Self-hosted provisioning roadmap
Status: proposed, 2026-10-21. No provisioning commands or modules are implemented. Tracker: #52.
#Product boundary
The roadmap has two deployment paths: independently usable open-source software, including automation into the user's own cloud account, and optional commercial Managed Connect for user-owned coding hosts. Hosted compute, sponsor-hosted workspaces and infrastructure resale are deferred. Users supply their own cloud account and pay their provider directly. Provisioning must not require a UuBright account, Connect subscription, Cloudflare or inference plan.
#Delivery gates
| Gate | Deliverable | Exit evidence |
|---|---|---|
| P0: resource/lifecycle design | One AWS EC2/Linux reference deployment, persistent data disk, network/access design, cost estimate and supported CLI/provider versions | Explicit stop/start/destroy/data-delete semantics; credential/state review; inventory of billable resources |
| P1: reproducible infrastructure | OpenTofu-compatible Terraform modules and cloud-init/bootstrap using pinned prerequisites | Validation and meaningful plan/security checks under both supported CLIs; no secret-bearing user data/state/outputs |
| P2: usable lifecycle | Thin plan/create/status/stop/start/destroy wrapper and user guide; exact command names remain to be designed | Partial-failure/retry tests; resource ownership recorded; destruction preview and leftover reporting; retained data protected by tested IaC behavior |
| P3: disposable-cloud evidence | Explicitly authorized AWS demonstration and cleanup | Phone access; uncommitted files, agent state and logs recover after stop/start; no prompt/approval replay; retained data recoverable and separately deletable; billable leftovers enumerated |
Additional providers follow demand and evidence from P3. The implementation issue is the acceptance checklist; no resource creation or spending is authorized by this roadmap. A small wrapper uses IaC state rather than duplicating provisioning. Host provisioning stays outside ComputeDriver; session drivers remain #13.
#Required lifecycle contract
Stop releases or stops compute as supported while retaining workspace data. Storage, addresses and snapshots may remain billable; show these separately. Destroy removes compute and explicitly identified infrastructure while retaining data by default. Permanent workspace deletion is a separate explicit operation. The chosen module/state layout must make these promises true; a naive destroy of all resources is insufficient. Recovery from lost state and partial cleanup needs a documented path that never targets unrelated resources.
Keep inference/Git credentials out of IaC variables, plans, state, outputs, cloud-init user data and CI logs. Configure credentials on the execution host separately. Protect IaC state and explain retention and backup access. Budget alerts are not hard spending caps. Optional TTL needs an independent cleanup executor; a resource tag alone does not enforce expiration.
Self-managed authenticated HTTPS/VPN access and local recovery work independently. Optional Connect enrollment can be added after Connect is released; it is not a prerequisite for P0–P3. Provisioning does not alter the existing agent credential or runner acknowledgement contracts.