Neil's Q1 answer: a plan id on the Stripe Price/Product maps to the repo catalog's entitlements.
seatPriceMatch reads price.metadata.orca_plan (after env ids and price history, before lookup key
and product); the catalog sync logs a lookup-key/tag mismatch; stripe-test-setup tags every price.
- planForPrice fix: seat prices map through the configured ids, the price history (plan_prices),
the plan's lookup key, or the plan's Stripe product; a known subscriber on an unmappable price
still gets status/period/cancel applied, so a price change can never leave a canceled
subscriber with access (test: lifecycle.test.ts, all modes)
- catalog prices synced from Stripe by lookup key (cron + price.*/product.* webhooks); every seat
price a subscription is on is kept as history; Checkout sells the lookup-key holder when on and
refuses (409 plan_unavailable) rather than guess a price
- webhook: one processStripeEvent for webhooks and replay; customer.deleted revokes; the mirror
upsert ignores older Stripe reads
- reconcile.ts (cron): Stripe event replay from a cursor, rolling re-sync of stale subscriptions
(404 = canceled), catalog price refresh; grant backfill after it
- GET /v1/plans (public, ETag/304, prices only from Stripe, entitlements, features, policy) and
GET /v1/entitlements (effective values, access, grants); legacy offers built from the catalog
when on (identical for the launch catalog, plus warnAtPercent)
- seats and overage read the price history and plan policy (seat bounds, true-down window)
- migration 0008: plans, immutable plan_versions, plan_prices (Stripe mirror), entitlement_grants,
entitlement_audit, entitlement_shadow_diffs, stripe_sync_state; subscriptions.seat_price_id
- catalog/catalog.json (catalog-as-code: Team, Enterprise, Trial; no prices) + scripts/catalog-apply.ts
- typed entitlement registry (entitlement-keys.ts) with sum/max/union/or aggregation
- grants.ts: idempotent projection of each subscription (Stripe mirror) and trial into grants,
hold/release/revoke, out-of-order guard, terminal revocation, audit; manual/promo grants
- entitlements.ts: one builder fed by legacy terms or grant terms; ENTITLEMENTS_MODE off|shadow|on;
shadow records every disagreement; lazy re-projection; cron backfill
- trial hours come from the catalog's trial plan when on (granted trials keep their hours)
- the whole suite runs in legacy, shadow (zero diffs enforced) and on modes
- orcad: a delivered keystroke frame from a paired device records that device as the terminal's driver (the same registry agent prompts use), so the VM git shim's orca-git-as answers for plain terminals too. The device is the transport-attested caller, never the client id. Local windows never record.
- desktop: typing in an Orca Cloud terminal reports "I'm driving" (noteCloudSend, throttled), so the egress honors the typist's GitHub identity. Only xterm user input counts; query replies, focus and mouse reports, replay and resubscribes don't.
- Fallback author email cloud@users.noreply.onorca.dev becomes cloud@users.noreply.orca.dev; existing workspaces on the old default follow on next boot.
Help menu docs/changelog, the telemetry privacy link, the share page's
"Get Orca" link and the MCP server's website URL now use orca.dev. The site
moved there; the old onorca.dev hosts redirect. Service hosts are unchanged.
Boot-time installs were swallowed and the boot cleared gitSetup, so a restart whose install failed again dropped the desktop strip while git still lacked identities. Every boot install now goes through settleMemberGit: failure marks the VM and the row, a later success (or a boot with nobody to install) clears them. The git shim refuses on a failed mark even with nothing pending. Restart is the retry (it re-runs the install before it answers).
POST /v1/sandboxes kept the response open ~2.3 s after orcad was ready while syncMemberGit ran (and again inside boot when the creator had GitHub connected). A create now records the owner device, answers, and installs member identities in ctx.waitUntil. The VM is told the setup is pending (ORCA_GIT_SETUP=pending -> ~/.orca-sandbox/git-setup.pending); its git shim holds commit/push/merge/... up to 15 s until orca-sandbox-members writes git-setup.ready, and on a failed or stalled setup stops them with what to do instead of committing as the workspace identity. Read-only git and fetches never wait: the boot already routes the workspace credential. A failed install is kept on the row (0053 git_setup_failed_at) and shown as sandbox.gitSetup 'failed' to clients sending feature git-setup; any later boot or successful sync clears it. Wake, resume, restart and grants are unchanged (synchronous).
* relay: skip the edge row read for hosts above the edge leave ceiling
With the edge on, every assign of a host outside the cohort ran leaveEdge (a
relay_assignments read) and every resolve ran edgeAssignment, on the director's
3-connection pool, ahead of the in-memory lanes. At 1% this saturated the pool at
peak: acquire timeouts and 503s for GCE hosts, and some cell heartbeats.
New optional edge.json flag leaveCeilingPermille: the highest rollout ever applied.
A host above it, the current rollout and the env percent, on no allow or deny list,
cannot have an edge row, so both reads are skipped. Absent: today's behaviour.
The evacuation sweep reports orca_relay_edge_row_above_ceiling if it finds an edge
row above the ceiling (set too low).
* relay: edge leave ceiling: void a ceiling below the rollout; document operating rules; test reads under it
Golden source builds publish their orcad + in-VM CLI as a commit-pinned bundle (R2, uploaded by the build VM over a signed PUT; the Worker computes the stored sha256). On every boot and wake, before orcad starts and inside the existing orcad phase, a sandbox whose /opt/orca/runtime/orcad/SOURCE_COMMIT differs from its region's active golden fetches that bundle from the control plane's own host (already on the egress allowlist) with a 10-minute signed URL, verifies the sha256 the control plane passes in, checks the commit and node runtime, and swaps orcad + orca-cli atomically. Any failure keeps the old orcad and boot continues; every outcome is logged (runtime_refresh: outcome, from, to, ms). RUNTIME_REFRESH=off is the kill switch. Dev R2 bucket orca-sandbox-runtime-dev.
Once an Orca account stops applying (revoked after a confirmed 401, expired, removed, turned off, shared, owner changed), requests still carrying the sandbox's account placeholder (shells and agents already running, a Vercel forward that hasn't caught up) now get Anthropic's own 401 authentication_error, saying the Orca sign-in for Claude needs renewing, instead of 403 host_not_proxied or a bare deny. Nothing is swapped on those routes.
Neil
Neil
OrcaWinandOrcaWin