Lucim separates serving, background acquisition, untrusted repository intake, and sandbox execution into distinct processes.

​
Topology

The canonical Fly topology uses separate API/ordinary-worker, hosted MCP, repository-scanner, sandbox-worker, frontend, Postgres, Redis, and MinIO deployments. The sandbox worker remains off until its rollout gate passes.

​
Routine Fly deployment

Run deployments from a green main branch. The backend release command acquires a PostgreSQL advisory lock, upgrades to Alembic head, runs alembic check, and fails closed before serving.
Deploy the sandbox worker only after completing the sandbox conformance and readiness checklist:
Deploy the frontend with its required public build arguments:

​
Post-deploy verification

1

Check liveness

Request GET /api/health on the API and GET /health on the hosted MCP service.
2

Check readiness

Request GET /api/health/ready. A required worker heartbeat, database, Redis, credential, migration, or invariant failure returns 503.
3

Check workers

Confirm ordinary-worker and repository-scanner heartbeat keys are current. Confirm the sandbox heartbeat only when sandbox admission is enabled.
4

Exercise one monitor

Verify a scheduled or manually requested capture and inspect its durable run status.

​
Rollback

Roll back each Fly app independently by deploying the last known-good image digest. Prefer forward-fix migrations; downgrade only an additive schema change with a tested downgrade path. Append-only snapshots do not need data rollback when a differ is corrected.
Never add the one-time legacy database cutover flag to a routine startup or release command.