[Agata-Proxima]

Summary

• Add signed 30-second node heartbeat reporting and a domain-separated identity-refresh flow. Existing enrolled nodes can receive their organization's verification key on upgrade without replacing their node UUID or consuming another enrollment token.
• Add customer Docker Compose installation with persistent node identity. The one-time enrollment token is the only mounted setup secret; the Control Plane delivers the node heartbeat key and organization-scoped tenant verification key over HTTPS.
• Add Windows PowerShell and Linux Bash installers. Both generate the node environment and one-time token file from the setup commands copied from Agata Proxima, prompt for the PostgreSQL upstream when needed, validate Compose, build/start the Engine and wait for the actual Docker health check.
• Add a customer-managed deployment executor with signature/timestamp verification, per-node release allowlists, stable execution IDs, Control Plane callbacks, runtime checks and verified rollback.
• One executor endpoint can manage multiple Engine Compose projects on the same customer Docker host using a node-target map. Separate hosts/clusters require the customer's own orchestrator.
• Publish multi-architecture Engine images from reviewed version tags, including semver tags consumed by the executor.

Security boundaries

• The Control Plane PROXIMA_TENANT_SIGNING_KEY is a private master used to derive organization-scoped tenant keys. It is never sent to customer nodes.
• The Engine stores its node heartbeat key and organization-scoped tenant verification key in the protected identity file; Unix permissions are owner-only.
• The one-time enrollment token is mounted as a file and is not injected into the Engine environment.
• Customer PostgreSQL remains customer-managed.
• The executor uses fixed Docker Compose arguments and explicit per-node release allowlists; it does not execute webhook-provided shell commands.
• The reference executor supports running/stopped; draining requires a customer-specific drain controller.

Validation

• Windows installer smoke test and Linux installer generation/health smoke test.
• Rust unit tests, customer Compose validation, PostgreSQL tenant-isolation acceptance test and PgBouncer transaction-pooling isolation test.
• CI must pass before merge. No production deployment or release tag has been created.