Rebuild Piggy's interface, and give the demo book a business to describe

Piggy answered in raw markdown, threw away every tool result it streamed,
and fought the reader's scroll on every token. The three surfaces that
made it worth having — what it read, how it reasoned, what it cost — were
all on the wire and none of them reached the screen.

The transcript is now composed of five parts under components/piggy:
answers render through streamdown, the container sticks to the bottom
without pinning the reader there, tool steps say what they read and link
to the record, and each turn carries its model and token count. Three
lifecycle bugs went with them: Stop left a permanent spinner, a truncated
stream was indistinguishable from thinking, and a failed send destroyed
the message it failed to send.

Underneath, the inference path grew timeouts, jittered retries on 429 and
5xx, tolerance of the malformed frames a 30B model emits, and an
agent_runs row per turn so chat spend is observable. The system prompt now
states that a field ending in Cents is cents — without it nemotron renders
costPerGpuHourCents: 189 as "$189 per GPU-hour", which is a 100x error on
the most scrutinised number in the room.

The demo book was arithmetically incoherent: every deal's value
contradicted its own allocation revenue by up to 3.6x, nothing had ever
closed, no customer had any paper, and the marketplace was empty. Deal
value is now derived from the allocation, the book clears 5.3% across five
blocks with one deliberately underwater, and the renewal, compliance and
agent-provenance machinery finally has rows to act on. A --clear that
deleted every obligation, SLA term and capacity request in the database
regardless of origin is scoped to the demo's own ids.

Around that: accounts have a detail page, ⌘K searches the book, Settings
can mint the API keys it always claimed to, and deploy.sh actually ships
the agent instead of silently skipping its compose profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -55,6 +55,10 @@ trap 'rm -f "$0"' EXIT
 # because that is the tag a rollback re-points at the previous image.
 IMAGE_REF="${PIG_IMAGE:-pig:local}"
 
+# Which compose profiles are active. Set below, once .env has been read; empty
+# means none, which is what compose does by default anyway.
+COMPOSE_PROFILES=''
+
 # Every compose invocation goes through this. sudo's default `env_reset` drops
 # PIG_IMAGE, so a plain `sudo docker compose` interpolates the `pig:local`
 # fallback in docker-compose.yml instead of the release tag: the pull then fails
@@ -63,8 +67,15 @@ IMAGE_REF="${PIG_IMAGE:-pig:local}"
 # `pig:local` happens to be while the log reports the release. Pass it on the
 # command line via env(1): `sudo -E` and bare `sudo VAR=val` are both refused by
 # the default sudoers policy, `sudo env VAR=val …` is not.
+#
+# COMPOSE_PROFILES rides along for the same reason and needs it just as badly:
+# the piggy service is profile-gated, and compose ignores a profile-gated
+# service SILENTLY — `pull`, `build` and `up` behave as though it were not in
+# the file at all, with no warning and a zero exit. Carrying the profile here
+# rather than at each call site is what stops one forgotten flag leaving the
+# agent on the previous release.
 dc() {
-  sudo env PIG_IMAGE="$IMAGE_REF" docker compose -p pig "$@"
+  sudo env PIG_IMAGE="$IMAGE_REF" COMPOSE_PROFILES="$COMPOSE_PROFILES" docker compose -p pig "$@"
 }
 
 # Gate failures come in two kinds and the caller must be able to tell them
@@ -80,6 +91,35 @@ env_value() {
   sed -n "s/^[[:space:]]*$1=//p" .env | tail -n1 | sed -e 's/^"\(.*\)"$/\1/' -e "s/^'\(.*\)'\$/\1/"
 }
 
+# The same words the API accepts, from `envBoolean` in apps/api/src/lib/config.ts.
+# If this and that ever disagree, the CRM offers a chat surface backed by a
+# container this script never started.
+is_true() {
+  # Compose drops a whitespace-preceded inline comment before the container ever
+  # sees the value, so this has to as well: `PIGGY_ENABLED=true  # on` would
+  # otherwise read as false here and true there — the agent offered by the CRM
+  # and never deployed, which is the exact fault this whole path exists to end.
+  local value=${1%%[[:space:]]#*}
+  case "$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')" in
+    1 | true | yes | on) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Piggy is part of the release or it is not; there is no half-deployed state
+# worth having. Left out of the pull, the build, the `up` and the rollback, it
+# runs the PREVIOUS image against the schema this deploy just migrated — the
+# hazard docker-compose.yml's own comment warns about — or does not run at all
+# while the deploy reports success.
+DEPLOY_SERVICES=(app)
+PIGGY_IN_RELEASE=0
+if is_true "$(env_value PIGGY_ENABLED)"; then
+  COMPOSE_PROFILES='piggy'
+  DEPLOY_SERVICES+=(piggy)
+  PIGGY_IN_RELEASE=1
+  echo "==> Piggy is enabled; it ships with this release"
+fi
+
 if [ -n "${PIG_IMAGE:-}" ]; then
   echo "==> Deploying published image $PIG_IMAGE"
   # No git sync. The caller has already detached this checkout at the tag the
@@ -112,10 +152,10 @@ echo "    $BACKUP ($(du -h "$BACKUP" | cut -f1))"
 
 if [ -n "${PIG_IMAGE:-}" ]; then
   echo "==> Pulling"
-  dc pull app
+  dc pull "${DEPLOY_SERVICES[@]}"
 else
   echo "==> Building"
-  dc build app
+  dc build "${DEPLOY_SERVICES[@]}"
 fi
 
 echo "==> Starting the database"
@@ -161,7 +201,10 @@ roll_back() {
 
   echo "==> Rolling back to $PREVIOUS_IMAGE"
   sudo docker tag "$PREVIOUS_IMAGE" "$IMAGE_REF"
-  dc up -d --no-build app
+  # Piggy included: app and piggy are one image running two commands, and a
+  # rollback that restores only the app leaves the two halves of the same
+  # release on different code.
+  dc up -d --no-build "${DEPLOY_SERVICES[@]}"
 
   for _ in $(seq 1 60); do
     if curl -sf http://127.0.0.1:8920/api/health > /dev/null; then break; fi
@@ -178,7 +221,7 @@ roll_back() {
 }
 
 echo "==> Starting the app"
-dc up -d app
+dc up -d "${DEPLOY_SERVICES[@]}"
 
 echo "==> Waiting for health"
 for _ in $(seq 1 60); do
@@ -203,6 +246,60 @@ if [ "$CODE" != "401" ]; then
 fi
 echo "    auth enforced"
 
+if [ "$PIGGY_IN_RELEASE" = '1' ]; then
+  echo "==> Verifying Piggy"
+  PIGGY_CID=$(dc ps -q piggy 2>/dev/null | head -n1 || true)
+  if [ -z "$PIGGY_CID" ]; then
+    echo "    PIGGY IS ENABLED IN .env BUT NO PIGGY CONTAINER IS RUNNING"
+    roll_back "piggy is enabled but no piggy container is running"
+  fi
+
+  # Image IDs, not tags. The failure this catches is a Piggy someone started by
+  # hand once and never touched again: it answers to the same tag while running
+  # whatever that tag meant on the day, so a tag comparison sees nothing wrong
+  # and the old agent goes on writing to a schema three migrations newer.
+  WANTED_IMAGE_ID=$(sudo docker image inspect -f '{{.Id}}' "$IMAGE_REF" 2>/dev/null || true)
+  PIGGY_IMAGE_ID=$(sudo docker inspect -f '{{.Image}}' "$PIGGY_CID" 2>/dev/null || true)
+  if [ -z "$WANTED_IMAGE_ID" ] || [ "$PIGGY_IMAGE_ID" != "$WANTED_IMAGE_ID" ]; then
+    echo "    PIGGY IS RUNNING ${PIGGY_IMAGE_ID:-<unknown>}, EXPECTED ${WANTED_IMAGE_ID:-<unknown>}"
+    roll_back "piggy is not running $IMAGE_REF"
+  fi
+  echo "    piggy on $IMAGE_REF"
+
+  # `starting` until the first probe answers, so this is a wait, not a poll of
+  # something already decided. start_period is 20s and the interval 30s, hence
+  # the longer budget than the app's.
+  PIGGY_HEALTH=''
+  for _ in $(seq 1 90); do
+    PIGGY_HEALTH=$(sudo docker inspect \
+      -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' \
+      "$PIGGY_CID" 2>/dev/null || true)
+    [ "$PIGGY_HEALTH" = 'starting' ] || break
+    sleep 1
+  done
+
+  if [ "$PIGGY_HEALTH" = 'healthy' ]; then
+    echo "    piggy healthy"
+  elif [ "$PIGGY_HEALTH" = 'none' ]; then
+    # Only reachable from a container created by an older compose file, since
+    # this one defines a healthcheck for the service. Worth saying rather than
+    # passing quietly, because "no result" is not "well".
+    echo "    piggy has no healthcheck to consult; recreate it to get one" >&2
+  else
+    echo "    PIGGY IS ${PIGGY_HEALTH:-UNKNOWN}" >&2
+    dc logs piggy --tail 40 || true
+    # Deliberately no rollback, for the same reason the empty-body case below
+    # does not: the previous image reads this same .env and fails identically,
+    # so restoring it churns the CRM without fixing the agent. The CRM is live
+    # and well; the agent the operator asked for is not.
+    echo "    The CRM is serving. Piggy is not, and a rollback would not help:" >&2
+    echo "    the previous image reads the same .env. The usual cause is a" >&2
+    echo "    missing or rejected PIGGY_INFERENCE_API_KEY, which crash-loops" >&2
+    echo "    the worker at boot before it can serve anything." >&2
+    exit "$EXIT_STILL_LIVE"
+  fi
+fi
+
 # Everything above proves the container is well. It proves nothing about what
 # the public actually gets, and there is a failure on this host that every
 # check so far passes: a Caddy site block missing `bind 10.0.0.2` lands in a