Pushleft engineering handoff for Claude

The user has paused development and requested this handoff. Do not resume autonomous implementation until the user starts work with you. Preserve the existing code and locked design. The platform is not production ready. Since 17 October 2026 npm run test:pl-up-demo demonstrates the whole vertical slice on one machine: an ordinary web-only checkout goes through the real CLI (production auth), isolated BuildKit build, registry, scheduler, mTLS gateway, Docker runtime and Caddy ingress to a URL that serves the build, survives agent/scheduler crashes and a second release, refuses foreign tenants, viewers, revoked tokens and failed build/start/health/route/integrity cases, and tears down fenced (see docs/pl-up-demo.md). It is not production-proven: network admission is stubbed in SQL, it runs on Docker Desktop rather than native Linux, on one host, and over HTTPS only with a per-run wildcard certificate, a local ACME CA and a DNS stub (no public DNS, public CA or internet-reachable 80/443). Environment network teardown reaches destroyed, but its nftables/host-route removal runs only on Linux and is untested there, and coordinator-side Headscale node records are not deleted.

Workspace: /Users/waseem/Development/pushleft. Handoff date: 16 October 2026. This directory is not a Git repository; do not assume commits, branches or a clean baseline exist. Existing changes belong to the user. No live cloud deployment or registry publication was performed during the latest work.

User objective and agreed product

Build an open source, self-hostable deployment platform for solo developers, small startups and product teams. Rust API, CLI and Linux agent; React developer frontend. The managed backend defaults to Pushleft on pushleft.dev; customers can configure another control-plane URL. Managed infrastructure comes first, customer-owned VMs second, Kubernetes later. Hetzner is the initial cloud.

pl up should detect the checkout, deploy without asking the developer to provision infrastructure, and return a URL. pl down tears down and pl list lists deployments. The web UI presents the same control-plane truth.
.pl.yaml defines application roles, resources and placement. Compose compatibility is wanted. Roles include web, private services, databases, workers, cron, jobs and release tasks.
Support per-branch previews and production deployments from a selected branch with rolling upgrades. GitHub and on-premises GitLab with hooks are required.
Versioned deployments, custom domains, wildcard TLS, ACME, ingress, logs, metrics and built-in web analytics are required. Analytics/access/CPU data should land in ClickHouse with 90-day retention.
External registrar integration plus Cloudflare DNS management/proxy protection. Manage full zones and additional records/presets for Microsoft 365, Google Workspace, inbox2, SES and domain verification.
Separate the private fleet-management tailnet from workload networking. Self-host the workload Tailscale control plane using Headscale; isolate environments/deployments from each other while allowing intended intra-environment connectivity. Public ingress is only 80/443 or explicitly approved ports. Do not expose fleet management in the public developer UI.
The agent must install/manage PostgreSQL and ClickHouse instances and their databases, users and grants. Persistent storage must be simpler to use than Kubernetes volumes while retaining explicit isolation and safe sharing rules.
Two-region failover and production-grade uptime are targets. Initial capacity target is 100 deployments on 10 nodes, not yet load-tested.
Database relocation means copy/replicate to a new PostgreSQL backend, catch up, fence old writers, cut over, drain and avoid acknowledged-write loss. It does not require unrestricted master/master PostgreSQL. DNS alone cannot enforce writer safety.
Include Vault/OpenBao secrets, firewall protection, quotas/cost controls, metering with billing hooks, an AI provider proxy, and transactional outbound mail with our own MTA primary and external ESPs secondary. DKIM/SPF and related mail operations remain required.
Eventually build private desktop fleet administration for VM provisioning, enrollment, health, drains and upgrades. Its UI was explicitly deferred; do not add it back to the public product.

Read these sources first

handbook.md: the one-page map of architecture, infrastructure, running and the way of working; start there.
docs/architecture.md: invariants, delivery slices, source/artifact contracts, capacity and network preparation. Some short milestone bullets are stale; the detailed sections and current implementation are more precise.
docs/source-ingestion.md: latest source transport, quota claims, cancellation/replay behavior and missing builder/retention work.
docs/agent-gateway.md: mandatory mTLS, node identity and lease/result fencing.
docs/mesh-coordinators.md: Headscale topology, enrollment, route proofs and remaining admission gaps.
docs/fleet.md: Hetzner provisioning, agent enrollment/rotation, signed updates, health, drains and the first-live-run checklist.
docs/managed-databases.md: instance/catalog/principal management, storage quotas and image promotion evidence.
docs/domain-registration.md: external registrar and Cloudflare ownership/reconciliation model.
docs/design-baseline.md: locked developer UI.
package.json, Cargo.toml, compose.dev.yaml, deploy/images.lock.env and all API migrations.
Security reference projects exist at ../inbox2 and ../gluon; inspect relevant code when implementing production identity/security rather than assuming their implementation has already been adopted.

The earlier review PDF is output/pdf/pushleft-product-architecture-plan.pdf. Treat it as a planning artifact, not proof that its features exist or that its pricing/security claims remain current.

Current implementation

Control plane and developer experience

Manifest parsing/inference/planning, deployment creation with idempotency, immutable events, PostgreSQL state, queued jobs, SSE cursors, CLI commands and the React shell exist. The frontend distinguishes demonstration data from connected control-plane state.

Public API authentication has two modes (see docs/authentication.md). PUSHLEFT_AUTH_MODE=development (the default) keeps the static development token and still refuses non-loopback binding. Do not weaken that to make a demo work. PUSHLEFT_AUTH_MODE=production uses database-backed API tokens and console sessions with organization roles (owner/admin/member/viewer), onboarding through bootstrap-owner, and revocation that takes effect on the next request. It may bind to any address, but only behind a trusted TLS-terminating proxy. The API refuses to start without that evidence. Still missing for production identity: SSO, 2FA, password login and reset, email delivery of login codes, a token rotation policy beyond expiry, rate limiting, a session management UI, org creation and settings endpoints, and a direct TLS listener.

Source ingestion

This is the latest substantial implemented increment.

New crates/pushleft-source packages deterministic bounded USTAR/Zstandard bundles. .pl.yaml is included even when inferred. Git and .plignore rules plus mandatory common credential/dependency exclusions apply. These exclusions are not content secret scanning.
Server validation refuses links, devices, sparse/extension entries, traversal, duplicate/ancestor aliases, unsafe modes, oversized expansion and trailing frames/data. It does not extract or execute source.
Limits: 64 MiB compressed, 256 MiB expanded, 32 MiB per file, 20,000 files. Two upload slots per API process and a 30-second body deadline. Blocking work retains its slot when the HTTP future is cancelled.
PUT /v1/deployments/{id}/source requires authentication, the source media type, checksum and a byte-identical deployment manifest. It is disabled unless both PUSHLEFT_SOURCE_ROOT and PUSHLEFT_BUILD_REGISTRY are configured.
Migration 0023_source_upload_claims.sql reserves one immutable digest, object key and stable snapshot/artifact identity per deployment before a durable object write. Organization quotas serialize across deployments. Defaults are 1 GiB and 1,000 claims, configurable through the documented environment variables.
Private no-overwrite object publication checks/fsyncs exact bytes, objects and parent directories, including replay. Concurrent directory creation is handled without adopting symlinks or non-private directories.
Final publication rechecks the claim, active deployment and build intent, then atomically inserts the verified snapshot, attaches provenance to the untargeted build job and appends one source_verified event.
CLI retries source uploads with the same deployment/checksum on transient failures. A real fault-proxy test commits source, drops the response and verifies exact replay rather than duplicate publication.

Important gaps: local storage only; no builder source-download route, isolated builder or registry push. Retention/verified GC now exists (migration 0028, scheduler src/retention.rs, npm run test:retention; see docs/source-ingestion.md). It does not cover: an object-store adapter, registry blob GC or registries without delete support, bearer-token registries, per-organization retention settings, or claims on deployments stuck in queued/building. The private filesystem assumes no concurrent hostile mutation by another process sharing its service identity. Do not market this as unlimited deployment history or production object storage.

Files: crates/pushleft-source/src/, API src/source.rs and src/source/, CLI src/main.rs, migration 0023, scripts/source-ingestion-e2e.sh, scripts/fixtures/source-probes.py.

Artifact publication and application placement

Migration 0021 binds immutable source snapshots, release artifacts and application instances to deployment/project/organization identity. The private publish_release_artifact function requires the targeted build job, its current lease, a fresh authorized isolated-build node, the exact source/plan and a digest under the scoped image repository. It creates role/replica intents and untargeted application jobs atomically. It is not an executable builder.

Migration 0022 and scheduler src/applications.rs reserve application capacity and one gateway allocation per host/environment. The current stateless envelope is fixed at 500 millicores and 512 MiB per replica, plus 500 millicores and 256 MiB for the gateway. Configurable application resource plans are not wired yet. Reservations do not silently migrate to another host on failure.

Initial topology waits for active application builds/artifacts and every replica reservation, including the correct application-pool host membership. A web-only app does not need a dummy database. Missing intents or incompatible reservations prevent sealing.

The scheduler reclaims only never-dispatched terminal application reservations before topology sealing and before any attachment/enrollment exists. It preserves shared allocations and subnet non-reuse. Sealed/prepared or previously dispatched workloads require a real fenced teardown. Maintenance contention does not stop unrelated placements.

Step 3 (application runtime admission) is now wired for web/private/worker: targeting only after independent network admission on the reserving host, gateway lease/heartbeat/completion bound to the owning node and durable task, and a Docker executor in the agent. See “Application runtime admission” in docs/architecture.md. Step 4b added one-shot cron/job/release executors (release gates long-lived targeting), fenced teardown_application for pl down, a lease-loss policy that leaves adopted/healthy generations running, and a lock-file default probe image; see “One-shot roles and teardown” in docs/architecture.md.

Environment network teardown (migration 0035) finishes pl down: once a torn-down deployment’s instances are removed and its routes are gone, the scheduler (src/network_teardown.rs) either retains the environment network (another active deployment or a database of the environment uses it; the deployment is destroyed at once) or marks the segment destroying and queues one fenced remove_environment_gateway job per host attachment on the agent network lane. Only the gateway-accepted receipt releases the attachment and membership (subnet slots stay burned), destroys the segment and moves the deployments to destroyed (deployment_destroyed); a terminal failure leaves them teardown_failed (deployment_teardown_failed) for an operator. A later deployment of the environment gets a new segment. See “Environment network teardown” in docs/architecture.md.

Step 4 (ingress publication) is wired: after every web instance is durably ready, the scheduler queues a generation-fenced publish_ingress per node. The agent writes the route into the host Caddy, and the gateway activates the route, marks the deployment live and appends deployment_url_ready. The previous release is drained first, then stopped (containers retained). pl up follows events to the URL by default. Wildcard DNS/TLS is operator-provisioned. Only plain HTTP on .localhost is tested; TLS is not. See “Ingress publication” in docs/architecture.md.

Networking and agents

Mandatory-mTLS agent gateway, certificate revocation, targeted leases, separate network/workload lanes, heartbeats and append-only results exist. Wall-clock lease validity is rechecked after resource waits; stale credential revisions cannot reuse current proofs.

Private Headscale/Caddy coordination, immutable host membership, non-recycled global subnet allocation, fixed initial topology sealing, credential publication/history, lost-response recovery and provider route reconciliation exist. Host agent components manage Docker Tailscale gateways, nftables and host routes. Gateway, firewall, local route and provider-route evidence are independent.

Do not infer production network admission from a prepared topology or a passing local coordinator fixture. Host-wide/provider-firewall proof, aggregate activation and native multi-host packet transport/failover remain incomplete. Live topology expansion is not implemented. Automatic enrollment renewal still needs agent-side credential restaging and proof that old remote execution cannot continue.

Fleet substrate (docs/fleet.md): pushleft-controller fleet provision|list|admit|drain|decommission|replace|sweep is the private operator CLI; there is no fleet UI. It provisions Hetzner servers with a crates/pushleft-hetzner client. The workflow is label-idempotent and resumable from fleet_nodes.provision_state, and the per-pool firewall is attached at create. Agents enroll through a one-time secret (hash, 15-minute TTL, single use) on a server-auth-only gateway listener that issues short-lived certificates. Agent mTLS certificates now renew automatically. The agent restages key and certificate atomically and restarts (which drops in-flight execution). The gateway revokes every older certificate on the first lease with the new one, so the old identity cannot lease, heartbeat or complete. npm run test:fleet proves this with real processes. Agents self-update from Ed25519-signed SHA256SUMS. Leases carry host inventory. A heartbeat sweep marks nodes unhealthy without releasing allocations. Decommission refuses while allocations are active, revokes all certificates, then deletes the server. Live Hetzner provisioning was never executed (no credentials). Only a local API stub was used. See “First live run” in docs/fleet.md. The mesh pre-auth key renewal remains a separate, unchanged workflow.

Databases and observability

Database placement, PostgreSQL/ClickHouse container lifecycle, health, owned catalogs/principals, grants, scoped Vault references and XFS project-quota paths exist. Agent OTel/telemetry and placement-bound access analytics support ClickHouse 90-day schemas and privacy reduction.

The agent now does continuous PostgreSQL WAL archiving and SHA-256-verified tar base backups. It does PITR into a new generation, never in place, and restore drills (pg_amcheck, the checksum counter and a marker row in a throwaway container). It also takes ClickHouse native BACKUP/RESTORE drills and applies retention, which deletes only after re-verifying the oldest kept base. Roles can declare host-local application volumes: one writer, same-environment read-only readers, quota-bound, retained on teardown, nightly tar backups, explicit or retention-window release. Migration 0030 holds the typed evidence and volume rows. npm run test:database-backup proves this on Docker Desktop with quotas disabled.

Local tests still do not prove native Linux XFS enforcement for restored generations and volumes, two-region HA, safe major upgrades or live relocation. Backups live on the node itself until an object-store adapter exists, and they are not encrypted by the agent. Restores are operator-requested; there is no API, and writers are never cut over. A rolling release of a volume writer briefly overlaps two writers. See “Backups, PITR and restore drills” and “Application volumes” in docs/managed-databases.md.

DNS and domains

Openprovider is the implemented registrar adapter. Cloudflare desired-state/controller code manages zones, owned records and presets without assuming mail records may be proxied. Ownership, idempotency and tenant validation exist. Live cloud provisioning and operational mail delivery are not proven by these fixtures.

Critical path for the next implementation

Prioritize completing the real vertical deployment path. Preserve safety checks while connecting these steps.

Add private build-source delivery. The mTLS agent gateway should return only the exact verified archive associated with that node’s current targeted build lease. Recheck certificate/node authorization, deployment lifecycle, job lease, source claim, snapshot, artifact ID and plan provenance. Read/verify bytes outside database authorization locks, then reauthorize after I/O and before returning bytes. Bound concurrent downloads and retain capacity through cancelled blocking work. Test another node/organization, revoked identity, lease expiry behind locks, tampered files and teardown racing the read. No implementation of this route was started before the handoff.
Choose and implement a genuine isolated build executor. Do not give tenant Dockerfiles the host Docker socket, host secrets or shared privileged access. Evaluate dedicated ephemeral build VMs or a rigorously sandboxed/rootless executor, with native Linux proof. Build only checksum-verified source in a fresh private workspace, push using scoped short-lived registry credentials and publish the exact resulting digest through the existing lease-fenced artifact contract. Include provenance and bounded live build logs.
Connect application admission and runtime. Extend gateway authorization and agent execution for web/private/worker; enforce CPU/memory/PID limits, private environment network attachment, secrets/volume policy, generation ownership, health, replay and cancellation. Only target jobs after independent network admission. Add cron/job/release executors rather than pretending they are persistent services.
(Ingress publication, verified URL, event stream and drain/stop of superseded releases are implemented. Since 17 October 2026 also wildcard TLS for previews (operator certificate files, hot-reloaded; DNS-01 is a documented operator option because the pinned Caddy has no DNS module) and custom domains with DNS TXT/CNAME ownership verification and ACME, migration 0036. Proven locally by npm run test:ingress-tls and npm run test:pl-up-demo with a real ACME HTTP-01 exchange against a local ACME CA. Still open: a run with public DNS, Let’s Encrypt and internet-reachable 80/443; DNS-01 wiring through pushleft-cloudflare; creating the tenant’s DNS records for zones Pushleft manages; custom-domain takeover by re-verification.) Publish ingress, DNS and TLS only after healthy runtime evidence. Return an actual verified URL from pl up; stream real build/runtime events. Implement failed-release rollback, previous-release retention, draining and fenced teardown.
(Demonstrated on one Docker Desktop host over plain HTTP by npm run test:pl-up-demo, docs/pl-up-demo.md.) Demonstrate the complete path from an ordinary web-only checkout through the real CLI, actual build/registry/runtime, HTTPS request, restart/reconciliation replay and teardown. Include negative tenant/auth tests and failed build/start/health/route cases. Still open for this item: the same run on native Linux, with real network admission, on more than one host, and with public DNS and a public CA (the HTTPS request now runs against a per-run wildcard and a local ACME CA).

For source delivery, likely touch crates/pushleft-agent-gateway/src/main.rs, a new source module there, and a bounded verified-read method in pushleft-source. GatewayState currently contains only db; existing tests instantiate it directly. authenticate takes certificate/node locks and bounds database transactions. Do not hold those locks while decoding or transmitting an archive. No build scheduler or agent build executor is currently wired, so adding source delivery alone is not a deployed application.

Production requirements after the core deployment path

Production authentication beyond the implemented token/session/RBAC baseline (docs/authentication.md): SSO, WebAuthn, password reset and token rotation. Login rate limiting (PostgreSQL fixed windows per address and per email/user, 429 + Retry-After, rate_limited audit rows) and TOTP 2FA for users (encrypted secrets, ±1 step, replay refusal, ten single-use recovery codes, login challenges, require_totp_for_admins per organization, pl totp, a minimal console challenge step) are implemented on the control-plane-ha-auth branch and proven by npm run test:auth-hardening and the --ignored DB tests. Still open: TOTP key rotation, console enrollment screens, self-service reset. Tenant isolation across jobs, storage, logs and provider resources still needs its own review; the HTTP API is covered.
Hetzner VM provisioning, private management-agent enrollment, signed updates, inventory, health, capacity accounting, drains, replacement and private fleet administration. A first implementation exists (docs/fleet.md) but has not run against live Hetzner. Dead-node reclamation (a silent node becomes lost, its leases are fenced and its application instances are replaced on another admitted node; a returning node is told to remove fenced containers) and two-phase CA rotation (fleet ca rotate --begin/--complete/--abort, gateway PKI hot reload, agent client swap after renewal) exist and are proven by npm run test:fleet-reclaim with local processes, not on Hetzner. Still open: relocation off a draining node that is still alive, database relocation (a lost database node fails closed), new hosts for a sealed environment topology, an enrollment rate limit and an update rollout controller.
Verified workload isolation and firewall exposure rules on native multi-host Linux, safe topology changes, robust credential rotation and two-region failover without split-brain writers.
Persistent volumes, backups, PITR, drills and retention exist on a local store. Still missing: an object-store adapter with encryption and off-host copies, a control-plane restore request, PostgreSQL relocation cutover with writer fencing, stop-before-start handover for volume writers, volume restore, migration and resize, and further ClickHouse operations.
Production ingress/TLS/DNS lifecycle and operator recovery from provider outages. Wildcard and custom-domain TLS, DNS ownership verification and certificate-expiry probes exist (item 4) but have never met public DNS or a public CA; ACME rate-limit handling, DNS-01, multi-ingress certificate storage sharing and CA outage recovery are open.
Transactional mail operations and reputation/abuse controls; AI provider proxy, BYOK and metering; budgets, prices and billing integration.
Source/registry retention and storage quota release through verified GC is implemented for the local store and a delete-enabled Basic-auth registry, without deleting admission history. Still missing: an object-store adapter, registry blob GC, per-organization retention policy, and a reaper for stale queued deployments.
Control-plane PostgreSQL: primary + synchronous streaming replica, WAL archive, base backups, PITR and a fenced manual failover are scripted in deploy/postgres and proven on Docker by npm run test:control-plane-ha (about 4.9 s scripted failover, see docs/runbooks/control-plane-postgres-failover.md). Still open: automatic failover with a witness, a moving endpoint, off-host encrypted archive copies, the Debian/systemd layout on a real host, and HA for the control-plane host itself.
Capacity/load tests for 100 deployments on 10 nodes, SLOs, alerts, audit trails, runbooks and disaster recovery. A first pass is in operations.md, deploy/README.md and runbooks/: control-plane units, health/readiness and SIGTERM handling, SQL-based SLO alerts, pushleft-api audit, and a control-plane placement capacity test (npm run test:capacity). A runtime load test with 100 real containers, HA and two-region failover remain open.

Security release gate

Checked 2026-10-17. npm run security exits 1, only at the pinned runtime image scan. All other steps pass: cargo audit (one allowed unsafe-libyaml unmaintained warning; serde_yaml_ng 0.10.0 is the newest and still uses it), npm audit (0 vulnerabilities), gitleaks, opengrep (0 findings) and trivy fs (0 findings).

gitleaks scans git history in a checkout. The baseline snapshot once tracked the generated dev token .env.herdr; on 17 October 2026 the token was rotated and the file was removed from all history with git filter-repo (the repository had no remote, so no clone carries it). .env.herdr is ignored. .gitleaksignore holds one fingerprint: a runbook’s shell-placeholder curl -u example in an older revision, not a credential.
trivy fs flagged DS-0002 on scripts/fixtures/web-only/Dockerfile. The fixture now ends with USER 65534:65534; scripts/build-executor-e2e.sh still passes.

The image gate stays red. No newer upstream digest is clean in the same major and on a stable track, so deploy/images.lock.env is unchanged. See “Image promotion evidence (2026-10-17)” in docs/managed-databases.md for each image and CVE. In short:

PostgreSQL 17.11-alpine: gosu Go stdlib (25 IDs). The local postgres-gosu candidate is clean and passes its probes on both architectures.
ClickHouse 26.9.19.9 and the newer 26.9.20.23: libssl3 CVE-2026-84782. The local clickhouse-libssl candidate is clean and passes the image suite on both architectures.
Tailscale v1.104.1 (newest stable): Go 1.27.1 / x/net (3 IDs). Only unstable-v1.105.59 is clean.
Headscale v0.29.5 (newest release): Go and module findings (8 IDs). Upstream has no fixed release.

Decision 2026-10-17 (Waseem): keep the upstream stable images and accept the findings above until 2026-11-16, recorded per image in deploy/security/image-risk-register.json. The register suppresses nothing; the image gate stays red, and npm run test:security-policy fails once an acceptance expires or a pinned digest changes without the entry being rewritten. The Tailscale unstable track was rejected; the local candidates are not published yet.

To turn the gate green: publish the two candidates to an immutable registry with provenance, scan the published digests with scripts/runtime-image-scan.sh, run the live suites, then promote. For Tailscale and Headscale, wait for upstream releases (or decide to accept the unstable track, or build from source). Do not suppress package vulnerabilities.

Verification state at pause

Logs under output/security/ are local evidence and may be overwritten on the next run.

current-source-tests.log: eight source library tests passed, including expansion bounds, malicious archives, immutable private storage and concurrent first writers.
current-source-ingestion.log: five migrated API tests plus real CLI/HTTP/object/SQL probes passed. The latest probes include a lost committed upload response, oversized body refusal, foreign-tenant refusal and replacement attempts without additional objects.
current-clippy.log: strict workspace/all-target Clippy passed on the latest source ingestion changes.
current-application-placement.log: seven migrated placement/cleanup tests passed in the preceding work.
current-mesh-controller.log: 24 topology/controller tests and four gateway authorization tests passed in the preceding work.
current-security.log (2026-10-17, written in the security-gate worktree): every step passes except the runtime image scan, which still has HIGH/CRITICAL findings for all four pinned images. An earlier scan also had a registry DNS failure. Do not confuse that operational failure with a clean vulnerability result.
current-full-tests.log: the latest full suite was deliberately stopped at the user’s pause, after database-agent success and during network-agent tests. It is not a complete green run. The preceding full run failed at Headscale health during local Docker/network disruption. Earlier suites passed before the latest source increment, but that does not prove the current entire tree.

Typical verification commands when the user resumes:

cargo fmt --all -- --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --locked -p pushleft-source
npm run test:source-ingestion
npm run test:release-artifact
npm run test:application-placement
npm run test:mesh-controller
npm run test:all
npm run security

The source integration script retains its own temporary directory for diagnostics. Most integration scripts create disposable PostgreSQL databases and local Docker fixtures; some older suites use fixed database/container names. Avoid concurrent overlapping suite runs. Verify an old process is actually terminal before restarting it. Do not reset Docker or touch other projects’ containers to repair a fixture.

Locked design and working constraints

Keep the full-dark developer UI, readable large fonts, Manrope text and native monospace console stack. Electric blue is the main CTA color; solid pink with white text is selected navigation. Use technical operational cards, not generic icon/copy SaaS cards. Service icons have colored strokes without background tiles. Avoid transparent status pills, decorative circles and button side borders. The full-width blue/pink/orange brand hero fades into black. App selection scopes the combined metrics/live-stream/service-role area. See the design baseline for exact details.

Do not silently enable unfinished paths to make tests green: development auth stays loopback-only, network readiness requires independent evidence, and reserved capacity is not execution permission. Keep source, artifact, deployment, node, lease and generation identities bound across retries. Retain immutable history and non-recycled subnet allocation.

Use apply_patch for source/document edits and preserve unrelated files. Use primary documentation when selecting new runtime/build dependencies. The user requested Claude Opus 5.5 review earlier; the available independent reviewer was not Claude. Do not relabel that review. Obtain actual Claude review in the new workflow, and make no claim of full test coverage or production readiness without end-to-end evidence.

The autonomous goal is paused. Test runners were terminated at the user’s request. The one active workload-network test container was stopped separately; the normal development PostgreSQL container and unrelated projects were left alone. No source-download implementation or other build work should be inferred from the next-step discussion above.