Harden lease lifecycle durability

deploy/DEPLOYMENT.md

@@ -0,0 +1,43 @@
+# Deployment verification
+
+Both binaries embed their Git revision, UTC build time, and dirty flag. Build
+the coordinator with `deploy/redeploy.sh`; it installs and restarts the local
+`orchestra.service`.
+
+## Browser operator login
+
+The browser UI requires `ORCHESTRA_WEB_USERNAME` and
+`ORCHESTRA_WEB_PASSWORD_HASH`. Generate a bcrypt hash without putting the
+password in shell history:
+
+```sh
+go run ./cmd/orchestra-password
+```
+
+Set the emitted hash in the service environment along with the chosen
+username, then restart the coordinator. `ORCHESTRA_WEB_TOKEN` is not used by
+the browser UI anymore.
+
+Build a worker for staging on workpc with:
+
+```sh
+revision=$(git rev-parse HEAD)
+build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+dirty=false; test -z "$(git status --porcelain)" || dirty=true
+go build -ldflags "-X orchestra/internal/buildinfo.Revision=$revision -X orchestra/internal/buildinfo.Time=$build_time -X orchestra/internal/buildinfo.Dirty=$dirty" -o orchestra-worker ./cmd/orchestra-worker
+scp orchestra-worker workpc:~/orchestra-deploy/orchestra-worker
+ssh workpc 'sha256sum ~/orchestra-deploy/orchestra-worker'
+```
+
+The worker receives only the path to a normal project configuration file:
+`ORCHESTRA_WORKER_PROJECT_CONFIG_FILE=/etc/orchestra/worker-projects.json`.
+That file contains a JSON object whose project entries contain `repo`,
+`worktree_root`, and `remote`; mount or provision it like any other worker
+configuration. The legacy single-checkout `ORCHESTRA_WORKER_PROJECTS` comma
+list remains supported for one existing checkout. An absent project is
+ineligible for routing.
+
+Verify the coordinator at `GET /v1/admin/diagnostics` with the normal admin
+credential: its `build` object is the coordinator provenance. `GET
+/v1/federation/workers` shows every worker's `build`, supported projects, and
+worker-local health without SSH.

deploy/config.example.jsonc

@@ -10,8 +10,9 @@
                                                  // Required — a project with no affinity can't be routed.
       "repo": "/var/lib/orchestra/repos/correx.git",       // Optional per-project git repo path.
                                                             // Overrides the global ORCHESTRA_REPO default.
-      "worktree_root": "/var/lib/orchestra/worktrees/correx" // Optional per-project worktree dir.
+      "worktree_root": "/var/lib/orchestra/worktrees/correx", // Optional per-project worktree dir.
                                                               // Overrides global ORCHESTRA_WORKTREE_ROOT.
+      "quality_gate": "go test ./... && go vet ./..."      // Worker runs this before deterministic delivery.
     },
     {
       "id": "maven",

deploy/redeploy.sh

@@ -7,7 +7,11 @@ trap 'rm -f -- "$tmp_bin"' EXIT
 
 cd "$repo_dir"
 echo "Building Orchestra..."
-go build -o "$tmp_bin" ./cmd/orchestra
+revision="$(git rev-parse HEAD)"
+build_time="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+dirty=false
+if [[ -n "$(git status --porcelain)" ]]; then dirty=true; fi
+go build -ldflags "-X orchestra/internal/buildinfo.Revision=$revision -X orchestra/internal/buildinfo.Time=$build_time -X orchestra/internal/buildinfo.Dirty=$dirty" -o "$tmp_bin" ./cmd/orchestra
 
 echo "Installing /usr/local/bin/orchestra..."
 sudo install -o root -g root -m 0755 "$tmp_bin" /usr/local/bin/orchestra

deploy/worker-projects.example.json

@@ -0,0 +1,14 @@
+{
+  "test-e2e": {
+    "repo": "/srv/orchestra/repos/test-e2e",
+    "worktree_root": "/srv/orchestra/worktrees/test-e2e",
+    "remote": "origin",
+    "quality_gate": "go test ./..."
+  },
+  "correx": {
+    "repo": "/srv/orchestra/repos/correx",
+    "worktree_root": "/srv/orchestra/worktrees/correx",
+    "remote": "origin",
+    "quality_gate": "go test ./... && go vet ./..."
+  }
+}