Rainier v0.0.1

First tagged release of Rainier, the OSS control plane and runtime for cloud coding-agent sessions, at the end of the O9 program gates.

Public Go surface (import github.com/tokencanopy/rainier@v0.0.1, no replace needed)

• control — the frozen application contract: portable domain vocabulary, the caller-facing Sessions/Environments/Fleet/Attachments interfaces, and the narrow host ports (repositories, authorizer, pool resolver, runner transport, attachment broker, event recorder, unit of work, checkpoint locator, clock, IDs).
• controlapp — the portable services behind that contract: session lifecycle, environments, fleet truth and within-pool scheduling, attachment and workspace RPC. controlapp/repotest is the executable contract a host's repositories must pass.
• protocol/runner, protocol/terminal, protocol/workspace — the wire.

Self-hosted product: controld (Postgres, GitHub identity, credential vault), runnerd (Docker), sessiond, egressd, and the rainier CLI, composed over the same contract.

Since the recomposition

• Workspace scope is mandatory in persistence; runner, placement, and controller generations are stored and fenced (#35, #38).
• Every command commits its mutation and its event in one unit of work; pgstore writes an events table in the same transaction (#39, #40).
• Placement prefers the runner holding a cached snapshot and falls back to a rebuild elsewhere (#40).
• Runners announce portable capabilities and are answered with an accept carrying their generation; environments can require a capability (#40).
• Secrets are handed to daemons through the environment, never as flags (#33).

Schema: migrations 0001–0009 apply on controld start; back up before upgrading from a pre-0007 database.