kami
97a9c65302
Acts on the seven review comments on PR #1. Design A is gone (comment 4). clients/ deleted rather than tracked: with workers carrying cross-machine work the bridge is undeployed, which supersedes the 2026-07-27 "keep through Phase 5" decision. CLAUDE.md, AGENTS.md and AUDIT.md updated from "retained" to "deleted". The harness-hook completion path is gone (comment 10). Investigation of the live OpenCode QA run showed orchestra-worker owns completion end to end: it watches for .orchestra/done, confirms via AgentStatus that the agent is not busy, then posts through /v1/federation/* with both lease epoch and expected version. The hook scripts used a different, older convention (.orchestra-report.md) and posted to /v1/harness/complete, which had already been reduced to a 410 stub - so that path could not have completed a task. Nothing exercised it, because the live run never used it. Deleted: the three deploy/hooks scripts, the 410 route, the unmounted harnessCompletion handler, and its test. That test passed against a handler no mux routed to, which is the exact "looks wired but isn't" pattern CLAUDE.md warns about; the constant-time token compare added to it earlier today goes with it, having never been reachable. /v1/harness/turn is untouched and still live. Retired deployment files (comments 8, 12, 14): deploy/orchestra.service and deploy/redeploy.sh (which sudo-installed to /usr/local/bin and restarted that unit), plus deploy/docker-api-entrypoint.sh. The entrypoint was safe to remove once its premise was checked: env vars reach the container through `env_file: .env` in compose.yaml, not by sourcing /etc/orchestra/orchestra.env - only config.jsonc is bind-mounted there - and Dockerfile.api's line 17 already sets ORCHESTRA_DATA/ORCHESTRA_PORT. Dockerfile.api now execs /app/orchestra directly. orchestra-worker.service is a different, current unit and is kept. deploy/config.example.json deleted as a duplicate (comment 6); the annotated .jsonc is the one registry.go points at, and its header no longer tells the reader to copy the file that just went away. Documentation corrected beyond the deletions: - CLAUDE.md's deployment section claimed the container bind-mounts /etc/orchestra:ro and its entrypoint sources the env file. Both wrong. - AGENTS.md still described a systemd deployment on homesrv as of 2026-07-27. - AUDIT.md's H5 row still described a "retained compatibility handler". - deploy/DEPLOYMENT.md still named redeploy.sh as the deployment path. - deploy/orchestra.env.example still cited EnvironmentFile=. TOKEN_MINIMAL_WORKFLOW_PLAN.md (comment 2) is untouched: it and WEB_UI_PLAN.md were both missed by REVIEW.md's documentation sweep, and reconciling a 534-line forward-looking plan against AUDIT.md is its own task, not a review fixup. Verified: go build ./..., go vet ./..., go test ./... all pass after the deletions, and go list ./... has no node_modules entry. No live herdr or pane was touched; nothing was deployed. The running image still predates this commit until compose is rebuilt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GEugbHVYfAXFpTqDYbByEB
104 lines
4.7 KiB
Bash
104 lines
4.7 KiB
Bash
# Copy to the compose directory as `.env` (chmod 600) and fill in the values
|
|
# you need; `compose.yaml` loads it via `env_file:`. The retired
|
|
# orchestra.service EnvironmentFile= path is gone as of 2026-07-31, and the
|
|
# container has no entrypoint script that sources an env file — compose passes
|
|
# these in directly. Every var below is read directly from os.Getenv in
|
|
# cmd/orchestra/main.go and the packages it wires up — grep ORCHESTRA_ in the
|
|
# repo if this list ever needs re-deriving.
|
|
|
|
# --- Core ---
|
|
ORCHESTRA_DATA=/var/lib/orchestra/data
|
|
ORCHESTRA_PORT=9145
|
|
|
|
# --- Federation worker (set only on a harness host such as workpc) ---
|
|
# ORCHESTRA_URL=http://homesrv:9145
|
|
# ORCHESTRA_WORKER_ID=workpc-opencode # must equal ORCHESTRA_WORKER_HERDR_ID
|
|
# ORCHESTRA_WORKER_TOKEN=<per-worker-secret>
|
|
# ORCHESTRA_FEDERATION_ADMIT_TOKEN=<homesrv-admission-secret>
|
|
# ORCHESTRA_WORKER_HERDR_ID=workpc-opencode
|
|
# ORCHESTRA_WORKER_HARNESS=opencode
|
|
# ORCHESTRA_WORKER_HERDR=/home/orchestra/.config/herdr/herdr.sock
|
|
# ORCHESTRA_WORKER_STATE=/var/lib/orchestra-worker/state.json
|
|
# ORCHESTRA_GIT_REMOTE=origin
|
|
ORCHESTRA_MACHINE_ID=homesrv # required when the registry has multiple machines
|
|
|
|
# Static project/machine/herdr topology (registry.Load). Required for
|
|
# routing across more than one machine; validated at startup.
|
|
ORCHESTRA_CONFIG=/etc/orchestra/config.json
|
|
|
|
# --- Git worktrees (global default; per-project repo/worktree_root in
|
|
# ORCHESTRA_CONFIG overrides this per project — see registry.Project) ---
|
|
ORCHESTRA_REPO=/var/lib/orchestra/repo.git
|
|
ORCHESTRA_WORKTREE_ROOT=/var/lib/orchestra/worktrees
|
|
|
|
# Protocol version fallback for herdrs that don't set "protocol" in
|
|
# ORCHESTRA_CONFIG. Prefer setting it per-herdr in the config; only use this
|
|
# if every herdr on the fleet truly matches.
|
|
#ORCHESTRA_HERDR_PROTOCOL=1
|
|
|
|
# Hard rotation occupancy threshold (0 < x < 1). Default 0.75 if unset/invalid.
|
|
ORCHESTRA_OCCUPANCY_HARD=0.75
|
|
# Advisory handoff threshold and the harness context window used to turn
|
|
# per-session token counts into occupancy. Both values are worker-local.
|
|
ORCHESTRA_OCCUPANCY_SOFT=0.55
|
|
ORCHESTRA_CONTEXT_WINDOW=200000
|
|
# OpenCode stores per-session token counters in SQLite. This optional override
|
|
# must point at the worker-local database; the worker persists the resolved
|
|
# session ID for each lease, never "the latest" session.
|
|
#ORCHESTRA_OPENCODE_DB=/home/orchestra/.local/share/opencode/opencode.db
|
|
|
|
# --- Providers ---
|
|
# Local JSONL task ingestion (baseline adapter).
|
|
#ORCHESTRA_JSONL=/var/lib/orchestra/tasks.jsonl
|
|
|
|
# Gitea issue ingestion + terminal-state reflection.
|
|
#
|
|
# Multiple repos (one per project) — preferred if you have more than one
|
|
# Gitea-backed project. Points at a JSON array of
|
|
# {project,base_url,owner,repo,token,webhook_secret}; project is the
|
|
# registry project id ingested tasks are tagged with. Each source gets its
|
|
# own webhook path: /v1/providers/gitea/webhook/{project}.
|
|
#ORCHESTRA_GITEA_CONFIG=/etc/orchestra/gitea.json
|
|
#
|
|
# Single repo (legacy) — all four required together. Ignored if
|
|
# ORCHESTRA_GITEA_CONFIG is set. Webhook path is the unprefixed
|
|
# /v1/providers/gitea/webhook. Ingested tasks are tagged with project =
|
|
# ORCHESTRA_GITEA_REPO.
|
|
#ORCHESTRA_GITEA_URL=https://gitea.example.internal
|
|
#ORCHESTRA_GITEA_TOKEN=
|
|
#ORCHESTRA_GITEA_OWNER=
|
|
#ORCHESTRA_GITEA_REPO=
|
|
#ORCHESTRA_GITEA_WEBHOOK_SECRET=
|
|
|
|
# --- Delivery (notify-only surfaces) ---
|
|
# Telegram: both required together.
|
|
#ORCHESTRA_TELEGRAM_BOT_TOKEN=
|
|
#ORCHESTRA_TELEGRAM_CHAT_ID=
|
|
# ntfy: topic required, token/url optional (self-hosted ntfy). This token is
|
|
# handed *out* to the ntfy server; it is not an inbound credential — see
|
|
# ORCHESTRA_NTFY_SURFACE_TOKEN below.
|
|
#ORCHESTRA_NTFY_TOPIC=
|
|
#ORCHESTRA_NTFY_TOKEN=
|
|
#ORCHESTRA_NTFY_URL=https://ntfy.sh
|
|
|
|
# --- Bus authorization tokens (bearer auth per surface; a surface with no
|
|
# token set has no auth requirement — set these once you have real clients) ---
|
|
#ORCHESTRA_TUI_TOKEN=
|
|
# Required: the service refuses to start without both. The browser UI's
|
|
# task, lifecycle and approval controls are session-gated; it no longer
|
|
# accepts a shared Web bearer token. Generate the bcrypt hash with:
|
|
# go run ./cmd/orchestra-password
|
|
ORCHESTRA_WEB_USERNAME=operator
|
|
ORCHESTRA_WEB_PASSWORD_HASH=
|
|
# Set when the UI is served over plain HTTP, so the session cookie can be
|
|
# sent without Secure. Leave unset behind TLS.
|
|
#ORCHESTRA_UI_INSECURE_COOKIE=1
|
|
#ORCHESTRA_MCP_TOKEN=
|
|
#ORCHESTRA_MAVEN_TOKEN=
|
|
# Inbound bearer tokens for the notify-only surfaces, separate from the
|
|
# credentials used to *send* (ORCHESTRA_TELEGRAM_BOT_TOKEN, ORCHESTRA_NTFY_TOKEN).
|
|
# S12: ORCHESTRA_NTFY_TOKEN used to serve both roles, so configuring ntfy
|
|
# delivery silently minted a valid inbound credential.
|
|
#ORCHESTRA_TELEGRAM_TOKEN=
|
|
#ORCHESTRA_NTFY_SURFACE_TOKEN=
|