inventory sweeps the instance — and an empty environment shouts (#22) #24

Merged

dan-claude-bot merged 2 commits from feat/inventory-sweep into main

2026-07-13 19:45:06 +00:00

dan-claude-bot commented

2026-07-13 19:07:38 +00:00

(Migrated from github.com)

Closes #22.

inventory shipped in #20 reconciling a manifest against one project and one
environment that you name. But the premise of the verb is that you are looking
at a box you did not build — so you do not know those coordinates yet. It was
a discovery tool that required you to have already discovered, and within the
hour the operator was back to hand-curling /projects and /applications to
find out where anything lived.

cast inventory --env prod --instance box-b      # no repo → sweep the instance

sweep — instance box-b (https://coolify.example.com)

  Every project, every environment, every resource this token can see.
  No manifest involved: this is what is HERE, not how it compares to anything.

  Incubator
    production     (empty)
    staging        2 applications, 2 databases, 1 service
      application  Incubator Stack v2
      application  Incubator Landing
      database     Incubator Database v2
      database     Incubator Redis v2
      service      Incubator Umami

  La Familia Site
    production     1 application
      application  lafamilia-web

No manifest, no store, no age key, no recipient — it runs before adoption
exists. With a repo it reconciles exactly as before.

The part that was actually dangerous

Not the missing sweep — the way the targeted path failed without it.

Pointed at a project's production environment (auto-created by Coolify, and
empty), inventory reported:

on the box, and in the manifest
    (nothing matched — see both lists below)
on the box, NOT in the manifest
    (none)

5 difference(s) between the manifest and this box.

Every word of that is true. And the overall impression — "the box has nothing;
the manifest has five things" — is exactly the D-237 lie that cast refuses
everywhere else. The resources were alive and serving production the whole
time, in an environment called staging that nobody had ever swapped.

An environment with zero resources is far more often the wrong coordinate
than an empty one. It now says so, and names the sweep:

  looked in:    project "Incubator", environment "production"
  found:        NOTHING. Not one resource.

This environment is EMPTY — so there is nothing here to reconcile, and the
manifest's list below would just be the manifest talking to itself.

An environment with zero resources is far more often the WRONG COORDINATE than
an empty one. Coolify auto-creates a `production` environment in every project…

Sweep the instance and see where things actually are:

    cast inventory --env prod --instance box-b

Two details worth reviewing

The sweep asserts the team first, and that matters more here than
anywhere else: Coolify scopes what a token can see to its team, so a
wrong-team token would sweep an instance and truthfully report that it is
empty. Same class of lie, one layer out.
Environment enumeration takes two roads — GET /projects/{uuid}/environments,
falling back to the relation on GET /projects/{uuid}. The vendored OpenAPI
has been wrong before, and this is the one path where failing to enumerate is
worse than being slow.

The new suite's stub is shaped like the box this came from: three projects (two
of them unrelated third-party client sites nobody knew were on it), an empty
auto-created production, and the real system in staging under names a human
typed.

Checks

npm run check (biome), npm run build (tsc), npm test — 173 passing
(was 169).

🤖 Generated with Claude Code

Closes #22. `inventory` shipped in #20 reconciling a manifest against **one project and one environment that you name**. But the premise of the verb is that you are looking at a box you did not build — **so you do not know those coordinates yet.** It was a discovery tool that required you to have already discovered, and within the hour the operator was back to hand-curling `/projects` and `/applications` to find out where anything lived. ```sh cast inventory --env prod --instance box-b # no repo → sweep the instance ``` ``` sweep — instance box-b (https://coolify.example.com) Every project, every environment, every resource this token can see. No manifest involved: this is what is HERE, not how it compares to anything. Incubator production (empty) staging 2 applications, 2 databases, 1 service application Incubator Stack v2 application Incubator Landing database Incubator Database v2 database Incubator Redis v2 service Incubator Umami La Familia Site production 1 application application lafamilia-web ``` No manifest, no store, no age key, no recipient — it runs *before* adoption exists. With a repo it reconciles exactly as before. ## The part that was actually dangerous Not the missing sweep — the way the **targeted** path failed without it. Pointed at a project's `production` environment (auto-created by Coolify, and empty), inventory reported: ``` on the box, and in the manifest (nothing matched — see both lists below) on the box, NOT in the manifest (none) 5 difference(s) between the manifest and this box. ``` Every word of that is true. And the overall impression — *"the box has nothing; the manifest has five things"* — is **exactly the D-237 lie** that cast refuses everywhere else. The resources were alive and **serving production the whole time**, in an environment called `staging` that nobody had ever swapped. An environment with **zero** resources is far more often the **wrong coordinate** than an empty one. It now says so, and names the sweep: ``` looked in: project "Incubator", environment "production" found: NOTHING. Not one resource. This environment is EMPTY — so there is nothing here to reconcile, and the manifest's list below would just be the manifest talking to itself. An environment with zero resources is far more often the WRONG COORDINATE than an empty one. Coolify auto-creates a `production` environment in every project… Sweep the instance and see where things actually are: cast inventory --env prod --instance box-b ``` ## Two details worth reviewing 1. **The sweep asserts the team first**, and that matters more here than anywhere else: Coolify scopes what a token can see to its team, so a wrong-team token would sweep an instance and *truthfully* report that it is empty. Same class of lie, one layer out. 2. **Environment enumeration takes two roads** — `GET /projects/{uuid}/environments`, falling back to the relation on `GET /projects/{uuid}`. The vendored OpenAPI has been wrong before, and this is the one path where failing to enumerate is worse than being slow. The new suite's stub is shaped like the box this came from: three projects (two of them **unrelated third-party client sites nobody knew were on it**), an empty auto-created `production`, and the real system in `staging` under names a human typed. ## Checks `npm run check` (biome), `npm run build` (tsc), `npm test` — **173 passing** (was 169). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/cast#24

No description provided.