commit b8b544816d143bd3deabb4bcc3cf5aa64875b48b
Author: MechaCat02 <fabian@diekaulbachs.de>
Date:   Fri May 22 23:16:32 2026 +0200

    chore: initial scaffold — workspace, docs, blueprint
    
    Sets up the PiCloud monorepo as a Cargo workspace organised around the
    three-service architecture (manager / orchestrator / executor), each
    backed by a *-core library crate so the same logic powers both the MVP
    all-in-one `picloud` binary and the future split-process cluster mode.
    
      * crates/shared, executor-core, orchestrator-core, manager-core
        define the library surface and trait seams between the three
        services (`ExecutorClient`, `ScriptResolver`, `ScriptRepository`).
      * crates/picloud is the MVP entrypoint; serves /healthz on 8080
        (override via PICLOUD_BIND).
      * crates/picloud-{manager,orchestrator,executor} are skeleton
        binaries that keep the crate boundaries honest until cluster
        mode is built out in v1.3+.
      * docs/git-workflow.md defines the trunk-based workflow:
        short-lived branches, Conventional Commits, separate hotfix
        flow with mandatory reproduction tests.
      * CLAUDE.md captures the working rules for future Claude sessions.
    
    Workspace passes `cargo fmt`, `cargo clippy -D warnings` (with
    pedantic enabled), and `cargo test --workspace`. The all-in-one
    binary responds on `/healthz` and `/`.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..7a3e394
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,38 @@
+# Rust
+/target
+**/*.rs.bk
+Cargo.lock.bak
+
+# IDE
+/.idea
+/.vscode
+*.swp
+*.swo
+.DS_Store
+
+# Env / secrets
+.env
+.env.*
+!.env.example
+
+# Local config overrides
+config.local.toml
+/data
+/postgres-data
+
+# Dashboard
+/dashboard/node_modules
+/dashboard/.svelte-kit
+/dashboard/build
+/dashboard/.env
+
+# Caddy
+/caddy/data
+/caddy/config
+
+# Logs
+*.log
+/logs
+
+# OS
+Thumbs.db
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..94b09b9
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,100 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project
+
+**PiCloud** is a self-hosted, event-driven serverless compute platform. Users upload Rhai scripts, get HTTP endpoints. Optimized for solo-dev / consumer hardware (single node MVP, multi-node cluster in v1.3+).
+
+Authoritative design: [serverless_cloud_blueprint.md](serverless_cloud_blueprint.md). The blueprint is a living document — when architecture decisions are made in conversation that contradict it, treat the latest decision as truth and update the blueprint.
+
+## Three-Service Architecture
+
+The platform splits into three logical services, each backed by a `*-core` library crate so the same logic runs in single-process MVP mode and split-process cluster mode:
+
+| Service | Role | Library crate |
+|---------|------|---------------|
+| **Manager** | Control plane: script CRUD, scheduling/cron, dashboard backend, config. Single-writer to Postgres. | `manager-core` |
+| **Orchestrator** | Per-node ingress: receives HTTP (later SMTP, queue) events, resolves script, dispatches to local executor. Stateless. | `orchestrator-core` |
+| **Executor** | Per-node compute: runs Rhai scripts in a sandboxed engine. Stateless. | `executor-core` |
+
+In MVP, all three run in one process (`picloud` binary). In cluster mode, each runs as its own binary on each node, with one manager total and one orchestrator + executor per node.
+
+**Key boundary:** the orchestrator never imports `executor-core` directly — it depends on an `ExecutorClient` trait. The local impl calls `executor-core` in-process; the remote impl is an HTTP client. Same pattern keeps cluster mode a swap, not a rewrite.
+
+## Path Scheme
+
+- `/api/admin/*` — manager (control plane: script CRUD, config, dashboard API)
+- `/api/execute/{id}` — orchestrator (data plane: invoke a script by ID)
+- `/exec/*` — orchestrator (data plane: invoke scripts at custom paths, v1.1+)
+- `/healthz` — liveness (orchestrator)
+- `/` and static assets — dashboard (SvelteKit static build, served by Caddy)
+
+Caddy fronts everything. Same Caddyfile shape works for single-node and cluster — only upstream targets change.
+
+## Tech Stack
+
+- **Rust 1.92+** workspace, pinned via `rust-toolchain.toml`
+- **Axum** for HTTP, **Tokio** async, **sqlx** for Postgres
+- **Rhai** embedded scripting (in `executor-core`)
+- **PostgreSQL 15+** with `pgcrypto` and (v1.1+) `hstore`
+- **SvelteKit** dashboard, static adapter, CodeMirror 6 for the script editor
+- **Caddy 2** reverse proxy (auto-HTTPS in prod)
+- **Docker Compose** for dev and single-node prod
+
+## Common Commands
+
+```sh
+# Rust workspace
+cargo check --workspace
+cargo test --workspace
+cargo fmt --all
+cargo clippy --all-targets --all-features -- -D warnings
+
+# Run the all-in-one binary (MVP entry point)
+cargo run -p picloud
+
+# Run a single test
+cargo test -p executor-core sandbox::tests::respects_operation_budget
+
+# Dashboard (from dashboard/)
+npm run dev
+npm run build
+npm run check
+
+# Full stack (once docker-compose.yml exists)
+docker compose up
+docker compose down -v   # reset Postgres data
+```
+
+## Workspace Layout
+
+```
+crates/
+  shared/                 # cross-cutting types (Script, IDs, error enum, db pool)
+  executor-core/          # Rhai engine, sandbox, ctx, log, SDK
+  orchestrator-core/      # event ingress + ExecutorClient trait + dispatch
+  manager-core/           # control plane: repos, scheduler, config
+  picloud/                # ★ MVP all-in-one binary
+  picloud-manager/        # cluster mode binary (skeleton)
+  picloud-orchestrator/   # cluster mode binary (skeleton)
+  picloud-executor/       # cluster mode binary (skeleton)
+dashboard/                # SvelteKit
+caddy/                    # Caddyfile, Caddyfile.prod
+docker/                   # Dockerfiles
+docs/
+  git-workflow.md         # trunk-based workflow
+  architecture.md         # (TBD)
+```
+
+## Working Rules
+
+- **Honor the three-service boundary.** Don't reach across `*-core` crates. If `orchestrator-core` needs something from `manager-core`, define a trait in `shared` and inject the impl.
+- **`executor-core` has no Postgres dependency.** Data-plane services (kv, docs, users — v1.1+) come in via injected `ServiceProvider` traits.
+- **Database writes only from `manager-core`.** `orchestrator-core` reads scripts (cached); `executor-core` doesn't touch the DB.
+- **MVP builds only the `picloud` all-in-one binary.** The three split binaries exist as skeletons so the crate boundaries stay honest; flesh them out only when cluster mode is being implemented.
+- **Trunk-based dev.** See [docs/git-workflow.md](docs/git-workflow.md). No long-lived branches. Feature flags for incomplete work.
+
+## Out of MVP
+
+Queue triggers, cron triggers, SMTP ingress, KV / docs / email / users / HTTP SDKs in scripts, interceptors, workflows, function-to-function `invoke()`, auth, multi-tenancy, secrets, metrics dashboard. All deferred to v1.1+ per the blueprint. Don't pre-build for them — but don't make decisions that close the door on them either.
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..eaf60ef
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,3283 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "const-random",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89cbf775b137e9b968e67227ef7f775587cde3fd31b0d8599dbd0f598a48340"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "axum"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+dependencies = [
+ "async-trait",
+ "axum-core",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bitflags"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "const-random"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
+dependencies = [
+ "const-random-macro",
+]
+
+[[package]]
+name = "const-random-macro"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
+dependencies = [
+ "getrandom 0.2.17",
+ "once_cell",
+ "tiny-keccak",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "either"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "figment"
+version = "0.10.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cb01cd46b0cf372153850f4c6c272d9cbea2da513e07538405148f95bd789f3"
+dependencies = [
+ "atomic",
+ "pear",
+ "serde",
+ "toml",
+ "uncased",
+ "version_check",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin 0.9.8",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hashlink"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+dependencies = [
+ "hashbrown 0.15.5",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.7",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "inlinable_string"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8fae54786f62fb2918dcfae3d568594e50eb9b5c25bf04371af6fe7516452fb"
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "142bc4740e452c1e57ade0cbc129f139c9093e354346f0872ef985f4f5cf5f11"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin 0.9.8",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
+dependencies = [
+ "bitflags",
+ "libc",
+ "plain",
+ "redox_syscall 0.7.5",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mio"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "no-std-compat"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b93853da6d84c2e3c7d730d6473e8817692dd89be387eb01b94d7f108ecb5b8c"
+dependencies = [
+ "spin 0.5.2",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.6",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "pear"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdeeaa00ce488657faba8ebf44ab9361f9365a97bd39ffb8a60663f57ff4b467"
+dependencies = [
+ "inlinable_string",
+ "pear_codegen",
+ "yansi",
+]
+
+[[package]]
+name = "pear_codegen"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bab5b985dc082b345f812b7df84e1bef27e7207b39e448439ba8bd69c93f147"
+dependencies = [
+ "proc-macro2",
+ "proc-macro2-diagnostics",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "picloud"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "figment",
+ "picloud-executor-core",
+ "picloud-manager-core",
+ "picloud-orchestrator-core",
+ "picloud-shared",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "tokio",
+ "tower",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "picloud-executor"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "picloud-executor-core",
+ "picloud-shared",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "picloud-executor-core"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "picloud-shared",
+ "rhai",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "picloud-manager"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "picloud-manager-core",
+ "picloud-shared",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "picloud-manager-core"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "chrono",
+ "picloud-orchestrator-core",
+ "picloud-shared",
+ "serde",
+ "serde_json",
+ "sqlx",
+ "thiserror 1.0.69",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "picloud-orchestrator"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "picloud-orchestrator-core",
+ "picloud-shared",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "picloud-orchestrator-core"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "chrono",
+ "picloud-executor-core",
+ "picloud-shared",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "picloud-shared"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "uuid",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "proc-macro2-diagnostics"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "version_check",
+ "yansi",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.4",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4666a1a60d8412eab19d94f6d13dcc9cea0a5ef4fdf6a5db306537413c661b1b"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 1.0.7",
+]
+
+[[package]]
+name = "rhai"
+version = "1.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f9ef5dabe4c0b43d8f1187dc6beb67b53fe607fff7e30c5eb7f71b814b8c2c1"
+dependencies = [
+ "ahash",
+ "bitflags",
+ "no-std-compat",
+ "num-traits",
+ "once_cell",
+ "rhai_codegen",
+ "serde",
+ "smallvec",
+ "smartstring",
+ "thin-vec",
+ "web-time",
+]
+
+[[package]]
+name = "rhai_codegen"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4322a2a4e8cf30771dd9f27f7f37ca9ac8fe812dddd811096a98483080dabe6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustls"
+version = "0.23.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "smartstring"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fb72c633efbaa2dd666986505016c32c3044395ceaf881518399d2f4127ee29"
+dependencies = [
+ "autocfg",
+ "serde",
+ "static_assertions",
+ "version_check",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
+dependencies = [
+ "base64",
+ "bytes",
+ "chrono",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.15.5",
+ "hashlink",
+ "indexmap",
+ "log",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rustls",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "uuid",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.6",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.18",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "chrono",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.6",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.18",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
+dependencies = [
+ "atoi",
+ "chrono",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "serde_urlencoded",
+ "sqlx-core",
+ "thiserror 2.0.18",
+ "tracing",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thin-vec"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0f7e269b48f0a7dd0146680fa24b50cc67fc0373f086a5b2f99bd084639b482"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_write",
+ "winnow",
+]
+
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-serde"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "serde",
+ "serde_json",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+ "tracing-serde",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+
+[[package]]
+name = "uncased"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+dependencies = [
+ "getrandom 0.4.2",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
+]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.122"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ed04576f974d2b2fba0f38c51dbc5518011e38c36bf1143164be765528fd409"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.72"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9473dbd2991ae90b6291c3c32c30c6187ac49aa32f9905d1cce280ec1e110b0f"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.122"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "916151b09da36bd82f6615cbf3a419e2f0ba23a03c6160e8e92eb6bd4aa1dec6"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.122"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "299047362ccbfce148b67ab7e73349f77748e00c8296f9542adfad2ad82c5c5e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.122"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a929b2c61f11ba3e9bc35b50c1f25cb38e0e892c0c231ae2b8cf78d5dad4437"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621441cfc37b84979402712047321980c178f299193a3589d05b99e8763436"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.7",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yansi"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
+
+[[package]]
+name = "yoke"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..50ed9ee
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,81 @@
+[workspace]
+resolver = "2"
+members = [
+    "crates/shared",
+    "crates/executor-core",
+    "crates/orchestrator-core",
+    "crates/manager-core",
+    "crates/picloud",
+    "crates/picloud-manager",
+    "crates/picloud-orchestrator",
+    "crates/picloud-executor",
+]
+
+[workspace.package]
+edition = "2021"
+rust-version = "1.92"
+license = "MIT OR Apache-2.0"
+authors = ["PiCloud contributors"]
+repository = "https://github.com/fhamm/picloud"
+
+[workspace.dependencies]
+# Internal crates
+picloud-shared = { path = "crates/shared" }
+picloud-executor-core = { path = "crates/executor-core" }
+picloud-orchestrator-core = { path = "crates/orchestrator-core" }
+picloud-manager-core = { path = "crates/manager-core" }
+
+# Async + HTTP
+tokio = { version = "1.40", features = ["full"] }
+axum = "0.7"
+tower = "0.5"
+tower-http = { version = "0.6", features = ["trace", "cors"] }
+hyper = "1"
+
+# Serialization
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+# Errors + logging
+thiserror = "1"
+anyhow = "1"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
+
+# IDs + time
+uuid = { version = "1", features = ["v4", "serde"] }
+chrono = { version = "0.4", features = ["serde"] }
+
+# Async traits
+async-trait = "0.1"
+
+# Rhai scripting
+rhai = { version = "1.19", features = ["sync", "serde"] }
+
+# Postgres (manager-core only — others stay DB-free)
+sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "uuid", "chrono", "json", "macros", "migrate"] }
+
+# Config
+figment = { version = "0.10", features = ["toml", "env"] }
+
+# HTTP client (for RemoteExecutorClient later)
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+
+[workspace.lints.rust]
+unsafe_code = "forbid"
+
+[workspace.lints.clippy]
+all = { level = "warn", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
+module_name_repetitions = "allow"
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+doc_markdown = "allow"
+
+[profile.release]
+lto = "thin"
+codegen-units = 1
+strip = "symbols"
+
+[profile.dev]
+debug = 1
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..04efb8a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,54 @@
+# PiCloud
+
+A lightweight, self-hosted, event-driven serverless compute platform. Upload a [Rhai](https://rhai.rs/) script, get an HTTP endpoint. Designed to run on a single modest server with no idle CPU cost, and to scale out to a small cluster when you need it.
+
+> **Status:** Phase 1 — MVP scaffolding in progress.
+>
+> The authoritative design lives in [`serverless_cloud_blueprint.md`](serverless_cloud_blueprint.md).
+
+## Why
+
+Existing serverless platforms are either cloud-locked, heavyweight, or both. PiCloud aims for the opposite end of the spectrum: one binary, one database, one reverse proxy — running on hardware you already own.
+
+## Architecture (one paragraph)
+
+PiCloud splits into three logical services — **manager** (control plane: scripts, schedules, dashboard), **orchestrator** (per-node event ingress and dispatch), and **executor** (per-node Rhai sandbox) — each backed by a `*-core` Rust library. In MVP they run in a single process; in cluster mode they run as three binaries with one manager and one orchestrator + executor per node. [Caddy](https://caddyserver.com/) fronts everything; [PostgreSQL](https://www.postgresql.org/) is the single source of truth.
+
+See [`CLAUDE.md`](CLAUDE.md) for working notes and [`serverless_cloud_blueprint.md`](serverless_cloud_blueprint.md) for the full design.
+
+## Quick Start
+
+> _Coming as scaffolding lands. For now:_
+
+```sh
+# Rust toolchain (pinned via rust-toolchain.toml)
+cargo check --workspace
+
+# Run the all-in-one MVP binary (once main.rs is wired up)
+cargo run -p picloud
+```
+
+## Repository Layout
+
+```
+crates/
+  shared/                 cross-cutting types
+  executor-core/          Rhai engine + sandbox
+  orchestrator-core/      event ingress, dispatch
+  manager-core/           control plane
+  picloud/                MVP all-in-one binary
+  picloud-{manager,orchestrator,executor}/   cluster-mode binaries (skeleton)
+dashboard/                SvelteKit
+caddy/                    Caddyfile
+docker/                   Dockerfiles
+docs/
+  git-workflow.md         Trunk-based workflow
+```
+
+## Contributing
+
+See [`docs/git-workflow.md`](docs/git-workflow.md) for the branching and commit conventions. TL;DR: trunk-based, short-lived branches, Conventional Commits, no force-pushing `main`.
+
+## License
+
+TBD.
diff --git a/crates/executor-core/Cargo.toml b/crates/executor-core/Cargo.toml
new file mode 100644
index 0000000..d321bc1
--- /dev/null
+++ b/crates/executor-core/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "picloud-executor-core"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+picloud-shared.workspace = true
+
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+uuid.workspace = true
+chrono.workspace = true
+rhai.workspace = true
diff --git a/crates/executor-core/src/context.rs b/crates/executor-core/src/context.rs
new file mode 100644
index 0000000..c341d67
--- /dev/null
+++ b/crates/executor-core/src/context.rs
@@ -0,0 +1,8 @@
+//! The `ctx` object exposed to running Rhai scripts.
+//!
+//! MVP shape only: execution metadata + request data. The full SDK
+//! (kv, docs, users, http, retry, invoke) lands in v1.1+ and will be
+//! injected via a `ServiceProvider` trait rather than hardcoded here.
+
+// Implementation lands together with the Rhai engine wiring; the file
+// exists now so the module boundary is fixed in the public API.
diff --git a/crates/executor-core/src/engine.rs b/crates/executor-core/src/engine.rs
new file mode 100644
index 0000000..94eda21
--- /dev/null
+++ b/crates/executor-core/src/engine.rs
@@ -0,0 +1,48 @@
+use crate::sandbox::Limits;
+use crate::types::{ExecError, ExecRequest, ExecResponse};
+
+/// Preconfigured Rhai engine with sandbox limits applied.
+///
+/// One `Engine` is constructed at process startup and reused across
+/// invocations. `execute` is the only entry point — it owns the per-call
+/// scope and log buffer, then returns a complete `ExecResponse`.
+pub struct Engine {
+    limits: Limits,
+    // The actual `rhai::Engine` lands with the first execution implementation.
+    // Keep this opaque for now so callers don't bind to it.
+}
+
+impl Engine {
+    #[must_use]
+    pub fn new(limits: Limits) -> Self {
+        Self { limits }
+    }
+
+    #[must_use]
+    pub fn limits(&self) -> &Limits {
+        &self.limits
+    }
+
+    /// Parse-only validation, used by the manager at script-upload time
+    /// so syntax errors are surfaced before the first invocation.
+    pub fn validate(&self, _source: &str) -> Result<(), ExecError> {
+        // TODO(executor-core): wire `rhai::Engine::compile`
+        Ok(())
+    }
+
+    /// Execute `source` against `req` under the configured sandbox.
+    ///
+    /// `async` is part of the contract: v1.1+ SDK calls (kv, docs, http)
+    /// will await injected service providers from inside this method.
+    #[allow(clippy::unused_async)]
+    pub async fn execute(
+        &self,
+        _source: &str,
+        _req: ExecRequest,
+    ) -> Result<ExecResponse, ExecError> {
+        // TODO(executor-core): wire `rhai::Engine::eval_with_scope`
+        Err(ExecError::Runtime(
+            "executor-core::Engine::execute not yet implemented".into(),
+        ))
+    }
+}
diff --git a/crates/executor-core/src/lib.rs b/crates/executor-core/src/lib.rs
new file mode 100644
index 0000000..5e64a51
--- /dev/null
+++ b/crates/executor-core/src/lib.rs
@@ -0,0 +1,17 @@
+//! Rhai script execution: engine, sandbox, SDK bindings.
+//!
+//! This crate has no Postgres dependency and no awareness of HTTP. It is
+//! used both by the orchestrator (in-process, via `LocalExecutorClient`) and
+//! by the standalone executor binary (in cluster mode). Keep it that way.
+
+pub mod context;
+pub mod engine;
+pub mod logging;
+pub mod sandbox;
+pub mod types;
+
+pub use engine::Engine;
+pub use sandbox::Limits;
+pub use types::{
+    ExecError, ExecRequest, ExecResponse, ExecStats, InvocationType, LogEntry, LogLevel,
+};
diff --git a/crates/executor-core/src/logging.rs b/crates/executor-core/src/logging.rs
new file mode 100644
index 0000000..5e314fe
--- /dev/null
+++ b/crates/executor-core/src/logging.rs
@@ -0,0 +1,6 @@
+//! `log.info / warn / error / debug` bindings exposed to Rhai scripts.
+//!
+//! Captures structured log entries into a per-execution buffer that is
+//! attached to the `ExecResponse` and persisted by the manager.
+
+// Implementation lands with the engine wiring.
diff --git a/crates/executor-core/src/sandbox.rs b/crates/executor-core/src/sandbox.rs
new file mode 100644
index 0000000..40eedef
--- /dev/null
+++ b/crates/executor-core/src/sandbox.rs
@@ -0,0 +1,37 @@
+/// Resource and capability limits applied to every script execution.
+///
+/// Defaults are conservative and safe to expose to untrusted Rhai sources.
+/// Per-script overrides (e.g. higher operation budgets) come from the
+/// `Script` config and are clamped against these as upper bounds.
+#[derive(Debug, Clone, Copy)]
+pub struct Limits {
+    /// Hard cap on Rhai operations executed per invocation.
+    /// Doubles as a CPU-time proxy without needing real timers.
+    pub max_operations: u64,
+
+    /// Max length of any single string the script constructs.
+    pub max_string_size: usize,
+
+    /// Max number of elements in any array.
+    pub max_array_size: usize,
+
+    /// Max number of properties in any object/map.
+    pub max_map_size: usize,
+
+    /// Max call/expression nesting depth.
+    pub max_call_levels: usize,
+    pub max_expr_depth: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self {
+            max_operations: 1_000_000,
+            max_string_size: 64 * 1024,
+            max_array_size: 10_000,
+            max_map_size: 10_000,
+            max_call_levels: 64,
+            max_expr_depth: 64,
+        }
+    }
+}
diff --git a/crates/executor-core/src/types.rs b/crates/executor-core/src/types.rs
new file mode 100644
index 0000000..1524843
--- /dev/null
+++ b/crates/executor-core/src/types.rs
@@ -0,0 +1,80 @@
+use std::collections::BTreeMap;
+
+use chrono::{DateTime, Utc};
+use picloud_shared::{ExecutionId, RequestId, ScriptId};
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum InvocationType {
+    Http,
+    Function,
+    Scheduled,
+}
+
+/// Everything the executor needs to run one invocation.
+///
+/// This type crosses process boundaries in cluster mode — keep it fully
+/// serializable and don't add transient handles (DB pools, etc.).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ExecRequest {
+    pub execution_id: ExecutionId,
+    pub request_id: RequestId,
+    pub script_id: ScriptId,
+    pub script_name: String,
+    pub invocation_type: InvocationType,
+    pub path: String,
+    pub headers: BTreeMap<String, String>,
+    pub body: serde_json::Value,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ExecResponse {
+    pub status_code: u16,
+    pub headers: BTreeMap<String, String>,
+    pub body: serde_json::Value,
+    pub logs: Vec<LogEntry>,
+    pub stats: ExecStats,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum LogLevel {
+    Debug,
+    Info,
+    Warn,
+    Error,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct LogEntry {
+    pub timestamp: DateTime<Utc>,
+    pub level: LogLevel,
+    pub message: String,
+    pub data: Option<serde_json::Value>,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, Default)]
+pub struct ExecStats {
+    pub duration_ms: u64,
+    pub operations: u64,
+}
+
+#[derive(Debug, Error)]
+pub enum ExecError {
+    #[error("script failed to parse: {0}")]
+    Parse(String),
+
+    #[error("script returned an invalid response shape: {0}")]
+    InvalidResponse(String),
+
+    #[error("execution timed out after {0}s")]
+    Timeout(u32),
+
+    #[error("execution exceeded operation budget")]
+    OperationBudgetExceeded,
+
+    #[error("script runtime error: {0}")]
+    Runtime(String),
+}
diff --git a/crates/manager-core/Cargo.toml b/crates/manager-core/Cargo.toml
new file mode 100644
index 0000000..16d2026
--- /dev/null
+++ b/crates/manager-core/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "picloud-manager-core"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+picloud-shared.workspace = true
+picloud-orchestrator-core.workspace = true
+
+async-trait.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+uuid.workspace = true
+chrono.workspace = true
+sqlx.workspace = true
diff --git a/crates/manager-core/src/lib.rs b/crates/manager-core/src/lib.rs
new file mode 100644
index 0000000..4620248
--- /dev/null
+++ b/crates/manager-core/src/lib.rs
@@ -0,0 +1,10 @@
+//! Control plane: script storage, scheduling, configuration.
+//!
+//! Single-writer to Postgres. The orchestrator may *read* scripts from
+//! the same DB for now; once we add caching and per-node ingress, the
+//! manager will publish change events.
+
+pub mod repo;
+pub mod scheduler;
+
+pub use repo::{PostgresScriptRepository, ScriptRepository, ScriptRepositoryError};
diff --git a/crates/manager-core/src/repo.rs b/crates/manager-core/src/repo.rs
new file mode 100644
index 0000000..443e445
--- /dev/null
+++ b/crates/manager-core/src/repo.rs
@@ -0,0 +1,83 @@
+use async_trait::async_trait;
+use picloud_orchestrator_core::{ResolverError, ScriptResolver};
+use picloud_shared::{Script, ScriptId};
+use sqlx::PgPool;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ScriptRepositoryError {
+    #[error("database error: {0}")]
+    Db(#[from] sqlx::Error),
+
+    #[error("not found: {0}")]
+    NotFound(ScriptId),
+}
+
+/// CRUD over the `scripts` table.
+#[async_trait]
+pub trait ScriptRepository: Send + Sync {
+    async fn get(&self, id: ScriptId) -> Result<Option<Script>, ScriptRepositoryError>;
+    async fn list(&self) -> Result<Vec<Script>, ScriptRepositoryError>;
+    async fn create(&self, script: &Script) -> Result<(), ScriptRepositoryError>;
+    async fn update(&self, script: &Script) -> Result<(), ScriptRepositoryError>;
+    async fn delete(&self, id: ScriptId) -> Result<(), ScriptRepositoryError>;
+}
+
+pub struct PostgresScriptRepository {
+    pool: PgPool,
+}
+
+impl PostgresScriptRepository {
+    #[must_use]
+    pub fn new(pool: PgPool) -> Self {
+        Self { pool }
+    }
+}
+
+// Real query bodies land alongside the first migration. Stubbing the trait
+// impl so the workspace compiles and the seam is visible.
+#[async_trait]
+impl ScriptRepository for PostgresScriptRepository {
+    async fn get(&self, _id: ScriptId) -> Result<Option<Script>, ScriptRepositoryError> {
+        let _ = &self.pool;
+        Ok(None)
+    }
+
+    async fn list(&self) -> Result<Vec<Script>, ScriptRepositoryError> {
+        Ok(Vec::new())
+    }
+
+    async fn create(&self, _script: &Script) -> Result<(), ScriptRepositoryError> {
+        Ok(())
+    }
+
+    async fn update(&self, _script: &Script) -> Result<(), ScriptRepositoryError> {
+        Ok(())
+    }
+
+    async fn delete(&self, _id: ScriptId) -> Result<(), ScriptRepositoryError> {
+        Ok(())
+    }
+}
+
+/// Adapts a `ScriptRepository` into the `ScriptResolver` trait the
+/// orchestrator depends on, so we don't pull the manager into the
+/// orchestrator's dependency graph.
+pub struct RepoResolver<R: ScriptRepository> {
+    repo: R,
+}
+
+impl<R: ScriptRepository> RepoResolver<R> {
+    pub fn new(repo: R) -> Self {
+        Self { repo }
+    }
+}
+
+#[async_trait]
+impl<R: ScriptRepository> ScriptResolver for RepoResolver<R> {
+    async fn resolve(&self, id: ScriptId) -> Result<Option<Script>, ResolverError> {
+        self.repo
+            .get(id)
+            .await
+            .map_err(|e| ResolverError::Backend(e.to_string()))
+    }
+}
diff --git a/crates/manager-core/src/scheduler.rs b/crates/manager-core/src/scheduler.rs
new file mode 100644
index 0000000..654237d
--- /dev/null
+++ b/crates/manager-core/src/scheduler.rs
@@ -0,0 +1,6 @@
+//! Cron / scheduled task dispatcher.
+//!
+//! Postgres `SELECT ... FOR UPDATE SKIP LOCKED` over a `schedules` table
+//! gives us strict singleton execution without external coordination.
+//!
+//! Skeleton only — wired up in v1.1+ when cron triggers ship.
diff --git a/crates/orchestrator-core/Cargo.toml b/crates/orchestrator-core/Cargo.toml
new file mode 100644
index 0000000..e4245f6
--- /dev/null
+++ b/crates/orchestrator-core/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "picloud-orchestrator-core"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+picloud-shared.workspace = true
+picloud-executor-core.workspace = true
+
+async-trait.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+uuid.workspace = true
+chrono.workspace = true
+reqwest.workspace = true
diff --git a/crates/orchestrator-core/src/client.rs b/crates/orchestrator-core/src/client.rs
new file mode 100644
index 0000000..b819239
--- /dev/null
+++ b/crates/orchestrator-core/src/client.rs
@@ -0,0 +1,61 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use picloud_executor_core::{Engine, ExecError, ExecRequest, ExecResponse};
+
+/// The seam between the orchestrator and the executor.
+///
+/// Single-node mode plugs in `LocalExecutorClient`, which calls
+/// `executor-core` in-process. Cluster mode plugs in `RemoteExecutorClient`,
+/// which forwards over HTTP to an executor node. Everything else in
+/// orchestrator-core depends only on this trait.
+#[async_trait]
+pub trait ExecutorClient: Send + Sync {
+    async fn execute(&self, source: &str, req: ExecRequest) -> Result<ExecResponse, ExecError>;
+}
+
+/// In-process executor — wraps `executor-core::Engine` directly.
+pub struct LocalExecutorClient {
+    engine: Arc<Engine>,
+}
+
+impl LocalExecutorClient {
+    #[must_use]
+    pub fn new(engine: Arc<Engine>) -> Self {
+        Self { engine }
+    }
+}
+
+#[async_trait]
+impl ExecutorClient for LocalExecutorClient {
+    async fn execute(&self, source: &str, req: ExecRequest) -> Result<ExecResponse, ExecError> {
+        self.engine.execute(source, req).await
+    }
+}
+
+/// Remote executor — forwards to a peer executor node over HTTP.
+///
+/// Skeleton only; fleshed out when cluster mode lands.
+pub struct RemoteExecutorClient {
+    _client: reqwest::Client,
+    _base_url: String,
+}
+
+impl RemoteExecutorClient {
+    #[must_use]
+    pub fn new(base_url: impl Into<String>) -> Self {
+        Self {
+            _client: reqwest::Client::new(),
+            _base_url: base_url.into(),
+        }
+    }
+}
+
+#[async_trait]
+impl ExecutorClient for RemoteExecutorClient {
+    async fn execute(&self, _source: &str, _req: ExecRequest) -> Result<ExecResponse, ExecError> {
+        Err(ExecError::Runtime(
+            "RemoteExecutorClient not implemented (cluster mode is v1.3+)".into(),
+        ))
+    }
+}
diff --git a/crates/orchestrator-core/src/lib.rs b/crates/orchestrator-core/src/lib.rs
new file mode 100644
index 0000000..ec52abb
--- /dev/null
+++ b/crates/orchestrator-core/src/lib.rs
@@ -0,0 +1,15 @@
+//! Per-node event ingress and dispatch.
+//!
+//! Owns the data-plane request path:
+//!   inbound event → resolve script → call `ExecutorClient::execute`
+//!
+//! Does not import `executor-core` types in its public surface beyond the
+//! transport DTOs (`ExecRequest`/`ExecResponse`). The `ExecutorClient`
+//! trait is the seam that lets the orchestrator call executor logic
+//! in-process (single-node) or over HTTP (cluster).
+
+pub mod client;
+pub mod resolver;
+
+pub use client::{ExecutorClient, LocalExecutorClient, RemoteExecutorClient};
+pub use resolver::{ResolverError, ScriptResolver};
diff --git a/crates/orchestrator-core/src/resolver.rs b/crates/orchestrator-core/src/resolver.rs
new file mode 100644
index 0000000..29726a0
--- /dev/null
+++ b/crates/orchestrator-core/src/resolver.rs
@@ -0,0 +1,17 @@
+use async_trait::async_trait;
+use picloud_shared::{Script, ScriptId};
+
+/// How the orchestrator looks up a script before dispatching to the
+/// executor. In MVP this is backed by a direct Postgres read inside the
+/// manager-core repository, exposed through this trait so orchestrator-core
+/// stays DB-agnostic.
+#[async_trait]
+pub trait ScriptResolver: Send + Sync {
+    async fn resolve(&self, id: ScriptId) -> Result<Option<Script>, ResolverError>;
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ResolverError {
+    #[error("backend error: {0}")]
+    Backend(String),
+}
diff --git a/crates/picloud-executor/Cargo.toml b/crates/picloud-executor/Cargo.toml
new file mode 100644
index 0000000..14b3f4d
--- /dev/null
+++ b/crates/picloud-executor/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "picloud-executor"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[[bin]]
+name = "picloud-executor"
+path = "src/main.rs"
+
+[dependencies]
+picloud-shared.workspace = true
+picloud-executor-core.workspace = true
+
+tokio.workspace = true
+anyhow.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
diff --git a/crates/picloud-executor/src/main.rs b/crates/picloud-executor/src/main.rs
new file mode 100644
index 0000000..85707fb
--- /dev/null
+++ b/crates/picloud-executor/src/main.rs
@@ -0,0 +1,10 @@
+//! Standalone executor binary for cluster mode. Skeleton — fleshed out
+//! when cluster mode lands (v1.3+). For MVP use the `picloud` binary.
+
+fn main() {
+    eprintln!(
+        "picloud-executor: cluster mode is not implemented yet (v1.3+).\n\
+         Use the `picloud` all-in-one binary for MVP."
+    );
+    std::process::exit(2);
+}
diff --git a/crates/picloud-manager/Cargo.toml b/crates/picloud-manager/Cargo.toml
new file mode 100644
index 0000000..ddc6bce
--- /dev/null
+++ b/crates/picloud-manager/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "picloud-manager"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[[bin]]
+name = "picloud-manager"
+path = "src/main.rs"
+
+[dependencies]
+picloud-shared.workspace = true
+picloud-manager-core.workspace = true
+
+tokio.workspace = true
+anyhow.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
diff --git a/crates/picloud-manager/src/main.rs b/crates/picloud-manager/src/main.rs
new file mode 100644
index 0000000..28d9533
--- /dev/null
+++ b/crates/picloud-manager/src/main.rs
@@ -0,0 +1,10 @@
+//! Standalone manager binary for cluster mode. Skeleton — fleshed out
+//! when cluster mode lands (v1.3+). For MVP use the `picloud` binary.
+
+fn main() {
+    eprintln!(
+        "picloud-manager: cluster mode is not implemented yet (v1.3+).\n\
+         Use the `picloud` all-in-one binary for MVP."
+    );
+    std::process::exit(2);
+}
diff --git a/crates/picloud-orchestrator/Cargo.toml b/crates/picloud-orchestrator/Cargo.toml
new file mode 100644
index 0000000..361c207
--- /dev/null
+++ b/crates/picloud-orchestrator/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "picloud-orchestrator"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[[bin]]
+name = "picloud-orchestrator"
+path = "src/main.rs"
+
+[dependencies]
+picloud-shared.workspace = true
+picloud-orchestrator-core.workspace = true
+
+tokio.workspace = true
+anyhow.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
diff --git a/crates/picloud-orchestrator/src/main.rs b/crates/picloud-orchestrator/src/main.rs
new file mode 100644
index 0000000..87c3b44
--- /dev/null
+++ b/crates/picloud-orchestrator/src/main.rs
@@ -0,0 +1,10 @@
+//! Standalone orchestrator binary for cluster mode. Skeleton — fleshed
+//! out when cluster mode lands (v1.3+). For MVP use the `picloud` binary.
+
+fn main() {
+    eprintln!(
+        "picloud-orchestrator: cluster mode is not implemented yet (v1.3+).\n\
+         Use the `picloud` all-in-one binary for MVP."
+    );
+    std::process::exit(2);
+}
diff --git a/crates/picloud/Cargo.toml b/crates/picloud/Cargo.toml
new file mode 100644
index 0000000..9270de8
--- /dev/null
+++ b/crates/picloud/Cargo.toml
@@ -0,0 +1,31 @@
+[package]
+name = "picloud"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[[bin]]
+name = "picloud"
+path = "src/main.rs"
+
+[dependencies]
+picloud-shared.workspace = true
+picloud-executor-core.workspace = true
+picloud-orchestrator-core.workspace = true
+picloud-manager-core.workspace = true
+
+tokio.workspace = true
+axum.workspace = true
+tower.workspace = true
+tower-http.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+anyhow.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+figment.workspace = true
diff --git a/crates/picloud/src/main.rs b/crates/picloud/src/main.rs
new file mode 100644
index 0000000..7f93da9
--- /dev/null
+++ b/crates/picloud/src/main.rs
@@ -0,0 +1,39 @@
+//! PiCloud all-in-one binary — runs manager + orchestrator + executor in
+//! one process. This is the only binary built for MVP. The split binaries
+//! (`picloud-manager`, `picloud-orchestrator`, `picloud-executor`) exist
+//! to enforce the crate boundaries and will be fleshed out in v1.3+
+//! when cluster mode is built.
+
+use axum::{routing::get, Router};
+use std::net::SocketAddr;
+use tracing_subscriber::EnvFilter;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()))
+        .json()
+        .init();
+
+    let app = Router::new()
+        .route("/healthz", get(healthz))
+        .route("/", get(root));
+
+    let addr: SocketAddr = std::env::var("PICLOUD_BIND")
+        .unwrap_or_else(|_| "0.0.0.0:8080".into())
+        .parse()?;
+
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    tracing::info!(%addr, "picloud all-in-one listening");
+    axum::serve(listener, app).await?;
+
+    Ok(())
+}
+
+async fn healthz() -> &'static str {
+    "ok"
+}
+
+async fn root() -> &'static str {
+    "picloud — see /api/admin/* (manager) and /api/execute/* (orchestrator)"
+}
diff --git a/crates/shared/Cargo.toml b/crates/shared/Cargo.toml
new file mode 100644
index 0000000..5f3fa3f
--- /dev/null
+++ b/crates/shared/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "picloud-shared"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+uuid.workspace = true
+chrono.workspace = true
diff --git a/crates/shared/src/error.rs b/crates/shared/src/error.rs
new file mode 100644
index 0000000..9c6a699
--- /dev/null
+++ b/crates/shared/src/error.rs
@@ -0,0 +1,14 @@
+use thiserror::Error;
+
+/// Root error type for things that genuinely cross crate boundaries.
+///
+/// Crate-specific errors (e.g. `executor_core::ExecError`) stay local. Only
+/// promote a variant to `Error` when more than one crate needs to match on it.
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("script not found: {0}")]
+    ScriptNotFound(crate::ScriptId),
+
+    #[error("invalid script source: {0}")]
+    InvalidScript(String),
+}
diff --git a/crates/shared/src/ids.rs b/crates/shared/src/ids.rs
new file mode 100644
index 0000000..b75f98b
--- /dev/null
+++ b/crates/shared/src/ids.rs
@@ -0,0 +1,52 @@
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+macro_rules! id_type {
+    ($name:ident) => {
+        #[derive(
+            Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize,
+        )]
+        #[serde(transparent)]
+        pub struct $name(pub Uuid);
+
+        impl $name {
+            #[must_use]
+            pub fn new() -> Self {
+                Self(Uuid::new_v4())
+            }
+
+            #[must_use]
+            pub fn into_inner(self) -> Uuid {
+                self.0
+            }
+        }
+
+        impl Default for $name {
+            fn default() -> Self {
+                Self::new()
+            }
+        }
+
+        impl From<Uuid> for $name {
+            fn from(u: Uuid) -> Self {
+                Self(u)
+            }
+        }
+
+        impl From<$name> for Uuid {
+            fn from(id: $name) -> Self {
+                id.0
+            }
+        }
+
+        impl std::fmt::Display for $name {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                self.0.fmt(f)
+            }
+        }
+    };
+}
+
+id_type!(ScriptId);
+id_type!(ExecutionId);
+id_type!(RequestId);
diff --git a/crates/shared/src/lib.rs b/crates/shared/src/lib.rs
new file mode 100644
index 0000000..f62692c
--- /dev/null
+++ b/crates/shared/src/lib.rs
@@ -0,0 +1,13 @@
+//! Cross-cutting types used by every PiCloud crate.
+//!
+//! Keep this crate small. If something only one core needs, it belongs in
+//! that core's crate. Things here must be genuinely shared (IDs, the Script
+//! entity, error roots, transport DTOs).
+
+pub mod error;
+pub mod ids;
+pub mod script;
+
+pub use error::Error;
+pub use ids::{ExecutionId, RequestId, ScriptId};
+pub use script::Script;
diff --git a/crates/shared/src/script.rs b/crates/shared/src/script.rs
new file mode 100644
index 0000000..d075f21
--- /dev/null
+++ b/crates/shared/src/script.rs
@@ -0,0 +1,24 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use crate::ScriptId;
+
+/// A user-uploaded Rhai script and its execution configuration.
+///
+/// This is the canonical representation that flows between manager (storage),
+/// orchestrator (dispatch), and executor (run). It must stay serializable
+/// because in cluster mode it crosses process boundaries on every invocation.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Script {
+    pub id: ScriptId,
+    pub name: String,
+    pub description: Option<String>,
+    pub version: i32,
+    pub source: String,
+
+    pub timeout_seconds: u32,
+    pub memory_limit_mb: u32,
+
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}
diff --git a/docs/git-workflow.md b/docs/git-workflow.md
new file mode 100644
index 0000000..b724b35
--- /dev/null
+++ b/docs/git-workflow.md
@@ -0,0 +1,202 @@
+# Git Workflow
+
+PiCloud uses **trunk-based development**: a single long-lived branch (`main`) that is always deployable, with short-lived branches for changes that need review.
+
+This document defines how branches, commits, reviews, and releases work — and how bug fixes flow through the system.
+
+---
+
+## 1. Branches
+
+| Branch | Purpose | Lifetime |
+|--------|---------|----------|
+| `main` | The trunk. Always green, always deployable. | Permanent |
+| `feat/<topic>` | New feature or non-trivial change. | ≤ 2 days |
+| `fix/<topic>` | Bug fix (non-critical). | ≤ 1 day |
+| `hotfix/<topic>` | Critical bug fix that needs to ship now. | Hours |
+| `chore/<topic>` | Refactor, deps update, CI tweak, docs. | ≤ 1 day |
+| `release/vX.Y` | Long-lived release branch for back-porting hotfixes to a shipped version. | Per minor version, once we tag releases |
+
+**Rules:**
+
+- Branch directly off `main`. Never branch off another feature branch.
+- Keep branches short. If a branch lives longer than 2 days, you're doing too much in one go — split it.
+- Branch names use `kebab-case` after the prefix: `feat/script-crud-endpoints`, `fix/executor-timeout-leak`.
+- Delete the branch after merge.
+
+---
+
+## 2. Commits
+
+**Format: Conventional Commits.**
+
+```
+<type>(<scope>): <subject>
+
+<body — optional, wrapped at 72 chars>
+
+<footer — optional: BREAKING CHANGE, issue refs>
+```
+
+**Types:** `feat`, `fix`, `chore`, `refactor`, `docs`, `test`, `perf`, `build`, `ci`.
+
+**Scopes (current crates / areas):** `executor-core`, `orchestrator-core`, `manager-core`, `shared`, `picloud`, `dashboard`, `caddy`, `compose`, `ci`, `docs`.
+
+**Examples:**
+
+```
+feat(executor-core): add operation budget enforcement
+
+fix(orchestrator-core): release Postgres pool guard before dispatch
+
+chore(ci): pin Rust toolchain to 1.92.0
+```
+
+**Rules:**
+
+- One logical change per commit. If you can't describe it in one line, split it.
+- Subject line: imperative, ≤ 72 chars, no trailing period.
+- Body explains *why*, not *what* — the diff already shows what.
+- No `WIP`, `fixup`, or `oops` commits on `main`. Squash or rewrite before merging.
+
+---
+
+## 3. The Feature Loop
+
+```
+                 ┌─────────────────────┐
+                 │ Pull latest main    │
+                 └──────────┬──────────┘
+                            │
+                 ┌──────────▼──────────┐
+                 │ Branch: feat/<name> │
+                 └──────────┬──────────┘
+                            │
+                 ┌──────────▼──────────┐
+                 │ Commit small steps  │◄────┐
+                 │ Run tests locally   │     │
+                 └──────────┬──────────┘     │
+                            │                │
+                 ┌──────────▼──────────┐     │
+                 │ Open PR to main     │─────┘  (iterate on feedback)
+                 │ CI must be green    │
+                 └──────────┬──────────┘
+                            │
+                 ┌──────────▼──────────┐
+                 │ Squash-merge to main│
+                 │ Delete branch       │
+                 └─────────────────────┘
+```
+
+**Before opening a PR:**
+
+```sh
+git fetch origin
+git rebase origin/main        # keep history linear
+cargo fmt --all -- --check
+cargo clippy --all-targets --all-features -- -D warnings
+cargo test --workspace
+```
+
+**PR requirements:**
+
+- CI green (fmt, clippy, tests, build).
+- At least one approving review for non-trivial changes. Solo dev exception: self-review the diff explicitly before merging.
+- PR description names *why* and links to any issue.
+- Squash-merge by default → one commit per PR on `main`.
+
+---
+
+## 4. Bug-fix Workflow
+
+Bugs are classified by severity:
+
+### Non-critical bug — normal flow
+
+1. Branch `fix/<topic>` from `main`.
+2. Write a failing test that reproduces the bug.
+3. Fix it. The test now passes.
+4. PR → review → squash-merge.
+
+### Critical / production hotfix
+
+```
+                 ┌──────────────────┐
+                 │ Bug reported     │
+                 └────────┬─────────┘
+                          │
+              ┌───────────▼───────────┐
+              │ Reproduce locally     │  ← required before any fix
+              │ Write failing test    │
+              └───────────┬───────────┘
+                          │
+              ┌───────────▼───────────┐
+              │ Branch hotfix/<name>  │
+              │ from main             │
+              └───────────┬───────────┘
+                          │
+              ┌───────────▼───────────┐
+              │ Minimal fix only      │  ← no refactors, no unrelated changes
+              │ Test passes           │
+              └───────────┬───────────┘
+                          │
+              ┌───────────▼───────────┐
+              │ Fast-track review     │
+              │ Merge to main         │
+              └───────────┬───────────┘
+                          │
+              ┌───────────▼───────────┐
+              │ Tag patch release     │  (vX.Y.Z+1)
+              │ Deploy                │
+              └───────────┬───────────┘
+                          │
+              ┌───────────▼───────────┐
+              │ Cherry-pick to        │  ← only if old releases are
+              │ release/vX.Y if active│    still in use
+              └───────────────────────┘
+```
+
+**Critical hotfix rules:**
+
+- A hotfix fixes one bug. Nothing else. No "while I'm here" cleanups.
+- The reproduction test stays in the suite forever — it's our guarantee the bug doesn't return.
+- If the fix can't be minimal (e.g. requires an architectural change), ship a *mitigation* as the hotfix (feature flag off, rate limit, revert), then schedule the real fix as a normal feature.
+
+---
+
+## 5. Keeping `main` Green
+
+Trunk-based only works if `main` is always green. Mechanisms:
+
+- **CI gate:** PRs cannot merge unless CI passes (`fmt`, `clippy -D warnings`, `cargo test --workspace`, dashboard build).
+- **Feature flags:** Code for incomplete features lives on `main` behind a flag, off by default. We finish features in small mergeable slices, not in long-lived branches.
+- **Reverts are cheap:** If something slips through and breaks `main`, revert first, debug after. `git revert <merge-sha>` and ship.
+- **No force-push to `main`.** Ever.
+
+---
+
+## 6. Releases
+
+Until we ship publicly we deploy off `main` continuously. Once we have external users:
+
+- Tag releases on `main`: `v0.1.0`, `v0.1.1`, `v0.2.0` (SemVer).
+- Patch releases (`v0.1.1`) come from hotfixes; bump the patch number on each fix.
+- Minor releases (`v0.2.0`) come from accumulated features on `main`.
+- For each minor version supported in the wild, create `release/v0.1` and cherry-pick patches there. Otherwise don't bother — single trunk is simpler.
+
+**Tagging:**
+
+```sh
+git tag -a v0.1.0 -m "v0.1.0 — MVP"
+git push origin v0.1.0
+```
+
+---
+
+## 7. What We Do Not Do
+
+- **No GitFlow.** No `develop`, no `release` branches by default, no `next`. They add merge overhead without buying anything at our scale.
+- **No long-lived feature branches.** If a feature is too big to land in 2 days, split it. Use a feature flag.
+- **No merge commits on `main` from feature branches.** Squash-merge keeps history linear and bisectable.
+- **No commits straight to `main`** — even for typo fixes. Go through a PR (it can take 30 seconds to review and merge).
+- **No `--no-verify`** to bypass hooks. If a hook fails, fix the underlying issue.
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..1a21655
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.92.0"
+components = ["rustfmt", "clippy"]
diff --git a/serverless_cloud_blueprint.md b/serverless_cloud_blueprint.md
new file mode 100644
index 0000000..1c53d14
--- /dev/null
+++ b/serverless_cloud_blueprint.md
@@ -0,0 +1,1345 @@
+# Project Blueprint: Lightweight Event-Based Serverless Cloud
+
+**Status**: Phase 4 — Blueprint Complete  
+**Last Updated**: 2026-04-10  
+**Audience**: Solo developer (DIY self-hosted)
+
+---
+
+## 1. Project Overview
+
+### Vision
+A lightweight, self-hosted, event-driven compute platform that allows developers to deploy and trigger Rhai scripts via HTTP endpoints. Scripts run in isolated containers, scale to zero when idle, and return structured responses. Optimized for resource efficiency on consumer hardware (< 100 functions).
+
+### Core Value Proposition
+- **Simple deployment**: Upload a Rhai script, get an HTTP endpoint
+- **Minimal overhead**: Containers spawn on-demand, no persistent services running
+- **DIY-friendly**: Run on modest hardware (single server, RPi-adjacent)
+- **Extensible**: Pluggable storage, compute, and messaging later
+
+### MVP Scope
+**In Scope:**
+- Dashboard: script upload + metadata (name, description, version, config)
+- REST API: script CRUD operations
+- HTTP-triggered script execution
+- Request → Rhai script → JSON response
+- PostgreSQL for script storage
+- Docker for isolated execution
+- Execution logs and basic observability
+
+**Out of Scope (v1.1+):**
+- Queue-based triggers
+- Scheduled jobs (cron)
+- Multi-user/projects
+- External HTTP calls from scripts
+- Metrics dashboards
+- Secrets management
+- Script versioning/rollback
+
+### Success Criteria
+1. Deploy a Rhai script in < 1 minute
+2. Script responds to HTTP requests within 500ms (p95)
+3. Runs on single modest server (2GB RAM, dual-core CPU)
+4. No background services consume CPU when idle
+
+---
+
+## 2. Architecture Overview
+
+### High-Level System Diagram
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                         Self-Hosted Server                       │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                   │
+│  ┌──────────────────────┐         ┌──────────────────────┐      │
+│  │   Web Dashboard      │         │  Orchestrator API    │      │
+│  │   (Alpine.js SPA)    │         │  (Rust + Axum)       │      │
+│  │   Port 3000          │         │  Port 8080           │      │
+│  └──────┬───────────────┘         └──────────┬───────────┘      │
+│         │                                    │                   │
+│         │ Upload script                      │ HTTP requests     │
+│         │ Manage scripts                     │ Script metadata   │
+│         │                                    │                   │
+│         └────────────────┬────────────────────┘                  │
+│                          │                                       │
+│                  ┌───────▼────────┐                             │
+│                  │  PostgreSQL    │                             │
+│                  │  (scripts, MD)  │                             │
+│                  └────────────────┘                             │
+│                          │                                       │
+│         ┌────────────────┼────────────────┐                     │
+│         │                │                │                     │
+│    ┌────▼────┐      ┌────▼────┐     ┌────▼────┐                │
+│    │Container │      │Container │     │Container │              │
+│    │ Instance │      │ Instance │     │ Instance │ (on-demand)  │
+│    │(Rhai Ex.)│      │(Rhai Ex.)│     │(Rhai Ex.)│              │
+│    └──────────┘      └──────────┘     └──────────┘              │
+│         │                 │                │                    │
+│         └─────────────────┼────────────────┘                    │
+│                           │                                     │
+│                  ┌────────▼────────┐                            │
+│                  │ Docker Daemon   │                            │
+│                  │ (container mgmt) │                            │
+│                  └─────────────────┘                            │
+│                                                                   │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+### Data Flow: HTTP Request → Response
+
+1. **HTTP Request** arrives at Orchestrator (`POST /api/execute/{script_id}`)
+2. **Orchestrator** fetches script from PostgreSQL
+3. **Docker daemon** spawns container from pre-built executor image
+4. **Container startup** loads script into Rhai runtime + passes request context
+5. **Rhai script** executes, processes request, returns JSON object
+6. **Orchestrator** extracts `statusCode`, `headers`, `body` from response
+7. **HTTP Response** sent to client
+8. **Container** is destroyed (scale to zero)
+
+---
+
+## 3. Core Components
+
+### 3.1 Orchestrator Service
+**Language**: Rust  
+**Framework**: Axum  
+**Port**: 8080 (default)
+
+**Responsibilities:**
+- HTTP server (REST API for script management + trigger)
+- Script lifecycle: fetch, validate, store
+- Container orchestration: spawn, monitor, cleanup
+- Request/response marshalling
+- Error handling & logging
+
+**Key Endpoints (MVP):**
+- `POST /api/scripts` — upload script
+- `GET /api/scripts` — list all scripts
+- `DELETE /api/scripts/{id}` — delete script
+- `POST /api/execute/{script_id}` — trigger script execution (with request body/headers)
+
+**Internal Tasks:**
+- Periodically clean up orphaned containers (optional, for MVP just GC on startup)
+- Log execution events to stdout/logs
+
+---
+
+### 3.2 Executor Container Image
+**Base**: `alpine:latest`  
+**Contents**:
+- Rhai runtime (compiled binary or via package manager)
+- Minimal libc (musl on Alpine)
+- Script loader + executor wrapper
+- Logging utilities
+
+**Startup Flow:**
+```bash
+# Pseudo-code
+SCRIPT_CONTENT=$(passed via env var or stdin)
+SCRIPT_PATH=/tmp/script.rhai
+echo "$SCRIPT_CONTENT" > $SCRIPT_PATH
+
+REQUEST_JSON=$(read from stdin or env)
+rhai_executor --script $SCRIPT_PATH --request "$REQUEST_JSON"
+```
+
+**Output**: JSON response to stdout, captured by Orchestrator
+
+---
+
+### 3.3 Dashboard (Web UI)
+**Framework**: Alpine.js (MVP), Svelte (v1.0+)  
+**Port**: 3000 (default)
+
+**Features (MVP):**
+- Script upload form (file picker or textarea)
+- Script metadata input (name, description, version, config)
+- Config fields: timeout (s), memory limit (MB), enabled service access (DB/S3/queue/functions)
+- List of deployed scripts
+- Simple "Deploy" / "Delete" actions
+
+**Technology Stack:**
+- HTML + CSS + Alpine.js
+- Fetch API to call Orchestrator
+- No build step (initially), just serve static files
+
+---
+
+### 3.4 PostgreSQL Database
+**Schema (MVP):**
+
+```sql
+CREATE TABLE scripts (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL,
+  description TEXT,
+  version INT DEFAULT 1,
+  script_content TEXT NOT NULL,
+  
+  -- Config
+  timeout_seconds INT DEFAULT 30,
+  memory_limit_mb INT DEFAULT 256,
+  
+  -- Service access (MVP: unused, future)
+  access_db BOOLEAN DEFAULT false,
+  access_s3 BOOLEAN DEFAULT false,
+  access_queue BOOLEAN DEFAULT false,
+  access_functions BOOLEAN DEFAULT false,
+  
+  -- Metadata
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW(),
+  
+  -- Execution tracking (MVP: optional)
+  last_executed_at TIMESTAMP,
+  execution_count INT DEFAULT 0
+);
+
+CREATE TABLE execution_logs (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  script_id UUID REFERENCES scripts(id) ON DELETE CASCADE,
+  request_path TEXT,
+  request_headers JSONB,
+  request_body JSONB,
+  response_code INT,
+  response_body JSONB,
+  logs TEXT,
+  duration_ms INT,
+  status TEXT, -- 'success', 'timeout', 'error', etc.
+  created_at TIMESTAMP DEFAULT NOW()
+);
+```
+
+**Rationale:**
+- Simple, relational structure
+- `execution_logs` for audit trail + debugging (can be pruned later)
+- JSONB for flexible config/response storage
+
+---
+
+## 4. Data Model
+
+### Script Entity
+```json
+{
+  "id": "uuid",
+  "name": "Process Payment",
+  "description": "Webhook handler for payment processor",
+  "version": 1,
+  "script_content": "let req = request();\nlet amt = req.body.amount;\n{ statusCode: 200, body: { processed: amt } }",
+  "timeout_seconds": 30,
+  "memory_limit_mb": 256,
+  "access_db": false,
+  "access_s3": false,
+  "access_queue": false,
+  "access_functions": false,
+  "interceptors": {
+    "s3": { "before_write": false },
+    "documents": { "before_create": false },
+    "queue": { "before_send": false }
+  },
+  "created_at": "2026-04-10T12:00:00Z",
+  "updated_at": "2026-04-10T12:00:00Z",
+  "last_executed_at": "2026-04-10T12:05:00Z",
+  "execution_count": 42
+}
+```
+
+### Execution Log Entity
+```json
+{
+  "id": "uuid",
+  "script_id": "uuid",
+  "request_path": "/api/execute/script-123",
+  "request_headers": { "content-type": "application/json" },
+  "request_body": { "amount": 100 },
+  "response_code": 200,
+  "response_body": { "processed": 100 },
+  "logs": "[12:05:10] Script started\n[12:05:11] Processing...",
+  "duration_ms": 145,
+  "status": "success",
+  "created_at": "2026-04-10T12:05:11Z"
+}
+```
+
+---
+
+## 5. API Specification (MVP)
+
+### 5.1 Upload Script
+```
+POST /api/scripts
+Content-Type: application/json
+
+{
+  "name": "string",
+  "description": "string",
+  "script_content": "string",
+  "timeout_seconds": 30,
+  "memory_limit_mb": 256
+}
+
+Response: 201 Created
+{
+  "id": "uuid",
+  "name": "...",
+  ...
+}
+```
+
+### 5.2 List Scripts
+```
+GET /api/scripts
+
+Response: 200 OK
+[
+  { id: "...", name: "...", ... },
+  { id: "...", name: "...", ... }
+]
+```
+
+### 5.3 Delete Script
+```
+DELETE /api/scripts/{script_id}
+
+Response: 204 No Content
+```
+
+### 5.4 Execute Script (via HTTP Endpoint)
+```
+POST /api/execute/{script_id}
+Content-Type: application/json
+[any headers]
+
+[any request body]
+
+Response: [script-returned status code]
+{
+  "..." : "..."
+}
+```
+
+**Notes:**
+- Script receives full HTTP request (path, headers, body)
+- Response is script's JSON object (assumes `{ statusCode, headers, body }`)
+- On error (timeout, crash): `{ statusCode: 500, body: "Server error" }`
+
+---
+
+## 6. Rhai SDK (MVP Stub)
+
+For MVP, scripts have access to:
+
+### Core Request/Response
+- **ctx object**: Contains execution metadata + request data (see below)
+- **Return value**: `{ statusCode: int, headers: object, body: object }`
+
+### Context Object (Available Globally)
+```rhai
+// Execution metadata
+ctx.execution_id       // UUID of this execution
+ctx.script_id          // UUID of the script being run
+ctx.script_name        // Name of the script
+ctx.request_id         // Request ID for tracing
+ctx.trace_id           // For call graphs (v1.2+)
+ctx.invocation_type    // 'http', 'function', 'scheduled', etc.
+ctx.parent_execution_id // For function hierarchies (v1.2+)
+
+// Request context
+ctx.request.path       // HTTP path
+ctx.request.headers    // HTTP headers object
+ctx.request.body       // Request body (parsed JSON or raw)
+```
+
+### Structured Logging (v1.0+)
+```rhai
+log.info("Processing order", { order_id: 123, user: "alice" });
+log.warn("Rate limit approaching", { remaining: 10 });
+log.error("Payment failed", { error: "timeout", retry_count: 2 });
+log.debug("Internal state", { state: { ... } });
+```
+**Output**: Captured in execution logs, searchable in dashboard
+
+### Error Handling & Retry (v1.1+)
+```rhai
+// Retry a function with exponential backoff
+let result = retry::call(
+  || { invoke("process-data", { item: 123 }) },
+  {
+    max_attempts: 3,
+    backoff: "exponential",  // or "linear"
+    initial_delay_ms: 100,
+    max_delay_ms: 5000
+  }
+);
+
+// Retry an HTTP call
+let response = retry::http_call(
+  || { http.post("https://api.example.com/webhook", body) },
+  {
+    max_attempts: 5,
+    backoff: "exponential",
+    on_retry: |attempt, error| {
+      log.warn("Retry attempt", { attempt, error });
+    }
+  }
+);
+
+// Manual error handling
+try {
+  let data = invoke("might-fail", {});
+} catch err {
+  log.error("Invocation failed", { error: err });
+  return { statusCode: 500, body: { error: "Service unavailable" } };
+}
+```
+
+---
+
+## 6.1 Future: Document Schema Validation (v1.2+)
+
+For documents, allow optional **schema definitions** similar to MongoDB:
+
+```rhai
+// Define schema when creating
+docs.create("users", 
+  { name: "Alice", email: "alice@example.com" },
+  {
+    schema: {
+      name: "string",
+      email: "string",
+      age: "number?",  // optional
+      tags: "array"
+    }
+  }
+);
+
+// Validate before update
+docs.update("users", user_id,
+  { age: 31 },
+  { schema: { age: "number" } }
+);
+```
+
+---
+
+## 6.2 Example Script: Full SDK Usage
+
+```rhai
+// Get execution and request context
+let user_id = ctx.request.body.user_id;
+
+// Log start
+log.info("Processing request", { 
+  script: ctx.script_name, 
+  execution_id: ctx.execution_id
+});
+
+// Call another function with retry
+let user_data = retry::call(
+  || { invoke("fetch-user", { id: user_id }) },
+  { max_attempts: 2, backoff: "linear" }
+);
+
+if user_data.statusCode != 200 {
+  log.error("Failed to fetch user", { response: user_data });
+  return { statusCode: 500, body: { error: "User fetch failed" } };
+}
+
+// Store in KV cache
+kv.set("user-cache", `user:${user_id}`, user_data.body, 3600);
+
+// Store in documents
+let doc = docs.create("user-requests", {
+  user_id: user_id,
+  request_at: "2026-04-10T12:00:00Z",
+  status: "processed"
+});
+
+// Log completion
+log.info("Request processed", { 
+  doc_id: doc,
+  user_id: user_id
+});
+
+return {
+  statusCode: 200,
+  headers: { "Content-Type": "application/json" },
+  body: { user: user_data.body, cached: true }
+};
+```
+
+### 8.4 User Management Service
+**Purpose**: Built-in user authentication, management, and invitations with secure password handling.
+
+**PostgreSQL Schema:**
+```sql
+CREATE EXTENSION IF NOT EXISTS pgcrypto;  -- For password hashing
+
+CREATE TABLE users (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  email TEXT NOT NULL UNIQUE,
+  password_hash TEXT NOT NULL,
+  password_salt TEXT NOT NULL,
+  
+  -- Profile
+  name TEXT,
+  locked BOOLEAN DEFAULT false,
+  
+  -- Roles & Permissions
+  roles TEXT[] DEFAULT '{}',  -- e.g., ["admin", "moderator"]
+  permissions JSONB DEFAULT '{}',  -- Custom permissions structure
+  
+  -- Metadata
+  metadata JSONB DEFAULT '{}',  -- Custom user data (profile pic URL, preferences, etc.)
+  
+  -- Audit
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW(),
+  last_login_at TIMESTAMP,
+  last_password_change_at TIMESTAMP
+);
+
+-- Invitations & password reset tokens
+CREATE TABLE user_tokens (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID REFERENCES users(id) ON DELETE CASCADE,
+  token_type TEXT NOT NULL,  -- 'invite', 'password_reset', 'login_link'
+  token_hash TEXT NOT NULL UNIQUE,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  created_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE INDEX idx_users_email ON users(email);
+CREATE INDEX idx_user_tokens_user_id ON user_tokens(user_id);
+CREATE INDEX idx_user_tokens_type ON user_tokens(token_type);
+```
+
+**Rhai SDK (v1.1+):**
+
+```rhai
+// ===== CREATE & INVITE =====
+
+// Create user with password
+let user_id = users.create({
+  email: "alice@example.com",
+  password: "secure-password",
+  name: "Alice Smith",
+  roles: ["user"],
+  metadata: { profile_pic: "https://..." }
+});
+
+// Send invite link (creates token, sends email)
+users.send_invite(email) → { token_sent: true, expires_in_days: 7 }
+
+// Set password from invite/reset token
+users.set_password_from_token(token, new_password) → { user_id, success: true }
+
+// ===== AUTHENTICATION =====
+
+// Authenticate user
+let user = users.authenticate(email, password);
+if user {
+  let user_id = user.id;
+  let roles = user.roles;
+} else {
+  // Authentication failed
+}
+
+// Send password reset link
+users.send_password_reset(email) → { sent: true, expires_in_hours: 24 }
+
+// Send login link (passwordless)
+users.send_login_link(email) → { sent: true, expires_in_minutes: 15 }
+
+// Verify login link token
+let user = users.verify_login_token(token);
+
+// ===== READ & SEARCH =====
+
+// Get user by ID
+let user = users.get(user_id);
+
+// Find user by email
+let user = users.find_by_email("alice@example.com");
+
+// Search users
+let results = users.search({
+  query: "alice",  // Searches email, name
+  limit: 50,
+  offset: 0
+});
+
+// List users with filtering
+let users_list = users.list({
+  roles: ["admin"],  // Filter by roles
+  locked: false,     // Include/exclude locked users
+  limit: 100,
+  offset: 0
+});
+
+// ===== UPDATE =====
+
+// Update user data (except password)
+users.update(user_id, {
+  name: "Alice Johnson",
+  roles: ["user", "moderator"],
+  metadata: { theme: "dark", notifications: true }
+});
+
+// Update password (requires old password or token)
+users.update_password(user_id, old_password, new_password) 
+  → { success: true } or { error: "Wrong password" }
+
+// ===== LOCK & DELETE =====
+
+// Lock user (disable login)
+users.lock(user_id) → { success: true }
+
+// Unlock user
+users.unlock(user_id) → { success: true }
+
+// Delete user
+users.delete(user_id) → { success: true }
+
+// ===== PERMISSIONS & ROLES =====
+
+// Check if user has role
+if users.has_role(user_id, "admin") {
+  // Allow admin action
+}
+
+// Check if user has permission
+if users.has_permission(user_id, "posts:delete") {
+  // Allow deletion
+}
+
+// Grant role to user
+users.add_role(user_id, "moderator");
+
+// Revoke role
+users.remove_role(user_id, "moderator");
+
+// Set custom permissions
+users.set_permissions(user_id, { 
+  "posts:create": true, 
+  "posts:delete": false,
+  "comments:moderate": true 
+});
+```
+
+**User Object (returned from get/auth/find):**
+```json
+{
+  "id": "uuid",
+  "email": "alice@example.com",
+  "name": "Alice Smith",
+  "roles": ["user", "moderator"],
+  "permissions": { "posts:create": true },
+  "metadata": { "theme": "dark" },
+  "locked": false,
+  "created_at": "2026-04-10T12:00:00Z",
+  "updated_at": "2026-04-10T12:05:00Z",
+  "last_login_at": "2026-04-10T11:55:00Z"
+}
+```
+
+**Use Cases:**
+- User registration with email verification
+- Login flows (password or passwordless)
+- Password reset flows
+- Role-based access control (RBAC)
+- User search/directory
+- Account management (lock, delete)
+
+---
+
+| Layer | Technology | Rationale |
+|-------|-----------|-----------|
+| **Orchestrator** | Rust + Axum | Performance, safety, async-first; minimal overhead |
+| **Dashboard** | Alpine.js + vanilla HTML/CSS | Zero dependencies, simple to deploy, fast enough for MVP |
+| **Database** | PostgreSQL + hstore | Robust ACID database; hstore extension for lightweight KV (v1.1) |
+| **Container Runtime** | Docker (Docker daemon) | Industry standard, simple CLI |
+| **Executor Image** | Alpine Linux + Rhai | Minimal image size (~50-100MB), fast startup |
+| **Scripting** | Rhai | Lightweight, embedded-friendly, safe by default |
+| **Deployment** | Docker Compose (local) / systemd (production) | Simple multi-service orchestration |
+
+---
+
+## 11. Deployment Model (MVP)
+
+### Local Development
+```bash
+# Clone repo
+git clone <repo> serverless-cloud
+cd serverless-cloud
+
+# Start all services (Orchestrator + Dashboard + Postgres)
+docker-compose up
+
+# Dashboard: http://localhost:3000
+# Orchestrator: http://localhost:8080
+```
+
+### Production (Single Server)
+```bash
+# On target machine:
+# 1. Install Docker, Docker Compose
+# 2. Deploy docker-compose.yml
+# 3. Optionally: use systemd service to auto-restart on reboot
+
+docker-compose -f docker-compose.prod.yml up -d
+```
+
+### docker-compose.yml (MVP Template)
+```yaml
+version: '3.8'
+services:
+  postgres:
+    image: postgres:15-alpine
+    environment:
+      POSTGRES_DB: serverless
+      POSTGRES_USER: app
+      POSTGRES_PASSWORD: changeme
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    ports:
+      - "5432:5432"
+
+  orchestrator:
+    build: ./orchestrator
+    environment:
+      DATABASE_URL: postgres://app:changeme@postgres:5432/serverless
+      DOCKER_HOST: unix:///var/run/docker.sock
+    ports:
+      - "8080:8080"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+
+  dashboard:
+    image: nginx:alpine
+    volumes:
+      - ./dashboard/dist:/usr/share/nginx/html
+    ports:
+      - "3000:80"
+
+volumes:
+  postgres_data:
+```
+
+---
+
+## 12. Development Roadmap
+
+### Phase 1: MVP ✓ (Current)
+- [x] Orchestrator: REST API for script CRUD + execute
+- [x] Executor image: load + run Rhai script
+- [x] Dashboard: upload script, deploy, delete
+- [x] PostgreSQL: script storage + execution logs
+- [ ] **Timeline**: 4-6 weeks
+
+**Deliverables:**
+- Docker image for executor
+- Rust binary (Orchestrator)
+- Static HTML + Alpine.js dashboard
+- docker-compose.yml for local/prod deployment
+
+---
+
+### Phase 2: v1.0 (Polish & Usability)
+- Script versioning + rollback
+- Execution history dashboard (view logs, timings, errors)
+- Better error messages (script parse errors, timeouts)
+- Timeout/resource limit enforcement
+- Container cleanup/GC
+- Rhai SDK: `request()` function fully documented
+
+**Timeline**: 2-3 weeks
+
+---
+
+### Phase 3: v1.1 (Expand Capabilities & Services)
+- Queue-based triggers (RabbitMQ / Redis)
+- Scheduled jobs (cron syntax)
+- Secrets management (encrypted env vars)
+- **Rhai SDK: KV Store** (`kv.get()`, `kv.set()`, `kv.delete()` with collections)
+- **Rhai SDK: Document Store** (`docs.create()`, `docs.find()`, `docs.update()`, `docs.delete()` with schema validation)
+- **Rhai SDK: User Management** (auth, CRUD, roles, permissions, invitations, password reset)
+- **Rhai SDK: Email** (`email.send(to, subject, body)` via SMTP)
+- Rhai SDK: `s3.*`, `queue.*`, `invoke()`, `retry.*()`
+- External HTTP calls from scripts (`http.get()`, `http.post()`)
+- Script versioning with automatic rollback on error
+
+**Timeline**: 8-10 weeks
+
+---
+
+### Phase 4: v1.2 (Advanced Workflows & Hierarchies)
+- Function workflows (DAG execution, conditional branching, error handling)
+- Function hierarchy (parent/child invocation, sync/async calls)
+- Nested workflows
+- Call graph visualization + execution tracing
+- Advanced query support for document store (`docs.query()` with filters)
+
+**Timeline**: 6-8 weeks
+
+---
+
+### Phase 5: v1.3+ (Scaling, Security, Observability)
+- Multi-user / project namespacing
+- Rate limiting on endpoints
+- Auth (API keys, dashboard login)
+- Metrics + monitoring dashboard
+- Container pooling / warm starts
+- Distributed tracing (OpenTelemetry)
+- Webhooks for execution events
+- S3 integration (object storage reads/writes)
+
+---
+
+## 7. Complete Rhai SDK Reference (MVP → v1.1+)
+
+### Storage & Data
+| Component | Methods | Availability |
+|-----------|---------|--------------|
+| **KV Store** | `kv.get(collection, key)`, `kv.set(collection, key, value, ttl?)`, `kv.delete(collection, key)`, `kv.has(collection, key)` | v1.1 |
+| **Documents** | `docs.create(collection, data, schema?)`, `docs.find(collection, id)`, `docs.update(collection, id, data, schema?)`, `docs.delete(collection, id)`, `docs.list(collection, opts?)`, `docs.query(collection, filter?)` | v1.1 |
+| **S3** | `s3.get(key)`, `s3.put(key, data)`, `s3.delete(key)`, `s3.list(prefix?)` | v1.1 |
+| **Users** | `users.create(data)`, `users.get(id)`, `users.find_by_email(email)`, `users.search(query, limit, offset)`, `users.list(filters)`, `users.update(id, data)`, `users.authenticate(email, password)`, `users.update_password(id, old, new)`, `users.lock/unlock(id)`, `users.delete(id)`, `users.send_invite(email)`, `users.send_password_reset(email)`, `users.send_login_link(email)`, `users.has_role/permission(id, role/perm)`, `users.add/remove_role(id, role)` | v1.1 |
+
+### Communication
+| Component | Methods | Availability |
+|-----------|---------|--------------|
+| **Email** | `email.send(to, subject, body)`, `email.send_html(to, subject, html, text?)` | v1.1 |
+| **HTTP** | `http.get(url, opts?)`, `http.post(url, body, opts?)`, `http.put(...)`, `http.delete(...)` | v1.1 |
+
+### Functions & Execution
+| Component | Methods | Availability |
+|-----------|---------|--------------|
+| **Invoke** | `invoke(function_id, args, opts?)`, `invoke_async(function_id, args)` | v1.1 |
+| **Queue** | `queue.send(queue_name, message)`, `queue.send_batch(queue_name, messages)` | v1.1 |
+| **Retry** | `retry::call(fn, opts)`, `retry::http_call(fn, opts)` | v1.1 |
+
+### Observability & Context
+| Component | Methods | Availability |
+|-----------|---------|--------------|
+| **Logging** | `log.info(msg, data?)`, `log.warn(msg, data?)`, `log.error(msg, data?)`, `log.debug(msg, data?)` | v1.0 |
+| **Context** | `context().execution_id()`, `context().script_id()`, `context().request_id()`, `context().trace_id()`, `context().invocation_type()`, `context().parent_execution_id()` | v1.0+ |
+
+### Request/Response & Context
+| Component | Structure | Availability |
+|-----------|-----------|--------------|
+| **ctx** (global) | `ctx.execution_id`, `ctx.script_id`, `ctx.script_name`, `ctx.request_id`, `ctx.trace_id`, `ctx.invocation_type`, `ctx.parent_execution_id`, `ctx.request.path`, `ctx.request.headers`, `ctx.request.body` | MVP+ |
+| **Response** | Return `{ statusCode, headers?, body }` | MVP |
+
+### 8.1 KV Store Service
+**Purpose**: Simple key-value persistence organized by collections, shared across script invocations and scripts.
+
+**PostgreSQL Setup:**
+```sql
+-- Enable hstore extension (one-time setup)
+CREATE EXTENSION IF NOT EXISTS hstore;
+
+-- Create KV table with collection support
+CREATE TABLE kv_store (
+  collection TEXT NOT NULL,
+  key TEXT NOT NULL,
+  value hstore NOT NULL,
+  expires_at TIMESTAMP,
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW(),
+  
+  PRIMARY KEY (collection, key)
+);
+
+CREATE INDEX idx_kv_collection ON kv_store(collection);
+CREATE INDEX idx_kv_expires ON kv_store(expires_at) 
+  WHERE expires_at IS NOT NULL;
+```
+
+**Why hstore + collections?**
+- Lightweight, purpose-built for key-value storage
+- Collections allow logical grouping (e.g., `kv:sessions`, `kv:counters`, `kv:flags`)
+- Faster than JSONB for simple KV use cases
+- Built-in indexing support
+- Keeps all data in one database (no Redis dependency)
+
+**Rhai SDK:**
+```rhai
+// Get a value from a collection
+let val = kv.get("sessions", "user:123");  // Returns object or null
+
+// Set a value in a collection
+kv.set("sessions", "user:123", { token: "abc", created: "2026-04-10" });
+
+// Delete a key from a collection
+kv.delete("sessions", "user:123");
+
+// Set with TTL (seconds)
+kv.set("sessions", "user:123", { token: "xyz" }, 3600);
+
+// Check if key exists in a collection
+if kv.has("sessions", "user:123") { ... }
+
+// Use different collections for different purposes
+kv.set("counters", "api:calls", 42);
+kv.set("flags", "feature:beta", true);
+kv.set("cache", "page:home", { html: "..." });
+```
+
+**Use Cases:**
+- Cache frequently accessed data
+- Store user session state
+- Counters, flags, feature toggles
+- Rate limiting state (hit counts)
+
+---
+
+### 8.2 Document Store Service
+**Purpose**: Flexible NoSQL-like storage for complex JSON documents, organized by collections.
+
+**PostgreSQL Schema:**
+```sql
+CREATE TABLE documents (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  collection TEXT NOT NULL,
+  data JSONB NOT NULL,
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW(),
+  
+  UNIQUE(collection, id)
+);
+
+CREATE INDEX idx_docs_collection ON documents(collection);
+CREATE INDEX idx_docs_data ON documents USING GIN(data);
+```
+
+**Rhai SDK:**
+```rhai
+// Create a document
+let doc_id = docs.create("users", { 
+  name: "Alice", 
+  email: "alice@example.com",
+  tags: ["vip", "beta"]
+});
+
+// Find by ID
+let user = docs.find("users", doc_id);
+
+// Update document
+docs.update("users", doc_id, { 
+  last_login: "2026-04-10T12:00:00Z" 
+});
+
+// Delete document
+docs.delete("users", doc_id);
+
+// Query by field (simple equality, v1.2+ advanced queries)
+let admins = docs.query("users", { role: "admin" });
+
+// List all in collection (with pagination)
+let all_users = docs.list("users", { limit: 100, offset: 0 });
+```
+
+**Use Cases:**
+- User profiles, orders, transactions
+- Event log / audit trail
+- Content (posts, articles, comments)
+- Configuration documents
+- Workflow state
+
+---
+
+### 8.3 Email Service
+**Purpose**: Send outgoing emails via SMTP.
+
+**Configuration (stored in orchestrator config):**
+```yaml
+email:
+  smtp_host: "smtp.gmail.com"
+  smtp_port: 587
+  smtp_user: "your-email@gmail.com"
+  smtp_password: "app-password"  # Or from secrets manager
+  from_address: "noreply@yourdomain.com"
+  from_name: "Serverless Cloud"
+```
+
+**Rhai SDK:**
+```rhai
+// Simple send
+email.send({
+  to: "user@example.com",
+  subject: "Welcome!",
+  body: "Hello, welcome to our service."
+});
+
+// HTML body
+email.send({
+  to: "user@example.com",
+  subject: "Welcome!",
+  html: "<h1>Welcome!</h1><p>Hello user.</p>",
+  text: "Welcome! Hello user."  // Fallback
+});
+
+// With CC, BCC, reply-to
+email.send({
+  to: "user@example.com",
+  cc: "admin@example.com",
+  bcc: "archive@example.com",
+  reply_to: "support@example.com",
+  subject: "Notification",
+  body: "..."
+});
+
+// Template-like (basic string interpolation)
+let name = req.body.name;
+email.send({
+  to: req.body.email,
+  subject: `Welcome, ${name}!`,
+  body: `Hi ${name},\n\nWelcome to our service.`
+});
+```
+
+**Use Cases:**
+- Welcome emails on sign-up
+- Notifications (password reset, order status)
+- Alerts from scripts
+- Digest emails from queued data
+
+---
+
+## 9. v1.2+ Future Vision: Workflows & Hierarchies
+
+### 9.1 Function Workflows (DAG Execution)
+**Concept**: Chain multiple functions together in a directed acyclic graph (DAG).
+
+**Example:**
+```
+Function A (process raw data)
+    ↓
+Function B (validate data)
+    ↓
+Function C (store in DB + send notification)
+```
+
+**Workflow Definition (YAML, v1.2+):**
+```yaml
+name: "data-pipeline"
+description: "Process, validate, store data"
+
+steps:
+  - name: "process"
+    function: "process-raw-data"
+    input: "{{ trigger.body }}"
+    
+  - name: "validate"
+    function: "validate-data"
+    input: "{{ steps.process.output }}"
+    on_error: "fail"  # or "skip", "retry"
+    
+  - name: "store"
+    function: "store-and-notify"
+    input: "{{ steps.validate.output }}"
+    timeout: 60
+    retry:
+      attempts: 3
+      backoff: "exponential"
+
+output: "{{ steps.store.output }}"
+```
+
+**Features:**
+- Sequential execution (A → B → C)
+- Parallel execution (B & C in parallel after A)
+- Conditional branching (if A succeeds, run B; else run C)
+- Error handling (fail fast, skip, retry with backoff)
+- Data passing between steps (output of A → input of B)
+- Workflow state tracking + execution history
+- Timeout per step + total timeout
+
+**Schema (PostgreSQL):**
+```sql
+CREATE TABLE workflows (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL UNIQUE,
+  description TEXT,
+  definition JSONB NOT NULL,  -- YAML parsed as JSON
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE TABLE workflow_executions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  workflow_id UUID REFERENCES workflows(id),
+  status TEXT,  -- 'pending', 'running', 'success', 'failed'
+  steps_state JSONB,  -- { "process": { output: ... }, "validate": { output: ... } }
+  error_message TEXT,
+  started_at TIMESTAMP,
+  completed_at TIMESTAMP
+);
+```
+
+---
+
+### 9.2 Function Hierarchy (Parent/Child Invocation)
+**Concept**: Functions can invoke other functions and wait for results (like microservice calls).
+
+**Example:**
+```
+Parent Function A
+  ├─ Child Function B (sync call, waits)
+  ├─ Child Function C (sync call, waits)
+  └─ Child Function D (async, fire-and-forget)
+```
+
+**Rhai SDK:**
+```rhai
+// Synchronous invoke (waits for result)
+let result_b = invoke("function-b", { param: "value" });
+let result_c = invoke("function-c", { param: "value" });
+
+// Process results
+if result_b.statusCode == 200 {
+  let data = result_b.body;
+  // ... process
+}
+
+// Asynchronous invoke (fire-and-forget)
+invoke_async("function-d", { param: "value" });
+
+// Invoke with timeout
+let result = invoke("function-b", { param: "value" }, { timeout: 30 });
+```
+
+**Orchestrator Behavior:**
+- Parent function execution starts container
+- Child function invocation: spawn new container (nested execution)
+- Sync: parent waits; async: parent continues
+- Error handling: propagate up or catch locally
+- Timeout cascading: child timeout ≤ parent timeout
+
+**Call Graph Tracking:**
+```
+Function Execution Tree:
+  parent-func-exec-123
+  ├─ child-b-exec-456 (sync, 200ms)
+  ├─ child-c-exec-789 (sync, 500ms)
+  └─ child-d-exec-012 (async, initiated)
+  
+Total execution: 700ms (max of child times)
+```
+
+**Schema (PostgreSQL):**
+```sql
+ALTER TABLE execution_logs ADD COLUMN (
+  parent_execution_id UUID REFERENCES execution_logs(id),
+  invocation_type TEXT,  -- 'http', 'parent_sync', 'parent_async'
+  call_depth INT DEFAULT 0  -- Track nesting level
+);
+
+CREATE INDEX idx_execution_parent ON execution_logs(parent_execution_id);
+```
+
+---
+
+### 9.4 Service Interceptors & Middleware (v1.2+)
+
+**Concept**: A script can act as middleware to intercept and validate/transform service operations before they execute.
+
+**Use Cases:**
+- Auth function intercepts S3 writes: validate user permissions
+- Audit function intercepts document updates: log all mutations
+- Rate-limiting function intercepts queue sends: enforce quotas
+- Data validation function intercepts DB operations: enforce schema
+
+**Script Configuration (at upload):**
+```json
+{
+  "name": "auth-interceptor",
+  "description": "Authorize S3 writes",
+  "version": 1,
+  "script_content": "...",
+  
+  "interceptors": {
+    "s3": {
+      "before_write": true,
+      "before_read": false
+    },
+    "queue": {
+      "before_send": true
+    },
+    "documents": {
+      "before_create": true,
+      "before_update": true,
+      "before_delete": true
+    },
+    "kv": {
+      "before_set": false,
+      "before_delete": false
+    }
+  }
+}
+```
+
+**Interceptor Script Execution:**
+When another script calls `s3.put("bucket", "key", data)`:
+1. Orchestrator checks if any interceptor is registered for `s3.before_write`
+2. If yes, spawn interceptor script with context:
+   ```rhai
+   ctx.operation = {
+     service: "s3",
+     action: "write",
+     bucket: "bucket",
+     key: "key",
+     caller_script_id: "...",
+     caller_execution_id: "..."
+   }
+   ctx.data = { ... }  // The data being written
+   ```
+3. Interceptor script returns: `{ allowed: true/false, reason: "...", data: {...} }`
+4. If `allowed: false`, reject the operation → error to caller
+5. If `allowed: true`, use potentially modified `data` → execute `s3.put()`
+
+**Interceptor Script Example:**
+```rhai
+// Auth interceptor for S3
+let user_id = ctx.request.body.user_id;
+let key = ctx.operation.key;
+
+// Check if user owns this key
+let allowed = kv.get("permissions", `user:${user_id}:s3:${key}`);
+
+if allowed {
+  log.info("S3 write authorized", { user_id, key });
+  {
+    allowed: true,
+    data: ctx.data  // Optionally transform/add metadata
+  }
+} else {
+  log.warn("S3 write denied", { user_id, key });
+  {
+    allowed: false,
+    reason: "User does not have write permission"
+  }
+}
+```
+
+**Availability Matrix (v1.2+):**
+| Service | Before Operations |
+|---------|------------------|
+| **S3** | read, write, delete, list |
+| **Documents** | create, read, update, delete, query |
+| **KV** | set, get, delete |
+| **Queue** | send, send_batch |
+| **Email** | send |
+| **HTTP** | get, post, put, delete |
+| **Functions (invoke)** | call, call_async |
+| **Users** | create, update, authenticate, lock, delete |
+
+**Notes:**
+- HTTP triggers have NO before interceptors (they're entry points)
+- Interceptors are **per-script, opt-in** (scripts only intercept what they explicitly configure)
+- Failed interceptors return `{ allowed: false }` → original caller gets error
+- Interceptor failures are logged in audit trail
+- **v1.3+ consideration**: Global policies / RBAC layer on top of interceptors
+
+---
+
+## 10. Open Questions & Notes
+
+### Architecture
+- [ ] **Container image caching**: Should we keep a warm executor image in memory between requests? (v1.1 optimization)
+- [ ] **Script isolation**: Do we need process-level isolation beyond Docker (seccomp, AppArmor)?
+- [ ] **Networking**: Can scripts initiate outbound connections? (deferred to v1.1)
+
+### v1.1 Services
+- [ ] **KV expiration**: Background cleanup task for expired keys, or lazy deletion?
+- [ ] **Document queries**: Start with simple equality, or support complex filters (v1.2)?
+- [ ] **Email retries**: If SMTP fails, retry strategy (exponential backoff)?
+- [ ] **SMTP configuration**: Environment variables, config file, or dashboard UI?
+- [ ] **User password hashing**: Use bcrypt, Argon2, or scrypt? What cost factor?
+- [ ] **User invitations**: Email template customization? Configurable expiration?
+- [ ] **Passwordless login**: Email-based or SMS-based login links?
+- [ ] **Session management**: Sessions table for tracking login tokens/refresh tokens?
+- [ ] **2FA/MFA**: In-scope for v1.1 or defer to v1.2?
+
+### v1.2+ Workflows & Hierarchies
+- [ ] **Workflow DAG format**: YAML, JSON, or domain-specific language (DSL)?
+- [ ] **Branching logic**: Simple if/else, or complex conditions (switch/case)?
+- [ ] **Workflow versioning**: Support multiple versions with rollback?
+- [ ] **Call graph limits**: Max depth of nested function calls (prevent runaway recursion)?
+- [ ] **Timeout cascading**: How strictly to enforce (child ≤ parent)?
+- [ ] **Observability**: Generate trace IDs for call graphs, visualize in dashboard?
+
+### v1.2+ Service Interceptors
+- [ ] **Interceptor chaining**: If multiple scripts intercept same operation, execution order?
+- [ ] **Performance**: Interceptor overhead on every service call — caching/optimization needed?
+- [ ] **Interceptor failures**: If interceptor times out, fail the entire operation or allow bypass?
+- [ ] **Circular dependencies**: Prevent interceptor A calling service that triggers interceptor B calling A?
+- [ ] **Audit trail**: Log all interceptor decisions (allowed/denied) automatically?
+- [ ] **Debugging**: How to trace interceptor execution in logs/dashboard?
+
+### Rhai & SDK
+- [ ] **Module loading**: Can scripts `import` external Rhai modules? (probably no for MVP)
+- [ ] **File system access**: Can scripts read/write to local filesystem? (no for MVP)
+- [ ] **Request/response sizes**: Max payload size? (set sensible default, e.g., 10MB)
+
+### Operations
+- [ ] **Container logs**: Capture executor stdout/stderr → attach to execution log? (yes, nice to have)
+- [ ] **Script parsing errors**: Fail at upload time or runtime? (recommend: upload validation in Rhai)
+- [ ] **Garbage collection**: How often to prune old execution logs? (optional MVP, monthly default)
+
+### Future Integrations
+- [ ] **Metrics backend**: Prometheus, InfluxDB, or local file?
+- [ ] **Log aggregation**: ELK, Loki, or just local files?
+- [ ] **Secrets backend**: Hashicorp Vault, local encrypted file, or built-in?
+
+---
+
+## 13. Success Metrics (MVP)
+
+1. **Deployment ease**: Script uploaded and responding to HTTP in < 1 minute
+2. **Performance**: p95 latency < 500ms (including container startup)
+3. **Resource efficiency**: Server CPU/memory stays < 30% at rest, scales only on active requests
+4. **Reliability**: 99.5% uptime, no memory leaks or orphaned containers
+5. **Developer experience**: Dashboard feels responsive, errors are clear
+
+---
+
+## 14. Assumptions & Dependencies
+
+**Assumptions:**
+- Single server, modest hardware (2GB+ RAM, dual-core CPU)
+- Rhai is mature enough for MVP (checked v1.12+)
+- Docker daemon available on target machine
+- PostgreSQL can be containerized (not separate managed service)
+
+**Dependencies:**
+- Docker (for executor runtime)
+- Rust 1.70+ (for Orchestrator build)
+- Rhai crate (script execution)
+- Axum crate (HTTP framework)
+- PostgreSQL client library (sqlx or tokio-postgres)
+- Alpine Linux (executor base image)
+
+---
+
+## 16. Next Steps
+
+1. **Clarify any ambiguities** in this blueprint
+2. **Spike: Rhai executor image** — build minimal Alpine + Rhai image, test startup time
+3. **Spike: Axum API** — scaffold REST endpoints for script CRUD
+4. **Spike: PostgreSQL schema** — finalize schema, migrations
+5. **Build Phase 1**: Orchestrator → Dashboard → Executor → docker-compose integration
+
+---
+
+## Document Control
+
+| Version | Date | Author | Notes |
+|---------|------|--------|-------|
+| 1.0 | 2026-04-10 | Blueprint | MVP scope, architecture, tech stack locked |
+