coreci-executor runbook

Deploy (host, one time)

git clone this repo onto the PVE host.
cp executor.env.example .env && fill: API key, passcode, GITEA_TOKEN (from pack output), Discord webhook (optional).
podman compose up -d --build (or: docker compose up -d --build)
Verify: curl http://127.0.0.1:8765/health -> {"status":"ok","version":"0.1.1"}
HAProxy: add frontend for executor.coreci.dev -> 127.0.0.1:8765.

Kill switch

podman compose down (requests in flight abort; audit JSONL persists)

Token rotation

Admin UI -> coreci-executor -> Applications -> delete executor-v0 -> recreate (write:repository) -> update .env -> podman compose restart. (Or delete the token and re-run deployment pack step [2/6]; it recreates and prints the value once.)

Audit

logs/audit-YYYY-MM-DD.jsonl inside this repo. Read-only verification from any chat: GET this repo's logs/ via the Gitea API.

First live job (P0)

Submit the credential-free re-run of the pending 09-28 PARA pack (agent coreci-coo, kind bash_pack, target coreci-coo/home). IMPORTANT: the pack content must be the credential-free variant — REPO_URL="https://git.coreci.dev/coreci-coo/home.git" (no user:pass@); the executor injects auth at run time and rejects embedded credentials.

1.3 KiB Raw Permalink Blame History