mirror of
https://github.com/stablyai/orca.git
synced 2026-10-31 09:07:40 +00:00
NeilandClaude
15a1ff75fc
* fix(ssh): keep machines cloned with one machine-id off each other's Orca server data (#32918) Machines cloned from one image share /etc/machine-id. On a shared home both got the same machine key, so both managed servers ran in ~/.orca, and each judged the other's PID locally and reclaimed its live instance lock. - Record the claiming hostname in the shared-home claim and machine homes; a Linux machine whose machine-id matches but hostname differs gets its own machine home. Older claims fall back to data-root owner records. - orcad's instance lock no longer treats a holder with this machine-id but another hostname as local, and refuses to start when an older clone's profile-state owner record shows it is using the data root. Co-Authored-By: Claude <noreply@anthropic.com> * fix(ssh): keep a clone's established machine home, and let a host renamed within its boot restart Co-Authored-By: Claude <noreply@anthropic.com> * fix(ssh): call a machine a clone only with positive evidence A renamed host keeps its boot and a local disk has one machine, so only another host and boot with this machine-id on a shared filesystem counts as a clone, on Linux only. When both clones already write the login home, stay and let the server lock refuse the second writer. Drop the machine-home owner markers. Co-Authored-By: Claude <noreply@anthropic.com> * fix(ssh): refuse a second server from a cloned host instead of relocating data Drop the inferred clone relocation. orcad refuses to start when a holder or profile-state owner on a shared filesystem reports this machine-id from another hostname and boot, naming that host and the fixes. Add ORCA_MACHINE_NAME, an explicit host-env name that gives a managed SSH host its own machine home. Co-Authored-By: Claude <noreply@anthropic.com> * fix(ssh): judge cloned machines by boot and freshness, not hostname A peer with this machine-id is another live machine only when its record is from another boot, was written after this boot began, and is fresh. The orcad lock now heartbeats its mtime. That drops the hostname test, which renames broke and same-hostname clones evaded. It also drops the participant-owner precheck that stale records could block forever, and keeps profile-state owner cleanup from deleting a live clone's owner. stale-lock reclaim uses the same rule. ORCA_MACHINE_NAME now rejects invalid names and keeps a host on the home its running server or own machine-id already uses. Hints are role-specific and aimed only at the clone. Co-Authored-By: Claude <noreply@anthropic.com> * fix(orcad): stale-lock reclaim waits out the lock freshness window Co-Authored-By: Claude <noreply@anthropic.com> * fix(orcad): log a failed lock heartbeat and say a crashed clone's lock frees itself Co-Authored-By: Claude <noreply@anthropic.com> * fix(orcad): align reclaim help, age evidence and clone hint with the freshness window Co-Authored-By: Claude <noreply@anthropic.com> * fix(ssh): ORCA_MACHINE_NAME always selects its own home Inferring which home to keep from running owners flipped after shutdown or reboot and couldn't see macOS boots. A name now deterministically selects its home, and a multi-line name is refused. Co-Authored-By: Claude <noreply@anthropic.com> * fix(ssh): refuse a whitespace-only ORCA_MACHINE_NAME, and pin reclaim test clocks Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>