omp-conductor 0.15.6 → 0.15.7

package/src/verbs/server.ts

@@ -120,7 +120,15 @@ export type VerbChannel =
       role: "orchestrator";
     };
 
-export type ActionOutcome = { ok: true; sha?: string; detail?: string } | { ok: false; stderr: string };
+export type ActionOutcome =
+  | {
+      ok: true;
+      sha?: string;
+      detail?: string;
+      /** A reviewable version bump. New PRs return immediately; existing ones are re-checked and merged. */
+      review?: { prUrl: string; created: boolean };
+    }
+  | { ok: false; stderr: string };
 
 /** What one release asks the privileged half to do, after policy said yes. */
 export interface ReleaseExecution {
@@ -645,11 +653,15 @@ function runForPr(deps: VerbDeps, project: string, prUrl: string): RunRecord | u
  * opened (workflow-generated release pins, etc.). Scope is the routed clone
  * slugs — not "any PR a run once recorded".
  */
-function prInProjectRouting(project: ProjectConfig, prUrl: string): boolean {
+function repoForPr(project: ProjectConfig, prUrl: string): RepoTarget | undefined {
   const parts = prUrlParts(prUrl);
-  if (parts === undefined) return false;
+  if (parts === undefined) return undefined;
   const slug = `${parts.owner}/${parts.repo}`;
-  return Object.values(project.routing.repos).some((repo) => repoSlugFor(repo) === slug);
+  return Object.values(project.routing.repos).find((repo) => repoSlugFor(repo) === slug);
+}
+
+function prInProjectRouting(project: ProjectConfig, prUrl: string): boolean {
+  return repoForPr(project, prUrl) !== undefined;
 }
 
 /** Refuse an orchestrator completion mutation that cannot prove a pre-pause run. */
@@ -747,11 +759,26 @@ async function prMergeVerb(
   refuse: Refuse,
   allow: Allow,
 ): Promise<Verdict> {
-  // The grant says *who*. Compared against the caller rather than tested for a
-  // single forbidden value: `authority` has two holders, so `!== "human"` would
-  // have let a worker through, and `"human"` has to refuse the orchestrator too.
+
+  const prUrl = String(args["prUrl"]);
+  const headSha = String(args["headSha"]);
+  const reason = String(args["reason"]);
+  const target = runForPr(deps, project.name, prUrl);
+  const recovery =
+    target === undefined
+      ? project.recoveryMerges?.find((authorization) => authorization.prUrl === prUrl)
+      : undefined;
+  const routedRepo = repoForPr(project, prUrl);
+  const authorizedRecovery =
+    recovery !== undefined &&
+    recovery.headSha.toLowerCase() === headSha.toLowerCase() &&
+    recovery.reason === reason;
+
+  // Ordinary calls obey the standing holder. A recovery entry is itself the
+  // operator's one-PR grant to the orchestrator, so its exact URL/head/reason
+  // match replaces that broad holder check without widening any other merge.
   const holder = project.authority.merge;
-  if (holder !== channel.role) {
+  if (holder !== channel.role && !authorizedRecovery) {
     return refuse(
       "authority-holder",
       `refused: merge authority is the ${holder}'s for ${project.name}, and this is a ${channel.role} session. ` +
@@ -760,16 +787,27 @@ async function prMergeVerb(
           : "Ask the operator which session is meant to hold it."),
     );
   }
-
-  const prUrl = String(args["prUrl"]);
-  const headSha = String(args["headSha"]);
-  const target = runForPr(deps, project.name, prUrl);
-  if (target === undefined) {
+  if (target === undefined && recovery === undefined) {
     return refuse("pr-not-this-run", `refused: ${prUrl} is not a pull request any run in ${project.name} opened.`);
   }
+  if (target === undefined && routedRepo === undefined) {
+    return refuse(
+      "pr-not-this-run",
+      `refused: ${prUrl} is not in ${project.name}'s routed repositories; a recovery authorization cannot widen project scope.`,
+    );
+  }
+  if (recovery !== undefined && !authorizedRecovery) {
+    return refuse(
+      "recovery-authorization-mismatch",
+      `refused: ${prUrl} has a recovery authorization, but not for this exact head and reason.`,
+    );
+  }
+  const issue = target?.issue;
 
-  const paused = orchestratorPauseRefusal(deps, channel, target, refuse);
-  if (paused !== undefined) return paused;
+  if (!authorizedRecovery) {
+    const paused = orchestratorPauseRefusal(deps, channel, target, refuse);
+    if (paused !== undefined) return paused;
+  }
 
   // Taken before any network call, so two concurrent callers contend here
   // rather than both spending a `gh` round trip and racing at the merge.
@@ -782,7 +820,7 @@ async function prMergeVerb(
       `refused: a merge is already in flight for ${project.name}` +
         (live === undefined ? "" : ` (${live.prUrl})`) +
         ". PRs land one at a time, each re-checked against its base: two agent merges at once is how they clobber each other.",
-      target.issue,
+      issue,
     );
   }
 
@@ -795,13 +833,13 @@ async function prMergeVerb(
       verification = await deps.tracker.verifyPr(prUrl, headSha);
     } catch (err) {
       const why = err instanceof Error ? err.message : String(err);
-      return refuse("head-unresolvable", `refused: the live head of ${prUrl} could not be read (${why}).`, target.issue);
+      return refuse("head-unresolvable", `refused: the live head of ${prUrl} could not be read (${why}).`, issue);
     }
     if (verification === undefined) {
       return refuse(
         "head-unresolvable",
         `refused: the live head of ${prUrl} could not be resolved. Refusing rather than merging what you last saw.`,
-        target.issue,
+        issue,
       );
     }
     if (verification.status !== "green") {
@@ -812,11 +850,14 @@ async function prMergeVerb(
           ? `refused: ${verification.reason}. You asked to merge ${headSha}; that is not what is on the branch now. ` +
             "Re-read the head, re-check the checks at it, and call again."
           : `refused: ${prUrl} is not mergeable at ${headSha} — ${verification.reason}.`,
-        target.issue,
+        issue,
       );
     }
 
-    const repoTarget = Object.values(project.routing.repos).find((r) => r.name === target.repo);
+    const repoTarget =
+      target === undefined
+        ? routedRepo
+        : Object.values(project.routing.repos).find((repo) => repo.name === target.repo);
     const chainDir = repoTarget?.migrations?.dir;
     if (chainDir !== undefined && repoTarget !== undefined) {
       // Checked against the base tip at merge time, not against a stale advisory:
@@ -826,7 +867,7 @@ async function prMergeVerb(
         return refuse(
           "chain-unreadable",
           `refused: the diff of ${prUrl} could not be read, so the migration chain in ${chainDir} cannot be verified. Failing closed: a wrong merge here is a silent production schema drift (#227).`,
-          target.issue,
+          issue,
         );
       }
       const { added, changed, deleted } = chainEntriesFromDiff(diff.files, chainDir);
@@ -835,7 +876,7 @@ async function prMergeVerb(
           return refuse(
             "chain-unreadable",
             `refused: the diff of ${prUrl} was truncated and it touches ${chainDir} — the chain cannot be verified from a partial diff.`,
-            target.issue,
+            issue,
           );
         }
         const base = await deps.chain.readBaseChain(project, repoTarget, chainDir);
@@ -843,7 +884,7 @@ async function prMergeVerb(
           return refuse(
             "chain-unreadable",
             `refused: could not read ${chainDir} at the tip of ${repoTarget.defaultBranch} (${base.stderr}).`,
-            target.issue,
+            issue,
           );
         }
         const violations = chainViolations({ base: base.entries, added, changed, deleted });
@@ -851,7 +892,7 @@ async function prMergeVerb(
           return refuse(
             "chain-conflict",
             `refused: merging ${prUrl} would corrupt the ordered migration chain in ${chainDir} — ${violations.join("; ")}. Rebase onto the current tip, regenerate the migration, and call again.`,
-            target.issue,
+            issue,
           );
         }
       }
@@ -859,12 +900,14 @@ async function prMergeVerb(
 
     const outcome = await deps.actions.mergePr(prUrl, headSha);
     if (!outcome.ok) {
-      return refuse("action-failed", `refused: gh could not merge:\n${outcome.stderr}`, target.issue);
+      return refuse("action-failed", `refused: gh could not merge:\n${outcome.stderr}`, issue);
     }
     return allow(
-      `merged ${prUrl} at ${headSha} (${verification.reason}).`,
+      `merged ${prUrl} at ${headSha} (${verification.reason})${
+        recovery === undefined ? "." : " under its exact operator recovery authorization."
+      }`,
       outcome.sha ?? headSha,
-      target.issue,
+      issue,
     );
   } finally {
     deps.store.releaseMergeLock(project.name, holderId);
@@ -1031,6 +1074,77 @@ async function releaseVerb(
   if (!outcome.ok) {
     return refuse("action-failed", `refused: the release command failed:\n${outcome.stderr}`);
   }
+  if (shape === "version-bump-pr") {
+    if (outcome.review === undefined) {
+      return allow(
+        `release version for ${repo.name} is already prepared${outcome.detail === undefined ? "" : ` — ${outcome.detail}`}.`,
+        outcome.sha,
+      );
+    }
+    if (outcome.sha === undefined) {
+      return refuse("action-failed", "refused: version-bump-pr returned no exact pull-request head.");
+    }
+    if (outcome.review.created) {
+      return allow(
+        `opened release preparation ${outcome.review.prUrl} at ${outcome.sha}; wait for its checks, then call version-bump-pr again.`,
+        outcome.sha,
+      );
+    }
+
+    const holderId = randomUUID();
+    const lock = deps.store.acquireMergeLock(
+      project.name,
+      holderId,
+      outcome.review.prUrl,
+      deps.now(),
+      MERGE_LOCK_STALE_MS,
+    );
+    if (lock === undefined) {
+      const live = deps.store.mergeLock(project.name);
+      return refuse(
+        "merge-in-flight",
+        `refused: a merge is already in flight for ${project.name}` +
+          (live === undefined ? "" : ` (${live.prUrl})`) +
+          ". Release preparation waits for the project's single merge slot.",
+      );
+    }
+    try {
+      let verification: PrVerification | undefined;
+      try {
+        verification = await deps.tracker.verifyPr(outcome.review.prUrl, outcome.sha);
+      } catch (err) {
+        const why = err instanceof Error ? err.message : String(err);
+        return refuse(
+          "head-unresolvable",
+          `refused: the live head of release preparation ${outcome.review.prUrl} could not be read (${why}).`,
+        );
+      }
+      if (verification === undefined) {
+        return refuse(
+          "head-unresolvable",
+          `refused: the live head of release preparation ${outcome.review.prUrl} could not be resolved.`,
+        );
+      }
+      if (verification.status !== "green") {
+        const stale = verification.status === "failed" && isHeadMismatch(verification.reason);
+        return refuse(
+          stale ? "head-stale" : "checks-not-green",
+          `refused: release preparation ${outcome.review.prUrl} is not mergeable at ${outcome.sha} — ${verification.reason}.`,
+        );
+      }
+
+      const merged = await deps.actions.mergePr(outcome.review.prUrl, outcome.sha);
+      if (!merged.ok) {
+        return refuse("action-failed", `refused: gh could not merge the release preparation:\n${merged.stderr}`);
+      }
+      return allow(
+        `merged release preparation ${outcome.review.prUrl} at ${outcome.sha}; git-tag remains refused until the live version matches.`,
+        merged.sha ?? outcome.sha,
+      );
+    } finally {
+      deps.store.releaseMergeLock(project.name, holderId);
+    }
+  }
   return allow(
     `cut ${shape} for ${repo.name}${outcome.detail === undefined ? "" : ` — ${outcome.detail}`}.`,
     outcome.sha,