How the pieces fit
The dashboard describes changes; a constrained helper applies host operations.
The control plane
| Layer | Responsibility |
|---|---|
| Portal | Unprivileged dashboard, sessions, organization permissions, encrypted SQLite state. |
| Root-owned helper | Typed, validated operations over a local Unix socket. |
| Project runtime | Native services as dedicated Unix users, or guarded Compose deployment. |
| Nginx / Certbot | Public routing, managed configuration validation and TLS. |
Web deployment phases
Node/Bun/Go prepare and health-check a native candidate before host activation. Python and PHP prepare source first; dependency installation and service health checks require the host helper. Compose builds and starts during helper activation. A local preflight is not proof of host health.
Keep a recovery path
Required activation, health or TLS failures trigger restoration of managed service/routing state. Release history records phases and failures. Application databases and external side effects are not rolled back by switching code releases.
A different lifecycle for Workers
The HTTP candidate flow applies to Web services. Worker preparation installs/builds without starting a candidate consumer. On the host, activation stops the old service before starting the new one, then checks that the same process stays running without a restart for five seconds. A failed activation attempts to restore the previous service configuration. Process readiness does not prove queue connectivity or successful jobs.