feat: implement Codencer v2 local self-host path

.github/workflows/public-testability-macos.yml

@@ -0,0 +1,45 @@
+name: Public Testability (macOS)
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-macos:
+    runs-on: macos-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Cache Go build and module directories
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/Library/Caches/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Install macOS verification prerequisites
+        run: |
+          brew update
+          brew install jq docker docker-compose
+          mkdir -p ~/.docker/cli-plugins
+          ln -sf "$(brew --prefix docker-compose)/bin/docker-compose" ~/.docker/cli-plugins/docker-compose
+          docker compose version
+
+      - name: Build supported beta-track binaries
+        run: make build-supported
+
+      - name: Run supported public verification
+        run: make verify-beta

.github/workflows/public-testability-windows.yml

@@ -0,0 +1,60 @@
+name: Public Testability (Windows)
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-windows-broker:
+    runs-on: windows-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Cache Go build and module directories
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/AppData/Local/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Install GNU Make
+        shell: pwsh
+        run: choco install make -y
+
+      - name: Verify make availability
+        shell: bash
+        run: make --version
+
+      - name: Build Windows agent-broker only
+        shell: bash
+        run: make build-broker
+
+      - name: Run nested broker tests (BG-011 still secondary and allowed to fail)
+        id: broker_tests
+        continue-on-error: true
+        shell: bash
+        working-directory: cmd/broker
+        run: go test ./...
+
+      - name: Report nested broker test status
+        if: always()
+        shell: bash
+        run: |
+          if [ "${{ steps.broker_tests.outcome }}" = "success" ]; then
+            echo "Nested cmd/broker tests passed in this run."
+          else
+            echo "BG-011 remains open: nested cmd/broker tests still fail, so the workflow only enforces the documented Windows claim that agent-broker builds on windows-latest."
+          fi

.github/workflows/public-testability.yml

@@ -0,0 +1,32 @@
+name: Public Testability
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install CGO build prerequisites
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends build-essential
+
+      - name: Build supported beta-track binaries
+        run: make build-supported
+
+      - name: Run supported public verification
+        run: ./scripts/verify_beta.sh

.gitignore

@@ -1,8 +1,20 @@
 # Build artifacts
 bin/
+node_modules/
+extension/out/
 orchestratorctl
 !cmd/orchestratorctl/
 !cmd/orchestratorctl/*.go
+/cmd/broker/agent-broker
+/cmd/broker/agent-broker.exe
+/cmd/codencer-connectord/codencer-connectord
+/cmd/codencer-connectord/codencer-connectord.exe
+/cmd/codencer-relayd/codencer-relayd
+/cmd/codencer-relayd/codencer-relayd.exe
+/cmd/orchestratord/orchestratord
+/cmd/orchestratord/orchestratord.exe
+/cmd/orchestratorctl/orchestratorctl
+/cmd/orchestratorctl/orchestratorctl.exe
 *.test
 *.out
 service.test

AGENTS.md

@@ -9,9 +9,10 @@ You are a principal engineer implementing a production-oriented local orchestrat
 
 ## General rules
 - follow the docs strictly
+- treat current code, tests, and smoke results as release truth when historical docs disagree
 - implement one phase at a time
 - do not widen scope
-- do not add cloud
+- do not add new cloud product scope; existing self-host cloud control-plane code is in scope for truthful maintenance
 - do not skip tests
 - do not skip docs when behavior changes
 - do not bypass service boundaries

CHANGELOG.md

@@ -7,17 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0-beta] - 2026-04-23
+
 ### Added
+- Self-hostable v2 relay path with:
+  - stable daemon instance identity and manifest-backed discovery
+  - outbound authenticated connector sessions with explicit shared-instance allowlists
+  - self-host relay planner API, enrollment token flow, audit persistence, and relay-side MCP tools
+- Cloud control-plane self-host surface with `codencer-cloudd`, `codencer-cloudctl`, and `codencer-cloudworkerd`, plus bootstrap/status/org/workspace/project/token/install/event/audit flows.
+- Cloud installation enable/disable routes and matching `cloudctl install enable|disable` subcommands.
+- Truthful cloud docs and smoke guidance for the bootstrap and control-plane path.
 - **OpenClaw (acpx) Adapter**: 🧪 Experimental support for OpenClaw-compatible executors via the standardized ACP bridge.
 - Official sequential wrapper examples for bash/zsh, PowerShell, and Python under `examples/automation/`.
 - Wrapper-friendly sample task lists and prompt/task inputs for ordered execution.
 - New `scripts/smoke_test_v1.sh` for verifying all 6 primary submission modes.
+- Public beta tester guide in `docs/BETA_TESTING.md` with exact local, relay, cloud, planner/client, and provider test-track entrypoints.
+- `make build-supported`, `make verify-beta`, and `make verify-beta-docker` as explicit repo-level verification entrypoints for the supported tracks.
+- Planner-client walkthroughs for ChatGPT, Claude Desktop plus `claude.ai`, and Gemini CLI under `docs/mcp/integrations/`.
+- Per-platform setup walkthroughs for macOS, Windows plus `agent-broker`, WSL, and remote VPS dev-server layouts.
+- Consolidated operator boundary reference in `docs/KNOWN_LIMITATIONS.md`.
+- Operator-facing beta launch notes in `docs/RELEASE_NOTES_v0.2.0-beta.md`.
+- Cross-platform public-testability CI on `macos-latest` and `windows-latest`.
 
 ### Changed
-- **Unified v1 Documentation Truth-Pass**: Cleaned and synchronized all public-facing docs (README, AI Guide, Runbook, Automation) for 100% alignment with the CLI contract.
+- Adopted `v0.2.0-beta` as the truthful build/version string for the current v2 local/self-host beta repo state.
+- Rewrote operator-facing v2 docs to match the implemented local/self-host path and current runtime truth.
+- Clarified that the relay is the public remote HTTP/MCP surface and the daemon-local `/mcp/call` endpoint is only a local compatibility/admin surface.
+- Documented current self-host beta boundaries explicitly: best-effort abort, bounded artifact transport, static-token auth, and relay routing that now probes only authorized online shared instances before failing closed.
+- Removed duplicate public connector/relay binary surfaces in favor of the canonical `codencer-connectord` and `codencer-relayd` entrypoints.
+- Tightened abort reporting so Codencer only reports success when the active step really reaches `cancelled`.
+- Removed committed extension dependency/build output directories and kept only the extension manifests plus source.
+- Added relay admin/status routes, connector local status snapshots, and a practical self-host smoke flow for daily operator use.
+- **Unified Documentation Truth-Pass**: Cleaned and synchronized current public-facing docs (README, AI Guide, Runbook, Automation) for alignment with the implemented CLI and relay surfaces.
 - Expanded automation documentation to make the shell-planner story explicit and machine-oriented.
 - Clarified that ordered task execution in v1 is wrapper-based and not a native workflow engine.
 - Hardened smoke/example guidance around strict JSON parsing and machine-safe CLI usage.
+- Clarified the public test-track boundaries so local, relay/runtime, cloud, planner/client, and provider testing route to the right docs without mixing surfaces.
+- Parameterized the Docker cloud image build version through the compose environment instead of hardcoding it only inside the Dockerfile.
 
 ## [0.1.0-beta] - 2026-03-28
 
@@ -49,3 +75,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ---
 
 [0.1.0-beta]: https://github.com/lookmanrays/codencer/releases/tag/v0.1.0-beta
+[0.2.0-beta]: https://github.com/lookmanrays/codencer/releases/tag/v0.2.0-beta

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing to Codencer
 
-Thank you for your interest in contributing to Codencer! As a **Public Beta (v0.1.0-beta)** project, we are actively looking for feedback on our orchestration protocols, CLI ergonomics, and adapter reliability.
+Thank you for your interest in contributing to Codencer! As an **open-source beta (`v0.2.0-beta`)** project, we are actively looking for feedback on the current local/self-host execution path, CLI ergonomics, and adapter reliability.
 
 ## 🏛 The Relay Philosophy
 Before contributing, please remember that Codencer is a **Defensive Relay**, not a "Brain." We prioritize:

Makefile

@@ -1,10 +1,39 @@
+VERSION ?= v0.2.0-beta
+LDFLAGS := -X agent-bridge/internal/app.Version=$(VERSION)
+
 all: lint test build
 
+build-supported: build build-cloud build-mcp-sdk-smoke
+
 build:
+	@mkdir -p bin
 	@echo "==> Building orchestratord..."
-	@go build -ldflags "-X agent-bridge/internal/app.Version=v1.0-release-candidate" -o bin/orchestratord ./cmd/orchestratord
+	@go build -ldflags "$(LDFLAGS)" -o bin/orchestratord ./cmd/orchestratord
 	@echo "==> Building orchestratorctl..."
-	@go build -ldflags "-X agent-bridge/internal/app.Version=v1.0-release-candidate" -o bin/orchestratorctl ./cmd/orchestratorctl
+	@go build -ldflags "$(LDFLAGS)" -o bin/orchestratorctl ./cmd/orchestratorctl
+	@echo "==> Building codencer-connectord..."
+	@go build -ldflags "$(LDFLAGS)" -o bin/codencer-connectord ./cmd/codencer-connectord
+	@echo "==> Building codencer-relayd..."
+	@go build -ldflags "$(LDFLAGS)" -o bin/codencer-relayd ./cmd/codencer-relayd
+
+build-cloud:
+	@mkdir -p bin
+	@echo "==> Building codencer-cloudctl..."
+	@go build -ldflags "$(LDFLAGS)" -o bin/codencer-cloudctl ./cmd/codencer-cloudctl
+	@echo "==> Building codencer-cloudd..."
+	@go build -ldflags "$(LDFLAGS)" -o bin/codencer-cloudd ./cmd/codencer-cloudd
+	@echo "==> Building codencer-cloudworkerd..."
+	@go build -ldflags "$(LDFLAGS)" -o bin/codencer-cloudworkerd ./cmd/codencer-cloudworkerd
+
+build-broker:
+	@mkdir -p bin
+	@echo "==> Building agent-broker (nested module)..."
+	@cd cmd/broker && go build -o ../../bin/agent-broker ./...
+
+build-mcp-sdk-smoke:
+	@mkdir -p bin
+	@echo "==> Building mcp-sdk-smoke (official MCP SDK proof helper)..."
+	@go build -o bin/mcp-sdk-smoke ./cmd/mcp-sdk-smoke
 
 test:
 	@echo "==> Running tests..."
@@ -116,6 +145,38 @@ smoke: build
 	@echo "==> Running automated smoke test..."
 	@./scripts/smoke_test.sh
 
+self-host-smoke: build
+	@echo "==> Running self-host relay/connector smoke test..."
+	@./scripts/self_host_smoke.sh
+
+self-host-smoke-all: build build-mcp-sdk-smoke
+	@echo "==> Running self-host relay/connector smoke test with all optional scenarios..."
+	@SMOKE_SCENARIOS=all ./scripts/self_host_smoke.sh
+
+self-host-smoke-mcp: build build-mcp-sdk-smoke
+	@echo "==> Running self-host relay/connector smoke test with MCP coverage..."
+	@SMOKE_SCENARIOS=status,audit,mcp,mcp-sdk ./scripts/self_host_smoke.sh
+
+cloud-smoke: build-cloud
+	@echo "==> Running cloud control-plane smoke test..."
+	@./scripts/cloud_smoke.sh
+
+cloud-stack-config:
+	@ENV_FILE=deploy/cloud/.env; \
+	if [ ! -f "$$ENV_FILE" ]; then ENV_FILE=deploy/cloud/.env.example; fi; \
+	echo "==> Validating docker compose cloud stack with $$ENV_FILE..."; \
+	docker compose --env-file "$$ENV_FILE" -f deploy/cloud/docker-compose.yml config > /dev/null
+
+cloud-stack-smoke:
+	@echo "==> Running docker-compose cloud stack smoke test..."
+	@./deploy/cloud/smoke.sh
+
+verify-beta: build-supported
+	@./scripts/verify_beta.sh
+
+verify-beta-docker: build-supported
+	@./scripts/verify_beta.sh --docker
+
 validate: build
 	@echo "==> Running Codex validation scenario (Internal Version Bump)..."
 	@./bin/orchestratorctl run start validation-run-01 validation-project || true