todo.md

• plugins job to check released versions
• cluster mode with ovn
• config in dqlite
• docs guide: dokploy
• openclaw and hermes guide advanced addition: add memories and artifacts data storing on storage box
• remove terrarium profile, add kvm profile

Smoke stabilization review queue

• P1: Fix route group authorization generation so @auth:group creates oauth2-proxy configs with enforced allowed_groups instead of passing policy via a Traefik query string.
• P1: Make denied-route browser assertions fail immediately when the denied user reaches the protected app body.
• P1: Preserve browser timeout diagnostics, including current step, URL, body snippet, and screenshot/trace.
• P1: Make terrariumctl proxy sync fail non-zero on route-auth/client/compose errors and verify route-auth listeners after compose.
• P1: Persist integration cloud resources to a manifest and add idempotent cleanup for app restarts/interrupted runs.
• P2: Delay/guard Traefik sync timer startup until LXD, ZITADEL, and oauth2 prerequisites are ready.
• P2: Replace heuristic LXD snap readiness polling with a deterministic snap/LXD readiness gate.
• P2: Improve artifact collection with route-auth compose/logs/probes and reduce noisy tar/SSH warnings.
• P2: Make ZITADEL Cloud preflight/cleanup fail fast and use the same org-scoped API helper.
• P3: Harden HTTP assertion status parsing for redirect-heavy flows.
• P2: Retry bounded idempotent SSH reads so transient transport failures do not abort a healthy smoke run.
• P2: Retry Hetzner locked volume detach/delete states during cleanup.
• P2: Select ZITADEL account cards with browser-like coordinate clicks when the login flow lands on account selection.
• P3: Use ZITADEL project deletion as the fixture cleanup boundary instead of noisy per-app deletes.
• P1: Give the denied ZITADEL fixture user a non-allowed project role so OAuth completes and route auth performs the denial.