omp-conductor 0.15.13 → 0.16.0

package/REFERENCE.md

@@ -979,6 +979,41 @@ honour the pattern it says so, and the daemon logs that per run:
 Worth reading the log for. A run that quietly used a weaker model than you chose
 otherwise looks like a run that was merely unlucky.
 
+## Omp settings overlay
+
+`ompSettings` on a project is the fleet-owned channel for saying "this project's
+workers run with *these* omp settings" without editing the daemon account's
+global `~/.omp/agent/config.yml`. The value is an opaque map serialised verbatim
+to a YAML overlay file by the dispatcher, under the run's own session directory
+(never inside the worktree), and threaded to the session through omp's own
+`Settings.init({ configFiles: [<path>] })` seam. Conductor validates YAML shape
+only — omp owns the schema; an unknown key or a wrong-typed value is omp's to
+reject, never conductor's to understand.
+
+```json
+"ompSettings": {
+  "retry": {
+    "modelFallback": true,
+    "fallbackChains": {
+      "default": ["openai/gpt-4o-mini", "google/gemini-x"]
+    }
+  },
+  "modelRoles": {
+    "worker": "@slow"
+  }
+}
+```
+
+The overlay is deep-merged **after** the daemon account's global config and any
+project `<cwd>/.omp/config.yml`, so it layers on top of both without erasing
+either. A config edit takes effect on the next dispatch (the overlay is
+rewritten on every attempt), and a project without the field dispatches
+byte-for-byte as it always has.
+
+The retry keys derived from `modelFallbacks` are merged into the effective
+overlay (unless the map already names a `retry` mapping), which is where
+#539's within-run staging lives.
+
 ## Code-graph discovery
 
 Optional, off unless you answer yes in the wizard, and worth answering yes to for
@@ -1409,7 +1444,38 @@ refused rather than overwriting the first answer.
 anything is open: `decisions 2 open (oldest 26h)`, or `decisions none open`. A
 row that appeared only when something was outstanding would leave "it forgot to
 record the question" and "there genuinely is none" looking identical, which is
-the ambiguity this table exists to remove.
+the ambiguity this table exists to remove. `decisions N open` counts only rows a
+human must answer (#459): watches the orchestrator set for itself are reported
+separately, as `· watches N`, so a fleet waiting on GitHub's checks is never
+mistaken for a fleet waiting on its operator.
+
+### Watches, and the split from questions (#459)
+
+A front-row sharp edge: the floor's no-sleep rule said "anything that needs
+waiting for is a watch (`decision open --resolves-when …`)". So the orchestrator
+opened its own conditions as decision rows — "merge #576 once its checks are
+green" — and every one of them rendered, counted and expired exactly like a
+question put to you. `omp-conductor status` reported `decisions 3 open` and the
+tick prompt listed them under "Open operator decisions … resolve or withdraw",
+so you reasonably read a self-reminder as an ask aimed at you. The fix is a
+durable split at the row, never a heuristic over the wording or over whether a
+condition is attached (a real question may carry one too):
+
+```bash
+omp-conductor watch add --note "merge #576 once its checks are green on the rebased head" \
+  --blocks "#576 merge" --resolves-when pr-checks-green:https://github.com/acme/api/pull/576
+omp-conductor watch list
+```
+
+A watch is a row `kind: watch` that the orchestrator opened for itself — either
+a `--resolves-when` condition (the daemon checks it and wakes the next tick when
+met, exactly as for a question), or a plain carry note the next tick should
+read. It renders under its own "Watches" heading, is never offered to you to
+resolve, and has **no seven-day expiry** — that deadline is for a question
+nobody answered; silently expiring a watch could drop a release the day its
+condition finally fires. A superseded watch is closed with the ordinary
+`decision withdraw <id>`. `decision open --resolves-when` still records an
+operator question: a condition governs *when* to ask, not *who* answers.
 
 ## Failure classes and recovery by class (#132)
 
@@ -2169,6 +2235,8 @@ omp-conductor decision open --question TEXT [--blocks TEXT] [--resolves-when CON
 omp-conductor decision resolve <id> --answer TEXT [--project NAME]
 omp-conductor decision withdraw <id> [--reason TEXT] [--project NAME]
 omp-conductor decision list [--project NAME]
+omp-conductor watch add --note TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
+omp-conductor watch list [--project NAME]
 omp-conductor daemon [--once] [--port N] [--project NAME]
 omp-conductor resume [--project NAME]
 omp-conductor brief-upgrade [--migrate|--retrofit] [--apply] [--file PATH] [--project NAME]
@@ -2202,7 +2270,9 @@ omp-conductor help
 | `decision open --question TEXT [--blocks TEXT] [--resolves-when COND]` | project | Record a question the orchestrator has put to you, and print its id. A question that lives only in a session's context is lost at the next compaction — after which it is either asked twice or dropped silently. `--resolves-when` attaches a machine-checkable condition: `pr-merged:<https url>`, `pr-checks-green:<https url>`, `pr-mergeable:<https url>`, `issue-closed:<n>`, `npm-version:<pkg>@<version>`, or `rate-limit-reset:github`; anything else exits `2` listing the six forms. See [The decision ledger](#the-decision-ledger-136). |
 | `decision resolve <id> --answer TEXT` | project | Record what you decided. Exits `1` naming the id when it is unknown or no longer open, so a second answer cannot overwrite the first. |
 | `decision withdraw <id> [--reason TEXT]` | project | Close a question the session stopped needing, with why. Same guard as `resolve`. |
-| `decision list` | project | Open questions, oldest first: id, age, what each blocks, whether its condition is met, and the question. Prints `no open decisions` when there are none. |
+| `decision list` | project | Open questions, oldest first: id, age, what each blocks, whether its condition is met, and the question. Prints `no open decisions` when there are none. Watches are not listed here — `watch list` shows those. |
+| `watch add --note TEXT [--blocks TEXT] [--resolves-when COND]` | project | Record a condition or carry note the orchestrator set for itself, with no human in the loop (#459). `--resolves-when` attaches a machine-checkable condition the daemon checks for you; a met watch wakes the next tick exactly as a met question does. Renders under its own "Watches" heading, is never counted in `decisions N open`, and has no seven-day expiry. |
+| `watch list` | project | Open watches, oldest first: id, age, what each blocks, whether its condition is met, and the note. Prints `no watches` when there are none. |
 | `daemon` | host | Run the loop in the **foreground**, ticking every 5 minutes and serving `/healthz`. Admitted workers run in a tracked background pool, so settlement and capacity checks remain periodic while they work; shutdown drains the pool before closing the store. This is what `start` launches and what a systemd unit should call. |
 | `daemon --once` | host | Run a single tick, wait for workers admitted by that tick, and exit. No HTTP server or pidfile — a drill must not register itself as the daemon, or the next reader believes it and the real daemon's in-flight runs get reconciled as orphans. |
 | `--port N` | — | Accepted by `start`, `restart` and `daemon`. Both `--port 9000` and `--port=9000` work; missing or out of range exits `2` rather than falling back to the default, because probing the wrong endpoint is worse than a hard failure. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.15.13",
+  "version": "0.16.0",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",
@@ -33,6 +33,7 @@
     "schema": "bun run src/generate-schema.ts"
   },
   "dependencies": {
+    "yaml": "^2.9.0",
     "zod": "^4"
   },
   "peerDependencies": {

package/schema/config.schema.json

@@ -94,6 +94,11 @@
       "additionalProperties": {},
       "description": "Per-fleet or per-project hard limits"
     },
+    "dbBackupDir": {
+      "description": "Absolute directory for restorable conductor.db snapshots; defaults to <stateDir>/backups/db",
+      "type": "string",
+      "minLength": 1
+    },
     "projects": {
       "minItems": 1,
       "type": "array",
@@ -299,6 +304,7 @@
           "workerModel": {},
           "modelFallbacks": {},
           "modelFallbackThreshold": {},
+          "ompSettings": {},
           "escalation": {
             "type": "object",
             "properties": {