HTTP. Without
@@ -298,6 +298,13 @@ Both are the kind that produce confusing symptoms rather than clean errors.
 - **Give it a long read timeout** — 300s or so. A reasoning model can go 90+ seconds without emitting
   a byte, and a 60s default cuts the response mid-stream. The client sees a connection reset rather
   than a timeout, which reads like a bug in Jarvis.
+- **Let uploads through.** Attaching or uploading a file posts it to `/api/uploads/`, up to 10 MB
+  each, and an image uploaded to a workspace travels with a copy of up to 3 MB prepared for the
+  model. Your proxy must accept request bodies of at least **13,376 KiB** on that path (nginx:
+  `client_max_body_size 13376k;` — its default is 1 MB). Below that, larger files fail with your
+  proxy's own error rather than Jarvis's, and smaller ones keep working, so nothing looks wrong
+  until somebody attaches a big screenshot or PDF. No other request body Jarvis accepts is larger
+  than 2 MB, so the higher ceiling can be given to that path alone.
 
 Forward `X-Forwarded-For` too. How many proxies rewrite it is a setting, and the install screen is
 where you answer it — **it shows you the chain your own request actually carried and the address the
@@ -483,6 +490,38 @@ These are deliberate and documented rather than surprises waiting to be found.
   conversation's autonomy level, and at *Full access* nothing does. See
   [What decides whether a tool call runs](#what-decides-whether-a-tool-call-runs).
 
+### Files people attach or upload
+
+Anyone who can send a message in a conversation can attach files to it, and upload files to its
+workspace from the Documents panel.
+
+- **What is accepted.** Pictures (PNG, JPEG, WebP, GIF), plain text — logs, CSV, JSON, YAML,
+  configuration files, scripts, public certificates — and PDF, whose text is extracted when it
+  arrives. Up to 10 MB each and 10 per message; 200 files and 256 MB per conversation, 2 GB per
+  organization. A picture attached to a message is made smaller in the browser before it leaves, so
+  one of up to 40 MB can be dropped; one uploaded to the workspace is kept as it was dropped, and
+  scaled only past 8,000 pixels on a side or 40 megapixels. Jarvis checks what a file actually
+  contains rather than trusting its name, strips camera metadata from pictures, and refuses the
+  rest with a reason: SVG and HTML, Office documents, archives, executables, and key or secret
+  files — including a text file that holds a private key.
+- **They are stored in Postgres, unencrypted, like documents.** Unlike the vault and terminal
+  recordings, nothing seals them. A secret belongs in the vault, not in a screenshot or a pasted
+  log, and a database dump carries every attached file in the clear.
+- **Every participant in the conversation can see them**, now and later, including people added
+  after the file was sent — until whoever attached a file, or the conversation's owner, removes
+  it. Removing it deletes the file for everyone; it does not take back what the assistant already
+  quoted from it.
+- **They go to the model when the assistant uses them.** A picture is sent as the picture itself
+  when the assistant answers the message it came with, and again only if the assistant asks to look
+  at it; a text file or a PDF is sent as the passages the assistant reads. That is the same on your
+  own provider and on the managed model.
+- **Public links never include them.** A guest sees that a message had attachments and nothing
+  more. The assistant's replies are still included, though, and a reply that describes a file
+  describes it to the guest as well.
+- **A CSV opened in Excel is Excel's business.** Jarvis serves text files as downloads and does
+  not rewrite them, so a cell beginning with `=` is a formula when Excel opens it, and the warning
+  Excel shows is the only one there is.
+
 ## When it does not come up
 
 ```sh
@@ -590,11 +629,11 @@ then the agents.
 
 ## Backups, and restoring one
 
-Postgres holds everything except the vault key — avatars, documents, exports and terminal recordings
-are all rows, not files on disk. **Two volumes are worth backing up, and they must go to different
-places:** `postgres_data` and `jarvis_secrets`. `redis_data` carries nonces, rate-limit counters and the
-socket fan-out, all of which rebuild themselves; `agent_releases` is refilled by the next
-`docker compose pull`.
+Postgres holds everything except the vault key — avatars, documents, exports, terminal recordings
+and attached files are all rows, not files on disk. **Two volumes are worth backing up, and they
+must go to different places:** `postgres_data` and `jarvis_secrets`. `redis_data` carries nonces,
+rate-limit counters and the socket fan-out, all of which rebuild themselves; `agent_releases` is
+refilled by the next `docker compose pull`.
 
 They are separate volumes precisely so that they can be, and must be, backed up separately. A dump
 that travelled with the key that opens it is a dump that opens itself.
@@ -824,7 +863,9 @@ configured.** Every request the assistant then makes to the model carries:
 - each message, and the conversation so far;
 - the instructions and the list of tools Jarvis gives the model;
 - the output of every tool the assistant ran — command output, file contents and API responses from
-  the systems you administer.
+  the systems you administer;
+- the files and images participants attach to a message or upload to a workspace, when the
+  assistant uses them — an image as the picture itself, a text file or PDF as the text read from it.
 
 That includes runs nobody is watching: scheduled wake-ups, and runs resumed after a restart. Your own
 provider receives exactly the same content on every request — that is how the assistant works on