rampway 0.3.0 → 0.4.0

package/build/src/velocious/sanitize.js

@@ -0,0 +1,154 @@
+// @ts-check
+const MAX_STRING_LENGTH = 4000;
+const MAX_DEPTH = 20;
+const MAX_COLLECTION_ENTRIES = 100;
+const MAX_VISITED_VALUES = 1000;
+const MAX_SERIALIZED_BYTES = 64 * 1024;
+const MAX_PREVIEW_LENGTH = 8000;
+const REDACTED = "[redacted]";
+const TRUNCATION_MARKER = "[truncated]";
+const TRUNCATED_VALUE = Symbol("truncated");
+/** @typedef {{visited: number}} SanitizerState */
+/**
+ * @param {string} value - Value to redact.
+ * @param {string[]} secrets - Exact configured secrets.
+ * @returns {string} Redacted and bounded value.
+ */
+function redactString(value, secrets) {
+    let result = value;
+    for (const secret of secrets) {
+        if (secret.length > 0)
+            result = result.split(secret).join(REDACTED);
+    }
+    return result.length > MAX_STRING_LENGTH ? `${result.slice(0, MAX_STRING_LENGTH)}…` : result;
+}
+/**
+ * Converts an integration value to bounded JSON data while redacting secrets
+ * in values and keys. Colliding redacted keys are retained with stable suffixes.
+ *
+ * @param {unknown} value - Integration value.
+ * @param {string[]} secrets - Secrets to remove.
+ * @param {number} [depth] - Current depth.
+ * @returns {any} JSON-safe value or undefined.
+ */
+export function sanitizeAdapterValue(value, secrets, depth = 0) {
+    const sanitized = sanitizeValue(value, secrets, depth, { visited: 0 });
+    if (sanitized === undefined)
+        return undefined;
+    if (sanitized === TRUNCATED_VALUE)
+        return { reason: "Sanitized output exceeded traversal limits", truncated: true };
+    const serialized = JSON.stringify(sanitized);
+    if (Buffer.byteLength(serialized) <= MAX_SERIALIZED_BYTES)
+        return sanitized;
+    return {
+        preview: serialized.slice(0, MAX_PREVIEW_LENGTH),
+        reason: `Sanitized output exceeded ${MAX_SERIALIZED_BYTES} bytes`,
+        truncated: true
+    };
+}
+/**
+ * @param {unknown} value - Integration value.
+ * @param {string[]} secrets - Secrets to remove.
+ * @param {number} depth - Current depth.
+ * @param {SanitizerState} state - Shared traversal budget.
+ * @returns {any} JSON-safe value, undefined, or the truncation sentinel.
+ */
+function sanitizeValue(value, secrets, depth, state) {
+    if (state.visited >= MAX_VISITED_VALUES || depth > MAX_DEPTH)
+        return TRUNCATED_VALUE;
+    state.visited++;
+    if (value === null)
+        return null;
+    if (typeof value === "string")
+        return redactString(value, secrets);
+    if (typeof value === "number")
+        return Number.isFinite(value) ? value : null;
+    if (typeof value === "boolean")
+        return value;
+    if (Array.isArray(value)) {
+        const result = [];
+        let truncated = value.length > MAX_COLLECTION_ENTRIES;
+        const contentLimit = truncated ? MAX_COLLECTION_ENTRIES - 1 : value.length;
+        for (let index = 0; index < contentLimit; index++) {
+            const sanitized = sanitizeValue(value[index], secrets, depth + 1, state);
+            if (sanitized === TRUNCATED_VALUE) {
+                truncated = true;
+                break;
+            }
+            if (sanitized !== undefined)
+                result.push(sanitized);
+        }
+        if (truncated)
+            result.push(TRUNCATION_MARKER);
+        return result;
+    }
+    if (typeof value !== "object")
+        return undefined;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return undefined;
+    /** @type {Record<string, any>} */
+    const result = {};
+    const keys = [];
+    let truncated = false;
+    for (const key in value) {
+        if (!Object.hasOwn(value, key))
+            continue;
+        keys.push(key);
+        if (keys.length > MAX_COLLECTION_ENTRIES) {
+            truncated = true;
+            keys.length = MAX_COLLECTION_ENTRIES - 1;
+            break;
+        }
+    }
+    for (const key of keys) {
+        const sanitized = sanitizeValue(/** @type {Record<string, unknown>} */ (value)[key], secrets, depth + 1, state);
+        if (sanitized === TRUNCATED_VALUE) {
+            truncated = true;
+            break;
+        }
+        if (sanitized === undefined)
+            continue;
+        defineAvailableProperty(result, redactString(key, secrets), sanitized);
+    }
+    if (truncated)
+        defineAvailableProperty(result, TRUNCATION_MARKER, true);
+    return result;
+}
+/**
+ * Defines a property without dropping a colliding diagnostic key.
+ *
+ * @param {Record<string, any>} target - Sanitized object.
+ * @param {string} key - Desired key.
+ * @param {unknown} value - Sanitized value.
+ * @returns {void}
+ */
+function defineAvailableProperty(target, key, value) {
+    let availableKey = key;
+    let collision = 2;
+    while (Object.hasOwn(target, availableKey)) {
+        availableKey = `${key}#${collision}`;
+        collision++;
+    }
+    Object.defineProperty(target, availableKey, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true
+    });
+}
+/**
+ * @param {unknown} error - Deployment failure.
+ * @param {string[]} secrets - Secrets to remove.
+ * @returns {{message: string, recovery: any}} Safe failure payload.
+ */
+export function sanitizeErrorPayload(error, secrets) {
+    const message = error instanceof Error ? error.message : String(error);
+    const recovery = error instanceof Error ? /** @type {Error & {recovery?: unknown}} */ (error).recovery : undefined;
+    const payload = sanitizeAdapterValue({ message, recovery }, secrets);
+    if (payload && typeof payload === "object" && typeof payload.message === "string") {
+        return { message: payload.message, recovery: payload.recovery };
+    }
+    return { message: "Deployment failure diagnostics were truncated", recovery: payload };
+}
+//# sourceMappingURL=sanitize.js.map

package/build/src/velocious/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/velocious/sanitize.js"],"names":[],"mappings":"AAAA,YAAY;AAEZ,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAC9B,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAClC,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAC/B,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAA;AACtC,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAC/B,MAAM,QAAQ,GAAG,YAAY,CAAA;AAC7B,MAAM,iBAAiB,GAAG,aAAa,CAAA;AACvC,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,CAAA;AAE3C,kDAAkD;AAElD;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAK,EAAE,OAAO;IAClC,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrE,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;AAC9F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC;IAC5D,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAC,OAAO,EAAE,CAAC,EAAC,CAAC,CAAA;IACpE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC7C,IAAI,SAAS,KAAK,eAAe;QAAE,OAAO,EAAC,MAAM,EAAE,4CAA4C,EAAE,SAAS,EAAE,IAAI,EAAC,CAAA;IAEjH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,oBAAoB;QAAE,OAAO,SAAS,CAAA;IAE3E,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QAChD,MAAM,EAAE,6BAA6B,oBAAoB,QAAQ;QACjE,SAAS,EAAE,IAAI;KAChB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK;IACjD,IAAI,KAAK,CAAC,OAAO,IAAI,kBAAkB,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,eAAe,CAAA;IACpF,KAAK,CAAC,OAAO,EAAE,CAAA;IAEf,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,EAAE,CAAA;QACjB,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAA;QACrD,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;QAE1E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;YACxE,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,SAAS,GAAG,IAAI,CAAA;gBAChB,MAAK;YACP,CAAC;YACD,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrD,CAAC;QAED,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC7C,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAE/C,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAE1E,kCAAkC;IAClC,MAAM,MAAM,GAAG,EAAE,CAAA;IACjB,MAAM,IAAI,GAAG,EAAE,CAAA;IACf,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,SAAQ;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACd,IAAI,IAAI,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACzC,SAAS,GAAG,IAAI,CAAA;YAChB,IAAI,CAAC,MAAM,GAAG,sBAAsB,GAAG,CAAC,CAAA;YACxC,MAAK;QACP,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,aAAa,CAAC,sCAAsC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/G,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,SAAS,GAAG,IAAI,CAAA;YAChB,MAAK;QACP,CAAC;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,SAAQ;QAErC,uBAAuB,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,SAAS;QAAE,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAA;IACvE,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK;IACjD,IAAI,YAAY,GAAG,GAAG,CAAA;IACtB,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3C,YAAY,GAAG,GAAG,GAAG,IAAI,SAAS,EAAE,CAAA;QACpC,SAAS,EAAE,CAAA;IACb,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE;QAC1C,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,KAAK;QACL,QAAQ,EAAE,IAAI;KACf,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAK,EAAE,OAAO;IACjD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAClH,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAC,OAAO,EAAE,QAAQ,EAAC,EAAE,OAAO,CAAC,CAAA;IAElE,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAClF,OAAO,EAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAC,CAAA;IAC/D,CAAC;IAED,OAAO,EAAC,OAAO,EAAE,+CAA+C,EAAE,QAAQ,EAAE,OAAO,EAAC,CAAA;AACtF,CAAC"}

package/build/src/velocious/worker.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @typedef {object} WorkerContext
+ * @property {any} [configuration] - Reconstructed Velocious configuration.
+ * @property {(args: {mountIdentifier: string, runId: string}) => Promise<void>} [execute] - Test-only bootstrap execution hook.
+ */
+/**
+ * Parses the package-owned worker's bounded invocation contract.
+ *
+ * @param {string[]} argv - Worker arguments.
+ * @returns {{bootstrapPath: string, mountIdentifier: string, runId: string}} Invocation.
+ */
+export function parseWorkerArguments(argv: string[]): {
+    bootstrapPath: string;
+    mountIdentifier: string;
+    runId: string;
+};
+/**
+ * Executes one admitted deployment in a fresh application process.
+ *
+ * @param {{bootstrapPath: string, mountIdentifier: string, runId: string}} args - Worker invocation.
+ * @returns {Promise<void>}
+ */
+export function runDetachedDeploymentWorker({ bootstrapPath, mountIdentifier, runId }: {
+    bootstrapPath: string;
+    mountIdentifier: string;
+    runId: string;
+}): Promise<void>;
+/**
+ * @param {any} configuration - Configuration.
+ * @param {string} context - Error context.
+ * @param {unknown} error - Error.
+ * @returns {void}
+ */
+export function reportWorkerFrameworkError(configuration: any, context: string, error: unknown): void;
+export type WorkerContext = {
+    /**
+     * - Reconstructed Velocious configuration.
+     */
+    configuration?: any;
+    /**
+     * - Test-only bootstrap execution hook.
+     */
+    execute?: ((args: {
+        mountIdentifier: string;
+        runId: string;
+    }) => Promise<void>) | undefined;
+};
+//# sourceMappingURL=worker.d.ts.map

package/build/src/velocious/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../../src/velocious/worker.js"],"names":[],"mappings":"AAgBA;;;;GAIG;AAEH;;;;;GAKG;AACH,2CAHW,MAAM,EAAE,GACN;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,CAU3E;AAED;;;;;GAKG;AACH,uFAHW;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAC7D,OAAO,CAAC,IAAI,CAAC,CAsEzB;AA+BD;;;;;GAKG;AACH,0DALW,GAAG,WACH,MAAM,SACN,OAAO,GACL,IAAI,CAQhB;;;;;oBAzIa,GAAG;;;;sBACI;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC"}

package/build/src/velocious/worker.js

@@ -0,0 +1,165 @@
+// @ts-check
+import { pathToFileURL } from "node:url";
+import AppRoutes from "velocious/build/src/routes/app-routes.js";
+import configurationResolver from "velocious/build/src/configuration-resolver.js";
+import { DeploymentControlPlane, lookupTarget } from "./control-plane.js";
+import { createRampwayDeploymentExecutor } from "./executor.js";
+import { validateWorkerBootstrapPath } from "./controller.js";
+import DeploymentRunStore from "./run-store.js";
+import { getDeploymentMountByIdentifier } from "./registry.js";
+import { sanitizeErrorPayload } from "./sanitize.js";
+const MAX_IDENTIFIER_LENGTH = 128;
+/**
+ * @typedef {object} WorkerContext
+ * @property {any} [configuration] - Reconstructed Velocious configuration.
+ * @property {(args: {mountIdentifier: string, runId: string}) => Promise<void>} [execute] - Test-only bootstrap execution hook.
+ */
+/**
+ * Parses the package-owned worker's bounded invocation contract.
+ *
+ * @param {string[]} argv - Worker arguments.
+ * @returns {{bootstrapPath: string, mountIdentifier: string, runId: string}} Invocation.
+ */
+export function parseWorkerArguments(argv) {
+    if (argv.length !== 3)
+        throw new Error("Rampway deployment worker requires bootstrap, mount, and run identifiers");
+    const [bootstrapPath, mountIdentifier, runId] = argv;
+    if (typeof mountIdentifier !== "string" || !/^[0-9a-f]{64}$/.test(mountIdentifier))
+        throw new Error("Invalid Rampway deployment worker mount identifier");
+    if (typeof runId !== "string" || runId.length === 0 || runId.length > MAX_IDENTIFIER_LENGTH || !/^[A-Za-z0-9_-]+$/.test(runId)) {
+        throw new Error("Invalid Rampway deployment worker run identifier");
+    }
+    return { bootstrapPath: validateWorkerBootstrapPath(bootstrapPath), mountIdentifier, runId };
+}
+/**
+ * Executes one admitted deployment in a fresh application process.
+ *
+ * @param {{bootstrapPath: string, mountIdentifier: string, runId: string}} args - Worker invocation.
+ * @returns {Promise<void>}
+ */
+export async function runDetachedDeploymentWorker({ bootstrapPath, mountIdentifier, runId }) {
+    /** @type {any} */
+    let configuration;
+    /** @type {DeploymentRunStore|null} */
+    let store = null;
+    /** @type {import('./control-plane.js').DeploymentMountOptions & {databaseIdentifier: string, executor: import('./executor.js').RampwayDeploymentExecutor}|null} */
+    let options = null;
+    let claimed = null;
+    try {
+        const imported = await import(pathToFileURL(bootstrapPath).href);
+        const bootstrap = imported.default ?? imported.createRampwayDeploymentWorkerContext;
+        if (typeof bootstrap !== "function")
+            throw new Error("Rampway worker bootstrap must default-export a context factory");
+        const context = /** @type {WorkerContext} */ (await bootstrap({ mountIdentifier, runId }));
+        if (!context || typeof context !== "object")
+            throw new Error("Rampway worker bootstrap must return a context object");
+        if (typeof context.execute === "function") {
+            await context.execute({ mountIdentifier, runId });
+            return;
+        }
+        configuration = context.configuration;
+        if (!configuration)
+            throw new Error("Rampway worker bootstrap did not return a Velocious configuration");
+        await initializeWorkerConfiguration(configuration);
+        options = deploymentWorkerOptions(configuration, mountIdentifier, bootstrapPath);
+        store = createWorkerStore(configuration, options, mountIdentifier);
+        claimed = await store.claimPendingRun({ id: runId, startedAtMs: Date.now() });
+        const target = lookupTarget(options.projects, claimed.project, claimed.stage);
+        if (!target)
+            throw new Error(`Deployment run ${runId} no longer has an allowlisted target`);
+        const plane = new DeploymentControlPlane({
+            detachedExecution: async () => { throw new Error("Detached workers cannot launch nested deployment workers"); },
+            emitFrameworkError(error) {
+                reportWorkerFrameworkError(configuration, error.context, error.error);
+            },
+            executor: options.executor ?? createRampwayDeploymentExecutor(),
+            options,
+            store
+        });
+        await plane._executeRun({ claimed: true, run: claimed, target });
+    }
+    catch (error) {
+        if (!store || !options) {
+            try {
+                const resolveConfiguration = /** @type {(args: {directory: string}) => Promise<any>} */ (configurationResolver);
+                configuration ??= await resolveConfiguration({ directory: process.cwd() });
+                await initializeWorkerConfiguration(configuration);
+                options = deploymentWorkerOptions(configuration, mountIdentifier, bootstrapPath);
+                store = createWorkerStore(configuration, options, mountIdentifier);
+            }
+            catch (recoveryError) {
+                reportWorkerFrameworkError(configuration, "rampway-deployment-api-worker-recovery", recoveryError);
+                throw new AggregateError([error, recoveryError], "Rampway worker could not reconstruct its durable failure context");
+            }
+        }
+        const safeError = sanitizeErrorPayload(error, options.accessTokens);
+        try {
+            if (claimed) {
+                await store.markFailed({ error: safeError, finishedAtMs: Date.now(), id: claimed.id, ownerToken: claimed.ownerToken ?? "" });
+            }
+            else {
+                await store.failPendingRun({ error: safeError, finishedAtMs: Date.now(), id: runId });
+            }
+            await store.addAuditEvent({ event: "run_failed", payload: { message: safeError.message, phase: claimed ? "worker_execution" : "worker_bootstrap" }, runId });
+        }
+        catch (persistenceError) {
+            reportWorkerFrameworkError(configuration, "rampway-deployment-api-worker-failure-persistence", persistenceError);
+            throw new AggregateError([error, persistenceError], "Rampway worker failure could not be persisted");
+        }
+        return;
+    }
+    finally {
+        if (configuration && typeof configuration.closeDatabaseConnections === "function")
+            await configuration.closeDatabaseConnections();
+    }
+}
+/** @param {any} configuration - Configuration. @returns {Promise<void>} */
+async function initializeWorkerConfiguration(configuration) {
+    const routes = await AppRoutes.getRoutes(configuration);
+    await configuration.initialize({ type: "rampway-deployment-worker" });
+    configuration.setRoutes(routes);
+}
+/**
+ * @param {any} configuration - Configuration.
+ * @param {string} mountIdentifier - Mount identifier.
+ * @param {string} bootstrapPath - Canonical bootstrap path.
+ * @returns {import('./control-plane.js').DeploymentMountOptions & {databaseIdentifier: string, executor: import('./executor.js').RampwayDeploymentExecutor}} Options.
+ */
+function deploymentWorkerOptions(configuration, mountIdentifier, bootstrapPath) {
+    const options = /** @type {import('./control-plane.js').DeploymentMountOptions & {databaseIdentifier: string, executor: import('./executor.js').RampwayDeploymentExecutor}} */ (getDeploymentMountByIdentifier(configuration, mountIdentifier));
+    if (!options || options.workerBootstrapPath !== bootstrapPath)
+        throw new Error("Rampway deployment worker mount was not reconstructed");
+    return options;
+}
+/**
+ * @param {any} configuration - Configuration.
+ * @param {import('./control-plane.js').DeploymentMountOptions & {databaseIdentifier: string}} options - Mount options.
+ * @param {string} mountIdentifier - Mount identifier.
+ * @returns {DeploymentRunStore} Store.
+ */
+function createWorkerStore(configuration, options, mountIdentifier) {
+    return new DeploymentRunStore({ configuration, databaseIdentifier: options.databaseIdentifier, mountIdentifier, staleRunTimeoutMs: options.staleRunTimeoutMs });
+}
+/**
+ * @param {any} configuration - Configuration.
+ * @param {string} context - Error context.
+ * @param {unknown} error - Error.
+ * @returns {void}
+ */
+export function reportWorkerFrameworkError(configuration, context, error) {
+    const events = configuration?.getErrorEvents?.();
+    if (!events)
+        return;
+    const payload = { context, error };
+    events.emit("framework-error", payload);
+    events.emit("all-error", { ...payload, errorType: "framework-error" });
+}
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+    try {
+        await runDetachedDeploymentWorker(parseWorkerArguments(process.argv.slice(2)));
+    }
+    catch (_error) {
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=worker.js.map

package/build/src/velocious/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../../src/velocious/worker.js"],"names":[],"mappings":"AAAA,YAAY;AAEZ,OAAO,EAAC,aAAa,EAAC,MAAM,UAAU,CAAA;AAEtC,OAAO,SAAS,MAAM,0CAA0C,CAAA;AAChE,OAAO,qBAAqB,MAAM,+CAA+C,CAAA;AAEjF,OAAO,EAAC,sBAAsB,EAAE,YAAY,EAAC,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAAC,+BAA+B,EAAC,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAC,2BAA2B,EAAC,MAAM,iBAAiB,CAAA;AAC3D,OAAO,kBAAkB,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAC,8BAA8B,EAAC,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAC,oBAAoB,EAAC,MAAM,eAAe,CAAA;AAElD,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAEjC;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAI;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAA;IAClH,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,IAAI,CAAA;IACpD,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACzJ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/H,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,EAAC,aAAa,EAAE,2BAA2B,CAAC,aAAa,CAAC,EAAE,eAAe,EAAE,KAAK,EAAC,CAAA;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAAC,aAAa,EAAE,eAAe,EAAE,KAAK,EAAC;IACvF,kBAAkB;IAClB,IAAI,aAAa,CAAA;IACjB,sCAAsC;IACtC,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,mKAAmK;IACnK,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,oCAAoC,CAAA;QACnF,IAAI,OAAO,SAAS,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACtH,MAAM,OAAO,GAAG,4BAA4B,CAAC,CAAC,MAAM,SAAS,CAAC,EAAC,eAAe,EAAE,KAAK,EAAC,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAErH,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,OAAO,CAAC,OAAO,CAAC,EAAC,eAAe,EAAE,KAAK,EAAC,CAAC,CAAA;YAC/C,OAAM;QACR,CAAC;QAED,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;QACrC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;QACxG,MAAM,6BAA6B,CAAC,aAAa,CAAC,CAAA;QAClD,OAAO,GAAG,uBAAuB,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;QAChF,KAAK,GAAG,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;QAClE,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,EAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAC,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC7E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,sCAAsC,CAAC,CAAA;QAC3F,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC;YACvC,iBAAiB,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA,CAAC,CAAC;YAC9G,kBAAkB,CAAC,KAAK;gBACtB,0BAA0B,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;YACvE,CAAC;YACD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,+BAA+B,EAAE;YAC/D,OAAO;YACP,KAAK;SACN,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,WAAW,CAAC,EAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAC,CAAC,CAAA;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,oBAAoB,GAAG,0DAA0D,CAAC,CAAC,qBAAqB,CAAC,CAAA;gBAC/G,aAAa,KAAK,MAAM,oBAAoB,CAAC,EAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EAAC,CAAC,CAAA;gBACxE,MAAM,6BAA6B,CAAC,aAAa,CAAC,CAAA;gBAClD,OAAO,GAAG,uBAAuB,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;gBAChF,KAAK,GAAG,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;YACpE,CAAC;YAAC,OAAO,aAAa,EAAE,CAAC;gBACvB,0BAA0B,CAAC,aAAa,EAAE,wCAAwC,EAAE,aAAa,CAAC,CAAA;gBAClG,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,kEAAkE,CAAC,CAAA;YACtH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QACnE,IAAI,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC,UAAU,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAC,CAAC,CAAA;YAC5H,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC,cAAc,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAC,CAAC,CAAA;YACrF,CAAC;YACD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,EAAC,EAAE,KAAK,EAAC,CAAC,CAAA;QAC1J,CAAC;QAAC,OAAO,gBAAgB,EAAE,CAAC;YAC1B,0BAA0B,CAAC,aAAa,EAAE,mDAAmD,EAAE,gBAAgB,CAAC,CAAA;YAChH,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,+CAA+C,CAAC,CAAA;QACtG,CAAC;QACD,OAAM;IACR,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,IAAI,OAAO,aAAa,CAAC,wBAAwB,KAAK,UAAU;YAAE,MAAM,aAAa,CAAC,wBAAwB,EAAE,CAAA;IACnI,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,6BAA6B,CAAC,aAAa;IACxD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACvD,MAAM,aAAa,CAAC,UAAU,CAAC,EAAC,IAAI,EAAE,2BAA2B,EAAC,CAAC,CAAA;IACnE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa;IAC5E,MAAM,OAAO,GAAG,8JAA8J,CAAC,CAAC,8BAA8B,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAA;IAC/O,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,mBAAmB,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IACvI,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,eAAe;IAChE,OAAO,IAAI,kBAAkB,CAAC,EAAC,aAAa,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAC,CAAC,CAAA;AAC/J,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK;IACtE,MAAM,MAAM,GAAG,aAAa,EAAE,cAAc,EAAE,EAAE,CAAA;IAChD,IAAI,CAAC,MAAM;QAAE,OAAM;IACnB,MAAM,OAAO,GAAG,EAAC,OAAO,EAAE,KAAK,EAAC,CAAA;IAChC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;IACvC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAC,GAAG,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAC,CAAC,CAAA;AACtE,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,2BAA2B,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAChF,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IACtB,CAAC;AACH,CAAC"}

package/docs/docker-development-environment.md

@@ -0,0 +1,103 @@
+# Docker development environment
+
+Rampway has one canonical root development image and one persistent Compose service. The image is digest-pinned Ubuntu 26.04 LTS with exact NodeSource Node 24, a checksummed signing key, the universal coding/debugging baseline, and the current OpenCode, Codex, Claude Code, and official Kimi Code CLIs. The build is source-independent: `.dockerignore` closes the build context to the Dockerfile metadata, the image copies no repository content, and project dependencies are installed only inside the running service.
+
+## First use
+
+Prerequisites are Docker with Compose v2 and a dedicated UID/GID-1000 development home containing this checkout at `$DEV_HOME_PATH/rampway`.
+
+Copy the portable template and confirm its required read-only credential sources:
+
+```bash
+cp .env.example .env
+test -d "${GH_CONFIG_SOURCE_PATH:-$HOME/.config/gh}"
+test -f "${CODEX_AUTH_SOURCE_PATH:-$HOME/.codex/auth.json}"
+```
+
+Set `DEV_HOME_PATH` in `.env` to a dedicated home path containing this checkout at `$DEV_HOME_PATH/rampway`. Do not use an unrelated general host home or recursively change its ownership in the container. The environment template defaults to `/home/dev`; adjust it for any non-default host layout.
+
+Run the preparation helper to create the required mount-target parent directories with correct permissions, then start the persistent service and install locked dependencies:
+
+```bash
+scripts/prepare-dev-home.sh
+docker compose up --build --detach dev
+scripts/docker-run.sh npm ci
+```
+
+`scripts/docker-run.sh` uses `docker compose exec -T dev` and preserves every command argument exactly. The service must already be running. Dependencies, caches, the checkout, and ordinary tool state persist naturally under the complete `/home/dev` bind.
+
+## Isolation and mounts
+
+Compose declares the default project name `rampway`. Override it with `COMPOSE_PROJECT_NAME` (or `-p`) and use a distinct `DEV_HOME_PATH` for each concurrent instance. Run `scripts/prepare-dev-home.sh` to create required mount-target parent directories before the first start:
+
+```bash
+COMPOSE_PROJECT_NAME=rampway-review DEV_HOME_PATH=/srv/rampway-dev-homes/review \
+  scripts/prepare-dev-home.sh
+COMPOSE_PROJECT_NAME=rampway-review DEV_HOME_PATH=/srv/rampway-dev-homes/review \
+  docker compose up --build --detach dev
+```
+
+The `dev` service has exactly these mounts:
+
+- `${DEV_HOME_PATH:?Set DEV_HOME_PATH in .env}` at `/home/dev`;
+- `${GH_CONFIG_SOURCE_PATH:?Set GH_CONFIG_SOURCE_PATH in .env}` at `/home/dev/.config/gh`, read-only;
+- `${CODEX_AUTH_SOURCE_PATH:?Set CODEX_AUTH_SOURCE_PATH in .env}` at `/home/dev/.codex/auth.json`, read-only.
+
+The GitHub config directory is selected through `GH_CONFIG_DIR`. Only the narrow Codex auth file is authorized; SSH keys, Docker sockets, broad host auth mounts, and separate Claude/Kimi/OpenCode secret paths are not. The tracked topology also forbids source split mounts, named source/session volumes, fixed names/ports, privileged mode, sidecars, and container-side ownership fixups.
+
+Provider CLI installation is not provider authorization. Threadwire remains parent-owned and is resolved outside this service through bare unversioned `npx threadwire`; Rampway installs no global or project Threadwire package and tracks no provider workspace profile.
+
+## Static validation
+
+The dependency-free verifier checks the image pin, NodeSource verification, provider specs, complete apt baseline, non-root identity, exact mounts, fail-closed interpolation, closed build context, forbidden topology, ignored `.env`, and helper contract. Its focused tests also inject representative regressions:
+
+```bash
+npm run verify:docker-dev-environment
+npm run test:docker-dev-environment
+```
+
+## Docker-capable coordinator validation
+
+The bootstrap service has no Docker access. A coordinator must render Compose and build the image cleanly:
+
+```bash
+export COMPOSE_PROJECT_NAME=rampway-canonical-validation
+docker compose config --quiet
+docker compose config
+docker compose build --pull --no-cache dev
+docker compose up --detach dev
+docker compose exec -T dev sh -lc 'test "$HOME" = /home/dev && test "$PWD" = /home/dev/rampway && test "$(id -u)" = 1000 && test "$(id -g)" = 1000'
+docker compose exec -T dev npm ci
+docker compose exec -T dev npm run verify:docker-dev-environment
+```
+
+To prove two-instance isolation, prepare two UID/GID-1000 development homes with Rampway at `<home>/rampway`, start both, and compare their container IDs:
+
+```bash
+COMPOSE_PROJECT_NAME=rampway-isolation-a DEV_HOME_PATH=/srv/rampway-dev-homes/isolation-a docker compose up --build --detach dev
+COMPOSE_PROJECT_NAME=rampway-isolation-b DEV_HOME_PATH=/srv/rampway-dev-homes/isolation-b docker compose up --build --detach dev
+test "$(COMPOSE_PROJECT_NAME=rampway-isolation-a docker compose ps -q dev)" != "$(COMPOSE_PROJECT_NAME=rampway-isolation-b docker compose ps -q dev)"
+```
+
+For fresh cutover, provision a new dedicated home with Rampway already checked out at `<home>/rampway`, then perform a clean image build and dependency install:
+
+```bash
+export RAMPWAY_COMPOSE_PROJECT=rampway-cutover-fresh
+export RAMPWAY_DEV_HOME=/srv/rampway-dev-homes/cutover-fresh
+test -d "$RAMPWAY_DEV_HOME/rampway/.git"
+COMPOSE_PROJECT_NAME="$RAMPWAY_COMPOSE_PROJECT" DEV_HOME_PATH="$RAMPWAY_DEV_HOME" docker compose build --pull --no-cache dev
+COMPOSE_PROJECT_NAME="$RAMPWAY_COMPOSE_PROJECT" DEV_HOME_PATH="$RAMPWAY_DEV_HOME" docker compose up --build --detach dev
+COMPOSE_PROJECT_NAME="$RAMPWAY_COMPOSE_PROJECT" DEV_HOME_PATH="$RAMPWAY_DEV_HOME" docker compose exec -T dev npm ci
+```
+
+For exact resume, reuse the retained home and project name without reinstalling or relocating state, then prove the same checkout revision is visible:
+
+```bash
+test -n "$RAMPWAY_COMPOSE_PROJECT"
+test -d "$RAMPWAY_DEV_HOME/rampway/.git"
+export RAMPWAY_EXPECTED_HEAD="$(git -C "$RAMPWAY_DEV_HOME/rampway" rev-parse HEAD)"
+COMPOSE_PROJECT_NAME="$RAMPWAY_COMPOSE_PROJECT" DEV_HOME_PATH="$RAMPWAY_DEV_HOME" docker compose up --build --detach dev
+COMPOSE_PROJECT_NAME="$RAMPWAY_COMPOSE_PROJECT" DEV_HOME_PATH="$RAMPWAY_DEV_HOME" docker compose exec -T -e RAMPWAY_EXPECTED_HEAD="$RAMPWAY_EXPECTED_HEAD" dev sh -lc 'test "$PWD" = /home/dev/rampway && test "$(git rev-parse HEAD)" = "$RAMPWAY_EXPECTED_HEAD"'
+```
+
+The obsolete `/workspace` and named-volume state is not imported. Verify the new service before stopping the old project; removal of old named volumes is a separate destructive coordinator decision.