feat: handle gondor in orb-supervisor via zoci (#1213)

* remove it from jobs-agent

Author: sky-mart

Cargo.lock

@@ -7,9 +7,6 @@ ignore = [
 	# List of advisories we have ignored
 	{ id = "RUSTSEC-2023-0071", reason = "we dont use rsa keys" },
 	{ id = "RUSTSEC-2026-0002", reason = "todo" },
-	# astral-tokio-tar 0.5.6 is a transitive dep of testcontainers; upgrade blocked
-	# until testcontainers releases a version depending on astral-tokio-tar >=0.6.0
-	{ id = "RUSTSEC-2026-0066", reason = "transitive dep via testcontainers, low severity, no fix available upstream yet" },
 	# rustls-webpki 0.101.7 and 0.102.8 are pulled in by older aws-sdk/reqwest 0.11
 	# crates; upgrade blocked until those dependents update their rustls stack
 	{ id = "RUSTSEC-2026-0049", reason = "transitive dep via aws-sdk and reqwest 0.11, low severity, upgrade blocked by upstream" },

deny.toml

@@ -2,7 +2,6 @@ pub mod beacon;
 pub mod change_name;
 pub mod check_my_orb;
 pub mod fsck;
-pub mod gondor;
 pub mod logs;
 pub mod mcu;
 pub mod netconfig_get;

orb-jobs-agent/src/handlers/gondor.rs

@@ -1,7 +1,7 @@
 use crate::{
     conn_change,
     handlers::{
-        beacon, change_name, check_my_orb, fsck, gondor, logs, mcu, netconfig_get,
+        beacon, change_name, check_my_orb, fsck, logs, mcu, netconfig_get,
         netconfig_set, orb_details, read_file, read_gimbal, reboot, reset_gimbal,
         reset_rgb_focus_calibration, sec_mcu_reboot, service, slot_switch, speed_test,
         thermal_cam_recalibration, update_versions, wifi_ip, wipe_downloads,
@@ -57,7 +57,6 @@ pub async fn run(deps: Deps) -> Result<()> {
         .parallel("change_name", change_name::handler)
         .parallel("check_my_orb", check_my_orb::handler)
         .parallel("fsck", fsck::handler)
-        .parallel("gondor", gondor::handler)
         .parallel("orb_details", orb_details::handler)
         .parallel("read_gimbal", read_gimbal::handler)
         .parallel("reset_gimbal", reset_gimbal::handler)

orb-jobs-agent/src/handlers/mod.rs

@@ -18,20 +18,23 @@ libc.workspace = true
 listenfd = "1.0.0"
 once_cell = "1.15.0"
 orb-build-info.workspace = true
+orb-info = { workspace = true, features = ["orb-id", "async"] }
 orb-telemetry.workspace = true
 tap = "1.0.1"
 thiserror = { workspace = true, features = ["std"] }
-tokio = { workspace = true, features = ["macros", "net", "rt-multi-thread"] }
+tokio = { workspace = true, features = ["macros", "net", "process", "rt-multi-thread"] }
 tokio-stream = "0.1.11"
 tracing = { workspace = true, features = ["attributes"] }
 zbus = { workspace = true, default-features = false, features = ["tokio"] }
 zbus_systemd = { workspace = true, features = ["systemd1", "login1"] }
+zenorb.workspace = true
 
 [build-dependencies]
 orb-build-info = { workspace = true, features = ["build-script"] }
 
 [dev-dependencies]
 dbus-launch = "0.2.0"
+portpicker = "0.1.1"
 tokio = { workspace = true, features = ["sync", "test-util"] }
 
 [package.metadata.deb]

orb-jobs-agent/src/program.rs

@@ -2,13 +2,16 @@
 Description=Worldcoin Supervisor
 After=worldcoin-dbus.socket
 Wants=worldcoin-dbus.socket
+After=zenohd.service
+Requires=zenohd.service
 
 [Service]
 Type=dbus
 BusName=org.worldcoin.OrbSupervisor1
 SyslogIdentifier=worldcoin-supervisor
 Environment=DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/worldcoin_bus_socket
 ExecStart=/usr/local/bin/orb-supervisor
+SupplementaryGroups=zenohd
 
 [Install]
 WantedBy=multi-user.target

supervisor/Cargo.toml

@@ -11,7 +11,9 @@ use tracing::{debug, info, instrument, warn};
 use zbus::{fdo::Error as FdoError, interface, Connection, DBusError, SignalContext};
 use zbus_systemd::{login1, systemd1};
 
-use crate::shutdown::UnknownShutdownKind;
+use crate::{
+    consts::DURATION_TO_STOP_CORE_AFTER_LAST_SIGNUP, shutdown::UnknownShutdownKind,
+};
 
 /// The duration of time since the last "start signup" event that has to have passed
 /// before the update agent is permitted to start a download.
@@ -39,6 +41,7 @@ impl BusError {
 
 pub struct Manager {
     duration_to_allow_downloads: Duration,
+    stop_core_after_signup: Duration,
     last_signup_event: watch::Sender<Instant>,
     system_connection: Option<Connection>,
 }
@@ -58,6 +61,7 @@ impl Manager {
         );
         Self {
             duration_to_allow_downloads,
+            stop_core_after_signup: DURATION_TO_STOP_CORE_AFTER_LAST_SIGNUP,
             last_signup_event: tx,
             system_connection: None,
         }
@@ -74,6 +78,14 @@ impl Manager {
         }
     }
 
+    #[must_use]
+    pub fn stop_core_after_signup(self, stop_core_after_signup: Duration) -> Self {
+        Self {
+            stop_core_after_signup,
+            ..self
+        }
+    }
+
     #[allow(clippy::must_use_candidate)]
     pub fn are_downloads_allowed(&self) -> bool {
         self.last_signup_event.borrow().elapsed() >= self.duration_to_allow_downloads
@@ -143,6 +155,7 @@ impl Manager {
             crate::tasks::update::spawn_shutdown_worldcoin_core_timer(
                 systemd_proxy.clone(),
                 self.last_signup_event.subscribe(),
+                self.stop_core_after_signup,
             );
         // Wait for one second to see if worldcoin core is already shut down
         match tokio::time::timeout(Duration::from_secs(1), &mut shutdown_core_task)

supervisor/debian/orb-supervisor.worldcoin-supervisor.service

@@ -3,8 +3,10 @@ use clap::{
     Parser,
 };
 use color_eyre::eyre::WrapErr as _;
+use orb_info::OrbId;
 use orb_supervisor::startup::{Application, Settings};
 use tracing::debug;
+use zenorb::Zenorb;
 
 use orb_supervisor::BUILD_INFO;
 
@@ -40,7 +42,15 @@ async fn main() -> color_eyre::Result<()> {
     let result = async move {
         let settings = Settings::default();
         debug!(?settings, "starting supervisor with settings");
-        let application = Application::build(settings.clone())
+
+        let orb_id = OrbId::read().await.wrap_err("failed to read orb id")?;
+        let zenorb = Zenorb::from_cfg(zenorb::default_cfg())
+            .orb_id(orb_id)
+            .with_name("supervisor")
+            .await
+            .wrap_err("failed to initialize zenorb session")?;
+
+        let application = Application::build(settings.clone(), zenorb)
             .await
             .wrap_err("failed to build supervisor")?;