Parse has_auth/public_key from the service manifest onto Container
(persisted to InstalledMetadata), fetch manifests for running non-db
containers during reconciliation, hide role=auth containers from the
grid, and ensure dcntrlized-auth starts with the shared database.
- New ResolveContainer inspects a container by id, name, service label
or image name (case-insensitive), falling back to label matching when
Docker cannot resolve the reference.
- The action proxy uses the org.dcntrlized.port label, falling back to
the first mapped guest port, and no longer hardcodes the host port.
- Action forwarding preserves the request method, body, query string and
hop-by-hop-safe headers, and passes non-2xx status and body through.
Service cards that declare the database capability render a status chip
for the shared dcntrlized-db infra service, with a Pull action to
install and start the database when it is not installed yet.
- Merge logic hides db-role containers and hidden registry items from
the grid.
- Service model carries capabilities; a new DatabaseChip maps the live
database state onto the existing status metadata.
The shared dcntrlized-db Postgres service is now treated as Maestro
infrastructure: it is hidden from the service grid and auto-started
before any app container when already installed.
- Container model gains role/hidden/capabilities; registry items gain
hidden; installed metadata persists manifest capabilities so stopped
services still surface them.
- Registry marks the shared database image as hidden (OCI annotation,
label, or name fallback).
- Compose label rewrite merges existing service labels instead of
replacing them, so org.dcntrlized.role/hidden survive.
- New infra helpers ensure the external dcntrlized_net network and
start the database on the prod path and before each StartContainer.
- Watcher skips manifest fetch for db-role containers and persists
capabilities from the manifest.
- spec.yaml documents the new fields.
Admin