omp-conductor 0.12.0 → 0.13.0

package/src/verbs/server.ts

@@ -265,6 +265,10 @@ export interface ReleaseFacts {
   openPrs: number;
   /** Queue depth, or `undefined` when the tracker could not be read. */
   queueDepth: number | undefined;
+  /** Newest observed verdict for the released routed repository. */
+  baseCheck?: RunRecord["baseCheck"];
+  /** Evidence attached to a newest red verdict. */
+  redBase?: string;
 }
 
 export function releaseRequirementRefusal(
@@ -286,6 +290,19 @@ export function releaseRequirementRefusal(
         return `policy.release.requires includes queue-drained and ${facts.queueDepth} issue(s) are still queued`;
       }
     }
+    if (requirement === "base-branch-green") {
+      if (facts.baseCheck === "green") continue;
+      if (facts.baseCheck === "pending") {
+        return "policy.release.requires includes base-branch-green and the newest merge's base workflows are still pending";
+      }
+      if (facts.baseCheck === "red" || facts.baseCheck === "red-preexisting") {
+        return (
+          "policy.release.requires includes base-branch-green and the newest observed base branch is red" +
+          (facts.redBase === undefined ? "" : `: ${facts.redBase}`)
+        );
+      }
+      return "policy.release.requires includes base-branch-green and no green base-branch verdict is available; refusing rather than assuming the base is healthy";
+    }
     if (requirement === "epic-children-closed") {
       return "policy.release.requires includes epic-children-closed, which nothing in a release request names an epic for. The daemon cannot settle it, so it refuses: take the requirement off this project's policy, or cut this release by hand.";
     }
@@ -423,19 +440,32 @@ async function decide(deps: VerbDeps, channel: VerbChannel, raw: unknown): Promi
     }
   }
 
-  // 4. Stop always wins, and is re-read here rather than remembered. Reads are
-  //    exempt: a run finishing its report during a `hold` still has to be able
-  //    to say what it saw, and refusing that would only make it guess. A run
-  //    admitted *before* the pause may finish its in-flight mutations — pause
-  //    stops new claims, not the work already running (#174) — so only a call
-  //    whose run started at or after the pause (or an orchestrator's call, with
-  //    no run row at all) is refused.
-  const stopped = spec.mutating ? deps.fleetStop() : undefined;
+  // 4. Stop always wins for work-starting mutations, and is re-read here
+  //    rather than remembered. Reads are exempt. A run admitted before the
+  //    pause may finish its own mutations (#174). Orchestrator completion
+  //    verbs resolve their target run inside the handler, where they can prove
+  //    that run also predates the pause (#251). Release remains available:
+  //    its authority, grant, and runs-settled gates still fail closed below.
+  const orchestratorCompletion =
+    channel.kind === "orchestrator" &&
+    (verb === "conductor_pr_merge" ||
+      verb === "conductor_pr_update_branch" ||
+      verb === "conductor_pr_update" ||
+      verb === "conductor_label");
+  const stopped =
+    spec.mutating && verb !== "conductor_release" && !orchestratorCompletion
+      ? deps.fleetStop()
+      : undefined;
   if (stopped !== undefined) {
     const at = deps.pausedAt();
     const admittedBeforePause = run !== undefined && at !== undefined && run.startedAt < at;
     if (!admittedBeforePause) {
-      return refuse("fleet-paused", `refused: ${stopped}. The pause stops new claims and new mutations; a run admitted before the pause may finish.`);
+      return refuse(
+        "fleet-paused",
+        `refused: ${stopped}. The pause refuses new claims and work-starting mutations. ` +
+          "Completion verbs for runs admitted before the pause (conductor_pr_merge, conductor_pr_update_branch, " +
+          "conductor_pr_update, conductor_label) and conductor_release remain available.",
+      );
     }
   }
 
@@ -599,7 +629,7 @@ async function prCreateVerb(
  * How far back to look is the recent-history cutoff `status` already uses: a
  * pull request older than that is not one an orchestrator is mid-flight on.
  */
-const PR_LOOKUP_WINDOW_MS = 30 * 24 * 60 * 60_000;
+export const PR_LOOKUP_WINDOW_MS = 30 * 24 * 60 * 60_000;
 
 function runForPr(deps: VerbDeps, project: string, prUrl: string): RunRecord | undefined {
   return deps.store
@@ -607,6 +637,31 @@ function runForPr(deps: VerbDeps, project: string, prUrl: string): RunRecord | u
     .find((candidate) => candidate.prUrl === prUrl);
 }
 
+/** Refuse an orchestrator completion mutation that cannot prove a pre-pause run. */
+function orchestratorPauseRefusal(
+  deps: VerbDeps,
+  channel: VerbChannel,
+  target: RunRecord | undefined,
+  refuse: Refuse,
+): Verdict | undefined {
+  if (channel.kind !== "orchestrator") return undefined;
+  const stopped = deps.fleetStop();
+  if (stopped === undefined) return undefined;
+  const at = deps.pausedAt();
+  if (target !== undefined && at !== undefined && target.startedAt < at) return undefined;
+  const why =
+    target === undefined
+      ? "this issue has no recorded run admitted before it."
+      : at === undefined
+        ? "the pause timestamp cannot prove when this run started."
+        : "this run started after it.";
+  return refuse(
+    "fleet-paused",
+    `refused: ${stopped}. Under pause, this verb applies only to runs admitted before the pause; ${why}`,
+    target?.issue,
+  );
+}
+
 async function prUpdateBranchVerb(
   deps: VerbDeps,
   project: ProjectConfig,
@@ -638,6 +693,9 @@ async function prUpdateBranchVerb(
     }
   }
 
+  const paused = orchestratorPauseRefusal(deps, channel, target, refuse);
+  if (paused !== undefined) return paused;
+
   let state: PrState | undefined;
   try {
     state = await deps.tracker.prState(prUrl);
@@ -691,6 +749,9 @@ async function prMergeVerb(
     return refuse("pr-not-this-run", `refused: ${prUrl} is not a pull request any run in ${project.name} opened.`);
   }
 
+  const paused = orchestratorPauseRefusal(deps, channel, target, refuse);
+  if (paused !== undefined) return paused;
+
   // Taken before any network call, so two concurrent callers contend here
   // rather than both spending a `gh` round trip and racing at the merge.
   const holderId = randomUUID();
@@ -814,6 +875,14 @@ async function labelVerb(
     );
   }
 
+  const paused = orchestratorPauseRefusal(
+    deps,
+    channel,
+    deps.store.latestRun(project.name, ref.issue),
+    refuse,
+  );
+  if (paused !== undefined) return paused;
+
   const label = String(args["label"]);
   const vocabulary = labelVocabulary(project);
   if (vocabulary.lifecycle.includes(label)) {
@@ -908,10 +977,19 @@ async function releaseVerb(
       queueDepth = undefined;
     }
   }
+  const wantsBase = policy.release.requires.includes("base-branch-green");
+  const latestBase = wantsBase
+    ? deps.store.latestBaseChecks(project.name, 0).find((run) => run.repo === repoName)
+    : undefined;
+  const redBase = latestBase?.settlementFlags?.find(
+    (flag) => flag.kind === "base-branch-red",
+  )?.detail;
   const unmet = releaseRequirementRefusal(policy.release.requires, {
     unsettledRuns: active.length,
     openPrs: active.filter((r) => r.prUrl !== undefined).length,
     queueDepth,
+    ...(latestBase?.baseCheck === undefined ? {} : { baseCheck: latestBase.baseCheck }),
+    ...(redBase === undefined ? {} : { redBase }),
   });
   if (unmet !== undefined) return refuse("release-not-granted", `refused: ${unmet}`);
 
@@ -991,10 +1069,11 @@ async function prStatusVerb(
     issue = target.issue;
   }
 
-  const headSha = String(args["headSha"]);
+  const askedHead = args["headSha"];
+  const expectedHead = typeof askedHead === "string" ? askedHead : undefined;
   let verification: PrVerification | undefined;
   try {
-    verification = await deps.tracker.verifyPr(prUrl, headSha);
+    verification = await deps.tracker.verifyPr(prUrl, expectedHead);
   } catch (err) {
     verification = undefined;
     deps.log(`verb pr_status could not read ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
@@ -1007,7 +1086,7 @@ async function prStatusVerb(
       issue,
     );
   }
-  return allow(`${prUrl} at ${headSha}: ${verification.status} — ${verification.reason}`, undefined, issue);
+  return allow(`${prUrl} at ${verification.headSha}: ${verification.status} — ${verification.reason}`, undefined, issue);
 }
 
 /**
@@ -1054,6 +1133,9 @@ async function prUpdateVerb(
     if (target === undefined) {
       return refuse("pr-not-this-run", `refused: ${asked} is not a pull request any run in ${project.name} opened.`);
     }
+
+    const paused = orchestratorPauseRefusal(deps, channel, target, refuse);
+    if (paused !== undefined) return paused;
     prUrl = asked;
     issue = target.issue;
   }

package/src/worker.ts

@@ -11,6 +11,7 @@
  */
 
 import { createSession, disposeSession } from "./omp.ts";
+import type { ReleaseBlockContext } from "./release-policy.ts";
 import type { Caps, ReleaseShape, ResolvedGrants, RunState } from "./types.ts";
 
 /** Structured evidence fields from the worker's final report. */
@@ -47,6 +48,9 @@ export interface WorkerPauseControl {
   /** Returns a parked session to work with a continuation prompt. Throws
    * when the phase is not `paused`. */
   resume(): void;
+  /** Terminally ends this run for an operator-supplied reason. The run is
+   * recorded as an administrative kill and cannot be resumed. */
+  stop(reason: string): void;
 }
 
 /** What a resumed session is told. One literal so tests can pin it. */
@@ -78,7 +82,7 @@ export interface WorkerOpts {
    */
   releaseGrants?: ResolvedGrants;
   /** Durable audit sink for rejected release/deploy calls. */
-  onReleaseBlocked?: (shape: ReleaseShape) => void;
+  onReleaseBlocked?: (shape: ReleaseShape, context: ReleaseBlockContext) => void;
   /** The child's pid, the instant it exists. See {@link VerbListener.bindPid}. */
   onSpawn?: (pid: number) => void;
   /** Control socket for that child, beside the run's own session directory. */
@@ -135,6 +139,8 @@ export interface WorkerResult {
   spendUsd: number;
   report: string;
   killedBy?: KilledBy;
+  /** Present only when an operator terminally stopped this run. */
+  stoppedReason?: string;
   /**
    * Transcript the session actually opened, absent if it opened none. Recorded
    * per run because it is the only readable evidence left once the worktree is
@@ -280,6 +286,7 @@ export async function runWorker(
   // merged (#217).
   let claim: { prUrl: string; headSha: string } | undefined;
   let killedBy: KilledBy | undefined;
+  let stoppedReason: string | undefined;
   // Canceler for the armed wall clock; invoked on every exit path below.
   let cancelWallClock: (() => void) | undefined;
   let wallClockRemainingMs = workerWallClockMs;
@@ -309,7 +316,7 @@ export async function runWorker(
   };
 
   const kill = (by: KilledBy) => {
-    if (killedBy !== undefined) return;
+    if (killedBy !== undefined || stoppedReason !== undefined) return;
     killedBy = by;
     o.onKilled?.(by);
     clearWallClock();
@@ -331,7 +338,7 @@ export async function runWorker(
       resumeWaiter = undefined;
       pauseRequested = Promise.withResolvers<void>();
     }
-    return killedBy !== undefined || done ? undefined : prompt;
+    return killedBy !== undefined || stoppedReason !== undefined || done ? undefined : prompt;
   };
 
   o.onPauseControl?.({
@@ -388,6 +395,16 @@ export async function runWorker(
       armWallClock();
       resumeWaiter?.resolve(RESUME_PROMPT);
     },
+    stop: (reason) => {
+      if (killedBy !== undefined || done) {
+        throw new Error("the run is settling; nothing left to stop");
+      }
+      stoppedReason = reason;
+      clearWallClock();
+      done = true;
+      settle();
+      session.abort();
+    },
   });
 
   session.on("turn_start", () => {
@@ -464,7 +481,7 @@ export async function runWorker(
       } catch (cause) {
         // Our own abort surfaces here on some paths: a cap kill (existing
         // behavior) or an operator park (new). Anything else is a real failure.
-        if (killedBy === undefined && resumeWaiter === undefined) throw cause;
+        if (killedBy === undefined && stoppedReason === undefined && resumeWaiter === undefined) throw cause;
       }
       next = undefined;
       if (killedBy !== undefined) break;
@@ -483,7 +500,7 @@ export async function runWorker(
     }
   } catch (cause) {
     // Our own abort surfaces here on some paths; that is a kill, not a crash.
-    if (killedBy === undefined) {
+    if (killedBy === undefined && stoppedReason === undefined) {
       const detail = cause instanceof Error ? cause.message : String(cause);
       return withSessionFacts({
         state: "failed",
@@ -504,6 +521,17 @@ export async function runWorker(
     }
   }
 
+  if (stoppedReason !== undefined) {
+    return withSessionFacts({
+      state: "stopped",
+      turns,
+      spendUsd,
+      report,
+      stoppedReason,
+      ...(claim === undefined ? {} : { prUrl: claim.prUrl, headSha: claim.headSha }),
+    });
+  }
+
   if (killedBy !== undefined) {
     // The PR and head are facts the session already established, so they
     // survive the kill. Without them `shouldContinueAfterTurnsCap` sees no

package/src/worktree.ts

@@ -317,6 +317,11 @@ async function ensureMirrorUnlocked(repo: RepoTarget, mirrorRoot: string): Promi
     throw err;
   }
   await configureMirror(mirrorPath);
+  // `clone --mirror` writes upstream heads under `refs/heads/*`; the safe
+  // normal-clone refspec above uses `refs/remotes/origin/*`. Populate that
+  // namespace before returning so first-use callers see the same fresh mirror
+  // shape as every later refresh.
+  await refreshMirror(mirrorPath);
   return mirrorPath;
 }