Reconcile docs with reality; fix module graph, token compare, health

Acts on the 2026-07-30 senior review (REVIEW.md findings 1, 2, 4, 5, 7).

Docs (finding 1): CLAUDE.md and AGENTS.md both claimed Design B "has zero
clients - no worker binary exists". cmd/orchestra-worker/main.go is the
deployed worker, and the non-local-herdr guardrail has landed in
Coordinator.adapterFor. Both sections rewritten; AUDIT.md gains a matching
federation-status record. The Phase 5 retention / Phase 6 deletion decision
for Design A is preserved, not flattened.

clients/ un-ignored and tracked, including the .service unit and README:
deployed code belongs in version control. Design A is NOT deleted here.

progress.md (finding 2): the file was deleted after 636ed8a, yet CLAUDE.md
instructed every session to cross-check against it. References removed from
CLAUDE.md, AGENTS.md, internal/orchestrator/rotation_test.go (comment only)
and deploy/hooks/orchestra-codex-poll.sh; AUDIT.md now carries the log role.

web/go.mod (finding 4): a module stub ends the parent package graph at the
directory boundary, so go list ./... no longer yields
web/node_modules/flatted/golang/pkg/flatted. A build tag cannot work - the
package is in the package list before tags are evaluated. Local/CI-only
breakage: Dockerfile.api builds ./cmd/orchestra by explicit path and
.dockerignore already excluded node_modules.

orchestra-worker (finding 5): untracked (8.9MB, mode 100755, still on disk);
both binaries now gitignored.

Token compare (finding 7): cmd/orchestra/main.go:139,582 use
subtle.ConstantTimeCompare, matching the authz.go idiom. The token != ""
guard stays first, so an empty configured token still means auth-disabled
rather than auth-bypass. Three further plain != secret compares remain in
internal/federation/federation.go:343,346,368 - tracked, not fixed here.

Also included from the review pass: orchestrator.go records adapter-resolution
failures in SessionHealth.LastError instead of dropping them on a bare
continue, plus an Observed flag so lease-seeded health is not mistaken for a
live reading, with a covering test. GET /v1/tasks/<id>/health now returns a
record with last_error where it previously returned a bare 404.

REVIEW.md's own second pass claimed every checkable fact held up; four did
not. AUDIT.md never contained the false Design B claim (AGENTS.md was the
second copy), the guardrail is at orchestrator.go:312 not :309, the
progress.md site list missed the codex-poll hook, and only orchestra-worker
was tracked. Verified: go build, go vet, go test, and
go list ./... | grep node_modules all clean with every change applied
together. No live herdr or pane was touched; nothing was deployed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GEugbHVYfAXFpTqDYbByEB

AGENTS.md

@@ -14,10 +14,10 @@ continuity,federation,delivery,authz,operations,admin}` + `cmd/orchestra/main.go
 This repo has a documented history of code that *looks* wired but isn't —
 packages with tests that pass in isolation while the live call path silently
 no-ops (bare `continue` on error, discarded return values). See `AUDIT.md`
-for the full audit and `progress.md` for a running log. **Before trusting a
-claim in progress.md that something "works" or "is fixed," check the actual
-call site** — the file is written by past sessions of this same assistant and
-has previously overstated completion.
+for the full audit; it is also the running log (there is no separate log
+file). **Before trusting a claim in `AUDIT.md` that something "works"
+or "is fixed," check the actual call site** — the file is written by past
+sessions of this same assistant and has previously overstated completion.
 
 The single most reliable way to verify herdr-adapter code is right: don't
 read `internal/herdr/adapter.go` and assume the method names are real. Ping
@@ -80,20 +80,26 @@ the live herdr instance and check.
   unstick an already-orphaned pane; that needs a manual kill/restart once the
   release path is trustworthy.
 
-## The federation fork — read before touching anything cross-machine
+## Federation — Design B is the live design (as of 2026-07-30)
 
-Two incompatible designs coexist. **Design A** ("drive the remote socket",
-currently deployed via `clients/herdr-bridge.go`) has homesrv call
-`worktree.create`/`agent.start` etc. directly on workpc's herdr over TCP as
-if it were local — meaning anchor validation (`git rev-parse HEAD`) run by
-the coordinator executes on the *wrong machine* relative to the actual
-checkout. **Design B** ("workers pull tasks", `/v1/federation/*`) is fully
-built server-side but has zero clients — no worker binary exists. Decision
-(AUDIT.md, 2026-07-27): keep Design A through Phase 5, commit to Design B in
-Phase 6, with two guardrails landed immediately (refuse to rotate/cleanup a
-lease held by a non-local herdr rather than validate against the wrong
-checkout). Don't build on top of Design A's cross-machine calls without
-reading that section first.
+**Design B** ("workers pull tasks", `/v1/federation/*`) is the live design and
+has a real client: `cmd/orchestra-worker/main.go` (~1,131 lines, with tests in
+`cmd/orchestra-worker/main_test.go`) is the deployed worker — the workpc
+OpenCode worker runs it. Build new cross-machine work on Design B.
+
+The **Design A guardrail has landed**: `Coordinator.adapterFor`
+(`internal/orchestrator/orchestrator.go`, the `LocalHerdr` check) refuses to
+resolve an adapter for a session owned by a non-local herdr, returning
+`session %s is owned by non-local herdr %s` instead of validating a git anchor
+(`git rev-parse HEAD`) against the wrong machine's checkout. Rotation/cleanup
+therefore no longer act on remote leases.
+
+**Design A is retained, not dead.** `clients/herdr-bridge.go` ("drive the
+remote socket": homesrv calling `worktree.create`/`agent.start` directly on
+workpc's herdr over TCP as if it were local) is kept through Phase 5 per the
+standing AUDIT.md decision of 2026-07-27; deletion of Design A and `clients/`
+is deferred to the Phase 6 cutover. Do not delete it early, and do not add new
+cross-machine call paths to it.
 
 ## Working conventions