The current product control plane is the Node.js/Express controller in controller/.
The separate Rust controller is an alternate implementation; its repository presence does
not establish production parity or deployment. This guide reflects the October 20 source.
Components
Work survives at different layers
An execution receipt can outlive an HTTP request. A supervised process can outlive the
request that started it. Prepared tasks retain private caller-side launch/input/result
journals. The server task registry enables fresh authorized observers, but does not replace
private launch/control receipts or make process logs permanent.
Persistent workspaces preserve files across pod replacement while their PVC exists.
Durable recovery recreates a pod under the same sandbox identity; it does not restore RAM,
REPL kernels, sockets, or arbitrary external transactions. Ending the sandbox deletes its
managed PVC; exported artifacts and checkpoints have their own retention contracts.
DurableRunClient targets the separate Temporal workflow service for durable orchestration.
A local multi-agent scheduler or terminal tmux workspace is not that workflow service.
Branching
Fork/promotion capture a workspace checkpoint, create a target, and restore it. Captures
for a source serialize through the configured checkpoint lock. Enabled healthy CSI snapshots
can restore a same-sized target PVC; failure can use the portable file-checkpoint path.
These are crash-consistent captures. Quiesce application writes if cross-file consistency
matters; neither path claims process-memory or database-transaction consistency.
Deployment boundaries
The Node controller exposes public process/database probes separately from authenticated
service capabilities and protected metrics. In production, use shared stores and compatible
migrations before assuming cross-replica replay. Database or coordination failures must not
be interpreted as a missing resource or permission to launch a duplicate.
Runtime images are separate from controller/dashboard builds. The latest controller-only
candidate can be built and collected from a reviewed source tag without rebuilding the
runtime or supplying a dashboard Stripe key. Source hash, registry digest, migration state,
and deployed capabilities each need their own evidence.
Continue with execution recovery,
operations, or
durable workspaces. Last modified on October 20, 2026
