Delete Design A, the harness-hook completion path, and retired deploy files

Acts on the seven review comments on PR #1.

Design A is gone (comment 4). clients/ deleted rather than tracked: with
workers carrying cross-machine work the bridge is undeployed, which supersedes
the 2026-07-27 "keep through Phase 5" decision. CLAUDE.md, AGENTS.md and
AUDIT.md updated from "retained" to "deleted".

The harness-hook completion path is gone (comment 10). Investigation of the
live OpenCode QA run showed orchestra-worker owns completion end to end: it
watches for .orchestra/done, confirms via AgentStatus that the agent is not
busy, then posts through /v1/federation/* with both lease epoch and expected
version. The hook scripts used a different, older convention
(.orchestra-report.md) and posted to /v1/harness/complete, which had already
been reduced to a 410 stub - so that path could not have completed a task.
Nothing exercised it, because the live run never used it. Deleted: the three
deploy/hooks scripts, the 410 route, the unmounted harnessCompletion handler,
and its test. That test passed against a handler no mux routed to, which is
the exact "looks wired but isn't" pattern CLAUDE.md warns about; the
constant-time token compare added to it earlier today goes with it, having
never been reachable. /v1/harness/turn is untouched and still live.

Retired deployment files (comments 8, 12, 14): deploy/orchestra.service and
deploy/redeploy.sh (which sudo-installed to /usr/local/bin and restarted that
unit), plus deploy/docker-api-entrypoint.sh. The entrypoint was safe to remove
once its premise was checked: env vars reach the container through
`env_file: .env` in compose.yaml, not by sourcing /etc/orchestra/orchestra.env
- only config.jsonc is bind-mounted there - and Dockerfile.api's line 17
already sets ORCHESTRA_DATA/ORCHESTRA_PORT. Dockerfile.api now execs
/app/orchestra directly. orchestra-worker.service is a different, current unit
and is kept.

deploy/config.example.json deleted as a duplicate (comment 6); the annotated
.jsonc is the one registry.go points at, and its header no longer tells the
reader to copy the file that just went away.

Documentation corrected beyond the deletions:
- CLAUDE.md's deployment section claimed the container bind-mounts
  /etc/orchestra:ro and its entrypoint sources the env file. Both wrong.
- AGENTS.md still described a systemd deployment on homesrv as of 2026-07-27.
- AUDIT.md's H5 row still described a "retained compatibility handler".
- deploy/DEPLOYMENT.md still named redeploy.sh as the deployment path.
- deploy/orchestra.env.example still cited EnvironmentFile=.

TOKEN_MINIMAL_WORKFLOW_PLAN.md (comment 2) is untouched: it and WEB_UI_PLAN.md
were both missed by REVIEW.md's documentation sweep, and reconciling a 534-line
forward-looking plan against AUDIT.md is its own task, not a review fixup.

Verified: go build ./..., go vet ./..., go test ./... all pass after the
deletions, and go list ./... has no node_modules entry. No live herdr or pane
was touched; nothing was deployed. The running image still predates this
commit until compose is rebuilt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GEugbHVYfAXFpTqDYbByEB

CLAUDE.md

@@ -66,15 +66,22 @@ the live herdr instance and check.
   `docker logs orchestra-api`. **Deploying a code change means rebuilding the
   compose images** (`up -d --build`) — the running image can silently predate
   recent commits, so compare its build time against `git log`.
-- `orchestra.service` is the **previous** deployment and is retired —
-  `compose.live.yaml` requires it stopped, since both bind the same port and
-  data dir. Do not start it. (`sudo` isn't available in this sandbox, so
-  `systemctl disable` needs the operator.)
-- Config: `/etc/orchestra/orchestra.env` (env vars) + `/etc/orchestra/
-  config.jsonc` (projects/machines/herdrs registry) — the deployed copies, not
-  the repo's `.orchestra-config/` or `deploy/config.example.jsonc`. The
-  container bind-mounts `/etc/orchestra:ro` and its entrypoint sources the env
-  file, so Docker never copies the secrets.
+- `orchestra.service` was the **previous** deployment; the unit file was
+  deleted from `deploy/` on 2026-07-31 along with `redeploy.sh` (which
+  `sudo install`ed to `/usr/local/bin` and restarted it). If a stale copy is
+  still installed on a host, it must stay stopped — it binds the same port and
+  data dir as the container. (`sudo` isn't available in this sandbox, so
+  `systemctl disable` needs the operator.) `orchestra-worker.service` is a
+  *different*, still-current unit — don't delete it by association.
+- Config: env vars come from **`.env` in the compose directory**, loaded via
+  `env_file:` in `compose.yaml` — that is where the Gitea/ntfy/web tokens and
+  the bcrypt operator hash live. The only thing bind-mounted into
+  `/etc/orchestra/` is a single file, `config.jsonc`
+  (projects/machines/herdrs registry), via `compose.override.yaml`. There is no
+  container entrypoint script — `Dockerfile.api` execs `/app/orchestra`
+  directly, and `ORCHESTRA_DATA`/`ORCHESTRA_PORT` come from the image `ENV`
+  plus compose. Neither the deployed `config.jsonc` nor `.env` is the repo's
+  `deploy/config.example.jsonc`.
 - The `0.0.0.0` bind on 9145 is **intentional**: ufw restricts the port to one
   other LAN machine. Don't report it as an exposure.
 - Two machines in the registry: `homesrv` (192.168.1.104) and `workpc`
@@ -107,12 +114,23 @@ resolve an adapter for a session owned by a non-local herdr, returning
 (`git rev-parse HEAD`) against the wrong machine's checkout. Rotation/cleanup
 therefore no longer act on remote leases.
 
-**Design A is retained, not dead.** `clients/herdr-bridge.go` ("drive the
-remote socket": homesrv calling `worktree.create`/`agent.start` directly on
-workpc's herdr over TCP as if it were local) is kept through Phase 5 per the
-standing AUDIT.md decision of 2026-07-27; deletion of Design A and `clients/`
-is deferred to the Phase 6 cutover. Do not delete it early, and do not add new
-cross-machine call paths to it.
+**Design A is gone (deleted 2026-07-31).** `clients/herdr-bridge.go` ("drive
+the remote socket": homesrv calling `worktree.create`/`agent.start` directly on
+workpc's herdr over TCP as if it were local) was deleted along with the whole
+`clients/` directory — the operator confirmed it is undeployed now that workers
+carry cross-machine work, which superseded the 2026-07-27 "keep through Phase
+5" decision. There is no bridge to preserve; do not reintroduce coordinator-side
+calls to a remote herdr socket.
+
+**Completion is worker-owned.** `orchestra-worker` watches for an
+`.orchestra/done` marker in the worktree, confirms via `AgentStatus` that the
+agent is no longer busy (a marker alone is intent, not proof), then finalizes
+and posts through `/v1/federation/*` with both the lease epoch and the expected
+version. The old harness-hook path — `.orchestra-report.md` plus
+`POST /v1/harness/complete` — is **deleted**: the endpoint, its handler, and the
+`deploy/hooks/` scripts are all gone, because an unaffiliated hook has no
+durable worker identity or fencing epoch. `/v1/harness/turn` remains for
+turn-boundary decisions.
 
 ## Working conventions