kami
97a9c65302
Acts on the seven review comments on PR #1. Design A is gone (comment 4). clients/ deleted rather than tracked: with workers carrying cross-machine work the bridge is undeployed, which supersedes the 2026-07-27 "keep through Phase 5" decision. CLAUDE.md, AGENTS.md and AUDIT.md updated from "retained" to "deleted". The harness-hook completion path is gone (comment 10). Investigation of the live OpenCode QA run showed orchestra-worker owns completion end to end: it watches for .orchestra/done, confirms via AgentStatus that the agent is not busy, then posts through /v1/federation/* with both lease epoch and expected version. The hook scripts used a different, older convention (.orchestra-report.md) and posted to /v1/harness/complete, which had already been reduced to a 410 stub - so that path could not have completed a task. Nothing exercised it, because the live run never used it. Deleted: the three deploy/hooks scripts, the 410 route, the unmounted harnessCompletion handler, and its test. That test passed against a handler no mux routed to, which is the exact "looks wired but isn't" pattern CLAUDE.md warns about; the constant-time token compare added to it earlier today goes with it, having never been reachable. /v1/harness/turn is untouched and still live. Retired deployment files (comments 8, 12, 14): deploy/orchestra.service and deploy/redeploy.sh (which sudo-installed to /usr/local/bin and restarted that unit), plus deploy/docker-api-entrypoint.sh. The entrypoint was safe to remove once its premise was checked: env vars reach the container through `env_file: .env` in compose.yaml, not by sourcing /etc/orchestra/orchestra.env - only config.jsonc is bind-mounted there - and Dockerfile.api's line 17 already sets ORCHESTRA_DATA/ORCHESTRA_PORT. Dockerfile.api now execs /app/orchestra directly. orchestra-worker.service is a different, current unit and is kept. deploy/config.example.json deleted as a duplicate (comment 6); the annotated .jsonc is the one registry.go points at, and its header no longer tells the reader to copy the file that just went away. Documentation corrected beyond the deletions: - CLAUDE.md's deployment section claimed the container bind-mounts /etc/orchestra:ro and its entrypoint sources the env file. Both wrong. - AGENTS.md still described a systemd deployment on homesrv as of 2026-07-27. - AUDIT.md's H5 row still described a "retained compatibility handler". - deploy/DEPLOYMENT.md still named redeploy.sh as the deployment path. - deploy/orchestra.env.example still cited EnvironmentFile=. TOKEN_MINIMAL_WORKFLOW_PLAN.md (comment 2) is untouched: it and WEB_UI_PLAN.md were both missed by REVIEW.md's documentation sweep, and reconciling a 534-line forward-looking plan against AUDIT.md is its own task, not a review fixup. Verified: go build ./..., go vet ./..., go test ./... all pass after the deletions, and go list ./... has no node_modules entry. No live herdr or pane was touched; nothing was deployed. The running image still predates this commit until compose is rebuilt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GEugbHVYfAXFpTqDYbByEB
2.8 KiB
Deployment verification
Both binaries embed their Git revision, UTC build time, and dirty flag. The
coordinator is deployed as a Docker Compose image — see "For the Docker
coordinator deployment" below for the build that carries provenance. (The old
deploy/redeploy.sh + orchestra.service path was deleted on 2026-07-31;
orchestra-worker.service is a different, still-current unit.)
Browser operator login
The browser UI requires ORCHESTRA_WEB_USERNAME and
ORCHESTRA_WEB_PASSWORD_HASH. Generate a bcrypt hash without putting the
password in shell history:
go run ./cmd/orchestra-password
Set the emitted hash in the service environment along with the chosen
username, then restart the coordinator. ORCHESTRA_WEB_TOKEN is not used by
the browser UI anymore.
Build a worker for staging on workpc with:
revision=$(git rev-parse HEAD)
build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
dirty=false; test -z "$(git status --porcelain)" || dirty=true
go build -ldflags "-X orchestra/internal/buildinfo.Revision=$revision -X orchestra/internal/buildinfo.Time=$build_time -X orchestra/internal/buildinfo.Dirty=$dirty" -o orchestra-worker ./cmd/orchestra-worker
scp orchestra-worker workpc:~/orchestra-deploy/orchestra-worker
ssh workpc 'sha256sum ~/orchestra-deploy/orchestra-worker'
The worker receives only the path to a normal project configuration file:
ORCHESTRA_WORKER_PROJECT_CONFIG_FILE=/etc/orchestra/worker-projects.json.
That file contains a JSON object whose project entries contain repo,
worktree_root, and remote; mount or provision it like any other worker
configuration. The legacy single-checkout ORCHESTRA_WORKER_PROJECTS comma
list remains supported for one existing checkout. An absent project is
ineligible for routing.
Verify the coordinator at GET /v1/admin/diagnostics with the normal admin
credential: its build object is the coordinator provenance. GET /v1/federation/workers shows every worker's build, supported projects, and
worker-local health without SSH.
For the Docker coordinator deployment, provide the same provenance as build
arguments (the Dockerfile intentionally cannot read .git from its build
context):
revision=$(git rev-parse HEAD)
build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
dirty=false; test -z "$(git status --porcelain)" || dirty=true
docker compose build \
--build-arg BUILD_REVISION="$revision" \
--build-arg BUILD_TIME="$build_time" \
--build-arg BUILD_DIRTY="$dirty" \
orchestra-api
docker compose up -d --no-deps orchestra-api
If a pre-v2 event log has the historical repeated-seq=1 prefix, the current
coordinator intentionally refuses to replay it. Stop every coordinator using
the data directory and run the explicit, backup-preserving migration before
deploying the current image:
orchestra-migrate -data /var/lib/orchestra/data -confirm