agent-orchestrator/docs
itrytoohard 2d00e4675d fix(cli): harden daemon control surface and stop CLI from writing the store
Addresses review findings on PR #53 (on top of the rebase onto main).

- doctor: stop opening/migrating SQLite. The daemon is the sole store
  writer/migrator (architecture.md §7); the CLI must not run migrations or
  open a second writer against a DB a live daemon owns. doctor now reports
  database-file presence and gains --json.
- stop: only remove running.json when it still belongs to the PID we
  stopped, so a concurrent `ao start` that wrote a new run-file is not
  clobbered into looking stopped.
- httpd: gate POST /shutdown to loopback callers with no Origin header,
  closing the CSRF / DNS-rebinding vector against an unauthenticated,
  state-changing endpoint.
- start: detach the spawned daemon into its own session/process group so a
  Ctrl-C while `ao start` waits for readiness doesn't also kill it.
- cli: exit 2 for usage errors (bad flag / arg count) vs 1 for runtime
  failures.
- daemon: unexport newLogger (only used in-package).
- tests: /shutdown guard (cross-origin + rebinding) and stop run-file
  ownership guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-01 01:55:14 +05:30
..
cli fix(cli): harden daemon control surface and stop CLI from writing the store 2026-06-01 01:55:14 +05:30
README.md feat(backend): add cobra cli foundation 2026-06-01 01:44:43 +05:30
architecture.md docs: document the LCM + Session Manager lane (architecture + status) 2026-05-27 14:08:13 +05:30
status.md docs: document the LCM + Session Manager lane (architecture + status) 2026-05-27 14:08:13 +05:30

README.md

agent-orchestrator (rewrite) — docs

The agent-orchestrator is being rebuilt as a long-running Go backend daemon
(backend/) plus an Electron + TypeScript frontend (frontend/). The
backend supervises a fleet of coding-agent sessions and keeps one true status
per session.

This folder documents the Lifecycle Manager (LCM) + Session Manager (SM)
lane
— the deterministic core of the backend that is now implemented (behind
fakes) on the feat/lcm-sm-contracts integration branch.

Start here

Doc What it covers
architecture.md How the lane works: the OBSERVE→DECIDE→ACT loop, the canonical state model, the package layout, every component, and the load-bearing invariants. Read this first.
status.md What's done (PR by PR), what's left, the integration to-dos, the open cross-lane contract questions, and how to build/test.
cli/README.md CLI foundation decisions: Cobra, reference projects, old CLI inventory, and the first command surface.

The one-paragraph mental model

The backend is a stateless supervisor over external ground truth: git/GitHub
own PR/CI/review truth, the agent's own files own its activity, and the backend
owns no agent state. Its whole job is, per session: OBSERVE raw facts →
DECIDE one canonical status via pure, deterministic functions → ACT
(persist + fire reactions). The LCM is that reducer; the SM is the
explicit-mutation plumbing (spawn/kill/restore/cleanup) that feeds it.

Where this lane fits

Other lanes (built by other people, in parallel) provide the real adapters this
lane depends on through narrow interfaces: the persistence layer + CDC, the
SCM poller, the runtime/agent/workspace plugins, the backend API +
OpenAPI
, and the frontend store. See status.md
for the hand-off points.