Why DockSpin
Everything listed here is live right now. We re-check it after every deploy and publish the raw results.
13 capabilities are live. See the raw ledger.
Billing / P0
Signed Paymenter lifecycle webhooks are live when PAYMENTER_SHARED_SECRET is configured. Live provider smoke passed on pioneer-vps.
Production evidence: apps/api/app/api/routes.py · smoke: paymenter:real_smoke_passed.
Provisioning / P0
V1 provisioning engine of record. Site lifecycle runs on the VPS via the DockSpin agent with signed command envelopes. vhost.create/delete/suspend execute on-host and command completion is synced to site status.
Production evidence: apps/agent/executor.go, apps/api/app/services/agent_provision.py, ... · smoke: dockspin-agent:provisioning_active.
Backups / P0
Host fleet Restic repository is live on pioneer-vps (RESTIC_REPOSITORY + RESTIC_PASSWORD). Backup commands dispatch to the agent; live restore drill smoke passed.
Production evidence: apps/api/app/services/restic.py, apps/api/app/services/restic_executor.py, ... · smoke: restic:drill_passed.
Backups / P0
Per-snapshot verify jobs dispatch backup.verify to the agent on pioneer-vps. Live restore-to-temp verification passed 2026-06-28. Admin UI shows Verified, Unverified, Verification failed, or Restore test required.
Production evidence: apps/api/app/services/backup_workflows.py, apps/api/app/models/backup_verification_job.py, ... · smoke: trust-foundation:pioneer-vps:20260628T102000Z:backups.verification.
Backups / P0
Backup snapshots store manifest v2 metadata (site files, databases, DNS, email). Restore jobs assert the manifest fingerprint before dispatch. Live manifest generation smoke passed on pioneer-vps 2026-06-28.
Production evidence: apps/api/app/services/restic_executor.py, apps/api/app/services/backup_workflows.py, ... · smoke: trust-foundation:pioneer-vps:20260628T102000Z:backups.restore-manifest.
Reliability / P1
Every mutation is tracked with actor, action, and target in the audit_log table.
Production evidence: apps/api/app/services/audit.py, apps/api/app/models/audit_log.py.
Email / P1
SMTP relay credentials, delivery event ingestion from Postfix logs, customer webhooks, and deliverability dashboard in the customer portal.
Production evidence: apps/api/app/services/email_delivery_events.py, apps/api/app/services/smtp_credentials.py, ....
Applications / P1
Customers can download a standard-format export (ZIP/tar.gz, SQL, DNS zone, env.example, cron, email inventory, restore README). Secrets are omitted. Full files+SQL require the host agent; otherwise DockSpin returns an honest metadata package instead of fake site files.
Production evidence: apps/api/app/services/site_portability.py, apps/api/app/api/vps/export_routes.py, ....
Security / P1
Composite score computed from live DB signals: SSL certificate expiry, backup snapshot freshness, active WAF rules, DNS SPF records, and customer activation status.
Production evidence: apps/api/app/services/security.py, apps/api/app/api/vps/security_routes.py, ....
Platform API / P1
Hashed API keys with PBKDF2, JSON scopes, expiration, revocation, and per-user isolation. Portal UI supports create/revoke with one-time secret reveal. IP allowlists and rate-limit telemetry remain planned.
Production evidence: apps/api/app/models/api_key.py, apps/api/app/api/vps/account_routes.py, ....
Support / P1
DB-backed ticket system with messages, SLA tracking, and stats; no external integration required.
Production evidence: apps/api/app/services/support.py, apps/api/app/api/vps/support_routes.py.
Commerce / P1
Static Next.js pricing, features, and checkout scaffold pages.
Production evidence: apps/web/app/pricing, apps/web/app/features.
Email / P2
DockSpin Webmail SSO deep-links and portal /portal/webmail poll endpoint on pioneer-vps.
Production evidence: apps/api/app/services/snappymail.py, apps/api/app/services/imap_proxy.py, ....