@rashidee/co2 1.3.17 → 1.3.19

package/plugin/skills/util-gencicdscript/references/cicd-app-template.md

@@ -41,6 +41,11 @@ const PORT = Number(process.env.PORT || loadConfig().port || 5000)
 const STUDIO = process.env.CO2_STUDIO_URL || 'http://127.0.0.1:3001'
 const PROJECT_ID = process.env.CO2_PROJECT_ID || ''
 const TOKEN = process.env.CO2_GUARD_TOKEN || ''
+// Defect 1 — the build id stamped into cicd.config.json at generation. Pinned at boot; when a
+// regeneration rewrites the config with a newer value while this process keeps running, /api/state
+// reports the drift and the page shows a "running older code — restart" banner. Missing (older
+// configs) → null → never a false positive.
+const BOOT_GENERATED_AT = loadConfig().generatedAt || null
 
 mkdirSync(LOG_DIR, { recursive: true })
 const running = new Map() // app name -> ChildProcess (only processes THIS app spawned)
@@ -63,30 +68,60 @@ function currentBranch() {
 
 // ---- Develop gate (Compound Context Studio) --------------------------------------------
 // An application that never completed a conductor-develop run has nothing to build or run —
-// its tab controls are disabled. Refreshed every 30 s; the last known answer is kept when the
-// studio is briefly unreachable, and `null` (never fetched) disables controls with a hint.
-let guardApps = null // Map lower(name|folder) -> developedOnce
-let guardVersions = [] // project versions (semver strings, studio order — latest first)
+// its tab controls are disabled. The studio build guard is authoritative; when it is
+// unreachable we fall back to the on-disk develop tracking file, and ONLY a definitive
+// "never developed" (false) disables controls — unknown fails OPEN (Defect 2c/4).
+//
+// Identity differs across the two sides: the studio keys by the CLAUDE.md application name
+// (e.g. `skolafund-web`), while the plan/config carry a display name (`SkolaFund Web`) and a
+// folder (`skolafund_web`). Match on a separator-insensitive key so all three collapse to the
+// same value (Defect 2b) — exact-lowercase matching silently missed every app.
+function norm(s) { return String(s == null ? '' : s).toLowerCase().replace(/[^a-z0-9]+/g, '') }
+let guardApps = null // Map norm(name) -> developedOnce (last good answer, kept across blips)
+// ok | unauthorized | unreachable | http-<code> | not-configured | init — surfaced in the notice
+// so a disabled/unknown control says WHAT actually happened instead of a hard-coded guess.
+let guardStatus = PROJECT_ID ? 'init' : 'not-configured'
 async function refreshGuard() {
-  if (!PROJECT_ID) return
+  if (!PROJECT_ID) { guardStatus = 'not-configured'; return }
   try {
     const r = await fetch(`${STUDIO}/api/cicd-guard/${PROJECT_ID}?token=${TOKEN}`, { signal: AbortSignal.timeout(3000) })
-    if (!r.ok) return
+    if (r.status === 401) { guardStatus = 'unauthorized'; return } // keep last good guardApps
+    if (!r.ok) { guardStatus = 'http-' + r.status; return }
     const g = await r.json()
     if (Array.isArray(g.applications)) {
-      guardApps = new Map()
-      for (const a of g.applications) guardApps.set(String(a.name).toLowerCase(), !!a.developedOnce)
+      const next = new Map()
+      for (const a of g.applications) next.set(norm(a.name), !!a.developedOnce)
+      guardApps = next
+      guardStatus = 'ok'
     }
-    // The topbar version selector's choices — the {VERSION} tag substituted into commands.
-    if (Array.isArray(g.versions)) guardVersions = g.versions.map((v) => String(v.semver)).filter(Boolean)
-  } catch {}
+  } catch { guardStatus = 'unreachable' } // keep last good guardApps
+}
+// On-disk fallback (Defect 2 fix 3) — conductor-feature-develop writes this app's
+// context/develop/IMPLEMENTATION_MASTER.md with `**Status**: COMPLETED` when development
+// finishes. Read it (mtime-cached) so the gate is correct even with the studio down, restarted
+// or renamed. Mirrors the studio's TRACKING_FILE_MAP.develop.
+const developMarkerCache = new Map() // abs path -> { mtimeMs, done }
+function localDeveloped(app) {
+  const p = join(PROJECT_DIR, app.folder || '', 'context', 'develop', 'IMPLEMENTATION_MASTER.md')
+  try {
+    const mtimeMs = statSync(p).mtimeMs
+    const hit = developMarkerCache.get(p)
+    if (hit && hit.mtimeMs === mtimeMs) return hit.done
+    const done = /^\s*\**\s*Status\s*\**\s*:\s*COMPLETED\b/im.test(readFileSync(p, 'utf8'))
+    developMarkerCache.set(p, { mtimeMs, done })
+    return done
+  } catch { return false }
 }
-function developedOnce(app) {
-  if (!guardApps) return null // unknown — controls stay disabled until the studio answers
-  const byName = guardApps.get(app.name.toLowerCase())
-  if (byName !== undefined) return byName
-  const byFolder = guardApps.get(String(app.folder || '').toLowerCase())
-  return byFolder === undefined ? null : byFolder
+// { val: true|false|null, src: 'studio'|'local'|'none' }. Studio wins; local marker fills the gap
+// when the studio has no answer; null only when nobody knows (controls then stay ENABLED).
+function developInfo(app) {
+  if (guardApps) {
+    let v = guardApps.get(norm(app.name))
+    if (v === undefined) v = guardApps.get(norm(app.folder))
+    if (v !== undefined) return { val: v, src: 'studio' }
+  }
+  if (localDeveloped(app)) return { val: true, src: 'local' }
+  return { val: null, src: 'none' }
 }
 refreshGuard()
 setInterval(refreshGuard, 30_000).unref?.()
@@ -143,7 +178,11 @@ function runLogged(app, command, onExit) {
   const log = createWriteStream(logPath(app.name), { flags: 'a' })
   log.write(`\n--- ${new Date().toISOString()} $ ${command}\n`)
   broadcast(app.name, `\n--- ${new Date().toISOString()} $ ${command}\n`)
-  const child = spawn(command, { cwd: join(PROJECT_DIR, app.folder), shell: true, env: process.env })
+  // detached on POSIX so the shell AND everything it forks (a compound `a && b` start command,
+  // pnpm → vite, etc.) share ONE process group we can signal as a unit on Stop. Without it, `sh`
+  // running `a && b` cannot exec into `b`, so killing the shell alone leaves the real server
+  // reparented to init and still holding the port (Defect 3). Windows kills the tree via taskkill.
+  const child = spawn(command, { cwd: join(PROJECT_DIR, app.folder), shell: true, env: process.env, detached: process.platform !== 'win32' })
   const tap = (d) => { log.write(d); broadcast(app.name, d) }
   child.stdout.on('data', tap)
   child.stderr.on('data', tap)
@@ -229,13 +268,6 @@ function tcpProbe(host, port, timeout = 1000) {
   })
 }
 
-// {VERSION} token substitution — the version comes from the page's topbar selector (the
-// studio guard's versions, latest preselected). Tag-only: never checks out code. The `v`
-// prefix is stripped so docker tags read `1.2.0`, not `v1.2.0`.
-function subst(cmd, version) {
-  return String(cmd || '').replaceAll('{VERSION}', String(version || 'latest').replace(/^v/, ''))
-}
-
 // Managed Dockerfile from the plan's ## Dockerfiles — written before Build only when the
 // application folder has none (an existing Dockerfile is never overwritten).
 function ensureDockerfile(app) {
@@ -249,38 +281,37 @@ function ensureDockerfile(app) {
   } catch (e) { logLine(app, `dockerfile: FAILED to write — ${e.message}`) }
 }
 
-function buildApp(app, version, onDone) {
-  if (activity.has(app.name)) { onDone && onDone(); return }
+function buildApp(app) {
+  if (activity.has(app.name)) return
   activity.set(app.name, 'building'); lastError.delete(app.name)
   ensureConfigs(app)
   ensureDockerfile(app)
-  runLogged(app, subst(app.build, version), (code) => {
+  runLogged(app, app.build, (code) => {
     activity.delete(app.name)
     if (code !== 0) lastError.set(app.name, `build exited ${code} — see log`)
     else logLine(app, 'build OK')
-    onDone && onDone()
   })
 }
 
-function deployApp(app, version) {
+function deployApp(app) {
   if (activity.has(app.name) || !app.deploy) return
   activity.set(app.name, 'deploying'); lastError.delete(app.name)
-  runLogged(app, subst(app.deploy, version), (code) => {
+  runLogged(app, app.deploy, (code) => {
     activity.delete(app.name)
     if (code !== 0) lastError.set(app.name, `deploy exited ${code} — see log`)
     else logLine(app, `deploy OK (${app.deployMethod})`)
   })
 }
 
-function startApp(app, version) {
+function startApp(app) {
   if (running.get(app.name) || activity.has(app.name)) return
   failed.delete(app.name); lastError.delete(app.name)
   ensureConfigs(app)
   if (app.method === 'container') {
-    runLogged(app, subst(app.start, version), () => {})
+    runLogged(app, app.start, () => {})
     saveState(); return
   }
-  const child = runLogged(app, subst(app.start, version), (code) => {
+  const child = runLogged(app, app.start, (code) => {
     running.delete(app.name)
     // A user-requested Stop exits nonzero (killed) — that is not a failure.
     if (code !== 0 && !stopping.delete(app.name)) {
@@ -293,20 +324,27 @@ function startApp(app, version) {
   saveState()
 }
 
-// shell:true spawns a shell whose grandchildren survive child.kill() on Windows — kill the
-// whole tree there (taskkill /T); plain kill elsewhere.
-function killTree(child) {
-  if (process.platform === 'win32' && child.pid) {
-    try { execFileSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore' }) } catch {}
-  } else {
-    try { child.kill() } catch {}
+const delay = (ms) => new Promise((r) => setTimeout(r, ms))
+// A signal-0 probe: alive if it succeeds OR fails with EPERM (exists, not ours to signal).
+function pidAlive(pid) { try { process.kill(Number(pid), 0); return true } catch (e) { return e.code === 'EPERM' } }
+
+// shell:true (and a compound start command) spawns a tree whose grandchildren survive a bare
+// child.kill(). Signal the whole PROCESS GROUP (detached → pgid === the shell's pid), escalating
+// SIGTERM → SIGKILL. Windows: taskkill /T /F kills the tree. Async — the caller awaits it.
+async function killTree(child) {
+  const pid = child && child.pid
+  if (!pid) return
+  if (process.platform === 'win32') {
+    try { execFileSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' }) } catch {}
+    return
   }
+  try { process.kill(-pid, 'SIGTERM') } catch { try { child.kill('SIGTERM') } catch {} }
+  for (let i = 0; i < 40 && pidAlive(pid); i++) await delay(100) // up to ~4s for a graceful exit
+  if (pidAlive(pid)) { try { process.kill(-pid, 'SIGKILL') } catch { try { child.kill('SIGKILL') } catch {} } }
 }
 
-// Stop an app we DON'T hold a child handle for (started outside this app, or before this app
-// last restarted) by killing whatever process tree is listening on its port — so Stop works
-// for any running app, not only ones this CI/CD app spawned. Returns true if a PID was killed.
-function killByPort(port) {
+// PIDs listening on a TCP port. POSIX: lsof, then fuser — both tolerated absent. Windows: netstat.
+function portListeners(port) {
   try {
     if (process.platform === 'win32') {
       const out = execFileSync('netstat', ['-ano', '-p', 'tcp'], { encoding: 'utf8' })
@@ -315,36 +353,60 @@ function killByPort(port) {
         const m = line.match(/:(\d+)\s+\S+\s+LISTENING\s+(\d+)/)
         if (m && Number(m[1]) === Number(port)) pids.add(m[2])
       }
-      for (const pid of pids) {
-        try { execFileSync('taskkill', ['/pid', pid, '/T', '/F'], { stdio: 'ignore' }) } catch {}
-      }
-      return pids.size > 0
+      return [...pids]
     }
-    const out = execFileSync('sh', ['-c', `lsof -ti tcp:${port} || true`], { encoding: 'utf8' })
-    const pids = out.split(/\s+/).filter(Boolean)
-    for (const pid of pids) { try { process.kill(Number(pid)) } catch {} }
-    return pids.length > 0
-  } catch { return false }
+    for (const cmd of [`lsof -ti tcp:${port}`, `fuser -n tcp ${port} 2>/dev/null`]) {
+      const out = execFileSync('sh', ['-c', `${cmd} || true`], { encoding: 'utf8' })
+      const pids = [...new Set(out.split(/\s+/).map((s) => s.trim()).filter((s) => /^\d+$/.test(s)))]
+      if (pids.length) return pids
+    }
+  } catch {}
+  return []
+}
+// Signal a pid's whole process group (falls back to the bare pid if the group is already gone).
+function killGroup(pid, sig) {
+  let pgid = 0
+  if (process.platform !== 'win32') {
+    try { pgid = Number(execFileSync('ps', ['-o', 'pgid=', '-p', String(pid)], { encoding: 'utf8' }).trim()) } catch {}
+  }
+  try { process.kill(pgid ? -pgid : Number(pid), sig) } catch { try { process.kill(Number(pid), sig) } catch {} }
+}
+
+// Stop whatever is listening on a port even when we hold no child handle for it (started outside
+// this app, or before this app last restarted) — group-kill each listener, escalating
+// SIGTERM → SIGKILL. Returns true when the port ended up FREE.
+async function killByPort(port) {
+  let pids = portListeners(port)
+  if (!pids.length) return true // nothing listening — already free
+  if (process.platform === 'win32') {
+    for (const pid of pids) { try { execFileSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' }) } catch {} }
+    for (let i = 0; i < 20 && portListeners(port).length; i++) await delay(100)
+    return portListeners(port).length === 0
+  }
+  for (const pid of pids) killGroup(pid, 'SIGTERM')
+  for (let i = 0; i < 30 && portListeners(port).length; i++) await delay(100) // ~3s grace
+  for (const pid of portListeners(port)) killGroup(pid, 'SIGKILL')
+  await delay(200)
+  return portListeners(port).length === 0
 }
 
-function stopApp(app, version) {
+async function stopApp(app) {
   if (app.method === 'container' && app.stop && app.stop !== 'process-kill') {
-    const stopCmd = subst(app.stop, version)
+    const stopCmd = app.stop
     try { execFileSync(stopCmd.split(' ')[0], stopCmd.split(' ').slice(1), { cwd: PROJECT_DIR }) } catch {}
-  } else {
-    const child = running.get(app.name)
-    if (child) {
-      stopping.add(app.name)
-      killTree(child)
-    } else {
-      // No child handle — kill by port so an externally/previously started app still stops.
-      lastError.delete(app.name)
-      if (!killByPort(app.port)) {
-        lastError.set(app.name, `could not stop — nothing found listening on port ${app.port}`)
-      }
-    }
+    running.delete(app.name)
+    saveState()
+    return
   }
+  lastError.delete(app.name)
+  const child = running.get(app.name)
+  if (child) { stopping.add(app.name); await killTree(child) }
   running.delete(app.name)
+  // ALWAYS sweep the port after killing our handle — the child dying is NOT proof the server did
+  // (its reparented grandchildren, or an app started outside this app, can still hold the port).
+  // Report an honest failure if it never frees, instead of the old silent "success" (Defect 3).
+  const free = await killByPort(app.port)
+  if (!free) lastError.set(app.name, `stop failed — port ${app.port} is still in use`)
   saveState()
 }
 
@@ -368,10 +430,10 @@ body{font-family:system-ui,sans-serif;margin:0;background:#f6f7f9;color:#1c2128;
 .badge.running{background:#1c8a4a}.badge.failed{background:#c23b3b}.badge.building,.badge.deploying{background:#c9922a}
 .url{font-size:12px;color:#1a66d0;text-decoration:underline;word-break:break-all}
 button{background:#fff;color:#1c2128;border:1px solid #c6cdd6;border-radius:6px;padding:4px 12px;font-size:12px;cursor:pointer}
-select{background:#fff;color:#1c2128;border:1px solid #c6cdd6;border-radius:6px;padding:3px 6px;font-size:12px}
 button:hover:enabled{background:#eef1f5}
 button:disabled{opacity:.4;cursor:default}
 .notice{padding:4px 12px;font-size:11px;color:#8a5a00;background:#fff7e6;display:none}
+.stale{padding:6px 12px;font-size:12px;color:#fff;background:#c23b3b;font-weight:600;display:none}
 .err{padding:4px 12px;font-size:11px;color:#c23b3b;display:none;white-space:pre-wrap}
 #log{flex:1;margin:0;padding:10px 12px;background:#0f1216;color:#d7dde4;font-size:11px;line-height:1.5;overflow:auto;white-space:pre-wrap}
 .muted{color:#5b6572;font-size:12px}
@@ -389,11 +451,8 @@ button:disabled{opacity:.4;cursor:default}
 .cfg pre{background:#0f1216;color:#d7dde4;font-size:11px;padding:8px 10px;border-radius:6px;overflow:auto;max-height:320px;white-space:pre-wrap;margin:4px 0 0}
 </style></head><body>
 <div class="top"><strong>CI/CD</strong><span id="branch" class="meta"></span>
-<span class="meta">version</span><select id="ver" title="Tag substituted into {VERSION} in commands (docker image tag)"><option value="">latest</option></select>
-<button onclick="actAll('build')" title="Build every eligible application, one at a time">Build All</button>
-<button onclick="actAll('start')" title="Start every eligible stopped application">Start All</button>
-<button onclick="actAll('stop')" title="Stop every running application">Stop All</button>
 <span style="flex:1"></span><a id="infralink" class="url" href="infra" target="_blank" rel="noreferrer" style="display:none">Infrastructure ↗</a></div>
+<div class="stale" id="stale"></div>
 <div class="tabs" id="tabs"></div>
 <div class="bar" id="bar"></div>
 <div class="notice" id="notice"></div>
@@ -419,11 +478,19 @@ function renderTabs(){
       <span class="dot \${a.phase}"></span>\${a.name}\${a.developedOnce===false?' 🔒':''}</div>\`).join('')
 }
 
+// A guard answer we could not get, said plainly — the notice names the cause it observed instead
+// of always blaming an unreachable studio (Defect 2c/4).
+function guardReason(s){
+  return ({unauthorized:'studio auth failed',unreachable:'studio unreachable','not-configured':'studio link not set',init:'checking…',ok:'not listed by the studio'})[s]
+    || ('studio error '+String(s||'').replace(/^http-/,''))
+}
 function renderBar(){
   const a = appOf(active)
   if (!a) return
   const url = 'http://'+location.hostname+':'+a.port+'/'
-  const gate = a.developedOnce === true
+  // Fail OPEN — only a definitive "never developed" (false) disables controls; unknown (null)
+  // leaves them enabled so an unverifiable studio never locks the user out (Defect 2c/4).
+  const gate = a.developedOnce !== false
   const busy = a.phase==='building'||a.phase==='deploying'
   document.getElementById('bar').innerHTML = \`
     <span class="badge \${a.phase}">\${a.phase}\${a.external?' (external)':''}</span>
@@ -431,7 +498,7 @@ function renderBar(){
     <a class="url" href="\${url}" target="_blank" rel="noreferrer">\${url}</a>
     <span style="flex:1"></span>
     <button onclick="openConfig()" title="Show this application's runtime configuration files">Config</button>
-    <button onclick="act('build')" \${!gate||busy||a.phase==='running'?'disabled':''} title="\${a.image?'Builds the app AND the docker image '+a.image+':<version>':'Runs the plan build command'}">Build</button>
+    <button onclick="act('build')" \${!gate||busy||a.phase==='running'?'disabled':''} title="\${a.image?'Builds the app AND the docker image '+a.image+':latest':'Runs the plan build command'}">Build</button>
     <button onclick="act('start')" \${!gate||busy||a.phase==='running'?'disabled':''}>Start</button>
     <button onclick="act('stop')" \${a.phase!=='running'?'disabled':''}>Stop</button>
     \${a.deploy?\`<button onclick="act('deploy')" \${!gate||busy?'disabled':''}>Deploy (\${a.deployMethod})</button>\`:''}\`
@@ -440,7 +507,10 @@ function renderBar(){
     notice.textContent = 'This application has not been developed through the workflow yet — run conductor-feature-develop first.'
     notice.style.display = 'block'
   } else if (a.developedOnce === null) {
-    notice.textContent = 'Develop status not verified yet (studio unreachable) — controls stay disabled.'
+    notice.textContent = 'Develop status unverified (' + guardReason(state.guardStatus) + ') — controls left enabled.'
+    notice.style.display = 'block'
+  } else if (a.developSource === 'local') {
+    notice.textContent = 'Develop status read from this app’s local tracking file (studio guard unavailable).'
     notice.style.display = 'block'
   } else notice.style.display = 'none'
   const err = document.getElementById('err')
@@ -461,7 +531,10 @@ function setActive(name){
 function openWs(name){
   // Path-relative + scheme-aware so the stream works direct (:5000/) AND behind the studio's
   // /api/cicd/<id>/app-proxy/ prefix (which tunnels the upgrade), also under HTTPS.
-  ws = new WebSocket((location.protocol==='https:'?'wss://':'ws://')+location.host+location.pathname.replace(/\/$/,'')+'/ws?app='+encodeURIComponent(name))
+  // NO backslash/regex here on purpose: this string is inside server.js's PAGE template literal,
+  // where a client-side regex like /\/$/ cooks to //$/ (a line comment) and kills the script.
+  var base = location.pathname.endsWith('/') ? location.pathname.slice(0, -1) : location.pathname
+  ws = new WebSocket((location.protocol==='https:'?'wss://':'ws://')+location.host+base+'/ws?app='+encodeURIComponent(name))
   ws.onmessage = e => appendLog(e.data)
   ws.onclose = () => { ws = null; if (active === name) wsTimer = setTimeout(() => openWs(name), 2000) }
 }
@@ -501,35 +574,21 @@ async function openConfig(){
 function closeConfig(){ document.getElementById('cfgModal').classList.remove('open') }
 document.addEventListener('keydown', e => { if (e.key === 'Escape') closeConfig() })
 
-// Topbar version selector — the studio guard's project versions (latest first). Repopulated
-// only when the list changes so the user's selection survives the 3 s poll.
-let verChoices = ''
-function renderVersions(versions){
-  const sel = document.getElementById('ver')
-  const list = (versions && versions.length ? versions : []).join('|')
-  if (list === verChoices) return
-  verChoices = list
-  sel.innerHTML = (versions && versions.length ? versions : ['latest'])
-    .map((v, i) => '<option value="'+esc(v)+'"'+(i===0?' selected':'')+'>'+esc(v)+'</option>').join('')
-}
-function selectedVersion(){ return document.getElementById('ver').value || '' }
-
 async function refresh(){
   const s = await fetch('api/state').then(r => r.json()).catch(() => null)
   if (!s) return
   state = s
   document.getElementById('branch').textContent = s.currentBranch ? 'branch: '+s.currentBranch : ''
   document.getElementById('infralink').style.display = s.hasInfra ? 'inline' : 'none'
-  renderVersions(s.versions)
+  // Defect 1 — the app was regenerated in place while this process kept serving the old code.
+  const stale = document.getElementById('stale')
+  if (s.regenerated) { stale.textContent = 'This CI/CD app is running older code than was generated — restart it (Stop, then Start).'; stale.style.display = 'block' }
+  else stale.style.display = 'none'
   if (!active && s.apps.length) setActive(s.apps[0].name)
   renderTabs(); renderBar()
 }
 async function act(op){
-  await fetch('api/apps/'+encodeURIComponent(active)+'/'+op+'?version='+encodeURIComponent(selectedVersion()), { method: 'POST' })
-  refresh()
-}
-async function actAll(op){
-  await fetch('api/all/'+op+'?version='+encodeURIComponent(selectedVersion()), { method: 'POST' })
+  await fetch('api/apps/'+encodeURIComponent(active)+'/'+op, { method: 'POST' })
   refresh()
 }
 // Rescan immediately when the user returns to this page (tab focus / regained visibility), so
@@ -602,19 +661,24 @@ const server = http.createServer(async (req, res) => {
     const apps = await Promise.all(loadConfig().apps.map(async (a) => {
       const healthy = await probe(a)
       const phase = activity.get(a.name) || (healthy ? 'running' : failed.has(a.name) ? 'failed' : 'stopped')
+      const dev = developInfo(a)
       return {
         name: a.name, method: a.method, port: a.port, phase,
         deploy: !!a.deploy, deployMethod: a.deployMethod || 'none',
         image: a.image || null,
         external: healthy && !running.has(a.name),
-        developedOnce: developedOnce(a),
+        developedOnce: dev.val, developSource: dev.src,
         error: lastError.get(a.name) || null,
       }
     }))
+    // Defect 1 — regenerated in place while still running the old code (config's generatedAt
+    // moved past the value pinned at boot).
+    const nowGen = loadConfig().generatedAt || null
     return json(res, 200, {
       currentBranch: currentBranch(),
       hasInfra: (loadConfig().infra || []).length > 0,
-      versions: guardVersions,
+      guardStatus,
+      regenerated: !!(BOOT_GENERATED_AT && nowGen !== BOOT_GENERATED_AT),
       apps,
     })
   }
@@ -624,54 +688,21 @@ const server = http.createServer(async (req, res) => {
     if (!app) return json(res, 404, { error: 'unknown app' })
     return json(res, 200, { configs: (app.configs || []).map((c) => readConfig(app, c)) })
   }
-  // ?version=<semver> on every action — the topbar selection, substituted into {VERSION}.
-  const reqVersion = (() => {
-    try { return new URL(req.url, 'http://x').searchParams.get('version') || '' } catch { return '' }
-  })()
   const path = (req.url || '').split('?')[0]
   const m = path.match(/^\/api\/apps\/([^/]+)\/(build|start|stop|deploy)$/)
   if (m && req.method === 'POST') {
     const app = loadConfig().apps.find((a) => a.name === decodeURIComponent(m[1]))
     if (!app) return json(res, 404, { error: 'unknown app' })
-    if (m[2] !== 'stop' && developedOnce(app) === false) {
+    // Only a DEFINITIVE "never developed" blocks — unknown (null) fails open (Defect 2c/4).
+    if (m[2] !== 'stop' && developInfo(app).val === false) {
       return json(res, 409, { error: 'application has not completed a develop workflow run' })
     }
-    if (m[2] === 'build') buildApp(app, reqVersion)
-    else if (m[2] === 'start') startApp(app, reqVersion)
-    else if (m[2] === 'deploy') deployApp(app, reqVersion)
-    else stopApp(app, reqVersion)
+    if (m[2] === 'build') buildApp(app)
+    else if (m[2] === 'start') startApp(app)
+    else if (m[2] === 'deploy') deployApp(app)
+    else await stopApp(app)
     return json(res, 200, { ok: true })
   }
-  // All-apps controls. Eligible = develop gate not failed and not mid-build/deploy; build and
-  // start additionally skip apps already running. Builds run SEQUENTIALLY (honest logs, no
-  // CPU storm); start/stop fire together. Ineligible apps are skipped silently.
-  const all = path.match(/^\/api\/all\/(build|start|stop)$/)
-  if (all && req.method === 'POST') {
-    const op = all[1]
-    const apps = loadConfig().apps
-    if (op === 'stop') {
-      for (const a of apps) {
-        if (running.has(a.name)) stopApp(a, reqVersion)
-        else probe(a).then((up) => { if (up) stopApp(a, reqVersion) })
-      }
-      return json(res, 200, { ok: true })
-    }
-    const eligible = []
-    for (const a of apps) {
-      if (developedOnce(a) === false || activity.has(a.name)) continue
-      if (await probe(a)) continue // already running — skip for build AND start
-      eligible.push(a)
-    }
-    if (op === 'start') {
-      for (const a of eligible) startApp(a, reqVersion)
-      return json(res, 200, { ok: true, count: eligible.length })
-    }
-    // op === 'build' — sequential chain: each build starts when the previous one exits.
-    const queue = [...eligible]
-    const next = () => { const a = queue.shift(); if (a) buildApp(a, reqVersion, next) }
-    next()
-    return json(res, 200, { ok: true, count: eligible.length })
-  }
   json(res, 404, { error: 'not found' })
 })
 
@@ -708,6 +739,10 @@ server.listen(PORT, () => console.log(`cicd app on :${PORT}`))
 
 `cicd/app/cicd.config.json` shape — one `apps` entry per application from the plan's Deployment
 Decisions table, one `infra` entry per row of the plan's `## Infrastructure` table.
+Top-level `"generatedAt"` is an ISO-8601 UTC timestamp **stamped fresh on every generation**
+(Defect 1): the running server pins the value it booted with and flags a "restart required" banner
+once a regeneration moves it forward, so a stale in-place-replaced process is self-diagnosing. It
+MUST change on each run — use the actual generation time (e.g. `new Date().toISOString()`).
 `deployMethod`/`deploy` come from the plan's Deploy columns (`deploy` is `null` when the method
 is `none`). `infra[].url` is `null` for a headless service (Console URL cell `-`); emit
 `"infra": []` when the plan declares no supporting services.
@@ -718,9 +753,8 @@ Docker fields (from the plan's `## Docker` / `## Dockerfiles` sections): top-lev
 `"dockerfile"` is `{ "path": "Dockerfile", "content": "<managed body>" }` for a `managed`
 Dockerfile (materialized before Build when missing — never overwriting), or
 `{ "path": "Dockerfile", "content": null }` for an `existing` one (`null` entirely when the
-app has no image). Commands may carry the literal `{VERSION}` token — copied verbatim; the
-server substitutes the topbar-selected version (semver sans `v`, fallback `latest`) at
-execution time.
+app has no image). Commands are copied verbatim from the plan and run as-is — no `{VERSION}`
+or any other token substitution.
 
 Each app also carries a `configs` array — the runtime config files the application reads at start,
 from the plan's `## Application Configs` section (one entry per file). Fields:
@@ -736,6 +770,7 @@ verbatim (this is a local dev CI/CD app).
 ```json
 {
   "port": 5000,
+  "generatedAt": "2026-07-24T09:15:00.000Z",
   "docker": { "registry": "registry.example.com/team" },
   "apps": [
     {
@@ -743,7 +778,7 @@ verbatim (this is a local dev CI/CD app).
       "folder": "my-app",
       "method": "process",
       "port": 3000,
-      "build": "pnpm install && pnpm build && docker build -t registry.example.com/team/my-app:{VERSION} .",
+      "build": "rm -rf dist && pnpm install && pnpm build && docker build --no-cache -t registry.example.com/team/my-app:latest .",
       "start": "node dist/index.js",
       "stop": "process-kill",
       "deployMethod": "kubernetes",