Kevin Veen-BirkenbachandClaude Opus 5.5
4540494c30
The Agents views gain a Hierarchie view: an org chart of the chair and the line offices read from the council claims. The operator appoints, hands over and recalls an office there; the page signs each change with the passkey and a host unit (client/offices.py, offices path unit) verifies the signature, removes a live holder itself and runs a plain council.py claim for the successor. council.py loses the --operator flag, so no agent can override a live holder. The agent order is now separate from task priority: rasci.py agents order stores it in agent-order.json beside the register through the nofollow helpers and never writes a --prio pin. It only breaks ties of equal task rank, also among the queue grants. The Hierarchie view edits it as a drag list. Host units run the installed skill scripts, so orchestrator.sh keeps the offices unit off while the installed council.py, nofollow.py or rasci.py differ from the tree. Job files, council files and hub records are read with O_NOFOLLOW and O_NONBLOCK and size caps; nofollow.rewrite replaces a claim without creating directories, so a beat never revives a released office. 🎯 Fix: 92 % 💥 Break: 4 % 💸 Cost: 100 % ⏱️ Time: 79 % 🛡️ Security: 100 % 🏆 Score: 100 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
132 lines
3.7 KiB
YAML
132 lines
3.7 KiB
YAML
name: kvb-orchestrator
|
|
|
|
services:
|
|
hub:
|
|
build: .
|
|
image: kvb-orchestrator:local
|
|
restart: unless-stopped
|
|
init: true
|
|
user: "${KVB_ORCHESTRATOR_USER:?written into .env by scripts/install.sh}"
|
|
read_only: true
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 2g
|
|
pids_limit: 256
|
|
healthcheck:
|
|
test: ["CMD", "python3", "-c", "import socket; socket.create_connection(('127.0.0.1', 8080), 2).close()"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
ports:
|
|
- "127.0.0.1:${KVB_ORCHESTRATOR_PORT:?set in .env}:8080"
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
command:
|
|
- --bind
|
|
- 0.0.0.0
|
|
- --listen-port
|
|
- "8080"
|
|
- --public-port
|
|
- "${KVB_ORCHESTRATOR_PORT:?set in .env}"
|
|
- --council
|
|
- /tmp/agents-council
|
|
- --pages
|
|
- /tmp/kvb-git-diff
|
|
- --state
|
|
- /state
|
|
- --host-state
|
|
- "${KVB_ORCHESTRATOR_STATE:?written into .env by scripts/install.sh}"
|
|
- --skills
|
|
- /skills
|
|
- --transcripts
|
|
- /projects
|
|
- --templates
|
|
- /app/templates
|
|
- --tree-file
|
|
- /tree/branch-tree.json
|
|
- --timers
|
|
- /timers
|
|
- --vendor
|
|
- /app/vendor
|
|
- --cleanup
|
|
- /state/cleanup
|
|
- --offices
|
|
- /state/offices
|
|
- --llm-url
|
|
- "${KVB_ORCHESTRATOR_LLM_URL}"
|
|
- --llm-model
|
|
- "${KVB_ORCHESTRATOR_LLM_MODEL}"
|
|
- --llm-key-file
|
|
- /run/kvb-orchestrator/llm.key
|
|
- --piper
|
|
- /opt/piper/bin/piper
|
|
- --voices
|
|
- /opt/voices
|
|
- --operator-voice
|
|
- "${KVB_ORCHESTRATOR_OPERATOR_VOICE:?set in .env}"
|
|
- --whisper
|
|
- /opt/whisper/whisper-cli
|
|
- --whisper-model
|
|
- /opt/whisper/ggml-base-q8_0.bin
|
|
- --scratch
|
|
- /scratch
|
|
- --approvers
|
|
- /approvers/approvers.json
|
|
tmpfs:
|
|
- /scratch:size=64m,mode=1777,noexec,nosuid,nodev
|
|
volumes:
|
|
- type: bind
|
|
source: /tmp
|
|
target: /tmp
|
|
read_only: true
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_COUNCIL:?written into .env by scripts/install.sh}"
|
|
target: /tmp/agents-council
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_SKILLS:?written into .env by scripts/install.sh}"
|
|
target: /skills
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_PROJECTS:?written into .env by scripts/install.sh}"
|
|
target: /projects
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_STATE:?written into .env by scripts/install.sh}"
|
|
target: /state
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
# the directory, not the file: pkgmgr replaces the file, and a file mount keeps showing the old inode
|
|
source: "${KVB_ORCHESTRATOR_TREE:?written into .env by scripts/orchestrator.sh}"
|
|
target: /tree
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_TIMERS:?written into .env by scripts/install.sh}"
|
|
target: /timers
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_APPROVERS:?written into .env by scripts/install.sh}"
|
|
target: /approvers
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
# /dev/null is an empty key file, which server.py --llm-key-file reads as no key
|
|
source: "${KVB_ORCHESTRATOR_LLM_KEY_FILE:-/dev/null}"
|
|
target: /run/kvb-orchestrator/llm.key
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|