@synapta/skills 0.1.0 → 0.1.2

package/skills/deploy-railway/scripts/enable-pg-stats.py

@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+"""
+Enable pg_stat_statements for query statistics tracking.
+
+This script replicates the frontend's Metrics.tsx enable logic:
+1. Check if pg_stat_statements is already in shared_preload_libraries
+2. If yes, just install the extension
+3. If no, install extension + ALTER SYSTEM + restart
+
+Usage:
+    enable-pg-stats.py --service <name>
+
+Requires: railway CLI linked to the correct project/environment
+
+IMPORTANT: This script requires interactive terminal confirmation.
+It cannot be run with piped input - the user must confirm directly.
+"""
+
+import argparse
+import sys
+import re
+from typing import List
+
+from dal import run_psql_query, info, error, confirm_with_user
+
+
+def parse_preload_libraries(value: str) -> List[str]:
+    """Parse shared_preload_libraries value into clean library names."""
+    if not value or not value.strip():
+        return []
+
+    # Split by comma and clean up quotes
+    libs = []
+    for lib in value.split(","):
+        clean = lib.strip().replace('"', '').replace("'", '')
+        # Validate as PostgreSQL identifier
+        if clean and re.match(r'^[a-zA-Z_][a-zA-Z0-9_]*$', clean):
+            libs.append(clean)
+    return libs
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Enable pg_stat_statements for query performance tracking.",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+What this does:
+  1. Checks if pg_stat_statements is already in shared_preload_libraries
+  2. Installs the extension: CREATE EXTENSION IF NOT EXISTS pg_stat_statements
+  3. If library wasn't preloaded: configures shared_preload_libraries and restarts
+
+Note: If restart is needed, the database will have brief downtime.
+
+IMPORTANT: This script requires interactive terminal confirmation and cannot
+be automated. The user must confirm the action directly.
+        """
+    )
+
+    parser.add_argument("--service", required=True, help="Service name (requires linked project)")
+
+    args = parser.parse_args()
+    service = args.service
+
+    # Step 1: Check current shared_preload_libraries
+    info("Checking current shared_preload_libraries...")
+    code, output = run_psql_query(service, "SHOW shared_preload_libraries")
+    if code != 0:
+        error(f"Failed to query shared_preload_libraries: {output}")
+
+    current_libs = output
+    info(f"Current shared_preload_libraries: {current_libs or '<empty>'}")
+
+    # Check if pg_stat_statements is already loaded
+    existing_libs = parse_preload_libraries(current_libs)
+    library_already_loaded = "pg_stat_statements" in existing_libs
+
+    if library_already_loaded:
+        info("pg_stat_statements is already in shared_preload_libraries")
+        needs_restart = False
+    else:
+        info("pg_stat_statements is NOT in shared_preload_libraries (will need restart)")
+        needs_restart = True
+
+    # Step 2: Check if extension is already installed
+    info("Checking if pg_stat_statements extension is installed...")
+    code, output = run_psql_query(service, "SELECT 1 FROM pg_extension WHERE extname = 'pg_stat_statements'")
+
+    extension_exists = code == 0 and output.strip() == "1"
+
+    if extension_exists:
+        info("pg_stat_statements extension is already installed")
+        needs_install = False
+    else:
+        info("pg_stat_statements extension needs to be installed")
+        needs_install = True
+
+    # If everything is already configured, exit early
+    if not needs_restart and not needs_install:
+        info("pg_stat_statements is fully configured and ready!")
+        print("")
+        print("Query statistics are available. Run:")
+        print("  SELECT * FROM pg_stat_statements LIMIT 10;")
+        return 0
+
+    # Confirm before making changes - REQUIRES interactive terminal
+    print("")
+    print(f"About to make the following changes to '{service}':")
+    if needs_install:
+        print("  - Install pg_stat_statements extension")
+    if needs_restart:
+        print("  - Configure shared_preload_libraries")
+        print("  - Restart the database (brief downtime)")
+    print("")
+
+    if not confirm_with_user("Continue? [y/N]"):
+        print("Cancelled.")
+        return 1
+
+    # Step 3: Install extension
+    if needs_install:
+        info("Installing pg_stat_statements extension...")
+        code, output = run_psql_query(service, "CREATE EXTENSION IF NOT EXISTS pg_stat_statements")
+        if code != 0:
+            error(f"Failed to install extension: {output}")
+        info("Extension installed")
+
+    # Step 4: Configure shared_preload_libraries and restart if needed
+    if needs_restart:
+        info("Configuring shared_preload_libraries...")
+
+        # Add pg_stat_statements to existing libraries
+        if "pg_stat_statements" not in existing_libs:
+            existing_libs.append("pg_stat_statements")
+
+        # Build ALTER SYSTEM with individual quoted values
+        # PostgreSQL syntax: ALTER SYSTEM SET shared_preload_libraries TO 'lib1', 'lib2'
+        quoted_libs = ", ".join(f"'{lib}'" for lib in existing_libs)
+        alter_query = f"ALTER SYSTEM SET shared_preload_libraries TO {quoted_libs}"
+
+        info(f"Setting shared_preload_libraries to: {', '.join(existing_libs)}")
+
+        code, output = run_psql_query(service, alter_query)
+        if code != 0:
+            error(f"Failed to configure shared_preload_libraries: {output}")
+        info("shared_preload_libraries configured")
+
+        # Step 5: Restart the service
+        info("Restarting database service...")
+        code, stdout, stderr = run_railway_command(["restart", "--service", service, "--yes"])
+        if code != 0:
+            error(f"Failed to restart service: {stderr or stdout}")
+
+        print("")
+        info("Database is restarting. Query statistics will be available shortly.")
+        print("")
+        print("After restart completes, verify with:")
+        print("  SHOW shared_preload_libraries;")
+        print("  SELECT * FROM pg_stat_statements LIMIT 5;")
+    else:
+        print("")
+        info("pg_stat_statements is now ready!")
+        print("")
+        print("Query statistics are available. Run:")
+        print("  SELECT * FROM pg_stat_statements LIMIT 10;")
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/deploy-railway/scripts/pg-extensions.py

@@ -0,0 +1,370 @@
+#!/usr/bin/env python3
+"""
+Manage PostgreSQL extensions for Railway database services.
+
+This script replicates the frontend's Extensions.tsx logic:
+- List available and installed extensions
+- Install extensions with automatic dependency handling
+- Uninstall extensions with dependency checking
+
+Usage:
+    pg-extensions.py --service <name> list
+    pg-extensions.py --service <name> install <extension> [--version <ver>]
+    pg-extensions.py --service <name> uninstall <extension>
+    pg-extensions.py --service <name> info <extension>
+
+Requires: railway CLI linked to the correct project/environment
+
+IMPORTANT: Install and uninstall require interactive terminal confirmation.
+They cannot be run with piped input - the user must confirm directly.
+"""
+
+import argparse
+import sys
+import json
+from typing import Tuple, List, Optional, Dict, Any
+from dataclasses import dataclass
+
+from dal import run_psql_query, info, error, confirm_with_user
+
+
+@dataclass
+class Extension:
+    """PostgreSQL extension info."""
+    name: str
+    default_version: str
+    installed_version: Optional[str]
+    comment: str
+
+
+def list_extensions(service: str, json_output: bool = False) -> List[Extension]:
+    """List all available and installed extensions."""
+    # Query available extensions
+    available_query = "SELECT name, default_version, comment FROM pg_available_extensions ORDER BY name"
+    code, output = run_psql_query(service, available_query)
+    if code != 0:
+        error(f"Failed to query available extensions: {output}")
+
+    # Parse available extensions
+    available = {}
+    for line in output.strip().split("\n"):
+        if not line:
+            continue
+        parts = line.split("|")
+        if len(parts) >= 2:
+            name = parts[0].strip()
+            version = parts[1].strip()
+            comment = parts[2].strip() if len(parts) > 2 else ""
+            available[name] = {"version": version, "comment": comment}
+
+    # Query installed extensions
+    installed_query = "SELECT extname, extversion FROM pg_extension"
+    code, output = run_psql_query(service, installed_query)
+    if code != 0:
+        error(f"Failed to query installed extensions: {output}")
+
+    # Parse installed extensions
+    installed = {}
+    for line in output.strip().split("\n"):
+        if not line:
+            continue
+        parts = line.split("|")
+        if len(parts) >= 2:
+            name = parts[0].strip()
+            version = parts[1].strip()
+            installed[name] = version
+
+    # Build extension list
+    extensions = []
+    for name, info in available.items():
+        ext = Extension(
+            name=name,
+            default_version=info["version"],
+            installed_version=installed.get(name),
+            comment=info["comment"]
+        )
+        extensions.append(ext)
+
+    if json_output:
+        print(json.dumps([{
+            "name": e.name,
+            "defaultVersion": e.default_version,
+            "installedVersion": e.installed_version,
+            "comment": e.comment
+        } for e in extensions], indent=2))
+    else:
+        # Print formatted output
+        installed_exts = [e for e in extensions if e.installed_version]
+        available_exts = [e for e in extensions if not e.installed_version]
+
+        print(f"\n{len(installed_exts)} Extension(s) installed:")
+        print("-" * 60)
+        if installed_exts:
+            for e in sorted(installed_exts, key=lambda x: x.name):
+                print(f"  {e.name} (v{e.installed_version})")
+        else:
+            print("  (none)")
+
+        print(f"\n{len(available_exts)} Extension(s) available:")
+        print("-" * 60)
+        for e in sorted(available_exts, key=lambda x: x.name)[:30]:
+            desc = f" - {e.comment[:50]}..." if e.comment and len(e.comment) > 50 else f" - {e.comment}" if e.comment else ""
+            print(f"  {e.name} (v{e.default_version}){desc}")
+        if len(available_exts) > 30:
+            print(f"  ... and {len(available_exts) - 30} more")
+
+    return extensions
+
+
+def get_extension_dependencies(service: str, extension: str) -> List[str]:
+    """Get dependencies for an extension."""
+    query = f"""
+        SELECT DISTINCT unnest(pev.requires) as dependency
+        FROM pg_available_extension_versions pev
+        WHERE pev.name = '{extension}' AND pev.requires IS NOT NULL
+        ORDER BY dependency
+    """
+    code, output = run_psql_query(service, query)
+    if code != 0:
+        return []
+
+    deps = []
+    for line in output.strip().split("\n"):
+        if line.strip():
+            deps.append(line.strip())
+    return deps
+
+
+def get_extension_dependents(service: str, extension: str) -> List[str]:
+    """Get extensions that depend on this extension."""
+    query = f"""
+        SELECT e.extname AS dependent_extension
+        FROM pg_depend d
+        JOIN pg_extension e ON d.objid = e.oid
+        JOIN pg_extension ref_e ON d.refobjid = ref_e.oid
+        WHERE d.classid = 'pg_extension'::regclass
+            AND d.refclassid = 'pg_extension'::regclass
+            AND ref_e.extname = '{extension}'
+        ORDER BY dependent_extension
+    """
+    code, output = run_psql_query(service, query)
+    if code != 0:
+        return []
+
+    dependents = []
+    for line in output.strip().split("\n"):
+        if line.strip():
+            dependents.append(line.strip())
+    return dependents
+
+
+def is_extension_installed(service: str, extension: str) -> Tuple[bool, Optional[str]]:
+    """Check if extension is installed, return (installed, version)."""
+    query = f"SELECT extversion FROM pg_extension WHERE extname = '{extension}'"
+    code, output = run_psql_query(service, query)
+    if code == 0 and output.strip():
+        return True, output.strip()
+    return False, None
+
+
+def is_extension_available(service: str, extension: str) -> bool:
+    """Check if extension is available in the image."""
+    query = f"SELECT 1 FROM pg_available_extensions WHERE name = '{extension}'"
+    code, output = run_psql_query(service, query)
+    return code == 0 and output.strip() == "1"
+
+
+def install_extension(service: str, extension: str, version: Optional[str] = None) -> bool:
+    """Install an extension with CASCADE (auto-install dependencies)."""
+    # Check if available
+    if not is_extension_available(service, extension):
+        error(f"Extension '{extension}' is not available in this database image")
+
+    # Check if already installed
+    installed, curr_ver = is_extension_installed(service, extension)
+    if installed:
+        info(f"Extension '{extension}' is already installed (v{curr_ver})")
+        return True
+
+    # Check dependencies and confirm - REQUIRES interactive terminal
+    deps = get_extension_dependencies(service, extension)
+    if deps:
+        print(f"\nInstalling '{extension}' will also install these dependencies: {', '.join(deps)}")
+    else:
+        print(f"\nAbout to install extension '{extension}'")
+
+    if not confirm_with_user("Continue? [y/N]"):
+        print("Cancelled.")
+        return False
+
+    # Build install query
+    query = f'CREATE EXTENSION IF NOT EXISTS "{extension}"'
+    if version:
+        query += f" VERSION '{version}'"
+    query += " CASCADE"  # Auto-install dependencies
+
+    info(f"Installing extension '{extension}'...")
+    code, output = run_psql_query(service, query)
+    if code != 0:
+        error(f"Failed to install extension: {output}")
+
+    # Verify installation
+    installed, ver = is_extension_installed(service, extension)
+    if installed:
+        info(f"Successfully installed '{extension}' (v{ver})")
+        if deps:
+            info(f"Dependencies installed: {', '.join(deps)}")
+        return True
+    else:
+        error("Extension installation failed - not found after CREATE EXTENSION")
+    return False
+
+
+def uninstall_extension(service: str, extension: str) -> bool:
+    """Uninstall an extension."""
+    # Check if installed
+    installed, ver = is_extension_installed(service, extension)
+    if not installed:
+        info(f"Extension '{extension}' is not installed")
+        return True
+
+    # Check for dependents
+    dependents = get_extension_dependents(service, extension)
+    if dependents:
+        error(f"Cannot uninstall '{extension}' - these extensions depend on it: {', '.join(dependents)}")
+
+    # Confirm - REQUIRES interactive terminal
+    print(f"\nAbout to uninstall '{extension}' (v{ver})")
+    if not confirm_with_user("Continue? [y/N]"):
+        print("Cancelled.")
+        return False
+
+    # Uninstall
+    query = f'DROP EXTENSION IF EXISTS "{extension}"'
+    info(f"Uninstalling extension '{extension}'...")
+    code, output = run_psql_query(service, query)
+    if code != 0:
+        error(f"Failed to uninstall extension: {output}")
+
+    # Verify
+    installed, _ = is_extension_installed(service, extension)
+    if not installed:
+        info(f"Successfully uninstalled '{extension}'")
+        return True
+    else:
+        error("Extension uninstall failed - still found after DROP EXTENSION")
+    return False
+
+
+def extension_info(service: str, extension: str, json_output: bool = False):
+    """Show detailed info about an extension."""
+    # Check availability
+    available = is_extension_available(service, extension)
+    if not available:
+        error(f"Extension '{extension}' is not available in this database image")
+
+    # Get info
+    query = f"SELECT name, default_version, comment FROM pg_available_extensions WHERE name = '{extension}'"
+    code, output = run_psql_query(service, query)
+    if code != 0:
+        error(f"Failed to get extension info: {output}")
+
+    parts = output.strip().split("|")
+    name = parts[0].strip() if parts else extension
+    default_version = parts[1].strip() if len(parts) > 1 else "unknown"
+    comment = parts[2].strip() if len(parts) > 2 else ""
+
+    installed, installed_version = is_extension_installed(service, extension)
+    deps = get_extension_dependencies(service, extension)
+    dependents = get_extension_dependents(service, extension) if installed else []
+
+    if json_output:
+        print(json.dumps({
+            "name": name,
+            "defaultVersion": default_version,
+            "installedVersion": installed_version,
+            "comment": comment,
+            "dependencies": deps,
+            "dependents": dependents
+        }, indent=2))
+    else:
+        print(f"\nExtension: {name}")
+        print("-" * 40)
+        print(f"  Default Version: {default_version}")
+        print(f"  Installed: {'Yes (v' + installed_version + ')' if installed else 'No'}")
+        if comment:
+            print(f"  Description: {comment}")
+        if deps:
+            print(f"  Dependencies: {', '.join(deps)}")
+        if dependents:
+            print(f"  Required by: {', '.join(dependents)}")
+        print()
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Manage PostgreSQL extensions for Railway services.",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  List all extensions (safe, no confirmation needed):
+    pg-extensions.py --service my-postgres list
+
+  Install an extension (requires interactive confirmation):
+    pg-extensions.py --service my-postgres install postgis
+    pg-extensions.py --service my-postgres install pgvector --version 0.5.0
+
+  Uninstall an extension (requires interactive confirmation):
+    pg-extensions.py --service my-postgres uninstall postgis
+
+  Get extension info (safe, no confirmation needed):
+    pg-extensions.py --service my-postgres info pg_stat_statements
+
+IMPORTANT: Install and uninstall require interactive terminal confirmation.
+They cannot be automated or run with piped input.
+        """
+    )
+
+    parser.add_argument("--service", required=True, help="Service name (requires linked project)")
+    parser.add_argument("--json", action="store_true", help="Output as JSON")
+
+    subparsers = parser.add_subparsers(dest="command", help="Command to run")
+
+    # list command (safe - no confirmation)
+    list_parser = subparsers.add_parser("list", help="List available and installed extensions")
+
+    # install command (requires interactive confirmation)
+    install_parser = subparsers.add_parser("install", help="Install an extension (requires confirmation)")
+    install_parser.add_argument("extension", help="Extension name")
+    install_parser.add_argument("--version", "-v", help="Specific version to install")
+
+    # uninstall command (requires interactive confirmation)
+    uninstall_parser = subparsers.add_parser("uninstall", help="Uninstall an extension (requires confirmation)")
+    uninstall_parser.add_argument("extension", help="Extension name")
+
+    # info command
+    info_parser = subparsers.add_parser("info", help="Show extension info")
+    info_parser.add_argument("extension", help="Extension name")
+
+    args = parser.parse_args()
+
+    if not args.command:
+        parser.print_help()
+        return 1
+
+    service = args.service
+
+    if args.command == "list":
+        list_extensions(service, json_output=args.json)
+    elif args.command == "install":
+        install_extension(service, args.extension, version=args.version)
+    elif args.command == "uninstall":
+        uninstall_extension(service, args.extension)
+    elif args.command == "info":
+        extension_info(service, args.extension, json_output=args.json)
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/deploy-railway/scripts/railway-api.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Railway GraphQL API helper
+# Usage: railway-api.sh '<graphql-query>' ['<variables-json>']
+
+set -e
+
+SKILL_ID="use-railway"
+SKILL_VERSION="${RAILWAY_SKILL_VERSION:-1.2.1}"
+
+export RAILWAY_CALLER="${RAILWAY_CALLER:-skill:${SKILL_ID}@${SKILL_VERSION}}"
+export RAILWAY_AGENT_SESSION="${RAILWAY_AGENT_SESSION:-railway-skill-$(date +%s)-$$}"
+
+if ! command -v jq &>/dev/null; then
+  echo '{"error": "jq not installed. Install with: brew install jq"}'
+  exit 1
+fi
+
+CONFIG_FILE="$HOME/.railway/config.json"
+
+if [[ ! -f "$CONFIG_FILE" ]]; then
+  echo '{"error": "Railway config not found. Run: railway login"}'
+  exit 1
+fi
+
+TOKEN=$(jq -r '.user.token' "$CONFIG_FILE")
+
+if [[ -z "$TOKEN" || "$TOKEN" == "null" ]]; then
+  echo '{"error": "No Railway token found. Run: railway login"}'
+  exit 1
+fi
+
+if [[ -z "$1" ]]; then
+  echo '{"error": "No query provided"}'
+  exit 1
+fi
+
+# Build payload with query and optional variables
+if [[ -n "$2" ]]; then
+  PAYLOAD=$(jq -n --arg q "$1" --argjson v "$2" '{query: $q, variables: $v}')
+else
+  PAYLOAD=$(jq -n --arg q "$1" '{query: $q}')
+fi
+
+HEADERS=(
+  -H "Authorization: Bearer $TOKEN"
+  -H "Content-Type: application/json"
+  -H "X-Railway-Skill-Id: $SKILL_ID"
+  -H "X-Railway-Skill-Version: $SKILL_VERSION"
+  -H "X-Railway-Agent-Session: $RAILWAY_AGENT_SESSION"
+)
+
+curl -s https://backboard.railway.com/graphql/v2 "${HEADERS[@]}" -d "$PAYLOAD"

package/skills/deploy-ssh/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: deploy-ssh
+description: Zero-downtime deploys over SSH using rsync + atomic symlink swap + systemd unit reload. For VPS / bare-metal targets where a managed platform isn't viable.
+triggers: [synapta deploy ssh, ssh deploy, rsync deploy, VPS, bare-metal, systemd, atomic deploy]
+network: allowlist
+tools: [Bash]
+source:
+  origin: authored-by-synapta
+  reason: "Surprising community gap — no production-quality community SKILL.md for SSH deploys at adoption time."
+  citation_patterns:
+    - "DeployHQ rsync cheatsheet (https://www.deployhq.com/cheatsheets/rsync)"
+    - "Lambros Petrou — Server deploy scripts (https://www.lambrospetrou.com/articles/server-deploy-scripts/)"
+    - "Capistrano's atomic-deploy pattern (releases/ + current symlink)"
+---
+
+# Deploy: SSH
+
+Atomic, zero-downtime deploys to a single host (VPS / bare metal) over SSH. Pattern: `releases/<sha>/` directory + atomic `current` symlink swap + `systemctl reload`.
+
+## Required credentials
+
+| Env / config | Purpose |
+|---|---|
+| `SSH_HOST` | host or hostname (e.g. `web01.example.com`) |
+| `SSH_USER` | deploy user (NOT root) |
+| `SSH_KEY_PATH` | path to deploy private key on the runner |
+| `DEPLOY_ROOT` | path on host, e.g. `/srv/<app>` |
+
+## Directory layout on host
+
+```
+/srv/<app>/
+├── releases/
+│   ├── <sha1>/
+│   ├── <sha2>/
+│   └── <sha3>/   ← new release lands here first
+├── shared/        ← persistent (uploads, logs, .env)
+└── current -> releases/<sha3>   ← atomic symlink
+```
+
+## Deploy steps
+
+1. **Build artifact** in CI (or on host via separate `build` step). Produce a self-contained tarball.
+2. **rsync** the new release to `releases/<sha>/` on the host. Use `--delete` and `--exclude=node_modules` (or vendor as needed).
+3. **Link shared** dirs: `ln -s ../../shared/.env releases/<sha>/.env`, same for uploads/logs.
+4. **Run any pre-flight** (DB migrations, asset compile) inside the new release dir, NOT the live one.
+5. **Atomic swap**: `ln -sfn releases/<sha> current` then `mv current.tmp current` if the system requires the rename pattern.
+6. **Reload**: `systemctl --user reload <app>` (or restart if reload isn't supported). The service unit points at `current/bin/<entry>`.
+7. **Health check**: GET `/health` on the listening port. If unhealthy within N seconds, roll back.
+8. **Prune**: keep the last 5 releases; remove older.
+
+## Rollback
+
+```sh
+ssh "$SSH_HOST" "ln -sfn $DEPLOY_ROOT/releases/<previous-sha> $DEPLOY_ROOT/current && systemctl --user reload <app>"
+```
+
+The release dirs from previous successful deploys are intact, so rollback is one symlink swap.
+
+## systemd service unit
+
+```ini
+[Unit]
+Description=<app>
+After=network.target
+
+[Service]
+WorkingDirectory=/srv/<app>/current
+ExecStart=/srv/<app>/current/bin/<entry>
+Restart=on-failure
+EnvironmentFile=/srv/<app>/shared/.env
+
+[Install]
+WantedBy=default.target
+```
+
+User units (run as the deploy user) avoid needing root for reloads.
+
+## Security defaults
+
+- `SSH_USER` is NOT root. It can `systemctl --user` its own units but not modify the system.
+- Deploy key is **deploy-only**: no shell, restricted to a `command=` in `authorized_keys` if possible.
+- `.env` lives in `shared/` only on the host. CI never sees production secrets.
+- Inbound port reachable only from the LB / Cloudflare / Tailscale; no public 22 if avoidable.
+
+## Anti-patterns
+
+- `scp` overwriting the live directory — not atomic, partial state visible
+- Editing `.env` on the host without checksumming — drifts undetected
+- `git pull` on the host as deploy mechanism — exposes git history + pulls partial state
+- Restart-instead-of-reload by default — drops in-flight requests