feat(orb-jobs-agent): allow local jobs execution

[pophilpo]

This PR will enable us to test new jobs for orb-jobs-agent easily.

Before this PR, in order to make a true e2e test, we had to make a PR in the backend repo, that will allow us to send the new job from fleet-cmdr.

This introduces some branching in the code, but does not affect the production orb-jobs-agent as a service logic.

With new changes introduced here, we will be able to build the orb-jobs-agent binary, move it to the orb and run a single job.

./orb-jobs-agent --run-job "read_file /usr/persistent/versions.json" # refer to specific handler info on the command format

It will mimic the whole job execution flow, with adding a job to a queue, requesting that job for execution, sending JobExecutionUpdates all that stuff.

Here's an example output for the command above:

2026-02-25T13:24:00.370186Z  INFO orb_jobs_agent: Starting jobs agent: Args { config: None, orb_id: None, orb_platform: None, orb_token: None, relay_host: None, relay_namespace: Some("jobs"), target_service_id: Some("job-server"), dbus_addr: "unix:path=/tmp/worldcoin_bus_socket", run_job: Some("read_file /usr/persistent/versions.json") }
2026-02-25T13:24:00.372800Z  INFO zenoh::net::runtime: Using ZID: fcd0c45a5aeb96f71df9921d28ff777
2026-02-25T13:24:00.374799Z  INFO orb_jobs_agent::job_system::client: Successfully requested additional job for parallel execution
2026-02-25T13:24:00.374822Z  INFO orb_jobs_agent::job_system::handler: Successfully requested initial job
2026-02-25T13:24:00.374832Z  INFO orb_jobs_agent::job_system::client: received local JobExecution job_id=local-job job_execution_id=local-job-execution job_document=read_file /usr/persistent/versions.json should_cancel=false
2026-02-25T13:24:00.374845Z  INFO orb_jobs_agent::job_system::handler: Processing job job_execution_id=local-job-execution job_id=local-job
2026-02-25T13:24:00.374904Z  INFO orb_jobs_agent::job_system::handler: executing job job_execution_id="local-job-execution" command="read_file" args="/usr/persistent/versions.json"
2026-02-25T13:24:00.374970Z  INFO handler: orb_jobs_agent::handlers::read_file: Reading file: /usr/persistent/versions.json for job local-job-execution
{"job_id":"local-job","job_execution_id":"local-job-execution","status":3,"std_out":"{\"releases\":{\"slot_a\":\"to-0.0.0-21e98c2-diamond-dev\",\"slot_b\":\"0.0.0-21e98c2-diamond-dev\"},\"slot_a\":{\"jetson\":{\"boot\":\"idk2\",\"sec_mcu\":\"idk2\",\"main_mcu\":\"idk2\",\"system\":\"idk2\"}},\"slot_b\":{\"jetson\":{\"main_mcu\":\"idk2\",\"boot\":\"idk2\",\"sec_mcu\":\"idk2\",\"system\":\"idk2\"}},\"singles\":{\"jetson\":{\"capsule\":\"idk2\"}}}","std_err":""}
2026-02-25T13:24:00.375142Z  INFO orb_jobs_agent::job_system::handler: Job completed job_execution_id=local-job-execution job_id=local-job status=Succeeded
2026-02-25T13:24:00.375163Z  INFO orb_jobs_agent::job_system::client: Successfully requested additional job for parallel execution
2026-02-25T13:24:00.375173Z  INFO orb_jobs_agent::job_system::handler: Requested additional job after job completion job_execution_id=local-job-execution
2026-02-25T13:24:00.375150Z  INFO orb_jobs_agent::job_system::handler: Relay service shutdown detected
2026-02-25T13:24:00.375263Z  INFO zenoh::api::session: close session zid=fcd0c45a5aeb96f71df9921d28ff777
2026-02-25T13:24:00.376877Z  INFO orb_jobs_agent: Shutting down jobs agent completed

Tested on the orb (both local and remote execution)

• yes (diamond only)

[AlexKaravaev]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3eb7fae74d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[semgrep-code-worldcoin]

Semgrep found 6 tainted-path findings:

• orb-connd/src/reporters/net_stats.rs
  • L63 - Triage
• orb-connd/src/reporters/active_connections.rs
  • L388 - Triage
  • L406 - Triage
• orb-backend-status/src/backend/uptime.rs
  • L9 - Triage
• hil/src/relay.rs
  • L95 - Triage
  • L122 - Triage

The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>orb-connd/src/reporters/net_stats.rs</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/worldcoin/orb-software/blob/2a5730dcea964e300b22bdc81955961945d8c371/orb-connd/src/reporters/net_stats.rs#L62 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 62] sysfs</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/worldcoin/orb-software/blob/2a5730dcea964e300b22bdc81955961945d8c371/orb-connd/src/reporters/net_stats.rs#L62 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 62] ifaces_dir</a>"]
        end
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/worldcoin/orb-software/blob/2a5730dcea964e300b22bdc81955961945d8c371/orb-connd/src/reporters/net_stats.rs#L63 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 63] ifaces_dir</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading