From d6cab133b56666f81f569f4c1c3c9a6f104088d1 Mon Sep 17 00:00:00 2001 From: kami Date: Thu, 30 Jul 2026 15:48:12 +0400 Subject: [PATCH] docs: record live release blockers --- AUDIT.md | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-) diff --git a/AUDIT.md b/AUDIT.md index 4e16f3c..544fe78 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -3,9 +3,9 @@ Audited 2026-07-30 against the working tree, spec, deployed coordinator, workpc worker, event log, and live herdr (read-only). -**Verdict:** one worker handoff completed, but the system is not safe to run -unattended. It can skip rotation, omit Git state, split ownership, strand a -released agent, or reject a valid completion. +**Verdict:** the source-level P0/P1/P2 fixes are in place and the live +coordinator can replay its repaired event log, but the system is not safe to +run unattended until live harness capacity and the worker rollout are restored. ## Evidence @@ -13,9 +13,25 @@ released agent, or reject a valid completion. - Live B17: release `seq=251`, re-lease `252`, completion `262`; the simple probe needed six approvals, logged a `409 lease version conflict`, and recorded `consumed:0`. -- Live now: Docker owns the coordinator; the old systemd unit is inactive. - Workpc runs a dirty `1ca9d64` worker build. No task is active and live herdr - reports no agents. This does not prove the current working tree. +- Live follow-up: Docker owns the coordinator; the old systemd unit is + inactive. The pre-v2 repeated-`seq=1` event prefix was migrated with a + backup-preserving, explicit tool before the current coordinator replayed it. + +## Remaining release blockers + +- **No live harness capacity.** Homesrv has no reachable herdr. Workpc has no + listener on any expected herdr port, so no safe live rotation, handoff, + completion, or late-recovery path can be exercised on Claude, Codex, or + OpenCode. +- **Worker rollout needs an administrator.** Workpc is still running the old + dirty `1ca9d64` `/usr/local/bin/orchestra-worker`. The current worker binary + is staged at `~/orchestra-deploy/orchestra-worker`, but this account cannot + install it or restart the systemd service. Its project configuration must + also declare supported projects before routing can admit a task. +- **B17 needs a fresh controlled run.** The historical probe's six approvals, + one `409 lease version conflict`, and `consumed:0` receipt came from the + old worker. They cannot be treated as evidence for the current worker until + a live OpenCode run is repeated; Claude and Codex require their own runs. ## P0 — correctness @@ -86,13 +102,11 @@ released agent, or reject a valid completion. ## Release gate -- All build/vet/test/race checks pass. -- Fault-inject every handoff phase, coordinator/worker restart, lost response, - worker partition/rejoin, stale completion, and corrupt state file. -- Cross-machine tests cover staged/deleted/clean-committed work and prove the - predecessor remains recoverable until successor pickup validation. -- Live controlled runs pass soft, hard, milestone, thrash, completion, and - late-recovery paths on each harness without manual intervention for safe - repository work. -- Coordinator and workers report the same immutable build revision; staged - worker checksum and Go build revision match before restart. +- **Pass:** build, vet, test, and race checks pass; unit/integration coverage + includes the defined fault and cross-machine cases. +- **Pending live capacity:** run the controlled soft, hard, milestone, thrash, + completion, and late-recovery paths on each harness without manual + intervention for safe repository work. +- **Pending worker installation:** install the staged worker, restart it after + herdr is restored, and verify its checksum and immutable build revision + against the coordinator diagnostics.