Created a persistent browser-accessible development environment at https://dev.codecartography.dev. It provides an acceptance surface for reviewed AutoCoder dev work before separately authorized production promotion.
The initial application revision is 73f6275fe7c581f902f64cb78cde353ad3587f79 using immutable images dev-73f6275fe7c5. /healthz returns HTTP 200 with X-Autocoder-Environment: development and the full revision in X-Autocoder-Revision.
autocoder-engineautocoder-dev-postgres, autocoder-dev-engine, and codecartography-dev-frontendautocoder-dev-postgres-pvc, 10 GiB local-path, bounded by the namespace quotaThe initial database was copied from production for realistic acceptance testing and sanitized before the development backend started. Operator sessions, stored account authentication, enabled accounts, active monitors, production evidence settings and production credential references were removed or disabled. The environment has a dedicated read-only Gitea token and OAuth application. It has no model-provider or Kubernetes credentials. Implementation, categorization, requirements scheduling, diagnostics, self-review, provider mutation and production webhook processing are disabled.
The branch-validation workflow validates the exact pushed dev revision, builds immutable images only for changed application components, rolls out the reviewed development overlay, waits for all three deployments, and verifies revision/environment health headers. A failed validation or rollout leaves the last healthy revision running.
The first rollout exposed an image-rewrite shell quoting error after both images were successfully built. No workload was changed by the failed workflow. The reviewed overlay was reconciled manually with those exact validated images. PR #4918 fixed the escaped end-of-line anchors and prevented workflow-only changes from rebuilding application images; its feature-head validation passed before merge to dev.
Added Traefik router autocoder-development-public on kryptovisor.auth.home.lan in /mnt/fastdata/docker/apps/traefik/config/docker/cert_conf.yml, using service autocoder-k8s and the letsencrypt certificate resolver. Backup: /mnt/fastdata/docker/apps/traefik/config/docker/cert_conf.yml.20260917T2040Z.bak.
The public route presents a valid certificate for dev.codecartography.dev and forwards to the isolated Kubernetes ingress.
dev revision.sha-792afedfeb32 throughout the development rollout.Revert the repository workflow and development overlay change to stop future rollout. Remove the Traefik router to withdraw public access. Removing the development PVC or other persistent data remains a destructive action requiring explicit approval.