omp-conductor 0.15.11 → 0.15.13

package/src/commands/restart.ts

@@ -7,70 +7,97 @@
  */
 
 import type { CommandContext } from "./context.ts";
+import { buildStopProvenance } from "../stop-provenance.ts";
 import { setPaused } from "../daemon.ts";
-import { restartDaemon, type RestartResult } from "../lifecycle.ts";
+import { restartDaemon, type RestartResult, type StopDelivery } from "../lifecycle.ts";
+import { openStore, dbPath } from "../store.ts";
 import { DEFAULT_DEPS, drainAndRestart, type UpgradeDeps } from "../upgrade.ts";
 
 export async function restartCommand(ctx: CommandContext): Promise<void> {
-if (ctx.argv.includes("--now")) {
-  // Inherit the running daemon's port and project: a restart that quietly
-  // moved to the default port would leave every existing health check
-  // pointing at nothing. When the unit owns the live pid, restartDaemon
-  // goes through systemctl so the replacement stays supervised; a failed
-  // installed unit is reset and started through systemd the same way and
-  // is never replaced by an unmanaged daemon. Success is only reported
-  // after the manager is proven to own the reported pid.
-  const { previous, record, via } = await restartDaemon({
-    port: ctx.portFlag(),
-    project: ctx.projectFlag,
+const store = openStore(dbPath());
+try {
+  // Provenance (#378): one record naming the request, every configured
+  // project with its live-run count, and — via the lifecycle chokepoint — the
+  // delivery method used. The shared daemon serves all projects, so a restart
+  // is never silent even when the operator narrows nothing.
+  const provenance = buildStopProvenance({
+    controlPath: "cli restart",
+    reason: "operator restart",
+    scope: "global",
   });
-  if (previous !== undefined) {
-    process.stdout.write(
-      `stopped — pid ${previous.pid}${via === "systemctl" ? " (via systemctl)" : ""}\n`,
-    );
-  }
-  process.stdout.write(
-    `started — pid ${record.pid}, /healthz on :${record.port}` +
-      `${record.project === undefined ? "" : `, project ${record.project}`}` +
-      `${via === "systemctl" ? " (via systemctl)" : ""}\nlog ${record.logFile}\n`,
-  );
-  return;
-}
+  const record = (signal: StopDelivery) => store.recordDaemonStop(signal.provenance);
 
-// Default: drain the fleet before restarting — pause new claims, wait for
-// live workers to reach 0/N (bounded by --timeout), restart, then restore
-// the prior dispatch state. A timed-out drain restarts nothing and leaves
-// dispatch paused, so it is safe to run while the daemon is wedged.
-const timeoutRaw = ctx.flag("timeout");
-const timeoutSeconds =
-  timeoutRaw === undefined ? 1800 : Number.parseInt(timeoutRaw, 10);
-const timeoutMs = (Number.isNaN(timeoutSeconds) ? 1800 : timeoutSeconds) * 1000;
-let result!: RestartResult;
-const deps: UpgradeDeps = {
-  ...DEFAULT_DEPS,
-  setPaused: (v, project) =>
-    setPaused(v, { source: "restart", reason: "restart, draining" }, project),
-  restartDaemon: async () => {
-    result = await restartDaemon({
+  if (ctx.argv.includes("--now")) {
+    // Inherit the running daemon's port and project: a restart that quietly
+    // moved to the default port would leave every existing health check
+    // pointing at nothing. When the unit owns the live pid, restartDaemon
+    // goes through systemctl so the replacement stays supervised; a failed
+    // installed unit is reset and started through systemd the same way and
+    // is never replaced by an unmanaged daemon. Success is only reported
+    // after the manager is proven to own the reported pid.
+    const { previous, record: newRecord, via } = await restartDaemon({
       port: ctx.portFlag(),
       project: ctx.projectFlag,
+      provenance,
+      record,
     });
-  },
-};
-try {
-  await drainAndRestart(deps, { project: ctx.projectFlag, timeoutMs });
-} catch (err) {
-  process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
-  process.exit(1);
-}
-if (result.previous !== undefined) {
+    if (previous !== undefined) {
+      process.stdout.write(
+        `stopped — pid ${previous.pid}${via === "systemctl" ? " (via systemctl)" : ""}\n`,
+      );
+    }
+    process.stdout.write(
+      `started — pid ${newRecord.pid}, /healthz on :${newRecord.port}` +
+        `${newRecord.project === undefined ? "" : `, project ${newRecord.project}`}` +
+        `${via === "systemctl" ? " (via systemctl)" : ""}\nlog ${newRecord.logFile}\n`,
+    );
+    return;
+  }
+
+  // Default: drain the fleet before restarting — pause new claims, wait for
+  // live workers to reach 0/N (bounded by --timeout), restart, then restore
+  // the prior dispatch state. A timed-out drain restarts nothing and leaves
+  // dispatch paused, so it is safe to run while the daemon is wedged.
+  const timeoutRaw = ctx.flag("timeout");
+  const timeoutSeconds =
+    timeoutRaw === undefined ? 1800 : Number.parseInt(timeoutRaw, 10);
+  const timeoutMs = (Number.isNaN(timeoutSeconds) ? 1800 : timeoutSeconds) * 1000;
+  let result!: RestartResult;
+  const deps: UpgradeDeps = {
+    ...DEFAULT_DEPS,
+    setPaused: (v, project) =>
+      setPaused(v, { source: "restart", reason: "restart, draining" }, project),
+    restartDaemon: async () => {
+      result = await restartDaemon({
+        port: ctx.portFlag(),
+        project: ctx.projectFlag,
+        provenance,
+        record,
+      });
+    },
+  };
+  // Record the request at ENTRY, before the drain: a caller that disconnects
+  // or hits --timeout while workers drain never reaches the lifecycle
+  // chokepoint, and the durable provenance must survive that — it is exactly
+  // the stop-with-no-witness incident #378 exists for (#378).
+  store.recordDaemonStop(provenance);
+  try {
+    await drainAndRestart(deps, { project: ctx.projectFlag, timeoutMs });
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+  }
+  if (result.previous !== undefined) {
+    process.stdout.write(
+      `stopped — pid ${result.previous.pid}${result.via === "systemctl" ? " (via systemctl)" : ""}\n`,
+    );
+  }
   process.stdout.write(
-    `stopped — pid ${result.previous.pid}${result.via === "systemctl" ? " (via systemctl)" : ""}\n`,
+    `started — pid ${result.record.pid}, /healthz on :${result.record.port}` +
+      `${result.record.project === undefined ? "" : `, project ${result.record.project}`}` +
+      `${result.via === "systemctl" ? " (via systemctl)" : ""}\nlog ${result.record.logFile}\n`,
   );
+} finally {
+  store.close();
 }
-process.stdout.write(
-  `started — pid ${result.record.pid}, /healthz on :${result.record.port}` +
-    `${result.record.project === undefined ? "" : `, project ${result.record.project}`}` +
-    `${result.via === "systemctl" ? " (via systemctl)" : ""}\nlog ${result.record.logFile}\n`,
-);
 }

package/src/commands/setup.ts

@@ -9,10 +9,11 @@
 import type { CommandContext } from "./context.ts";
 import { findProject, loadConfig, resolveCaps } from "../config.ts";
 import { AMEND_AREA_IDS, type AmendAreaId } from "../setup.ts";
-import { runGraphInstall, runHostInstall } from "../setup-install.ts";
+import { runGraphInstall, runHostInstall, type InstallOutcome } from "../setup-install.ts";
 import { DEFAULT_PROBES, NO_PROBES, setup } from "../setup-wizard.ts";
 import { telegramStateDir } from "../fleet.ts";
 import { terminalUi } from "../wizard-ui.ts";
+import type { ConductorConfig, ProjectConfig } from "../types.ts";
 
 /**
  * The setup verb's own usage, printed for `setup --help` / `setup -h` before
@@ -25,18 +26,43 @@ and the staged host files behind one confirm.
 
 usage:
   omp-conductor setup [area] [--no-ai] [--project NAME]
+  omp-conductor setup host [NAME] [--project NAME]
+  omp-conductor setup graph [--no-seed] [--print] [--project NAME]
 
   Bare setup runs the full interview — or, when the project already exists,
   asks which area to amend. Naming an area positionally skips that chooser and
-  amends only that area.
+  amends only that area. \`setup host\` and \`setup graph\` are install
+  subcommands, not areas: the NAME (or --project NAME) says which project to
+  install for.
 
 amend areas:
   ${AMEND_AREA_IDS.join(", ")}
 
 flags:
-  --project NAME   the project to configure or amend
+  --project NAME   the project to configure or amend (or NAME positionally
+                   for \`setup host\`)
   --no-ai          ask every question, propose nothing (no AI repo reads)`;
 
+/**
+ * Resolve the project an install subcommand (`setup host`, `setup graph`)
+ * installs for — the flag, or the positional form an operator naturally
+ * types on a multi-project host (`setup host conductor`). The pair may not
+ * disagree, and an unknown name fails loudly as "Unknown project …" rather
+ * than being silently ignored (#514).
+ */
+export function setupInstallProject(
+  cfg: ConductorConfig,
+  projectFlag: string | undefined,
+  positionalName: string | undefined,
+): ProjectConfig {
+  if (projectFlag !== undefined && positionalName !== undefined && projectFlag !== positionalName) {
+    throw new Error(
+      `setup names two different projects (--project ${projectFlag} and ${positionalName}) — pass one`,
+    );
+  }
+  return findProject(cfg, projectFlag ?? positionalName);
+}
+
 export async function setupCommand(ctx: CommandContext): Promise<void> {
 // Help first, and only in the first trailing position: a help request
 // must never open a UI, read config, probe GitHub or pause dispatch.
@@ -58,14 +84,38 @@ try {
   // is how `setup host` came to exit 2 as an "unknown setup area".
   if (positional === "host" || positional === "graph") {
     const cfg = loadConfig();
-    const project = findProject(cfg, ctx.projectFlag);
-    const outcome =
-      positional === "host"
-        ? await runHostInstall(project, resolveCaps(project, cfg.defaults), telegramStateDir(), ui)
-        : await runGraphInstall(project, ui, {
-            noSeed: ctx.argv.includes("--no-seed"),
-            print: ctx.argv.includes("--print"),
-          });
+    // `setup host <name>`: the project an operator would naturally type.
+    // The positional only ever names a project; anything else that does not
+    // look like a flag is refused by findProject below rather than being
+    // quietly ignored.
+    const positionalName =
+      positional === "host" && ctx.argv[2] !== undefined && !ctx.argv[2].startsWith("--")
+        ? ctx.argv[2]
+        : undefined;
+    let outcome: InstallOutcome;
+    if (positional === "host") {
+      // No `--project` and no positional → a host-global install (#530): the
+      // units are host-global, so a multi-project host installs them with no
+      // name and skips the per-project tail (tick config, brief link) with a
+      // named note; a name resolves and wires the tail.
+      const project =
+        ctx.projectFlag === undefined && positionalName === undefined
+          ? undefined
+          : setupInstallProject(cfg, ctx.projectFlag, positionalName);
+      outcome = await runHostInstall(
+        project,
+        project === undefined ? cfg.defaults : resolveCaps(project, cfg.defaults),
+        telegramStateDir(),
+        ui,
+      );
+    } else {
+      // `setup graph` is inherently per-project repositories; there is no
+      // host-global graph to install, so a project must resolve.
+      outcome = await runGraphInstall(findProject(cfg, ctx.projectFlag), ui, {
+        noSeed: ctx.argv.includes("--no-seed"),
+        print: ctx.argv.includes("--print"),
+      });
+    }
     // `staged` is a success on a host that has no systemd: the files are
     // real, only the enable step is impossible.
     if (outcome.kind === "refused" || outcome.kind === "failed") process.exit(1);

package/src/commands/stop.ts

@@ -7,8 +7,10 @@
  */
 
 import type { CommandContext } from "./context.ts";
+import { buildStopProvenance } from "../stop-provenance.ts";
 import { hold, pinPaneHalt, stopConductorPane } from "../fleet.ts";
 import { stopDaemon } from "../lifecycle.ts";
+import { openStore, dbPath } from "../store.ts";
 
 export async function stopCommand(ctx: CommandContext): Promise<void> {
 const withPane = ctx.argv.includes("--pane");
@@ -24,28 +26,49 @@ const targets = ctx.targetProjects().map((project) => {
     pin: withPane ? pinPaneHalt(project.name).path : undefined,
   };
 });
-const stop = await stopDaemon();
-const stopLine =
-  stop.kind === "not-running"
-    ? "daemon was not running"
-    : `daemon stopped — pid ${stop.pid}${stop.via === "systemctl" ? " (via systemctl)" : ""}`;
-for (const target of targets) {
-  if (target.pin !== undefined) {
-    const pane = await stopConductorPane(target.project.name);
-    process.stdout.write(
-      `stopped — claiming paused; ticks disarmed at ${target.hold.disarmed.path}\n` +
-        `${stopLine}\n` +
-        `pane recovery pinned at ${target.pin}\n` +
-        `pane stop: ${pane.stopped} — ${pane.detail}\n` +
-        `  (conductor agent "${pane.agentName}" only — herdr-fleet.service was NOT stopped;\n` +
-        `   resume clears the pin when you want recovery again)\n`,
-    );
-  } else {
-    process.stdout.write(
-      `stopped — claiming paused; ticks disarmed at ${target.hold.disarmed.path}\n` +
-        `${stopLine}\n` +
-        `pane left running (pass --pane to stop the conductor agent and pin recovery)\n`,
-    );
+const store = openStore(dbPath());
+try {
+  // Provenance (#378): the shared daemon serves every configured project, so
+  // the record names the request's own project (or the global scope) AND every
+  // sibling with its live-run count — no silent cross-project stop.
+  const provenance = buildStopProvenance({
+    controlPath: "cli stop",
+    reason: "operator stop",
+    scope: targets.length > 1 ? "global" : "project",
+    project: targets.length === 1 ? targets[0]!.project.name : undefined,
+  });
+  const stop = await stopDaemon({
+    provenance,
+    // The durable row is written by the lifecycle at the exact chokepoint —
+    // immediately before systemctl/SIGTERM, with the delivery method that is
+    // about to be used — which is what makes "provenance precedes signalling"
+    // provable rather than claimed.
+    record: (signal) => store.recordDaemonStop(signal.provenance),
+  });
+  const stopLine =
+    stop.kind === "not-running"
+      ? "daemon was not running"
+      : `daemon stopped — pid ${stop.pid}${stop.via === "systemctl" ? " (via systemctl)" : ""}`;
+  for (const target of targets) {
+    if (target.pin !== undefined) {
+      const pane = await stopConductorPane(target.project.name);
+      process.stdout.write(
+        `stopped — claiming paused; ticks disarmed at ${target.hold.disarmed.path}\n` +
+          `${stopLine}\n` +
+          `pane recovery pinned at ${target.pin}\n` +
+          `pane stop: ${pane.stopped} — ${pane.detail}\n` +
+          `  (conductor agent "${pane.agentName}" only — herdr-fleet.service was NOT stopped;\n` +
+          `   resume clears the pin when you want recovery again)\n`,
+      );
+    } else {
+      process.stdout.write(
+        `stopped — claiming paused; ticks disarmed at ${target.hold.disarmed.path}\n` +
+          `${stopLine}\n` +
+          `pane left running (pass --pane to stop the conductor agent and pin recovery)\n`,
+      );
+    }
   }
+} finally {
+  store.close();
 }
 }

package/src/commands/upgrade-rollback.ts

@@ -13,6 +13,15 @@ import type { CommandContext } from "./context.ts";
 import { rollbackFromJournal } from "../upgrade.ts";
 
 export async function upgradeRollbackCommand(ctx: CommandContext): Promise<void> {
+  // Nothing here varies by project (#514): the rollback restores every
+  // surface the failed install touched, from the host-wide journal. The
+  // flag only ever misled, so refuse it with a reason.
+  if (ctx.projectFlag !== undefined) {
+    process.stderr.write(
+      `omp-conductor: upgrade-rollback does not take a project — it restores the whole host from the upgrade journal\n`,
+    );
+    process.exit(2);
+  }
   const result = await rollbackFromJournal();
   process.stdout.write(
     `rolled back to omp-conductor@${result.restoredVersion} after the failed ` +

package/src/config-schema.ts

@@ -316,12 +316,21 @@ const projectSchema = z
     routing: routingSchema.optional(),
     caps: capsSchema.optional(),
     workerModel: z.unknown().optional(),
+    // The loader normalises both of these (trimmed entries / positive integer),
+    // so the schema admits any shape and lets the normaliser decide what is
+    // usable, exactly like `workerModel`.
+    modelFallbacks: z.unknown().optional(),
+    modelFallbackThreshold: z.unknown().optional(),
     escalation: escalationSchema.optional(),
     authority: authoritySchema.optional(),
     releasePolicy: releasePolicySchema.optional(),
     policy: projectPolicySchema.optional(),
     recoveryMerges: recoveryMergesSchema.optional(),
     reporting: reportingSchema.optional(),
+    // Hand-edited safety markers (commit SHAs or refs) a preserved continuation
+    // branch must contain before it may be reattached; the loader normalises
+    // them like `modelFallbacks`.
+    criticalBase: z.unknown().optional(),
     // Roots silently fall back to the default when unusable, so the schema
     // admits any shape and the normaliser picks the usable path.
     workspaceRoot: z.unknown().optional(),

package/src/config.ts

@@ -355,8 +355,11 @@ export function findProject(c: ConductorConfig, name?: string): ProjectConfig {
   if (name === undefined) {
     const only = c.projects[0];
     if (c.projects.length !== 1 || only === undefined) {
+      // #514: every operator hitting this has to guess the spelling of the
+      // flag that names a project — say it outright. Doctor's project finding
+      // quotes this text, so keep the "name one explicitly" phrase.
       throw new Error(
-        `Ambiguous project: config has ${c.projects.length} projects (${names.join(", ") || "none"}) — name one explicitly.`,
+        `Ambiguous project: config has ${c.projects.length} projects (${names.join(", ") || "none"}) — name one explicitly with --project NAME.`,
       );
     }
     return only;
@@ -1080,6 +1083,34 @@ function finalizeProject(
   const workerModel =
     typeof rawWorkerModel === "string" && rawWorkerModel.trim() !== "" ? rawWorkerModel : undefined;
 
+  // The failover chain is a hint like workerModel, not a ceiling: an unusable
+  // entry or a malformed threshold is dropped rather than failing the load,
+  // and absent/empty `modelFallbacks` keeps today's dispatch byte for byte.
+  const rawFallbacks = p["modelFallbacks"];
+  const modelFallbacks = Array.isArray(rawFallbacks)
+    ? rawFallbacks
+        .filter((entry): entry is string => typeof entry === "string")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+    : [];
+  const rawThreshold = p["modelFallbackThreshold"];
+  const modelFallbackThreshold =
+    typeof rawThreshold === "number" && Number.isInteger(rawThreshold) && rawThreshold >= 1
+      ? rawThreshold
+      : undefined;
+
+  // Marked critical-base/safety markers (commit SHAs or refs). A continuation
+  // branch must contain every one before the dispatcher may reattach it;
+  // unusable entries are dropped like `modelFallbacks` and an absent or empty
+  // list keeps today's behaviour byte for byte.
+  const rawCriticalBase = p["criticalBase"];
+  const criticalBase = Array.isArray(rawCriticalBase)
+    ? rawCriticalBase
+        .filter((entry): entry is string => typeof entry === "string")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+    : [];
+
   if (problems.length > before) return undefined;
 
   return {
@@ -1095,12 +1126,15 @@ function finalizeProject(
     routing: { labelPrefix, repos },
     caps,
     ...(workerModel === undefined ? {} : { workerModel }),
+    ...(modelFallbacks.length === 0 ? {} : { modelFallbacks }),
+    ...(modelFallbackThreshold === undefined ? {} : { modelFallbackThreshold }),
     escalation,
     authority,
     releasePolicy,
     policy,
     ...(recoveryMerges === undefined ? {} : { recoveryMerges }),
     reporting,
+    ...(criticalBase.length === 0 ? {} : { criticalBase }),
     workspaceRoot: expandHome(pickString(p["workspaceRoot"], defaultWorkspaceRoot())),
     mirrorRoot: expandHome(pickString(p["mirrorRoot"], defaultMirrorRoot())),
   };