v0.9.0

Security

• Compose guard completed (agent): strict allowlists on every key of the resolved docker compose config model (services, builds, deploy, volumes, networks, secrets, configs), hardened sidecars (cap_drop: ALL plus a harmless baseline, no-new-privileges, CPU/memory/PID limits, no published ports or fixed container names) and a corpus of real compose files tested against it. It also closes a host escape: a sidecar with a writable bind of a directory could swap a path that another sidecar mounts (including a top-level secrets/configs file) for a symlink to / before that mount. Such writable binds are now refused. Repositories whose compose files used one of the refused features have to adapt them (see the security docs) (#71, @laupernoe)
• Private repository access re-checked: the stored project owner is only a hint. Every view and action on a private repository (usage, history, board, templates, pool, MCP tools, notifications, task offers and repository tokens) asks GitHub whether the user still has a role on it. Answers are cached, and webhooks invalidate them. A 403 or 404 denies at once. During a GitHub outage (5xx, 429, rate-limited 403 or 401), the last verified role is kept for a grace window, then access is denied (#67, @laupernoe)
• Stronger secret redaction: one shared module masks secrets in live logs (agent and server), the local run log, failure messages and notifications. It covers common token formats and every value the agent knows for a run, in its common encodings (JSON-escaped, URL, hex, base64), also when a value is split across lines or batches. All rules run in linear time (#72, @laupernoe)
• Signed webhooks: generic JSON webhooks are signed according to Standard Webhooks (webhook-id, webhook-timestamp, webhook-signature). A secret is generated or rotated in the notification settings and is shown only once. During a rotation, the previous secret also signs for 24 hours (#70, @laupernoe)

Changes

• Several server instances: run orch behind a load balancer with Postgres as the only shared component. The dispatcher and the maintenance jobs each run on an elected leader, agent messages are relayed between instances and live output is mirrored to the instance that has viewers. Notification deliveries go through a durable queue that another instance takes over if the first one dies. The auth and agent-connect rate limits are shared across instances. See Running several server instances in the installation docs (#68, @laupernoe)
• English and French interface: every page is translated through typed catalogs, and a CI check keeps the two locales in sync. English is the default; French is used only when chosen with the EN | FR switch, and the choice is remembered on the browser (#69, @laupernoe)
• Faster history search: trigram index on task titles and indexes on issue and PR numbers (#73, @laupernoe)
• Landing site: a static site in site/, published with GitHub Pages (#66, @laupernoe)

Many thanks to @laupernoe, who wrote every pull request in this release.

New configuration

Variable	Default	Meaning
ORCH_REPO_ACCESS_TTL_SEC	300	How long a user's role on a repository is cached
ORCH_REPO_ACCESS_GRACE_SEC	900	GitHub outage grace for private repositories
NOTIFY_QUEUE_POLL_MS	5000	How often the notification queue is polled for retries and leftovers of other instances
ORCH_INSTANCE_ID	hostname	Unique name of this instance among those sharing the database
ORCH_CLUSTER_NAME	orch	Instances with the same database and name cooperate
ORCH_INSTANCE_HEARTBEAT_MS	10000	Instance heartbeat; an instance silent for 3 heartbeats is considered gone
ORCH_LEADER_RETRY_MS	5000	How often a follower tries to take a free leadership

All of these are optional, and the defaults suit a single instance.

Upgrade

Server: set ORCH_VERSION=0.9.0 (or keep latest), then from deploy/server:

git pull
docker compose pull
docker compose up -d

git pull also brings the new deploy/server/upstream.caddy, which compose.yaml now mounts into Caddy. Three additive migrations run on start: the pg_trgm extension and the history search indexes, the webhook signing secret columns, and the multi-instance tables. pg_trgm is a trusted extension, so the database owner can create it. For several instances, add -f compose.replicas.yaml (see the installation docs). Every instance needs the same .env, including ORCH_ENCRYPTION_KEY.

Agents: orch update gets the completed compose guard and the new redaction.

Webhook receivers: verify the signature once a secret has been generated in the notification settings, and dedupe on webhook-id.