- unidesk/ (Repository root: configuration, orchestration, CLI, and documentation)
  - AGENTS.md (Top-level agent index and `scripts/cli.ts` usage guide)
  - TEST.md (Manual CLI test plan following cli-spec expectations)
  - config.json (Single source of truth for ports, tokens, runtime, paths, and provider identity)
  - docker-compose.yml (Main server orchestration for database, backend-core, frontend, dev-frontend-proxy, provider-gateway, and managed main-server user services such as Todo Note)
  - package.json / bun.lock (Root Bun tooling for CLI checks)
  - .gitignore
  - reference -> docs/reference (Compatibility symlink for older references)
  - scripts/ (Unified CLI and implementation modules)
    - cli.ts (Single Bun CLI entry)
    - tsconfig.json (TypeScript check scope for CLI)
    - src/ (CLI business logic modules; `cli.ts` remains a thin router)
      - config.ts (Root config loading and validation)
      - docker.ts (Docker Compose env generation, start/stop/status/logs)
      - jobs.ts (Fire-and-Forget job state under `.state/jobs/`)
      - check.ts (Formal checks)
      - debug.ts (Real-flow debug helpers)
      - command.ts (Bounded command execution helpers)
      - output.ts (JSON output helpers)
      - e2e.ts (Public production frontend/dev frontend/provider ingress, internal core/database, and Playwright frontend E2E checks)
      - ci.ts (D601 k3s Tekton CI install/status/manual-run/dev-namespace-e2e/logs helpers; CI only, no CD)
  - logs/ (Generated service logs; ignored by git)
  - .state/ (Generated job state and compose env; ignored by git)
  - docs/
    - issue/ (Manual test issue records)
    - reference/ (Long-term reference documents)
      - arch.md (Distributed work platform architecture)
      - repo-tree.md (This repository structure reference)
      - cli.md (CLI command model and async job contract)
      - config.md (Config and runtime rules)
      - code-queue-supervision.md (Supervisor policy for parallel Code Queue delivery programs)
      - deployment.md (Docker stack deployment and health criteria)
      - frontend.md (Frontend layout and design rules)
      - provider-gateway.md (Provider connection and host SSH maintenance bridge)
      - observability.md (Logs and status visibility)
      - e2e.md (Delivery gate, Playwright frontend E2E, and database persistence checks)
      - ci.md (D601 k3s Tekton CI, read-only production database performance gate, master deploy.json dev namespace e2e harness, and trigger boundary)
      - user-service-delivery.md (Default user-service delivery flow and Decision Center product workflow policy)
      - dev-environment.md (D601 persistent dev environment, public dev frontend proxy, deploy dev scope, and Rust build boundary)
  - src/ (Component monorepo)
    - package.json (Component workspace metadata)
    - bun.lock (Component dependency lockfile)
    - tsconfig.base.json (Project references for component checks)
    - tsconfig.check.json (No-emit TypeScript check scope for all components)
    - components/
      - shared/ (Shared message types and utilities)
        - package.json
        - tsconfig.json
        - src/index.ts
      - backend-core/ (UniDesk stateless core service container)
        - Cargo.toml / Cargo.lock (Rust backend-core crate and pinned dependency graph)
        - package.json
        - Dockerfile
        - src/main.rs (Server setup, HTTP/WebSocket routing, startup orchestration)
        - src/cli.rs (Container-local helpers for JSON fetch and SSH broker)
        - src/types.rs (Runtime config, provider, task, microservice and performance data structures)
        - src/config.rs (Environment variable reading, config validation and dev identity)
        - src/state.rs (Shared application state, database pool, logger and in-memory task/provider indexes)
        - src/logger.rs (Structured JSONL logger with hourly rotation and retention pruning)
        - src/http.rs (HTTP routing, JSON utilities, health payload and API handlers)
        - src/db.rs (Database init, schema creation and CRUD queries)
        - src/performance.rs (Request/operation performance sampling and database size reporting)
        - src/provider_registry.rs (Provider WebSocket lifecycle: register, heartbeat, status, disconnect)
        - src/task_dispatcher.rs (Task creation, dispatch to providers, wait-for-result)
        - src/ssh_bridge.rs (SSH control bridge and TCP pool data-channel dispatch)
        - src/egress_tcp.rs (Egress TCP proxy for provider outbound connections)
        - src/scheduler.rs (Scheduled task system: cron-like recurring tasks)
        - src/microservice_proxy.rs (Microservice routing, HTTP proxy, health aggregation)
        - src/overview.rs (Overview endpoint, node/task/service summary, load test)
      - dev-frontend-proxy/ (Main-server nginx proxy exposing D601 `frontend-dev` on the dev public port)
        - Dockerfile
        - nginx.conf
      - frontend/ (Frontend web application container)
        - package.json
        - tsconfig.json
        - Dockerfile
        - src/index.ts (Bun static server, login/session handling, and same-origin internal API proxy)
        - src/app.tsx (TypeScript + React browser app shell, login, global data loading, and route dispatcher; `/app.js` is generated by Bun at runtime)
        - src/todo-note.tsx (Todo Note user-service React page; do not fold back into `app.tsx`)
        - src/findjob.tsx (FindJob user-service React page; do not fold back into `app.tsx`)
        - src/pipeline.tsx (Pipeline user-service React page and React Flow control graph; do not fold back into `app.tsx`)
        - src/met-nonlinear.tsx (MET Nonlinear D601 training orchestration React page; do not fold back into `app.tsx`)
        - src/code-queue.tsx (Code Queue user-service React page; do not fold back into `app.tsx`)
        - src/oa-event-flow.tsx (Unified OA event flow and Trace/STEP stats React page; do not fold back into `app.tsx`)
        - src/decision-center.tsx (Decision Center records dashboard; do not fold back into `app.tsx`)
        - src/k3sctl.tsx (k3s Control Plane React page backed only by `k3sctl-adapter`; do not fold back into `app.tsx`)
        - public/ (HTML/CSS static assets for the compact industrial console; no handwritten app JS)
      - provider-gateway/ (Compute node Provider Gateway container)
        - package.json
        - tsconfig.json
        - Dockerfile
        - src/index.ts (WebSocket client, heartbeat, system/Docker telemetry, Docker adapter, provider.upgrade handler, Host SSH / WSL SSH maintenance probe)
        - scripts/host-ssh-shell.sh (Optional maintenance-only SSH bridge)
      - database/ (PostgreSQL initialization and configuration)
        - config/postgresql.conf
        - init/001_unidesk_init.sql
      - microservices/ (UniDesk-owned user services and compatibility examples)
        - code-queue/ (Codex/OpenCode execution plane backend; k3s-managed on D601)
        - code-queue-mgr/ (Lightweight master-side Code Queue control plane; PostgreSQL CRUD/read path only)
        - oa-event-flow/ (Unified OA event ledger, tag stream, and Trace/STEP stats center)
        - decision-center/ (Decision records backend; k3s-managed on D601 and PostgreSQL-backed)
        - k3sctl-adapter/ (D601 k3s control-plane adapter and managed service manifests)
          - k3s/ci/ (Tekton CI install marker, Pipeline/Task, and in-cluster Trigger manifests)
        - example-service/