Release v0.45.0

.agents/resume

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "No persistent services require repair."

.agents/setup

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+mise_bin="$HOME/.local/bin/mise"
+
+echo "Installing mise..."
+if [[ ! -x "$mise_bin" ]]; then
+	curl -fsSL https://mise.run | sh
+fi
+
+profile_marker="# Techulus Cloud toolchains managed by mise"
+if ! grep -Fqx "$profile_marker" "$HOME/.bash_profile" 2>/dev/null; then
+	cat >> "$HOME/.bash_profile" <<'EOF'
+
+# Techulus Cloud toolchains managed by mise
+if [[ -x "$HOME/.local/bin/mise" ]]; then
+	eval "$("$HOME/.local/bin/mise" activate bash)"
+fi
+EOF
+fi
+
+go_version="$(awk '$1 == "go" { print $2; exit }' "$repo_root/agent/go.mod")"
+
+echo "Installing repository toolchains..."
+"$mise_bin" use --global "go@$go_version" node@24 pnpm@11
+for config in \
+	"$repo_root/agent/mise.toml" \
+	"$repo_root/web/mise.toml" \
+	"$repo_root/docs/mise.toml"; do
+	"$mise_bin" trust "$config"
+	(
+		cd "$(dirname "$config")"
+		"$mise_bin" install
+	)
+done
+
+echo "Installing web dependencies..."
+(
+	cd "$repo_root/web"
+	"$mise_bin" exec -- pnpm install --frozen-lockfile
+)
+
+echo "Downloading Go dependencies..."
+for module in agent cli deployment/updater; do
+	(
+		cd "$repo_root/$module"
+		"$mise_bin" exec -- go mod download
+	)
+done
+
+echo "Orb setup complete."

AGENT.md

@@ -0,0 +1,43 @@
+# Techulus Cloud — Agent Guide
+
+An open container deployment platform. See README.md for architecture.
+
+## Project facts
+
+- **Unreleased beta.** Never build
+  backward-compatibility shims, deprecation windows, or migration paths for
+  old agent or API versions — delete and replace outright.
+- The control plane and agent ship together; cross-cutting protocol changes
+  land in one PR with no rollout ordering concerns.
+
+## Repo map
+
+- `web/` — Next.js control plane (PostgreSQL + Drizzle, Inngest workflows)
+- `agent/` — Go server agent (Podman, Traefik, WireGuard)
+- `cli/` — Go CLI
+- `deployment/` — production Compose files and updater
+- `proxy/`, `registry/`, `logging/` — supporting service configs
+- `docs/` — documentation
+
+## Commands
+
+- Web tests: `cd web && pnpm test`
+- Web typecheck: `cd web && ./node_modules/.bin/tsc --noEmit`
+- Web lint/format: `cd web && npx biome check --write <files>`
+- Go (agent/cli): `go build ./...`, `go test ./...`, `gofmt -l .`
+- After deleting or renaming a Next.js route, stale generated types in
+  `web/.next/types` can fail the typecheck — delete them; they regenerate.
+
+## Making changes
+
+- Pull latest main before starting; if there are conflicts, STOP.
+- If product or architectural intent is unclear, ask — don't guess.
+- Create a branch before committing; never commit to main or a release branch.
+- Tests are expensive to write and maintain. Only add or expand tests for
+  high-value critical behavior, serious regression risk, or contracts that
+  would be costly to break. Keep tests focused; avoid low-signal harnesses.
+
+## ⚠️ Critical restrictions
+
+- **NEVER run the Node application** (`next dev`, `next start`, `pnpm dev`), Go Agent or Go CLI
+  without explicit permission. Tests, typechecks, and `go build` are fine.

CLAUDE.md

@@ -0,0 +1 @@
+AGENT.md

agent/README.md

@@ -44,13 +44,9 @@ curl -sSL $CONTROL_PLANE_URL/setup.sh | sudo bash
 
 ## Updating
 
-To update an existing agent to the latest version:
+When an update is available, open the server in the control plane and click **Update**. After you confirm the target version, the control plane queues an upgrade work item over the authenticated agent channel.
 
-```bash
-curl -sSL https://your-control-plane.com/update.sh | sudo bash
-```
-
-This downloads the latest agent binary, verifies the checksum, and restarts the service.
+The agent downloads the release binary, verifies its checksum, installs it, and restarts itself.
 
 ## Manual Setup
 

agent/internal/agent/agent.go

@@ -72,6 +72,9 @@ type Agent struct {
 	pendingServerlessWake        map[string]serverlessTransitionGuard
 	expectedStateMutex           sync.RWMutex
 	latestExpectedState          *agenthttp.ExpectedState
+	compiledTraefikMutex         sync.Mutex
+	compiledTraefikFor           *agenthttp.ExpectedState
+	compiledTraefik              *compiledTraefikState
 	Client                       *agenthttp.Client
 	Reconciler                   *reconcile.Reconciler
 	Config                       *Config

agent/internal/agent/drift.go

@@ -353,28 +353,19 @@ func (a *Agent) planReconcile(expected *agenthttp.ExpectedState, actual *ActualS
 	}
 
 	if a.IsProxy {
-		expectedHttpRoutes := ConvertToHttpRoutes(expected.Traefik.HttpRoutes)
-		expectedTraefikHash := traefik.HashRoutesWithServerName(expectedHttpRoutes, expected.ServerName)
-		tcpRoutes := ConvertToTCPRoutes(expected.Traefik.TCPRoutes)
-		udpRoutes := ConvertToUDPRoutes(expected.Traefik.UDPRoutes)
-		expectedL4Hash := traefik.HashTCPRoutes(tcpRoutes) + traefik.HashUDPRoutes(udpRoutes)
-		expectedCerts := make([]traefik.Certificate, len(expected.Traefik.Certificates))
-		for i, c := range expected.Traefik.Certificates {
-			expectedCerts[i] = traefik.Certificate{Domain: c.Domain, Certificate: c.Certificate, CertificateKey: c.CertificateKey}
-		}
-		expectedCertsHash := traefik.HashCertificates(expectedCerts)
-		if expectedTraefikHash != actual.TraefikConfigHash ||
-			expectedL4Hash != actual.L4ConfigHash ||
-			expectedCertsHash != actual.CertificatesHash ||
+		compiled := a.compiledTraefikState(expected)
+		if compiled.HTTPHash != actual.TraefikConfigHash ||
+			compiled.L4Hash != actual.L4ConfigHash ||
+			compiled.CertHash != actual.CertificatesHash ||
 			!actual.TraefikReloaded {
 			actions = append(actions, reconcileAction{
 				Kind: actionUpdateTraefik,
 				Description: fmt.Sprintf(
 					"UPDATE Traefik (%d HTTP, %d TCP, %d UDP routes; %d certificates)",
-					len(expected.Traefik.HttpRoutes),
-					len(tcpRoutes),
-					len(udpRoutes),
-					len(expected.Traefik.Certificates),
+					len(compiled.HTTP),
+					len(compiled.TCP),
+					len(compiled.UDP),
+					len(compiled.Certificates),
 				),
 			})
 		}
@@ -570,17 +561,7 @@ func (a *Agent) applyReconcileAction(action reconcileAction) error {
 }
 
 func (a *Agent) updateTraefik() error {
-	expectedHttpRoutes := ConvertToHttpRoutes(a.expectedState.Traefik.HttpRoutes)
-	tcpRoutes := ConvertToTCPRoutes(a.expectedState.Traefik.TCPRoutes)
-	udpRoutes := ConvertToUDPRoutes(a.expectedState.Traefik.UDPRoutes)
-
-	var tcpPorts, udpPorts []int
-	for _, r := range tcpRoutes {
-		tcpPorts = append(tcpPorts, r.ExternalPort)
-	}
-	for _, r := range udpRoutes {
-		udpPorts = append(udpPorts, r.ExternalPort)
-	}
+	compiled := a.compiledTraefikState(a.expectedState)
 
 	needsRestart := false
 	metricsRestart, err := traefik.EnsureMetricsConfig()
@@ -589,9 +570,9 @@ func (a *Agent) updateTraefik() error {
 	}
 	needsRestart = metricsRestart
 
-	if len(tcpPorts) > 0 || len(udpPorts) > 0 {
-		log.Printf("[reconcile] ensuring L4 entry points: %d TCP, %d UDP", len(tcpPorts), len(udpPorts))
-		entryPointsRestart, err := traefik.EnsureEntryPoints(tcpPorts, udpPorts)
+	if len(compiled.TCPPorts) > 0 || len(compiled.UDPPorts) > 0 {
+		log.Printf("[reconcile] ensuring L4 entry points: %d TCP, %d UDP", len(compiled.TCPPorts), len(compiled.UDPPorts))
+		entryPointsRestart, err := traefik.EnsureEntryPoints(compiled.TCPPorts, compiled.UDPPorts)
 		if err != nil {
 			return fmt.Errorf("failed to ensure entry points: %w", err)
 		}
@@ -604,19 +585,9 @@ func (a *Agent) updateTraefik() error {
 		}
 	}
 
-	expectedCerts := make([]traefik.Certificate, len(a.expectedState.Traefik.Certificates))
-	for i, certificate := range a.expectedState.Traefik.Certificates {
-		expectedCerts[i] = traefik.Certificate{
-			Domain:         certificate.Domain,
-			Certificate:    certificate.Certificate,
-			CertificateKey: certificate.CertificateKey,
-		}
-	}
-	expectedTraefikHash := traefik.HashRoutesWithServerName(expectedHttpRoutes, a.expectedState.ServerName)
-	expectedL4Hash := traefik.HashTCPRoutes(tcpRoutes) + traefik.HashUDPRoutes(udpRoutes)
-	routesChanged := expectedTraefikHash != traefik.GetCurrentConfigHash() ||
-		expectedL4Hash != traefik.GetCurrentL4ConfigHash()
-	certificatesChanged := traefik.HashCertificates(expectedCerts) != traefik.GetCurrentCertificatesHash()
+	routesChanged := compiled.HTTPHash != traefik.GetCurrentConfigHash() ||
+		compiled.L4Hash != traefik.GetCurrentL4ConfigHash()
+	certificatesChanged := compiled.CertHash != traefik.GetCurrentCertificatesHash()
 	if !routesChanged && !certificatesChanged {
 		if err := traefik.EnsureDynamicConfigReloaded(a.DataDir, 15*time.Second); err != nil {
 			return fmt.Errorf("failed to recover Traefik config reload: %w", err)
@@ -633,13 +604,13 @@ func (a *Agent) updateTraefik() error {
 	}
 
 	if certificatesChanged {
-		if err := traefik.UpdateCertificates(expectedCerts); err != nil {
+		if err := traefik.UpdateCertificates(compiled.Certificates); err != nil {
 			return fmt.Errorf("failed to update Traefik certificates: %w", err)
 		}
 	}
 	if routesChanged {
-		log.Printf("[reconcile] updating Traefik routes (HTTP: %d, TCP: %d, UDP: %d)", len(expectedHttpRoutes), len(tcpRoutes), len(udpRoutes))
-		if err := traefik.UpdateHttpRoutesWithL4(expectedHttpRoutes, tcpRoutes, udpRoutes, a.expectedState.ServerName); err != nil {
+		log.Printf("[reconcile] updating Traefik routes (HTTP: %d, TCP: %d, UDP: %d)", len(compiled.HTTP), len(compiled.TCP), len(compiled.UDP))
+		if err := traefik.UpdateHttpRoutesWithL4(compiled.HTTP, compiled.TCP, compiled.UDP, a.expectedState.ServerName); err != nil {
 			return fmt.Errorf("failed to update Traefik: %w", err)
 		}
 	}

agent/internal/agent/helpers.go

@@ -50,3 +50,62 @@ func ConvertToUDPRoutes(routes []agenthttp.TraefikUDPRoute) []traefik.TraefikUDP
 	}
 	return udpRoutes
 }
+
+type compiledTraefikState struct {
+	HTTP         []traefik.TraefikRoute
+	TCP          []traefik.TraefikTCPRoute
+	UDP          []traefik.TraefikUDPRoute
+	Certificates []traefik.Certificate
+	TCPPorts     []int
+	UDPPorts     []int
+
+	HTTPHash string
+	L4Hash   string
+	CertHash string
+}
+
+func compileTraefikState(expected *agenthttp.ExpectedState) *compiledTraefikState {
+	httpRoutes := ConvertToHttpRoutes(expected.Traefik.HttpRoutes)
+	tcpRoutes := ConvertToTCPRoutes(expected.Traefik.TCPRoutes)
+	udpRoutes := ConvertToUDPRoutes(expected.Traefik.UDPRoutes)
+
+	certificates := make([]traefik.Certificate, len(expected.Traefik.Certificates))
+	for i, c := range expected.Traefik.Certificates {
+		certificates[i] = traefik.Certificate{
+			Domain:         c.Domain,
+			Certificate:    c.Certificate,
+			CertificateKey: c.CertificateKey,
+		}
+	}
+
+	var tcpPorts, udpPorts []int
+	for _, r := range tcpRoutes {
+		tcpPorts = append(tcpPorts, r.ExternalPort)
+	}
+	for _, r := range udpRoutes {
+		udpPorts = append(udpPorts, r.ExternalPort)
+	}
+
+	return &compiledTraefikState{
+		HTTP:         httpRoutes,
+		TCP:          tcpRoutes,
+		UDP:          udpRoutes,
+		Certificates: certificates,
+		TCPPorts:     tcpPorts,
+		UDPPorts:     udpPorts,
+		HTTPHash:     traefik.HashRoutesWithServerName(httpRoutes, expected.ServerName),
+		L4Hash:       traefik.HashTCPRoutes(tcpRoutes) + traefik.HashUDPRoutes(udpRoutes),
+		CertHash:     traefik.HashCertificates(certificates),
+	}
+}
+
+func (a *Agent) compiledTraefikState(expected *agenthttp.ExpectedState) *compiledTraefikState {
+	a.compiledTraefikMutex.Lock()
+	defer a.compiledTraefikMutex.Unlock()
+
+	if a.compiledTraefikFor != expected || a.compiledTraefik == nil {
+		a.compiledTraefik = compileTraefikState(expected)
+		a.compiledTraefikFor = expected
+	}
+	return a.compiledTraefik
+}

agent/internal/agent/reporting.go

@@ -89,11 +89,26 @@ func (a *Agent) BuildStatusReport(includeResources bool) *agenthttp.StatusReport
 			if a.ShouldSuppressServerlessContainerReport(c.DeploymentID) {
 				continue
 			}
-
-			status := "stopped"
-			if c.State == "running" {
+			// Intermediate podman states (e.g. "created" mid-deploy) must not be
+			// reported as stopped — the control plane would move the deployment
+			// into a stopped phase — nor omitted, which would read as the
+			// container being gone. They are reported as "transient" so the
+			// control plane keeps tracking the deployment without acting until
+			// the state settles. Settled non-running states ("stopped",
+			// "paused") map to stopped so the deployment leaves routing and
+			// drift reconciliation can repair it; the same goes for "unknown"
+			// or unrecognized states, since presence-only reporting there would
+			// leave a broken container marked healthy indefinitely.
+			var status string
+			switch c.State {
+			case "running":
 				status = "running"
-			} else if c.State == "exited" {
+			case "exited", "stopped", "paused":
+				status = "stopped"
+			case "created", "configured", "initialized", "stopping", "removing":
+				status = "transient"
+			default:
+				log.Printf("[status] container %s in unexpected state %q, reporting as stopped", c.ID, c.State)
 				status = "stopped"
 			}
 
@@ -148,24 +163,14 @@ func (a *Agent) routingSyncedRolloutIds() []string {
 }
 
 func (a *Agent) proxyRoutingStateConverged(expected *agenthttp.ExpectedState) bool {
-	httpRoutes := ConvertToHttpRoutes(expected.Traefik.HttpRoutes)
-	if traefik.HashRoutesWithServerName(httpRoutes, expected.ServerName) != traefik.GetCurrentConfigHash() {
+	compiled := a.compiledTraefikState(expected)
+	if compiled.HTTPHash != traefik.GetCurrentConfigHash() {
 		return false
 	}
-	tcpRoutes := ConvertToTCPRoutes(expected.Traefik.TCPRoutes)
-	udpRoutes := ConvertToUDPRoutes(expected.Traefik.UDPRoutes)
-	if traefik.HashTCPRoutes(tcpRoutes)+traefik.HashUDPRoutes(udpRoutes) != traefik.GetCurrentL4ConfigHash() {
+	if compiled.L4Hash != traefik.GetCurrentL4ConfigHash() {
 		return false
 	}
-	certificates := make([]traefik.Certificate, len(expected.Traefik.Certificates))
-	for i, certificate := range expected.Traefik.Certificates {
-		certificates[i] = traefik.Certificate{
-			Domain:         certificate.Domain,
-			Certificate:    certificate.Certificate,
-			CertificateKey: certificate.CertificateKey,
-		}
-	}
-	if traefik.HashCertificates(certificates) != traefik.GetCurrentCertificatesHash() {
+	if compiled.CertHash != traefik.GetCurrentCertificatesHash() {
 		return false
 	}
 	reloaded, err := traefik.DynamicConfigReloaded(a.DataDir)

agent/internal/agent/serverless.go

@@ -160,22 +160,18 @@ func (a *Agent) SnapshotServerlessTransitions() []agenthttp.ServerlessTransition
 	return append([]agenthttp.ServerlessTransition(nil), a.pendingServerlessTransitions...)
 }
 
-func (a *Agent) ClearReportedServerlessTransitions(count int) {
-	if count <= 0 {
-		return
-	}
-
-	a.serverlessMutex.Lock()
-	defer a.serverlessMutex.Unlock()
-	if count > len(a.pendingServerlessTransitions) {
-		count = len(a.pendingServerlessTransitions)
-	}
-	a.pendingServerlessTransitions = a.pendingServerlessTransitions[count:]
-}
-
 func (a *Agent) AcknowledgeServerlessTransitions(results []agenthttp.ServerlessTransitionResult, reportedCount int) {
 	if len(results) == 0 {
-		a.ClearReportedServerlessTransitions(reportedCount)
+		if reportedCount <= 0 {
+			return
+		}
+
+		a.serverlessMutex.Lock()
+		defer a.serverlessMutex.Unlock()
+		if reportedCount > len(a.pendingServerlessTransitions) {
+			reportedCount = len(a.pendingServerlessTransitions)
+		}
+		a.pendingServerlessTransitions = a.pendingServerlessTransitions[reportedCount:]
 		return
 	}