From 95a96d87a5bdb4751f6a1dcf6abe3687de3ce2bf Mon Sep 17 00:00:00 2001 From: kami Date: Wed, 29 Jul 2026 01:45:01 +0400 Subject: [PATCH] Record the Docker deployment and the live 2026-07-29 state The deployment moved from orchestra.service to Docker Compose, but both CLAUDE.md and AUDIT.md still described the systemd unit. A stopped unit plus a stale /usr/local/bin/orchestra reads exactly like a dead service, so document where the live deployment actually is and that deploying now means rebuilding the compose images. Also record what a live check found: the running image predates the B18 auth commit, all six herdrs are unreachable (the sole remaining blocker on live proof for B13-B17), GET /v1/tasks has no authz gate but sits behind a ufw-restricted bind, and ntfy still 403s. Sharpen the herdr-logging note: successes are never logged, so a herdr with no log line is up, not down, and the logs can't confirm one coming back. Probe the ports directly. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01535A3Y8RtkAi8wYuWhtkEd --- AUDIT.md | 28 ++++++++++++++++++++++++++++ CLAUDE.md | 37 +++++++++++++++++++++++++------------ 2 files changed, 53 insertions(+), 12 deletions(-) diff --git a/AUDIT.md b/AUDIT.md index 67975ee..2f40bd1 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -64,6 +64,34 @@ narrow: a fresh run now remains `TaskLeased` while OpenCode is paused at its normal permission boundary. +### Deployment state observed live (2026-07-29) + +Checked against the running system, not the docs: + +- The deployment **moved from `orchestra.service` to Docker Compose** + (`/home/kami/docker-apps/orchestra-web-ui`). `orchestra-api` and + `orchestra-web-ui` are both up; `/healthz` and the UI answer 200. The + stopped systemd unit is the retired predecessor, not an outage — see the + deployment section of `CLAUDE.md`. +- The **running image predates the last two commits** (built 2026-07-28 + 21:28; `0b4b52a` "Require a token for the web UI" landed 23:15). So B18's + auth fix is *not* in the live container. Rebuild before drawing any + conclusion about the live surface's auth behaviour. +- **All six herdrs are unreachable** — workpc `192.168.1.105:9245-7` refuses, + homesrv `192.168.1.104:9245-7` times out (filtered). Probed directly, since + a herdr that connects logs nothing. Nothing can be leased; every task the + API serves is history. This is the sole remaining blocker on live proof for + B13–B17. +- `GET /v1/tasks` has **no authz check at all** (`cmd/orchestra/main.go:286` + returns before any gate). B18 gated the mutation and approval controls, not + the read path. Accepted for now: the `0.0.0.0:9145` bind is deliberate and + ufw restricts the port to a single other LAN machine, so the read path's + trust boundary is the LAN, not the host. Revisit if that bind is ever + widened. +- ntfy delivery still fails `403 Forbidden` on every send (last observed + 2026-07-28) — a wrong or expired credential, separate from S12's + `ORCHESTRA_NTFY_SURFACE_TOKEN`. + This does not complete the cross-machine continuity design. `clients/herdr- bridge.go` is only a byte proxy; it is not a worker. The worker-side process described below remains required before a remote checkout can author diff --git a/CLAUDE.md b/CLAUDE.md index fb53ea8..ad4f807 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -57,21 +57,34 @@ the live herdr instance and check. today — don't "clean up" that code without checking this note first, or it might start doing a real numeric-vs-string comparison and break. -## Deployment topology (as of 2026-07-27) +## Deployment topology (as of 2026-07-29) -- Runs as `orchestra.service` on **homesrv** (this machine's own systemd — - `journalctl -u orchestra.service` for logs; `sudo` isn't available in this - sandbox environment, but plain `journalctl` without sudo works here). -- Config: `.orchestra-config/orchestra.env` (env vars) + - `.orchestra-config/config.jsonc` (projects/machines/herdrs registry). - `ORCHESTRA_CONFIG=/etc/orchestra/config.jsonc` — the deployed copy, not the - repo's `deploy/config.example.jsonc`. +- **Runs under Docker Compose, not systemd.** `docker compose -f compose.yaml + -f compose.live.yaml` in `/home/kami/docker-apps/orchestra-web-ui`, building + both images from this repo: `orchestra-api` (bound `0.0.0.0:9145`) and + `orchestra-web-ui` (nginx proxy, `127.0.0.1:19145`). Logs are + `docker logs orchestra-api`. **Deploying a code change means rebuilding the + compose images** (`up -d --build`) — the running image can silently predate + recent commits, so compare its build time against `git log`. +- `orchestra.service` is the **previous** deployment and is retired — + `compose.live.yaml` requires it stopped, since both bind the same port and + data dir. Do not start it. (`sudo` isn't available in this sandbox, so + `systemctl disable` needs the operator.) +- Config: `/etc/orchestra/orchestra.env` (env vars) + `/etc/orchestra/ + config.jsonc` (projects/machines/herdrs registry) — the deployed copies, not + the repo's `.orchestra-config/` or `deploy/config.example.jsonc`. The + container bind-mounts `/etc/orchestra:ro` and its entrypoint sources the env + file, so Docker never copies the secrets. +- The `0.0.0.0` bind on 9145 is **intentional**: ufw restricts the port to one + other LAN machine. Don't report it as an exposure. - Two machines in the registry: `homesrv` (192.168.1.104) and `workpc` (192.168.1.105), each nominally running 3 herdrs (claude/codex/opencode). - In practice **homesrv has no local herdr running** (connection refused on - 9245) — only workpc's herdr is live and reachable. `main.go` only logs - herdr connection *failures* at startup, never successes, so "no log line" - for a herdr does not mean it's down — check reachability directly. + As of 2026-07-29 **all six are unreachable** — workpc refuses on 9245-9247, + homesrv times out (filtered). Nothing can be leased until one is brought up. +- `main.go` logs herdr connection *failures* at startup and **never logs a + success**, so a herdr with no log line is *up*, not down — absence of a line + is evidence in the opposite direction, and an operator cannot confirm a + herdr came back by tailing the logs. Always probe reachability directly. - There was a real, live, stuck task as of 2026-07-27: workspace `wA`, task id `06FT6CKD9Y98AZRX6X8K3QXFZG`, opencode harness, pane `wA:p1`, `agent_status: "blocked"`. Likely stuck because rotation/release could