5. Operations

Status: ⚫ Superseded by 13 User Guide §4 and §6 (2026-08-17). This page was a design-era scope note; the runbook was never written. Several of its claims were overtaken by the build — recycle() events do not exist, per-session authorization shipped (auth/Authz), and the internal broker is optional rather than required.

Go to 13 User Guide:

§4 Run, and prove it runs — scripts/redeploy-fleetd.sh, why a merge is not a deployment, draining before a restart, and the four checks that go beyond /healthz.
§6 When it breaks — twelve traps hit for real this year, grouped by bring-up, losing a member's work, and merging a member's work.

What actually shipped, against what this page predicted

This page said	What is true now
"no per-session authz yet"	Per-session authorization shipped. `auth/Authz` holds the role table; identity comes from the connection, never from an argument.
"observing recycle events"	There is no `recycle()`. Lifecycle is an idle reaper plus a context cap — `lifecycle.idleTtlSeconds`, `lifecycle.contextCap`, `lifecycle.drainTimeoutSeconds`.
"internal broker/queue replay"	The broker is optional. With `broker:` commented out the daemon uses an in-memory inbox. When it is on, it is LavinMQ, never RabbitMQ.
"`GET /healthz` liveness"	Still true, and still not sufficient. Health can be green while every spawn fails, because the socket connects but the herdr wire protocol has moved. Check `protocol` in the body and verify with a real spawn.
"recycling a pane to swap models"	Spawn a member on a different profile instead. Profiles are the unit of model choice.

Guardrails that still hold

The lead must never busy-poll a member's pane — it burns your subscription for nothing. Async wake-ups are injected into the lead's own pane when a ticket goes terminal (CB-588).
Keep the port off public interfaces. The daemon binds loopback and trusts it; the exposure check only fires on a non-loopback bind.
Rotate tokens. Members get a minimal write:repository forge token, never the admin one.

13 User Guide · 2 Message Server · 1 Architecture · 11 Features

📖 fleet

Home — overview & the decision

Chapters

Architecture — system · 2 invariants · 2 modes
Message Server — the fleetd design
Approaches — transports compared, why herdr
Setup — ⚫ superseded by 13
Operations — ⚫ superseded by 13
Team — orchestrating a mixed fleet
Use Cases — the review scenario + mechanisms
Roadmap — delivery record: what is live, what is off, what was dropped
Implementation — as-built code map · classes · flows · state machines
Cross-Host Messaging — broker topology · exchanges · queues per entity
Features — what it can do · the knob that turns it on · why · the gotcha
Claude → OpenCode — porting a workspace to a second host
User Guide — 🟢 install · configure · run · delegate · the traps
Fleet Manager — many fleets on one host, over REST
REST API Reference — all 14 routes, roles, and bodies
Security & Trust Boundary — the guard · authz · what a member inherits

Design proposals (not built)

CB-548 Lead Quorum — a deterministic decision procedure around a lead's judgment

🟢 herdr-centric fleetd · AgentAPI = research, never built

5. Operations

What actually shipped, against what this page predicted

Guardrails that still hold

Related

📖 fleet