alissa-tools-github-orcloop 0.3.0__tar.gz → 0.3.2__tar.gz

{alissa_tools_github_orcloop-0.3.0/src/main/alissa_tools_github_orcloop.egg-info → alissa_tools_github_orcloop-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.3.0
+Version: 0.3.2
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_orcloop-0.3.0 → alissa_tools_github_orcloop-0.3.2}/src/main/alissa/tools/github/orcloop/__main__.py

@@ -2,7 +2,8 @@
 
 O1 wired the config surface and the argument parser; O3 wires the decision
 loop behind it; O6 adds the release-feed selector (`--release-feed bow` and its
-`--bow-prefix` / `--bow-owner` / `--scan-fallback-interval` knobs).
+`--bow-prefix` / `--bow-owner` / `--scan-fallback-interval` knobs); O8 makes the
+feed's authority resolve itself (see `resolve_feed_authority`).
 
 The CLI resolves and validates the full configuration
 (four-layer precedence, fail-closed `repos` guard), reports the effective
@@ -10,6 +11,12 @@ settings, then runs the orchestrator: `--once` for a single sweep (pair it
 with `--dry-run -v` to print every decision and its reasons without touching
 GitHub or the task graph), otherwise `run_forever`. Config errors still surface
 here, at startup, with a clean exit code.
+
+Startup is the ONE place that may do I/O before the loop begins, and it does
+exactly one call: under `release_feed: bow` with no explicit `bow_owners`, the
+daemon asks Alissa who its token is and makes itself the feed authority. That
+call failing is fatal — the daemon exits rather than starting up unable to tell
+its own containers from a stranger's.
 """
 
 from __future__ import annotations
@@ -17,9 +24,10 @@ from __future__ import annotations
 import argparse
 import logging
 import sys
+from dataclasses import replace
 from pathlib import Path
 
-from .alissa_client import AlissaError
+from .alissa_client import AlissaClient, AlissaError
 from .config import (
     FEED_BOW,
     RELEASE_FEEDS,
@@ -84,9 +92,10 @@ def build_parser() -> argparse.ArgumentParser:
         dest="repos",
         action="append",
         metavar="OWNER/REPO",
-        help="watch this repo; repeatable. When given, REPLACES the config "
-        "`repos` list. The allowlist is fail-closed: an empty allowlist is a "
-        "fatal startup error, not a no-op.",
+        help="watch this repo; repeatable, and one flag may carry several "
+        "entries separated by `|` (the daemon-family convention) or `,`. When "
+        "given, REPLACES the config `repos` list. The allowlist is fail-closed: "
+        "an empty allowlist is a fatal startup error, not a no-op.",
     )
     over.add_argument("--label", metavar="LABEL", help="issue label released work carries")
     over.add_argument("--poll-interval", type=int, metavar="SECONDS")
@@ -118,10 +127,12 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="ACTOR_ID",
         help="bow feed only: trust bodies of work OWNED by this Alissa actor "
         "as release feeds; repeatable. When given, REPLACES the config "
-        "`bow_owners` list. Fail-closed like --repo: `--release-feed bow` with "
-        "an empty owner list is a fatal startup error, because being SHARED a "
-        "body of work is not a claim to drive this daemon. An actor id is the "
-        "`ownerActorId` on the container's row in GET /v1/bodies-of-work.",
+        "`bow_owners` list. OPTIONAL — left unset, the daemon resolves its own "
+        "token's actor at boot and trusts only its own containers; give this "
+        "flag only when the containers belong to someone else. Being SHARED a "
+        "body of work is never a claim to drive this daemon either way. Must be "
+        "an actor ID (the `ownerActorId` on the container's row in "
+        "GET /v1/bodies-of-work) — a username or display name is refused.",
     )
     over.add_argument(
         "--scan-fallback-interval",
@@ -196,6 +207,57 @@ def resolve_config(args: argparse.Namespace) -> Config:
     return Config.build(workspace_root, file_data, overrides_from(args))
 
 
+def resolve_feed_authority(config: Config, alissa: AlissaClient) -> Config:
+    """Decide WHOSE bodies of work drive this daemon, and say so out loud.
+
+    Two answers, one of them free:
+
+    * `bow_owners` **set** — the operator named the authority explicitly. That
+      is the multi-operator case: the containers belong to an actor this token
+      is not. Nothing is resolved, nothing is called.
+    * `bow_owners` **unset** — the authority is **self**. The token already
+      carries an identity, so `GET /v1/ping` answers the question the operator
+      would otherwise have hand-copied out of the API, and the daemon trusts
+      exactly its own containers.
+
+    The whoami call is **fatal on failure**, deliberately, and this is the whole
+    fail-closed argument in one place. The alternative — carry on with an empty
+    authority — is technically safe (nothing would be trusted, so nothing would
+    release) but it is safe *silently*: the operator sees a daemon that runs and
+    releases nothing, which is exactly what a correctly configured daemon with
+    an empty queue looks like. Dying names the reason while someone is watching.
+    Note the property being protected is not "self is trusted" but "only a
+    KNOWN actor is trusted" — an unanswered whoami leaves that unknown, and no
+    default can fill it in.
+
+    Under `scan` this is a no-op: that feed never reads a Body of Work, so it
+    never needs an identity, and a daemon that only scans must not fail to boot
+    because an endpoint it does not use was unreachable.
+    """
+    if config.release_feed != FEED_BOW:
+        return config
+
+    if config.bow_owners:
+        log.info(
+            "bow feed authority: explicit (%s)", ", ".join(config.bow_owners)
+        )
+        return config
+
+    identity = alissa.whoami()  # fatal on failure — see main()
+    log.info("bow feed authority: self (%s)", identity.actor_id)
+    if identity.display_name:
+        # Logged as context, never compared: a display name is renameable, which
+        # is why `config.bow_owners` refuses to hold one.
+        log.debug(
+            "resolved from this token's identity: %r", identity.display_name
+        )
+    # The id comes from the API, so it is the authority on its own shape and is
+    # NOT put through `config`'s actor-id check — that check exists to catch a
+    # human typing a username, and applying it here would let a future id format
+    # break a daemon that had been given no configuration to be wrong about.
+    return replace(config, bow_owners=(identity.actor_id,))
+
+
 def log_effective_config(config: Config) -> None:
     """The resolved settings, defaults and all. INFO carries the decisions an
     operator needs; -v (DEBUG) shows the full surface."""
@@ -240,14 +302,52 @@ def main(argv: "list[str] | None" = None) -> int:
     try:
         config = resolve_config(args)
         log.info("workspace: %s", config.workspace_root)
-        log_effective_config(config)
-    except (FileNotFoundError, ValueError) as exc:
+        # One client, shared with the orchestrator: the boot-time whoami and
+        # every later task-graph call must speak as the same actor, or the
+        # authority resolved here would not be the one doing the reading.
+        alissa = AlissaClient(base=config.alissa_endpoint)
+    except (FileNotFoundError, ValueError, AlissaError) as exc:
+        # `AlissaError` is here to keep main()'s exit contract whole, not because
+        # anything in this block raises one today (the client's constructor only
+        # reads ALISSA_BASE / ALISSA_API_TOKEN). Exit 2 means "never started" and
+        # every other way of never starting prints one line; a lone path that
+        # answers with a traceback and exit 1 — the code that means "started,
+        # then a pass failed" — would misreport itself the day the constructor
+        # grows any validation. Plain text, deliberately: the bow-specific advice
+        # belongs only to the call that can actually earn it, below.
         print(f"config error: {exc}", file=sys.stderr)
         return 2
     except KeyboardInterrupt:
         return 0
 
-    orchestrator = Orchestrator(config)
+    # Deliberately its OWN try, holding exactly one call. The handler below
+    # names the bow feed, and `resolve_feed_authority` is the only thing here
+    # that can fail for that reason — under `scan` it returns before making any
+    # call at all. A wider block would let some unrelated Alissa failure be
+    # reported as an authority problem, pointing a scan-only operator at a knob
+    # that does nothing in their feed mode.
+    try:
+        config = resolve_feed_authority(config, alissa)
+    except AlissaError as exc:
+        # The bow feed could not learn who this token is. Fatal by design (see
+        # resolve_feed_authority): booting on an unknown identity would mean a
+        # daemon that looks healthy and silently releases nothing. Same exit
+        # code as a config error — it is the same class of failure, a daemon
+        # that never started, and the operator's fix is a token or an explicit
+        # bow_owners rather than anything the loop could retry.
+        print(
+            f"config error: could not resolve the bow feed authority — {exc}. "
+            f"Check ALISSA_API_TOKEN and the endpoint, or set bow_owners "
+            f"explicitly to name the actor(s) that own the feed bodies of work.",
+            file=sys.stderr,
+        )
+        return 2
+    except KeyboardInterrupt:
+        return 0
+
+    log_effective_config(config)
+
+    orchestrator = Orchestrator(config, alissa=alissa)
     try:
         if args.once:
             orchestrator.poll_once()

{alissa_tools_github_orcloop-0.3.0 → alissa_tools_github_orcloop-0.3.2}/src/main/alissa/tools/github/orcloop/alissa_client.py

@@ -94,6 +94,18 @@ Both BOW endpoints require the daemon actor to be a **collaborator** on the
 Body of Work (otherwise 403 ``FORBIDDEN`` on attach/detach) -- an operator setup
 step, documented in the README. orcloop never attaches: attaching is the
 operator's trigger, detaching is orcloop's terminal release act.
+
+WHO AM I (O8)
+=============
+``GET /v1/ping`` -- ``{"pong", "timestamp", "userId", "actorId",
+"displayName"}`` -- is the token's identity endpoint, and it is the ONLY one:
+``/v1/me``, ``/v1/whoami``, ``/v1/actors/me``, ``/v1/auth/me``, ``/v1/user(s)/me``,
+``/v1/identity``, ``/v1/actor``, ``/v1/session``, ``/v1/profile`` all answer 404
+``"The requested endpoint does not exist."``. Its OpenAPI summary states the
+contract outright: *"Verify the token and return the acting identity."* That is
+what lets ``bow_owners`` default to the daemon's own actor instead of making the
+operator hand-copy an id -- see ``whoami`` and the boot resolution in
+``__main__.resolve_feed_authority``.
 """
 
 from __future__ import annotations
@@ -189,6 +201,21 @@ class BowMember:
     status: str
 
 
+@dataclass(frozen=True)
+class Identity:
+    """Who this token acts as, from ``GET /v1/ping``.
+
+    `actor_id` is the load-bearing field: it is the same opaque id that appears
+    as `ownerActorId` on a Body of Work, so it can be compared directly against
+    a container's owner. `user_id` and `display_name` are carried for logging
+    only -- a display name is renameable and must never reach an authority
+    check (see `config.bow_owners`)."""
+
+    actor_id: str
+    user_id: str = ""
+    display_name: str = ""
+
+
 @dataclass(frozen=True)
 class Criterion:
     id: str
@@ -317,6 +344,37 @@ class AlissaClient:
 
     # --- adapter surface ---------------------------------------------------
 
+    def whoami(self) -> Identity:
+        """The identity this token acts as (`GET /v1/ping`).
+
+        The `bow` feed's authority defaults to this actor, so the call is on the
+        BOOT path and its failure is fatal there -- never softened into a
+        warning. A daemon that could not learn who it is cannot tell its own
+        containers from a stranger's, and the only safe answers are "refuse to
+        start" or "trust nobody"; refusing is the loud one, so that is what
+        `__main__.resolve_feed_authority` does with what this raises.
+
+        A 2xx with no `actorId` is a contract violation rather than a missing
+        resource, so it surfaces as the base `AlissaError` -- the same way
+        `get_task` treats a response with no task object. `AlissaAuthError`
+        (a bad or unset token) and `AlissaTransient` (the endpoint was
+        unreachable) come through the shared taxonomy unchanged.
+        """
+        payload = self._request("GET", "/v1/ping")
+        row = payload if isinstance(payload, dict) else {}
+        actor_id = row.get("actorId")
+        if not isinstance(actor_id, str) or not actor_id.strip():
+            raise AlissaError(
+                200,
+                f"GET /v1/ping returned no actorId (got {payload!r}) — the "
+                f"token's acting identity could not be determined",
+            )
+        return Identity(
+            actor_id=actor_id.strip(),
+            user_id=str(row.get("userId") or ""),
+            display_name=str(row.get("displayName") or ""),
+        )
+
     def list_marked_committed_tasks(self, marker: str = RELEASE_MARKER) -> list[MarkedTask]:
         """Committed tasks carrying the release `marker`, with descriptions.
 

{alissa_tools_github_orcloop-0.3.0 → alissa_tools_github_orcloop-0.3.2}/src/main/alissa/tools/github/orcloop/config.py

@@ -21,6 +21,20 @@ watch nothing, but boot anyway), an empty orcloop allowlist is **fatal at
 startup** — the orchestrator releases work into `alissa:develop` issues and
 closes the loop on merge, so it never runs against an unbounded repo set.
 
+REPOS SEPARATOR (O7). A repo list written as one string — `ALISSA_ORC_REPOS`,
+a `--repo a/b|c/d` flag, or a single-element list in the config file — is split
+on **both `|` and `,`**, mixed freely. `|` is the daemon **family convention**
+(devloop's `ALISSA_DEV_REPOS` has always been pipe-separated); comma stays
+accepted for backward compatibility with every orcloop release up to 0.3.0.
+The convention matters because the operator points several Railway services at
+ONE list through a variable reference — `ALISSA_ORC_REPOS=${{dev.ALISSA_DEV_REPOS}}`
+— which only works if both daemons read the same separator. Entries are
+whitespace-stripped, empties from splitting are dropped (so a trailing
+separator is harmless), duplicates collapse, and each surviving entry must look
+like `owner/repo` (a bare word or a pasted URL is a fatal startup error naming
+the offending entry). An allowlist that is empty *after* parsing stays fatal —
+fail-closed is unchanged.
+
 The marker contract (`Autonomous-Dev` / `Autonomous-Scope` issue-body
 trailers) is parsed in `markers.py`; the keys that name those trailers live
 here (`marker_key`, `scope_key`) so an operator can rename them per-deployment.
@@ -36,21 +50,35 @@ RELEASE FEED (O6). `release_feed` selects where release candidates come from:
   O(total BOW membership). `scan_fallback_interval` keeps a low-frequency full
   trailer scan running underneath as a visibility safety net.
 
-The `bow` feed has a **second** fail-closed allowlist, `bow_owners`, and the two
-answer different questions. A container's title says which repo it targets, so
-`repos` bounds *where* a release lands. Nothing in a title says who created the
+The `bow` feed has a **second** allowlist, `bow_owners`, and the two answer
+different questions. A container's title says which repo it targets, so `repos`
+bounds *where* a release lands. Nothing in a title says who created the
 container — and the daemon lists Bodies of Work it merely **collaborates** on,
 which any actor in the tenant can arrange without an acceptance step on this
 side. `bow_owners` names the actor id(s) whose containers may drive the daemon,
-so "whose work reaches an autonomous pipeline" is an operator decision rather
-than a consequence of being shared something. Empty is fatal under
-`release_feed: bow`, exactly as an empty `repos` is fatal always.
+so "whose work reaches an autonomous pipeline" is a decided question rather
+than a consequence of being shared something.
+
+FEED AUTHORITY (O8). `bow_owners` is an OPTIONAL OVERRIDE, not required setup.
+Left unset it resolves at boot to the **token's own actor** — the daemon asks
+`GET /v1/ping` who it is and trusts only its own containers (see
+`__main__.resolve_feed_authority`, which is also where a failed whoami is
+fatal). Set it only for a multi-operator deployment, where the containers are
+owned by someone other than the actor the daemon's token acts as. That the
+default is self does not soften the gate: an unresolvable identity refuses to
+boot rather than trusting everything, so the fail-closed property `bow_owners`
+was introduced for is unchanged — only the hand-copying is gone.
+
+Entries are actor **ids** and nothing else; a username or display name is
+rejected here, naming it (see `_validate_actor_id` for why a name is both a
+spoof surface and a silent one).
 """
 
 from __future__ import annotations
 
 import json
 import os
+import re
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Mapping
@@ -91,9 +119,52 @@ RELEASE_FEEDS = (FEED_SCAN, FEED_BOW)
 # Keys carrying a boolean; env strings for these need real parsing (bool("false")
 # is True, which would silently invert the setting).
 _BOOL_KEYS = frozenset({"dry_run", "close_loop_enabled"})
-# Keys carrying a list of strings; an env value is comma-separated.
+# Keys carrying a list of strings. In an env value they are separator-delimited;
+# `repos` accepts the family's `|` as well as `,` (see REPO_SEPARATORS), every
+# other list key is comma-separated.
 _LIST_KEYS = frozenset({"repos", "bow_owners"})
 
+# The separators a one-string repo list may use, in preference order. `|` is the
+# daemon-family convention (devloop's ALISSA_DEV_REPOS), which is what lets one
+# Railway variable reference feed both daemons; `,` is what orcloop shipped
+# through 0.3.0 and stays accepted. Mixing them in one value is fine.
+REPO_SEPARATORS = ("|", ",")
+_REPO_SPLIT_RE = re.compile("[" + re.escape("".join(REPO_SEPARATORS)) + "]")
+
+# What an allowlist entry must look like once split: exactly one `/`, a GitHub
+# owner (alphanumerics and hyphens, not leading/trailing) and a repo name
+# (alphanumerics, `.`, `_`, `-`) that is neither all dots nor `.git`-suffixed
+# (in any casing, matching the hint branch below — spelled as a character class
+# rather than re.IGNORECASE, which would also relax the two strict classes) —
+# both are names GitHub itself refuses. Deliberately strict enough to reject
+# the mistakes a separator change invites — a bare word (`widgets`, which names
+# no owner) and a pasted URL or git remote (`https://github.com/acme/widgets`,
+# `git@github.com:acme/widgets.git`), each of which would otherwise become an
+# allowlist row the daemon silently never matches.
+#
+# Every exclusion here is one spelling GitHub refuses that the character class
+# would otherwise accept, so this is the line new ones get added to; the hint
+# table in `_validate_repo_entry` is where each earns its own message.
+_REPO_NAME_RE = re.compile(
+    r"^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?"
+    r"/(?!\.+$)(?!.*\.[Gg][Ii][Tt]$)[A-Za-z0-9._-]+$"
+)
+
+# What an Alissa actor id looks like: a 32-character opaque handle of lower-case
+# letters and digits (`j5706fv7xe5jy1k5wdwzacab9s8axcd2`). Every id the API mints
+# — actors, users, tasks, bodies of work — has this shape, and `bow_owners` is
+# checked against it so a username or display name cannot be mistaken for one.
+# The check is SHAPE only: it says "this could be an id", never "this actor
+# exists" (nothing short of a lookup could, and a wrong-but-well-formed id
+# already fails loudly as a feed nobody owns). If the API ever mints a different
+# shape, this constant and the pattern below are the two lines to widen.
+ACTOR_ID_LENGTH = 32
+_ACTOR_ID_ALPHABET = frozenset("abcdefghijklmnopqrstuvwxyz0123456789")
+# `\Z`, not `$`: `$` also matches just before a trailing newline, so
+# `"<id>\n"` would pass. Callers strip, but a gate that only holds because its
+# caller normalised is not a gate.
+_ACTOR_ID_RE = re.compile(rf"^[a-z0-9]{{{ACTOR_ID_LENGTH}}}\Z")
+
 MIN_POLL_INTERVAL = 10  # the GitHub search API allows 30 req/min
 
 DEFAULT_ALISSA_ENDPOINT = "https://api.alissa.app"
@@ -134,6 +205,168 @@ def _string_list(value: Any, key: str) -> tuple[str, ...]:
     return tuple(value)
 
 
+def split_repo_entries(raw: str) -> list[str]:
+    """Split one repo-list string into entries on `|` and/or `,`.
+
+    Whitespace around an entry is stripped and empties are dropped, so a
+    trailing separator, a doubled one, and `a/b | c/d` all behave. This is the
+    ONE place the separator set is applied: the library's env layer, the CLI
+    flag, the config file, and the container's `render_config.py` all route
+    through it, so no surface can end up accepting a different syntax.
+
+    Splitting only — shape validation is `normalize_repos`, because the config
+    file may also hand over an already-split JSON list.
+    """
+    return [entry for part in _REPO_SPLIT_RE.split(raw) if (entry := part.strip())]
+
+
+def normalize_repos(values: tuple[str, ...] | list[str]) -> tuple[str, ...]:
+    """Turn the raw `repos` layer value into the validated allowlist.
+
+    Every element is itself split (an entry may carry a whole separated list —
+    that is exactly what `ALISSA_ORC_REPOS` and a `--repo a/b|c/d` flag look
+    like), duplicates collapse case-insensitively keeping the operator's first
+    spelling (GitHub names are case-insensitive, and `watches` matches them
+    that way — a repeat is a duplicated GitHub search term, not a second lane),
+    and each survivor is validated as `owner/repo`.
+
+    Emptiness is NOT judged here: `Config.build` owns the fail-closed guard so
+    the operator gets its one canonical message.
+    """
+    out: list[str] = []
+    seen: set[str] = set()
+    for value in values:
+        for entry in split_repo_entries(value):
+            _validate_repo_entry(entry)
+            if (key := entry.casefold()) not in seen:
+                seen.add(key)
+                out.append(entry)
+    return tuple(out)
+
+
+def _validate_repo_entry(entry: str) -> None:
+    """Reject anything that is not an `owner/repo` name, naming the entry.
+
+    Fail loudly rather than carry it: an unmatchable allowlist entry is not
+    inert, it is a repo the operator believes is watched and is not.
+    """
+    if _REPO_NAME_RE.match(entry):
+        return
+    if (
+        "://" in entry
+        or "@" in entry
+        or ":" in entry
+        or entry.casefold().startswith(("github.com/", "www."))
+    ):
+        # Covers a pasted browser URL, a scheme-less `github.com/...`, and an
+        # SSH remote (`git@github.com:acme/widgets.git`) — which has no `://`
+        # and only one `/`, so without the `@`/`:` tests it would fall through
+        # to the bare message.
+        hint = " — that looks like a URL or a git remote; use only the " \
+               "`owner/repo` part"
+    elif entry.casefold().endswith(".git") and "/" in entry:
+        # Ordered AFTER the URL/remote branch so the two messages COMPOSE: a
+        # full remote keeps "use only the `owner/repo` part", and the
+        # `acme/widgets.git` that following that advice yields gets the
+        # remaining half of the fix here. Without this branch, the first
+        # message walks the operator from a loud abort into a silent no-match.
+        hint = (" — drop the trailing `.git`; that is the clone URL's suffix, "
+                "not part of the repo name")
+    elif "/" not in entry:
+        hint = " — no `/`, so it names no owner"
+    elif entry.count("/") > 1:
+        hint = " — too many `/`; an entry is one owner and one repo"
+    else:
+        hint = ""
+    raise ValueError(
+        f"repos entry {entry!r} is not an owner/repo name{hint}. Entries look "
+        f"like `acme/widgets` and are separated by `|` (the daemon-family "
+        f"convention) or `,`, e.g. \"acme/widgets|acme/gadgets\"."
+    )
+
+
+def normalize_bow_owners(values: tuple[str, ...] | list[str]) -> tuple[str, ...]:
+    """Turn the raw `bow_owners` layer value into the validated authority list.
+
+    Entries are whitespace-stripped, empties dropped (so a trailing comma is
+    harmless, matching `repos`), duplicates collapsed — EXACTLY, with no
+    casefolding, because actor ids are opaque: two spellings that differ in case
+    are two different strings on the wire, and folding them would silently widen
+    the match. Every survivor must look like an actor id.
+
+    Emptiness is fine here and means "not overridden": the boot path resolves
+    the authority to this token's own actor (see the module docstring). There is
+    no fail-closed guard left in `build` for it — an empty list still admits
+    nothing (`trusts_feed_owner` returns False for every owner), so the property
+    is preserved by the comparison itself rather than by refusing to start.
+    """
+    out: list[str] = []
+    seen: set[str] = set()
+    for value in values:
+        entry = value.strip()
+        if not entry:
+            continue
+        _validate_actor_id(entry)
+        if entry not in seen:
+            seen.add(entry)
+            out.append(entry)
+    return tuple(out)
+
+
+def _validate_actor_id(entry: str) -> None:
+    """Reject anything that is not an Alissa actor id, naming the entry.
+
+    Ownership is checked against a container's `ownerActorId`, which is opaque
+    and immutable. A username or display name is neither: it is operator-facing
+    text the owning account can CHANGE, so an allowlist written in those terms
+    grants authority to whoever holds the name when the check runs rather than
+    to the actor the operator meant — the reason ids are the only accepted
+    spelling.
+
+    Worse, getting it wrong would not even be loud. Nothing on the wire ever
+    equals a name, so a name in this list simply matches no container, and the
+    `bow` feed's symptom is an empty queue — indistinguishable from "no work
+    attached yet". Failing here, at boot, with the offending entry named, is the
+    only point where the mistake is visible.
+    """
+    if _ACTOR_ID_RE.match(entry):
+        return
+    lowered = entry.lower()
+    if _ACTOR_ID_RE.match(lowered):
+        # The one near-miss with a mechanical fix, so it gets its own message
+        # instead of being described. NOT lowered silently: ids are opaque, and
+        # quietly rewriting one makes a config stop meaning what it says.
+        hint = f" — actor ids are lower-case; did you mean {lowered!r}?"
+    else:
+        # LENGTH FIRST. Both problems are reported when both are present, but a
+        # short name is a length problem before it is an alphabet one: telling
+        # someone their 8-character username "contains 'ADHMORTZ'" buries the
+        # useful observation under a rendering of its own character set.
+        problems = []
+        if len(entry) != ACTOR_ID_LENGTH:
+            problems.append(
+                f"it is {len(entry)} characters, not {ACTOR_ID_LENGTH}"
+            )
+        offending = "".join(sorted(set(entry) - _ACTOR_ID_ALPHABET))
+        if offending:
+            problems.append(
+                f"it contains {offending!r}, which no actor id does"
+            )
+        hint = " — " + " and ".join(problems)
+        if offending:
+            hint += "; that looks like a username or a display name"
+    raise ValueError(
+        f"bow_owners entry {entry!r} is not an Alissa actor id{hint}. Use the "
+        f"opaque id — the `ownerActorId` on the container's row in "
+        f"GET /v1/bodies-of-work, or `actorId` from GET /v1/ping — never a "
+        f"username or display name: names are renameable, so an ownership "
+        f"check against one is a spoof surface, and since no id on the wire "
+        f"ever equals a name it would fail as a silently empty feed rather "
+        f"than an error. Leave bow_owners unset to trust this token's own "
+        f"actor, which needs no id at all."
+    )
+
+
 def _env_bool(env_name: str, raw: str) -> bool:
     value = raw.strip().lower()
     if value in _ENV_TRUE:
@@ -164,6 +397,11 @@ def env_overrides(environ: Mapping[str, str] | None = None) -> dict[str, Any]:
         raw = env[env_name]
         if key in _BOOL_KEYS:
             out[key] = _env_bool(env_name, raw)
+        elif key == "repos":
+            # Separator-tolerant (`|` and `,`); shape-validated in `build`
+            # alongside the file and CLI layers, so one bad entry reports the
+            # same way wherever it came from.
+            out[key] = tuple(split_repo_entries(raw))
         elif key in _LIST_KEYS:
             out[key] = tuple(
                 item for part in raw.split(",") if (item := part.strip())
@@ -181,7 +419,9 @@ class Config:
     # Fail-closed allowlist of owner/repo. Empty is REJECTED at build (see
     # build's guard) — the orchestrator never runs against an unbounded set.
     # The dataclass default is () only to mark "unset"; a real Config always
-    # carries at least one repo.
+    # carries at least one repo. Entries reach `build` as `|`- and/or
+    # `,`-separated text from any layer and land here split, validated,
+    # de-duplicated, and in the operator's own casing (see `normalize_repos`).
     repos: tuple[str, ...] = ()
 
     label: str = "alissa:develop"
@@ -222,13 +462,16 @@ class Config:
     bow_prefix: str = "autodev: "
 
     # WHOSE Bodies of Work may act as a release feed: the Alissa actor id(s)
-    # allowed to OWN a feed container. Fail-closed like `repos` — empty is
-    # REJECTED at build when `release_feed` is `bow` (see build's guard). The
-    # title tells the daemon which repo a container targets; it says nothing
-    # about who created it, and the daemon lists containers it merely
-    # collaborates on, which anyone in the tenant can arrange unilaterally.
-    # So provenance is an operator decision, made here. Ids are opaque and
+    # allowed to OWN a feed container. The title tells the daemon which repo a
+    # container targets; it says nothing about who created it, and the daemon
+    # lists containers it merely collaborates on, which anyone in the tenant can
+    # arrange unilaterally. So provenance is decided here. Ids are opaque and
     # compared EXACTLY (unlike `repos`, which casefolds GitHub names).
+    #
+    # Empty means "not overridden", NOT "trust everyone": the boot path resolves
+    # it to this token's own actor and dies if it cannot (O8), and until it does
+    # an empty list matches no owner at all. An explicit list is the
+    # multi-operator case — containers owned by an actor this token is not.
     bow_owners: tuple[str, ...] = ()
 
     # The `bow`-feed safety net: every this-many seconds, ALSO run the full
@@ -270,6 +513,13 @@ class Config:
         payload does not state cannot be attributed, and an unattributable feed
         is exactly what `bow_owners` exists to refuse. Exact comparison — Alissa
         actor ids are opaque, so normalising them would only widen the match.
+
+        Fail-closed on an EMPTY authority as well, which is what makes the O8
+        default safe to resolve outside this class: before boot fills the list
+        in (or when something skipped that step), every owner is untrusted and
+        nothing is a feed. The failure mode of a missing authority is therefore
+        an inert daemon, never an open one — boot's job is only to make that
+        state loud instead of quiet.
         """
         return bool(actor_id) and actor_id in self.bow_owners
 
@@ -313,7 +563,12 @@ class Config:
         # The env layer wins over everything, including a value set on the CLI.
         raw.update(env_overrides(environ))
 
-        repos = _string_list(raw.get("repos", cls.repos), "repos")
+        # Split-then-validate: whichever layer won, an entry may still be a
+        # whole `a/b|c/d` list (that is what one Railway variable reference
+        # looks like), so normalize before the fail-closed check — a value of
+        # only separators parses to nothing and must read as "empty", not as
+        # one bogus repo.
+        repos = normalize_repos(_string_list(raw.get("repos", cls.repos), "repos"))
         if not repos:
             # Fail-closed: the orchestrator spawns develop work and closes the
             # loop on merge. An empty allowlist would let anyone who can label
@@ -321,7 +576,8 @@ class Config:
             raise ValueError(
                 "repos allowlist is empty — the orchestrator is fail-closed and "
                 "refuses to start with no repos. Set `repos` in the config file, "
-                "pass one or more --repo flags, or set ALISSA_ORC_REPOS."
+                "pass one or more --repo flags, or set ALISSA_ORC_REPOS "
+                "(entries separated by `|`, or `,`)."
             )
 
         interval = int(raw.get("poll_interval", cls.poll_interval))
@@ -365,25 +621,15 @@ class Config:
                 "turn every Body of Work into a release feed"
             )
 
-        bow_owners = _string_list(raw.get("bow_owners", cls.bow_owners), "bow_owners")
-        if release_feed == FEED_BOW and not bow_owners:
-            # Fail-closed, the `repos` guard's twin. `repos` bounds WHERE the
-            # orchestrator writes; this bounds WHOSE work drives it. The feed
-            # lists Bodies of Work the daemon merely collaborates on, and being
-            # made a collaborator takes no acceptance step on this side, so
-            # without an owner allowlist "shared with the daemon and titled for
-            # a watched repo" is enough to get a task rendered into an issue in
-            # that repo and handed to the develop pipeline. Only fatal for the
-            # `bow` feed: `scan` never reads a Body of Work at all.
-            raise ValueError(
-                "bow_owners is empty and release_feed is 'bow' — the release "
-                "feed is fail-closed and refuses to start without the actor "
-                "id(s) allowed to own a feed Body of Work (being shared one is "
-                "not a claim to drive this daemon). Set `bow_owners` in the "
-                "config file, pass one or more --bow-owner flags, or set "
-                "ALISSA_ORC_BOW_OWNERS. An actor id is the `ownerActorId` on "
-                "the container's row in GET /v1/bodies-of-work."
-            )
+        # Shape-validated in EVERY feed mode, not just `bow`. The value is inert
+        # under `scan`, but a malformed id that boots quietly today is a daemon
+        # that refuses to start on the unrelated day the operator flips the feed
+        # over — and this is the layer that knows the entry came from a human.
+        # Empty stays legal: the boot path resolves the authority to this
+        # token's own actor (O8), so `bow_owners` is an override, not setup.
+        bow_owners = normalize_bow_owners(
+            _string_list(raw.get("bow_owners", cls.bow_owners), "bow_owners")
+        )
 
         fallback = int(raw.get("scan_fallback_interval", cls.scan_fallback_interval))
         if fallback < 0:

{alissa_tools_github_orcloop-0.3.0 → alissa_tools_github_orcloop-0.3.2}/src/main/alissa/tools/github/orcloop/loop.py

@@ -67,9 +67,10 @@ titled `autodev: <owner>/<repo>` (`bow_prefix`).
   trailer logs a warning and the BOW wins (never a silent retarget).
   `Autonomous-Scope` is unchanged: still read from the task body, still the
   intra-repo parallel-release glob list.
-* **Only an ALLOWLISTED OWNER's Body of Work is a feed** (`bow_owners`, empty
-  is fatal under this feed). The listing includes containers merely SHARED with
-  the daemon, and sharing is unilateral -- so a feed-shaped title is a target
+* **Only an ALLOWLISTED OWNER's Body of Work is a feed** (`bow_owners`, which
+  defaults at boot to the daemon's OWN actor and is fatal if that cannot be
+  resolved -- O8). The listing includes containers merely SHARED with the
+  daemon, and sharing is unilateral -- so a feed-shaped title is a target
   declaration, never a provenance claim. `bow_prefix` and `repos` bound which
   repo a release lands in; they say nothing about whose task gets there, and an
   allowlisted repo is where the daemon's writes are most trusted. A prefix-
@@ -609,6 +610,26 @@ class Orchestrator:
         surfaced: set[int] = set()
         unresolved: set[str] = set()
 
+        if not self.config.bow_owners:
+            # Not reachable through the CLI: boot resolves the authority (the
+            # token's own actor, or the operator's explicit list) and refuses to
+            # start if it cannot. Kept because it is the feed's central property
+            # and it must hold for an Orchestrator built any other way -- a
+            # test, an embedder, a future entry point. `trusts_feed_owner`
+            # already refuses every owner on an empty list, so the release
+            # behavior here is unchanged; what this adds is the LOUDNESS boot
+            # would have provided. The pass is INCOMPLETE, so the fallback sweep
+            # does not go on to report every marked task as "the feed did not
+            # surface this" -- the feed did not run.
+            log.error(
+                "release_feed is 'bow' but no feed authority is set — no body "
+                "of work can be authoritative, so nothing is released this "
+                "pass. Startup normally resolves this to the token's own actor; "
+                "set bow_owners explicitly if the feed containers are owned by "
+                "another actor."
+            )
+            return FeedPass(results, surfaced, unresolved, complete=False)
+
         try:
             bows = self.alissa.list_bodies_of_work()
         except AlissaError as exc:

alissa_tools_github_orcloop-0.3.2/src/main/alissa/tools/github/orcloop/version

@@ -0,0 +1 @@
+0.3.2

{alissa_tools_github_orcloop-0.3.0 → alissa_tools_github_orcloop-0.3.2/src/main/alissa_tools_github_orcloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.3.0
+Version: 0.3.2
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_orcloop-0.3.0/src/main/alissa/tools/github/orcloop/version

@@ -1 +0,0 @@
-0.3.0