# coreci-executor runbook

## Deploy (host, one time)
1. git clone this repo onto the PVE host.
2. cp executor.env.example .env && fill: API key, passcode, GITEA_TOKEN
   (from pack output), Discord webhook (optional).
3. podman compose up -d --build     (or: docker compose up -d --build)
4. Verify: curl http://127.0.0.1:8765/health -> {"status":"ok","version":"0.1.1"}
5. HAProxy: add frontend for executor.coreci.dev -> 127.0.0.1:8765.

## Kill switch
podman compose down   (requests in flight abort; audit JSONL persists)

## Token rotation
Admin UI -> coreci-executor -> Applications -> delete executor-v0 ->
recreate (write:repository) -> update .env -> podman compose restart.
(Or delete the token and re-run deployment pack step [2/6]; it recreates and
prints the value once.)

## Audit
logs/audit-YYYY-MM-DD.jsonl inside this repo. Read-only verification from any
chat: GET this repo's logs/ via the Gitea API.

## First live job (P0)
Submit the credential-free re-run of the pending 09-28 PARA pack
(agent coreci-coo, kind bash_pack, target coreci-coo/home).
IMPORTANT: the pack content must be the credential-free variant —
REPO_URL="https://git.coreci.dev/coreci-coo/home.git" (no user:pass@);
the executor injects auth at run time and rejects embedded credentials.