omp-conductor 0.15.10 → 0.15.12

package/src/orchestrator-tick.ts

@@ -63,22 +63,27 @@ import {
   reportScopeFromPolicy,
   refreshComposedBriefForProject,
 } from "./setup.ts";
+import { sharedPolicyPath } from "./brief-upgrade.ts";
 import {
   recordReleaseBlock,
   redactReleaseArgs,
+  releaseBlockedInvocation,
   releaseDriftDigestLine,
   releaseRefusal,
-  releaseShapeFromTool,
+  releaseToolMatch,
   type ReleaseDecision,
 } from "./release-policy.ts";
 import {
   DEFAULT_REPORT_POLICY,
   DEFAULT_REPORT_SCOPE,
   DENIED_RELEASE_GRANTS,
+  INTERRUPT_CATEGORIES,
   type DispatchSummary,
   type DigestBacklog,
   type FrictionSignal,
   type HeldNotice,
+  type InterruptCategory,
+  type IntakeItem,
   type MaterialEvent,
   type ReportScopeChoice,
   type ReportingPolicy,
@@ -86,9 +91,22 @@ import {
   type Store,
 } from "./types.ts";
 import { formatDecisionDigest } from "./decisions.ts";
+import {
+  ASK_TOOL,
+  askParameterSchema,
+  DEFAULT_ASK_TIMEOUT_SECONDS,
+  MAX_ASK_TIMEOUT_SECONDS,
+  MIN_ASK_TIMEOUT_SECONDS,
+  parseAskRequest,
+  performAsk,
+  type AskResult,
+} from "./ask.ts";
+import { deliverOperatorMessage } from "./reports.ts";
 import type { RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
 import { digestDue, localDayKey } from "./digest-schedule.ts";
+import { heldNoticeId } from "./notices.ts";
+import { isActiveArmProof } from "./arm-challenge.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -96,6 +114,24 @@ export const TICK_CONFIG_FILE = ".conductor-tick.json";
 /** Namespaced so a renderer or a session-log reader can pick ticks out. */
 export const TICK_CUSTOM_TYPE = "omp-conductor.tick";
 
+/**
+ * A deterministic machine-readable steer the availability gate sends when an
+ * inbound user turn is an active arming proof (conductor #415). It names the
+ * turn for what it is so the model acknowledges receipt and hands completion to
+ * the host-side `arm` instead of ad-libbing pairing-safety prose at the bare
+ * `FLEET-…` token — and it never quotes the code, which has no place outside
+ * the protected session transcript.
+ */
+export const ARM_PROOF_CUSTOM_TYPE = "omp-conductor.arm-proof";
+
+/** The model-ready wording for {@link ARM_PROOF_CUSTOM_TYPE}. Kept fixed so the
+ *  orchestrator's handling of an arming proof is deterministic, whichever
+ *  challenge it was cut for. */
+export const ARM_PROOF_ACK_TEXT =
+  "The message you just received was an active omp conductor arming confirmation. " +
+  "Acknowledge that the arming confirmation was received; the host-side `arm` command " +
+  "owns completion of the arming handshake. No pairing or access change is required.";
+
 /**
  * A tick costs a whole turn of a frontier model, and the orchestrator's loop is
  * about minutes of latency, not seconds. Anything under a minute is a
@@ -268,6 +304,23 @@ interface TickApi {
    * `@oh-my-pi/pi-coding-agent/src/extensibility/extensions/types.ts:1267-1268`.
    */
   getActiveTools(): string[];
+  /**
+   * Register one tool on this session — the same shape the verb client uses
+   * (`verbs/client.ts`). The bounded ask surface ({@link ASK_TOOL}) is mounted
+   * with it, so the orchestrator's only waiting ask can never outlive its
+   * ceiling.
+   */
+  registerTool(tool: {
+    name: string;
+    label: string;
+    description: string;
+    parameters: unknown;
+    approval?: "read" | "write" | "exec";
+    execute(
+      toolCallId: string,
+      params: Record<string, unknown>,
+    ): Promise<{ content: { type: "text"; text: string }[]; isError?: boolean }>;
+  }): void;
   on(event: "session_start", handler: (event: { type: "session_start" }, ctx: TickContext) => void): void;
   on(event: "turn_start", handler: (event: { type: "turn_start" }, ctx: TickContext) => void): void;
   on(event: "turn_end", handler: (event: { type: "turn_end" }, ctx: TickContext) => void): void;
@@ -282,6 +335,11 @@ interface TickApi {
           synthetic?: boolean;
           attribution?: "user" | "agent";
           timestamp?: number;
+          /** Full-text content parts, as the runtime's `AgentMessage` carries
+           *  them. The arming-proof classifier hashes the reply's tokens
+           *  against persisted pending-challenge state, so it needs the text
+           *  here — content absent means "no reply text", which never matches. */
+          content?: readonly { type?: string; text?: string }[];
         };
       },
       ctx: TickContext,
@@ -340,6 +398,15 @@ export interface TickConfig {
    * before the next tick).
    */
   budgetSeconds?: number;
+  /**
+   * Seconds one {@link ASK_TOOL} call waits for the operator before its
+   * declared timeout outcome fires (#438). Optional; defaults to
+   * {@link DEFAULT_ASK_TIMEOUT_SECONDS} (5 minutes) and is always capped at the
+   * turn budget, so an ask can never outlive the turn it runs in. The ceiling
+   * is the tool's, not the model's: an ask issued without a `timeoutSeconds`
+   * gets this value all the same.
+   */
+  askTimeoutSeconds?: number;
   /**
    * The herdr agent name this fleet's orchestrator pane is registered under, and
    * the whole of {@link resolveTickOwnership}'s identity test under herdr.
@@ -380,9 +447,12 @@ export function defaultTickMessage(
   now: Date,
   briefPath = "ORCHESTRATOR.md",
   policyPath = "POLICY.md",
+  sharedPath?: string,
 ): string {
+  const sources =
+    sharedPath === undefined ? "package floor + policy" : "package floor + shared policy + policy";
   return (
-    `Tick ${now.toISOString()}: re-read ${briefPath} (composed package floor + policy) and ` +
+    `Tick ${now.toISOString()}: re-read ${briefPath} (composed ${sources}) and ` +
     `${policyPath} (editable fleet policy) from disk, then run your standing loop from them. ` +
     `Learning-loop amendments edit only ${policyPath} — never the package floor.`
   );
@@ -476,7 +546,7 @@ export function formatDigestLedger(
     return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
   };
   const lines = [
-    `Durable digest ledger — ${backlog.materialCount} material event(s), ${backlog.heldNoticeCount} held escalation(s); oldest first:`,
+    `Durable digest ledger — ${backlog.materialCount} material event(s), ${backlog.heldNoticeCount} held notice(s); oldest first:`,
     ...events.map(
       (event) =>
         `  event ${event.id} | ${new Date(event.occurredAt).toISOString()} | ${event.category} | ` +
@@ -492,7 +562,7 @@ export function formatDigestLedger(
     lines.push(`  … ${backlog.materialCount - events.length} newer material event(s) remain owed.`);
   }
   if (backlog.heldNoticeCount > notices.length) {
-    lines.push(`  … ${backlog.heldNoticeCount - notices.length} additional held escalation(s) remain owed.`);
+    lines.push(`  … ${backlog.heldNoticeCount - notices.length} additional held notice(s) remain owed.`);
   }
   const eventIds = events.map((event) => event.id).join(",");
   const noticeIds = notices.map((notice) => notice.id).join(",");
@@ -635,10 +705,69 @@ export { TELEGRAM_APPROVAL_TOOL };
  */
 export const TICK_APPROVAL_UNAVAILABLE_RULE =
   `The ${TELEGRAM_APPROVAL_TOOL} tool is NOT mounted on this tick, so the package floor's yes/no amendment approval cannot be asked here. ` +
-  `If you have an amendment to propose, deliver the question with \`omp-conductor message --text "QUESTION: <the question>"\` — it resolves this project's own Telegram chat and topic — and wait for your operator's reply on a later turn. ` +
-  `A returned telegram_ask answer proves an answer, not Telegram delivery. ` +
+  `If you have an amendment to propose, deliver the question with \`omp-conductor message --category decision-needed --text "<the question>"\` — ` +
+  `it resolves this project's own Telegram chat and topic, records the question as an open decision row, and applies the ` +
+  `same availability policy as the tick: an unanswered yes/no stays pending — re-surfaced in every tick until answered ` +
+  `or the seven-day expiry, never recorded as approved. ` +
+  `Wait for the operator's reply on a later turn, then resolve the row with \`omp-conductor decision resolve <id> --answer "..."\`. ` +
+  `A returned answer proves an answer, not Telegram delivery. ` +
   `Never apply an amendment, or record one as approved, without an explicit answer you actually received.`;
 
+/**
+ * Appended to every tick — the shipped prompt or the operator's own — because
+ * the bounded-ask surface is the mechanical contract of a local tick (#438).
+ *
+ * Even a *mounted* `telegram_ask` is not the ask surface for a locally injected
+ * tick: it would wait for the operator for as long as the answer takes, and on
+ * 2026-08-16 that was six stopped hours. The gate refuses it, so the tick names
+ * the bounded replacement up front instead of letting the model discover the
+ * refusal mid-ask.
+ */
+export const TICK_ASK_RULE =
+  `On this locally injected tick, questions to your operator go through ${ASK_TOOL}: ` +
+  `call it with "on-timeout": "auto-proceed" or "park" (what to do when nobody answers within the ceiling) ` +
+  `and optionally "timeoutSeconds" — an ask issued without one still gets the default ceiling, capped at the turn budget. ` +
+  `The ${TELEGRAM_APPROVAL_TOOL} tool is refused here: it would wait for your operator for as long as the answer ` +
+  `takes, and an unanswered question must never hold the loop.`;
+
+/**
+ * What a tick says when the bounded ask surface did not actually mount on this
+ * session (#520). {@link TICK_ASK_RULE} is appended only to a tick whose live
+ * mounted set carries {@link ASK_TOOL}; this is the other half of that
+ * agreement, and it has to carry the ask's semantics rather than just its text:
+ * the escalation category is declared from the vocabulary that already exists
+ * (the `conductor_ask` category is the same one), and the fallback command
+ * records the question as an open decision row, so "nobody answered" is a
+ * durable pending row re-surfaced in every tick — never "asked once, no reply,
+ * dropped". It also names the #524 consequence of a plain send: delivery
+ * follows the fleet's reporting policy, so a category the policy defers waits
+ * for the scheduled digest, and a *blocking* question must declare a category
+ * the fleet interrupts on.
+ */
+export const TICK_ASK_UNAVAILABLE_RULE =
+  `The ${ASK_TOOL} tool is NOT mounted on this tick, so the bounded ask surface is unavailable on this session. ` +
+  `Ask through the CLI fallback instead: run \`omp-conductor message --category <category> --text "<the question>"\` ` +
+  `with the escalation category declared from the policy vocabulary — fleet-stopped, tier2 or decision-needed — ` +
+  `never smuggled through a "QUESTION:" text prefix. The command records the question as an open decision row before ` +
+  `delivering, parked on silence: nobody answering keeps the row open and pending, re-surfaced in every tick until ` +
+  `answered or the seven-day expiry, never an approval. Delivery follows the same reporting policy as the tick — a ` +
+  `category the fleet's interruptOn list defers waits for the next digest or working-hours catch-up and prints a ` +
+  `held-notice id, so a blocking question must declare a category the fleet interrupts on (tier2 or fleet-stopped). ` +
+  `Wait for the operator's reply on a later turn, then resolve the row with \`omp-conductor decision resolve <id> --answer "..."\`. ` +
+  `A returned answer proves an answer, not Telegram delivery.`;
+
+/**
+ * The gate's refusal for a raw {@link TELEGRAM_APPROVAL_TOOL} / `write
+ * xd://telegram_ask` call on a locally injected tick (#438). Fixed wording the
+ * way {@link TICK_ASK_RULE} is: a model that must act on a refusal reads it the
+ * same way every time.
+ */
+export const ASK_DIVERSION_REASON =
+  `Blocked: on this locally injected tick, ${TELEGRAM_APPROVAL_TOOL} would wait for your operator for as long as ` +
+  `the answer takes, and an unanswered question must never stop the loop (#438). Nothing was sent or recorded ` +
+  `by this call. Ask instead with ${ASK_TOOL}, declaring "on-timeout" ("auto-proceed" or "park") — it bounds the ` +
+  `wait, records the question durably, and returns one of those outcomes when nobody answers.`;
+
 /**
  * Appended to every tick — the shipped prompt or the operator's own — composed
  * on a bridge that is not in omp-telegram's `profile: "daemon"`.
@@ -700,6 +829,49 @@ export function formatFrictionDigest(signals: readonly FrictionSignal[]): string
   return lines.join("\n");
 }
 
+/** Bounds one pending idea's text in the tick prompt, like the digest ledger. */
+const INTAKE_TEXT_LIMIT = 160;
+
+/**
+ * Pending intake items, each waiting to become an issue (#300).
+ *
+ * The one appended block that is a *duty* rather than a read-out: every pending
+ * item is listed with its id and text (oldest first, as the store returns
+ * them), followed by the standing instruction for grooming one into an issue —
+ * file it without the queue label, mark provenance with `intake groomed`, and
+ * name the grooming in the digest ledger. Absent when nothing is pending: an
+ * empty intake is the common state of a healthy fleet, and a block that said
+ * "0 pending" every tick would be permanent noise — the same convention as
+ * {@link queueDigestLine}. Project-specific grooming taste (priority scales,
+ * template wording) stays in POLICY.md; this block carries only the floor duty.
+ */
+export function formatPendingIntake(
+  items: readonly IntakeItem[],
+  instruction: { tracker: string; queueLabel: string; labelPrefix: string },
+): string | undefined {
+  if (items.length === 0) return undefined;
+  const oneLine = (text: string): string => {
+    const flat = text.replace(/\s+/g, " ").trim();
+    return flat.length <= INTAKE_TEXT_LIMIT ? flat : `${flat.slice(0, INTAKE_TEXT_LIMIT - 1)}…`;
+  };
+  const lines = [
+    `Pending intake — ${items.length} idea(s) captured, waiting to be groomed into issues, oldest first:`,
+    ...items.map((item) => `- ${item.id} — ${oneLine(item.text)}`),
+    "",
+    `Groom each into exactly one issue on ${instruction.tracker}: a title stating the problem; a body ` +
+      `carrying the product rationale and the acceptance criteria as a checklist; the routing ` +
+      `"${instruction.labelPrefix}<repo>" label and a priority per POLICY.md. File it WITHOUT the ` +
+      `"${instruction.queueLabel}" queue label — filing is not promoting, and never add ` +
+      `${instruction.queueLabel} to an issue you groomed from intake. Then mark provenance with ` +
+      "`omp-conductor intake groomed <id> --issue <url>` — an already-groomed id is a no-op, and an " +
+      "idea is filed exactly once — and record the outcome with `omp-conductor event record --category " +
+      'intake --summary "groomed intake <id> → #<issue-number>" --evidence <url>` so the digest names ' +
+      "the grooming. An item that is malformed or empty is dismissed with `omp-conductor intake dismiss " +
+      "<id>` and noted in the digest rather than filed.",
+  ];
+  return lines.join("\n");
+}
+
 /**
  * The scope this tick carries, where the brief actually lives, and — when the
  * config could not answer — why.
@@ -934,6 +1106,19 @@ export function readTickConfig(cwd: string): TickConfigResult {
       ? budgetRaw
       : undefined;
 
+  // Same tolerance, same reason. The ask ceiling is bounded on both ends by
+  // construction: MIN..MAX here, and the resolved per-ask ceiling is capped at
+  // the turn budget by the ask tool itself, so a config cannot smuggle an
+  // unbounded wait in through this key.
+  const askRaw = raw["askTimeoutSeconds"];
+  const askTimeoutSeconds =
+    typeof askRaw === "number" &&
+    Number.isInteger(askRaw) &&
+    askRaw >= MIN_ASK_TIMEOUT_SECONDS &&
+    askRaw <= MAX_ASK_TIMEOUT_SECONDS
+      ? askRaw
+      : undefined;
+
   // Relative paths resolve against the session cwd, so the files can sit beside
   // the config that names them (`state/armed`) without hard-coding a deploy path.
   const armedFile = optionalPath(raw["armedFile"], "armedFile", cwd, problems);
@@ -978,6 +1163,7 @@ export function readTickConfig(cwd: string): TickConfigResult {
       intervalSeconds,
       ...(project === undefined ? {} : { project }),
       ...(budgetSeconds === undefined ? {} : { budgetSeconds }),
+      ...(askTimeoutSeconds === undefined ? {} : { askTimeoutSeconds }),
       ...(armedFile === undefined ? {} : { armedFile }),
       ...(accessFile === undefined ? {} : { accessFile }),
       ...(message === undefined ? {} : { message }),
@@ -1611,6 +1797,12 @@ interface PendingLocalTick {
 interface ActiveLocalTick extends PendingLocalTick {
   /** A person who writes during an autonomous run is awake by construction. */
   humanWaiting: boolean;
+  /** The most recent inbound turn was an *active arming proof* (conductor #415):
+   *  a reply matching a persisted pending challenge for this project. Set when
+   *  `humanWaiting` is, without flipping the human-present exemption — the
+   *  operator answered a challenge, so they are awake, and the model must not
+   *  treat the matching token as license to mutate pairing or access. */
+  armingProof?: boolean;
 }
 
 interface TelegramInterrupt {
@@ -1718,6 +1910,32 @@ export function telegramTopicRoutingRefusal(payload: Record<string, unknown>): s
   );
 }
 
+/**
+ * The caller's declared interrupt category for one Telegram call, when it names
+ * a real one (#347). The tick prompt tells an autonomous turn which categories
+ * may interrupt under this scope — a condition that stops the fleet is
+ * `fleet-stopped`, a decision the operator must make is `tier2` — and the
+ * caller tags the call with `category` so the admission gate below runs that
+ * category through the same policy as a daemon escalation. Anything that is
+ * not a known category falls back to the historical mapping in
+ * {@link telegramInterruptFromTool}: a question is `decision-needed`, an
+ * ordinary send is `material`.
+ */
+function declaredTelegramCategory(payload: Record<string, unknown>): InterruptCategory | undefined {
+  const value = payload["category"];
+  if (typeof value !== "string") return undefined;
+  return (INTERRUPT_CATEGORIES as readonly string[]).includes(value)
+    ? (value as InterruptCategory)
+    : undefined;
+}
+
+/**
+ * One Telegram call, whatever surface it arrived on, classified enough for the
+ * availability gate: its kind (a question that wants an answer, or a message)
+ * plus the interrupt category the caller declared — defaulting to
+ * `decision-needed` for questions and `material` for messages when the caller
+ * declares none.
+ */
 function telegramInterruptFromTool(
   toolName: string,
   input: Record<string, unknown>,
@@ -1769,7 +1987,7 @@ function telegramInterruptFromTool(
   const canonical = serialiseTelegramPayload({ kind, payload });
   return {
     kind,
-    category: kind === "question" ? "decision-needed" : "material",
+    category: declaredTelegramCategory(payload) ?? (kind === "question" ? "decision-needed" : "material"),
     summary,
     hasFiles: Array.isArray(payload["files"]) && payload["files"].length > 0,
     detail,
@@ -1822,6 +2040,20 @@ function autonomousTelegramInterruptBlock(
   if (active === undefined || active.humanWaiting) return undefined;
   const interrupt = telegramInterruptFromTool(event.toolName, event.input);
   if (interrupt === undefined) return undefined;
+  // The raw ask tool would wait for the operator for as long as the answer
+  // takes; on an autonomous tick that wait must be bounded and its timeout
+  // outcome declared (#438). Divert before the policy read, because the
+  // diversion does not depend on availability — the incident was an ask the
+  // policy *admitted*: the gate let telegram_ask through at 01:01Z and the loop
+  // stopped for six hours. Nothing is persisted here: the bounded surface
+  // records the row and the delivery when the model actually asks, and a
+  // gate-side duplicate would record questions that were never asked.
+  const directAsk =
+    event.toolName === TELEGRAM_APPROVAL_TOOL ||
+    (event.toolName === "write" && event.input["path"] === `xd://${TELEGRAM_APPROVAL_TOOL}`);
+  if (directAsk) {
+    return { block: true, reason: ASK_DIVERSION_REASON };
+  }
   if (active.projectName === undefined) {
     return {
       block: true,
@@ -1869,7 +2101,7 @@ function autonomousTelegramInterruptBlock(
     try {
       if (!store.wasNotified(key)) {
         store.addHeldNotice({
-          id: createHash("sha256").update(`held-notice\0${key}`).digest("hex"),
+          id: heldNoticeId(key),
           project: active.projectName,
           category: interrupt.category,
           summary: interrupt.summary,
@@ -2085,13 +2317,28 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
         store.close();
       }
     }
-    content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${reportingConstraint}\n${bridged ? TICK_DELIVERY_RULE_BRIDGED : TICK_DELIVERY_RULE}`;
+    content = `${defaultTickMessage(
+      new Date(),
+      scope.briefPath,
+      scope.policyPath,
+      existsSync(sharedPolicyPath()) ? sharedPolicyPath() : undefined,
+    )}\n${reportingConstraint}\n${bridged ? TICK_DELIVERY_RULE_BRIDGED : TICK_DELIVERY_RULE}`;
   }
   if (scope.projectName !== undefined) {
     // Unlike ordinary reporting prose, this is a mechanical clock reading and
     // survives a custom heartbeat message. The model never infers whether the
-    // operator can be interrupted.
+    // operator can be interrupted. The bounded-ask rule is the same class
+    // (#438): even a mounted telegram_ask is refused on a locally injected
+    // tick — it would wait unbounded — so the tick names the replacement
+    // surface up front, custom message included.
     content = `${content}\n${availabilityPrompt(scope.policy, Date.now())}`;
+    // The ask rule names the surface this session can actually call (#520):
+    // the bounded ask is registered at `session_start`, so the live mounted
+    // set read here — between turns, in the heartbeat timer — is the honest
+    // source for whether the registration took. A tick that mandates a tool
+    // the session does not carry is #114 all over again, so a missing surface
+    // degrades to the CLI path that exists and carries the ask's semantics.
+    content = `${content}\n${pi.getActiveTools().includes(ASK_TOOL) ? TICK_ASK_RULE : TICK_ASK_UNAVAILABLE_RULE}`;
   }
   let frictionStore: Store | undefined;
   let frictionSignals: FrictionSignal[] = [];
@@ -2137,8 +2384,17 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
             project.groomBelow ?? DEFAULT_GROOM_BELOW,
           );
           if (queue !== undefined) content = `${content}\n${queue}`;
+          // Pending intake is the same class of standing block as the friction
+          // and decisions read-outs: a store-backed duty the orchestrator must
+          // not derive from memory. The store answers, the prompt instructs.
+          const pendingIntake = formatPendingIntake(frictionStore.pendingIntake(scope.projectName), {
+            tracker: project.tracker.repo,
+            queueLabel: project.queueLabel,
+            labelPrefix: project.routing.labelPrefix,
+          });
+          if (pendingIntake !== undefined) content = `${content}\n${pendingIntake}`;
         } catch {
-          // unreadable config: no queue digest this tick
+          // unreadable config: no queue digest or pending-intake block this tick
         }
       } catch (err) {
         frictionStore?.close();
@@ -2398,6 +2654,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
   };
   let releaseGateArmed = false;
   let availabilityGateArmed = false;
+  let askToolArmed = false;
   let guardArmed = false;
   // An activation file makes this a fleet directory before Herdr can prove
   // which pane owns it. The gate therefore starts closed and only honours a
@@ -2424,8 +2681,9 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     }).on("tool_call", (event) => {
       // Most tool calls are ordinary tracker/file work. Classify first so they
       // do not re-read config or emit policy diagnostics.
-      const shape = releaseShapeFromTool(event.toolName, event.input);
-      if (shape === undefined) return undefined;
+      const match = releaseToolMatch(event.toolName, event.input);
+      if (match === undefined) return undefined;
+      const shape = match.shape;
       let projectName: string | undefined;
       let grants: ResolvedGrants = DENIED_RELEASE_GRANTS;
       let external = true;
@@ -2457,9 +2715,12 @@ export default function orchestratorTickExtension(pi: TickApi): void {
       if (decision === undefined) return undefined;
       if (projectName !== undefined) {
         try {
+          const invocation = releaseBlockedInvocation(event.toolName, event.input);
           recordReleaseBlock(projectName, "orchestrator", shape, {
             tool: event.toolName,
             reason: decision.reason,
+            ...(invocation === undefined ? {} : { invocation }),
+            matched: match.matched,
             args: redactReleaseArgs(event.input),
           });
         } catch (err) {
@@ -2509,13 +2770,35 @@ export default function orchestratorTickExtension(pi: TickApi): void {
         }
         return;
       }
-      if (
-        session.activeLocalTick !== undefined &&
-        message.role === "user" &&
-        message.synthetic !== true &&
-        message.attribution !== "agent"
-      ) {
-        session.activeLocalTick.humanWaiting = true;
+      // The reply to an arming challenge lands here as an ordinary user turn. It
+      // must reach the transcript exactly as sent — the host's transcript scan
+      // (`armTicks`) is the backend proof, so it is left untouched — while the
+      // model gets a trusted, machine-readable steer about it, so it stops
+      // ad-libbing pairing-safety prose at a bare `FLEET-…` token (conductor
+      // #415). The classification derives from persisted authenticated
+      // pending-challenge state (hash + expiry, keyed by this project), never
+      // from the `FLEET-` prefix, so an unsolicited lookalike that matches no
+      // active challenge stays inert.
+      if (message.role === "user" && message.synthetic !== true && message.attribution !== "agent") {
+        const replyText =
+          message.content
+            ?.filter((part) => part.type === "text" && typeof part.text === "string")
+            .map((part) => part.text as string)
+            .join(" ") ?? "";
+        const proof = isActiveArmProof(configuredProject, replyText, Date.now());
+        if (session.activeLocalTick !== undefined) {
+          session.activeLocalTick.humanWaiting = true;
+          if (proof) session.activeLocalTick.armingProof = true;
+        }
+        // Acknowledged whether or not a local tick is running: an inactivity-
+        // window challenge reply still deserves deterministic handling, and the
+        // host-side `arm` owns completion either way.
+        if (proof) {
+          pi.sendMessage(
+            { customType: ARM_PROOF_CUSTOM_TYPE, content: ARM_PROOF_ACK_TEXT, display: true, attribution: "agent" },
+            { triggerTurn: true, deliverAs: "steer" },
+          );
+        }
       }
     });
     pi.on("agent_end", () => {
@@ -2539,6 +2822,116 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     );
   };
 
+  /**
+   * Mount the bounded ask surface (#438). One registration per session, next to
+   * the gates it complements: raw {@link TELEGRAM_APPROVAL_TOOL} is refused on
+   * autonomous ticks, so the session must own the tool that asks instead. The
+   * ceiling comes from the tick config the heartbeat started with — the same
+   * startup-only contract `budgetSeconds` already has — and is capped at the
+   * turn budget by the tool itself, so no combination of config and arguments
+   * produces an unbounded wait.
+   *
+   * The tool is inert unless the config resolves this fleet's project: it needs
+   * the project to file the decision row against and to resolve the delivery
+   * target. An unreadable/ambiguous config makes the tool say so and record
+   * nothing, which is the same fail-closed posture the autonomous gate takes.
+   */
+  const armAskTool = (config: TickConfig, configuredProject: string | undefined): void => {
+    if (askToolArmed) return;
+    pi.registerTool({
+      name: ASK_TOOL,
+      label: ASK_TOOL,
+      description:
+        `Ask your operator one question and wait up to a bounded ceiling for the answer. ` +
+        `Records the question durably (decision row + the same delivery path as \`omp-conductor message\`), ` +
+        `delivers it to the operator per the reporting policy, and waits at most the ceiling ` +
+        `(default ${DEFAULT_ASK_TIMEOUT_SECONDS}s, capped at the turn budget; pass "timeoutSeconds" to ` +
+        `shorten or extend within ${MIN_ASK_TIMEOUT_SECONDS}–${MAX_ASK_TIMEOUT_SECONDS}s — an ask issued without ` +
+        `one still gets the default). When nobody answers, the declared "on-timeout" decides: ` +
+        `"auto-proceed" applies your recommended option and resolves the decision row naming the ` +
+        `auto-application ("<option> (auto-applied on ask timeout)"); "park" leaves the row open and ` +
+        `pending — re-surfaced in every tick prompt until answered or the seven-day expiry — and you then ` +
+        `take the blocked work out of the claimable queue and record its state. A timeout is "nobody ` +
+        `answered yet", never a cancellation, an error, or an operator "no".`,
+      parameters: askParameterSchema(),
+      approval: "write",
+      execute: async (_toolCallId, params) => {
+        const parsed = parseAskRequest(params);
+        if (!parsed.ok) {
+          return { content: [{ type: "text", text: parsed.problem }], isError: true };
+        }
+        let projectConfig;
+        try {
+          projectConfig = findProject(loadConfig(), configuredProject);
+        } catch (err) {
+          return {
+            content: [
+              {
+                type: "text",
+                text:
+                  `${ASK_TOOL}: conductor config unreadable (${err instanceof Error ? err.message : String(err)}); ` +
+                  "nothing was asked or recorded. Repair the config, do not ask through another path.",
+              },
+            ],
+            isError: true,
+          };
+        }
+        const store = openStore(dbPath());
+        let result: AskResult;
+        try {
+          result = await performAsk(parsed.request, {
+            store,
+            project: projectConfig.name,
+            configuredCeilingSeconds: config.askTimeoutSeconds,
+            turnBudgetSeconds: config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS,
+            deliver: async (text, category) => {
+              const at = Date.now();
+              const noticeId = randomUUID();
+              try {
+                const delivered = await deliverOperatorMessage(projectConfig, text, {
+                  store,
+                  at,
+                  noticeId,
+                  category,
+                });
+                return delivered.kind === "sent"
+                  ? { kind: "sent", category: delivered.category }
+                  : { kind: "held", category: delivered.category, noticeId: delivered.noticeId };
+              } catch (err) {
+                // A failed immediate send must not drop the question: fall back
+                // to the durable hold exactly like the gate's own hold path, and
+                // let the daemon retry with the digest.
+                store.addHeldNotice({
+                  id: noticeId,
+                  project: projectConfig.name,
+                  category,
+                  summary: text.split("\n", 1)[0]!.slice(0, 240),
+                  detail: text,
+                  createdAt: at,
+                });
+                pi.logger.error(
+                  `[omp-conductor] ${ASK_TOOL} could not deliver the ask directly (${err instanceof Error ? err.message : String(err)}); held durably`,
+                );
+                return { kind: "held", category, noticeId };
+              }
+            },
+          });
+        } finally {
+          store.close();
+        }
+        return { content: [{ type: "text", text: result.text }] };
+      },
+    });
+    // Latched after the registration returns, not before: a throw inside
+    // `registerTool` must not leave the surface permanently unmounted — the
+    // latch would otherwise turn a transient registration failure into a
+    // missing ask surface for the whole session (#520). On a real harness
+    // `session_start` fires once, so this is a retry on the next session
+    // rather than a loop, but it is the difference between a recovery and a
+    // permanent divergence between the prompt and the mounted set.
+    askToolArmed = true;
+  };
+
   pi.on("session_start", (_event, ctx) => {
     if (decided) return;
 
@@ -2571,6 +2964,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     const configuredProject = result.kind === "ok" ? result.config.project : undefined;
     armReleaseGate(configuredProject);
     armAvailabilityGate(configuredProject);
+    if (result.kind === "ok") armAskTool(result.config, configuredProject);
 
     if (result.kind === "invalid") {
       const detail = `${result.path}: ${result.problem}`;

package/src/orchestrator.ts

@@ -33,8 +33,8 @@ import { stateDir } from "./config.ts";
 import { formatEscalation } from "./escalate.ts";
 import { createSession, disposeSession } from "./omp.ts";
 import type { AgentSessionLike } from "./omp.ts";
-import type { ReleaseBlockContext } from "./release-policy.ts";
-import type { Escalation, ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
+import type { GateShape, ReleaseBlockContext } from "./release-policy.ts";
+import type { Escalation, ResolvedGrants, SessionRole } from "./types.ts";
 
 /**
  * The session factory {@link startOrchestrator} uses. Named so the test seam
@@ -47,7 +47,7 @@ export type CreateSessionFn = (opts: {
   resume?: boolean;
   role: SessionRole;
   releaseGrants?: ResolvedGrants;
-  onReleaseBlocked?: (shape: ReleaseShape, context: ReleaseBlockContext) => void;
+  onReleaseBlocked?: (shape: GateShape, context: ReleaseBlockContext) => void;
   onSpawn?: (pid: number) => void;
   socketPath?: string;
   verbSocketPath?: string;
@@ -85,7 +85,7 @@ export interface OrchestratorOpts {
   sessionDir?: string;
   model?: string;
   releaseGrants?: ResolvedGrants;
-  onReleaseBlocked?: (shape: ReleaseShape, context: ReleaseBlockContext) => void;
+  onReleaseBlocked?: (shape: GateShape, context: ReleaseBlockContext) => void;
   /** The child's pid, the instant it exists. See {@link VerbListener.bindPid}. */
   onSpawn?: (pid: number) => void;
   /** Control socket for the session child, beside its own working directory. */