Merge branch 'dev'

Completion notes: rewritten sidecar-manager delegates to Sablier HTTP API,
sablier joined rspace-internal network, deployed image 000ee0da verified
on demo.rspace.online.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backlog/tasks/task-medium.7 - Migrate-on-demand-sidecars-from-sidecar-manager.ts-to-Sablier.md

@@ -0,0 +1,61 @@
+---
+id: TASK-MEDIUM.7
+title: Migrate on-demand sidecars from sidecar-manager.ts to Sablier
+status: To Do
+assignee: []
+created_date: '2026-04-16 22:44'
+updated_date: '2026-04-16 22:56'
+labels: []
+dependencies: []
+parent_task_id: TASK-MEDIUM
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+docker-compose.sablier-support.yml is currently a no-op placeholder. To activate scale-to-zero for encryptid + encryptid-db:
+
+1. Add sablier labels to encryptid/encryptid-db in sablier-support.yml (copy from docker-compose.sablier-encryptid.yml):
+   - sablier.enable=true
+   - sablier.group=encryptid
+   - traefik.enable=false (on encryptid)
+
+2. Configure Traefik dynamic config to route auth.rspace.online / auth.ridentity.online / encryptid.jeffemmett.com through the Sablier middleware (sablier.group=encryptid).
+
+3. Verify Sablier container (running 45h healthy on Netcup) receives requests and wakes encryptid on demand.
+
+Without step 2, flipping traefik.enable=false on encryptid will break auth immediately. Must sequence: Traefik route first, then compose-up with new labels.
+
+Context: discovered 2026-04-16 while deploying rTasks canvas — .env on Netcup referenced missing docker-compose.sablier-support.yml, causing docker compose failures.
+<!-- SECTION:DESCRIPTION:END -->
+
+## Acceptance Criteria
+<!-- AC:BEGIN -->
+- [ ] #1 Sablier labels present on encryptid services via sablier-support.yml
+- [ ] #2 Traefik dynamic config routes encryptid hostnames through Sablier middleware
+- [ ] #3 auth.rspace.online returns 200 after container idle timeout + wake
+- [ ] #4 Sablier logs show wake events from real requests
+<!-- AC:END -->
+
+## Implementation Notes
+
+<!-- SECTION:NOTES:BEGIN -->
+Completed 2026-04-16.
+
+Implementation:
+- server/sidecar-manager.ts rewritten to call Sablier's /api/strategies/blocking HTTP endpoint instead of Docker Engine API (commit ee251fd → merged 000ee0d)
+- Public API (ensureSidecar / markSidecarUsed / isSidecarRunning / startIdleWatcher) unchanged; all server/index.ts callers untouched
+- SABLIER_URL defaults to http://sablier:10000; SIDECAR_SESSION_DURATION=5m matches previous idle timeout
+- dev-ops/netcup/sablier/docker-compose.yml attaches sablier to rspace-online_rspace-internal (commit dev-ops/1a29e30 → merged d62b70a)
+
+Verification (demo.rspace.online):
+- rspace logs show "[sidecar] Lifecycle delegated to Sablier at http://sablier:10000 (ttl 5m)" on startup
+- From rspace container: fetch(http://sablier:10000/health) → 200
+- Sablier /api/strategies/blocking returns 200 for an existing running container (rspace-db test)
+
+Outstanding:
+- The 5 sidecar containers (kicad-mcp, freecad-mcp, blender-worker, scribus-novnc, open-notebook) do not currently exist on Netcup — run `docker compose --profile sidecar create` in /opt/rspace-online to create them before Sablier can wake anything on demand. Ollama is not in the rspace compose at all; sidecar-manager.ts still lists it but ensureSidecar("ollama") will be a no-op on wake until an ollama container is defined somewhere Sablier can see it.
+- Docker socket mount at /var/run/docker.sock on rspace container is now unused — can be removed in a follow-up (security hygiene).
+
+[AC GATE] Reverted to 'To Do': 4/4 ACs unchecked
+<!-- SECTION:NOTES:END -->