> ## Documentation Index
> Fetch the complete documentation index at: https://tesser.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Prior Art

Research date: 2026-07-22.

Primary sources were the public Crabbox, Coder, Daytona, and DevPod repositories
and their first-party documentation.

## Crabbox

Crabbox is strongest as a reference for short-lived remote execution, not as a
shared development workspace.

Useful mechanisms:

* A coordinator owns provider credentials, leases, TTLs, cost, and cleanup;
  ordinary SSH/rsync traffic goes directly between CLI and runner.
* Expiry is `min(created + hard TTL, last activity + idle timeout)`
  (`openclaw/crabbox/worker/src/fleet.ts:17957-17969`).
* Cleanup uses claims/fencing and verifies provider resource identity before
  deletion (`worker/src/fleet.ts:12062-12198`).
* Git seeding plus a dirty-worktree overlay avoids full transfers while keeping
  deletion bounded (`internal/cli/repo.go:286-326`,
  `internal/cli/ssh.go:1540-1765`).
* Loopback services are exposed with short-lived tickets rather than public
  runner ports.

Important mismatch: a claim belongs to one local repository, sync is one-way,
commands depend on the invoking CLI, and sharing does not grant the creator's
SSH key. It has no first-class three-component route selection.

Source: [https://github.com/openclaw/crabbox](https://github.com/openclaw/crabbox)

## Coder

Coder is the best source reference for a mature workspace control plane.

Useful mechanisms:

* Provisioning success is separate from agent connection, lifecycle, health,
  and application readiness
  (`coder/coder/codersdk/workspaceagents.go:20-87,139-215`).
* A workspace agent connects outbound, reconnects with backoff, and multiplexes
  control and data streams over one WebSocket
  (`codersdk/agentsdk/agentsdk.go:365-423`, `agent/agent.go:1167-1271`).
* App routes are RBAC checked, health aware, and isolated on wildcard
  subdomains (`coderd/workspaceapps/db.go:270-364`).
* Durable logs use monotonic cursors; pub/sub only wakes readers, which then
  fetch authoritative rows (`coderd/provisionerjobs.go:534-640`).
* Prebuilt workspaces are unowned until claim and only become eligible after
  complete readiness (`docs/admin/templates/extending-templates/prebuilt-workspaces.md`).
* Autostop, dormancy, and deletion are separate lifecycle policies with locked,
  transactional reconciliation (`coderd/autobuild/lifecycle_executor.go:170-440`).

Important mismatch: Coder models arbitrary Terraform workspaces. Repository
composition and component compatibility are template conventions, while
devcloud needs dashboard, client, and backend to be explicit independently
selectable components.

Source: [https://github.com/coder/coder](https://github.com/coder/coder)

## Daytona

Daytona is both prior art and an existing Mintlify integration.

Useful mechanisms:

* Desired state and observed state are persisted separately
  (`daytonaio/daytona@v0.190.0/apps/api/src/sandbox/entities/sandbox.entity.ts:93-105`).
* PostgreSQL is the durable job source; Redis only wakes runners
  (`apps/api/src/sandbox/services/job.service.ts:54-233`).
* Per-resource locks, optimistic conditions, and fencing protect state changes
  (`apps/api/src/sandbox/managers/sandbox.manager.ts:1003-1118`).
* Toolbox separates structured commands, stateful sessions, PTYs, files, Git,
  and port detection behind an authenticated proxy.
* Session commands write output and exit state to disk and support WebSocket
  following (`apps/daemon/pkg/session/execute.go`, `log.go`).
* Preview routing and activity updates are handled outside the sandbox app.
* Auto-stop, archive, and delete are independent policies.

Important mismatch: current hosted development moved to a private codebase in
June 2026, so public source is historical. Current service limits, persistence,
networking, and pricing need hands-on verification.

Source: [https://github.com/daytonaio/daytona/tree/v0.190.0](https://github.com/daytonaio/daytona/tree/v0.190.0)

## DevPod

DevPod is strongest as a runtime transport toolkit.

Useful mechanisms:

* Providers need a small command/lifecycle adapter surface.
* A client-shipped agent layers SSH and gRPC over provider stdin/stdout, so the
  provider does not need inbound SSH.
* Content-addressed devcontainer prebuilds and registry caches are portable
  between providers (`loft-sh/devpod/pkg/devcontainer/config/prebuild.go:18-84`).
* Machine ownership and workspace ownership are separate, avoiding accidental
  deletion of shared machines.

Important mismatch: the open-source product is deliberately local-authoritative.
It uses filesystem locks, client credentials, session-bound tunnels, and
non-durable logs. Those are not a collaborative control plane.

Source: [https://github.com/loft-sh/devpod](https://github.com/loft-sh/devpod)

## Synthesis

The common shape worth carrying forward is:

1. A control plane owns box identity, desired state, access, leases, and provider
   credentials.
2. A box agent connects outbound and reconciles an explicit component manifest.
3. Long-running components and ad hoc command runs are separate objects.
4. HTTP/WebSocket routes are authenticated outside the component process.
5. Logs are sequenced and durable; live streams are reconnectable views.
6. A box can stop independently of its retained checkout/cache state.
7. Warm capacity has no developer credentials or revision until it is claimed.