omp-conductor 0.16.2 → 0.17.1

package/src/commands/watch.ts

@@ -50,18 +50,27 @@ export async function watchCommand(ctx: CommandContext): Promise<void> {
     }
 
     if (sub === "list" || sub === undefined) {
-      const watches = store.openDecisions(project.name).filter((d) => d.kind === "watch");
+      const open = store.openDecisions(project.name).filter((d) => d.kind === "watch");
+      const now = Date.now();
+      const watches = open.map((d) => ({
+        id: d.id,
+        ageHours: Math.max(0, Math.round((now - d.askedAt) / 3_600_000)),
+        blocks: d.blocks ?? null,
+        condition: d.condition === undefined ? null : d.conditionMetAt === undefined ? "pending" : "met",
+        note: d.question,
+      }));
+      if (ctx.argv.includes("--json")) {
+        process.stdout.write(`${JSON.stringify({ project: project.name, watches }, null, 2)}\n`);
+        return;
+      }
       if (watches.length === 0) {
         process.stdout.write("no watches\n");
         return;
       }
-      const now = Date.now();
-      for (const d of watches) {
-        const condition =
-          d.condition === undefined ? "-" : d.conditionMetAt === undefined ? "pending" : "met";
-        const hours = Math.max(0, Math.round((now - d.askedAt) / 3_600_000));
+      for (const watch of watches) {
         process.stdout.write(
-          `${d.id}  ${hours}h  blocks:${d.blocks ?? "-"}  condition:${condition}  ${d.question}\n`,
+          `${watch.id}  ${watch.ageHours}h  blocks:${watch.blocks ?? "-"}  ` +
+            `condition:${watch.condition ?? "-"}  ${watch.note}\n`,
         );
       }
       return;

package/src/config-schema.ts

@@ -22,10 +22,12 @@
 
 import { z } from "zod";
 import {
+  ARM_PROOFS,
   AUTHORITY_HOLDERS,
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
   CONFIG_VERSION,
+  DEFAULT_ARM_PROOF,
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
@@ -239,6 +241,21 @@ const escalationSchema = z
   })
   .strict();
 
+/**
+ * The per-project arming gate (conductor #613): how `arm` proves a human just
+ * approved dispatch. Absent or a legacy config without the key loads as
+ * `challenge` — the authenticated round-trip, which is what existing installs
+ * already run. `claim-only` arms on the shared live-plumbing verdict with no
+ * Telegram send or wait, so an unattended recovery can re-arm a project that
+ * opted in.
+ */
+const armSchema = z
+  .object({
+    proof: z.enum([...ARM_PROOFS]).default(DEFAULT_ARM_PROOF),
+  })
+  .strict()
+  .describe("How `arm` proves a human just approved arming");
+
 const releasePolicySchema = z.union([
   releasePolicyLegacyEnum,
   z.record(z.string(), authorityHolderEnum),
@@ -330,6 +347,9 @@ const projectSchema = z
     // overlay); anything else is dropped by the loader, like `workerModel`.
     workerAdvisor: z.unknown().optional(),
     escalation: escalationSchema.optional(),
+    // How `arm` proves a human approved arming (#613); absent loads as
+    // `challenge`, preserving today's authenticated round-trip.
+    arm: armSchema.optional(),
     authority: authoritySchema.optional(),
     releasePolicy: releasePolicySchema.optional(),
     policy: projectPolicySchema.optional(),

package/src/config.ts

@@ -17,10 +17,12 @@ import { homedir } from "node:os";
 import { dirname, isAbsolute, join } from "node:path";
 import { backupTimestamp, copyToUniqueBackup } from "./backups.ts";
 import {
+  ARM_PROOFS,
   AUTHORITY_HOLDERS,
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
   CONFIG_VERSION,
+  DEFAULT_ARM_PROOF,
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
@@ -55,6 +57,7 @@ import {
   type WeeklyAvailability,
   type RepoTarget,
   type ResolvedGrants,
+  type ArmProof,
 } from "./types.ts";
 import {
   AUTHORITY_HOLDER_LIST,
@@ -313,6 +316,20 @@ export function resolvePolicy(p: ProjectConfig): ProjectPolicy {
   return clonePolicy(p.policy ?? DEFAULT_PROJECT_POLICY);
 }
 
+/**
+ * How this project's `arm` proves a human just approved arming (#613),
+ * complete.
+ *
+ * The loader always materialises `arm` (finalizeProject), so this is only ever
+ * the fallback for a `ProjectConfig` that never went through it — a hand-built
+ * one in a test, or a config written before the key existed. Absent resolves
+ * to {@link DEFAULT_ARM_PROOF} (`challenge`): the authenticated round-trip,
+ * which is the behaviour every existing install already has.
+ */
+export function resolveArmProof(p: ProjectConfig): ArmProof {
+  return p.arm?.proof === "claim-only" ? "claim-only" : DEFAULT_ARM_PROOF;
+}
+
 /**
  * A policy with no array shared with its source.
  *
@@ -835,6 +852,9 @@ function clauseFor(rel: readonly PropertyKey[], issue: {
       return `reporting.availability must be an object`;
     }
     if (rel.length === 1 && relStr === "escalation") return `escalation must be an object`;
+    if (rel.length === 1 && relStr === "arm") {
+      return `arm must be an object with a "proof" of ${ARM_PROOF_LIST}`;
+    }
     if (rel.length === 1 && relStr === "authority") {
       return `authority must be an object with "merge", "release" and "promotion" of ${AUTHORITY_HOLDER_LIST}`;
     }
@@ -995,6 +1015,9 @@ function capProblem(key: string, found: string): string {
 const POLICY_MERGE_KEYS = quoteList(Object.keys(clonePolicy(DEFAULT_PROJECT_POLICY).merge));
 const POLICY_RELEASE_KEYS = quoteList(Object.keys(clonePolicy(DEFAULT_PROJECT_POLICY).release));
 
+/** The closed `arm.proof` vocabulary, for the not-an-object wording. */
+const ARM_PROOF_LIST = quoteList(ARM_PROOFS);
+
 // ---------------------------------------------------------------------------
 // residue: cross-field coherence, migrations, defaults, path expansion
 // ---------------------------------------------------------------------------
@@ -1062,6 +1085,7 @@ function finalizeProject(
 
   const stateLabels = p["stateLabels"] as Raw | undefined;
   const escalation = finalizeEscalation(p["escalation"] as Raw | undefined);
+  const arm = finalizeArm(p["arm"] as Raw | undefined);
   const authority = finalizeAuthority(p["authority"] as Raw | undefined);
   const releasePolicy = finalizeReleasePolicy(p["releasePolicy"], label, problems);
   const strandedTagRepos =
@@ -1183,6 +1207,7 @@ function finalizeProject(
     ...(modelFallbackThreshold === undefined ? {} : { modelFallbackThreshold }),
     ...(effectiveOmpSettings === undefined ? {} : { ompSettings: effectiveOmpSettings }),
     escalation,
+    arm,
     authority,
     releasePolicy,
     policy,
@@ -1194,6 +1219,18 @@ function finalizeProject(
   };
 }
 
+/**
+ * The project's arming gate (#613), complete. A config written before the key
+ * existed — or one that never answered — materialises as `challenge`, the
+ * authenticated round-trip every existing install already runs, so an upgrade
+ * changes no behaviour. zod has already rejected anything that is not a
+ * `"challenge"` / `"claim-only"` string, so this only fills the absent case.
+ */
+function finalizeArm(parsed: Raw | undefined): ProjectConfig["arm"] {
+  if (parsed === undefined) return { proof: DEFAULT_ARM_PROOF };
+  return { proof: (parsed["proof"] as ArmProof | undefined) ?? DEFAULT_ARM_PROOF };
+}
+
 function finalizeEscalation(parsed: Raw | undefined): ProjectConfig["escalation"] {
   if (parsed === undefined) {
     return { fallbackToIssueComment: true, orchestrator: "embedded" };