1.15.2 — Custom domains, name-only web apps, durable deploy evidence

2026-08-20

1.15.2 completes the web-app overhaul: create an app from just a name, upload a build straight from the browser, and attach a custom domain from the app's page — automatic when the domain's DNS is managed here, at most two records to publish when it isn't. Deployment failures become diagnosable: a failure's phase, node, and error output now survive verification and rollback, and the Deployments page explains what broke and what is currently serving before offering recovery actions. Plus first-boot and convergence-probe fixes straight from the first live account run.

Added

• Web apps can be created from a single name — availability previewed under the workspace's apps domain — and the setup run completes on its own; the GitHub step is skippable and auto-skipped when no repository is configured.
• A custom domain can be attached to a web app from its page: DNS managed here means records and HTTPS are handled automatically; external DNS shows at most two records to publish (delegation and traffic CNAME) with a Check button. The platform address keeps serving, and an alias can be removed at any time.
• The app page gains an Addresses card listing the platform address and every custom one with DNS and certificate status.
• Deploys publish to every address of an app; a lagging custom domain is recorded as a named warning, never a failed deploy or rollback.
• "Upload a build" is real: drag-drop or folder upload from the browser, checksummed end to end through the existing release API, with plain-language help when storage CORS blocks the upload.
• Each app has a full detail page (Overview / Deploys / Set up deploys / Deploy key / Danger) instead of an inspector drawer; old deep links redirect.
• Certificates can be retired from the domain page: every referencing address is repointed to a covering certificate first, with an eligibility preview before anything changes.
• Deployment attempts keep a durable diagnosis — failing phase, node, sanitized error output, rollback target and outcome — that survives later Verify, Converge, reconciliation, and rollback.
• The deployments payload reports what is currently serving (commit, framework version, converged when) and a per-node progress summary.
• System Setup gains an "Apps domain" readiness section and a release-bucket CORS checkup.

Changed

• The Deployments page explains a failed attempt — phase, node, error tail, rollback story, what is serving now — before offering actions, and only offers the actions valid for that attempt's state.
• Deployment rows open history (the action reads "History", not "Deploy"), and the page auto-refreshes while a deploy is in flight, so a mid-deploy snapshot no longer looks failed after convergence.
• Managed domains issue one apex+wildcard certificate per domain and honor an existing wildcard CNAME instead of writing per-host records and per-host certificates.
• A workspace's apps domain may be owned by an ancestor group; addressing accepts ancestor-owned domains (ancestors only, never siblings).
• An app with no release yet serves a placeholder page over working HTTPS instead of a 404 — which also lets onboarding verify itself.
• Taking a site offline or deleting an app tears down its custom-domain addresses in the same step, so an alias can never keep serving removed content.

Fixed

• Verifying a failed deployment no longer replaces the failure evidence with "unavailable"; the diagnosis the button was pressed to inspect survives it.
• A failed rollback's error output is recorded instead of silently dropped, and a successful rollback is confirmed once the node provably serves the previous release.
• A fresh node's first boot no longer fails when the platform config does not exist yet — boot-time config sync is best-effort, and the configure step remains the authoritative convergence. Previously every first boot on an empty account died this way while the node looked healthy.
• Node convergence probes the app over HTTPS; the plain-HTTP probe only ever saw the redirect, reporting healthy nodes as unreachable at the final gate.
• DNS answers synthesized by a wildcard record no longer read as conflicts during onboarding prechecks.
• Provisioning: security groups are tagged so later runs can see them (ending the re-create loop on every apply), name-based discovery covers estates created before the fix, and a missing optional S3 object is treated as absence rather than an error.
• Enabling a domain already bound to another app refuses with a plain message instead of a database integrity error.

Security

• Writes touching an ancestor-owned domain (per-host records, wildcard convergence, certificate requests) require manage authority in the domain-owning group; a child-only grant fails closed before any write, while grants made at the parent keep working.
• A web app can never claim another app's custom-domain address as its own primary — the cross-app address takeover the alias feature could have opened is refused at validation.

Upgrade notes

• Two additive database migrations (deployment journal, vhost alias link), applied automatically on migrate.
• Failure-diagnosis capture works from this release; rollback-outcome confirmation additionally needs the rollback target to carry this release too, so it activates once 1.15.2 is your fleet's baseline.
• All new deployment-payload and app-summary fields are additive; older admin bundles ignore them.