Kevin Veen-BirkenbachandClaude Opus 5.5
912a3dc07f
Phase 3 of requirement 001. The orchestrator no longer starts git: orchestrator/kvb_orchestrator/tree.py maps the document that pkgmgr branch tree writes (repos, branches, worktrees, detached heads, delete_ready) onto the Tree view, re-reads it when mtime or size change, and reports a missing or broken file as an empty tree with the error. compose.yml mounts the tree directory read-only (a file mount would keep the replaced inode). /api/state touches state/tree-heartbeat; kvb-orchestrator-tree.timer runs every minute and its oneshot service runs only while that heartbeat is younger than 5 minutes, with PATH=/usr/bin:/bin and the pkgmgr venv that the install builds from the newest v* tag a fully trusted GPG key signed, cloned fresh from PKGMGR_REPO because the local checkout's config is sandbox-writable. Dialectic verdict 2026-11-06 (2 rounds, 5 skeptics, ~85 %): hardened git runner in pkgmgr, gc classification shared with the tree scan, forge facts only from an unlocked Secret Service token with a 600 s cache, atomic tree output refreshed by open/close/drop/gc, host units outside sandbox-writable paths, orchestrator reads the file only. Losing objections: extending the host runner (it would run bash -c on signed text), a new payload kind, copying the pkgmgr checkout, a tree limited to .worktrees. Operator answers: signed-tag venv, UI delete keeps volumes and is local only, ignored files beyond known caches block a delete, scan only while the page polls. Delete jobs, gc_item signing and the UI delete path follow in phase 4. MEDUSA acceptances (kvb-think-criticize 2026-11-07, 1 skeptic): MEDUSA-MM-SCAN-058 orchestrator/server.py:64 and :80 false positives (case-insensitive substring pla in --templates and Places; --tree-file is a read-only JSON file, no model loading). 🎯 Fix: 93 % 💥 Break: 4 % 💸 Cost: – ⏱️ Time: – 🛡️ Security: 100 % 🏆 Score: 89 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
126 lines
3.6 KiB
YAML
126 lines
3.6 KiB
YAML
name: kvb-orchestrator
|
|
|
|
services:
|
|
hub:
|
|
build: .
|
|
image: kvb-orchestrator:local
|
|
restart: unless-stopped
|
|
init: true
|
|
user: "${KVB_ORCHESTRATOR_USER:?written into .env by scripts/install.sh}"
|
|
read_only: true
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 2g
|
|
pids_limit: 256
|
|
healthcheck:
|
|
test: ["CMD", "python3", "-c", "import socket; socket.create_connection(('127.0.0.1', 8080), 2).close()"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
ports:
|
|
- "127.0.0.1:${KVB_ORCHESTRATOR_PORT:?set in .env}:8080"
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
command:
|
|
- --bind
|
|
- 0.0.0.0
|
|
- --listen-port
|
|
- "8080"
|
|
- --public-port
|
|
- "${KVB_ORCHESTRATOR_PORT:?set in .env}"
|
|
- --council
|
|
- /tmp/agents-council
|
|
- --pages
|
|
- /tmp/kvb-git-diff
|
|
- --state
|
|
- /state
|
|
- --host-state
|
|
- "${KVB_ORCHESTRATOR_STATE:?written into .env by scripts/install.sh}"
|
|
- --skills
|
|
- /skills
|
|
- --transcripts
|
|
- /projects
|
|
- --templates
|
|
- /app/templates
|
|
- --tree-file
|
|
- /tree/branch-tree.json
|
|
- --timers
|
|
- /timers
|
|
- --llm-url
|
|
- "${KVB_ORCHESTRATOR_LLM_URL}"
|
|
- --llm-model
|
|
- "${KVB_ORCHESTRATOR_LLM_MODEL}"
|
|
- --llm-key-file
|
|
- /run/kvb-orchestrator/llm.key
|
|
- --piper
|
|
- /opt/piper/bin/piper
|
|
- --voices
|
|
- /opt/voices
|
|
- --operator-voice
|
|
- "${KVB_ORCHESTRATOR_OPERATOR_VOICE:?set in .env}"
|
|
- --whisper
|
|
- /opt/whisper/whisper-cli
|
|
- --whisper-model
|
|
- /opt/whisper/ggml-base-q8_0.bin
|
|
- --scratch
|
|
- /scratch
|
|
- --approvers
|
|
- /approvers/approvers.json
|
|
tmpfs:
|
|
- /scratch:size=64m,mode=1777,noexec,nosuid,nodev
|
|
volumes:
|
|
- type: bind
|
|
source: /tmp
|
|
target: /tmp
|
|
read_only: true
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_COUNCIL:?written into .env by scripts/install.sh}"
|
|
target: /tmp/agents-council
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_SKILLS:?written into .env by scripts/install.sh}"
|
|
target: /skills
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_PROJECTS:?written into .env by scripts/install.sh}"
|
|
target: /projects
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_STATE:?written into .env by scripts/install.sh}"
|
|
target: /state
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
# the directory, not the file: pkgmgr replaces the file, and a file mount keeps showing the old inode
|
|
source: "${KVB_ORCHESTRATOR_TREE:?written into .env by scripts/orchestrator.sh}"
|
|
target: /tree
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_TIMERS:?written into .env by scripts/install.sh}"
|
|
target: /timers
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: "${KVB_ORCHESTRATOR_APPROVERS:?written into .env by scripts/install.sh}"
|
|
target: /approvers
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
# /dev/null is an empty key file, which server.py --llm-key-file reads as no key
|
|
source: "${KVB_ORCHESTRATOR_LLM_KEY_FILE:-/dev/null}"
|
|
target: /run/kvb-orchestrator/llm.key
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|