feat: add the tool-interaction layer and foundryctl melt

cmd/foundryctl/cast.go

@@ -9,6 +9,7 @@ import (
 	"github.com/signoz/foundry/internal/domain"
 	"github.com/signoz/foundry/internal/errors"
 	"github.com/signoz/foundry/internal/foundry"
+	"github.com/signoz/foundry/internal/tooler"
 	"github.com/spf13/cobra"
 )
 
@@ -19,6 +20,10 @@ func registerCastCmd(rootCmd *cobra.Command) {
 		RunE: recoverRunE(domain.EventCast, func(cmd *cobra.Command, args []string, report reporter) error {
 			ctx := cmd.Context()
 
+			if castCfg.Yes {
+				ctx = tooler.WithApproval(ctx)
+			}
+
 			// A document the inner stages pass is prepared, not cast, so
 			// only their failures report.
 			prepReport := reporter(func(props domain.Properties, err error) {

cmd/foundryctl/config.go

@@ -12,6 +12,9 @@ var (
 	// Stores cast configuration.
 	castCfg castConfig
 
+	// Stores melt configuration.
+	meltCfg meltConfig
+
 	// Stores catalog configuration.
 	catalogCfg catalogConfig
 )
@@ -43,11 +46,21 @@ func (c *poursConfig) RegisterFlags(cmd *cobra.Command) {
 type castConfig struct {
 	NoGauge bool
 	NoForge bool
+	Yes     bool
+}
+
+type meltConfig struct {
+	Yes bool
+}
+
+func (c *meltConfig) RegisterFlags(cmd *cobra.Command) {
+	cmd.PersistentFlags().BoolVar(&c.Yes, "yes", false, "Confirm the verbs that change infrastructure.")
 }
 
 func (c *castConfig) RegisterFlags(cmd *cobra.Command) {
 	cmd.PersistentFlags().BoolVar(&c.NoGauge, "no-gauge", false, "Do not run gauge before forge and cast.")
 	cmd.PersistentFlags().BoolVar(&c.NoForge, "no-forge", false, "Do not run forge before cast.")
+	cmd.PersistentFlags().BoolVar(&c.Yes, "yes", false, "Confirm the verbs that change infrastructure.")
 }
 
 type catalogConfig struct {

cmd/foundryctl/main.go

@@ -1,14 +1,18 @@
 package main
 
 import (
+	"context"
 	"os"
+	"os/signal"
+	"syscall"
 
 	foundryerrors "github.com/signoz/foundry/internal/errors"
 	"github.com/signoz/foundry/internal/version"
 	"github.com/spf13/cobra"
 )
 
 func main() {
+
 	rootCmd := &cobra.Command{
 		Use:          "foundryctl",
 		SilenceUsage: true,
@@ -26,11 +30,24 @@ func main() {
 	registerGaugeCmd(rootCmd)
 	registerForgeCmd(rootCmd)
 	registerCastCmd(rootCmd)
+	registerMeltCmd(rootCmd)
 	registerGenCmd(rootCmd)
 	registerCatalogCmd(rootCmd)
 	registerVersionCmd(rootCmd)
 
-	err := rootCmd.Execute()
+	// Foundry survives the interrupt to keep reading the tool's streams: dying
+	// here SIGPIPEs the tool mid-write. Exec'd tools get the kernel's copy
+	// directly; the cancelled context is the relay only for in-process SDK work.
+	// A second signal kills foundry by the OS default.
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	go func() {
+		<-ctx.Done()
+		stop()
+	}()
+
+	err := rootCmd.ExecuteContext(ctx)
 
 	if rootNotifier != nil {
 		rootNotifier.Finish(version.Info.Version(), os.Stderr)

cmd/foundryctl/melt.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"context"
+	"log/slog"
+	"path/filepath"
+	"slices"
+
+	"github.com/signoz/foundry/internal/domain"
+	foundryerrors "github.com/signoz/foundry/internal/errors"
+	"github.com/signoz/foundry/internal/foundry"
+	"github.com/signoz/foundry/internal/tooler"
+	"github.com/spf13/cobra"
+)
+
+func registerMeltCmd(rootCmd *cobra.Command) {
+	meltCmd := &cobra.Command{
+		Use:   "melt",
+		Short: "Remove the cast deployment",
+		Long:  "Remove the cast deployment from the target environment; data is never touched",
+		RunE: recoverRunE(domain.EventMelt, func(cmd *cobra.Command, args []string, report reporter) error {
+			ctx := cmd.Context()
+
+			if meltCfg.Yes {
+				ctx = tooler.WithApproval(ctx)
+			}
+
+			return runMelt(ctx, rootLogger, poursCfg.Path, commonCfg.File, report)
+		}),
+	}
+
+	rootCmd.AddCommand(meltCmd)
+	meltCfg.RegisterFlags(meltCmd)
+}
+
+func runMelt(ctx context.Context, logger *slog.Logger, poursPath string, configPath string, report reporter) error {
+	foundry, err := foundry.New(logger)
+	if err != nil {
+		return err
+	}
+
+	poursPath, err = filepath.Abs(poursPath)
+	if err != nil {
+		return foundryerrors.Wrapf(err, foundryerrors.TypeInternal, "failed to resolve pours path")
+	}
+
+	machineries, err := foundry.Config.GetV1Alpha1Lock(ctx, configPath)
+	if err != nil {
+		return err
+	}
+
+	// Backwards against the order the lock records, so a workload leaves
+	// before the substrate it runs on.
+	for _, machinery := range slices.Backward(machineries) {
+		if err := foundry.Melt(ctx, machinery, poursPath); err != nil {
+			report(machinery.TrackableProperties(), err)
+
+			return err
+		}
+
+		report(machinery.TrackableProperties(), nil)
+	}
+
+	return nil
+}

docs/examples/docker/compose-mcp/pours/deployment/compose.yaml

@@ -17,6 +17,10 @@ services:
     - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_DSN=tcp://signoz-telemetrystore-clickhouse-0-0:9000
     - SIGNOZ_OTEL_COLLECTOR_TIMEOUT=10m
     image: signoz/signoz-otel-collector:latest
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
       signoz-network:
         aliases:
@@ -36,6 +40,10 @@ services:
     - SIGNOZ_URL=http://signoz-signoz-0:8080
     - TRANSPORT_MODE=http
     image: signoz/signoz-mcp-server:latest
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
       signoz-network:
         aliases:
@@ -58,6 +66,10 @@ services:
       - pg_isready -U signoz -d signoz
       timeout: 10s
     image: postgres:16
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: unless-stopped
@@ -82,6 +94,10 @@ services:
       - http://localhost:8080/api/v1/health
       timeout: 10s
     image: signoz/signoz:latest
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     ports:
@@ -107,6 +123,10 @@ services:
       - ls
       timeout: 10s
     image: clickhouse/clickhouse-keeper:25.12.5
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: unless-stopped
@@ -135,6 +155,10 @@ services:
       - http://localhost:8123/ping
       timeout: 10s
     image: clickhouse/clickhouse-server:25.12.5
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: unless-stopped
@@ -158,6 +182,10 @@ services:
       mv histogram-quantile /var/lib/clickhouse/user_scripts/histogramQuantile
     container_name: signoz-telemetrystore-clickhouse-user-scripts
     image: clickhouse/clickhouse-server:25.12.5
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: on-failure
@@ -178,6 +206,10 @@ services:
     - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_DSN=tcp://signoz-telemetrystore-clickhouse-0-0:9000
     - SIGNOZ_OTEL_COLLECTOR_TIMEOUT=10m
     image: signoz/signoz-otel-collector:latest
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: on-failure

docs/examples/docker/compose/pours/deployment/compose.yaml

@@ -17,6 +17,10 @@ services:
     - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_DSN=tcp://signoz-telemetrystore-clickhouse-0-0:9000
     - SIGNOZ_OTEL_COLLECTOR_TIMEOUT=10m
     image: signoz/signoz-otel-collector:latest
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
       signoz-network:
         aliases:
@@ -43,6 +47,10 @@ services:
       - pg_isready -U signoz -d signoz
       timeout: 10s
     image: postgres:16
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: unless-stopped
@@ -67,6 +75,10 @@ services:
       - http://localhost:8080/api/v1/health
       timeout: 10s
     image: signoz/signoz:latest
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     ports:
@@ -92,6 +104,10 @@ services:
       - ls
       timeout: 10s
     image: clickhouse/clickhouse-keeper:25.12.5
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: unless-stopped
@@ -120,6 +136,10 @@ services:
       - http://localhost:8123/ping
       timeout: 10s
     image: clickhouse/clickhouse-server:25.12.5
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: unless-stopped
@@ -143,6 +163,10 @@ services:
       mv histogram-quantile /var/lib/clickhouse/user_scripts/histogramQuantile
     container_name: signoz-telemetrystore-clickhouse-user-scripts
     image: clickhouse/clickhouse-server:25.12.5
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: on-failure
@@ -163,6 +187,10 @@ services:
     - SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_DSN=tcp://signoz-telemetrystore-clickhouse-0-0:9000
     - SIGNOZ_OTEL_COLLECTOR_TIMEOUT=10m
     image: signoz/signoz-otel-collector:latest
+    labels:
+      foundry.signoz.io/kind: Installation
+      foundry.signoz.io/managed-by: foundry
+      foundry.signoz.io/name: signoz
     networks:
     - signoz-network
     restart: on-failure

docs/examples/kubernetes/kustomize/pours/deployment/kustomization.yaml

@@ -1,5 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+labels:
+- includeSelectors: false
+  pairs:
+    foundry.signoz.io/kind: Installation
+    foundry.signoz.io/managed-by: foundry
+    foundry.signoz.io/name: signoz
 namespace: signoz
 resources:
 - namespace.yaml

go.mod

@@ -16,9 +16,13 @@ require (
 	github.com/tidwall/gjson v1.18.0
 	go.yaml.in/yaml/v3 v3.0.4
 	golang.org/x/mod v0.35.0
+	golang.org/x/oauth2 v0.36.0
 	gopkg.in/ini.v1 v1.67.1
 	helm.sh/helm/v3 v3.20.2
 	k8s.io/apimachinery v0.35.1
+	k8s.io/cli-runtime v0.35.1
+	k8s.io/client-go v0.35.1
+	sigs.k8s.io/kustomize/api v0.20.1
 	sigs.k8s.io/kustomize/kyaml v0.21.1
 	sigs.k8s.io/yaml v1.6.0
 )
@@ -109,7 +113,6 @@ require (
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/term v0.43.0 // indirect
@@ -124,16 +127,13 @@ require (
 	k8s.io/api v0.35.1 // indirect
 	k8s.io/apiextensions-apiserver v0.35.1 // indirect
 	k8s.io/apiserver v0.35.1 // indirect
-	k8s.io/cli-runtime v0.35.1 // indirect
-	k8s.io/client-go v0.35.1 // indirect
 	k8s.io/component-base v0.35.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
 	k8s.io/kubectl v0.35.1 // indirect
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
 	oras.land/oras-go/v2 v2.6.2 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/kustomize/api v0.20.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 )

internal/casting/casting.go

@@ -6,6 +6,7 @@ import (
 	"github.com/signoz/foundry/api/v1alpha1/installation"
 	"github.com/signoz/foundry/internal/domain"
 	"github.com/signoz/foundry/internal/molding"
+	"github.com/signoz/foundry/internal/tooler"
 )
 
 // DeploymentDir is the subdirectory within the pours directory where
@@ -19,6 +20,11 @@ type Casting interface {
 	// Generates all the files needed for casting.
 	Forge(ctx context.Context, config installation.Casting, poursPath string) ([]domain.Material, error)
 
-	// Runs the forged files.
-	Cast(ctx context.Context, config installation.Casting, poursPath string) error
+	// Runs the forged files. Toolers are the tool interfaces the registry
+	// lists for this casting.
+	Cast(ctx context.Context, config installation.Casting, poursPath string, toolers []tooler.Tooler) error
+
+	// Removes what Cast deployed: definitions only, never data, never
+	// users, config stays.
+	Melt(ctx context.Context, config installation.Casting, poursPath string, toolers []tooler.Tooler) error
 }