Preview Safely in an Isolated Runtime
Let a reviewer interact with generated code without granting it production data, identity, network, or permanence.
System map · Day 06
Whole-system design
Five stable layers. Today's work is expanded and linked; the rest stays in context.
Product and authority
Covered — People and product entry points · Generated application planeAhead — Identity and policy
HelixWorks control plane
Source-backed today
Authorizes which tenant artifact may enter preview and requests the hosted runtime operation.
Delivery and desired state
Covered — CI and immutable artifactsAhead — Git desired state · Argo CD reconciliation
Cloud and orchestration
Covered — Terraform and AWS APIs · Kubernetes or EKS control plane
Accounts, VPC, DNS, and private paths
Design target · not proved
Default-deny preview ingress and egress is a required design boundary that the current local runtime does not yet implement.
Compute and traffic
Covered — Worker compute · Platform service workloadsAhead — Ambient mesh data plane
Generated app workloads
Design target · not proved
The target is a bounded preview workload; the current local runtime proves payload isolation but not a production Pod identity or resource envelope.
Storage and evidence
Covered — Evidence and observabilityAhead — Infrastructure state · Cluster desired and live state
Product data and artifacts
Source-backed today
Persists the tenant-scoped preview payload and expiry metadata independently of application domain data.
The enterprise problem and today’s slice
Enterprise problem: Generated code can be incorrect or hostile, and running it beside trusted services with ambient credentials turns a review feature into a path to customer data.
Whole-course context: The incoming source artifact has a deterministic digest; today deploys it to the local hosted-runtime store without publishing it.
Today’s slice: Run the implemented tenant-scoped preview deployment, then derive the namespace, identity, network, resource, hostname, and expiry controls still required for an isolated production preview.
End-of-day evidence: A preview response and tenant/app runtime row reference the same artifact digest, and preview.deployed is published; namespace isolation, denied egress, and expiry are explicitly not yet proved.
Still unsolved: Managed application data, enterprise connectors, human identity, sharing, publication, and cloud isolation remain deferred.
Customer outcome and implementation focus
The customer outcome is a reviewable preview safely in an isolated runtime change, not a collection of requirements. This day starts with the implementation boundary, then uses the command or manifest below to produce positive, denied, and recovery evidence.
Components in focus
Runtime provisioner, preview gateway, and generated-app container; Kubernetes namespace/pod/service compute; artifact store and preview metadata database; cache: not involved because each preview must resolve its own immutable revision.
This map names the implementation boundary for this day. The service or controller changes only the state it owns; runtime and audit evidence let the operator distinguish a declared change from an effective one.
Create an isolated preview runtime
Prove interaction and containment
A policy manifest proves only declared intent. The current monorepo implements preview as a tenant-scoped call to the runtime service and persists the payload in local SQLite; it does not yet create per-preview namespaces, enforce egress policy, or expire previews automatically. Kubernetes also requires a network plugin that implements NetworkPolicy; the API object alone is not enforcement (Kubernetes Network Policies). Read the exact operation in services/control_plane/domain.py.
def preview(self, project: Project, actor: str) -> dict[str, object]:
self._authorize(project, actor)
artifact = self._latest(project)
payload = {"mode": "preview", **artifact, "source": self.artifacts.get(project.organization_id, artifact["artifact_id"])}
result = self.runtime.deploy(project.organization_id, project.project_id, payload)
self._audit(project, actor, "preview.deployed")
return result
Decision rules
Treat generated code as untrusted until publication policy says otherwise. The desired production design gives previews no ambient cloud or enterprise permissions, default-deny networking, resource limits, and reconciled expiry; the current local runtime does not prove those controls and must not be presented as a sandbox.