kami
95454afa72
All five defects filed while implementing B18, plus the router flake that predated them. None of this has run on the deployed instance: the service is stopped and /usr/local/bin/orchestra predates every change here. B20 is the one that could silently defeat approvals. The capture revision was UnixNano, so it changed on every read and said nothing about whether the pane had changed; it is now an FNV-1a hash of the pane text, changing iff the text does. The worse half was precedence: capture() preferred the coordinator over a published worker capture, handing Queue a timestamp the owning worker's staleness check could never match, so every federated approval resolved "stale" and the keystroke never happened. Worker captures now win — their existence means a registered worker owns that pane — and capturePane follows the same precedence via Capture.Source rather than guessing. B19 was filed as "federated approvals emit no event", which overstated it: the resolution half already existed, and correctly fires only on an acknowledged worker report. The missing half was the request. Server.action now appends ApprovalRequested at queue time, subject_ref set to the command ID the later resolution carries. If that append fails the queued command is resolved "rejected" — a keystroke that left no audit trail must not run. B21 bounds the command list: resolved commands prune after 30 minutes on both Queue and Commands, pending ones never at any age, since dropping one would discard an operator decision. The persistence half stays open and is recorded as such — captures and commands are still in-memory only. S12 splits ORCHESTRA_NTFY_TOKEN, which was both the secret handed to the ntfy server and a valid inbound credential for the ntfy surface; the latter is now ORCHESTRA_NTFY_SURFACE_TOKEN. Breaking: a deployment relying on the old dual use has no inbound gate until it sets the new variable. S13 deletes the dead auth() copy of the authorization policy. The router flake was in the test, not in assignment. Store.Tasks() ranges a map, and the assertion indexed two separate Tasks() calls, failing whenever the orderings disagreed; instrumenting it showed a valid TaskLeased and a genuinely leased task on every "failing" run. It now snapshots once and asserts that exactly one task is leased, and passes at -count=60. AUDIT.md records what is still not done: the deployed env and binary, the live re-verification B13-B17 has always lacked, and two operational faults found in the journal that block it — all six herdrs are refusing connections, and ntfy delivery is failing 403 on every send. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01535A3Y8RtkAi8wYuWhtkEd
92 lines
4.0 KiB
Bash
92 lines
4.0 KiB
Bash
# Copy to /etc/orchestra/orchestra.env (chmod 600, owned by the orchestra
|
|
# user) and fill in the values you need. Referenced by orchestra.service via
|
|
# EnvironmentFile=. Every var below is read directly from os.Getenv in
|
|
# cmd/orchestra/main.go and the packages it wires up — grep ORCHESTRA_ in the
|
|
# repo if this list ever needs re-deriving.
|
|
|
|
# --- Core ---
|
|
ORCHESTRA_DATA=/var/lib/orchestra/data
|
|
ORCHESTRA_PORT=9145
|
|
|
|
# --- Federation worker (set only on a harness host such as workpc) ---
|
|
# ORCHESTRA_URL=http://homesrv:9145
|
|
# ORCHESTRA_WORKER_ID=workpc-opencode # must equal ORCHESTRA_WORKER_HERDR_ID
|
|
# ORCHESTRA_WORKER_TOKEN=<per-worker-secret>
|
|
# ORCHESTRA_FEDERATION_ADMIT_TOKEN=<homesrv-admission-secret>
|
|
# ORCHESTRA_WORKER_HERDR_ID=workpc-opencode
|
|
# ORCHESTRA_WORKER_HARNESS=opencode
|
|
# ORCHESTRA_WORKER_HERDR=/home/orchestra/.config/herdr/herdr.sock
|
|
# ORCHESTRA_WORKER_STATE=/var/lib/orchestra-worker/state.json
|
|
# ORCHESTRA_GIT_REMOTE=origin
|
|
# ORCHESTRA_MACHINE_ID=homesrv # set on the authoritative coordinator
|
|
|
|
# Static project/machine/herdr topology (registry.Load). Required for
|
|
# routing across more than one machine; validated at startup.
|
|
ORCHESTRA_CONFIG=/etc/orchestra/config.json
|
|
|
|
# --- Git worktrees (global default; per-project repo/worktree_root in
|
|
# ORCHESTRA_CONFIG overrides this per project — see registry.Project) ---
|
|
ORCHESTRA_REPO=/var/lib/orchestra/repo.git
|
|
ORCHESTRA_WORKTREE_ROOT=/var/lib/orchestra/worktrees
|
|
|
|
# Protocol version fallback for herdrs that don't set "protocol" in
|
|
# ORCHESTRA_CONFIG. Prefer setting it per-herdr in the config; only use this
|
|
# if every herdr on the fleet truly matches.
|
|
#ORCHESTRA_HERDR_PROTOCOL=1
|
|
|
|
# Hard rotation occupancy threshold (0 < x < 1). Default 0.75 if unset/invalid.
|
|
ORCHESTRA_OCCUPANCY_HARD=0.75
|
|
|
|
# --- Providers ---
|
|
# Local JSONL task ingestion (baseline adapter).
|
|
#ORCHESTRA_JSONL=/var/lib/orchestra/tasks.jsonl
|
|
|
|
# Gitea issue ingestion + terminal-state reflection.
|
|
#
|
|
# Multiple repos (one per project) — preferred if you have more than one
|
|
# Gitea-backed project. Points at a JSON array of
|
|
# {project,base_url,owner,repo,token,webhook_secret}; project is the
|
|
# registry project id ingested tasks are tagged with. Each source gets its
|
|
# own webhook path: /v1/providers/gitea/webhook/{project}.
|
|
#ORCHESTRA_GITEA_CONFIG=/etc/orchestra/gitea.json
|
|
#
|
|
# Single repo (legacy) — all four required together. Ignored if
|
|
# ORCHESTRA_GITEA_CONFIG is set. Webhook path is the unprefixed
|
|
# /v1/providers/gitea/webhook. Ingested tasks are tagged with project =
|
|
# ORCHESTRA_GITEA_REPO.
|
|
#ORCHESTRA_GITEA_URL=https://gitea.example.internal
|
|
#ORCHESTRA_GITEA_TOKEN=
|
|
#ORCHESTRA_GITEA_OWNER=
|
|
#ORCHESTRA_GITEA_REPO=
|
|
#ORCHESTRA_GITEA_WEBHOOK_SECRET=
|
|
|
|
# --- Delivery (notify-only surfaces) ---
|
|
# Telegram: both required together.
|
|
#ORCHESTRA_TELEGRAM_BOT_TOKEN=
|
|
#ORCHESTRA_TELEGRAM_CHAT_ID=
|
|
# ntfy: topic required, token/url optional (self-hosted ntfy). This token is
|
|
# handed *out* to the ntfy server; it is not an inbound credential — see
|
|
# ORCHESTRA_NTFY_SURFACE_TOKEN below.
|
|
#ORCHESTRA_NTFY_TOPIC=
|
|
#ORCHESTRA_NTFY_TOKEN=
|
|
#ORCHESTRA_NTFY_URL=https://ntfy.sh
|
|
|
|
# --- Bus authorization tokens (bearer auth per surface; a surface with no
|
|
# token set has no auth requirement — set these once you have real clients) ---
|
|
#ORCHESTRA_TUI_TOKEN=
|
|
# Required: the service refuses to start without it. It gates the web UI's
|
|
# task, lifecycle and approval controls, and it is also the token for any
|
|
# /v1/ caller that does not declare a surface (they default to Web).
|
|
ORCHESTRA_WEB_TOKEN=
|
|
# Set when the UI is served over plain HTTP, so the session cookie can be
|
|
# sent without Secure. Leave unset behind TLS.
|
|
#ORCHESTRA_UI_INSECURE_COOKIE=1
|
|
#ORCHESTRA_MCP_TOKEN=
|
|
#ORCHESTRA_MAVEN_TOKEN=
|
|
# Inbound bearer tokens for the notify-only surfaces, separate from the
|
|
# credentials used to *send* (ORCHESTRA_TELEGRAM_BOT_TOKEN, ORCHESTRA_NTFY_TOKEN).
|
|
# S12: ORCHESTRA_NTFY_TOKEN used to serve both roles, so configuring ntfy
|
|
# delivery silently minted a valid inbound credential.
|
|
#ORCHESTRA_TELEGRAM_TOKEN=
|
|
#ORCHESTRA_NTFY_SURFACE_TOKEN=
|