tada5hi · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
diff --git a/.agents/architecture.md b/.agents/architecture.md
@@ -3,7 +3,7 @@
 `DESIGN.md` is the authoritative rationale. This file is the compact list of
 operational invariants that template changes must preserve.
 
-## Authup beta.64 runtime contract
+## Authup runtime contract (through beta.68)
 
 1. **One image, explicit roles.** The supported default args are `start` for the
    combined server, `start core` for the split API, `start console auth|admin|account`
@@ -15,9 +15,10 @@ operational invariants that template changes must preserve.
    Deployments. The auth console is required in split mode because it owns login;
    admin and account remain independently optional.
 3. **Role ports come from Authup.** Core listens on 3000. Split auth, admin and
-   account consoles listen on 3020, 3021 and 3022. The worker has no listener,
-   Service, or HTTP probe.
-4. **Worker ownership is explicit.** `worker.enabled=true` sets
+   account consoles listen on 3020, 3021 and 3022. The worker health listener
+   uses `worker.containerPorts.http` (3000), wired to `WORKER_PORT` and an HTTP
+   readiness probe. It has no Service or liveness probe.
+4. **Worker ownership is explicit.** `worker.enabled=true` (the default) sets
    `WORKER_ENABLED=true` on the worker and `WORKER_ENABLED=false` on the server.
    The worker gets database and Redis credentials, but not SMTP, bootstrap
    identity secrets, migrations, or console secrets. It requires the server

diff --git a/.agents/references/authup.md b/.agents/references/authup.md
@@ -1,9 +1,32 @@
 # authup application mapping
 
 Repository: https://github.com/authup/authup. A local checkout commonly exists
-at `/opt/projects/authup/authup`. This mapping is pinned to v1.0.0-beta.67, the
+at `/opt/projects/authup/authup`. This mapping is pinned to v1.0.0-beta.68, the
 chart `appVersion`.
 
+Verified against tag commit `114f1bbc2dd16eb8be859e56e683b2fc9cd226b5`.
+Beta.68 adds the worker health listener:
+
+- `apps/server-core/src/app/modules/components/health.ts` serves `GET /` and
+  `HEAD /` with 200/503; other paths return 404. `app/factory.ts` includes this
+  module only for the worker role, after database schema verification.
+- `packages/server-config/src/sections/core/schema.ts` reads `WORKER_PORT`
+  (`core.worker.port`), falling back to `PORT` when unset. The listener binds
+  `core.host`. The chart sets `WORKER_PORT` from `worker.containerPorts.http`
+  so the listener and named readiness port agree even with shared config.
+- `components/module.ts` reports a sweep overdue after five minutes without a
+  successful pass (including the startup allowance), or after a running pass
+  exceeds 30 minutes. `docs/src/guide/deployment/worker.md` recommends readiness
+  only: database outages should not trigger liveness restarts.
+- The image and CLI healthchecks still follow `PORT`, not `WORKER_PORT`.
+  Kubernetes uses the chart's explicit readiness probe instead.
+- CLI role args, database ownership and worker secret requirements are unchanged.
+  The chart enables the dedicated worker by default; `worker.enabled=false`
+  preserves in-process sweeps. Fresh-install workers can restart until the
+  server initializes the schema; the optional migration Job orders upgrades.
+
+## Previous deployment changes
+
 beta.66 to beta.67 changed no image entrypoint, CLI role, port or
 environment-variable contract the chart owns: `Dockerfile`, `entrypoint.sh`
 and `packages/client-auth-console` are unchanged, and `apps/authup/src` only
@@ -27,7 +50,7 @@ Deployment-facing facts, none of which needs a chart value
 - The new config field `eventLogAggregateRetentionDays`
   (`EVENT_LOG_AGGREGATE_RETENTION_DAYS`, default 0 = forever,
   `packages/server-config/src/sections/core/schema.ts`) is reachable through
-  the long tail (`server.config.core.eventLogAggregateRetentionDays`). The
+  the long tail (`server.config.EVENT_LOG_AGGREGATE_RETENTION_DAYS`). The
   rollup task runs wherever the worker sweeps run: the `start` process, or
   the `start worker` Deployment when `worker.enabled=true`.
 - Earlier deployment facts still hold: the device authorization grant rides
@@ -46,10 +69,11 @@ Deployment-facing facts, none of which needs a chart value
 | Background worker: `start worker` | `apps/authup/src/module.ts`, `apps/server-core/src/app/modules/components/module.ts` | `worker/deployment.yaml` |
 | Migration: `migration run` | `apps/server-core/src/cli/commands/migration.ts` | `server/migration-job.yaml` |
 | Core port 3000; console ports 3020/3021/3022 | `packages/server-config/src/sections/*/schema.ts`, `Dockerfile` | role `containerPorts` and Services |
+| Worker health port, default 3000 | `sections/core/schema.ts`, `components/health.ts` | `worker.containerPorts.http`, readiness probe; no Service |
 
 Do not use the pre-beta.64 prefixes `server/core` and
-`client/admin-console`. A worker has no HTTP listener; it must not gain a
-Service or HTTP probes.
+`client/admin-console`. The worker listener serves health only; do not route
+API traffic to it or use its sweep-health status for liveness.
 
 ## Unified configuration
 
@@ -63,6 +87,7 @@ The single schema is in `packages/server-config/src/`. Every service reads one
 | `LOG_DIRECTORY_PATH` | `sections/core/schema.ts`, Dockerfile | `/var/log/authup` log emptyDir |
 | `PROVISIONING_DIRECTORY_PATH` | `sections/core/schema.ts`, Dockerfile | `/etc/authup/provisioning` |
 | `WORKER_ENABLED`, `MIGRATION_ENABLED` | `sections/core/schema.ts` | explicit role ownership in Deployments |
+| `WORKER_PORT` | `sections/core/schema.ts` | worker health listener and readiness probe |
 | `AUTH_CONSOLE_PORT`, `ADMIN_CONSOLE_PORT`, `ACCOUNT_CONSOLE_PORT` | console section schemas | `_console-env.tpl` |
 | database, Redis, SMTP and strict feature flags | section schemas and `constants.ts` | `_server-env.tpl`, `_database.tpl`, Secrets |
 
@@ -72,10 +97,11 @@ the config mount load-bearing for `migration run`.
 ## Role boundaries
 
 - `start` combines core, enabled consoles and worker behavior in one process.
-- `start core` serves the API only. If a dedicated worker exists, the API must
+- `start core` serves the API with optional in-process sweeps. If a dedicated worker exists, the API must
   receive `WORKER_ENABLED=false`.
 - `start worker` requires `WORKER_ENABLED=true` and database/cache config. It
-  does not need SMTP, bootstrap identity secrets, HTTP probes, or migrations.
+  does not need SMTP or bootstrap identity secrets, and runs no migrations.
+  Its health listener is used for readiness only.
 - Split consoles use the deployment-wide `PUBLIC_URL`. Server-side console
   calls use `INTERNAL_URL`, which the chart points at the core Service.
 - `ACCOUNT_CONSOLE_ENABLED` and `ADMIN_CONSOLE_ENABLED` describe whether those

diff --git a/.agents/structure.md b/.agents/structure.md
@@ -22,11 +22,11 @@ authup/helm
     ├── README.md.gotmpl
     ├── BREAKING.md                   # migration ledger for the 0.x line
     ├── ci/
-    │   ├── default-values.yaml       # combined server + built-in PostgreSQL
+    │   ├── default-values.yaml       # combined server + worker + built-in PostgreSQL
     │   ├── mysql-values.yaml
     │   ├── external-db-values.yaml
     │   ├── valkey-values.yaml        # replicas + migration hook
-    │   ├── server-only-values.yaml   # optional admin/account surfaces disabled
+    │   ├── server-only-values.yaml   # worker and optional admin/account surfaces disabled
     │   ├── split-values.yaml         # split consoles + worker + restrictive policies
     │   ├── theme-values.yaml
     │   └── manifests/postgres.yaml
@@ -43,7 +43,7 @@ authup/helm
         ├── auth-console/             # split `start console auth` resources
         ├── admin-console/            # split `start console admin` resources
         ├── account-console/          # split `start console account` resources
-        ├── worker/                   # `start worker`; no Service or HTTP probes
+        ├── worker/                   # `start worker`; HTTP readiness, no Service
         ├── postgresql/               # vendored single-instance backing service
         ├── mysql/
         └── valkey/
@@ -54,7 +54,8 @@ authup/helm
 All application roles use the same `authup/authup` image. The default server
 runs `start`, which combines the API and consoles. `server.splitConsoles=true`
 switches it to `start core` and enables explicit console Deployments with ports
-3020, 3021 and 3022. `worker.enabled=true` adds `start worker`.
+3020, 3021 and 3022. `worker.enabled=true` adds `start worker` by default;
+setting it to false keeps background sweeps in the server.
 
 The similar role directories are deliberate. Authup roles have different
 ports, probes, secrets and Services, and authentik reverted a generic role loop

diff --git a/.agents/testing.md b/.agents/testing.md
@@ -17,6 +17,11 @@ The contract script uses real `helm template` output and PyYAML. Prefer adding
 a focused assertion there over brittle text grep when changing the application
 boundary.
 
+The script retains its beta.64 filename and Make target, but tracks the current
+appVersion. Beta.68 coverage includes the default worker, its opt-out, readiness
+probe overrides and diagnostics, and the configured health port. The
+server-only CI fixture disables the worker to keep the in-process path covered.
+
 ## Useful renders
 
 ```bash

diff --git a/AGENTS.md b/AGENTS.md
@@ -16,7 +16,7 @@ changing chart architecture.
 ## Quick Reference
 
 ```bash
-make test                    # lint + render matrix + coverage + beta.64 contract
+make test                    # lint + render matrix + coverage + runtime contract
 make lint                    # helm lint + ct lint
 make template                # render the chart once per ci/*-values.yaml file
 make docs                    # regenerate charts/*/README.md (helm-docs, dockerized)

diff --git a/DESIGN.md b/DESIGN.md
@@ -10,9 +10,9 @@ PrivateAIM/helm.
 1. Provide Bitnami-grade values ergonomics without external chart dependencies:
    existing-secret key mapping, tpl-rendered extension points, predictable
    naming, diagnostics and standard workload controls.
-2. Deploy every supported Authup v1.0.0-beta.64 role from the one upstream
+2. Deploy every supported Authup v1.0.0-beta.68 role from the one upstream
    `authup/authup` image.
-3. Keep a default install useful: a combined Authup server plus built-in
+3. Keep a default install useful: a combined Authup server, dedicated worker and built-in
    PostgreSQL, while making external database and cache services the documented
    production path.
 4. Preserve a single browser origin in combined and split topologies.
@@ -35,21 +35,25 @@ Authup beta.64 replaces app-path arguments with direct CLI roles:
 | auth console | `start console auth` | 3020 | split mode, required |
 | admin console | `start console admin` | 3021 | split mode, optional |
 | account console | `start console account` | 3022 | split mode, optional |
-| worker | `start worker` | none | optional |
+| worker | `start worker` | 3000 (health) | yes |
 | migration Job | `migration run` | none | optional upgrades |
 
-`server.splitConsoles=false` keeps the minimum topology: one Deployment runs
-the API, enabled consoles and in-process worker behavior. Setting it true
+`server.splitConsoles=false` keeps the API and enabled consoles in one
+Deployment, alongside the dedicated worker. Setting it true
 changes that Deployment to the core role and creates explicit console
 Deployments. The auth console cannot be disabled in split mode because it owns
 the login flow. Admin and account consoles can be scaled or disabled
 independently.
 
-The worker is a separate Deployment only when `worker.enabled=true`. Its process
+The worker is a separate Deployment when `worker.enabled=true` (the default). Its process
 gets `WORKER_ENABLED=true`; the API gets `WORKER_ENABLED=false`. It shares
-database, cache, configuration and log mechanics with core, but it has no
-Service, ports or HTTP probes. It does not receive SMTP or bootstrap identity
-secrets because those modules are outside the worker role.
+database, cache, configuration and log mechanics with core. Since beta.68 it
+serves `GET /` health reports on `WORKER_PORT`, configured through
+`worker.containerPorts.http` (3000 by default). A readiness probe checks sweep
+health; no Service is needed for kubelet probes. There is no liveness probe:
+database failures must not cause restart loops. It does not receive SMTP or
+bootstrap identity secrets because those modules are outside the worker role.
+Setting `worker.enabled=false` keeps the sweeps in the server process.
 
 Each role has explicit templates. Their structural duplication is deliberate:
 authentik built and later removed a generic role loop because heterogeneous
@@ -257,7 +261,7 @@ idempotent on reruns.
 | Full Authup config-file templating | env-first configuration plus escape hatches avoid a schema treadmill |
 | Generic role-loop templates | explicit heterogeneous roles are easier to audit and change |
 | Pre-install migration Job | hooks run before chart-managed backing services exist |
-| Service or HTTP probes for worker | the beta.64 worker has no HTTP listener |
+| Worker Service or liveness probe | kubelet probes need no Service; failed sweeps should affect readiness without restarts |
 | Different public origins for split consoles | Authup's browser and login contracts use one deployment-wide public URL |
 | PVC for file logs | application state is in the database; log persistence belongs in collection infrastructure |
 | Run-without-database demo mode | impossible in the production image |

diff --git a/Makefile b/Makefile
@@ -21,7 +21,7 @@ lint:
 lint-values-coverage:
 	python3 scripts/check-values-coverage.py charts/authup
 
-## Assert the authup beta.64 process, configuration and filesystem contract.
+## Assert the authup process, configuration and filesystem contract through beta.68.
 lint-beta64-contract:
 	python3 scripts/check-beta64-contract.py charts/authup all
 

diff --git a/README.md b/README.md
@@ -87,8 +87,9 @@ valkey:
   enabled: true
 ```
 
-Set `server.splitConsoles=true` to run the consoles as separate workloads and
-`worker.enabled=true` for a dedicated background worker.
+Set `server.splitConsoles=true` to run the consoles as separate workloads.
+A dedicated background worker is enabled by default with an HTTP readiness
+probe. Set `worker.enabled=false` to run background sweeps in the server.
 
 See the [chart README](./charts/authup/README.md) for every parameter and the
 operational notes (GitOps caveats, scaling rules, the write-once encryption
@@ -98,7 +99,7 @@ key).
 
 | Chart | Description |
 |---|---|
-| [authup](./charts/authup) | Authup API and consoles (combined or split), optional worker, optional built-in PostgreSQL / MySQL / Valkey |
+| [authup](./charts/authup) | Authup API and consoles (combined or split), dedicated worker, optional built-in PostgreSQL / MySQL / Valkey |
 
 ## Documentation
 

diff --git a/charts/authup/BREAKING.md b/charts/authup/BREAKING.md
@@ -3,6 +3,16 @@
 This chart uses `0.major.minor` versioning while below 1.0.0: breaking changes
 land on the middle digit. Every entry lists the value migrations required.
 
+## Unreleased
+
+- `worker.enabled` now defaults to `true`, adding a worker Deployment and moving
+  background sweeps out of the server. Set it to `false` to keep the previous
+  topology. Deployments with `server.enabled=false` must also disable the worker.
+- The default image is Authup v1.0.0-beta.68. If pinning an older image, disable
+  `worker.readinessProbe.enabled` because older workers have no health listener.
+- `WORKER_PORT` is now owned by `worker.containerPorts.http`; move any
+  `server.config.WORKER_PORT` override there.
+
 ## 0.4.0
 
 - The chart now requires the Authup v1.0.0-beta.64 CLI. Default server args are

diff --git a/charts/authup/Chart.yaml b/charts/authup/Chart.yaml
@@ -5,7 +5,7 @@ description: Authup is an authentication & authorization system. This chart
   built-in PostgreSQL, MySQL and Valkey instances.
 type: application
 version: 0.4.3
-appVersion: "1.0.0-beta.67"
+appVersion: "1.0.0-beta.68"
 kubeVersion: ">=1.25.0-0"
 home: https://authup.org
 icon: https://raw.githubusercontent.com/authup/helm/master/assets/icon.svg
@@ -32,8 +32,6 @@ annotations:
       url: https://github.com/authup/helm
   artifacthub.io/changes: |
     - kind: changed
-      description: Track Authup v1.0.0-beta.67; no image entrypoint, CLI or environment-variable contract changes
+      description: Track Authup v1.0.0-beta.68 and enable the dedicated worker by default
     - kind: changed
-      description: Authup v1.0.0-beta.67 ships migration 1789930726252-PathsAndEventAggregates, applied by the migration Job or the server boot
-    - kind: changed
-      description: Authup now pins database sessions to UTC; a database that ran in local time needs its historical timestamps converted once (see the Authup upgrading guide)
+      description: Probe worker sweep health with a configurable HTTP readiness check