cixuuz · Oct 23, 2026
@@ -313,6 +313,7 @@ Third-party and builtin apps that add their own pages, crons and MCP tools.
 | Builtin app surfaces | Top-level routes builtin apps claim | `/<app>` via the `/:builtinApp/*` catch-all | `apps/builtinRegistry.ts` → per-app page | per-app `backend/routes.py` | `POST /api/apps/<app>/...` per app |
 | Dev Fleet Make Live | Repoint the live gateway at a worktree (stage the cutover, cancel a staged one, restart into it) — runs in the gateway process because the pointer is bind-masked from the sandboxed backend; owner-only, every app token refused | `/dev-fleet` → row → **Make live** / **Cancel staged cutover** / **Restart** | `pages/DevFleetPage.tsx` (`devFleetApi.ts` `postGateway`; the row controls in `pages/DevFleetPageRow.tsx` and `pages/DevFleetPageMenus.tsx`, the restart handshake in `pages/devFleetPageModel.ts`) | `src/kiro_crew/apps/builtins/dev_fleet/gateway_routes.py`, `live.py` (owners `live_leases.py`, `live_service.py`, `live_plan.py`); `src/kiro_crew/service/live_target.py`; the backend reads pointer state back through `pointer_broker.py` | `POST /api/apps/dev-fleet/make-live`, `POST /api/apps/dev-fleet/restart-gateway`; backend-token-only `GET /api/apps/dev-fleet/live-target`, `POST/PUT/DELETE /api/apps/dev-fleet/live-target/removal-lease` |
 | Dev Fleet Switch back | One safe return to the previous checkout after a completed Make Live cutover; the banner is absent while a cutover is only staged | `/dev-fleet` → completed-cutover banner → **Switch back** | `pages/DevFleetPage.tsx` (the banner in `pages/DevFleetPageNotices.tsx`) | `src/kiro_crew/apps/builtins/dev_fleet/fleet_state.py`, `gateway_routes.py`, `live.py`, `live_plan.py`; `src/kiro_crew/service/live_target.py` | `GET /apps/dev-fleet/api/fleet`, `POST /api/apps/dev-fleet/make-live` (`undo: true`) |
+| Dev Fleet release-channel worktree | A detached worktree pinned to the newest published `stable` release, resolved from a private pruned tag mirror (`refs/dev-fleet/release-tags/*`) and verified against the oid the remote advertises, so a local tag cannot masquerade as a release. Carried as an ordinary fleet row, so a shipped build can be podded beside unreleased work. The pin never moves in place — a newer release is Remove then Create — and nothing here touches `$KIROCREW_HOME/channel`, so it does not change which channel this install updates from | `/dev-fleet` → the `release-channel-stable` row → **Create worktree** on the placeholder | `pages/DevFleetPage.tsx` (the placeholder row, the version badge and the `n/a` PR and Behind cells in `pages/DevFleetPageReleaseChannel.tsx`, the Rebase suppression on the channel row in `pages/DevFleetPageRow.tsx`, the payload types and row grouping in `pages/devFleetPageModel.ts`) | `src/kiro_crew/apps/builtins/dev_fleet/release_channel_pin.py` (resolve), `worktree_ops_release.py` (Create), `fleet_state.py` (row state), `http_api.py`, `server.py` | `GET /apps/dev-fleet/api/fleet` (the `release_channel` key), `POST /apps/dev-fleet/api/release-channel/create` |
 | App session controls | A compact per-chat control an app contributes to the composer, handed the active session's identity | Chip in the composer bar of any chat, when an enabled app declares `contributes.sessionControls` — no route of its own | `hooks/useSessionControls.ts`, `components/SessionControlHost.tsx`, `components/ChatInput.tsx` (chips), `pages/ChatPage.tsx`, `pages/chat/page/ComposerDockView.tsx` and `pages/chat/page/sessionControls.ts` (wiring) | `src/kiro_crew/apps/manifest_contributes.py` (declaration), `src/kiro_crew/apps/manifest.py` (validation); the status route is app-owned | `GET /api/apps`, `GET /api/apps/{name}/{statusPath}` (in-gateway) or `GET /apps/{name}/api/{statusPath}` (process-backed) |
 | App rail run state | The state of an app's own scheduled jobs on its rail icon — running, failed, or succeeded within the last 90s. Derived from the app's crons rather than pushed: the host already owns the in-flight marker, `last_status`, and the `created_by` owner stamp, so an app declares nothing new and cannot set its own mark. A user-paused job contributes nothing, which is the opt-out that works with the app's page closed | Mark on the row of an enabled installed app that OWNS a cron job — whether declared in `contributes.crons` or created at run time through `ctx.cron.add_job()`; no route of its own. Covers builtin and AppHost-routed apps alike: the row carries the app's resolved `name`, so a builtin's bare nav id is not parsed back | `appRunState.ts`, `shell/nav/railBadges.ts` (reads the crons), `shell/nav/navRow.tsx` (`RunStateIndicator` in `NavBadge`) | `src/kiro_crew/dashboard/handlers/cron.py` (`api_crons` serializes the owning `app` and `user_paused`); `src/kiro_crew/apps/cron_sdk.py` (`owner_tag` / `app_owner_name`) | `GET /api/crons` |