Record the Docker deployment and the live 2026-07-29 state

The deployment moved from orchestra.service to Docker Compose, but both
CLAUDE.md and AUDIT.md still described the systemd unit. A stopped unit
plus a stale /usr/local/bin/orchestra reads exactly like a dead service,
so document where the live deployment actually is and that deploying now
means rebuilding the compose images.

Also record what a live check found: the running image predates the B18
auth commit, all six herdrs are unreachable (the sole remaining blocker
on live proof for B13-B17), GET /v1/tasks has no authz gate but sits
behind a ufw-restricted bind, and ntfy still 403s.

Sharpen the herdr-logging note: successes are never logged, so a herdr
with no log line is up, not down, and the logs can't confirm one coming
back. Probe the ports directly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01535A3Y8RtkAi8wYuWhtkEd

AUDIT.md

@@ -64,6 +64,34 @@ narrow:
   a fresh run now remains `TaskLeased` while OpenCode is paused at its normal
   permission boundary.
 
+### Deployment state observed live (2026-07-29)
+
+Checked against the running system, not the docs:
+
+- The deployment **moved from `orchestra.service` to Docker Compose**
+  (`/home/kami/docker-apps/orchestra-web-ui`). `orchestra-api` and
+  `orchestra-web-ui` are both up; `/healthz` and the UI answer 200. The
+  stopped systemd unit is the retired predecessor, not an outage — see the
+  deployment section of `CLAUDE.md`.
+- The **running image predates the last two commits** (built 2026-07-28
+  21:28; `0b4b52a` "Require a token for the web UI" landed 23:15). So B18's
+  auth fix is *not* in the live container. Rebuild before drawing any
+  conclusion about the live surface's auth behaviour.
+- **All six herdrs are unreachable** — workpc `192.168.1.105:9245-7` refuses,
+  homesrv `192.168.1.104:9245-7` times out (filtered). Probed directly, since
+  a herdr that connects logs nothing. Nothing can be leased; every task the
+  API serves is history. This is the sole remaining blocker on live proof for
+  B13–B17.
+- `GET /v1/tasks` has **no authz check at all** (`cmd/orchestra/main.go:286`
+  returns before any gate). B18 gated the mutation and approval controls, not
+  the read path. Accepted for now: the `0.0.0.0:9145` bind is deliberate and
+  ufw restricts the port to a single other LAN machine, so the read path's
+  trust boundary is the LAN, not the host. Revisit if that bind is ever
+  widened.
+- ntfy delivery still fails `403 Forbidden` on every send (last observed
+  2026-07-28) — a wrong or expired credential, separate from S12's
+  `ORCHESTRA_NTFY_SURFACE_TOKEN`.
+
 This does not complete the cross-machine continuity design. `clients/herdr-
 bridge.go` is only a byte proxy; it is not a worker. The worker-side process
 described below remains required before a remote checkout can author

CLAUDE.md

@@ -57,21 +57,34 @@ the live herdr instance and check.
   today — don't "clean up" that code without checking this note first, or it
   might start doing a real numeric-vs-string comparison and break.
 
-## Deployment topology (as of 2026-07-27)
+## Deployment topology (as of 2026-07-29)
 
-- Runs as `orchestra.service` on **homesrv** (this machine's own systemd —
-  `journalctl -u orchestra.service` for logs; `sudo` isn't available in this
-  sandbox environment, but plain `journalctl` without sudo works here).
-- Config: `.orchestra-config/orchestra.env` (env vars) +
-  `.orchestra-config/config.jsonc` (projects/machines/herdrs registry).
-  `ORCHESTRA_CONFIG=/etc/orchestra/config.jsonc` — the deployed copy, not the
-  repo's `deploy/config.example.jsonc`.
+- **Runs under Docker Compose, not systemd.** `docker compose -f compose.yaml
+  -f compose.live.yaml` in `/home/kami/docker-apps/orchestra-web-ui`, building
+  both images from this repo: `orchestra-api` (bound `0.0.0.0:9145`) and
+  `orchestra-web-ui` (nginx proxy, `127.0.0.1:19145`). Logs are
+  `docker logs orchestra-api`. **Deploying a code change means rebuilding the
+  compose images** (`up -d --build`) — the running image can silently predate
+  recent commits, so compare its build time against `git log`.
+- `orchestra.service` is the **previous** deployment and is retired —
+  `compose.live.yaml` requires it stopped, since both bind the same port and
+  data dir. Do not start it. (`sudo` isn't available in this sandbox, so
+  `systemctl disable` needs the operator.)
+- Config: `/etc/orchestra/orchestra.env` (env vars) + `/etc/orchestra/
+  config.jsonc` (projects/machines/herdrs registry) — the deployed copies, not
+  the repo's `.orchestra-config/` or `deploy/config.example.jsonc`. The
+  container bind-mounts `/etc/orchestra:ro` and its entrypoint sources the env
+  file, so Docker never copies the secrets.
+- The `0.0.0.0` bind on 9145 is **intentional**: ufw restricts the port to one
+  other LAN machine. Don't report it as an exposure.
 - Two machines in the registry: `homesrv` (192.168.1.104) and `workpc`
   (192.168.1.105), each nominally running 3 herdrs (claude/codex/opencode).
-  In practice **homesrv has no local herdr running** (connection refused on
-  9245) — only workpc's herdr is live and reachable. `main.go` only logs
-  herdr connection *failures* at startup, never successes, so "no log line"
-  for a herdr does not mean it's down — check reachability directly.
+  As of 2026-07-29 **all six are unreachable** — workpc refuses on 9245-9247,
+  homesrv times out (filtered). Nothing can be leased until one is brought up.
+- `main.go` logs herdr connection *failures* at startup and **never logs a
+  success**, so a herdr with no log line is *up*, not down — absence of a line
+  is evidence in the opposite direction, and an operator cannot confirm a
+  herdr came back by tailing the logs. Always probe reachability directly.
 - There was a real, live, stuck task as of 2026-07-27: workspace `wA`, task
   id `06FT6CKD9Y98AZRX6X8K3QXFZG`, opencode harness, pane `wA:p1`,
   `agent_status: "blocked"`. Likely stuck because rotation/release could