omp-conductor 0.15.10 → 0.15.12

package/src/setup-wizard.ts

@@ -30,7 +30,7 @@ import {
   type QueuePreview,
 } from "./daemon.ts";
 import { armTicks, telegramStateDir } from "./fleet.ts";
-import { restartDaemon } from "./lifecycle.ts";
+import { restartDaemon, type RestartResult } from "./lifecycle.ts";
 import { defaultGraphRoot, graphRepos } from "./graph.ts";
 import {
   formatHostRuntimePlan,
@@ -40,8 +40,9 @@ import {
   SYSTEMD_UNIT_DIR,
   tickCwdForProject,
   writeHostRuntime,
+  type SetupSmokeResult,
 } from "./setup-host.ts";
-import { runGraphInstall, runHostInstall } from "./setup-install.ts";
+import { runGraphInstall, runHostInstall, type GraphInstallOptions, type InstallOutcome } from "./setup-install.ts";
 import { probeGates, probeProse, probeRepoMap, type ProbedGate, type ProbeTarget } from "./setup-probe.ts";
 import {
   discoverFacts,
@@ -74,7 +75,9 @@ import {
   summarisePlan,
   writeOrchestratorBrief,
   type AmendAreaId,
+  type LabelPlan,
   type OperatorJudgment,
+  type ScopeCheck,
   type SetupAnswers,
   type ProbedProse,
 } from "./setup.ts";
@@ -82,11 +85,13 @@ import {
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
   DEFAULT_CAPS,
+  DENIED_RELEASE_GRANTS,
   DRAFT_POLICIES,
   RELEASE_REQUIREMENTS,
   INTERRUPT_CATEGORIES,
   RELEASE_SHAPES,
   WEEKDAYS,
+  type AuthorityHolder,
   type Caps,
   type ConductorConfig,
   type OrchestratorMode,
@@ -374,8 +379,18 @@ async function askReleaseRequirements(
  * them out of POLICY.md is that they are config: a condition an operator can
  * only reach by opening `config.json` is one that stays at its default while
  * their prose says something else, which is the drift this key ended.
+ *
+ * The merge half is always asked — it gates work that lands whatever the
+ * release authority is. The release half only matters when the orchestrator
+ * actually cuts releases: with `release: human` a release verb is refused
+ * before these fields are read (see `verbs/server`), so asking them would be a
+ * dead question. They are skipped, keeping the seed's value.
  */
-async function askPolicyPreconditions(ui: WizardUi, prior: ProjectPolicy): Promise<ProjectPolicy> {
+async function askPolicyPreconditions(
+  ui: WizardUi,
+  prior: ProjectPolicy,
+  releaseAuthority: AuthorityHolder,
+): Promise<ProjectPolicy> {
   const merge = {
     requiredChecks: await askNameList(
       ui,
@@ -405,33 +420,58 @@ async function askPolicyPreconditions(ui: WizardUi, prior: ProjectPolicy): Promi
     ),
   };
 
-  const release = {
-    requires: await askReleaseRequirements(ui, prior.release.requires),
-    requiredChecks: await askNameList(
-      ui,
-      `Release — required checks (comma separated, "${EMPTY_LIST}" = every check the branch reports)`,
-      prior.release.requiredChecks,
-    ),
-    artefacts: await askNameList(
-      ui,
-      `Release — artefacts this project ships (comma separated, or "${EMPTY_LIST}")`,
-      prior.release.artefacts,
-    ),
-    environments: await askNameList(
-      ui,
-      `Release — environments a deploy may target (comma separated, or "${EMPTY_LIST}")`,
-      prior.release.environments,
-    ),
-  };
+  const release =
+    releaseAuthority === "orchestrator"
+      ? {
+          requires: await askReleaseRequirements(ui, prior.release.requires),
+          requiredChecks: await askNameList(
+            ui,
+            `Release — required checks (comma separated, "${EMPTY_LIST}" = every check the branch reports)`,
+            prior.release.requiredChecks,
+          ),
+          artefacts: await askNameList(
+            ui,
+            `Release — artefacts this project ships (comma separated, or "${EMPTY_LIST}")`,
+            prior.release.artefacts,
+          ),
+          environments: await askNameList(
+            ui,
+            `Release — environments a deploy may target (comma separated, or "${EMPTY_LIST}")`,
+            prior.release.environments,
+          ),
+        }
+      : prior.release;
 
   return { merge, release };
 }
 
 /**
- * Who merges and who releases. Two confirms rather than one four-way list:
- * these are independent grants — delegating merges is routine, delegating
- * releases is not — and a menu of four combinations frames them as equally
- * ordinary choices, which is exactly the framing a release grant must not get.
+ * The release questions a delegated release authority unlocks, in the order the
+ * interview asks them after the grant: one tool gate per release shape, then
+ * the release-policy conditions.
+ *
+ * The authority preview counts and names them from this list — and from
+ * `RELEASE_SHAPES` directly — so the prompt stays honest with the questions
+ * that follow: a shape added to `RELEASE_SHAPES` or a condition added here moves
+ * the number the preview quotes at the same time the later questions appear. A
+ * hard-coded count is the drift this exists to prevent.
+ */
+export function releaseUnlockPlan(): { gates: readonly string[]; policy: readonly string[] } {
+  return {
+    // `RELEASE_SHAPES`, not a copy that can rot: these are exactly the per-shape
+    // gates `askReleaseGrants` asks (seven, not five (#500)).
+    gates: [...RELEASE_SHAPES],
+    // The release half of `askPolicyPreconditions`, in the order it asks them.
+    policy: ["requirements", "required checks", "artefacts", "environments"],
+  };
+}
+
+/**
+ * Who merges, who releases and who promotes. Three confirms rather than one
+ * four-way list: these are independent grants — delegating merges is routine,
+ * delegating releases and promotion is not — and a menu of combinations frames
+ * them as equally ordinary choices, which is exactly the framing a release or
+ * promotion grant must not get.
  *
  * Neither confirm can start on "yes", so a re-run that Enters through the
  * wizard revokes rather than renews. That is the safe direction, and the
@@ -448,15 +488,31 @@ async function askAuthority(
       "re-checked against the base branch first. Default: humans merge" +
       `${prior.merge === "orchestrator" ? " — currently delegated, answer no to take it back" : ""}.`,
   );
+  const unlock = releaseUnlockPlan();
+  const unlockCount = unlock.gates.length + unlock.policy.length;
   const release = await askYesNo(
     ui,
     "Release authority",
     "Delegate release cutting to the orchestrator session? It would tag, pin and publish by the " +
       "procedure you write into its brief — and its brief forbids cutting one before you have. " +
-      "Default: humans release" +
+      `Delegating unlocks ${unlockCount} later decisions: the ${unlock.gates.length} release-tool ` +
+      `gates (${unlock.gates.join(", ")}) and the release-policy conditions (${unlock.policy.join(", ")}). ` +
+      "Declining means humans release and none are asked. Default: humans release" +
       `${prior.release === "orchestrator" ? " — currently delegated, answer no to take it back" : ""}.`,
   );
-  return { merge: merge ? "orchestrator" : "human", release: release ? "orchestrator" : "human" };
+  const promotion = await askYesNo(
+    ui,
+    "Promotion authority",
+    "Delegate promotion to the orchestrator session? Promotion is adding the queue label to an " +
+      "issue — the sign-off that lets a worker claim it, and the act that starts spend. " +
+      "Default: the operator promotes" +
+      `${prior.promotion === "orchestrator" ? " — currently delegated, answer no to take it back" : ""}.`,
+  );
+  return {
+    merge: merge ? "orchestrator" : "human",
+    release: release ? "orchestrator" : "human",
+    promotion: promotion ? "orchestrator" : "human",
+  };
 }
 
 /**
@@ -478,6 +534,14 @@ const RELEASE_SHAPE_QUESTIONS: { readonly [K in (typeof RELEASE_SHAPES)[number]]
   deploy:
     "deploy — change what is running: kubectl/helm/terraform, a deploy device call, a rollout. " +
     "This is the one grant that mutates a live environment rather than producing an artifact",
+  // #486: the last leg of the loop. Releasing publishes; installing replaces the
+  // running conductor itself, detached from the session, and only the first
+  // tick after the restart proves it. Fund as deliberate as `deploy` is — the
+  // package floor's "nobody patches the running conductor" is this grant's
+  // deny default.
+  install:
+    "install — replace this host's installed conductor: the Bun-global CLI, omp plugin " +
+    "and Herdr plugin pinned to one published release, executed detached from the fleet",
 };
 
 /**
@@ -1137,11 +1201,25 @@ const askWorkerModel: AreaAsker = async (ui, a) => {
   return next;
 };
 
-/** The two ownership questions, then the mechanical gate one shape at a time:
+/** The three ownership questions, then the mechanical gate one shape at a time:
  *  together they are what decides what an unattended fleet may do unasked. */
 const askAuthorityArea: AreaAsker = async (ui, a, _probes, discovered) => {
   const authority = await askAuthority(ui, a.authority);
-  const releaseGrants = await askReleaseGrants(ui, a.releaseGrants);
+  // Declining release authority makes the five per-shape grants moot — they
+  // exist to scope an authority that was just refused, and asking them after
+  // "humans release" teaches the operator that answers do not matter (#368).
+  //
+  // Humans-only authority clears any stale per-shape grant to the fail-closed
+  // baseline rather than offering an individual-tool path: `releaseVerb`
+  // refuses before a shape grant is ever read (see `verbs/server`), so a shape
+  // granted under humans-only authority is a dead prompt that says the opposite
+  // of what the operator answered. Clearing keeps the tick tripwire, which
+  // reads the grant map independently of authority, from enforcing a shape the
+  // operator just revoked.
+  const releaseGrants =
+    authority.release === "human"
+      ? { ...DENIED_RELEASE_GRANTS }
+      : await askReleaseGrants(ui, a.releaseGrants);
   // Asked here because it is the same decision one layer down: the grants say
   // who may act, and these say where that permission stops. Amending authority
   // therefore re-asks the boundary, which is the point — a grant widened without
@@ -1151,8 +1229,13 @@ const askAuthorityArea: AreaAsker = async (ui, a, _probes, discovered) => {
 };
 
 /** What a merge and a release must satisfy. Asked straight after the grants:
- *  who may act, then under what conditions (#129). */
-const askPolicy: AreaAsker = async (ui, a) => ({ ...a, policy: await askPolicyPreconditions(ui, a.policy) });
+ *  who may act, then under what conditions. The release half is only asked
+ *  when the orchestrator cuts releases — with humans releasing it has no gates
+ *  to configure, so it would be a dead prompt (#368). */
+const askPolicy: AreaAsker = async (ui, a) => ({
+  ...a,
+  policy: await askPolicyPreconditions(ui, a.policy, a.authority.release),
+});
 
 /** How a stuck run reaches a human, and who triages it when it does. */
 const askEscalation: AreaAsker = async (ui, a) => {
@@ -1421,6 +1504,32 @@ const AREA_ASKERS: { readonly [K in AmendAreaId]: AreaAsker } = {
     await askBrief(ui, { ...a, judgment: await askJudgment(ui, a.releaseGrants, a.judgment ?? {}) }, probes),
 };
 
+/**
+ * The full interview's areas, in the exact order `collectAnswers` walks them.
+ *
+ * This array is the single source of both the questions and their progress
+ * marker: the "m" in every `Area n of m` line is this list's `.length`, never a
+ * separate constant, so an area a branch predicate prunes takes its row and its
+ * slot in the denominator with it — the count cannot drift from the iterable.
+ *
+ * The order is load-bearing and each step documents its own rationale: the
+ * graph sits straight after the repos because the answer is derived per repo;
+ * the worker model sits after the policy block because the boundary is an
+ * authority-shaped decision, not a runtime knob; the brief is last because its
+ * write question needs the real path the rest of the answers derive.
+ */
+const INTERVIEW_AREAS: readonly { label: string; asker: AreaAsker }[] = [
+  { label: "tracker & repos", asker: askTrackerAndRepos },
+  { label: "code graph", asker: askGraph },
+  { label: "caps", asker: askCaps },
+  { label: "authority & release grants", asker: askAuthorityArea },
+  { label: "merge & release preconditions", asker: askPolicy },
+  { label: "worker model", asker: askWorkerModel },
+  { label: "escalation & triage", asker: askEscalation },
+  { label: "reporting", asker: askReporting },
+  { label: "orchestrator brief", asker: askBrief },
+];
+
 /** The two ways to answer the first question a configured project gets. Labels,
  *  because the harness's select resolves to the label it displayed. */
 const AMEND_ONE = "Change one area";
@@ -1444,7 +1553,7 @@ type AmendChoice =
  * add-a-project path. Only asked when a project is already configured — a first
  * run has nothing to amend and is never shown this.
  */
-async function chooseAmendArea(ui: WizardUi, prior: ProjectConfig): Promise<AmendChoice> {
+async function chooseAmendArea(ui: WizardUi, prior: ProjectConfig, defaults: Caps = DEFAULT_CAPS): Promise<AmendChoice> {
   const mode = await ui.select(
     `"${prior.name}" is already configured — what would you like to do?`,
     [
@@ -1473,7 +1582,7 @@ async function chooseAmendArea(ui: WizardUi, prior: ProjectConfig): Promise<Amen
     return { kind: "reinterview" };
   }
 
-  const choices = amendChoices(prior);
+  const choices = amendChoices(prior, defaults);
   const picked = await ui.select(
     "Which area? Each row shows what it says now",
     choices.map((c) => ({ label: c.label, description: c.description })),
@@ -1536,19 +1645,14 @@ async function collectAnswers(
       mirrorRoot: scoped.mirrorRoot,
     };
   }
-  a = await askTrackerAndRepos(ui, a, probes);
-  // Straight after the repos, because it is a fact about them: one clone per
-  // routed repo, under one root.
-  a = await askGraph(ui, a, probes);
-  a = await askCaps(ui, a, probes);
-  a = await askAuthorityArea(ui, a, probes, discovered);
-  a = await askPolicy(ui, a, probes, discovered);
-  a = await askWorkerModel(ui, a, probes);
-  a = await askEscalation(ui, a, probes);
-  a = await askReporting(ui, a, probes);
-  // Asked last, and asked with the real path in the question — which needs the
-  // rest of the answers to derive.
-  return await askBrief(ui, a, probes);
+  // Walk the ordered area list once; the marker's denominator is the list's
+  // length, so an area a branch prunes drops its row and its slot together.
+  const areas = INTERVIEW_AREAS;
+  for (const [index, area] of areas.entries()) {
+    ui.notify(`Area ${index + 1} of ${areas.length}: ${area.label}`, "info");
+    a = await area.asker(ui, a, probes, discovered);
+  }
+  return a;
 }
 
 /** The dry run, rendered. Same routing code the loop uses, so this is what the
@@ -1661,7 +1765,7 @@ export async function collectSetup(
     };
   }
 
-  const choice = await chooseAmendArea(ui, prior);
+  const choice = await chooseAmendArea(ui, prior, existing?.defaults ?? DEFAULT_CAPS);
   if (choice.kind === "add-project") {
     // Fresh interview, no pre-fill from the neighbour. CLI --project is ignored
     // here: the operator just chose to add, so the name comes from the prompt.
@@ -1743,11 +1847,82 @@ export function formatHerdrHandoff(project: ProjectConfig, cfg: ConductorConfig)
 
 
 
+/**
+ * The side-effecting apply tail of {@link setup}, as one injectable object — the
+ * wizard has `collectSetup` fully covered but none of its apply tail today. The
+ * default is the real implementations; a test stubs whichever of gh/daemon/root
+ * it proves, and drives the real tail (including the real `runGraphInstall`
+ * with injected `unitDir`/`privileged`/probe) through the same seam, so a
+ * regression cannot hide behind a rewritten status line.
+ */
+export interface SetupApplyDeps {
+  scopes: () => Promise<ScopeCheck>;
+  labels: (trackerRepo: string, a: SetupAnswers) => Promise<LabelPlan[]>;
+  preview: (project: ProjectConfig) => Promise<QueuePreview>;
+  createLabels: (trackerRepo: string, plan: LabelPlan[]) => Promise<string[]>;
+  smoke: (project: string) => Promise<SetupSmokeResult>;
+  restart: (o: { project?: string }) => Promise<RestartResult>;
+  arm: (project: string) => Promise<string>;
+  resume: (project: string) => void;
+  hostInstall: (
+    project: ProjectConfig,
+    caps: Caps,
+    telegramStateDir: string,
+    ui: WizardUi,
+  ) => Promise<InstallOutcome>;
+  graphInstall: (
+    project: ProjectConfig,
+    ui: WizardUi,
+    options?: GraphInstallOptions,
+  ) => Promise<InstallOutcome>;
+}
+
+export const DEFAULT_APPLY: SetupApplyDeps = {
+  scopes: checkTokenScopes,
+  labels: planLabels,
+  preview: previewProject,
+  createLabels: createMissingLabels,
+  smoke: runSetupSmoke,
+  restart: (o) => restartDaemon(o),
+  arm: (project) => ensureSetupArm(project),
+  resume: (project) => setPaused(false, undefined, project),
+  hostInstall: (project, caps, telegramStateDir, ui) =>
+    runHostInstall(project, caps, telegramStateDir, ui),
+  graphInstall: (project, ui, options) => runGraphInstall(project, ui, options),
+};
+
+/**
+ * The post-apply code-graph offer. Shared by the tail and the live-worker early
+ * return, so neither path can silently leave the graph install unreferenced.
+ * `graphInstall` is injectable: the tail and the CLI both call the real
+ * {@link runGraphInstall}, and a test drives apply through this same seam.
+ */
+async function offerCodeGraph(
+  project: ProjectConfig,
+  ui: WizardUi,
+  graphInstall: SetupApplyDeps["graphInstall"],
+): Promise<void> {
+  if (graphRepos(project).length === 0) return;
+  const wantsGraph = await ui.confirm(
+    "Install the code-graph indexes now?",
+    "Clones each index-only checkout as you, installs and enables the reindex timer as root, then seeds one " +
+      "indexing run so the first fetch happens while you watch. Minutes per repo. " +
+      "`omp-conductor setup graph` does the same later; `--no-seed` skips the seeding run.",
+  );
+  if (wantsGraph === true) await graphInstall(project, ui);
+  else
+    ui.notify(
+      "Skipped the code graph — workers grep until it exists. When you want it: omp-conductor setup graph",
+      "info",
+    );
+}
+
 export async function setup(
   ui: WizardUi,
   projectArg: string | undefined,
   areaArg?: AmendAreaId,
   probes: SetupProbes = DEFAULT_PROBES,
+  apply: SetupApplyDeps = DEFAULT_APPLY,
 ): Promise<void> {
   const path = configPath();
   // A config that exists but does not parse is a fault to report, never
@@ -1768,7 +1943,7 @@ export async function setup(
   }
   const { answers, amend, added } = collected;
 
-  const scopes = await checkTokenScopes();
+  const scopes = await apply.scopes();
   if (!scopes.ok) {
     ui.notify(
       `Setup stopped before writing anything. The gh token needs repo and project scopes. ` +
@@ -1783,7 +1958,7 @@ export async function setup(
   // files will contain. Each draft carries its own preview and confirm; declining
   // one keeps the shipped stub, so an operator who wants none reaches the same plan.
   const prose = answers.writeOrchestratorBrief ? await probes.prose(ui, answers) : {};
-  const labels = await planLabels(answers.trackerRepo, answers);
+  const labels = await apply.labels(answers.trackerRepo, answers);
   const telegram = detectTelegram();
   let nextConfig;
   try {
@@ -1820,7 +1995,7 @@ export async function setup(
   );
   let queuePreview: string[];
   try {
-    queuePreview = formatPreview(await previewProject(project));
+    queuePreview = formatPreview(await apply.preview(project));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     ui.notify(
@@ -1834,8 +2009,8 @@ export async function setup(
     [
       // The delta first when there is one, then the whole plan: the confirm has
       // to name every mutation it authorises, and a delta names none of them.
-      ...(amend === undefined ? [] : [summariseAmend(amend.area, amend.before, answers)]),
-      summarisePlan(answers, scopes, labels, telegram),
+      ...(amend === undefined ? [] : [summariseAmend(amend.area, amend.before, answers, nextConfig.defaults)]),
+      summarisePlan(answers, scopes, labels, telegram, nextConfig.defaults),
       "",
       formatHostRuntimePlan(runtime),
       "",
@@ -1863,11 +2038,23 @@ export async function setup(
       runtime.service.action === "keep"
         ? `Keeps the staged systemd unit at ${runtime.service.path}.`
         : `${runtime.service.action === "create" ? "Creates" : "Updates"} the staged systemd unit at ${runtime.service.path}.`,
+      runtime.herdrUnit === undefined
+        ? ""
+        : runtime.herdrUnit.action === "keep"
+          ? `Keeps the staged Herdr session unit at ${runtime.herdrUnit.path}.`
+          : `${runtime.herdrUnit.action === "create" ? "Creates" : "Updates"} the staged Herdr session unit at ${runtime.herdrUnit.path} (account's login shell for panes).`,
       runtime.tick === undefined
         ? ""
         : runtime.tick.action === "keep"
           ? `Keeps the external heartbeat config at ${runtime.tick.path}.`
           : `${runtime.tick.action === "create" ? "Creates" : "Updates"} the external heartbeat config at ${runtime.tick.path}.`,
+      runtime.briefLink === undefined
+        ? ""
+        : runtime.briefLink.action === "skip"
+          ? `Leaves the existing file at ${runtime.briefLink.path} alone (an operator's file, not overwritten).`
+          : runtime.briefLink.action === "keep"
+            ? `Keeps the brief link at ${runtime.briefLink.path}.`
+            : `${runtime.briefLink.action === "create" ? "Creates" : "Replaces"} the brief link at ${runtime.briefLink.path} -> ${runtime.briefLink.target}.`,
       answers.writeOrchestratorBrief
         ? `Writes ${orchestratorBriefPath(answers)}, which is then yours to edit.`
         : "",
@@ -1887,11 +2074,12 @@ export async function setup(
   // Hold first. Any later filesystem, tracker, smoke, or channel error leaves a
   // partially applied setup unable to claim work.
   prepareConductor(project.name);
-  const created = await createMissingLabels(answers.trackerRepo, labels);
+  const created = await apply.createLabels(answers.trackerRepo, labels);
   saveConfig(nextConfig);
   const briefPath = answers.writeOrchestratorBrief ? writeOrchestratorBrief(answers, prose) : undefined;
   const runtimeFiles = writeHostRuntime(runtime);
-  const smoke = await runSetupSmoke(project.name);
+  for (const warning of runtimeFiles.warnings) ui.notify(warning, "warning");
+  const smoke = await apply.smoke(project.name);
   let smokeLine =
     `paused daemon --once; temporary /healthz on :${smoke.daemon.port}; ` +
     `stored status for ${smoke.status.project}`;
@@ -1911,6 +2099,12 @@ export async function setup(
         ].join("\n"),
         "warning",
       );
+      // The early return must not swallow the graph offer. This host is the
+      // live reproduction: the shared reindex units were already installed by
+      // the first project, so only the clone+seed are outstanding — and nothing
+      // above names them. Offer regardless of live workers: cloning seeds and
+      // enables the timer, which does not touch the running daemon.
+      await offerCodeGraph(project, ui, apply.graphInstall);
       ui.notify(formatHerdrHandoff(project, nextConfig), "info");
       return;
     }
@@ -1928,7 +2122,7 @@ export async function setup(
         "info",
       );
     } else {
-      const restarted = await restartDaemon({ project: project.name });
+      const restarted = await apply.restart({ project: project.name });
       restartVia = restarted.via;
       smokeLine =
         `existing /healthz and stored status; restarted through ${restarted.via}; ` +
@@ -1940,7 +2134,7 @@ export async function setup(
   if (project.escalation.orchestrator === "external") {
     ui.notify("Setup smoke passed. Proving the external heartbeat channel…", "info");
     try {
-      armLine = await ensureSetupArm(project.name);
+      armLine = await apply.arm(project.name);
     } catch (err) {
       ui.notify(
         [
@@ -1955,7 +2149,7 @@ export async function setup(
       return;
     }
   }
-  setPaused(false, undefined, project.name);
+  apply.resume(project.name);
 
   ui.notify(
     [
@@ -1964,9 +2158,9 @@ export async function setup(
       briefPath === undefined
         ? "Kept the existing orchestrator brief."
         : `Wrote ${briefPath} + POLICY.md. Edit POLICY.md for Releases and Reporting.`,
-      runtimeFiles.length === 0
+      runtimeFiles.wrote.length === 0
         ? "Host runtime files were already current."
-        : `Wrote host runtime file(s): ${runtimeFiles.join(", ")}`,
+        : `Wrote host runtime file(s): ${runtimeFiles.wrote.join(", ")}`,
       `Smoke passed: ${smokeLine}.`,
       `Heartbeat: ${armLine}.`,
       "",
@@ -2004,24 +2198,11 @@ export async function setup(
         "command before it runs. Skipping is fine — `omp-conductor setup host` does exactly this later.",
     );
     if (install === true)
-      await runHostInstall(project, resolveCaps(project, nextConfig.defaults), telegram.stateDir, ui);
+      await apply.hostInstall(project, resolveCaps(project, nextConfig.defaults), telegram.stateDir, ui);
     else ui.notify("Left the unit staged. When you want it supervised: omp-conductor setup host", "info");
   }
 
-  if (graphRepos(project).length > 0) {
-    const wantsGraph = await ui.confirm(
-      "Install the code-graph indexes now?",
-      "Clones each index-only checkout as you, installs and enables the reindex timer as root, then seeds one " +
-        "indexing run so the first fetch happens while you watch. Minutes per repo. " +
-        "`omp-conductor setup graph` does the same later; `--no-seed` skips the seeding run.",
-    );
-    if (wantsGraph === true) await runGraphInstall(project, ui);
-    else
-      ui.notify(
-        "Skipped the code graph — workers grep until it exists. When you want it: omp-conductor setup graph",
-        "info",
-      );
-  }
+  await offerCodeGraph(project, ui, apply.graphInstall);
 
   // Always print: first install, amend, and add-a-project all need the operator
   // to create/verify the herdr pane. Added projects especially — the CLI wrote