omp-conductor 0.17.0 → 0.18.0

package/src/release-policy.ts

@@ -280,7 +280,7 @@ function wholePackageBunTest(segment: string): boolean {
  * the host were all plain invocations, and refusing the sanctioned parse check
  * would teach workers to skip it rather than stop the load.
  */
-const SHARED_HOST_SCRIPTS = [
+export const SHARED_HOST_SCRIPTS: readonly string[] = [
   "herdr/test/recover-test.sh",
   "test/setup-test.sh",
   "setup.sh",
@@ -298,6 +298,147 @@ function sharedHostScriptMatch(segment: string): string | undefined {
   return undefined;
 }
 
+/** The `git [-C <dir>] tag` prefix; the tail after it decides read vs write. */
+const GIT_TAG_HEAD = /^git(?:\s+-[Cc]\s+\S+)*\s+tag(?=\s|$)/;
+
+/**
+ * Whether a segment that opens with `git [-C <dir>] tag` is a write — tag
+ * creation or deletion — rather than a read. The tripwire used to match the
+ * `git tag` prefix alone (#696), so a worker orienting itself with
+ * `git tag | head -5` was refused as an attempted release and the refusal
+ * reached the digest as release-policy drift. Git writes tags in exactly two
+ * shapes, and every other form is a read:
+ *
+ * - creation needs a tagname operand: `git tag <name>` and the
+ *   `-a`/`-s`/`-u`/`-t`/`-m`/`-F`/`-f` forms;
+ * - deletion needs `-d`/`--delete`;
+ * - bare `git tag`, `-l`/`--list` (with an optional pattern), `-n`,
+ *   `--contains`, `--points-at`, `--sort`, `--merged`/`--no-merged`,
+ *   `--format`, `--column` and `-v`/`--verify` all only read.
+ *
+ * A creation flag with no name is still gated: git rejects the command, but a
+ * create attempt is not a read, and the tripwire errs toward refusing a
+ * release act.
+ */
+function gitTagIsWrite(segment: string): boolean {
+  const head = GIT_TAG_HEAD.exec(segment);
+  if (head === null) return false;
+  const tokens = segment.slice(head[0].length).trim().split(/\s+/).filter((token) => token.length > 0);
+
+  let deletion = false; // -d / --delete
+  let listRead = false; // a read-only list flag
+  let verifyRead = false; // -v / --verify
+  let createSignal = false; // -a / -s / -f / -m / -u / -t / -F
+  let hasOperand = false; // a positional tagname, pattern or commit
+
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i]!;
+    // A `--` ends option parsing: whatever follows is a plain operand, the
+    // created or deleted tag's name.
+    if (token === "--") {
+      hasOperand = true;
+      break;
+    }
+    if (token.startsWith("--")) {
+      const flag = token.includes("=") ? token.slice(0, token.indexOf("=")) : token;
+      switch (flag) {
+        case "--delete":
+          deletion = true;
+          break;
+        case "--list":
+        case "--contains":
+        case "--no-contains":
+        case "--points-at":
+        case "--merged":
+        case "--no-merged":
+        case "--sort":
+        case "--format":
+        case "--column":
+        case "--no-column":
+        case "--color":
+        case "--no-color":
+        case "--ignore-case":
+        case "--no-ignore-case":
+          listRead = true;
+          break;
+        case "--verify":
+          verifyRead = true;
+          break;
+        case "--annotate":
+        case "--sign":
+        case "--force":
+          createSignal = true;
+          break;
+        case "--local-user":
+        case "--object":
+        case "--message":
+        case "--file":
+          // The flag's operand is part of the create parameters, not a
+          // tagname; `--flag value` must not be read as `--flag` plus a name.
+          createSignal = true;
+          if (!token.includes("=")) i++;
+          break;
+        default:
+          break; // an unknown flag: no conclusion either way
+      }
+      continue;
+    }
+    if (token.startsWith("-") && token.length > 1) {
+      // Combined short options (`-an5` is `-a -n 5`). An option with a
+      // required operand takes the rest of its token or the next token.
+      let consumeNext = false;
+      for (let j = 1; j < token.length; j++) {
+        const flag = token[j];
+        switch (flag) {
+          case "d":
+            deletion = true;
+            break;
+          case "a":
+          case "s":
+          case "f":
+            createSignal = true;
+            break;
+          case "l":
+            listRead = true;
+            break;
+          case "v":
+            verifyRead = true;
+            break;
+          case "n":
+            // `-n[<num>]` — the digit run belongs to the flag, so `-n5`
+            // is one token and never an operand.
+            listRead = true;
+            while (j + 1 < token.length && token[j + 1]! >= "0" && token[j + 1]! <= "9") j++;
+            break;
+          case "m":
+          case "u":
+          case "t":
+          case "F":
+            createSignal = true;
+            if (j + 1 < token.length) {
+              j = token.length;
+            } else {
+              consumeNext = true;
+            }
+            break;
+          default:
+            break; // an unknown short flag: no conclusion either way
+        }
+      }
+      if (consumeNext) i++;
+      continue;
+    }
+    // A plain operand: with a list flag it is a pattern or commit for the
+    // read; without one it is the tagname a creation needs.
+    hasOperand = true;
+  }
+
+  if (deletion) return true;
+  if (listRead || verifyRead) return false;
+  if (hasOperand) return true;
+  return createSignal;
+}
+
 /**
  * Classify a shell command and the segment that fired. The segment is what a
  * triager reads: `bun test src/foo.test.ts && npm publish` matches on its
@@ -323,7 +464,7 @@ function releaseCommandMatch(command: string): { shape: GateShape; matched: stri
     // any future spelling under the upgrade family all need the install shape,
     // and a session without that grant is refused before the shell runs.
     if (/^omp-conductor\s+upgrade(?:\b|$)/.test(segment)) return { shape: "install", matched: segment };
-    if (/^git(?:\s+-[Cc]\s+\S+)*\s+tag(?:\s|$)/.test(segment)) return { shape: "git-tag", matched: segment };
+    if (gitTagIsWrite(segment)) return { shape: "git-tag", matched: segment };
     if (
       /^git(?:\s+-[Cc]\s+\S+)*\s+push\b/.test(segment) &&
       GIT_PUSH_TAG_SHAPE.test(segment)
@@ -513,8 +654,10 @@ export function releaseShapeFromTool(
 /**
  * The refusal wording for the shared-host gate (#428). The whole-package
  * `bun test` form names the focused alternative (a guard that only denies
- * teaches nothing and gets worked around); the shell suites get their own
- * because there is no focused form of a suite script.
+ * teaches nothing and gets worked around); a refused shell suite names the
+ * script that fired and the sanctioned `bash -n` parse check (#687), because
+ * there is no focused form of a suite script — the alternative is to drop the
+ * execution segment and keep the allowed prefix, not to run something else.
  */
 function sharedHostRefusalReason(matched: string | undefined): string {
   if (matched !== undefined && /^bun\s+test\b/.test(matched)) {
@@ -524,10 +667,39 @@ function sharedHostRefusalReason(matched: string | undefined): string {
       "Run a focused `bun test <file>.test.ts` instead."
     );
   }
+  if (matched !== undefined) {
+    return (
+      `Blocked by sharedHostPolicy: \`${matched}\` is a shared-host shell suite and not a worker's proof ` +
+      "path on this shared host (it overloads the 4-core VPS that also runs Langfuse and the fleet). " +
+      `\`bash -n ${matched}\` is the sanctioned local check — parsing never executes the script — and CI's ` +
+      "`herdr plugin + installer shell suites` job owns executing it. Drop the segment that fired and keep " +
+      "the `bash -n` parse gate."
+    );
+  }
   return (
     "Blocked by sharedHostPolicy: this shell suite is not a worker's proof path on this shared host " +
     "(it overloads the 4-core VPS that also runs Langfuse and the fleet). " +
-    "Run focused `bun test <file>.test.ts` unit tests instead."
+    "`bash -n <path>` is the sanctioned local check; CI's `herdr plugin + installer shell suites` job owns " +
+    "executing it."
+  );
+}
+
+/**
+ * The worker-brief notice for the shared-host gate (#687): the guarded suite
+ * paths and the sanctioned local check, derived from
+ * {@link SHARED_HOST_SCRIPTS} so the rendered brief and the refusal can never
+ * disagree about what is guarded. One line and non-empty whenever the list is:
+ * the brief's rendered line count must equal its template's, which the
+ * buildBrief tests pin, so the notice must never carry an internal newline.
+ */
+export function sharedHostBriefNotice(): string {
+  if (SHARED_HOST_SCRIPTS.length === 0) return "";
+  const paths = SHARED_HOST_SCRIPTS.map((script) => `\`${script}\``).join(", ");
+  return (
+    `**Shared-host guard:** ${paths} are never executed on this shared host — \`bash -n\` on them is the ` +
+    "sanctioned local check (parsing never executes), and CI's `herdr plugin + installer shell suites` job " +
+    "owns executing them. A command that executes one is refused, and the refusal names the segment; drop " +
+    "that segment and keep the `bash -n` parse gate."
   );
 }
 

package/src/routing.ts

@@ -39,7 +39,10 @@ export type Unroutable = {
 const MAX_BRANCH_LEN = 60;
 
 /**
- * True only when a human has queued the issue and no run already owns it.
+ * True only when a human has queued the issue, no run already owns it, and
+ * the operator has not parked it. The park label beats the queue label: an
+ * issue carrying both is not eligible, because the queue listing was fetched
+ * before the park landed and must not turn into a claim (#734).
  *
  * The state labels are the interlock against double-dispatch across daemon
  * restarts: the tracker, not the local store, is the source of truth for
@@ -51,8 +54,13 @@ export function isEligible(issue: ReadyIssue, p: ProjectConfig): boolean {
   // sides here, which is the only place labels are matched.
   const labels = new Set(issue.labels);
   if (!labels.has(p.queueLabel)) return false;
-  const { inProgress, blocked, failed } = p.stateLabels;
-  return !labels.has(inProgress) && !labels.has(blocked) && !labels.has(failed);
+  const { inProgress, blocked, failed, backlog } = p.stateLabels;
+  return (
+    !labels.has(inProgress) &&
+    !labels.has(blocked) &&
+    !labels.has(failed) &&
+    !labels.has(backlog)
+  );
 }
 
 /**

package/src/session-host.ts

@@ -55,6 +55,19 @@ export interface SessionHostSpec {
    *  Carried as a plain scalar like the other fields; absent, nothing is staged
    *  on the far side either. */
   ompSettingsFile?: string;
+  /**
+   * The structured-settlement contract (#540): a JSON Schema the session's
+   * `yield` tool validates its `data` payload against. Carried as plain JSON
+   * through the spec, like everything else; absent, the far side passes nothing
+   * to the harness.
+   */
+  outputSchema?: unknown;
+  /** Enforcement policy for {@link outputSchema} — the worker contract is
+   *  `"permissive"`: a schema violation settles with whatever the worker
+   *  produced, never a lost report. */
+  outputSchemaMode?: "permissive" | "strict";
+  /** Force the hidden `yield` tool into this session's toolset (#540). */
+  requireYieldTool?: boolean;
 }
 
 /** Parent → child. */
@@ -192,6 +205,9 @@ export async function runSessionHost(
       ...(spec.verbSocketPath === undefined ? {} : { verbSocketPath: spec.verbSocketPath }),
       ...(spec.readOnly === undefined ? {} : { readOnly: spec.readOnly }),
       ...(spec.ompSettingsFile === undefined ? {} : { ompSettingsFile: spec.ompSettingsFile }),
+      ...(spec.outputSchema === undefined ? {} : { outputSchema: spec.outputSchema }),
+      ...(spec.outputSchemaMode === undefined ? {} : { outputSchemaMode: spec.outputSchemaMode }),
+      ...(spec.requireYieldTool === undefined ? {} : { requireYieldTool: spec.requireYieldTool }),
       // The release audit lives in the daemon's state directory, which this
       // process may not be able to write and must not be trusted to. It
       // becomes a message; the parent performs the durable write.