omp-conductor 0.15.13 → 0.16.0

package/src/commands/unfreeze.ts

@@ -0,0 +1,56 @@
+/**
+ * `unfreeze <repo>` — the operator's sanctioned override for a base-red-freeze.
+ *
+ * A base-red-freeze is a mechanical gate: `prMergeVerb` refuses every
+ * `conductor_pr_merge` to a repo whose base is red, and the floor binds even
+ * the orchestrator to that refusal. This verb is the *one* sanctioned way to
+ * lift it early — after the operator has judged the base repaired (or the
+ * merge warranted anyway) — and it is ledger-recorded: the freeze row keeps
+ * `clearedBy`/`clearedReason`/`clearedAt` as its durable override audit, and a
+ * material event names the override for the queue digest. It is deliberately
+ * not label surgery or a raw DB edit, and it does not re-arm — a still-red base
+ * will re-freeze the repo on the next watch observation.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { dbPath, openStore } from "../store.ts";
+
+export async function unfreezeCommand(ctx: CommandContext): Promise<void> {
+  const repo = ctx.argv[1];
+  if (repo === undefined || repo.length === 0 || repo.startsWith("-")) {
+    process.stderr.write("omp-conductor: unfreeze needs the routed repo name, e.g. `omp-conductor unfreeze api`\n");
+    process.exit(2);
+  }
+  const reason = ctx.flag("--reason") ?? "operator-override";
+  const cfg = loadConfig();
+  const project = findProject(cfg, ctx.projectFlag);
+  const store = openStore(dbPath());
+  try {
+    const now = Date.now();
+    const lifted = store.clearBaseFreeze(project.name, repo, "operator", reason, now);
+    if (!lifted) {
+      process.stdout.write(
+        `unfreeze: ${repo} has no active base-red freeze in ${project.name} (merges already allowed). Nothing to lift.\n`,
+      );
+      return;
+    }
+    store.recordMaterialEvent({
+      project: project.name,
+      category: "unfreeze",
+      summary: `operator unfroze merges to ${repo} (${reason})`,
+      evidence:
+        `An operator lifted the base-red-freeze on ${repo} with reason "${reason}". ` +
+        "This is the sanctioned override path — the freeze re-arms automatically if the base is " +
+        "observed red again.",
+      occurredAt: now,
+      recordedAt: now,
+    });
+    process.stdout.write(
+      `unfreeze: ${repo} base-red freeze lifted in ${project.name} (reason: ${reason}). ` +
+        "Merges to this repo resume; a still-red base will re-freeze on the next watch observation.\n",
+    );
+  } finally {
+    store.close();
+  }
+}

package/src/commands/watch.ts

@@ -0,0 +1,77 @@
+/**
+ * `watch` — set a condition for the orchestrator itself, with no human in the
+ * loop (#459).
+ *
+ * The split exists because the old `decision open --resolves-when` kept
+ * producing rows rendered as questions put to the operator — the fleet looked
+ * like it was waiting on a person when it was waiting on GitHub. A watch is a
+ * row the orchestrator opened for itself: either a condition the daemon checks
+ * (`--resolves-when`) that wakes the next tick when met, or a carry note the
+ * next tick should read, neither of which ever needs an operator answer. It is
+ * distinguished durably by its `kind`, never by whether it carries a
+ * condition — a real question may carry one too.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { CONDITION_FORMS, parseCondition } from "../decisions.ts";
+import { dbPath, openStore } from "../store.ts";
+
+export async function watchCommand(ctx: CommandContext): Promise<void> {
+  const sub = ctx.argv[1];
+  const project = findProject(loadConfig(), ctx.projectFlag);
+  const store = openStore(dbPath());
+  try {
+    if (sub === "add") {
+      const note = ctx.flag("note")?.trim();
+      if (note === undefined || note.length === 0 || note.startsWith("--")) {
+        process.stderr.write("omp-conductor: watch add needs --note with what the next tick should know\n");
+        process.exit(2);
+      }
+      const condition = ctx.flag("resolves-when")?.trim();
+      if (condition !== undefined && parseCondition(condition) === undefined) {
+        process.stderr.write(
+          `omp-conductor: --resolves-when must be one of:\n${CONDITION_FORMS.map((f) => `  ${f}`).join("\n")}\n`,
+        );
+        process.exit(2);
+      }
+      const blocks = ctx.flag("blocks")?.trim();
+      const watch = store.createDecision({
+        project: project.name,
+        question: note,
+        kind: "watch",
+        ...(blocks === undefined || blocks.length === 0 ? {} : { blocks }),
+        ...(condition === undefined ? {} : { condition }),
+        at: Date.now(),
+      });
+      const wake = condition === undefined ? "read by the next tick" : "the daemon wakes the next tick when it is met";
+      process.stdout.write(`watch ${watch.id} added — ${wake} (no operator answer needed)\n`);
+      return;
+    }
+
+    if (sub === "list" || sub === undefined) {
+      const watches = store.openDecisions(project.name).filter((d) => d.kind === "watch");
+      if (watches.length === 0) {
+        process.stdout.write("no watches\n");
+        return;
+      }
+      const now = Date.now();
+      for (const d of watches) {
+        const condition =
+          d.condition === undefined ? "-" : d.conditionMetAt === undefined ? "pending" : "met";
+        const hours = Math.max(0, Math.round((now - d.askedAt) / 3_600_000));
+        process.stdout.write(
+          `${d.id}  ${hours}h  blocks:${d.blocks ?? "-"}  condition:${condition}  ${d.question}\n`,
+        );
+      }
+      return;
+    }
+
+    process.stderr.write(
+      `omp-conductor: unknown watch subcommand "${sub}" — expected add or list\n`,
+    );
+    process.exit(2);
+  } finally {
+    store.close();
+  }
+}

package/src/config-schema.ts

@@ -321,6 +321,10 @@ const projectSchema = z
     // usable, exactly like `workerModel`.
     modelFallbacks: z.unknown().optional(),
     modelFallbackThreshold: z.unknown().optional(),
+    // The fleet-owned omp settings overlay (#537): an opaque map omp's own
+    // schema owns. Conductor validates YAML shape only — the loader keeps it
+    // when it is a mapping and drops anything else, like `modelFallbacks`.
+    ompSettings: z.unknown().optional(),
     escalation: escalationSchema.optional(),
     authority: authoritySchema.optional(),
     releasePolicy: releasePolicySchema.optional(),
@@ -344,6 +348,11 @@ const configSchema = z
     $schema: z.string().optional().describe("Path to the shipped config.schema.json"),
     version: z.number().describe(`The config format version (${READABLE_CONFIG_VERSIONS.join(" or ")})`),
     defaults: capsSchema.optional(),
+    dbBackupDir: z
+      .string()
+      .min(1, "must name a directory")
+      .optional()
+      .describe("Absolute directory for restorable conductor.db snapshots; defaults to <stateDir>/backups/db"),
     projects: z.array(projectSchema).min(1, `"projects" must be a non-empty array — the dispatcher has nothing to service otherwise`),
   })
   .loose()

package/src/config.ts

@@ -124,6 +124,18 @@ export function configBackupDir(): string {
   return join(stateDir(), "backups", "config");
 }
 
+/**
+ * Where restorable `conductor.db` snapshots land: the configured `dbBackupDir`,
+ * or the state-root default `<stateDir()>/backups/db` beside the config
+ * backups when the field is absent. A `~/`-prefixed configured value is
+ * expanded like every other hand-written path field.
+ */
+export function dbBackupDirFor(cfg: Pick<ConductorConfig, "dbBackupDir"> | undefined): string {
+  const configured = cfg?.dbBackupDir;
+  const dir = configured !== undefined && configured.trim() !== "" ? expandHome(configured) : join(stateDir(), "backups", "db");
+  return dir;
+}
+
 /**
  * Where per-run worktrees and bare mirrors live when a project names neither.
  *
@@ -1099,6 +1111,17 @@ function finalizeProject(
       ? rawThreshold
       : undefined;
 
+  // The fleet-owned omp settings overlay (#537): an opaque map omp's own schema
+  // owns, so the loader validates YAML shape only — a non-mapping is dropped
+  // like an unusable `modelFallbacks` entry rather than failing the load, and
+  // an absent field keeps today's dispatch byte for byte. Everything inside the
+  // map is omp's to interpret, never conductor's.
+  const rawOmpSettings = p["ompSettings"];
+  const ompSettings =
+    typeof rawOmpSettings === "object" && rawOmpSettings !== null && !Array.isArray(rawOmpSettings)
+      ? (rawOmpSettings as Record<string, unknown>)
+      : undefined;
+
   // Marked critical-base/safety markers (commit SHAs or refs). A continuation
   // branch must contain every one before the dispatcher may reattach it;
   // unusable entries are dropped like `modelFallbacks` and an absent or empty
@@ -1128,6 +1151,7 @@ function finalizeProject(
     ...(workerModel === undefined ? {} : { workerModel }),
     ...(modelFallbacks.length === 0 ? {} : { modelFallbacks }),
     ...(modelFallbackThreshold === undefined ? {} : { modelFallbackThreshold }),
+    ...(ompSettings === undefined ? {} : { ompSettings }),
     escalation,
     authority,
     releasePolicy,