kami
7f12c7fc37
The v3 stack, previously an uncommitted working tree, plus this session's two units and the burn-in instrument. This commit is the burn-in build identity: coordinator and worker must both report this revision before a task is created. Workflow (earlier sessions, uncommitted until now): human decision events and reduction, source cursors and reconcile-before-launch, turn-boundary reconciliation, internal/agentctx as the single renderer, ace-fca phases with sealed artifacts, the trajectory gate, bounded grilling, independent review, task pr enforcement, and human review reflection. Capability restrictions at the agent boundary: an authz.Agent surface at GatedWrite may ask and may not act. It also fixes two bugs the unit exposed -- gated surfaces could not reach the two endpoints written for them, and RequestHumanDecision would block an unowned task while rejecting a question from the session that did own it. Turn-boundary reconcile-failure escalation: a streak of consecutive failures asks the session to hand off, fenced on the lease epoch, with reconcile_failure as a real handoff reason. The worker was dropping the coordinator's verdict on the floor; it now acts on it. Burn-in: herdr.WriteLaunchContext dumps the exact agentctx.Build result to <worktree>/.orchestra/launch.md at every launch, local and federated. BURNIN.md is the runbook. deploy/build.sh stamps both binaries from one commit. go build, go vet and go test ./... pass, 20 packages. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
3.0 KiB
Deployment verification
Both binaries embed their Git revision, UTC build time, and dirty flag. The
coordinator is deployed as a Docker Compose image — see "For the Docker
coordinator deployment" below for the build that carries provenance. (The old
deploy/redeploy.sh + orchestra.service path was deleted on 2026-07-31;
orchestra-worker.service is a different, still-current unit.)
Browser operator login
The browser UI requires ORCHESTRA_WEB_USERNAME and
ORCHESTRA_WEB_PASSWORD_HASH. Generate a bcrypt hash without putting the
password in shell history:
go run ./cmd/orchestra-password
Set the emitted hash in the service environment along with the chosen
username, then restart the coordinator. ORCHESTRA_WEB_TOKEN is not used by
the browser UI anymore.
Build a worker for staging on workpc with:
revision=$(git rev-parse HEAD)
build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
dirty=false; test -z "$(git status --porcelain)" || dirty=true
go build -ldflags "-X orchestra/internal/buildinfo.Revision=$revision -X orchestra/internal/buildinfo.Time=$build_time -X orchestra/internal/buildinfo.Dirty=$dirty" -o orchestra-worker ./cmd/orchestra-worker
scp orchestra-worker workpc:~/orchestra-deploy/orchestra-worker
ssh workpc 'sha256sum ~/orchestra-deploy/orchestra-worker'
The worker receives only the path to a normal project configuration file:
ORCHESTRA_WORKER_PROJECT_CONFIG_FILE=/etc/orchestra/worker-projects.json.
That file contains a JSON object whose project entries contain repo,
worktree_root, and remote; mount or provision it like any other worker
configuration. The legacy single-checkout ORCHESTRA_WORKER_PROJECTS comma
list remains supported for one existing checkout. An absent project is
ineligible for routing.
Verify the coordinator at GET /v1/admin/diagnostics with the normal admin
credential: its build object is the coordinator provenance. GET /v1/federation/workers shows every worker's build, supported projects, and
worker-local health without SSH.
Build both binaries with deploy/build.sh, which stamps them from one commit
and refuses a dirty tree. A burn-in run must never pair a new coordinator with
an old worker, and matching revisions are how that is checked rather than
assumed.
For the Docker coordinator deployment, provide the same provenance as build
arguments (the Dockerfile intentionally cannot read .git from its build
context):
revision=$(git rev-parse HEAD)
build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
dirty=false; test -z "$(git status --porcelain)" || dirty=true
docker compose build \
--build-arg BUILD_REVISION="$revision" \
--build-arg BUILD_TIME="$build_time" \
--build-arg BUILD_DIRTY="$dirty" \
orchestra-api
docker compose up -d --no-deps orchestra-api
If a pre-v2 event log has the historical repeated-seq=1 prefix, the current
coordinator intentionally refuses to replay it. Stop every coordinator using
the data directory and run the explicit, backup-preserving migration before
deploying the current image:
orchestra-migrate -data /var/lib/orchestra/data -confirm