Review an app suite

This canonical Manifest v3 example declares a completed preparation job, two workers, and a web service. Review total CPU/memory requests, limits, dependency and probe gates, and the host port before planning. Local admission must reserve the complete executable service set; it never silently discards unsupported fields.

version: 3
project: phase04-three-service
imagePolicy: require-digest

services:
  prepare:
    image: docker.io/library/python@sha256:26730869004e2b9c4b9ad09cab8625e81d256d1ce97e72df5520e806b1709f92
    resources:
      requests: {cpus: 1, memory: 256MiB}
      limits: {cpus: 1, memory: 256MiB}
    command: ["python3", "-c", "print('prepared')"]
    restart:
      policy: "no"

  worker:
    image: docker.io/library/python@sha256:26730869004e2b9c4b9ad09cab8625e81d256d1ce97e72df5520e806b1709f92
    resources:
      requests: {cpus: 1, memory: 512MiB}
      limits: {cpus: 1, memory: 512MiB}
    replicas: 2
    command: ["python3", "-c", "import time; time.sleep(3600)"]
    dependsOn:
      prepare: completed
    probes:
      startup:
        exec: ["python3", "-c", "raise SystemExit(0)"]
      readiness:
        exec: ["python3", "-c", "raise SystemExit(0)"]
      liveness:
        exec: ["python3", "-c", "raise SystemExit(0)"]
    update:
      strategy: rolling
      maxSurge: 1
      maxUnavailable: 1
      progressDeadline: 60s

  web:
    image: docker.io/library/python@sha256:26730869004e2b9c4b9ad09cab8625e81d256d1ce97e72df5520e806b1709f92
    resources:
      requests: {cpus: 1, memory: 512MiB}
      limits: {cpus: 1, memory: 512MiB}
    command: ["python3", "-m", "http.server", "8080", "--bind", "0.0.0.0"]
    dependsOn:
      worker: ready
    ports:
      - "18081:8080"
    probes:
      startup:
        exec: ["python3", "-c", "raise SystemExit(0)"]
      readiness:
        tcp:
          port: 8080
      liveness:
        http:
          port: 8080
          path: /
    update:
      strategy: recreate
      maxSurge: 0
      maxUnavailable: 1
      progressDeadline: 60s

Review and execute

Use a signed current-source candidate and start Apple container. Follow installation and daemon setup before running these commands: validation, planning, and lifecycle requests use the authenticated Control API. The public dev.12 package uses older contracts.

hostwright validate hostwright.yaml
hostwright image pull docker.io/library/python@sha256:26730869004e2b9c4b9ad09cab8625e81d256d1ce97e72df5520e806b1709f92 --platform linux/arm64 --runtime-provider apple-cli
hostwright plan hostwright.yaml --output json
hostwright runtime providers --json
hostwright up hostwright.yaml --dry-run --runtime-provider apple-cli --output json

validate and plan do not change the runtime. plan is a manifest-level plan; the lifecycle confirmation hash comes from the observed-runtime up --dry-run. Review its exact image, resource requests/limits, ownership, provider, and actions.

hostwright up hostwright.yaml --confirm-plan <planSHA256> --runtime-provider apple-cli
hostwright status hostwright.yaml --runtime-provider apple-cli --output json

Use the exact hash from the fresh dry run, with the same manifest, provider, and selected state path. If anything changes, review another dry run. Stopping and removing resources each require their own fresh dry-run hash:

hostwright down hostwright.yaml --dry-run --runtime-provider apple-cli
hostwright down hostwright.yaml --confirm-plan <down-planSHA256> --runtime-provider apple-cli
hostwright rm hostwright.yaml --dry-run --runtime-provider apple-cli
hostwright rm hostwright.yaml --confirm-plan <rm-planSHA256> --runtime-provider apple-cli

Only proven Hostwright-owned resources are eligible for removal. Preserve unmanaged workloads and inspect recovery after interruption.