claude-bot
0ab6a33ef5
Close the missing invariant "by merge-verify time the branch has an open code-PR". The pipeline created a PR only on the developer path with a fresh worktree commit (launcher._ensure_pr), so a branch (e.g. after a manual main restore) could reach the deploy->done merge-verify under-gate PR-less -> merge_pr returned "no open PR" -> a FALSE HOLD (ORCH-074 incident). - merge_gate.ensure_open_pr(repo, branch) -> (status, detail): idempotent leaf-actor (never-raise). GET open PRs filtered head==branch AND base==main (identical to merge_pr/ORCH-073 FR-3 — auto docs-PR is not a code-PR) -> existed; else POST -> created; 409/422 race -> re-GET -> existed (no dup); any other error -> failed. - stage_engine._handle_merge_verify: врезка after validated_revision and BEFORE merge_pr. created|existed -> proceed; failed -> honest HOLD via new _hold_pr_create_failed (note "pr-create-failed-hold", text distinguishable from the not-merged HOLD; task stays on deploy, NO rollback). - launcher._ensure_pr delegated to ensure_open_pr (single PR-creation path, shared head==branch & base==main filter); the developer-only trigger is unchanged. - ORCH-073 protection untouched & authoritative: merge is confirmed ONLY by verify_merged_to_main (SHA-in-main) + check_main_regression. Real un-merged code still HOLDs. - Kill-switch ORCH_MERGE_VERIFY_AUTOCREATE_PR_ENABLED (default true); scope = merge_verify_applies (self-hosting / merge_verify_repos); non-self -> no-op; false -> ORCH-074 behaviour 1:1. No DB migration; main never push/force-push. - Append ORCH-082 marker to MAIN_REGRESSION_MARKERS (append-only convention). - conftest defaults the autocreate flag OFF (mirrors merge_verify_enabled) so unrelated deploy->done tests stay 1:1 (no network). Tests: tests/test_orch082_ensure_pr.py (TC-01..05), tests/test_orch082_merge_verify_autocreate.py (TC-06..12). Docs: README merge-verify block (ORCH-082), CHANGELOG, .env.example. Refs: ORCH-082 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
307 lines
19 KiB
Plaintext
307 lines
19 KiB
Plaintext
ORCH_PLANE_API_URL=http://plane-app-api-1:8000
|
|
# External (browser) web URL of Plane for clickable issue links in notifications
|
|
# (ORCH-017). Falls back to ORCH_PLANE_API_URL; a loopback fallback is treated as
|
|
# "no web URL" and the Plane link is omitted. Example: https://plane.example.org
|
|
ORCH_PLANE_WEB_URL=
|
|
ORCH_PLANE_API_TOKEN=
|
|
ORCH_PLANE_WORKSPACE_SLUG=
|
|
ORCH_PLANE_WEBHOOK_SECRET=
|
|
ORCH_GITEA_URL=http://localhost:3000
|
|
ORCH_GITEA_TOKEN=
|
|
ORCH_GITEA_WEBHOOK_SECRET=
|
|
ORCH_CLAUDE_BIN=/usr/bin/claude
|
|
ORCH_REPOS_DIR=/home/slin/repos
|
|
ORCH_DB_PATH=/app/data/orchestrator.db
|
|
|
|
# ── Agent model / effort / fallback (ORCH-41, validation ORCH-74) ─────────────
|
|
# Per-agent LLM model + reasoning effort, resolved by launcher.resolve_agent_*.
|
|
# Resolution priority (per agent): project-override (projects_json agent_models/
|
|
# agent_efforts) > ORCH_AGENT_MODEL_<AGENT> / ORCH_AGENT_EFFORT_<AGENT> >
|
|
# ORCH_AGENT_MODEL_DEFAULT / ORCH_AGENT_EFFORT_DEFAULT > CLI default (no flag).
|
|
# The frontmatter `model:` in .openclaw/agents/*.md is DESCRIPTIVE only and is NOT
|
|
# read — config below is the single source of truth for the model (ORCH-74 G1).
|
|
#
|
|
# ORCH-74 (G2): a resolved MODEL name is validated (^claude-…$ format check) before
|
|
# it reaches --model. A structurally invalid name (typo, gpt-4, empty) is logged and
|
|
# the next valid level is used (in the limit: no --model flag). Forward-compatible:
|
|
# a future claude-* version passes without editing any allowlist. EFFORT is validated
|
|
# against low|medium|high|xhigh|max (ORCH-41); an invalid effort is dropped.
|
|
#
|
|
# All 6 agents resolve to claude-opus-4-8 (model-routing G3 NOT enabled). Leave the
|
|
# per-agent overrides empty to use the default. Do NOT hardcode the model version
|
|
# anywhere except ORCH_AGENT_MODEL_DEFAULT.
|
|
ORCH_AGENT_MODEL_DEFAULT=claude-opus-4-8
|
|
ORCH_AGENT_MODEL_ANALYST=
|
|
ORCH_AGENT_MODEL_ARCHITECT=
|
|
ORCH_AGENT_MODEL_DEVELOPER=
|
|
ORCH_AGENT_MODEL_REVIEWER=
|
|
ORCH_AGENT_MODEL_TESTER=
|
|
ORCH_AGENT_MODEL_DEPLOYER=
|
|
# Effort split (ORCH-081/ORCH-52h): thinking agents (analyst/architect/reviewer)
|
|
# -> high; developer -> xhigh (coding/agentic role, Opus 4.8 canon); mechanical
|
|
# agents (tester/deployer) -> medium. NB: an empty ORCH_AGENT_EFFORT_*= no longer
|
|
# zeroes the effort — the launcher falls back to a per-role floor (= the config.py
|
|
# class-default) so each role still runs at its canonical level (ORCH-081).
|
|
ORCH_AGENT_EFFORT_DEFAULT=high
|
|
ORCH_AGENT_EFFORT_ANALYST=high
|
|
ORCH_AGENT_EFFORT_ARCHITECT=high
|
|
ORCH_AGENT_EFFORT_DEVELOPER=xhigh
|
|
ORCH_AGENT_EFFORT_REVIEWER=high
|
|
ORCH_AGENT_EFFORT_TESTER=medium
|
|
ORCH_AGENT_EFFORT_DEPLOYER=medium
|
|
# Optional --fallback-model used when the primary is overloaded. Empty -> no flag
|
|
# (G4 NOT enabled, ADR-001 ORCH-74: determinism — all agents stay on opus-4-8). A
|
|
# non-empty value is validated by the SAME predicate as the model; a typo is dropped.
|
|
ORCH_AGENT_FALLBACK_MODEL=
|
|
# ORCH-042/ORCH-067: live-tracker mode. bump (DEFAULT since ORCH-067) -> on every
|
|
# update the old card is deleted and a fresh one is sent silently to the BOTTOM of
|
|
# the chat (deleteMessage + sendMessage + repoint), so the current status is always
|
|
# the last message in an active chat. edit -> the task card is edited in place
|
|
# (editMessageText). One card per task in both modes. Any value other than "bump"
|
|
# (incl. empty/garbage) -> edit.
|
|
ORCH_TRACKER_MODE=bump
|
|
# ORCH-067: best-effort live-overlay for the card status line. The offline core
|
|
# (stage -> Plane status, In Review from the brd-clock) always works without network;
|
|
# the overlay only fills in branches indistinguishable offline (Needs Input / Blocked /
|
|
# Rejected / Cancelled / Deploying / Monitoring after Deploy) by reading the LIVE Plane
|
|
# status with a short timeout + per-issue TTL cache. It NEVER blocks the pipeline and
|
|
# NEVER raises.
|
|
# LIVE_STATUS -> kill-switch (false -> offline core only).
|
|
# LIVE_STATUS_TTL_S -> TTL (seconds) of the per-issue live-uuid cache (hot-path guard).
|
|
# LIVE_STATUS_TIMEOUT_S -> timeout (seconds) of a single live-GET on the render path.
|
|
ORCH_TRACKER_LIVE_STATUS=true
|
|
ORCH_TRACKER_LIVE_STATUS_TTL_S=60
|
|
ORCH_TRACKER_LIVE_STATUS_TIMEOUT_S=3
|
|
# ORCH-043: merge-gate (auto-rebase onto current origin/main + re-test + merge-lock)
|
|
# on the deploy-staging -> deploy edge. Deterministic sub-gate (no LLM) that catches
|
|
# the branch up to the CURRENT origin/main, re-tests it, and serialises merges so two
|
|
# green parallel branches can't break main.
|
|
# ENABLED -> global kill-switch (false -> whole gate is a no-op pass).
|
|
# REPOS -> CSV of repos where the gate is REAL; empty -> only the self-hosting
|
|
# repo (orchestrator); other repos -> conditional no-op (mirrors ORCH-35).
|
|
# RETEST_TIMEOUT_S -> wall-clock budget for the post-rebase re-test.
|
|
# RETEST_TARGET -> pytest target for the re-test.
|
|
# LOCK_TIMEOUT_S -> max merge-lease age before a stale lease is reclaimed.
|
|
# DEFER_DELAY_S -> delay before re-running the gate when the lock is busy.
|
|
# DEFER_MAX_ATTEMPTS -> defer retries before escalation (avoids livelock).
|
|
ORCH_MERGE_GATE_ENABLED=true
|
|
ORCH_MERGE_GATE_REPOS=
|
|
ORCH_MERGE_RETEST_TIMEOUT_S=600
|
|
ORCH_MERGE_RETEST_TARGET=tests/
|
|
ORCH_MERGE_LOCK_TIMEOUT_S=300
|
|
ORCH_MERGE_DEFER_DELAY_S=60
|
|
ORCH_MERGE_DEFER_MAX_ATTEMPTS=5
|
|
# ORCH-026 Level A: unconditional pre-merge rebase. With the flag ON (default),
|
|
# check_branch_mergeable ALWAYS rebases the branch onto origin/main under the held
|
|
# merge-lease (not only when behind) — a deterministic structural anti-phantom on
|
|
# the scheduler edge. No-op on an up-to-date branch (rebase keeps HEAD, force-with-
|
|
# lease -> "Everything up-to-date", CI not triggered). Scope = ORCH_MERGE_GATE_REPOS.
|
|
# PREMERGE_REBASE_ALWAYS=false -> strictly pre-ORCH-026 (rebase only when behind).
|
|
ORCH_PREMERGE_REBASE_ALWAYS=true
|
|
# ORCH-026 Level B: declarative task dependencies ("B waits for A"). claim_next_job
|
|
# gates jobs whose depends-on tasks are not yet 'done' (additive job_deps table,
|
|
# NOT EXISTS) WITHOUT occupying a max_concurrency slot. Inert on an empty job_deps.
|
|
# TASK_DEPS_ENABLED=false -> claim query is 1:1 the ORCH-1 query (no gate).
|
|
# TASK_DEPS_SOURCE=db|plane|hybrid -> declaration source; db (default) never calls
|
|
# Plane on the hot path; plane/hybrid ingest Plane `blocked-by` relations and
|
|
# cache them into job_deps (the scheduler then reads only the DB).
|
|
ORCH_TASK_DEPS_ENABLED=true
|
|
ORCH_TASK_DEPS_SOURCE=db
|
|
# ORCH-071/073: merge-verify under-gate on the `deploy -> done` edge (врезка in
|
|
# advance_stage, NOT a new STAGE_TRANSITIONS edge / registered QG). A deterministic
|
|
# merge-actor merges the feature code-PR via the Gitea PR-merge API (never push/
|
|
# force-push to main), then `done` is allowed ONLY when the deployed SHA is proven an
|
|
# ancestor of origin/main (ORCH-073 FR-1: SHA-in-main is the single criterion; a
|
|
# merged PR alone no longer confirms). A secondary regression guard then checks a
|
|
# declarative marker set (MAIN_REGRESSION_MARKERS) is still in origin/main; a missing
|
|
# marker -> alert + HOLD (NOT done), a git error of the grep itself -> fail-open.
|
|
# MERGE_VERIFY_ENABLED -> global kill-switch (false -> strictly pre-ORCH-071).
|
|
# MERGE_VERIFY_REPOS -> CSV of repos where the under-gate is REAL; empty ->
|
|
# only the self-hosting repo (orchestrator); non-self -> no-op.
|
|
# MERGE_PR_TIMEOUT_S -> per Gitea list/merge HTTP call timeout.
|
|
# MERGE_VERIFY_TIMEOUT_S -> git fetch/merge-base timeout for the ancestor + marker checks.
|
|
# REGRESSION_GUARD_ENABLED -> kill-switch for the ORCH-073 main-integrity regression
|
|
# guard (false -> SHA-in-main alone gates done); reuses the
|
|
# merge-verify scope, so non-self repos are a no-op.
|
|
# MERGE_VERIFY_AUTOCREATE_PR_ENABLED -> ORCH-082: guarantee an open code-PR
|
|
# (head==branch, base==main) via merge_gate.ensure_open_pr
|
|
# BEFORE the deterministic merge_pr (fixes the false HOLD
|
|
# "no open PR"). false -> exactly pre-ORCH-082 behaviour.
|
|
# Reuses the merge-verify scope; non-self repos -> no-op.
|
|
ORCH_MERGE_VERIFY_ENABLED=true
|
|
ORCH_MERGE_VERIFY_REPOS=
|
|
ORCH_MERGE_PR_TIMEOUT_S=60
|
|
ORCH_MERGE_VERIFY_TIMEOUT_S=60
|
|
ORCH_REGRESSION_GUARD_ENABLED=true
|
|
ORCH_MERGE_VERIFY_AUTOCREATE_PR_ENABLED=true
|
|
# ORCH-036: executable self-deploy of the `deploy` stage. For the self-hosting repo
|
|
# (orchestrator) the stage REALLY restarts prod (8500) via a detached host hook;
|
|
# deploy_status: SUCCESS means proven health-ok, not an LLM declaration. Three
|
|
# deterministic phases (A: request approve, B: human Approved -> detached deploy,
|
|
# C: finalizer maps hook exit-code -> deploy_status). Non-self repos: unchanged
|
|
# synchronous ssh deploy. SECRETS / host paths live ONLY on the host — do NOT commit.
|
|
# SELF_DEPLOY_ENABLED -> global kill-switch (false -> legacy synchronous deploy for all).
|
|
# SELF_DEPLOY_REPOS -> CSV of repos where Phase A/B/C is REAL; empty -> only the
|
|
# self-hosting repo (orchestrator); others -> no-op (mirrors ORCH-35).
|
|
# DEPLOY_REQUIRE_MANUAL_APPROVE -> require a human Plane "Approved" before the prod
|
|
# deploy (true on rollout; full auto is ORCH-54).
|
|
# DEPLOY_FINALIZE_DELAY_S -> delay before the first/each finalize poll (>= hook+health).
|
|
# DEPLOY_FINALIZE_MAX_ATTEMPTS -> bounded finalize-defer budget (anti-livelock).
|
|
# DEPLOY_SSH_USER / DEPLOY_SSH_HOST -> ssh target for the host hook (DEPLOY_SSH_HOST
|
|
# empty -> detached deploy will NOT launch; set on the host).
|
|
# DEPLOY_HOOK_SCRIPT -> path to the hook ON THE HOST (relative to the repo).
|
|
# DEPLOY_HOST_REPO_PATH -> orchestrator clone path on the host.
|
|
# DEPLOY_PROD_SOURCE_IMAGE -> staging-validated image, retagged build-once (no rebuild).
|
|
# DEPLOY_PROD_TARGET_SERVICE / _PORT / _IMAGE / _COMPOSE_PROFILE -> prod compose profile.
|
|
# DEPLOY_PROD_PREV_IMAGE_FILE -> prod prev-image snapshot (separate from staging's).
|
|
ORCH_SELF_DEPLOY_ENABLED=true
|
|
ORCH_SELF_DEPLOY_REPOS=
|
|
ORCH_DEPLOY_REQUIRE_MANUAL_APPROVE=true
|
|
ORCH_DEPLOY_FINALIZE_DELAY_S=90
|
|
ORCH_DEPLOY_FINALIZE_MAX_ATTEMPTS=10
|
|
ORCH_DEPLOY_SSH_USER=slin
|
|
ORCH_DEPLOY_SSH_HOST=
|
|
ORCH_DEPLOY_HOOK_SCRIPT=scripts/orchestrator-deploy-hook.sh
|
|
ORCH_DEPLOY_HOST_REPO_PATH=/home/slin/repos/orchestrator
|
|
ORCH_DEPLOY_PROD_SOURCE_IMAGE=orchestrator-orchestrator-staging
|
|
ORCH_DEPLOY_PROD_TARGET_SERVICE=orchestrator
|
|
ORCH_DEPLOY_PROD_TARGET_PORT=8500
|
|
ORCH_DEPLOY_PROD_TARGET_IMAGE=orchestrator-orchestrator
|
|
ORCH_DEPLOY_PROD_COMPOSE_PROFILE=
|
|
ORCH_DEPLOY_PROD_PREV_IMAGE_FILE=.deploy-prev-image-prod
|
|
|
|
# ORCH-058: staging-image provenance before the BUILD-ONCE prod retag (INV-FRESH).
|
|
# Guarantees the staging image promoted to prod is the EXACT artefact rebuilt from the
|
|
# validated commit — two layers, self-hosting only:
|
|
# A (liveness): QG sub-check `check_staging_image_fresh` on the deploy-staging->deploy
|
|
# edge rebuilds orchestrator-orchestrator-staging from the validated commit + recreates
|
|
# 8501; FAIL -> rollback to development. (builds/recreate STAGING only, never prod.)
|
|
# B (safety): the Dockerfile stamps `org.opencontainers.image.revision`; the prod hook
|
|
# fail-closes (exit 1) before `docker tag` if SOURCE_IMAGE's label != EXPECTED_REVISION.
|
|
# ENABLED -> single kill-switch for A+B as a WHOLE (never "B without A"); false -> legacy.
|
|
# REPOS -> CSV of repos where the gate is REAL; empty -> only self-hosting (orchestrator).
|
|
ORCH_IMAGE_FRESHNESS_ENABLED=true
|
|
ORCH_IMAGE_FRESHNESS_REPOS=
|
|
|
|
# ORCH-061: staging-verdict tolerance to sandbox-infra-only FAILs. The self-hosting
|
|
# orchestrator looped on deploy-staging because staging_check.py exited 1 on ANY FAIL,
|
|
# so two infra-only checks (C9a sandbox branch / C9b analyst-job — caused by SANDBOX
|
|
# bot accounts not being members of the sandbox Plane project, NOT a pipeline regress)
|
|
# forced staging_status: FAILED -> rollback -> loop. With this ON, C9a/C9b are WAIVED
|
|
# to SUCCESS when every REAL check is green; any REAL failure still fails closed.
|
|
# true (default) -> tolerant; false -> legacy strict (1:1 pre-ORCH-061, any FAIL rolls back).
|
|
# Lives in .env.staging (the staging instance). CLI --strict overrides this per-run.
|
|
ORCH_STAGING_INFRA_TOLERANCE_ENABLED=true
|
|
|
|
# ORCH-053: stuck-task reconciler (sweeper for lost webhooks). A background daemon
|
|
# replays a missed stage transition through the SAME gates/handlers a webhook would,
|
|
# fixing tasks that got stuck on a dropped event (502 on rebuild, no Plane/Gitea
|
|
# retries, unresolved sha->branch).
|
|
# ENABLED -> global kill-switch (self-hosting safety / staged rollout).
|
|
# PLANE_ENABLED -> separate flag for the F-2 Plane-API poll (mute only F-2).
|
|
# INTERVAL_S -> background sweep period (seconds).
|
|
# GRACE_DEFAULT_S -> default "stuck" threshold on tasks.updated_at (seconds).
|
|
# GRACE_OVERRIDES_JSON -> per-stage thresholds, e.g. {"development":300}; bad JSON -> default.
|
|
# NOTIFY_UNBLOCK -> send a Telegram message when a stuck task is unblocked.
|
|
# SKIP_BLOCKED_ENABLED -> ORCH-060 F-1 Guard 2: skip reconciling issues a human moved
|
|
# to Blocked / Needs Input (per-candidate Plane state lookup).
|
|
# false mutes ONLY the networked Guard 2; Guard 1 (escalated by
|
|
# developer retries, local+deterministic) is always active.
|
|
ORCH_RECONCILE_ENABLED=true
|
|
ORCH_RECONCILE_PLANE_ENABLED=true
|
|
ORCH_RECONCILE_INTERVAL_S=120
|
|
ORCH_RECONCILE_GRACE_DEFAULT_S=600
|
|
ORCH_RECONCILE_GRACE_OVERRIDES_JSON=
|
|
ORCH_RECONCILE_NOTIFY_UNBLOCK=true
|
|
ORCH_RECONCILE_SKIP_BLOCKED_ENABLED=true
|
|
|
|
# ORCH-068: TTL (seconds) for the per-project Plane states cache (plane_sync
|
|
# _STATES_CACHE). Historically the cache lived for the whole process lifetime,
|
|
# so a status added to Plane after start was invisible until a restart
|
|
# ("stale set -> no pipeline action"). With a TTL the entry self-heals by
|
|
# re-fetching /states/ once it expires (reuses reload_project_states()).
|
|
# >0 -> re-fetch after this many seconds (default 300 = 5 min);
|
|
# 0 -> disable TTL -> strictly the previous lifetime cache (back-compat).
|
|
ORCH_PLANE_STATES_TTL_S=300
|
|
|
|
# ORCH-065: job-reaper + proactive merge-lease reclaim. A background daemon thread
|
|
# (src/job_reaper.py, started LAST in main.lifespan after requeue_running_jobs) reaps
|
|
# zombie 'running' jobs whose monitor/process died before writing the terminal status
|
|
# (one zombie at max_concurrency=1 blocks the whole shared queue) and periodically
|
|
# reclaims dead/stale merge-leases. Liveness is three-tier: Tier-1 dead jobs.pid
|
|
# (os.kill(pid,0)) after REAPER_DEAD_TICKS consecutive dead ticks (anti-false-positive
|
|
# for a live agent); Tier-2 agent_runs.exit_code recorded but job still 'running'
|
|
# (only after a REAPER_FINALIZE_GRACE_S finalization grace, so a live monitor still
|
|
# doing git push / PR / Plane comments is never reaped); Tier-3 backstop after
|
|
# REAPER_MAX_RUNNING_S. The terminal flip carries an atomic status='running' guard and
|
|
# precedes any advance/enqueue (claim-before-act) so it never double-processes/-advances
|
|
# a row racing a late monitor or requeue_running_jobs.
|
|
# REAPER_ENABLED -> global kill-switch (false -> strictly prior behaviour).
|
|
# REAPER_INTERVAL_S -> background scan period (seconds).
|
|
# REAPER_DEAD_TICKS -> consecutive dead-pid ticks before reaping (Tier-1, >=2).
|
|
# REAPER_MAX_RUNNING_S -> Tier-3 backstop ceiling; must exceed max agent_timeout+grace.
|
|
# REAPER_FINALIZE_GRACE_S -> Tier-2 grace: how long agent_runs.exit_code must have been
|
|
# recorded before a still-'running' job is reaped; MUST exceed
|
|
# the max finalization window (git push + PR + Plane comments).
|
|
# LEASE_RECLAIM_ENABLED -> kill-switch for the proactive stale/dead lease reclaim
|
|
# (false -> only the legacy lazy TTL reclaim in acquire_merge_lease).
|
|
# (reuse) ORCH_MERGE_LOCK_TIMEOUT_S -> lease TTL; ORCH_MERGE_GATE_REPOS -> reclaim scope.
|
|
ORCH_REAPER_ENABLED=true
|
|
ORCH_REAPER_INTERVAL_S=60
|
|
ORCH_REAPER_DEAD_TICKS=2
|
|
ORCH_REAPER_MAX_RUNNING_S=3600
|
|
ORCH_REAPER_FINALIZE_GRACE_S=300
|
|
ORCH_LEASE_RECLAIM_ENABLED=true
|
|
|
|
# ORCH-022: security-gate (secret-scanning + dependency audit) on the
|
|
# deploy-staging -> deploy edge, run FIRST among the edge sub-gates. Deterministic
|
|
# (no LLM): gitleaks (offline secret-scan, pinned Go binary in the image) + pip-audit
|
|
# (OSV/PyPI CVE audit). Verdict in the versioned 17-security-report.md frontmatter;
|
|
# FAIL -> rollback to development + developer-retry (cap 3). See ADR-001.
|
|
# GATE_ENABLED -> global kill-switch; false -> pipeline 1:1 as before ORCH-022.
|
|
# GATE_REPOS -> CSV of repos where the gate is REAL; empty -> only self-hosting.
|
|
# DEP_BLOCK_SEVERITY -> CVE severity that BLOCKS (CRITICAL>HIGH>MEDIUM>LOW); below /
|
|
# UNKNOWN -> warning only (anti-loop).
|
|
# SCAN_TIMEOUT_S -> per external scanner call timeout.
|
|
# DEP_AUDIT_FAIL_CLOSED -> strict mode: unreachable CVE feed -> FAIL instead of the
|
|
# default fail-open + warning (anti-loop). Default false.
|
|
# SECRETS_BLOCK -> a found secret blocks (always true by default; the offline
|
|
# secrets guarantee is unconditional).
|
|
ORCH_SECURITY_GATE_ENABLED=true
|
|
ORCH_SECURITY_GATE_REPOS=
|
|
ORCH_SECURITY_DEP_BLOCK_SEVERITY=HIGH
|
|
ORCH_SECURITY_SCAN_TIMEOUT_S=300
|
|
ORCH_SECURITY_DEP_AUDIT_FAIL_CLOSED=false
|
|
ORCH_SECURITY_SECRETS_BLOCK=true
|
|
|
|
# ORCH-021: post-deploy production monitoring + degradation reaction. After the
|
|
# terminal deploy->done transition for an applicable repo, a reserved-agent job
|
|
# `post-deploy-monitor` (no LLM, modelled on deploy-finalizer) probes prod over a
|
|
# window and reacts to a degradation the restart-time health-check missed (class
|
|
# "green deploy, red prod", precedent ET-8). State is in sentinel files
|
|
# (.post-deploy-state-<repo>/<wi>/), no DB migration.
|
|
# MONITOR_ENABLED -> global kill-switch; false -> pipeline is 1:1 as before ORCH-021.
|
|
# REPOS -> CSV of repos where monitoring is REAL; empty -> only self-hosting.
|
|
# WINDOW_S -> observation window length (~15 min).
|
|
# INTERVAL_S -> seconds between probe ticks.
|
|
# FAIL_THRESHOLD -> N CONSECUTIVE health failures -> DEGRADED.
|
|
# 5XX_THRESHOLD -> window 5xx ratio above this -> DEGRADED.
|
|
# AUTO_ROLLBACK -> allow auto-rollback; acts ONLY for non-self repos. Self-hosting
|
|
# is ALWAYS ALERT_ONLY (a tick NEVER restarts the prod container).
|
|
# BASE_URL -> base URL of the observed prod instance.
|
|
ORCH_POST_DEPLOY_MONITOR_ENABLED=true
|
|
ORCH_POST_DEPLOY_REPOS=
|
|
ORCH_POST_DEPLOY_WINDOW_S=900
|
|
ORCH_POST_DEPLOY_INTERVAL_S=30
|
|
ORCH_POST_DEPLOY_FAIL_THRESHOLD=3
|
|
ORCH_POST_DEPLOY_5XX_THRESHOLD=0.5
|
|
ORCH_POST_DEPLOY_AUTO_ROLLBACK=false
|
|
ORCH_POST_DEPLOY_BASE_URL=http://localhost:8500
|
|
|
|
# ── QG-0 entry validation (ORCH-069) ──────────────────────────────────────────
|
|
# Upper title-length limit for the QG-0 entry gate (_qg0_errors). The old 80-char
|
|
# cap was a hygiene limit, not structural (slug is cut to [:30] independently, the
|
|
# DB title TEXT is unbounded). Default 200. An invalid/empty value gracefully
|
|
# degrades to 200 (the process never crashes on startup).
|
|
ORCH_QG0_TITLE_MAX=200
|