Architecture and implementation boundaries

apps/dashboard/       Next.js App Router, Auth.js, email auth, same-origin API proxy
services/api/         Go + chi, session validation, tenant authorization
services/worker/      Redis + Asynq maintenance, DNS/TLS and custom-domain reconciliation
agent/                Ubuntu agent, verified installer, pairing, hardware, scoped Docker controls
packages/agent-protocol/ Shared Go protocol, signing and command/snapshot validation
services/edge/        FRP authorization, Caddy ask/public proxy, regional health probes
packages/ui/          Future shared UI; current shadcn-style primitives live in dashboard
packages/api-client/  Future generated client; current typed fetch lives in dashboard
infrastructure/      Local Compose, PostgreSQL migration and role bootstrap
scripts/              Development utilities
docs/                 Architecture, authentication, API contract, status

Browser → Next.js (same-origin HTTP-only cookie) → Go (internal Bearer token) → PostgreSQL. Go hashes the opaque token and checks its unexpired database session on every request. Revocation takes effect immediately. It does not decode or blindly trust a Next.js cookie. Every organization query checks membership; organization RLS additionally uses a transaction-local app.user_id. Connection-pool state does not leak between tenants.

The dashboard database role performs trusted authentication operations. The API uses a separate role without ownership or BYPASSRLS. Platform super_admin is modeled but has no automatic tenant bypass. OAuth access/refresh tokens are not retained: login does not grant repository deployment access. Session/email tokens are SHA-256 hashes; passwords use Argon2id. Secrets come from environment configuration. Use database TLS, encrypted storage, SMTP TLS, ingress limits, and HTTPS for production. Local Compose is development-only and binds published ports to loopback. Redis is internal and carries Asynq reconciliation tasks.

Phase 2 adds servers, agent_pairing_tokens, agent_credentials, agent_nonces, and agent_commands with RLS. The persisted SQL command queue is polled over signed outbound HTTPS; Asynq reconciliation is implemented in services/worker. See docs/phase-2.md for agent identity and command journaling.

Migrations 004–009 add applications/releases/logs, app tunnels and gateways, billing catalog/checkouts/subscriptions/payments/receipts, domain quotes/operations/verified registrants, compiled template pins, AI inventories, metrics, backup snapshots/jobs and regional routing. Runtime environments and registrar/native subscription secrets use organization-bound AES-GCM. Commercial catalogs have explicit operator administration; tenant data remains subject to membership and RLS even for platform administrators.

The agent executes typed, durable jobs through fixed Docker/Ollama/restic operations; the control plane exposes no shell endpoint. Managed application volumes are scoped by server/app/slot labels. Backups stream validated archives into encrypted restic storage; recovery creates separate volumes. Edge gateways authorize each new HTTP request against the control plane, report release-specific loopback health, and use worker-managed DNS failover. The worker role cannot read billing or application secrets. Read the Phase 3–6 operations guides for runtime prerequisites and unimplemented scope.