feat(orchestrator): rename kvb-hub to Agent Orchestrator with the phase 2 surface

Surface (requirement 001 phase 2): navigation Stream (Inbox, Regeln) / Agents / Artifacts with keys 1-3 and hash routes (#graph and #tree redirect), header with title, command palette and settings only, server-side badges (unsnoozed inbox, beats within 900 s, open jobs), a Mayday banner with "aufheben", four stream chips with agent:/art:/seit: search, Filter and time menus, the inbox in main, an agents toolbar (Funk an alle with Newsletter, Broadcast, Pan-Pan, Security, Mayday; Priorität; Tag/Nacht), Post or Call in the agent panel, Ambiente in the settings and read-aloud over the seven classes with Mayday locked. Rename (decision 9): hub/ is orchestrator/, the package kvb_orchestrator, the unit kvb-orchestrator-runner.service, scripts/orchestrator.sh, environment KVB_ORCHESTRATOR_*, make targets orchestrator-*, the MCP server, image and compose project kvb-orchestrator, the guard header X-Kvb-Orchestrator and the message marker [kvb-orchestrator msg <id>]. install runs migrate first: it stops the old container, removes its image and code, moves state, approvals and pinned keys, swaps the MCP registration, the PermissionRequest hook and the runner unit, and changes nothing on a second run (scratch-HOME test with stub docker, claude and systemctl). Saved views fall back to the old localStorage key once. MEDUSA acceptances carried to the renamed paths: 82 rows whose lines are unchanged (reason prefixed "renamed from <old path>, line unchanged"), and 7 rows whose text changed only in the product name, the package name, a temp prefix or a new class argument, each upheld by one kvb-think-criticize skeptic (approval.py:60, messaging.py:53, server.py:56, tests/hub_support.py:64, passkey.py:205, page-agent.js:75, language.py:46). Cost 101 %: the longer name adds 15 tokens of skill text; the operator approved it with the commit. 🎯 Fix: 92 % 💥 Break: 4 % 💸 Cost: 101 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 87 🚦 Gate: ⚠️ cost 101 % > 100: ask the operator before the commit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 22:20:06 +00:00
1 parent 54f3725aa1
commit 6f940b4415
@@ -0,0 +1,132 @@
+name: kvb-orchestrator
+
+services:
+  hub:
+    build: .
+    image: kvb-orchestrator:local
+    restart: unless-stopped
+    init: true
+    user: "${KVB_ORCHESTRATOR_USER:?written into .env by scripts/install.sh}"
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    mem_limit: 2g
+    pids_limit: 256
+    healthcheck:
+      test: ["CMD", "python3", "-c", "import socket; socket.create_connection(('127.0.0.1', 8080), 2).close()"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    ports:
+      - "127.0.0.1:${KVB_ORCHESTRATOR_PORT:?set in .env}:8080"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    command:
+      - --bind
+      - 0.0.0.0
+      - --listen-port
+      - "8080"
+      - --public-port
+      - "${KVB_ORCHESTRATOR_PORT:?set in .env}"
+      - --council
+      - /tmp/agents-council
+      - --pages
+      - /tmp/kvb-git-diff
+      - --state
+      - /state
+      - --host-state
+      - "${KVB_ORCHESTRATOR_STATE:?written into .env by scripts/install.sh}"
+      - --skills
+      - /skills
+      - --transcripts
+      - /projects
+      - --templates
+      - /app/templates
+      - --repos
+      - "${KVB_ORCHESTRATOR_REPOS:?written into .env by scripts/install.sh}"
+      - --worktrees
+      - "${KVB_ORCHESTRATOR_WORKTREES:?written into .env by scripts/install.sh}"
+      - --timers
+      - /timers
+      - --llm-url
+      - "${KVB_ORCHESTRATOR_LLM_URL}"
+      - --llm-model
+      - "${KVB_ORCHESTRATOR_LLM_MODEL}"
+      - --llm-key-file
+      - /run/kvb-orchestrator/llm.key
+      - --piper
+      - /opt/piper/bin/piper
+      - --voices
+      - /opt/voices
+      - --operator-voice
+      - "${KVB_ORCHESTRATOR_OPERATOR_VOICE:?set in .env}"
+      - --whisper
+      - /opt/whisper/whisper-cli
+      - --whisper-model
+      - /opt/whisper/ggml-base-q8_0.bin
+      - --scratch
+      - /scratch
+      - --approvers
+      - /approvers/approvers.json
+    tmpfs:
+      - /scratch:size=64m,mode=1777,noexec,nosuid,nodev
+    volumes:
+      - type: bind
+        source: /tmp
+        target: /tmp
+        read_only: true
+      - type: bind
+        source: "${KVB_ORCHESTRATOR_COUNCIL:?written into .env by scripts/install.sh}"
+        target: /tmp/agents-council
+        bind:
+          create_host_path: false
+      - type: bind
+        source: "${KVB_ORCHESTRATOR_SKILLS:?written into .env by scripts/install.sh}"
+        target: /skills
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: "${KVB_ORCHESTRATOR_PROJECTS:?written into .env by scripts/install.sh}"
+        target: /projects
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: "${KVB_ORCHESTRATOR_STATE:?written into .env by scripts/install.sh}"
+        target: /state
+        bind:
+          create_host_path: false
+      - type: bind
+        source: "${KVB_ORCHESTRATOR_REPOS:?written into .env by scripts/install.sh}"
+        target: "${KVB_ORCHESTRATOR_REPOS:?written into .env by scripts/install.sh}"
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: "${KVB_ORCHESTRATOR_WORKTREES:?written into .env by scripts/install.sh}"
+        target: "${KVB_ORCHESTRATOR_WORKTREES:?written into .env by scripts/install.sh}"
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: "${KVB_ORCHESTRATOR_TIMERS:?written into .env by scripts/install.sh}"
+        target: /timers
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: "${KVB_ORCHESTRATOR_APPROVERS:?written into .env by scripts/install.sh}"
+        target: /approvers
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        # /dev/null is an empty key file, which server.py --llm-key-file reads as no key
+        source: "${KVB_ORCHESTRATOR_LLM_KEY_FILE:-/dev/null}"
+        target: /run/kvb-orchestrator/llm.key
+        read_only: true
+        bind:
+          create_host_path: false