Delete Design A, the harness-hook completion path, and retired deploy files

Acts on the seven review comments on PR #1.

Design A is gone (comment 4). clients/ deleted rather than tracked: with
workers carrying cross-machine work the bridge is undeployed, which supersedes
the 2026-07-27 "keep through Phase 5" decision. CLAUDE.md, AGENTS.md and
AUDIT.md updated from "retained" to "deleted".

The harness-hook completion path is gone (comment 10). Investigation of the
live OpenCode QA run showed orchestra-worker owns completion end to end: it
watches for .orchestra/done, confirms via AgentStatus that the agent is not
busy, then posts through /v1/federation/* with both lease epoch and expected
version. The hook scripts used a different, older convention
(.orchestra-report.md) and posted to /v1/harness/complete, which had already
been reduced to a 410 stub - so that path could not have completed a task.
Nothing exercised it, because the live run never used it. Deleted: the three
deploy/hooks scripts, the 410 route, the unmounted harnessCompletion handler,
and its test. That test passed against a handler no mux routed to, which is
the exact "looks wired but isn't" pattern CLAUDE.md warns about; the
constant-time token compare added to it earlier today goes with it, having
never been reachable. /v1/harness/turn is untouched and still live.

Retired deployment files (comments 8, 12, 14): deploy/orchestra.service and
deploy/redeploy.sh (which sudo-installed to /usr/local/bin and restarted that
unit), plus deploy/docker-api-entrypoint.sh. The entrypoint was safe to remove
once its premise was checked: env vars reach the container through
`env_file: .env` in compose.yaml, not by sourcing /etc/orchestra/orchestra.env
- only config.jsonc is bind-mounted there - and Dockerfile.api's line 17
already sets ORCHESTRA_DATA/ORCHESTRA_PORT. Dockerfile.api now execs
/app/orchestra directly. orchestra-worker.service is a different, current unit
and is kept.

deploy/config.example.json deleted as a duplicate (comment 6); the annotated
.jsonc is the one registry.go points at, and its header no longer tells the
reader to copy the file that just went away.

Documentation corrected beyond the deletions:
- CLAUDE.md's deployment section claimed the container bind-mounts
  /etc/orchestra:ro and its entrypoint sources the env file. Both wrong.
- AGENTS.md still described a systemd deployment on homesrv as of 2026-07-27.
- AUDIT.md's H5 row still described a "retained compatibility handler".
- deploy/DEPLOYMENT.md still named redeploy.sh as the deployment path.
- deploy/orchestra.env.example still cited EnvironmentFile=.

TOKEN_MINIMAL_WORKFLOW_PLAN.md (comment 2) is untouched: it and WEB_UI_PLAN.md
were both missed by REVIEW.md's documentation sweep, and reconciling a 534-line
forward-looking plan against AUDIT.md is its own task, not a review fixup.

Verified: go build ./..., go vet ./..., go test ./... all pass after the
deletions, and go list ./... has no node_modules entry. No live herdr or pane
was touched; nothing was deployed. The running image still predates this
commit until compose is rebuilt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GEugbHVYfAXFpTqDYbByEB

AGENTS.md

@@ -57,15 +57,25 @@ the live herdr instance and check.
   today — don't "clean up" that code without checking this note first, or it
   might start doing a real numeric-vs-string comparison and break.
 
-## Deployment topology (as of 2026-07-27)
+## Deployment topology (as of 2026-07-31)
 
-- Runs as `orchestra.service` on **homesrv** (this machine's own systemd —
-  `journalctl -u orchestra.service` for logs; `sudo` isn't available in this
-  sandbox environment, but plain `journalctl` without sudo works here).
-- Config: `.orchestra-config/orchestra.env` (env vars) +
-  `.orchestra-config/config.jsonc` (projects/machines/herdrs registry).
-  `ORCHESTRA_CONFIG=/etc/orchestra/config.jsonc` — the deployed copy, not the
-  repo's `deploy/config.example.jsonc`.
+- **Runs under Docker Compose, not systemd.** `docker compose -f compose.yaml
+  -f compose.live.yaml` in `/home/kami/docker-apps/orchestra-web-ui`, building
+  both images from this repo: `orchestra-api` (bound `0.0.0.0:9145`, which is
+  intentional — ufw restricts the port to one other LAN machine) and
+  `orchestra-web-ui` (nginx proxy, `127.0.0.1:19145`). Logs are
+  `docker logs orchestra-api`. **Deploying a code change means rebuilding the
+  compose images** (`up -d --build`) — the running image can silently predate
+  recent commits, so compare its build time against `git log`.
+- `orchestra.service` was the previous deployment; its unit file and
+  `redeploy.sh` were deleted from `deploy/` on 2026-07-31. A stale installed
+  copy must stay stopped — it binds the same port and data dir as the
+  container. `orchestra-worker.service` is a *different*, still-current unit.
+- Config: env vars come from **`.env` in the compose directory** via
+  `env_file:`; only `config.jsonc` is bind-mounted into `/etc/orchestra/`.
+  There is no container entrypoint script — `Dockerfile.api` execs
+  `/app/orchestra` directly. Neither deployed file is the repo's
+  `deploy/config.example.jsonc`.
 - Two machines in the registry: `homesrv` (192.168.1.104) and `workpc`
   (192.168.1.105), each nominally running 3 herdrs (claude/codex/opencode).
   In practice **homesrv has no local herdr running** (connection refused on
@@ -94,12 +104,21 @@ resolve an adapter for a session owned by a non-local herdr, returning
 (`git rev-parse HEAD`) against the wrong machine's checkout. Rotation/cleanup
 therefore no longer act on remote leases.
 
-**Design A is retained, not dead.** `clients/herdr-bridge.go` ("drive the
-remote socket": homesrv calling `worktree.create`/`agent.start` directly on
-workpc's herdr over TCP as if it were local) is kept through Phase 5 per the
-standing AUDIT.md decision of 2026-07-27; deletion of Design A and `clients/`
-is deferred to the Phase 6 cutover. Do not delete it early, and do not add new
-cross-machine call paths to it.
+**Design A is gone (deleted 2026-07-31).** `clients/herdr-bridge.go` ("drive
+the remote socket": homesrv calling `worktree.create`/`agent.start` directly on
+workpc's herdr over TCP as if it were local) was deleted along with the whole
+`clients/` directory — the operator confirmed it is undeployed now that workers
+carry cross-machine work, which superseded the 2026-07-27 "keep through Phase
+5" decision. There is no bridge to preserve; do not reintroduce
+coordinator-side calls to a remote herdr socket.
+
+**Completion is worker-owned.** `orchestra-worker` watches for an
+`.orchestra/done` marker, confirms via `AgentStatus` that the agent is no
+longer busy, then posts through `/v1/federation/*` with the lease epoch and
+expected version. The old harness-hook path — `.orchestra-report.md` plus
+`POST /v1/harness/complete` — is **deleted**, endpoint, handler, and
+`deploy/hooks/` scripts alike. `/v1/harness/turn` remains for turn-boundary
+decisions.
 
 ## Working conventions