From c9ef5eb98bfd782b6d8b4986eed625237ddfdd47 Mon Sep 17 00:00:00 2001
From: Agent <agent@example.com>
Date: Sun, 29 Mar 2026 09:15:01 +0000
Subject: [PATCH 1/4] =?UTF-8?q?fix:=20feat:=20task=20dispatcher=20?=
 =?UTF-8?q?=E2=80=94=20poll=20ops=20repo=20and=20launch=20runners=20(#45)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docker/edge/dispatcher.sh | 134 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 127 insertions(+), 7 deletions(-)
 mode change 100644 => 100755 docker/edge/dispatcher.sh

diff --git a/docker/edge/dispatcher.sh b/docker/edge/dispatcher.sh
old mode 100644
new mode 100755
index adae33a..947e40e
--- a/docker/edge/dispatcher.sh
+++ b/docker/edge/dispatcher.sh
@@ -1,12 +1,132 @@
 #!/usr/bin/env bash
-# dispatcher.sh — Edge task dispatcher placeholder
+# dispatcher.sh — Edge task dispatcher
 #
-# TODO: Implement task polling and runner launching (#45)
-# Currently a no-op loop for future expansion.
+# Polls the ops repo for approved actions and launches task-runner containers.
+# Part of #24.
+#
+# Action JSON schema:
+# {
+#   "id": "publish-skill-20260328",
+#   "formula": "clawhub-publish",
+#   "secrets": ["CLAWHUB_TOKEN"],
+#   "tools": ["clawhub"],
+#   "context": "SKILL.md bumped to 0.3.0",
+#   "model": "sonnet"
+# }
 
 set -euo pipefail
 
-while true; do
-  # Placeholder: no-op loop, no logic yet
-  sleep 60
-done
+# Resolve script root (parent of lib/)
+SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# Source shared environment
+source "${SCRIPT_ROOT}/../lib/env.sh"
+
+# Ops repo location (vault/actions directory)
+OPS_REPO_ROOT="${OPS_REPO_ROOT:-/home/debian/disinto-ops}"
+VAULT_ACTIONS_DIR="${OPS_REPO_ROOT}/vault/actions"
+
+# Log function
+log() {
+  printf '[%s] %s\n' "$(date -u '+%Y-%m-%d %H:%M:%S UTC')" "$*"
+}
+
+# Clone or pull the ops repo
+ensure_ops_repo() {
+  if [ ! -d "${OPS_REPO_ROOT}/.git" ]; then
+    log "Cloning ops repo from ${FORGE_OPS_REPO}..."
+    git clone "${FORGE_WEB}" "${OPS_REPO_ROOT}"
+  else
+    log "Pulling latest ops repo changes..."
+    (cd "${OPS_REPO_ROOT}" && git pull --rebase)
+  fi
+}
+
+# Check if an action has already been completed
+is_action_completed() {
+  local id="$1"
+  [ -f "${VAULT_ACTIONS_DIR}/${id}.result.json" ]
+}
+
+# Launch a runner for the given action ID
+launch_runner() {
+  local id="$1"
+  log "Launching runner for action: ${id}"
+
+  # Read action config
+  local action_file="${VAULT_ACTIONS_DIR}/${id}.json"
+  if [ ! -f "$action_file" ]; then
+    log "ERROR: Action file not found: ${action_file}"
+    return 1
+  fi
+
+  # Extract formula from action JSON
+  local formula
+  formula=$(jq -r '.formula // empty' "$action_file")
+  if [ -z "$formula" ]; then
+    log "ERROR: Action ${id} missing 'formula' field"
+    return 1
+  fi
+
+  # Extract secrets (as space-separated list for env injection)
+  local secrets
+  secrets=$(jq -r '.secrets[]? // empty' "$action_file" 2>/dev/null | tr '\n' ' ')
+
+  # Run the formula via docker compose with action ID as argument
+  # The runner container should be defined in docker-compose.yml
+  # Secrets are injected via -e flags
+  local compose_cmd="docker compose run --rm runner ${formula} ${id}"
+
+  if [ -n "$secrets" ]; then
+    # Inject secrets as environment variables
+    for secret in $secrets; do
+      compose_cmd+=" -e ${secret}=${!secret}"
+    done
+  fi
+
+  log "Running: ${compose_cmd}"
+  eval "${compose_cmd}"
+
+  log "Runner completed for action: ${id}"
+}
+
+# Main dispatcher loop
+main() {
+  log "Starting dispatcher..."
+  log "Polling ops repo: ${VAULT_ACTIONS_DIR}"
+
+  # Ensure ops repo is available
+  ensure_ops_repo
+
+  while true; do
+    # Check if actions directory exists
+    if [ ! -d "${VAULT_ACTIONS_DIR}" ]; then
+      log "Actions directory not found: ${VAULT_ACTIONS_DIR}"
+      sleep 60
+      continue
+    fi
+
+    # Process each action file
+    for action_file in "${VAULT_ACTIONS_DIR}"/*.json; do
+      # Handle case where no .json files exist
+      [ -e "$action_file" ] || continue
+
+      local id
+      id=$(basename "$action_file" .json)
+
+      # Skip if already completed
+      if is_action_completed "$id"; then
+        continue
+      fi
+
+      # Launch runner for this action
+      launch_runner "$id"
+    done
+
+    # Wait before next poll
+    sleep 60
+  done
+}
+
+# Run main
+main "$@"
-- 
2.49.1


From 6e34b13a0595b44a27d108882179f8add1775abd Mon Sep 17 00:00:00 2001
From: Agent <agent@example.com>
Date: Sun, 29 Mar 2026 10:21:54 +0000
Subject: [PATCH 2/4] =?UTF-8?q?fix:=20dispatcher=20=E2=80=94=20address=20A?=
 =?UTF-8?q?I=20review=20feedback=20-=20Redact=20secrets=20in=20logs=20(=3D?=
 =?UTF-8?q?***)=20-=20Fix=20-e=20flags=20before=20service=20name=20in=20do?=
 =?UTF-8?q?cker=20compose=20run=20-=20Use=20FORGE=5FOPS=5FREPO=20for=20clo?=
 =?UTF-8?q?ning=20ops=20repo=20-=20Refresh=20ops=20repo=20in=20each=20poll?=
 =?UTF-8?q?=20loop=20iteration=20-=20Use=20array-based=20command=20executi?=
 =?UTF-8?q?on=20to=20prevent=20shell=20injection=20-=20Load=20vault=20secr?=
 =?UTF-8?q?ets=20after=20env.sh=20for=20dispatcher=20access?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docker/edge/dispatcher.sh | 57 ++++++++++++++++++++++++++-------------
 1 file changed, 38 insertions(+), 19 deletions(-)

diff --git a/docker/edge/dispatcher.sh b/docker/edge/dispatcher.sh
index 947e40e..66f438d 100755
--- a/docker/edge/dispatcher.sh
+++ b/docker/edge/dispatcher.sh
@@ -22,6 +22,20 @@ SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # Source shared environment
 source "${SCRIPT_ROOT}/../lib/env.sh"
 
+# Load vault secrets after env.sh (env.sh unsets them for agent security)
+# Vault secrets must be available to the dispatcher
+if [ -f "$FACTORY_ROOT/.env.vault.enc" ] && command -v sops &>/dev/null; then
+  set -a
+  eval "$(sops -d --output-type dotenv "$FACTORY_ROOT/.env.vault.enc" 2>/dev/null)" \
+    || echo "Warning: failed to decrypt .env.vault.enc — vault secrets not loaded" >&2
+  set +a
+elif [ -f "$FACTORY_ROOT/.env.vault" ]; then
+  set -a
+  # shellcheck source=/dev/null
+  source "$FACTORY_ROOT/.env.vault"
+  set +a
+fi
+
 # Ops repo location (vault/actions directory)
 OPS_REPO_ROOT="${OPS_REPO_ROOT:-/home/debian/disinto-ops}"
 VAULT_ACTIONS_DIR="${OPS_REPO_ROOT}/vault/actions"
@@ -35,7 +49,7 @@ log() {
 ensure_ops_repo() {
   if [ ! -d "${OPS_REPO_ROOT}/.git" ]; then
     log "Cloning ops repo from ${FORGE_OPS_REPO}..."
-    git clone "${FORGE_WEB}" "${OPS_REPO_ROOT}"
+    git clone "${FORGE_OPS_REPO}" "${OPS_REPO_ROOT}"
   else
     log "Pulling latest ops repo changes..."
     (cd "${OPS_REPO_ROOT}" && git pull --rebase)
@@ -68,24 +82,29 @@ launch_runner() {
     return 1
   fi
 
-  # Extract secrets (as space-separated list for env injection)
-  local secrets
-  secrets=$(jq -r '.secrets[]? // empty' "$action_file" 2>/dev/null | tr '\n' ' ')
+  # Extract secrets (array for safe handling)
+  local -a secrets=()
+  while IFS= read -r secret; do
+    [ -n "$secret" ] && secrets+=("$secret")
+  done < <(jq -r '.secrets[]? // empty' "$action_file" 2>/dev/null)
 
-  # Run the formula via docker compose with action ID as argument
-  # The runner container should be defined in docker-compose.yml
-  # Secrets are injected via -e flags
-  local compose_cmd="docker compose run --rm runner ${formula} ${id}"
+  # Build command array (safe from shell injection)
+  local -a cmd=(docker compose run --rm runner)
 
-  if [ -n "$secrets" ]; then
-    # Inject secrets as environment variables
-    for secret in $secrets; do
-      compose_cmd+=" -e ${secret}=${!secret}"
-    done
-  fi
+  # Add environment variables BEFORE service name
+  for secret in "${secrets[@]+"${secrets[@]}"}"; do
+    local secret_val="${!secret:-}"
+    cmd+=(-e "${secret}=***")  # Redact value in the command array
+  done
 
-  log "Running: ${compose_cmd}"
-  eval "${compose_cmd}"
+  # Add formula and id as arguments (after service name)
+  cmd+=("$formula" "$id")
+
+  # Log command skeleton (secrets are redacted)
+  log "Running: ${cmd[*]}"
+
+  # Execute with array expansion (safe from shell injection)
+  "${cmd[@]}"
 
   log "Runner completed for action: ${id}"
 }
@@ -95,10 +114,10 @@ main() {
   log "Starting dispatcher..."
   log "Polling ops repo: ${VAULT_ACTIONS_DIR}"
 
-  # Ensure ops repo is available
-  ensure_ops_repo
-
   while true; do
+    # Refresh ops repo at the start of each poll cycle
+    ensure_ops_repo
+
     # Check if actions directory exists
     if [ ! -d "${VAULT_ACTIONS_DIR}" ]; then
       log "Actions directory not found: ${VAULT_ACTIONS_DIR}"
-- 
2.49.1


From 649a893184f21f05caa1cabbd2a8c5474418f442 Mon Sep 17 00:00:00 2001
From: Agent <agent@example.com>
Date: Sun, 29 Mar 2026 10:42:44 +0000
Subject: [PATCH 3/4] =?UTF-8?q?fix:=20dispatcher=20=E2=80=94=20remove=20un?=
 =?UTF-8?q?used=20variable=20-=20Remove=20unused=20secret=5Fval=20variable?=
 =?UTF-8?q?=20to=20pass=20shellcheck?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docker/edge/dispatcher.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docker/edge/dispatcher.sh b/docker/edge/dispatcher.sh
index 66f438d..73f1590 100755
--- a/docker/edge/dispatcher.sh
+++ b/docker/edge/dispatcher.sh
@@ -93,7 +93,6 @@ launch_runner() {
 
   # Add environment variables BEFORE service name
   for secret in "${secrets[@]+"${secrets[@]}"}"; do
-    local secret_val="${!secret:-}"
     cmd+=(-e "${secret}=***")  # Redact value in the command array
   done
 
-- 
2.49.1


From 6be0eee20b9d3ba7cdfeba187507b06935d70b30 Mon Sep 17 00:00:00 2001
From: Agent <agent@example.com>
Date: Sun, 29 Mar 2026 11:00:58 +0000
Subject: [PATCH 4/4] =?UTF-8?q?fix:=20dispatcher=20=E2=80=94=20fix=20clone?=
 =?UTF-8?q?=20URL=20and=20secret=20injection=20-=20Use=20FORGE=5FURL/FORGE?=
 =?UTF-8?q?=5FOPS=5FREPO=20for=20clonable=20URL=20-=20Pass=20-e=20SECRET?=
 =?UTF-8?q?=5FNAME=20without=20value=20(Docker=20inherits=20from=20env)=20?=
 =?UTF-8?q?-=20Simplify=20logging=20to=20hide=20all=20-e=20flags=20entirel?=
 =?UTF-8?q?y?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docker/edge/dispatcher.sh | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/docker/edge/dispatcher.sh b/docker/edge/dispatcher.sh
index 73f1590..02718b6 100755
--- a/docker/edge/dispatcher.sh
+++ b/docker/edge/dispatcher.sh
@@ -48,8 +48,8 @@ log() {
 # Clone or pull the ops repo
 ensure_ops_repo() {
   if [ ! -d "${OPS_REPO_ROOT}/.git" ]; then
-    log "Cloning ops repo from ${FORGE_OPS_REPO}..."
-    git clone "${FORGE_OPS_REPO}" "${OPS_REPO_ROOT}"
+    log "Cloning ops repo from ${FORGE_URL}/${FORGE_OPS_REPO}..."
+    git clone "${FORGE_URL}/${FORGE_OPS_REPO}" "${OPS_REPO_ROOT}"
   else
     log "Pulling latest ops repo changes..."
     (cd "${OPS_REPO_ROOT}" && git pull --rebase)
@@ -93,14 +93,28 @@ launch_runner() {
 
   # Add environment variables BEFORE service name
   for secret in "${secrets[@]+"${secrets[@]}"}"; do
-    cmd+=(-e "${secret}=***")  # Redact value in the command array
+    cmd+=(-e "${secret}")  # Pass actual value to container (from env)
   done
 
   # Add formula and id as arguments (after service name)
   cmd+=("$formula" "$id")
 
-  # Log command skeleton (secrets are redacted)
-  log "Running: ${cmd[*]}"
+  # Log command skeleton (hide all -e flags for security)
+  local -a log_cmd=()
+  local skip_next=0
+  for arg in "${cmd[@]}"; do
+    if [[ $skip_next -eq 1 ]]; then
+      skip_next=0
+      continue
+    fi
+    if [[ "$arg" == "-e" ]]; then
+      log_cmd+=("$arg" "<redacted>")
+      skip_next=1
+    else
+      log_cmd+=("$arg")
+    fi
+  done
+  log "Running: ${log_cmd[*]}"
 
   # Execute with array expansion (safe from shell injection)
   "${cmd[@]}"
-- 
2.49.1