June turned the operating contracts introduced in May into active control loops. Cluster components began reporting live runtime state, control planes gained explicit reconciliation actions, route changes moved closer to event-driven updates, and several services added authenticated read-only MCP surfaces.

The May update focused on App Store contracts, gateway ownership, MFA, and release tooling. June connected those boundaries to the processes that perform updates, move workloads, inspect health, deliver mail, and expose operational state without handing out broad write access.

The version references below come from public code.foss.global tags and changelogs, public Gitea release records, and npm publication timestamps between June 1 and June 30, 2026. A public tag records released source, but it does not prove a production rollout. This update makes no deployment or adoption claims.

serve.zone: reconciliation becomes a live control loop

The largest June thread was the control path between Cloudly, Coreflow, Spark, CoreTraffic, and the workloads they manage.

Cloudly receives live runtime state. The public Cloudly changelog advanced from 6.4.4 to 8.22.0 during June. The 8.x line added runtime deployment snapshots, live node metrics, routed deployment details, interactive shells, log streaming, archived deployment records, service migration orchestration, live health views, and operator-triggered service update actions. The useful change is the data path: node-reported state can now drive a control-plane view and an explicit action instead of remaining a periodic status record.

Coreflow reacts to events. Coreflow 2.x introduced deployment snapshot reporting, workload placement controls, log and shell handlers, Corestore inventory access, current routing retrieval, and base-service reconciliation. The 2.15.0 event bus uses one filtered Docker event stream per node and fans container lifecycle events out to health and routing consumers. Periodic inventory and routing passes remain as safety nets, but they are no longer the only trigger.

Health and resource reporting move into the runtime. Coreflow 2.14 replaced per-container Docker health-check execution with an in-process prober and added live per-deployment resource usage. Follow-up releases made the prober event-driven and moved resource sampling away from repeated full container listings. Spark 1.8.0, published as a public Gitea release on June 18, added Cloudly-triggered managed-service updates and structured update results alongside runtime information in heartbeat payloads.

Update ownership becomes explicit. Cloudly 8.18 can request serve.zone service updates and display their status. Coreflow 2.16 handles base-service reconciliation requests and uses image-aware update checks. Spark skips its scheduled service-update path when it is running in the Coreflow node mode, leaving Cloudly to trigger the operation. That removes two actors independently deciding when the same managed service should change.

Ecosystem note. Cloudly is the cluster control plane, Coreflow manages workloads on cluster nodes, Spark owns the node-side service lifecycle, and CoreTraffic carries routed traffic. June's work made the handoff between those components observable and request-driven.

Corestore and Onebox consolidate the storage boundary

May added tenant-aware database and object-storage operations. June moved more of the hosted runtime behind a single storage service boundary.

Onebox 4.1.0 and 4.2.0 added SmartStorage-backed S3 provisioning and a migration path from the older MinIO platform service. The tagged 4.2.0 changelog marks that unification complete for the Onebox platform model. Onebox 5.0.0 then renamed its SmartProxy platform integration to CoreTraffic and added migration logic for persisted service records and settings. These are tagged source changes; the public record does not establish where either migration has been run.

Corestore 1.1.0 through 1.4.0 added archive manifests, object transfer endpoints, pruning with dry-run support, serialized archive operations, and host-path reporting for its Docker volume plugin. Cloudly 8.9 added Corestore inventory views, while the June backup line added node archive pruning and an external offload tier. Together, those contracts let a control plane inspect stored resources and move archive objects without reaching around Corestore's API.

The underlying npm packages also received narrow correctness work. @push.rocks/smartdb 2.11.0 bounded its in-memory oplog, checkpoints the write-ahead log during runtime, and serializes writes per collection namespace so concurrent unique-key writes cannot both pass the pre-check. Version 2.11.1 allows read-write tenants to perform collection-level DDL within their own database while keeping database-administration commands separate.

@push.rocks/smartstorage 6.5.6 made S3 client discovery compatible with scoped tenant credentials by allowing bucket listing while filtering the result to the credential's assigned bucket. The result is a tighter storage boundary: Corestore owns archive and volume operations, while SmartDB and SmartStorage enforce database and bucket scope below it.

Edge transport adds HTTP/3 WebSockets and DNS-over-TCP

June's edge work concentrated on protocol completeness and long-lived connection behavior.

@push.rocks/smartproxy moved from 27.12.3 to 27.17.5 on npm during the month. Version 27.17.0 added WebSocket over HTTP/3 using RFC 9220 Extended CONNECT on both frontend and backend paths. The follow-up releases added QUIC keep-alives, protected active H3 WebSocket streams from connection-pool age rotation, stabilized route cancellation during hot reload, and cleaned idle QUIC relay sessions on a timer.

The same release line changed certificate work from route-update side effects into bounded maintenance. Version 27.16.0 skips still-valid certificates during provisioning sweeps, coalesces concurrent sweeps, applies per-domain failure cooldowns, and runs periodic renewal checks. CoreTraffic 1.2.0 exposed HTTP/3 on service routes, and DcRouter consumed the SmartProxy 27.17 line in its public June releases.

RemoteIngress 4.25.0 added policy-controlled outbound TCP proxy sessions over QUIC. Earlier June releases fixed same-stream frame ordering and TCP half-close behavior, then switched the Rust build to static Linux binaries where its dependency set permits that.

DNS gained a missing transport path. @push.rocks/smartdns 7.11.0 added RFC 7766 length-prefixed DNS-over-TCP listeners alongside UDP and HTTPS lifecycle handling. Version 7.11.2 fixed TXT records longer than 255 bytes by splitting them into valid chunks without breaking UTF-8 boundaries. DcRouter 15.5.0 integrated the TCP listener and tightened DNS cleanup. The existing SmartDNS architecture dispatch covers the TypeScript and Rust split behind those listeners.

Ecosystem note. SmartProxy, SmartDNS, and RemoteIngress are push.rocks and serve.zone transport components. Their June releases were public package or Gitea releases; no specific network layout or rollout is implied here.

Service mail becomes a typed platform contract

Mail work crossed the gateway, service interfaces, platform client, MTA, and Cloudly control plane instead of landing as an isolated SMTP feature.

DcRouter 14.1.0 introduced shared WorkApp mail-address binding APIs. The 15.4 and 15.6 lines added managed outbound credentials, sender enforcement, typed inbound endpoint registration, typed outbound submission, and spool dispatch to registered service endpoints. Cloudly 8.21 synchronized service mail bindings through DcRouter, and 8.22 added typed endpoint targets and scoped API credentials. @serve.zone/platformclient 2.0.0 switched its service-mail integration to that typed transport.

The lower mail packages tightened acceptance and delivery rules. @push.rocks/smartmta 6.0.0 enabled recipient validation by default and required explicit relay permission for non-local recipients. It also waits for policy and consumer acceptance before returning SMTP success. Version 6.1.0 made the implicit TLS listener port configurable, and 6.3.0 added one-shot outbound connection proxies while preserving the logical SMTP destination for protocol checks.

@push.rocks/smartsmtp 4.0.0 replaced its Nodemailer-backed transport with a native SMTP client for relay and sendmail delivery. Version 3.1.0 had already added explicit SMTP port and TLS-mode selection. These releases give hosted services a typed submission path at the platform boundary and stricter SMTP behavior underneath it.

MCP arrives as a read-only operations surface

@push.rocks/smartmcp 0.2.0 was published to npm on June 20 with HTTP server handling, authorization hooks, tool registration, response redaction, client connections, and aggregated tool access.

The following day, public changelogs added authenticated MCP endpoints to Cloudly 8.20.0, Onebox 5.0.0, DcRouter 15.3.0, and CallRouter 1.30.0. The tools are deliberately read-only. They expose summaries of resources each service already owns, while the Onebox and CallRouter contracts explicitly omit sensitive fields. Authentication stays with the service instead of becoming a second MCP-specific account system.

This is a narrower interface than an unrestricted agent shell. Cloudly can summarize clusters, services, deployments, domains, and nodes. Onebox covers services, domains, and platform services. DcRouter exposes operational summaries. CallRouter covers runtime, providers, devices, routes, active calls, voicemail, and fax state. None of those June MCP endpoints claims write access.

CallRouter's 1.29.1 tag also added a mediasoup SFU engine bootstrap with worker and room lifecycle scaffolding. The changelog calls it a bootstrap, and the public evidence supports that wording. It does not establish a finished multiparty calling workflow. The CallRouter architecture dispatch remains the fuller description of the released SIP, WebRTC, and media-engine boundary.

idp.global tightens the contracts around authentication

May introduced MFA and passkeys across the idp.global interfaces, SDK, catalog, and application. June concentrated on token handling, OIDC requirements, data exposure, and service-to-service authorization.

The public @idp.global/interfaces npm line moved through major versions 2 to 7, while @idp.global/sdk published versions 2 through 6. These were coordinated breaking changes rather than routine dependency bumps:

  • OIDC authorization-code requests now require PKCE challenge parameters, and token requests require the verifier.
  • Refresh-token contracts carry family identifiers for rotation tracking.
  • Invitation contracts separate public data from persisted records and keep token hashes on the record side.
  • Typed API responses use sanitized DTOs instead of returning persistence models.
  • The backend-service socket tag and JWT validation APIs replace older service labels and request shapes.

The public idp.global app tags followed those contracts. The 4.0.0 line enforced PKCE and refresh-token rotation. Version 5.0.0 switched reception responses to DTOs, 5.0.2 rejected expired persisted JWTs during server-side validation, and 6.0.1 centralized required-token and required-user checks across reception handlers. The CLI moved saved credentials into the operating-system keyring, while SDK 5.0.1 removes transfer tokens from browser URLs before exchange.

Version 6.1.0 added liveness and readiness endpoints with readiness held until Reception startup completes. These are public tagged capabilities. They do not say where the service runs or which version is active in any environment.

GitZone turns deployment and native builds into repeatable artifacts

GitZone's June releases focused on two questions: how a developer can inspect and execute a deployment safely, and how packages with native code produce portable artifacts without custom repository scripts.

@git.zone/tsdeploy published 0.2.0 through 1.0.0 on npm. The first release provided non-mutating profile, project-link, status, doctor, and plan commands. Version 0.3.0 added the Cloudly workload deployment flow, 0.4.0 required a clean Git worktree before mutable deployments unless explicitly overridden, and 1.0.0 encrypted saved profile tokens through SmartConfig's SSH-agent secret store. It also resolves the expected registry target before a push and rejects mismatched image overrides.

@git.zone/tsrust 1.4.0 added verified static Linux builds. Version 1.5.0 added configurable Rust flags and deterministic source-path remapping, and 1.6.0 added a managed Cargo target cache with guarded pruning. SmartProxy, SmartDNS, SmartMTA, SmartDB, SmartStorage, RemoteIngress, and several smaller packages adopted the static build option in their June changelogs.

The exception is useful: CallRouter documented that its current native media dependency chain still requires a glibc runtime. June did not pretend every Rust binary could use the same linkage mode. The shared tooling now supports static builds where the dependency graph allows them and leaves dynamically linked packages explicit.

@git.zone/tspm 5.15 added self-contained Linux x64 and arm64 release assets, with public Gitea releases and checksums. The same June line added POSIX user and group identities for managed processes and a compile-time V8 heap cap for the binaries. @git.zone/tsdocker 2.5.0 added marker-guarded registry-cache pruning with dry-run output, following 2.4.x work that moved OCI blob copies to resumable chunked uploads.

TypedServer and dees-catalog update the operator surface

The runtime and control-plane changes needed corresponding API and UI primitives.

@api.global/typedserver 8.5.0 added a built-in health endpoint with registered checks. Version 8.5.3 cleans dynamic routes during shutdown, which matters for services that register and replace routes at runtime. The 8.6 line added stable dashboard seed data for inactive service workers and explicit inactive, degraded, and error states.

@design.estate/dees-catalog published 3.84.0 through 3.90.0. June moved component styling onto shared theme tokens, added PTY-aware process support to the workspace terminal, corrected overlay and menu behavior, and removed FontAwesome from dees-icon in favor of Lucide-only rendering. The terminal change supports the interactive workspace paths added to the hosting tools; the token work keeps the expanding operator dashboards on one theme contract.

What June changed

June put feedback paths behind the contracts established in May. Coreflow reacts to runtime events. Spark reports structured update outcomes. Cloudly can request reconciliation and display live health. Corestore owns archive movement and pruning. CoreTraffic and SmartProxy carry HTTP/3 WebSockets, while SmartDNS answers over TCP.

The platform boundary also became easier to consume safely. Service mail has typed endpoint and submission contracts. MCP endpoints expose authenticated read-only summaries. idp.global separates DTOs from persisted records and requires stronger OIDC token flows. GitZone tools turn deployment plans, native builds, and release binaries into checked workflows.

The public record shows npm publications, Gitea releases, and tagged source work. It does not show production rollout, customer use, or private infrastructure state, and none is inferred here.

Sources: public code.foss.global repositories and tagged changelogs, public Gitea release records, and public npm publication metadata for June 1-30, 2026. No private deployment, customer, telemetry, incident, or environment data is included.

code.foss.global is hosted by Task Venture Capital GmbH, Bremen, Germany.