refactor(deployment)!: remove App Deployment and bound capabilities

[Yevanchen]

Parent

• feat(platform): pivot Mosoo to an API-first managed Agent runtime #546

What to build

Remove the App Deployment product and its deployment-bound Agent capability model from Mosoo main.

This is an end-to-end removal, not a hidden or deprecated surface:

• Remove repository deployment, framework detection, build planning, Mosoo subdomains, deployment runs and history, Cloudflare Pages/Worker provisioning, redeploy, and deletion flows.
• Remove the deployment console and preview experience while preserving non-deployment tenant content needed before the Workspace migration.
• Remove App Deployment GraphQL operations, contracts, generated clients, identifiers, command variants, configuration, environment variables, provider-only dependencies, CLI commands and guidance, documentation, examples, and translations.
• Remove every bound-capability URL and route, signed-token implementation, capability-specific caller, admission and revocation policy, idempotency scope, Thread visibility rule, deployment authority guard, and Run provenance path.
• Remove deployment bindings from repository configuration and generated deployment environments. Do not leave stubs, aliases, redirects, disabled feature flags, or compatibility parsers.
• Keep the ordinary API-key-authenticated Agent/Thread path working until the Workspace and Session API slices replace it.
• Do not remove unrelated concepts that merely contain the word “deployment,” including immutable Agent configuration revisions, Mosoo's own production deployment machinery, or generic runtime infrastructure.
• Remove only App Deployment command variants; shared command queues remain where retained runtime workflows use them.

Use the existing cleanup behavior before deleting its implementation:

1. Freeze creation of new App Deployments and bound capabilities.
2. Inventory active deployments, active deployment runs, and queued or running deployment commands.
3. Delete or explicitly account for every tracked Pages project, Worker script, route, domain, and deployment sandbox through the current compensating cleanup path.
4. Verify that no external hosted site remains managed by Mosoo and no deployment command can still execute.
5. Remove bound routes so all previously issued capability URLs become unusable.
6. Remove the active product, API, runtime, and infrastructure code.

Preserve accepted Session, Run, message, artifact, usage, and audit records after removing deployment-only provenance.

Do not rewrite established D1 migrations, snapshots, or journals. Historical deployment tables and provenance columns may remain as isolated retired storage in this slice. Physically dropping or rewriting them requires explicit approval, a production backup, verification queries, and a rollback plan.

Acceptance criteria

• The console contains no deploy, redeploy, deployment status, deployment history, repository hosting, subdomain, or bound-Agent experience.
• Former bound-capability routes are unregistered, and all previously issued capability URLs are unusable.
• A normal authenticated public API call still reaches an authorized Agent without any Deployment dependency.
• Session and Run admission no longer reads, validates, or writes App Deployment authority or bound-capability provenance.
• No App Deployment GraphQL field, contract, generated client, command, external provisioner, configuration variable, CLI surface, documentation promise, or provider-only dependency remains.
• No stub, redirect, tombstone endpoint, or active compatibility layer remains.
• Shared command queues, Agent configuration revisions, runtime, and Mosoo production deployment tooling remain intact.
• Production inventory proves there are no active deployment runs or queued deployment commands before their processors are removed.
• All tracked external hosted resources are deleted or explicitly accounted for before the feature is declared removed.
• Existing Sessions, Runs, messages, artifacts, usage, and audit history remain readable without executable Deployment semantics.
• Historical D1 migrations remain byte-for-byte unchanged; fresh-chain and production-shaped forward-migration verification pass.
• Frontend, API, contract, generated-client, database, and end-to-end verification pass without App Deployment.

Blocked by

• refactor(channels)!: remove Channels from Mosoo end to end #579 — both slices touch shared command processing, Worker configuration, and cross-domain fixtures.

[Yevanchen]

Production cutover inventory before removal

• Inventory time: 2026-09-01 (Asia/Shanghai).
• Organization: Dify (01KWC37Q6EJFNJVVK3G192X5X6), 6 Apps total.
• Exactly one active App Deployment: App mosoo-codex-pet (01KWC37Q6EJFNJVVK3G192X5X7), Deployment 01KYMQKQCZQSGY6C27HR9V75MN.
• Hosted resource name: app-01kwc37q6ejfnjvvk3g192x5x7; hostname: app-01kwc37q6ejfnjvvk3g192x5x7.apps.mosoo.ai. The site returned HTTP 200 before cleanup.
• Source backup / recreation point: Yevanchen/mosoo-codex-pet@954a0c93d125166960817b7dbe877e65033df432 on main.
• Deployment Runs: 14 total, 4 successful and 10 failed; 0 queued, preparing, building, submitting, submitted, or activating.
• The current compensating delete path will revoke the active deployment, destroy any active deployment build/deploy sandboxes, and idempotently remove the matching Cloudflare Pages project/domain plus Worker script/route/domain before soft-deleting the D1 Deployment row. Historical migrations are not changed.
• Rollback point: before the removal code ships, the public source commit above can be redeployed through the existing flow. The intended product decision is shutdown, so no hosted-resource rollback will be performed unless cleanup itself fails.

The owner-facing API does not expose the api_command ledger, so queued-command proof is limited to the authoritative Deployment Run inventory above. The current processor remains deployed during cleanup, and the post-cleanup check will verify the Deployment is absent and the hostname is no longer serving the site.

[Yevanchen]

Production cleanup completed on 2026-09-01.

• Target app: 01KWC37Q6EJFNJVVK3G192X5X7 (mosoo-codex-pet)
• Target deployment: 01KYMQKQCZQSGY6C27HR9V75MN
• External resource name/hostname: app-01kwc37q6ejfnjvvk3g192x5x7 / app-01kwc37q6ejfnjvvk3g192x5x7.apps.mosoo.ai
• The first deletion attempt returned 502 after partially removing external resources. The same idempotent delete was retried and succeeded.
• Post-delete control-plane readback: deployment: null, boundAgents: [].
• Post-delete run inventory: 14 historical runs retained, 0 active runs; the latest historical run now has liveUrl: null.
• The former hostname no longer serves the deployed site (TLS connection fails / HTTP code 000).
• No D1 migration, snapshot, journal, or historical record was rewritten.

Recovery provenance remains the public source commit 954a0c93d125166960817b7dbe877e65033df432 in Yevanchen/mosoo-codex-pet; the managed hosted resource itself has been intentionally reclaimed.

[Yevanchen]

Correction to the earlier owner-scoped inventory: the CLI overview covered only the signed-in Dify organization, not all production tenants. The authoritative production D1 inventory initially had 6 active deployment records. One (01KYMQKQCZQSGY6C27HR9V75MN) has been cleaned, leaving 5 active records globally, 0 active deployment runs, 2 live Worker resources, and 2 expired app_deployment_run_dispatch ledger claims. The remaining app IDs are 01KWTHT538K6TTENKTX45AZF7G, 01KWXK0QNVM0687GAMYPH0MXMZ, 01KY9H7485NJ517MPYDN94CS56, 01KWGVY9PYHB4MZVBPATW1D6RK, and 01KZ8ZX52YCNQCFQ61YP9ASFDK.

I am treating the global inventory as authoritative for retirement: freeze creation first, remove the remaining external resources and active records through the compensating cleanup sequence, settle the two stale command claims while the processor still exists, then run the final zero-residual readback before removing the implementation.

[Yevanchen]

Global retirement recovery checkpoint (read-only inventory, before the remaining 5 records are removed):

• Production D1 Time Travel bookmark: 000000ef-00001a7e-000050d9-9daf70ae80b127e6eddc305f2e20dc04 (captured around 2026-09-01 11:54Z).
• Source commits verified readable through GitHub: MRZHUH/mosoo-test@8cb1ed833efa8b1e6866ac96444d0521347cfb07, KurosawaGeeker/mosoo-stock-desk@be79e449dd420fe1f42ba293c0d4b3fca7f7b5fd, DangoSys/buckyball@6d0ca224873b495f871eba35359c7949f8e7b505, RockChinQ/signal-garden@5c00ef7265b0e7d0fccd0d503069401ea561ac2c, and KurosawaGeeker/skill-product@163238b0ea753f940df7b1af92ffa722a2f783e3.
• Live resource provenance: signal-garden deployment/version aeb6958e-93ea-47cf-b37e-9d9040f8ca20 / 2ad64365-2f60-49a9-9086-3d772f2111d3; skill-product 53104d52-5dc5-4d13-b7d7-50c81db6dafb / 44acf7b3-7684-40eb-a534-59ef2f42e74b.
• The two expired command ledger rows have been backed up field-for-field before terminal settlement.

Rollback warning: do not restore the whole D1 bookmark because that would overwrite concurrent business writes. If recovery is ever required, export only the exact retired rows from the bookmark and rebuild the corresponding external resource from its verified source commit.

[Yevanchen]

生产清理已完成并通过 TTL 后独立复核：

• D1：13/13 App Deployment 已软删除，active=0，live URL 残留=0；40 条历史 Runs 完整保留（18 success / 22 failed），active=0。
• Command ledger：19 failed / 21 succeeded，queued/running/dead-lettered=0；2 条过期 running 命令已终结并清空 claim。
• Cloudflare：app-* Pages projects、Worker scripts、custom domains、routes 均为 0；Queue/DLQ backlog=0。
• Runtime：deployment build/deploy sandbox=0；deployment Vault secret=0。
• 公共面：6/6 已知 apps.mosoo.ai hosts 在 TTL 后仍 DoH NXDOMAIN，HTTPS 不可达。
• 删前 D1 Time Travel bookmark：000000ef-00001a7e-000050d9-9daf70ae80b127e6eddc305f2e20dc04
• 删后 D1 Time Travel bookmark：000000f0-0000049a-000050d9-766f2392936ab3c1f992f3bda10ace90

源码恢复 SHA 已在前一条 recovery comment 逐一验证。当前生产控制面/资源清理完成；剩余工作是合并并发布代码删除，然后显式移除 Worker 上 3 个 deployment-only bindings。