[qiragu]

Closes #528.

What changed

• deleteProject in src/orca.js sends orca project setup-delete --setup <id> --force. Its only caller is obk retire --bot. That command checks first that every tab in the project is one the book names. Then it closes those tabs and waits until Orca no longer lists them. Only then does it delete.
• When Orca refuses --force with invalid_argument "Unknown flag --force", the kit sends the plain delete. Orca 1.4.223 gives this refusal. Every other refusal is reported as before, and the kit does not delete some other way.
• docs/tech-notes.md records the guard and the 1.4.223 refusal. Item 12 in "Live checks still owed" is new.

Orca's guard (boundary 1, read in Orca's code at cb69d52455, no build or run)

• Without --force, the new CLI sends force: false. Then the runtime refuses a repo-backed project that has terminals not known to have exited, or saved metadata for any of its workspaces. The refusal is runtime_error: "This project has … Re-run with --force to remove it anyway."
• A project with a workspace keeps that metadata after its tabs close. So the new Orca refuses every plain delete of a bot's project, not only one with a tab open.
• --force skips the whole check. A client that sends no force key is not checked.
• No tag carries the commit yet. git tag --contains cb69d52455 gives nothing, and v1.4.224 is the newest tag.

Orca 1.4.223 (boundary 3)

• Read in its code: the CLI checks flags before it calls the runtime (src/cli/args.ts), and --force is not an allowed flag of setup-delete.
• Seen live, 2026-10-10 11:05 EDT, on this machine's Orca 1.4.223, against a setup id that does not exist: orca project setup-delete --setup obk-probe-528-no-such-setup --force --json gave ok: false, code: invalid_argument, message Unknown flag --force for command: project setup-delete, and runtimeId: null. Nothing was deleted. The architect was told first, and ~/.claude.json and ~/.codex/config.toml were compared after the probe.

Tests (boundary 4)

A separate subagent wrote the tests from the issue and the public interface. I did not change them.

• test/helpers/fake-orca.js has two new state keys: deleteGuard (the new Orca) and forceUnknown (1.4.223). With neither key, the fake behaves as before.
• test/retire-orca-guard.test.js:
  • RG1: retire finishes on 3 kinds of guard refusal and on 1.4.223.
  • RG2: every delete is of the bot's own project and comes after the closes.
  • RG3: a different refusal is reported in Orca's words, and the bot stays.
• test/orca-fake.test.js: three new tests check the fake's new keys.
• Red before the change: 6 of 11 failed, with "Orca refused project setup-delete --setup repo_5: This project has saved details for 1 workspace. … Re-run with --force to remove it anyway." The 1.4.223 tests and RG3 passed, because they describe today's behaviour.
• Green after the change, run one file at a time: retire-orca-guard 11/11, retire 33/33. More results follow in a comment.
• Hand mutation, in a scratch copy: with the fallback removed, both 1.4.223 tests fail. The test author also tried a fallback on any refusal, and RG3 caught it.

Not done here

• A live check on the first Orca release with the guard. It is owed before the fleet takes that release (tech notes, section 5, item 12).
• The system tests clean up their throwaway projects with a plain setup-delete. On the new release that cleanup will be refused. This is outside the kit's own removal and outside this issue. I will tell the architect.

Tier: 0 — obk retire keeps removing a bot's Orca project on the Orca release that guards setup-delete

🤖 Generated with Claude Code

[qiragu]

For the follow-up on the system tests' cleanup (the architect's request): deleteProject in src/orca.js is already exported, with the --force and the 1.4.223 fallback in it. No change in this PR is needed for reuse.

The system tests already import from src/orca.js (for example test/system/restart.test.js:120). Their cleanup has the same order that obk retire has: guard.closeOwnAt(homes) closes only the test's own tabs, and a home with a foreign tab is skipped. So in each test, the follow-up can change orca(['project', 'setup-delete', '--setup', setup.id]) to deleteProject(setup.id).

[qiragu]

No findings against issue #528 or the changed code.

Reviewed 07db61e3370877266ca46853034c99c7092f9714...7f692550bb1127828ab6eda5692574fb6e6049d5: five changed files.

Checked the sole deleteProject caller in retireBot: the unbooked-tab check precedes closeTabs, which confirms the closes before deletion. The fallback checks both Orca's code and its own message. Other refusals propagate.

Read Orca at cb69d52455 and v1.4.223, without a build or run. The guard, flag validation, fake behavior, and new technical notes agree for the kit's local folder projects. The captured red log has six expected guard failures and five passes. All three test files named in the author's handoff are present.

Local checks used Node v26.11.1 and a hard 1800-second process limit:

• node --test test/retire-orca-guard.test.js: 11 passes, no failures.
• node --test test/orca-fake.test.js: 57 passes, no failures.
• node --test test/retire.test.js: 25 passes and eight failures inside the sandbox. Each failure concerns an unset conversation ID. The sandbox refuses the ps call that identifies the test harness.
• Repeated RS3, RS6, RB2, all three RB12 cases, RB13, and RT4 outside the sandbox: eight passes, no failures. The source and assertions stayed unchanged. The developer's saved full retirement log also has 33 passes.
• git diff --check: no output. The review clone remains clean.

Set aside: the fake's empty error data differs from the old CLI. The kit reads only the code and message.

CI currently has seven successful test shards and two active shards. AssuredLoop and CodeQL passed. The merge must wait for the remaining checks.

I did not load or run test/system/. The guarded-release live check remains due before the fleet takes that release, as technical notes item 12 states.

VERDICT: APPROVED