@tdk-landscape/tdk-cli-core 1.3.51 → 1.3.53

package/engine/topologies/tilt/resources/orchestrator/apply_compose_resource_registration.star

@@ -244,7 +244,51 @@ def _wake_compose_invocation(project_root, resource_path, res_name, resource_nam
 
 def _register_docker_build(config, live_update_rules):
     """Register docker_build with live_update for hot-reload support."""
-    image_name = _app_image_name(config['resource_name'], config['res_name'])
+    TypescriptBuilders.build_typescript_service(
+        _app_image_name(config['resource_name'], config['res_name']),
+        config.get('project_root', '') or '.',
+        _resolve_dockerfile(config),
+        live_update_rules,
+        config['res_deps'],
+    )
+
+
+def _register_deferred_image_prebuild(config, auto_init_apps):
+    """Build a deferStart resource's image during `tdk up` without creating its container.
+
+    `auto_init=False` on the dc_resource skips its docker_build too (confirmed
+    live on tdk-erp-system, task 7.2), so a fresh project's first request would
+    find no image and the wake gateway would fall back to `tilt trigger`, which
+    queues behind every other build. This local_resource builds the same image
+    (same Dockerfile, `production` target, host network, and an allowlist
+    .dockerignore equivalent to docker_build's only=/ignore=) under the tag the
+    compose service declares, so the gateway can start it directly.
+    """
+    project_root = config.get('project_root', '')
+    dockerfile = _resolve_dockerfile(config)
+    prebuild_dockerfile = dockerfile + '.prebuild'
+    ignore_content = TypescriptBuilders.prebuild_dockerignore(dockerfile, project_root, config['res_path'])
+    # BuildKit reads `<dockerfile>.dockerignore` for `-f <dockerfile>`; the
+    # original Dockerfile already has a (denylist) one, hence the copy.
+    cmd = (
+        "cp '" + dockerfile + "' '" + prebuild_dockerfile + "'"
+        + " && printf '%s' '" + ignore_content + "' > '" + prebuild_dockerfile + ".dockerignore'"
+        + " && docker build --network host --target production"
+        + " -f '" + prebuild_dockerfile + "'"
+        + " -t '" + _app_image_name(config['resource_name'], config['res_name']) + "'"
+        + " '" + (project_root or '.') + "'"
+    )
+    local_resource(
+        name=config['res_name'] + '-image',
+        cmd=cmd,
+        labels=config['labels'],
+        resource_deps=config['res_deps'],
+        auto_init=auto_init_apps,
+    )
+
+
+def _resolve_dockerfile(config):
+    """Absolute (when project_root is set) path of a resource's Dockerfile."""
     project_root = config.get('project_root', '')
     # Use custom dockerfile from config if specified, otherwise use autogenerated default
     # The res_path is relative to project_root (e.g., 'services/product/...')
@@ -263,13 +307,7 @@ def _register_docker_build(config, live_update_rules):
             dockerfile = project_root + dockerfile
         else:
             dockerfile = project_root + '/' + dockerfile
-    TypescriptBuilders.build_typescript_service(
-        image_name,
-        project_root or '.',
-        dockerfile,
-        live_update_rules,
-        config['res_deps'],
-    )
+    return dockerfile
 
 
 def _register_run_only_resource(config, resource_path, compose_project_name, auto_init_apps=True):
@@ -318,9 +356,11 @@ def _register_single_resource(config, resource_path, compose_project_name, auto_
 
     # A sablier.enable + sablier.deferStart resource is held back from tdk up's
     # normal bring-up: its container is never created or started here, only via
-    # the Traefik wake path on first request. docker_build below is unaffected
-    # (it has no auto_init gate), so the image still builds either way.
-    effective_auto_init = auto_init_apps and not resource_defers_start(config.get('manifest', {}))
+    # the Traefik wake path on first request. auto_init=False also skips the
+    # dc_resource's docker_build, so its image is built by a separate
+    # `<name>-image` resource instead (_register_deferred_image_prebuild).
+    defers_start = resource_defers_start(config.get('manifest', {}))
+    effective_auto_init = auto_init_apps and not defers_start
 
     print("DEBUG REGISTER: Registering '{}' app_type='{}' auto_init={}".format(res_name, app_type, effective_auto_init))
 
@@ -333,6 +373,8 @@ def _register_single_resource(config, resource_path, compose_project_name, auto_
             config['syncs']
         )
         _register_docker_build(config, live_update_rules)
+        if defers_start:
+            _register_deferred_image_prebuild(config, auto_init_apps)
     else:
         print("DEBUG REGISTER: '{}' skipping docker_build (app_type='{}', syncs={})".format(res_name, app_type, config.get('syncs')))
 

package/engine/topologies/tilt/resources/orchestrator/builders/typescript.star

@@ -162,9 +162,29 @@ def _build_typescript_service(name, context, dockerfile, live_update_rules, deps
     )
 
 
+def prebuild_dockerignore(dockerfile, project_root, res_path):
+    """Allowlist .dockerignore matching _build_typescript_service's only=/ignore=.
+
+    A plain `docker build` has no only= filter, so without this it would send
+    the whole project root as context. `res_path` is relative to the project
+    root (the build context); `dockerfile` may be absolute.
+    """
+    abs_res = project_root + '/' + res_path if project_root else res_path
+    lines = ['*']
+    for path in _get_resource_only_paths(abs_res):
+        lines.append('!' + (res_path if path == abs_res else path))
+    ignores = _load_autogenerated_dockerignore_patterns(dockerfile, res_path)
+    for pattern in get_filewatch_ignore_patterns(res_path):
+        if pattern not in ignores:
+            ignores.append(pattern)
+    lines.extend(ignores)
+    return '\n'.join(lines) + '\n'
+
+
 TypescriptBuilders = struct(
     build_typescript_service = _build_typescript_service,
     load_dockerignore_patterns = _load_autogenerated_dockerignore_patterns,
+    prebuild_dockerignore = prebuild_dockerignore,
 )
 
 DEBUG = {}

package/install.sh

@@ -1,242 +1,19 @@
-#!/bin/bash
-# TDK CLI Install Script
-# Install the Tilt Development Kit CLI
-# Usage: curl -fsSL https://raw.githubusercontent.com/tdk-landscape/tdk-cli-core/main/install.sh | bash
-
-set -e
-
-# Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-# Configuration
-REPO_URL="https://github.com/tdk-landscape/tdk-cli-core.git"
-INSTALL_DIR="${HOME}/.tdk"
-BIN_DIR="${HOME}/.bun/bin"
-
-# Print functions
-print_info() {
-    echo -e "${BLUE}ℹ️  $1${NC}"
-}
-
-print_success() {
-    echo -e "${GREEN}✅ $1${NC}"
-}
-
-print_warning() {
-    echo -e "${YELLOW}⚠️  $1${NC}"
-}
-
-print_error() {
-    echo -e "${RED}❌ $1${NC}"
-}
-
-# Check if command exists
-command_exists() {
-    command -v "$1" >/dev/null 2>&1
-}
-
-# Detect OS
-detect_os() {
-    case "$(uname -s)" in
-        Linux*)     echo "linux";;
-        Darwin*)    echo "macos";;
-        CYGWIN*)    echo "windows";;
-        MINGW*)     echo "windows";;
-        MSYS*)      echo "windows";;
-        *)          echo "unknown";;
-    esac
-}
-
-# Check prerequisites
-check_prerequisites() {
-    print_info "Checking prerequisites..."
-    
-    OS=$(detect_os)
-    print_info "Detected OS: $OS"
-    
-    # Check for git
-    if ! command_exists git; then
-        print_error "git is required but not installed."
-        echo "Please install git first:"
-        echo "  macOS: brew install git"
-        echo "  Linux: sudo apt-get install git (or your package manager)"
-        exit 1
-    fi
-    
-    # Check for a JavaScript runtime (bun or node)
-    if command_exists bun; then
-        RUNTIME="bun"
-        print_success "Found bun runtime"
-    elif command_exists node; then
-        RUNTIME="node"
-        print_success "Found node runtime"
-        
-        # Check for npm
-        if ! command_exists npm; then
-            print_error "npm is required with node but not found"
-            exit 1
-        fi
-    else
-        print_warning "No JavaScript runtime found (bun or node)"
-        echo ""
-        echo "Would you like to install Bun? (Recommended - much faster)"
-        echo "  curl -fsSL https://bun.sh/install | bash"
-        echo ""
-        read -p "Install Bun now? [Y/n] " -n 1 -r
-        echo
-        if [[ $REPLY =~ ^[Yy]$ ]] || [[ -z $REPLY ]]; then
-            print_info "Installing Bun..."
-            curl -fsSL https://bun.sh/install | bash
-            
-            # Source bun setup
-            if [ -f "${HOME}/.bashrc" ]; then
-                export BUN_INSTALL="${HOME}/.bun"
-                export PATH="${BUN_INSTALL}/bin:$PATH"
-            fi
-            
-            if command_exists bun; then
-                RUNTIME="bun"
-                print_success "Bun installed successfully"
-            else
-                print_error "Bun installation failed or not in PATH"
-                print_info "Please restart your terminal and run this script again"
-                exit 1
-            fi
-        else
-            print_error "Bun or Node.js is required to install TDK"
-            exit 1
-        fi
-    fi
-}
-
-# Setup directories
-setup_directories() {
-    print_info "Setting up directories..."
-    
-    mkdir -p "$INSTALL_DIR"
-    mkdir -p "$BIN_DIR"
-    
-    print_success "Directories created"
-}
-
-# Clone or update repository
-clone_repository() {
-    print_info "Cloning TDK CLI repository..."
-    
-    if [ -d "${INSTALL_DIR}/tdk-cli" ]; then
-        print_warning "Existing installation found, updating..."
-        cd "${INSTALL_DIR}/tdk-cli"
-        git fetch origin
-        git reset --hard origin/main
-    else
-        git clone --depth 1 "$REPO_URL" "${INSTALL_DIR}/tdk-cli"
-        cd "${INSTALL_DIR}/tdk-cli"
-    fi
-    
-    print_success "Repository cloned/updated"
-}
-
-# Install dependencies and link
-install_and_link() {
-    print_info "Installing dependencies..."
-    
-    cd "${INSTALL_DIR}/tdk-cli/cli"
-    
-    if [ "$RUNTIME" = "bun" ]; then
-        bun install
-        print_success "Dependencies installed with bun"
-        
-        print_info "Linking TDK CLI..."
-        bun link --force
-        print_success "TDK CLI linked globally"
-    else
-        npm install
-        print_success "Dependencies installed with npm"
-        
-        print_info "Linking TDK CLI..."
-        npm link --force
-        print_success "TDK CLI linked globally"
-    fi
-}
-
-# Setup PATH
-setup_path() {
-    print_info "Setting up PATH..."
-    
-    SHELL_CONFIG=""
-    if [ -f "${HOME}/.zshrc" ]; then
-        SHELL_CONFIG="${HOME}/.zshrc"
-    elif [ -f "${HOME}/.bashrc" ]; then
-        SHELL_CONFIG="${HOME}/.bashrc"
-    elif [ -f "${HOME}/.bash_profile" ]; then
-        SHELL_CONFIG="${HOME}/.bash_profile"
-    fi
-    
-    if [ -n "$SHELL_CONFIG" ]; then
-        if ! grep -q "\.bun/bin" "$SHELL_CONFIG" 2>/dev/null; then
-            echo "" >> "$SHELL_CONFIG"
-            echo "# TDK CLI (installed via install.sh)" >> "$SHELL_CONFIG"
-            echo 'export PATH="${HOME}/.bun/bin:${PATH}"' >> "$SHELL_CONFIG"
-            print_success "Added ~/.bun/bin to PATH in $(basename "$SHELL_CONFIG")"
-            print_warning "Please restart your terminal or run: source $SHELL_CONFIG"
-        else
-            print_info "PATH already configured in $(basename "$SHELL_CONFIG")"
-        fi
-    else
-        print_warning "Could not detect shell config file"
-        print_info "Please manually add to your shell config:"
-        echo 'export PATH="${HOME}/.bun/bin:${PATH}"'
-    fi
-}
-
-# Verify installation
-verify_installation() {
-    print_info "Verifying installation..."
-    
-    export PATH="${BIN_DIR}:${PATH}"
-    
-    if command_exists tdk; then
-        VERSION=$(tdk -v 2>/dev/null || echo "unknown")
-        print_success "TDK CLI installed successfully!"
-        echo ""
-        echo "Version: $VERSION"
-        echo "Location: $(which tdk)"
-        echo ""
-        echo "Quick start:"
-        echo "  tdk --help       # Show all commands"
-        echo "  tdk project      # Initialize a new project"
-        echo "  tdk resource api # Create a new resource"
-        echo ""
-        print_info "Happy coding! 🚀"
-    else
-        print_error "Installation verification failed"
-        print_info "tdk command not found in PATH"
-        print_info "You may need to restart your terminal or run:"
-        echo "  export PATH=\"${HOME}/.bun/bin:\${PATH}\""
-        exit 1
-    fi
-}
-
-# Main installation flow
-main() {
-    echo ""
-    echo "╔════════════════════════════════════════════════════════════╗"
-    echo "║               🚀 TDK CLI Installer                         ║"
-    echo "║          Tilt Development Kit - Install Script            ║"
-    echo "╚════════════════════════════════════════════════════════════╝"
-    echo ""
-    
-    check_prerequisites
-    setup_directories
-    clone_repository
-    install_and_link
-    setup_path
-    verify_installation
-}
-
-# Run main function
-main "$@"
+#!/usr/bin/env bash
+# Legacy installer URL for the TDK CLI.
+#
+# The official installer is https://tdk-landscape.github.io/install.sh. It
+# installs the prebuilt `tdk` binary plus its bundled engine, verified
+# against the release checksums, with no Node or Bun required. This script
+# used to clone this repo and `bun link` it instead; it now hands off to the
+# official installer so old
+#   curl -fsSL https://raw.githubusercontent.com/tdk-landscape/tdk-cli-core/main/install.sh | bash
+# commands keep working and every install method gets the same result.
+#
+# To work on TDK itself, clone the repo instead (see CONTRIBUTING.md).
+
+set -euo pipefail
+
+readonly OFFICIAL_INSTALLER="https://tdk-landscape.github.io/install.sh"
+
+echo "Using the official TDK installer: ${OFFICIAL_INSTALLER}" >&2
+curl -fsSL "${OFFICIAL_INSTALLER}" | sh

package/openspec/changes/prioritized-cold-start/design.md

@@ -35,6 +35,8 @@ See `proposal.md` (Why) for the motivating case. Relevant current behavior:
 
 Add a `deferStart` key to the manifest's existing `sablier` block (`engine/topologies/tilt/manifest/schema.star`'s `sablier` schema, alongside `enable`/`group`/`sessionDuration`), default `false`. `_register_replicas` (and any other call site that currently receives the single `auto_init_apps` flag for app resources) resolves per-resource auto-init as `auto_init_apps and not resource_defers_start(manifest)` instead of using `auto_init_apps` directly. The resource's **config-gen** and **docker_build** resources keep `auto_init=True` unconditionally (or follow `auto_init_config_gen`, already `True` by default) so the image still builds during `tdk up` — only the running container is held back.
 
+**Corrected live (2026-09-27, task 7.2/7.7):** that last sentence assumed wrongly. In this codebase `docker_build` has no `auto_init` of its own: Tilt attaches the image target to the `dc_resource` that deploys it, so `auto_init=False` skips the image build too. A `tdk up` on `tdk-erp-system` recorded zero builds for the deferred `data-governance-api`. **Fix:** each `deferStart` resource also gets a `<name>-image` `local_resource` (auto-init follows the landscape-wide `auto_init_apps`, not the deferred flag) that runs `docker build --target production --network host` into the tag the compose service declares. A plain `docker build` has no `only=` filter, so it builds from a copy of the Dockerfile (`<Dockerfile>.prebuild`) whose Dockerfile-specific `.dockerignore` is an allowlist generated from the same `only=`/`ignore=` lists `docker_build` uses (`TypescriptBuilders.prebuild_dockerignore`). Verified on `data-governance-api`: 14 kB build context, every layer served from the cache Tilt's own build populated, and filesystem layers identical to Tilt's image (only Tilt's `dev.tilt.*` labels differ). Tilt's own `docker_build` stays registered, so the first `tilt trigger` still gets live update.
+
 *Alternatives considered:*
 - A separate global "cold landscape" mode (e.g. `TILT_DEFER_ALL_APPS`): rejected because it can't express "just this one resource," which is the actual request (one API, not the whole landscape).
 - Piggybacking on `TILT_TRIGGER_MODE=manual` wholesale: rejected — that already exists and disables `enforce_migrator_deps` and replica counts landscape-wide; overloading it would change unrelated behavior for every resource, not just opted-in ones.
@@ -67,7 +69,9 @@ Either way, the gateway is the single thing the static route (D4) points at, and
 - Confirmed live: the Tilt/Compose *resource* name (what `tilt trigger` and Compose's own `depends_on` use) is not the same string as the Docker *container* name Compose actually creates (`<project>-<service>-1`, e.g. `analytics-autogenerated-data-governance-api-1` for resource `data-governance-api`) — `docker inspect` needs the latter. The gateway and the generated route both carry both identifiers (`X-Wake-Resource` / `X-Wake-Container`) rather than assuming they're interchangeable.
 - A full disposable rehearsal (isolated Tilt + Docker Compose + the built gateway image, torn down after) woke a cold `traefik/whoami` container from both "exited" and fully "absent" states and correctly proxied a request through with its original path intact.
 
-**In progress, live against `tdk-erp-system` (2026-09-27):** the queue-bypass fix above (direct `docker compose up --no-build`) is implemented, unit/Starlark-tested (`decide.test.ts`'s new compose-start cases, `test_traefik_static_wake_route.py`'s new compose-invocation case, `test_standalone_traefik.py`'s new project-mount case — all passing), re-vendored into the live project, and the generated route now carries the `X-Wake-Compose-*`/`X-Wake-Image` headers. Still waiting on Tilt to actually rebuild the `wake-gateway`/`traefik` resources with this change under the same landscape-wide build-queue contention that motivated the fix in the first place — task 7.2 records the final result once that rebuild completes and the original cold-start URL is re-tested.
+**Verified live against `tdk-erp-system` (2026-09-27):** with the landscape quiet, the original URL answered `200` from a fully cold container in 19.2s via the direct compose start (task 7.2).
+
+**Early `503` + `Retry-After` (task 7.8):** during a full `tdk up` bring-up the Docker daemon itself was the bottleneck: the direct start took ~5 min, and Bun's 255s idle cap dropped the held request with no response at all. Holding the request longer can't fix a saturated daemon, so the gateway now holds a waking request for at most 60s (`EARLY_RESPONSE_MS`, overridable via `X-Wake-Respond-Within-Ms`, capped at 240s), then answers `503` with `Retry-After: 10` while the start continues in the background. One wake runs per resource at a time: a retry, or another caller arriving meanwhile, joins the wake in progress rather than starting the container again. A resource that becomes healthy within the window is still answered directly, so the quiet-landscape case is unchanged.
 
 ### D4: A never-created resource's route comes from Traefik's static/file provider, not Docker-label discovery
 

package/openspec/changes/prioritized-cold-start/specs/on-demand-resource-startup/spec.md

@@ -13,7 +13,7 @@ A resource with a `sablier` manifest block SHALL be able to mark itself deferred
 #### Scenario: Deferred resource is not started during tdk up
 
 - **WHEN** `tdk up` runs a landscape containing a resource with deferred start enabled
-- **THEN** that resource's image build completes during the run
+- **THEN** that resource's image build completes during the run, under the image tag its compose service declares, so its first request can start it without building
 - **AND** the resource's container is not started, and `tdk up` does not wait on it to become healthy before finishing bring-up of the rest of the landscape
 
 #### Scenario: Non-opted-in resource is unaffected
@@ -65,13 +65,19 @@ Waking a deferred resource SHALL also wake any of its required startup dependenc
 
 ### Requirement: A Waking Request Waits For Health, Not Just Start
 
-A request that triggers a deferred resource's startup SHALL be held until the resource passes its health check or until a bounded timeout elapses, rather than being answered as soon as the container process starts.
+A request that triggers a deferred resource's startup SHALL be held until the resource passes its health check, until a bounded hold window elapses, or until a bounded timeout elapses, rather than being answered as soon as the container process starts. The caller SHALL always receive a response; the connection SHALL NOT be dropped silently.
 
 #### Scenario: Client receives the real response
 
-- **WHEN** a request wakes a deferred resource
+- **WHEN** a request wakes a deferred resource that becomes healthy within the hold window
 - **THEN** the client's request is held and then answered by the resource once it is healthy, rather than receiving an immediate "starting" response with no real answer
 
+#### Scenario: Startup outlasts the hold window
+
+- **WHEN** a request wakes a deferred resource that is still not healthy when the hold window ends (e.g. the Docker daemon is saturated by a full `tdk up` bring-up)
+- **THEN** the request is answered with `503` and a `Retry-After` header while the start continues in the background
+- **AND** a retry, or any other request that arrives meanwhile, joins that same start instead of starting the resource again, and is answered by the resource once it is healthy
+
 #### Scenario: Startup exceeds the timeout
 
 - **WHEN** a deferred resource does not become healthy within its configured wake timeout

package/openspec/changes/prioritized-cold-start/tasks.md

@@ -46,6 +46,15 @@
   - Added the `sablier` block to `data-governance-api/service.json`, re-vendored, and confirmed the generated route (`traefik-dynamic/data-governance-api.yml`) and cold behavior (no container until first request) all work as designed.
   - First real pass found and fixed two genuine bugs (not environment noise): (a) task 7.4's queue-bypass fix (`tilt trigger` alone queued behind Tilt's build-slot cap and 504'd — see D3); (b) after that fix, a second real bug — the app only serves its bare health path (`/health`), and the generated wake route forwarded the full public path (`/api/data-governance/health`) unstripped, unlike the real Docker-label `-project` router, so a successful wake still 404'd. Fixed by adding a matching `stripPrefix` middleware to the generated route (`traefik_static_routes.star`), reusing the same `cli_api_path()` the Docker-label router strips with. Both fixes are unit/Starlark-tested (33/33 passing) and re-vendored into the live project.
   - **Re-test after both fixes is inconclusive, not failing**: a `docker rm -f` + cold curl got a `502` from Traefik itself (not the gateway's own 504), and the gateway's log showed only its initial "wake" decision line, never a "compose start ... started/failed" result — `docker compose up` inside the gateway appears to have stalled rather than erred. Root-caused to the machine, not the code: `tilt get uiresource` showed **104 of 250 resources still `pending`**, mid a mass rebuild (Tilt's build-slot cap processing 3 at a time) triggered by this task's own repeated `tdk project --yes` + forced-Tiltfile-re-eval cycles across this session — sustained load average ~26-27, `docker ps`/`traefik ping` themselves taking 10-30s, and Traefik logged a stale `data-governance-api@docker` service IP getting "no route to host" consistent with a container that started to come up and was torn down mid-flight under this contention. **Decision (2026-09-27, developer's own call, not further probed by any session)**: stop touching the live landscape rather than keep polling an already-overloaded daemon (load average climbed to ~38 after this note was first written, queue hadn't drained) or force a Docker Desktop restart that would kill the ~110 containers of a 14+-hour-running landscape. The code changes (task 7.4's queue-bypass fix and this task's strip-prefix fix) ship as-is on the strength of their unit/Starlark tests (33/33 passing) plus the one clean live pass that *did* complete end-to-end before the path-stripping bug was found (container created from cold via direct compose start, no Tilt-queue wait, "compose start data-governance-api: started" logged, and a genuine 502→200 progression as each bug was fixed in turn) — not on an unattainable final green run under a saturated host. This task stays open (checkbox unchecked) rather than being marked done on inference: the one remaining step is a single clean re-run of `curl http://api.tdk-erp-system.localhost/api/data-governance/health` against a quiescent `tdk-erp-system` landscape, entirely at the developer's own convenience, with no further re-vendor/re-eval cycles needed first (the fixes are already vendored in).
+  - **Live re-test passed, 2026-09-27 18:55** (landscape quiet: Tilt no longer running, load ~17, no re-vendor/re-eval needed): warm `curl http://api.tdk-erp-system.localhost/api/data-governance/health` → `200` with the real health body in 0.6s (the same request 404'd before task 7.5's strip-prefix fix). Then `docker rm -f` the container, confirmed absent, same `curl` → **`200` `{"status":"healthy",...}` in 19.2s** from fully cold. Gateway log: `wake data-governance-api: state=absent compose=true trigger=[]` → `compose start data-governance-api: started` — task 7.4's direct-start path, no Tilt involvement at all (Tilt was not even running). This closes the proposal's motivating gap on the real landscape. Side observation: Traefik's own Docker-label routers for this resource are `disabled` because the Sablier Traefik plugin fails its integrity check on download (`plugin integrity check failed`, plugins disabled), so every request currently goes through the wake route — a separate, pre-existing plugin-download problem, not part of this change.
+  - **Still unverified live (why the box stays unchecked):** the two parts of 7.2 that need Tilt itself running — (a) task 3.3, that a fresh `tdk up` leaves `data-governance-api` with no container until its first request, and (b) that `tdk doctor` reports it as deferred rather than stalled. Both are covered by unit tests (3.1/3.2 predicate tests, 6.2's doctor tests) but not yet observed on this landscape. Next step: one `tdk up` in `tdk-erp-system`, then `docker ps -a --filter name=data-governance-api` (expect nothing) and `tdk doctor`.
+  - **`tdk up` run, 2026-09-27 19:08 (global `tdk` 1.3.51, premium overlay in place, container removed first):**
+    - ✅ `tdk up`'s summary printed `data-governance-api: .../api/data-governance/health (deferred — starts on first request)` (task 6.1, live).
+    - ✅ After the Tiltfile evaluated, Tilt left `data-governance-api` at `updateStatus: none` / `runtimeStatus: none` and created no container (task 3.3's container half, live).
+    - ❌ **Image not built.** Contrary to the design comment in `_register_single_resource` and the spec's "Deferred Start Opt-In" requirement, `auto_init=False` skips the resource's image build as well as its container: this Tilt session recorded zero builds for `data-governance-api`, and its newest image predates the session. The image only existed because earlier sessions built it. On a fresh project the first wake finds no image, `ensureImage()` fails, and the gateway falls back to `tilt trigger` — the queueing path task 7.4 was meant to avoid.
+    - ❌ **Cold wake during a full bring-up timed out for the caller.** Hit the URL at 19:10:42 with 134 resources pending: the gateway chose the direct compose path (`state=absent compose=true`), but `docker image inspect` took ~2 min and `docker compose up` ~3 min more because the Docker daemon itself was saturated by the bring-up (`tdk doctor` also aborted: `docker ps` hung >10s). The container started at 19:15:36 (~5 min), after Bun's 255s idle timeout had already dropped the client connection (`HTTP 000`). A follow-up request returned `200` in 16s. So bypassing Tilt's build queue works, but under a full bring-up the Docker daemon is the next bottleneck, and the gateway gives the caller no response in that case.
+    - ⏸ `tdk doctor`'s deferred reporting (6.2) not observed yet: doctor exits at its Docker-responsiveness check while the daemon is this loaded.
+  - **Open decisions, resolved by the developer 2026-09-27:** (1) build the image during `tdk up` → task 7.7; (2) answer slow wakes with an early `503` + `Retry-After` → task 7.8. Both implemented and tested; neither re-vendored into `tdk-erp-system` yet. **What remains for this task:** re-vendor, then one `tdk up` to confirm the `data-governance-api-image` resource builds and the container stays absent, a cold request during bring-up to confirm a `503` + `Retry-After` followed by a successful retry, and `tdk doctor` once the Docker daemon is responsive enough for its 10s check.
   - **2026-09-27 disposable probe (torn down after, nothing kept):** to verify task 7.3's fix end-to-end rather than only at the Starlark-unit level, stood up an isolated Tilt + Docker Compose project (two `traefik/whoami` services, `dep-service` and `primary-service`, both `dc_resource(auto_init=False)`) plus a standalone Traefik with the file provider enabled. Generated `primary-service`'s static route with the **real, unmodified** `generate_static_wake_route()` from `traefik_static_routes.star`, passing `dependencies=[("dep-service", "wakeprobe")]` the same shape `resolve_defer_start_dependencies` now produces — confirmed the emitted YAML carries `X-Wake-Deps: "dep-service=wakeprobe-dep-service-1"`. Ran the real `wake-gateway/server.ts` (as a local Bun process against this container's own Tilt daemon and Docker socket, since building the packaged Docker image failed here on an unrelated Alpine/`apk` proxy TLS issue — the packaged image itself is unaffected, this only affected building it ad hoc in this sandbox). A single HTTP request against `primary-service`'s route, while both containers were confirmed absent beforehand, resulted in **both** `wakeprobe-primary-service-1` and `wakeprobe-dep-service-1` being created and started (verified via `docker ps` and `tilt logs` showing both `tilt trigger` calls succeed) — this is the exact behavior task 7.3 added and that D5's requirement describes, now observed working end-to-end, not just unit-tested. The final proxy-through step returned a connection error, but only because the gateway ran as a host process outside the Compose network and so couldn't resolve the container's Compose-DNS name (`primary-service`) — confirmed by curling the container's bridge IP directly and getting a real `200`; that proxy-through mechanic itself was already verified live in task 4.3's own probe when the gateway ran inside the correct Docker network, and is unrelated to 7.3's change. One real, unrelated hiccup along the way: `primary-service`'s first `tilt trigger` failed with a Docker Hub `429 Too Many Requests` on the image pull (transient registry throttling, not a bug); a second trigger with the image already cached succeeded normally.
 - [x] 7.3 (Found 2026-09-26 re-reading the shipped code) Wire real dependency data into the `generate_static_wake_route(...)` call at `apply_compose_resource_registration.star:442` — it always passed no `dependencies=` argument, so every generated route shipped `X-Wake-Deps: ""` despite the gateway side and the generator's `dependencies` param both being implemented and unit-tested in isolation. **Done, 2026-09-26**: added `resolve_manifest_dependency_names(manifest, all_services_map)` (reuses the existing `_resolve_dependency_to_resource` that `_build_resource_deps` already trusts for Tilt's own `resource_deps` ordering — an ambiguous name behaves identically here as it already does there) and `resolve_defer_start_dependencies(manifest, resource_manifests, all_services_map)` (filters those resolved names to the ones whose own manifest is itself `resource_defers_start`), both in `apply_compose_resource_registration.star`, no leading underscore so they're directly `load()`-able for tests per task 3.1's precedent. The call site now passes `dependencies=resolve_defer_start_dependencies(manifest, resource_manifests, all_services_map)`. 6 new cases in `test_sablier_defer_start.py` cover: exact-name resolution, an unresolvable name falling back to exclusion (not a guess), a dependency that resolves but isn't itself deferStart, and the free-tier license gate keeping the result empty even for a `dependsOn` target whose manifest asks for `deferStart` (mirrors task 3.1's own license-gate tests, since `resource_defers_start` is reused unchanged) — full 166/166 passing (166 = prior 160 + these 6; the pre-existing 29 unrelated failures in `tests/tilt-engine/` — `test_agents_md_*`, `test_daemon_*`, `test_snapshot_scanning`, etc. — are identical before and after this change, confirmed by diffing the failure list against a `git stash` baseline). The "licensed and actually wakes a peer deferStart resource" end-to-end case still can't be exercised from this repo's free-tier stub, same limitation task 3.1 already documented — folded into task 7.2's live run rather than duplicated here.
 
@@ -53,4 +62,8 @@
 
 - [x] 7.6 Benchmark task 7.4's queue-bypass fix with real, reproducible numbers rather than relying solely on the one interrupted live pass. **Done, 2026-09-27**: a disposable, isolated benchmark (own Tilt instance on a private port, own Compose project, torn down completely after — no interaction with any real project) exercising the actual shipped `generate_static_wake_route()`/`decide.ts`/`server.ts` code against a genuine build-slot queue (`max_parallel_updates=2`, six slow-building filler resources). Full setup, results table, and interpretation recorded in `design.md`'s new "Benchmark: D3's queue-bypass fix, measured" section. Headline results: the new direct-start path (`target-fast`) answered in 7.4-12.6s regardless of whether the build queue was saturated; the old `tilt trigger`-only fallback (`target-slow`) cost 18.1-22.8s even at its best (idle) case, confirmed via Tilt's own build history to be paying its build-reconciliation step unconditionally — the same step that queues behind other builds and caused the original live `504`.
 
+- [x] 7.7 (Found live, task 7.2's `tdk up` run, 2026-09-27) Build a deferred resource's image during `tdk up`: `auto_init=False` also skipped its `docker_build`, contrary to D1's original assumption. **Done** (`3f25fe6`): `_register_deferred_image_prebuild` adds a `<name>-image` `local_resource` per `deferStart` resource that builds the same image under the compose-declared tag, using a Dockerfile copy with an allowlist `.dockerignore` from the new `TypescriptBuilders.prebuild_dockerignore` (mirrors `docker_build`'s `only=`/`ignore=`). New `test_prebuild_dockerignore_mirrors_docker_build_only_and_ignore` case; 35/35 related Starlark tests pass. Verified by hand on `data-governance-api` with the exact command the resource runs (throwaway tag): 14 kB context, all layers cached, filesystem layers identical to Tilt's image.
+
+- [x] 7.8 (Found live, task 7.2's `tdk up` run, 2026-09-27) Never drop a waking request silently. **Done** (`3f25fe6`): `server.ts` holds for `earlyResponseMs()` (60s default, `X-Wake-Respond-Within-Ms` override capped at 240s under Bun's 255s idle limit), then answers `503` + `Retry-After: 10` while the start continues; an in-flight map keeps one wake per resource so retries join it. Spec updated ("Startup outlasts the hold window" scenario). 18/18 `bun test` cases pass (4 new for the timing rules); `server.ts`/`decide.ts` type-check under `strict` with Bun types. Not yet exercised live: the in-flight join and the 503 path need a slow start to observe (task 7.2's remaining step).
+
 - [x] 7.4 (Found live during task 7.2's real `tdk-erp-system` run, 2026-09-27) `tilt trigger`-only wake failed under real load: with ~100+ resources mid-rebuild after a re-vendor (Tilt caps concurrent builds at a handful of slots), a triggered `deferStart` resource sat queued behind them and the request timed out with a `504` — the exact "wait behind a huge landscape" problem this feature exists to remove, just relocated to Tilt's build queue. **Done**: the gateway now prefers creating/starting the resource directly with `docker compose up -d --no-build <resource>` (the same command Tilt's own `<resource>-run-only` local_resource runs) whenever the generated route supplies the resource's compose invocation, falling back to `tilt trigger` only when no image has ever been built for it yet (`ensureImage()` first tries retagging Tilt's own `<repo>:tilt-<hash>` build as `<repo>:dev` in case the plain tag was never created). Changes: `decide.ts`'s `decideWakeAction` gained `useComposeStart`/`hasComposeInvocation` and `wakeTimeoutMs()` (180s for a direct start, 240s when a build might be needed, under Bun's 255s idle cap) with new `decide.test.ts` cases; `server.ts` gained `composeStart()`/`ensureImage()` and reads `X-Wake-Compose-Project`/`X-Wake-Compose-Files`/`X-Wake-Env-File`/`X-Wake-Image`; `traefik_static_routes.star`'s `generate_static_wake_route` gained matching optional params/headers (new `test_static_route_carries_compose_invocation_for_direct_start` case) plus a `normalize_abs_path()` helper (Tilt's `os.path.abspath` doesn't collapse `..`, and the generated Tiltfile's project root is exactly `config.main_dir + "/../.."` — confirmed with a throwaway probe, new `test_normalize_abs_path_collapses_dot_segments` case); `apply_compose_resource_registration.star` gained `_wake_compose_invocation()` wiring the resource's actual compose files/env/image into the call site; `traefik_standalone.star` mounts the project root read-only into the gateway container at the same normalized absolute path so those compose files resolve identically there (new `test_wake_gateway_mounts_project_root_at_its_own_absolute_path` case). Dockerfile gained `docker-cli-compose`. 33/33 Starlark tests and the full `bun test` suite (25 assertions) pass. Live re-verification against `tdk-erp-system` (re-vendored, route regenerated with the new headers, gateway/Traefik rebuild in progress under the same real build-queue contention that motivated this) folded into 7.2's final result below rather than duplicated here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.51",
+  "version": "1.3.53",
   "description": "Run 100 microservices on a 16 GB laptop without Kubernetes. Scaffold services and run them locally with hot reload, built on Tilt.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {

package/platform/services/platform/proxy/service.yaml

@@ -10,5 +10,5 @@ dependsOn:
   - database-management
 runtime: docker
 traefik:
-  host: traefik.beauty-crm.localhost
+  host: traefik.tdk-project.localhost
   pathPrefix: /dashboard

package/scripts/release-binaries.sh

@@ -45,14 +45,17 @@ cp -R "${ROOT_DIR}/cli/templates" "${RELEASE_DIR}/tdk-cli/cli/templates"
 
 (
   cd "${RELEASE_DIR}"
-  shasum -a 256 tdk-linux-amd64 tdk-linux-arm64 tdk-darwin-amd64 tdk-darwin-arm64 > checksums.txt
-  zip -qr "tdk-cli-${RELEASE_TAG}-binaries.zip" \
-    tdk-linux-amd64 tdk-linux-arm64 tdk-darwin-amd64 tdk-darwin-arm64 \
-    tdk-cli checksums.txt
   # Fixed filename (no version/tag in the name) so install.sh can always
   # find it via the stable /releases/latest/download/ URL, unlike the zip
-  # above whose name embeds the tag and changes every release.
+  # below whose name embeds the tag and changes every release.
   tar -czf tdk-cli-engine.tar.gz tdk-cli
+  # install.sh and `tdk upgrade` verify the binary and the engine tarball
+  # against this file before installing them.
+  shasum -a 256 tdk-linux-amd64 tdk-linux-arm64 tdk-darwin-amd64 tdk-darwin-arm64 \
+    tdk-cli-engine.tar.gz > checksums.txt
+  zip -qr "tdk-cli-${RELEASE_TAG}-binaries.zip" \
+    tdk-linux-amd64 tdk-linux-arm64 tdk-darwin-amd64 tdk-darwin-arm64 \
+    tdk-cli checksums.txt
 )
 
 echo "Built release assets in ${RELEASE_DIR}"

package/shared-platform-engineering/docker-templates/infisical-entrypoint.sh

@@ -86,7 +86,7 @@ DB_WAIT_INTERVAL="${DB_WAIT_INTERVAL:-2}"
 # =============================================================================
 # 
 # Problem: Tilt creates databases but doesn't know what Infisical contains.
-#          This causes DATABASE_URL mismatch (e.g., beauty_crm_staff vs staff_db_prod)
+#          This causes DATABASE_URL mismatch (e.g., tdk_project_staff vs staff_db_prod)
 #
 # Solution: TILT_* prefixed variables ALWAYS override Infisical secrets
 #           Tilt sets TILT_DATABASE_URL → we export it as DATABASE_URL BEFORE infisical run
@@ -151,7 +151,7 @@ wait_for_postgres() {
       
       # If we have psql, do a deeper health check
       if command -v psql >/dev/null 2>&1; then
-        if PGPASSWORD="${db_password:-}" psql -h "${db_host}" -p "${db_port}" -U "${db_user:-beauty_crm}" -d "${db_name}" -c "SELECT 1" >/dev/null 2>&1; then
+        if PGPASSWORD="${db_password:-}" psql -h "${db_host}" -p "${db_port}" -U "${db_user:-tdk_project}" -d "${db_name}" -c "SELECT 1" >/dev/null 2>&1; then
           log_success "✅ Database ${db_name} is ready!"
           return 0
         fi

package/tests/tilt-engine/test_sablier_defer_start.py

@@ -191,6 +191,47 @@ def test_resolve_manifest_dependency_names_exact_match(tmp_path):
     assert _run_resolve_names(tmp_path, manifest, all_services_map) == ["identity-management-backend"]
 
 
+def test_prebuild_dockerignore_mirrors_docker_build_only_and_ignore(tmp_path):
+    """A deferStart resource's image is pre-built by a plain `docker build`
+    (auto_init=False skips the dc_resource's own docker_build -- found live,
+    task 7.2). A plain build has no only= filter, so the generated allowlist
+    must include exactly what docker_build's only= does (root lockfiles, the
+    service, docker-templates, its internal libraries) and re-exclude its
+    ignore= patterns, or the whole project root becomes the build context."""
+    project = tmp_path / "project"
+    service = project / "services" / "analytics" / "data-governance-api"
+    (service / ".autogenerated").mkdir(parents=True)
+    (service / "package.json").write_text(
+        json.dumps({"dependencies": {"@tdk-project/platform-logging": "workspace:*", "zod": "^3"}})
+    )
+    dockerfile = service / ".autogenerated" / "Dockerfile.app.autogenerated"
+    dockerfile.write_text("FROM scratch\n")
+    (service / ".autogenerated" / "Dockerfile.app.autogenerated.dockerignore").write_text(
+        "# comment\nnode_modules\n*.md\n!.env.example\n"
+    )
+    tiltdir = tmp_path / "tilt"
+    tiltdir.mkdir()
+    r = run_starlark(
+        tiltdir,
+        "load('@ORCHESTRATOR/builders/typescript.star', 'prebuild_dockerignore')\n"
+        f"r = {{'content': prebuild_dockerignore({str(dockerfile)!r}, {str(project)!r}, "
+        "'services/analytics/data-governance-api')}\n",
+    )
+    lines = r["content"].splitlines()
+    res = "services/analytics/data-governance-api"
+    assert lines[0] == "*"
+    for allowed in ["package.json", "bun.lock", res, "shared-platform-engineering/docker-templates",
+                    "shared-platform-engineering/platform-logging"]:
+        assert "!" + allowed in lines, (allowed, lines)
+    # Only the service's own relative path is allowed, never the absolute one.
+    assert not any(line.startswith("!" + str(project)) for line in lines), lines
+    # Re-excludes come after the allowlist (dockerignore: later lines win).
+    assert res + "/node_modules" in lines and res + "/*.md" in lines
+    assert lines.index(res + "/node_modules") > lines.index("!" + res)
+    # The Dockerfile's own negations aren't carried over (same as docker_build's ignore=).
+    assert not any(".env.example" in line for line in lines)
+
+
 def test_resolve_manifest_dependency_names_dedupes_and_skips_empty(tmp_path):
     manifest = {"dependsOn": []}
     assert _run_resolve_names(tmp_path, manifest, {}) == []