mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 18:37:24 +00:00
Neil
134fc24436
Golden source builds publish their orcad + in-VM CLI as a commit-pinned bundle (R2, uploaded by the build VM over a signed PUT; the Worker computes the stored sha256). On every boot and wake, before orcad starts and inside the existing orcad phase, a sandbox whose /opt/orca/runtime/orcad/SOURCE_COMMIT differs from its region's active golden fetches that bundle from the control plane's own host (already on the egress allowlist) with a 10-minute signed URL, verifies the sha256 the control plane passes in, checks the commit and node runtime, and swaps orcad + orca-cli atomically. Any failure keeps the old orcad and boot continues; every outcome is logged (runtime_refresh: outcome, from, to, ms). RUNTIME_REFRESH=off is the kill switch. Dev R2 bucket orca-sandbox-runtime-dev.
76 lines
4.6 KiB
JSON
76 lines
4.6 KiB
JSON
{
|
|
"$schema": "node_modules/wrangler/config-schema.json",
|
|
// DEV deployment only (workers.dev, no custom domain). Deploy:
|
|
// wrangler deploy -c wrangler.dev.jsonc
|
|
// Secrets (wrangler secret put -c wrangler.dev.jsonc, never here): VERCEL_TOKEN, SANDBOX_DEV_JWKS,
|
|
// EGRESS_DEV_STATIC_AUTHORIZATION, CONTROL_PLANE_TOKEN (same value as on
|
|
// orca-billing-dev), GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY (PKCS#8), SECRETS_KEK (base64 32 bytes),
|
|
// OPERATOR_TOKEN (/v1/internal/*), GITHUB_STATE_SECRET; for the GitHub connect flow also
|
|
// GITHUB_APP_CLIENT_ID + GITHUB_APP_CLIENT_SECRET (app settings → generate a client secret).
|
|
"name": "orca-sandbox-control-dev",
|
|
"main": "src/index.ts",
|
|
"compatibility_date": "2026-11-01",
|
|
"workers_dev": true,
|
|
// Preview aliases (wrangler versions upload --preview-alias) must stay reachable for pre-merge VM tests.
|
|
"preview_urls": true,
|
|
"d1_databases": [
|
|
{
|
|
"binding": "SANDBOX_DB",
|
|
"database_name": "orca-sandbox-control-dev",
|
|
"database_id": "e9f259e9-94b3-4e18-a132-2d807693a498",
|
|
"migrations_dir": "migrations"
|
|
}
|
|
],
|
|
// ENV-STALE: each golden build's orcad bundle; booting sandboxes behind the active golden install it.
|
|
"r2_buckets": [{ "binding": "RUNTIME_BUNDLES", "bucket_name": "orca-sandbox-runtime-dev" }],
|
|
// Same-account Workers cannot call each other over workers.dev (error 1042); BILLING_URL names the origin.
|
|
"services": [{ "binding": "BILLING", "service": "orca-billing-dev" }],
|
|
// Every minute for routines (src/routines); the rest of the cron work runs on minute % 5 == 0.
|
|
// Environment builds advance on Durable Object alarms (EnvironmentBuildRunner), not on readers. The
|
|
// runner is its own Worker (wrangler.build-runner.dev.jsonc, deployed first): a Worker implementing a
|
|
// Durable Object gets no preview URLs. v2 deletes the class this Worker hosted until then; its only
|
|
// state was each build's alarm, and the cron below re-arms every unfinished build within a minute.
|
|
// v2 below was applied in a deploy with no binding (Cloudflare error 10061 refuses a delete-class migration
|
|
// while any binding names the class, even one with script_name); the binding now points at the runner Worker.
|
|
"durable_objects": {
|
|
"bindings": [{ "name": "ENV_BUILD_RUNNER", "class_name": "EnvironmentBuildRunner", "script_name": "orca-sandbox-build-runner-dev" }]
|
|
},
|
|
"migrations": [
|
|
{ "tag": "env-build-runner-v1", "new_sqlite_classes": ["EnvironmentBuildRunner"] },
|
|
{ "tag": "env-build-runner-v2", "deleted_classes": ["EnvironmentBuildRunner"] }
|
|
],
|
|
"triggers": { "crons": ["* * * * *"] },
|
|
"vars": {
|
|
"SANDBOX_ENV": "dev",
|
|
// Flag S1 (contract D10/D11): Claude via the person's Orca account. Dev only until Neil's S1 sign-off.
|
|
"AGENT_ACCOUNTS_CLAUDE": "on",
|
|
// Flag S2: Codex via the account broker (broker sandbox, lease refresher, placeholder auth.json). Dev only
|
|
// until Neil's S2 sign-off; the kill switch is AGENT_ACCOUNTS_CODEX_DISABLED=1.
|
|
"AGENT_ACCOUNTS_CODEX": "on",
|
|
"SANDBOX_POOL_SIZE": "2",
|
|
// Dev only (ignored unless SANDBOX_ENV is dev): these dev accounts hit the real billing gate.
|
|
"SANDBOX_DEV_BILLING_ENFORCE_PREFIX": "dev:billing-test-",
|
|
// The golden orcad tracks this branch (host RPCs ship there first); rebuilt when HEAD touches VM code.
|
|
"GOLDEN_IMAGE_SOURCE": "git:https://github.com/nwparker/orca-private#cloud/integration",
|
|
"SANDBOX_JWT_AUDIENCE": "orca-sandbox",
|
|
"SANDBOX_JWKS_URL": "https://login.onorca.dev/.well-known/jwks.json",
|
|
"SANDBOX_AUTH_ISSUER": "https://login.onorca.dev",
|
|
// Dev only: also trust Orca Cloud auth STAGING sandbox tokens (billing dev trusts staging too).
|
|
"SANDBOX_STAGING_JWKS_URL": "https://auth-staging.onorca.dev/.well-known/jwks.json",
|
|
"SANDBOX_STAGING_AUTH_ISSUER": "https://auth-staging.onorca.dev",
|
|
"VERCEL_TEAM_ID": "team_c5IO9DfEYAxKEUgMxrbEtO0a",
|
|
"VERCEL_PROJECT_ID": "prj_SkVtv6zJurF9dUHpfTRy4v9avwPq",
|
|
"VERCEL_REGION": "pdx1",
|
|
"VERCEL_FALLBACK_REGIONS": "iad1",
|
|
"BILLING_URL": "https://orca-billing-dev.lovecast.workers.dev",
|
|
// Golden image from image/build-golden-image.ts; lifecycle routes answer 503 without one.
|
|
"GOLDEN_SNAPSHOT_ID": "snap_vpcmcCAgTtISiTZgsCosOlThQbFd",
|
|
// Snapshots are region-locked: the seed is an iad1 image; pdx1 builds its first image from source.
|
|
"GOLDEN_SNAPSHOT_REGION": "iad1",
|
|
"GITHUB_APP_SLUG": "orca-cloud-dev",
|
|
// Cloud setup pages (staging auth): GitHub installs started from a setup session return there.
|
|
"CLOUD_SETUP_ORIGIN": "https://auth-staging.onorca.dev",
|
|
"EGRESS_PROXY_URL": "https://orca-sandbox-control-dev.lovecast.workers.dev/v1/egress/proxy"
|
|
}
|
|
}
|