Mechanics 0.4.1: disposable previews expire themselves

Mechanics 0.4.1 makes preview environments a first-class app instance shape. Agents can deploy or clone an instance, ask for a generated route, and stamp the overlay with a TTL in one command. The result is a review URL that is ordinary Mechanics state while it lives and scheduled for removal after it expires.

ssh -T mechanics.run -- app -a myapp -i pr-42 deploy \
  --tag abc1234 --ttl --route --json
ssh -T mechanics.run -- app -a myapp -i pr-42 wait --tag abc1234 --json
ssh -T mechanics.run -- route info myapp-pr-42

Expiry lives in GitOps

Passing --ttl without a value means eight hours. Passing a value, such as --ttl 4h, sets an explicit lifetime. The stamp is not a hidden database row. Mechanics writes a metadata-only label and an expires-at annotation onto the instance overlay kustomization, then propagates that marker to runtime resources for discovery.

Clones are safe by default. app instance clone pr-42 --from main does not inherit the source instance expiry unless the clone command carries its own --ttl. If a preview should stay, the user can clear the stamp explicitly.

ssh -T mechanics.run -- app -a myapp instance clone pr-42 --from main --ttl 2h --route
ssh -T mechanics.run -- app -a myapp instance set pr-42 --ttl 8h
ssh -T mechanics.run -- app -a myapp instance set pr-42 --ttl 0

The scheduler removes, not hides

The serve runtime now sweeps marked instances, re-reads the owning GitOps overlay as the authority, and removes only instances whose authoritative stamp has expired. Removal uses the same teardown flow as a manual instance remove, including generated routes. The audit trail records the scheduler action as app.instance.expire, so automatic cleanup is still a human-visible platform operation.

The recent foundation

• Licensing is explicit. Mechanics source is AGPL-3.0-only, while official pre-built binaries and packages use the Mechanics Community License for eligible individuals, non-profits, and smaller organizations.
• Workspaces are isolated and observable. Calico denies cross-workspace traffic by default, Istio sidecars add L7 telemetry and mTLS, and scoped Sidecar resources keep workspace xDS limited to the product surface.
• Static sites can skip app containers. Bucket website routes serve index.html and 404.html from bucket prefixes, with public reads still controlled by explicit bucket policy.
• Debug access is direct but bounded. user kubeconfig allows workspace reads and kubectl port-forward while denying exec, attach, Secret reads, and writes. addon credentials prints only catalog-known addon credential Secrets.

Previews are not snowflakes. They are app instances with receipts, URLs, and an expiry.