feat: harden orchestrator execution runtime

services/orchestrator/server.mjs

@@ -10,6 +10,21 @@ function positivePort(value, fallback = 8093) {
   return parsed;
 }
 
+function envFlag(value, fallback = false) {
+  const normalized = String(value ?? '').trim().toLowerCase();
+  if (!normalized) return fallback;
+  return ['1', 'true', 'yes', 'on'].includes(normalized);
+}
+
+function csvList(value) {
+  return [...new Set(
+    String(value ?? '')
+      .split(',')
+      .map((item) => item.trim().toLowerCase())
+      .filter(Boolean),
+  )];
+}
+
 export async function startOrchestratorServer({
   env = process.env,
   logger = console,
@@ -37,10 +52,25 @@ export async function startOrchestratorServer({
     checkpointProbe: checkpoint.probe,
     executorJobStore: executorJobs.store,
     executorJobProbe: executorJobs.probe,
+    executionEnabled: envFlag(env.MEMIND_ORCHESTRATOR_EXECUTION_ENABLED, false),
+    enabledExecutors: csvList(env.MEMIND_ORCHESTRATOR_ENABLED_EXECUTORS),
+    admissionConfig: {
+      tenantAllowlist: csvList(env.MEMIND_ORCHESTRATOR_TENANT_ALLOWLIST),
+      userAllowlist: csvList(env.MEMIND_ORCHESTRATOR_USER_ALLOWLIST),
+      workspaceKindAllowlist: csvList(
+        env.MEMIND_ORCHESTRATOR_WORKSPACE_KIND_ALLOWLIST ?? 'workspace-alias',
+      ),
+      maxGlobalActive: env.MEMIND_ORCHESTRATOR_MAX_GLOBAL_ACTIVE,
+      maxTenantActive: env.MEMIND_ORCHESTRATOR_MAX_TENANT_ACTIVE,
+      maxUserActive: env.MEMIND_ORCHESTRATOR_MAX_USER_ACTIVE,
+      maxTenantPerMinute: env.MEMIND_ORCHESTRATOR_MAX_TENANT_PER_MINUTE,
+      maxUserPerMinute: env.MEMIND_ORCHESTRATOR_MAX_USER_PER_MINUTE,
+    },
   });
   const app = createOrchestratorApp({
     runtime,
     serviceToken: env.MEMIND_ORCHESTRATOR_SERVICE_TOKEN,
+    workerToken: env.MEMIND_ORCHESTRATOR_WORKER_TOKEN,
   });
   const host = String(env.MEMIND_ORCHESTRATOR_HOST ?? '127.0.0.1').trim() || '127.0.0.1';
   const port = positivePort(env.MEMIND_ORCHESTRATOR_PORT, 8093);
@@ -99,5 +129,7 @@ if (isEntrypoint) {
 }
 
 export const orchestratorServerInternals = {
+  csvList,
+  envFlag,
   positivePort,
 };