omp-conductor 0.10.0 → 0.13.0

package/src/plugin.ts

@@ -91,6 +91,7 @@ import {
   type ProjectPolicy,
   type ReleaseRequirement,
   type ReportScope,
+  type ReportScopeChoice,
   type ResolvedGrants,
 } from "./types.ts";
 
@@ -309,7 +310,7 @@ async function askGates(
  * means silence. The cursor starts on the current setting so Enter re-affirms
  * it, the same contract every other prompt here has.
  */
-async function askReportScope(ctx: CommandContext, current: ReportScope): Promise<ReportScope> {
+async function askReportScope(ctx: CommandContext, current: ReportScopeChoice): Promise<ReportScopeChoice> {
   const options = REPORT_SCOPE_CHOICES.map((c) => ({ label: c.label, description: c.description }));
   const at = REPORT_SCOPE_CHOICES.findIndex((c) => c.scope === current);
   const picked = await ctx.ui.select("What should the orchestrator report unprompted?", options, {
@@ -793,7 +794,8 @@ const askCaps: AreaAsker = async (ctx, a) => {
   const tuneCaps = await ctx.ui.confirm(
     "Caps",
     `Defaults: ${workersDefault} workers, ` +
-      `${spendLabel}, ${DEFAULT_CAPS.workerMaxTurns} turns and ` +
+      `${spendLabel}, ${DEFAULT_CAPS.workerMaxTurns} base / ` +
+      `${DEFAULT_CAPS.workerMaxTurnsCeiling} max turns and ` +
       `${Math.round(DEFAULT_CAPS.workerWallClockMs / 60000)} min per worker, ` +
       `${DEFAULT_CAPS.maxAttemptsPerIssue} failed attempts and ` +
       `${DEFAULT_CAPS.maxContinuationsPerIssue} operational continuations per issue.${smallHostNote} Change them?`,
@@ -820,7 +822,32 @@ const askCaps: AreaAsker = async (ctx, a) => {
     "Spend ceiling per rolling day (USD) — blank = no spend cap",
     caps.dailySpendUsd !== undefined ? caps.dailySpendUsd : DEFAULT_CAPS.dailySpendUsd,
   );
-  caps.workerMaxTurns = await askNumber(ctx, "Turn ceiling per worker", caps.workerMaxTurns ?? DEFAULT_CAPS.workerMaxTurns);
+  const workerMaxTurns = await askNumber(
+    ctx,
+    "Turn ceiling per worker",
+    caps.workerMaxTurns ?? DEFAULT_CAPS.workerMaxTurns,
+  );
+  caps.workerMaxTurns = workerMaxTurns;
+  const turnCeilingFallback = Math.max(
+    workerMaxTurns,
+    caps.workerMaxTurnsCeiling ??
+      Math.min(workerMaxTurns * 2, Number.MAX_SAFE_INTEGER),
+  );
+  const workerMaxTurnsCeiling = await askNumber(
+    ctx,
+    "Maximum turn ceiling for one issue",
+    turnCeilingFallback,
+  );
+  if (workerMaxTurnsCeiling < workerMaxTurns) {
+    ctx.ui.notify(
+      `Maximum turn ceiling ${workerMaxTurnsCeiling} cannot be below the ` +
+        `${workerMaxTurns}-turn worker base — keeping ${turnCeilingFallback}.`,
+      "warning",
+    );
+    caps.workerMaxTurnsCeiling = turnCeilingFallback;
+  } else {
+    caps.workerMaxTurnsCeiling = workerMaxTurnsCeiling;
+  }
   caps.workerWallClockMs = await askNumber(
     ctx,
     "Wall-clock ceiling per worker (ms)",
@@ -898,7 +925,22 @@ const askEscalation: AreaAsker = async (ctx, a) => {
 };
 
 /** How loud the orchestrator is when nobody asked it anything. */
-const askReporting: AreaAsker = async (ctx, a) => ({ ...a, reportScope: await askReportScope(ctx, a.reportScope) });
+const askReporting: AreaAsker = async (ctx, a) => {
+  const reportScope = await askReportScope(ctx, a.reportScope);
+  if (reportScope !== "quiet") return { ...a, reportScope };
+  // `quiet` picks the explicit form, whose only free parameter is when the
+  // daily rollup happens. Blank = whenever the orchestrator composes it.
+  const at = await ctx.ui.input(
+    "Daily rollup time, 24h HH:MM (blank = whenever the orchestrator composes it):",
+    a.quietDigestAt,
+  );
+  const trimmed = at?.trim() ?? "";
+  if (trimmed !== "" && !/^([01]\d|2[0-3]):[0-5]\d$/.test(trimmed)) {
+    ctx.ui.notify(`"${trimmed}" is not a 24h HH:MM time — leaving the digest model-timed.`, "warning");
+    return { ...a, reportScope };
+  }
+  return { ...a, reportScope, ...(trimmed === "" ? {} : { quietDigestAt: trimmed }) };
+};
 
 /** The operator's own brief. Asked last in the full interview, because the
  *  question quotes the path the rest of the answers derive. */

package/src/release-policy.ts

@@ -36,11 +36,19 @@ import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
 export const RELEASE_POLICY_AUDIT_FILE = "release-policy-blocks.jsonl";
 
-export interface ReleaseBlock {
+export interface ReleaseBlockContext {
+  tool: string;
+  reason: string;
+  args: Record<string, string>;
+}
+
+export interface ReleaseBlock extends Partial<ReleaseBlockContext> {
   project: string;
   source: "worker" | "orchestrator";
   shape: ReleaseShape;
   at: string;
+  issue?: number;
+  runId?: string;
 }
 
 export type ReleaseDecision = { block: true; reason: string };
@@ -271,6 +279,32 @@ export function releaseDecision(
   return decision === undefined ? undefined : { shape, decision };
 }
 
+const RELEASE_ARG_ALLOWLIST = new Set([
+  "repo",
+  "stack",
+  "artefact",
+  "artifact",
+  "environment",
+  "tag",
+  "version",
+  "image",
+  "prUrl",
+  "branch",
+  "service",
+]);
+
+/** Keep only explicitly safe release-target strings; redact every other value. */
+export function redactReleaseArgs(input: Record<string, unknown>): Record<string, string> {
+  const redacted: Record<string, string> = {};
+  for (const [key, value] of Object.entries(input)) {
+    redacted[key] =
+      RELEASE_ARG_ALLOWLIST.has(key) && typeof value === "string"
+        ? value.slice(0, 120)
+        : "(redacted)";
+  }
+  return redacted;
+}
+
 interface ReleasePolicyPi {
   on(
     event: "tool_call",
@@ -285,14 +319,18 @@ interface ReleasePolicyPi {
 export function releasePolicyTripwire(
   grants: ResolvedGrants,
   role: SessionRole,
-  onBlocked: (shape: ReleaseShape) => void = () => {},
+  onBlocked: (shape: ReleaseShape, context: ReleaseBlockContext) => void = () => {},
 ): (pi: ReleasePolicyPi) => void {
   return (pi) => {
     pi.on("tool_call", (event) => {
       const blocked = releaseDecision(grants, role, event.toolName, event.input);
       if (blocked === undefined) return undefined;
       try {
-        onBlocked(blocked.shape);
+        onBlocked(blocked.shape, {
+          tool: event.toolName,
+          reason: blocked.decision.reason,
+          args: redactReleaseArgs(event.input),
+        });
       } catch {
         // Audit is evidence, not the gate. A full disk must not turn a deny into allow.
       }
@@ -305,11 +343,22 @@ export function recordReleaseBlock(
   project: string,
   source: ReleaseBlock["source"],
   shape: ReleaseShape,
+  details: Omit<ReleaseBlock, "project" | "source" | "shape" | "at"> = {},
   root = stateDir(),
   now = new Date(),
 ): void {
   mkdirSync(root, { recursive: true });
-  const record: ReleaseBlock = { project, source, shape, at: now.toISOString() };
+  // Redact again at the durable boundary. Callers normally pass the tripwire's
+  // already-safe context, but no alternate recorder path gets to rely on that.
+  const { args, ...attribution } = details;
+  const record: ReleaseBlock = {
+    project,
+    source,
+    shape,
+    ...attribution,
+    ...(args === undefined ? {} : { args: redactReleaseArgs(args) }),
+    at: now.toISOString(),
+  };
   appendFileSync(join(root, RELEASE_POLICY_AUDIT_FILE), `${JSON.stringify(record)}\n`, { mode: 0o600 });
 }
 
@@ -354,12 +403,23 @@ export function releaseDriftToday(
   return latest === undefined ? undefined : { count, latest };
 }
 
-export function releaseDriftDigestLine(project: string, root = stateDir(), now = new Date()): string | undefined {
+export function releaseDriftDigestLine(
+  project: string,
+  root = stateDir(),
+  now = new Date(),
+): string | undefined {
   const drift = releaseDriftToday(project, root, now);
   if (drift === undefined) return undefined;
+  const latest = drift.latest;
+  const attribution = [
+    `${latest.source} ${latest.shape} at ${latest.at}`,
+    ...(latest.issue === undefined ? [] : [`issue #${latest.issue}`]),
+    ...(latest.runId === undefined ? [] : [`run ${latest.runId}`]),
+    ...(latest.tool === undefined ? [] : [`tool ${latest.tool}`]),
+  ].join(", ");
   return (
     `Release-policy drift today: ${drift.count} release/deploy tool call(s) were blocked ` +
-    `(latest: ${drift.latest.source} ${drift.latest.shape} at ${drift.latest.at}). ` +
+    `(latest: ${attribution}). ` +
     "Include this divergence from releasePolicy=none in today's digest."
   );
 }

package/src/reports.ts

@@ -37,6 +37,7 @@
  */
 
 import { readTelegramToken, sendTelegram, TelegramSendError } from "./escalate.ts";
+import { localDayKey } from "./digest-schedule.ts";
 import type { Escalation, ProjectConfig, ReportRecord, Store } from "./types.ts";
 
 /**
@@ -120,13 +121,11 @@ export interface ReportOutboxDeps {
 /**
  * Local day, matching how a human reads "one daily digest" and how the
  * dispatcher's own `startOfToday` reads "today". A UTC key would roll the
- * digest over mid-evening for anyone west of Greenwich.
+ * digest over mid-evening for anyone west of Greenwich; the zone is the
+ * project's `reporting.digest.timezone` when set, else the host zone (#229).
  */
-export function digestDedupeKey(at: number): string {
-  const d = new Date(at);
-  const month = `${d.getMonth() + 1}`.padStart(2, "0");
-  const day = `${d.getDate()}`.padStart(2, "0");
-  return `digest:${d.getFullYear()}-${month}-${day}`;
+export function digestDedupeKey(at: number, timezone?: string): string {
+  return `digest:${localDayKey(at, timezone)}`;
 }
 
 /** Exponential, capped. `attempts` is attempts *started*, so the first failure

package/src/session-host.ts

@@ -9,19 +9,20 @@
  * fleet, and what makes a kill a real kill.
  *
  * This file is the far side: it loads the harness, runs the real session, and
- * speaks a five-verb protocol back over a unix socket to the
+ * speaks a small protocol back over a unix socket to the
  * {@link AgentSessionLike} proxy in `omp.ts`. It holds no conductor state, opens
  * no database, and reads no config — everything it needs arrives in
  * {@link SessionHostSpec}, so the child's inputs are data a caller can see
  * rather than ambient state it inherits.
  *
- * The protocol is deliberately tiny. `AgentSessionLike` has five members, so
- * there are five things to carry, and every one of them is data.
+ * The protocol deliberately mirrors the narrow session surface and carries
+ * only data.
  */
 
 import { connect } from "node:net";
 
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
+import type { ReleaseBlockContext } from "./release-policy.ts";
 
 import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
@@ -53,6 +54,7 @@ export interface SessionHostSpec {
 /** Parent → child. */
 export type ParentToHost =
   | { t: "prompt"; id: number; text: string; opts?: Record<string, unknown> }
+  | { t: "park"; id: number }
   | { t: "abort" }
   | { t: "dispose" };
 
@@ -63,7 +65,8 @@ export type HostToParent =
   | { t: "event"; event: unknown }
   | { t: "session-file"; path: string }
   | { t: "prompt-result"; id: number; ok: boolean; error?: string }
-  | { t: "release-blocked"; shape: ReleaseShape };
+  | { t: "park-result"; id: number; ok: boolean; error?: string }
+  | ({ t: "release-blocked"; shape: ReleaseShape } & ReleaseBlockContext);
 
 /**
  * Depth at which a harness event stops being copied for the wire.
@@ -184,8 +187,8 @@ export async function runSessionHost(
       // The release audit lives in the daemon's state directory, which this
       // process may not be able to write and must not be trusted to. It
       // becomes a message; the parent performs the durable write.
-      onReleaseBlocked: (shape) => {
-        send({ t: "release-blocked", shape });
+      onReleaseBlocked: (shape, context) => {
+        send({ t: "release-blocked", shape, ...context });
       },
     });
   } catch (err) {
@@ -240,6 +243,20 @@ export async function runSessionHost(
         );
         continue;
       }
+      if (message.t === "park") {
+        const id = message.id;
+        void live.park().then(
+          () => send({ t: "park-result", id, ok: true }),
+          (err: unknown) =>
+            send({
+              t: "park-result",
+              id,
+              ok: false,
+              error: err instanceof Error ? err.message : String(err),
+            }),
+        );
+        continue;
+      }
       if (message.t === "abort") {
         live.abort();
         continue;

package/src/setup.ts

@@ -40,6 +40,7 @@ import {
   resolveCaps,
   resolvePolicy,
   resolveReleaseGrants,
+  SCOPE_PRESETS,
   stateDir,
 } from "./config.ts";
 import { graphProjectPath, graphRepos } from "./graph.ts";
@@ -61,6 +62,8 @@ import {
   type ProjectPolicy,
   type ReleaseRequirement,
   type ReportScope,
+  type ReportScopeChoice,
+  type ReportingPolicy,
   type RepoTarget,
   type ResolvedGrants,
 } from "./types.ts";
@@ -88,7 +91,9 @@ export interface SetupAnswers {
   telegramChatId?: string;
   fallbackToIssueComment: boolean;
   /** How loud the supervising orchestrator session should be. */
-  reportScope: ReportScope;
+  reportScope: ReportScopeChoice;
+  /** The daily digest wall-clock (`HH:MM`) for the `quiet` choice, blank = model-timed. */
+  quietDigestAt?: string;
   /**
    * Mechanical gate for release/deploy-shaped tool calls, per shape. Always
    * complete: the wizard asks about every shape, so an answer object can never
@@ -175,7 +180,11 @@ export const SETUP_DEFAULTS = {
  * brief spells the same three options out — so "material" cannot come to mean
  * one thing in the dialog and another in the session that has to honour it.
  */
-export const REPORT_SCOPE_CHOICES: readonly { scope: ReportScope; label: string; description: string }[] = [
+export const REPORT_SCOPE_CHOICES: readonly {
+  scope: ReportScopeChoice;
+  label: string;
+  description: string;
+}[] = [
   {
     scope: "decisions",
     label: "Decisions interrupt, rest batches",
@@ -192,6 +201,12 @@ export const REPORT_SCOPE_CHOICES: readonly { scope: ReportScope; label: string;
     label: "Escalations only",
     description: "escalations when they happen, plus one daily digest — silent otherwise",
   },
+  {
+    scope: "quiet",
+    label: "Quiet (scheduled digest)",
+    description:
+      "interrupt only for escalations, fleet stops and confirmed failures; one daily rollup on your schedule",
+  },
 ];
 
 /**
@@ -204,7 +219,7 @@ export const REPORT_SCOPE_CHOICES: readonly { scope: ReportScope; label: string;
  * answers "an operator being asked the question for the first time", where the
  * recommended answer is the useful one — and they see it, and confirm it.
  */
-export const SETUP_DEFAULT_REPORT_SCOPE: ReportScope = REPORT_SCOPE_CHOICES[0]!.scope;
+export const SETUP_DEFAULT_REPORT_SCOPE: ReportScopeChoice = REPORT_SCOPE_CHOICES[0]!.scope;
 
 /**
  * What each precondition value means to the operator being asked about it, in
@@ -236,6 +251,7 @@ export const RELEASE_REQUIREMENT_CHOICES: { readonly [K in ReleaseRequirement]:
   "runs-settled": "every run this release covers actually merged, not merely reached a green PR",
   "no-open-prs": "no pull request is still open against the branch being released",
   "queue-drained": "nothing still carries the queue label",
+  "base-branch-green": "the newest observed post-merge base-branch workflows are green",
   "epic-children-closed": "the epic this release closes has no open children",
 };
 
@@ -560,8 +576,24 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // and a release require without anyone having to know a default (#129).
     policy: clonePolicy(a.policy),
     // Written out even when it is the default, so an operator amending the
-    // volume has a line in the file to point at.
-    reporting: { scope: a.reportScope },
+    // volume has a line in the file to point at. A `scope` answer is
+    // materialised as its preset policy (with `scopePreset` set) so the file
+    // and the prompt agree with no migration rule; `quiet` is the explicit
+    // form — a curated interrupt list and a scheduled digest (#229).
+    reporting:
+      a.reportScope === "quiet"
+        ? {
+            interruptOn: ["tier2", "fleet-stopped", "confirmed-failure"],
+            digest: {
+              cadence: "daily",
+              ...(a.quietDigestAt !== undefined && a.quietDigestAt.length > 0 ? { at: a.quietDigestAt } : {}),
+            },
+          }
+        : {
+            interruptOn: [...(SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).interruptOn],
+            digest: { ...(SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).digest },
+            scopePreset: (SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).scopePreset,
+          },
     // Both under the state dir so one `rm -rf ~/.omp/conductor` is a complete
     // uninstall, and neither can land in a repo the daemon then tries to commit.
     workspaceRoot: defaultWorkspaceRoot(),
@@ -667,7 +699,7 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     releaseGrants: resolveReleaseGrants(p),
     policy: resolvePolicy(p),
     orchestratorMode: p.escalation.orchestrator,
-    reportScope: p.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
+    reportScope: p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
   };
 
@@ -704,7 +736,7 @@ function briefVarsForProject(p: ProjectConfig): Record<string, string> {
     QUEUE_LABEL: p.queueLabel,
     RELEASES_DEFAULT: RELEASES_DEFAULTS[`${p.authority.merge}/${p.authority.release}`],
     MERGE_DUTY: MERGE_DUTY[p.authority.merge],
-    REPORT_SCOPE: p.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
+    REPORT_SCOPE: p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
     POLICY_SOURCE: policySourceLine(p),
   };
 }
@@ -1160,14 +1192,15 @@ export const AMEND_AREAS: {
     // The model rides with the caps because it is the other per-worker knob, and
     // an area no menu offers is a setting only a full re-interview can reach.
     name: "caps & worker model",
-    asks: "concurrency, spend, turns, wall clock, failed attempts, continuations — then the worker model",
+    asks: "concurrency, spend, turn base and extension ceiling, wall clock, failed attempts, continuations — then the worker model",
     describe: (p) => {
       const c = resolveCaps(p, DEFAULT_CAPS);
       const answered = Object.keys(p.caps).length > 0;
       const spend =
         c.dailySpendUsd === null ? "no spend cap" : `$${c.dailySpendUsd}/day`;
       return (
-        `${c.maxConcurrentWorkers} workers (${c.maxConcurrentWorkersPerRepo}/repo), ${c.workerMaxTurns} turns, ` +
+        `${c.maxConcurrentWorkers} workers (${c.maxConcurrentWorkersPerRepo}/repo), ` +
+        `${c.workerMaxTurns} base/${c.workerMaxTurnsCeiling} max turns, ` +
         `${Math.round(c.workerWallClockMs / 60000)}m, ${spend}, ` +
         `${c.maxAttemptsPerIssue} failed attempt${c.maxAttemptsPerIssue === 1 ? "" : "s"}, ` +
         `${c.maxContinuationsPerIssue} continuation${c.maxContinuationsPerIssue === 1 ? "" : "s"}` +
@@ -1234,7 +1267,7 @@ export const AMEND_AREAS: {
     name: "reporting scope",
     asks: "how much the orchestrator says unprompted",
     describe: (p) => {
-      const scope = p.reporting?.scope ?? DEFAULT_REPORT_SCOPE;
+      const scope = p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE;
       const choice = REPORT_SCOPE_CHOICES.find((c) => c.scope === scope);
       return `${scope} — ${choice?.description ?? "unknown scope"}`;
     },