kami/orchestra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Record the Docker deployment and the live 2026-07-29 state

Browse Source 
The deployment moved from orchestra.service to Docker Compose, but both
CLAUDE.md and AUDIT.md still described the systemd unit. A stopped unit
plus a stale /usr/local/bin/orchestra reads exactly like a dead service,
so document where the live deployment actually is and that deploying now
means rebuilding the compose images.

Also record what a live check found: the running image predates the B18
auth commit, all six herdrs are unreachable (the sole remaining blocker
on live proof for B13-B17), GET /v1/tasks has no authz gate but sits
behind a ufw-restricted bind, and ntfy still 403s.

Sharpen the herdr-logging note: successes are never logged, so a herdr
with no log line is up, not down, and the logs can't confirm one coming
back. Probe the ports directly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01535A3Y8RtkAi8wYuWhtkEd
This commit is contained in:
kami
2026-07-29 01:45:01 +04:00
parent 95454afa72
commit 95a96d87a5
2 changed files with 53 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AUDIT.md
+28
View File
@@ -64,6 +64,34 @@ narrow:
a fresh run now remains `TaskLeased` while OpenCode is paused at its normal
permission boundary.
### Deployment state observed live (2026-07-29)
Checked against the running system, not the docs:
- The deployment **moved from `orchestra.service` to Docker Compose**
(`/home/kami/docker-apps/orchestra-web-ui`). `orchestra-api` and
`orchestra-web-ui` are both up; `/healthz` and the UI answer 200. The
stopped systemd unit is the retired predecessor, not an outage — see the
deployment section of `CLAUDE.md`.
- The **running image predates the last two commits** (built 2026-07-28
21:28; `0b4b52a` "Require a token for the web UI" landed 23:15). So B18's
auth fix is *not* in the live container. Rebuild before drawing any
conclusion about the live surface's auth behaviour.
- **All six herdrs are unreachable** — workpc `192.168.1.105:9245-7` refuses,
homesrv `192.168.1.104:9245-7` times out (filtered). Probed directly, since
a herdr that connects logs nothing. Nothing can be leased; every task the
API serves is history. This is the sole remaining blocker on live proof for
B13–B17.
- `GET /v1/tasks` has **no authz check at all** (`cmd/orchestra/main.go:286`
returns before any gate). B18 gated the mutation and approval controls, not
the read path. Accepted for now: the `0.0.0.0:9145` bind is deliberate and
ufw restricts the port to a single other LAN machine, so the read path's
trust boundary is the LAN, not the host. Revisit if that bind is ever
widened.
- ntfy delivery still fails `403 Forbidden` on every send (last observed
2026-07-28) — a wrong or expired credential, separate from S12's
`ORCHESTRA_NTFY_SURFACE_TOKEN`.
This does not complete the cross-machine continuity design. `clients/herdr-
bridge.go` is only a byte proxy; it is not a worker. The worker-side process
described below remains required before a remote checkout can author