* fix(cloud): validate ORCA_PLATFORM_HOST_SUFFIXES up front; smoke boots use the configured hosts
A malformed suffix now refuses every request (503 platform_hosts_misconfigured,
naming the bad entries) and skips scheduled work, instead of failing each
limited-mode create later. Golden-image and environment-build smoke boots
use the workspace base allowlist, so they follow the configured platform
hosts rather than the built-in *.onorca.dev.
* fix(cloud): narrow the platform-host guard to what compiles an allowlist
A malformed ORCA_PLATFORM_HOST_SUFFIXES no longer takes the Worker down.
GET /v1/health (no auth, for the post-deploy smoke) returns 503
platform_hosts_misconfigured; limited-mode creates, wakes and resumes,
new environment builds and the golden rotation refuse or skip. Reads,
sleep, stop, delete and the reconcile cron keep working; open-mode
creates compile no allowlist and are unaffected.
* fix(cloud): platform_hosts_misconfigured responses carry the code only
/v1/health is public, so the bad entries stay in the config_error log
line; the authenticated refusals return the same bare code.
- SANDBOX_/BILLING_(STAGING_)AUTH_ISSUER accept a comma-separated issuer list; a single value behaves as before.
- ORCA_PLATFORM_HOST_SUFFIXES supplies the platform egress hosts (default *.onorca.dev, unchanged allowlist).
- Billing: CLOUD_SETUP_PAGES_URL unset with BILLING_ENV=prod answers 503 billing_misconfigured; dev/staging keep the fallback.
No wrangler config or current value changes.
The Worker reads environment-build.sh's own lines from the stored build log at finalize and records
autoInstall { manager, outcome } in the build result (no image change). The build view carries it;
the environment page shows 'Dependencies installed (pnpm)' or that the install failed and workspaces
run their own setup.
The golden image ships Ubuntu's docker.io, docker-compose-v2 and docker-buildx (pinned in the
manifest; daemon.json: overlay2, local log driver with caps, mirror.gcr.io registry mirror).
dockerd runs rootful inside the workspace's microVM and is never started at boot: the new
/opt/orca/bin/docker shim (image/vm/docker, first on PATH) starts it on the first command that
needs it (0.3 s in the spike), says once what differs from a laptop (containers stop on sleep;
credential hosts need the proxy CA mounted), then execs plain docker. An image without Docker
says so instead of waiting.
Off switch: SANDBOX_DOCKER=off (Worker var, default on) sends ORCA_DOCKER=off on every boot;
orca-sandbox-start leaves ~/.orca-sandbox/docker.off and the shim refuses with a plain message.
Starts without the flag (retries, repairs) keep the VM's last answer.
Egress: CONTAINER_REGISTRY_HOSTS (mirror.gcr.io, Docker Hub, GHCR) join the default allowlist.
Docs: cloud/docs/sandbox-docker.md (incl. the proxy-CA mount). Golden rotation carries only
this change, with the Worker deployed from the same commit (runbook 1.8a).
An automatic environment (no install script) now runs the first repo's JavaScript install from its
lockfile during its build, so creates start with node_modules: pnpm/yarn through corepack (frozen /
immutable), npm ci; package.json's packageManager wins. A failure, a lockfile out of date or the
15-minute cap never fails the build: the log says why, half-installed node_modules are removed, and
the warm clone is snapshotted as before. Lockfiles the image has no tool for (bun, uv, bundler, go,
cargo) are named in the log. Admin environments are unchanged. env/ scripts ship in the Worker:
VM_SCRIPTS_HASH is unchanged (no golden rotation).
A GitHub App user token generally can't read orgs the App isn't installed on, which is
exactly when canInstall is asked. Read the owner type anonymously first (GET /users/{owner}):
another user's account is false; an org is true only for active admin, false for another
role/state, and null for 403/404/errors/timeouts. Owner-type lookup failures are null.
Present while the Orca GitHub App isn't installed for the repo owner ('missing', or
'public' with no installation). true: the caller's connected GitHub login is the owner,
or their membership in the owner org is active admin. false: member, non-member (403/404),
or another user's account. null: no connected GitHub user token, the token can't be read
or refreshed, or GitHub errored / timed out (3 s). Never fails the answer.
The token comes from memberGitIdentity (decrypt + refresh near expiry).
Neil
Neil