@orchestraworks/worker 0.0.149 → 0.0.151

package/README.md

@@ -25,7 +25,8 @@ To check that a machine image can host a harness, run `worker check` inside it:
 docker run --rm --entrypoint worker <image> check --harness claude
 ```
 
-`worker version` prints the version and the protocol versions this build speaks.
+`worker version` prints the version, the build hash, the release package and the protocol versions this
+build speaks.
 
 ## Make a machine image
 
@@ -227,8 +228,8 @@ minutes later.
 - `orchestra worker --help` lists the worker commands. `orchestra worker <command> --help` gives their flags.
 - `worker` with no command prints its usage.
 - `skills/orchestra/SKILL.md` in `@orchestraworks/cli` explains machines and what the platform can do.
-- [docs/REFERENCE.md](docs/REFERENCE.md): every command, the start-up settings, egress, and how a release is built.
+- [docs/REFERENCE.md](https://unpkg.com/@orchestraworks/worker/docs/REFERENCE.md): every command, the start-up settings, egress, and how a release is built.
 
 ## License
 
-Apache License 2.0. The full text is in [LICENSE](LICENSE).
+Apache License 2.0. The full text is in the `LICENSE` file in this package.

package/docs/REFERENCE.md

@@ -16,7 +16,7 @@ The worker exposes no API of its own. Every route it calls is the platform's.
 | `identity/` | the four identity exchanges — claim, refresh, reattach-challenge, reattach — the holder key, and the loop that keeps the machine token alive |
 | `broker/` | the protocol on the message broker: the connection, the register on every connect, the heartbeat and the status cadence, the pull of this machine's own work consumer, and the publisher every other package sends through |
 | `env/` | the machine-side environment the platform composes onto a launch, read from the names the contract declares |
-| `facts/` | what this build knows about the four harness families: the program to install and the digest that authenticates it, the environment each family is handed, the templates it seeds, and every location its content lands in; and, in `machine.json`, the pins of what `install-machine` puts on a machine beside the worker — Docker, WinDivert and the agent's Node — and where a launch's certificate files land. Both are embedded in the binary, so one release digest covers the facts and the program that reads them |
+| `facts/` | what this build knows about the four harness families: the program to install and the digest that authenticates it, the environment each family is handed, the templates it seeds, and every location its content lands in; and, in `machine.json`, the pins of what `install-machine` puts on a machine beside the worker — Docker and WinDivert, the agent's Node being the families' own Node pin — and where a launch's certificate files land. Both are embedded in the binary, so one release digest covers the facts and the program that reads them |
 | `harness/` | the only place family-specific knowledge lives: the launch plan, the content layout, the store lookup, the mid-turn message each family accepts, and the installer that puts the pinned Node and a family's programs under the worker root |
 | `process/` | the agent's setup and the harness process behind each session placement: the start, the stop and the last save a remove asks for, the startup fence over what a previous run left, and the stop of everything when the worker is told to stop |
 | `stream/` | the queue: every placement message and every prompt, steer and cancel pulled off this machine's work consumer, the ACP client that opens a session's harness conversation and runs its turns, each turn's events batched to the platform and published live, and the answer every placement message is owed |
@@ -82,6 +82,18 @@ Each `ORCHESTRA_` machine variable this page names also has a former `SFDK_` spe
   forms fill the installer seam in `cmd/worker/install.go`; a build with none refuses rather than
   reporting an install it did not perform.
 
+  **An install that names a family stops the running worker first.** When `--harness` names a family
+  and `--service` is not `none`, the install stops the worker service in its scope, and the service an
+  earlier release registered, before it changes anything under the root. A running service installs and
+  runs harnesses from that same root, and nothing else keeps the two apart. The stop keeps each
+  service's definition, and the install prints `the worker service is stopped while this install changes
+  <root>`. The service starts again only after the whole install succeeds, and then at the time its role
+  sets, below. When the stop fails, the install changes nothing. When a later step fails, or a signal
+  interrupts the install after the stop, the service stays stopped and the error says so; for a `worker`,
+  run `worker install` again to start it. A signal during the stop itself gives an error that says the
+  service may still be stopping. A signal before the stop ends the install quietly, with nothing stopped
+  and nothing changed.
+
   **`--service` says which session the worker is registered in, and neither of its two values needs any
   privilege.** `user` registers it in the invoking account's own session: a launch agent under
   `~/Library/LaunchAgents` on macOS, a `systemd --user` unit under `~/.config/systemd/user` on Linux, a
@@ -176,7 +188,7 @@ Each `ORCHESTRA_` machine variable this page names also has a former `SFDK_` spe
   the worker's unit, which requires it. Azure on Linux also installs WALinuxAgent's and azure-vm-utils'
   udev rules, which name a data disk by its LUN. `aws` removes the Azure task, or the Azure unit and the
   worker unit's link to it, that an earlier `azure` run left. The optional steps fetch what they install from the pins
-  in `facts/machine.json` and check each archive's SHA-256 — Node against `nodejs.org`'s published
+  in `facts/machine.json`, and Node at the families' pin in `facts/families.json`, and check each archive's SHA-256 — Node against `nodejs.org`'s published
   `SHASUMS256.txt` — before anything is unpacked. A new Node on Windows replaces only the archive's own
   files, `node.exe` last, so npm's global packages in its folder and their commands stay. The last step runs `worker check` in-process with the
   profile that holds only what this command installs: `launcher` for `azure`, `enrolled` for `aws`. A
@@ -235,12 +247,13 @@ Each `ORCHESTRA_` machine variable this page names also has a former `SFDK_` spe
   **`worker redirect remove`** deletes it. Each runs with its caller's own rights, so without
   `CAP_NET_ADMIN` the kernel refuses both, and each exits 0 on an answer and 1 on a failure. Off Linux
   both refuse, naming the operating system. What the table holds is under the in-guest egress below.
-- **`worker version`** prints this binary's version, the release package it belongs to, and the
-  protocol versions it speaks.
+- **`worker version`** prints one `key value` line each: `version`, this binary's version; `build`,
+  the content hash it was stamped with, or `unstamped`; `platform`, the release package it belongs to;
+  and `protocol`, the protocol versions it speaks.
 
-The version is stamped at link time by the publishing lane, and both `package.json` files carry
-`0.0.0` until that lane stamps them; a build that stamps nothing says so rather than claiming a
-version it is not.
+The version and the build hash are stamped at link time by the publishing lane, and both `package.json`
+files carry `0.0.0` until that lane stamps them; a build that stamps nothing says so rather than
+claiming a version or a build it is not.
 
 ## The bootstrap a machine is started with
 

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@orchestraworks/worker",
-  "version": "0.0.149",
+  "version": "0.0.151",
   "type": "module",
   "description": "The Orchestra worker.",
   "license": "Apache-2.0",
   "author": "Orchestra Works",
   "homepage": "https://orchestraworks.ai",
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "bin": {
     "worker": "bin/worker.js"
@@ -18,10 +18,10 @@
     "docs/REFERENCE.md"
   ],
   "optionalDependencies": {
-    "@orchestraworks/worker-linux-x64": "0.0.149",
-    "@orchestraworks/worker-linux-arm64": "0.0.149",
-    "@orchestraworks/worker-darwin-x64": "0.0.149",
-    "@orchestraworks/worker-darwin-arm64": "0.0.149",
-    "@orchestraworks/worker-win32-x64": "0.0.149"
+    "@orchestraworks/worker-linux-x64": "0.0.151",
+    "@orchestraworks/worker-linux-arm64": "0.0.151",
+    "@orchestraworks/worker-darwin-x64": "0.0.151",
+    "@orchestraworks/worker-darwin-arm64": "0.0.151",
+    "@orchestraworks/worker-win32-x64": "0.0.151"
   }
 }