omp-conductor 0.17.1 → 0.18.0

package/REFERENCE.md

@@ -1078,11 +1078,15 @@ omp-conductor setup graph --print     # print the plan: clones, index commands,
 omp-conductor setup graph             # run it: clone, install, enable, seed, verify
 ```
 
-`setup graph --print` prints a `git clone` for every clone that does not exist yet, the
-one-shot index command per repo, and a `cbm-reindex.service` + `cbm-reindex.timer`
-pair built from the project's own repos and branches. `--write` stages all three
-in the state directory and prints the two `sudo` lines that install and enable
-them; it never runs `systemctl`.
+`setup graph --print` prints the plan: the host prerequisites, a `git clone` for
+every clone that does not exist yet, the one-shot index command per repo, and
+this project's `cbm-reindex-<project>.sh` script plus `cbm-reindex-<project>.service`
++ `cbm-reindex-<project>.timer` unit pair, named for the project so a second
+project on the same host gets its own refresh instead of silently replacing the
+first project's (#720). A run stages those three files in the state directory
+**only after its consent prompt** — declining leaves the staged tree
+byte-identical — then clones, installs and enables the timer as root, seeds one
+indexing run, and verifies; it never runs `systemctl` on its own authority.
 
 **Run it as the account the fleet runs as, never under `sudo`** — it refuses if
 you try. Everything it derives resolves per-account: the config it loads, the
@@ -2255,7 +2259,7 @@ omp-conductor help
 | --- | --- | --- |
 | `setup [area] [--no-ai] [--answers FILE] [--save-answers FILE] [--project NAME]` | project | The deterministic interview, with styled Clack prompts on an interactive TTY and byte-stable plain output for pipes or `OMP_CONDUCTOR_PLAIN_UI=1`. `--answers` validates a JSON object of stable prompt keys before setup and replaces every prompt; a missing required key exits `1` naming the key and file instead of hanging. `--save-answers` records accepted interactive answers as replayable JSON after a successful run. Bare setup is a full first run, or — when the project already exists — a chooser of which area to amend. Naming an area positionally skips that chooser and amends only that area: `tracker`, `gates`, `caps`, `code-graph`, `authority`, `policy`, `escalation`, `reporting`, `brief`. `host` and `graph` are install subcommands rather than areas and are matched first; anything else exits `2` listing both vocabularies. Every prompt shows its current value as the default, and Enter accepts what you see; `Ctrl-C` at any prompt abandons the run and writes nothing. Setup also **reads your repos to propose answers**: the gates prompt is pre-filled from what CI actually runs, and the brief's `## Project context` and release procedure are drafted from every routing repo and shown for confirmation before anything is written. Each probe is a short session with **no shell, no editor and no verbs** in a throwaway shallow clone, and every answer is a proposal you edit or decline — a probe that cannot clone, cannot reach a model, or answers unusably costs you one warning and the shipped stub. `--no-ai` asks every question with the reading half removed. |
 | `setup host [--project NAME]` | host | Re-render and stage the systemd unit, then **run** the install: `install -m 0644` into `/etc/systemd/system`, `daemon-reload`, `enable`, `restart`. Stages the fleet recovery oneshot (`omp-conductor-recover.service`) and its playbook (`/usr/local/sbin/omp-conductor-recover`) alongside, and installs them **before** the fleet units: both fleet units carry `OnFailure=` to the recovery unit, so a crash-looped daemon or herdr session now collects evidence durably, attempts one bounded recovery, and pages tier-2 instead of dying silently (#485). Every command is shown with its exact argv, one confirm covers the batch, and `sudo` asks for your password once before the first step — or is skipped entirely on a fleet that genuinely runs as root. The first failure stops the rest and prints the un-run remainder verbatim so you can finish by hand. Refuses an *escalated* invocation (`sudo`, or `sudo -i`/`su -` detected by the invoking account disagreeing with the fleet's) before writing anything, naming both accounts, because staging derives the unit's `User=`/`HOME=` from whoever ran it. On a non-Linux host the files are still staged and only the `systemctl` steps are refused. |
-| `setup graph [--no-seed] [--print] [--project NAME]` | project | The code-graph install end to end, in one preview and one confirm: check the prerequisites read-only and stop before installing anything when `codebase-memory-mcp` is absent or no MCP entry mounts it (printing the entry to add); `git clone` each missing index-only checkout **as you, never through sudo**; install and enable `cbm-reindex.timer` as root; then seed one indexing run so the first fetch happens while you watch, and verify with the same probe `status` uses. A repo that does not verify is a failure with the remediation, not a success — staged-but-not-trusted is how you discover months later that no worker read an index. `--no-seed` enables the timer without the seeding run and says plainly the graph is unusable until it first fires; it never skips the prerequisite or clone steps. `--print` changes nothing. Exits `1` when no repo has [`graphProject`](#configuration). |
+| `setup graph [--no-seed] [--print] [--project NAME]` | project | The code-graph install end to end, in one preview and one confirm: check the prerequisites read-only and stop before installing anything when `codebase-memory-mcp` is absent or no MCP entry mounts it (printing the entry to add); stage this project's `cbm-reindex-<project>.{sh,service,timer}` **after** the confirm — never before, so a declined run leaves the staged tree byte-identical — refusing a stem that already belongs to another project or to a file it did not generate (#720); `git clone` each missing index-only checkout **as you, never through sudo**; install and enable `cbm-reindex-<project>.timer` as root; then seed one indexing run so the first fetch happens while you watch, and verify with the same probe `status` uses. A repo that does not verify is a failure with the remediation, not a success — staged-but-not-trusted is how you discover months later that no worker read an index. `--no-seed` enables the timer without the seeding run and says plainly the graph is unusable until it first fires; it never skips the prerequisite or clone steps. `--print` changes nothing. Exits `1` when no repo has [`graphProject`](#configuration). |
 | `start` | host | Start `herdr-fleet.service` when that optional unit is installed, clearing a previous pane-recovery pin, then start the dispatch daemon and wait until it answers `GET /healthz`. When `omp-conductor.service` is installed, systemd is the only start path: even `start --project NAME` restores the shared unit and uses the name only to verify that `/healthz` serves the requested project. A detached daemon is allowed only when the unit is proven absent. It never clears pause or arms ticks. Refuses if a daemon is already live, naming its pid; manager refusal or unprovable ownership is an error rather than a detached fallback. |
 | `stop` | fleet | Prefer `systemctl stop omp-conductor.service` when that unit's MainPID is the live daemon — systemd then owns the stop and will not schedule a restart for the exit it just requested. Otherwise `SIGTERM`, then `SIGKILL` after a 10-second grace period. Prints `not running` when there is nothing to stop, and tags the confirmation with `(via systemctl)` when the unit path was used. |
 | `restart [--now] [--timeout SECONDS] [--port N] [--project NAME]` | host | Drains the fleet by default: pause new claims, wait until live workers reach `0 / N` (bounded by `--timeout SECONDS`, default 1800 = 30 min), restart, then restore the prior dispatch state. A daemon serving multiple configured projects makes restart host-wide: `--project` is rejected because draining one queue and restarting the shared process would kill another project's workers. Prefer `systemctl restart` when the unit owns the live pid so the replacement stays supervised; only a host proven not to have the installed unit may fall back to the standalone stop/start path. `--now` skips the drain and restarts immediately, orphaning any live runs (old behaviour). A drain that hits `--timeout` restarts nothing and leaves dispatch paused — `omp-conductor resume` lifts it, or re-run `restart` to keep waiting. The new process **salvages dirty live worktrees before orphaning** those rows — see [Deploying a new package onto a busy fleet](#deploying-a-new-package-onto-a-busy-fleet). |
@@ -2355,7 +2359,7 @@ curl -s localhost:8787/healthz
         "configured": true,
         "status": "degraded",
         "checkedAt": "2026-08-08T13:00:00.000Z",
-        "prerequisites": { "indexer": "present", "mcpMount": "missing" },
+        "prerequisites": { "indexer": "present", "mcpMount": "unconfigured" },
         "repos": [
           {
             "name": "api",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/schema/config.schema.json

@@ -136,7 +136,8 @@
             "properties": {
               "inProgress": {},
               "blocked": {},
-              "failed": {}
+              "failed": {},
+              "backlog": {}
             },
             "additionalProperties": false
           },
@@ -340,6 +341,28 @@
             "additionalProperties": false,
             "description": "How `arm` proves a human just approved arming"
           },
+          "review": {
+            "type": "object",
+            "properties": {
+              "strictness": {
+                "default": "medium",
+                "type": "string",
+                "enum": [
+                  "low",
+                  "medium",
+                  "high"
+                ]
+              },
+              "maxRounds": {
+                "default": 3,
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 6
+              }
+            },
+            "additionalProperties": false,
+            "description": "Review strictness and round ceiling for green PRs"
+          },
           "authority": {
             "type": "object",
             "properties": {

package/src/admission.ts

@@ -32,7 +32,8 @@ import { readPlanUsage, type PlanUsageStatus, type UsageSource } from "./usage.t
 import type { CriticalBaseProbe, CriticalBaseVerdict, LaneFile, LaneSource, RunLaneProbe } from "./gitops.ts";
 import { repoSlugFor } from "./gitops.ts";
 import { branchName, type Routed } from "./routing.ts";
-import { parseDependsOn } from "./depends-on.ts";
+import { parseDependsOn, buildDependencyCycles } from "./depends-on.ts";
+import type { DependencyCycle, DependencyNodeReader } from "./depends-on.ts";
 
 /** Fleet-wide escalations still need an issue number in the payload; 0 is the
  *  sentinel that reads as "no issue" in every renderer. */
@@ -64,6 +65,16 @@ export interface AdmissionDeps {
    * prerequisite closed too — the daemon always wires it.
    */
   probeIssueIn?: (repo: string, issue: number) => Promise<IssueSnapshot | undefined>;
+  /**
+   * Reads one issue's BODY in a repository the admission tracker is NOT bound
+   * to — the cross-repo half of the dependency-graph cycle pass (#421). The
+   * tracker bound to `project.tracker.repo` already answers same-repo bodies
+   * via {@link Tracker.issueBody}; a reachable prerequisite body in a routed
+   * repo goes through this. Undefined means "could not tell"; unset, a routed
+   * reachable body fails that branch closed (no false cycle), exactly like
+   * {@link Tracker.issueBody}. The daemon always wires it.
+   */
+  probeBodyIn?: (repo: string, issue: number) => Promise<string | undefined>;
 }
 /** `stops` are the operational ends that each require one resume. */
 export function hasContinuationBudget(stops: number, maxContinuations: number): boolean {
@@ -259,6 +270,18 @@ export function declaredLane(body: string): string[] {
   return laneDeclaration(body)?.files ?? [];
 }
 
+/**
+ * The file lane as one line, for surfaces where a human asserts the claim
+ * (#724): the parsed file list exactly as admission will enforce it, or the
+ * explicit fail-open note when nothing parsed. Verbatim parser output only —
+ * a paraphrase would hide the very over-parse (#720) or under-parse (#684)
+ * this echo exists to surface.
+ */
+export function laneEcho(lane: LaneDeclaration | undefined): string {
+  if (lane === undefined) return "no lane declared (fail open)";
+  return lane.files.join(", ");
+}
+
 /** A plausible relative path: it has a `.` extension or a directory separator. */
 function isPathLike(token: string): boolean {
   return token !== "" && !/\s/.test(token) && (token.includes("/") || /\.[A-Za-z0-9]{1,10}$/.test(token));
@@ -469,8 +492,79 @@ export async function admitCandidates(
   }
 
   const admitted: Admission[] = [];
+
+  // Phase A — dependency-graph cycle pass (#421). Built ONCE per pass, before
+  // any per-candidate open-prerequisite hold, so a candidate sitting on a cycle
+  // is held as `dependency-cycle` instead of having an open first edge mask the
+  // group. Readers follow the same tracker/probe seams as the per-candidate
+  // interlock: same-repo refs via `tracker`, routed refs via `probeIssueIn` /
+  // `probeBodyIn`. Traversal is bounded to the tracker/routed repos and every
+  // node is read at most once; a tracker failure fails closed (no edge) rather
+  // than ever synthesising a cycle.
+  const readDepNode: DependencyNodeReader = async (repo, issue) => {
+    const snap = await (async () => {
+      try {
+        if (repo === project.tracker.repo) return await tracker.issueSnapshot(issue);
+        return d.probeIssueIn === undefined ? undefined : await d.probeIssueIn(repo, issue);
+      } catch {
+        return undefined;
+      }
+    })();
+    if (snap === undefined) return undefined;
+    if (snap.state === "closed") return { state: "closed", body: "" };
+    const body = await (async () => {
+      try {
+        if (repo === project.tracker.repo) return await tracker.issueBody(issue);
+        return d.probeBodyIn === undefined ? undefined : await d.probeBodyIn(repo, issue);
+      } catch {
+        return undefined;
+      }
+    })();
+    return body === undefined ? undefined : { state: "open", body };
+  };
+  const graph = await buildDependencyCycles(
+    routed.map((r) => ({ repo: project.tracker.repo, issue: r.issue.number, body: r.issue.body })),
+    project.tracker.repo,
+    (ownerRepo) => crossRepoTarget(project, ownerRepo),
+    readDepNode,
+  );
+  // candidate issue -> the cycle path that holds it, for status/digest.
+  const memberCycle = new Map<number, string>();
+  for (const cycle of graph.cycles) {
+    for (const member of cycle.members) {
+      const [repo, issueStr] = member.split("#") as [string, string];
+      if (repo !== project.tracker.repo) continue;
+      const n = Number(issueStr);
+      // Prefer the cycle anchored at this member (its "own" cycle) when a
+      // candidate sits on more than one.
+      if (!memberCycle.has(n) || cycle.anchorIssue === n) memberCycle.set(n, cycle.display);
+    }
+    // One material event per stable cycle identity: the escalation ledger
+    // dedupes on project/issue/tier/summary, and the summary carries the
+    // canonical path, so a stable cycle pages once and a changed cycle emits a
+    // new event (the rotated/queue-ordered spelling is canonicalised away).
+    await safeEscalate(d, {
+      tier: 1,
+      project: project.name,
+      issue: cycle.anchorIssue,
+      summary: `Dependency cycle detected: ${cycle.display}`,
+      detail: [
+        "None of the issues on this cycle can be dispatched until one edge is broken.",
+        `Cycle: ${cycle.display}`,
+        "Break it by closing or reordering a `Depends-on:` reference, and the affected",
+        "candidates become claimable again on the next tick.",
+      ].join("\n"),
+    });
+  }
+
   for (const r of routed) {
     const issue = r.issue.number;
+    const cyclePath = memberCycle.get(issue);
+    if (cyclePath !== undefined) {
+      hold(issue, "dependency-cycle", cyclePath);
+      log(`#${issue} held (dependency-cycle): ${cyclePath}`);
+      continue;
+    }
     if (admitted.length >= slots) {
       hold(issue, "capacity");
       continue;
@@ -761,6 +855,15 @@ export async function admitCandidates(
       log(`#${issue} skipped: queue label ${project.queueLabel} was removed (search index lag)`);
       continue;
     }
+    // Park beats queue here too (#734): the candidate list was fetched from
+    // the search index before the operator parked the issue, so the fresh
+    // snapshot is the last gate. A park never touches a live run — it only
+    // stops a claim.
+    if (snapshot.labels.includes(project.stateLabels.backlog)) {
+      hold(issue, "issue-parked");
+      log(`#${issue} skipped: park label ${project.stateLabels.backlog} was applied since listing`);
+      continue;
+    }
 
     // The Depends-on interlock (#419/#420): a candidate declares the issues it
     // must not be dispatched before — same-repo (`#123`) or cross-repo

package/src/ask.ts

@@ -93,7 +93,11 @@ export interface AskRequest {
   timeoutSeconds?: number;
   /** What is waiting on the answer, for the decision row and the digest. */
   blocks?: string;
-  /** The option applied by `auto-proceed`; required exactly for that outcome. */
+  /**
+   * The option applied by `auto-proceed`; required exactly for that outcome.
+   * When {@link AskRequest.options} are supplied it must name one of their
+   * labels — the label as delivered, never an index.
+   */
   recommended?: string;
   /** The choices shown to the operator, with {@link AskRequest.recommended} named. */
   options?: AskOption[];
@@ -115,6 +119,13 @@ function isInterruptCategory(value: unknown): value is InterruptCategory {
  * {@link MAX_QUESTION_LINES} / {@link MAX_QUESTION_CHARACTERS}, and refuses
  * rather than truncating: a truncated question reads as complete and has lost
  * its options, which is strictly worse than a rejection the caller must fix.
+ *
+ * The refusal is terminal for the call (#741): nothing is recorded or
+ * delivered, and the caller must not resubmit the trimmed question in the same
+ * turn — the rationale belongs in the issue or the event ledger, and a
+ * decision that still needs a human answer is raised as a fresh ask on a later
+ * tick. A re-issued ask therefore always starts from the accepted arguments of
+ * a new call, never from a rewrite of a refused one.
  */
 export function validateQuestionShape(question: string): QuestionShape {
   const lines = question.split("\n").length;
@@ -151,7 +162,13 @@ export function parseAskRequest(raw: unknown): AskParse {
   }
   const shape = validateQuestionShape(question.trim());
   if (!shape.ok) {
-    return { ok: false, problem: `conductor_ask ${shape.problem}` };
+    return {
+      ok: false,
+      problem:
+        `conductor_ask ${shape.problem} Do not re-issue the trimmed question in this turn: if the ` +
+        "decision still needs a human answer, say so in the report and raise it as a fresh ask in a " +
+        "later tick.",
+    };
   }
 
   const onTimeoutRaw = input["on-timeout"];
@@ -225,6 +242,25 @@ export function parseAskRequest(raw: unknown): AskParse {
     options = parsedOptions;
   }
 
+  // A recommendation must name a supplied option. `recommended` is the option
+  // label exactly as the operator reads it — never an index (that is
+  // telegram_ask's convention, not this tool's) and never free text when a
+  // menu exists. Refused at parse time so the incoherent ask leaves no trace:
+  // on `auto-proceed` its text becomes the recorded auto-applied answer, and a
+  // value that named no option would resolve a decision row to something that
+  // was never a choice (#740).
+  if (options !== undefined && recommended !== undefined) {
+    const labels = options.map((option) => option.label);
+    if (!labels.includes(recommended)) {
+      return {
+        ok: false,
+        problem:
+          `conductor_ask recommended "${recommended}" names no option — it must be one of: ${labels.join(", ")}. ` +
+          "It is the option label exactly as delivered to the operator, not an index",
+      };
+    }
+  }
+
   const categoryRaw = input["category"];
   if (categoryRaw !== undefined && !isInterruptCategory(categoryRaw)) {
     return {
@@ -274,7 +310,7 @@ export function askParameterSchema(): Record<string, unknown> {
       recommended: {
         type: "string",
         description:
-          "The option applied on auto-proceed. Required when on-timeout is auto-proceed, because the row must record what was auto-applied.",
+          "The option applied on auto-proceed; required when on-timeout is auto-proceed because the row must record what was auto-applied. When options are supplied this must be one of their labels — the label as delivered to the operator, not an index.",
       },
       blocks: {
         type: "string",

package/src/backups.ts

@@ -18,8 +18,8 @@ import {
 import { join } from "node:path";
 
 /** A timestamp stem safe to embed in a file name. */
-export function backupTimestamp(): string {
-  return new Date().toISOString().replace(/[:.]/g, "-");
+export function backupTimestamp(at: number = Date.now()): string {
+  return new Date(at).toISOString().replace(/[:.]/g, "-");
 }
 
 /**

package/src/briefs/orchestrator.md

@@ -66,6 +66,7 @@ For each one, pick exactly one of three outcomes:
   question that unblocks it. Do not guess: a wrong answer costs a worker's whole
   budget and lands a wrong PR, while an unanswered question costs a delay.
 {{MERGE_DUTY}}
+{{REVIEW_DUTY}}
 
 **Then check for orphans.** A worker is a process, and processes die: a daemon
 restart, a host reboot, a kill. The `agent:in-progress` label survives that death

package/src/briefs/worker.md

@@ -47,7 +47,7 @@ files are canonical; your priors are not.
 
 {{ACCEPTANCE_CRITERIA}}
 
-{{ISSUE_COMMENTS}}## How to work
+{{ISSUE_COMMENTS}}{{FILE_LANE}}## How to work
 
 1. **Understand before editing — and ask the graph before you grep.** Your turns
    are mostly spent finding code, not writing it, and running out of turns
@@ -76,6 +76,18 @@ files are canonical; your priors are not.
    genuinely cannot be done small, stop and escalate rather than ballooning.
 5. **Fix the root cause, never the symptom.** Do not suppress a warning, delete an
    assertion, or special-case an input to make a check pass.
+6. **Prefer the structured edit tool for file changes, and the structured
+   search tool over shelling out.** A structured edit is one call: anchored and
+   verified, and a stale anchor fails loudly instead of silently editing the
+   wrong line. The shell equivalent is three or four — compose the script,
+   escape it correctly, run it, then read the file back to confirm it did what
+   was intended — and a mis-escaped `sed -i` pattern silently edits nothing or
+   the wrong line. So do not hand-roll edits through `sed -i`, `python3`
+   heredocs, `node -e` or shell redirection except where no structured tool can
+   express the change (a binary file, a generated artefact). The same holds for
+   finding code: use the structured search tool rather than shelling out to
+   grep, for the same reason the graph line exists — it is cheaper per call and
+   its output is already scoped.
 
 ## Tests — read this carefully
 
@@ -210,24 +222,29 @@ Escalating is a successful outcome. Guessing is not.
 
 ## Your final report
 
-End with exactly these seven lines, evidence only — no narration:
-
-```
-issue:   {{TRACKER_REPO}}#{{ISSUE_NUMBER}}
-pr:      <url or "none">
-head:    <40-character head SHA or "none">
-state:   pushed-green | blocked | failed
-gates:   <exact commands run and their results>
-changed: <the settlement derives this from the PR diff — omit the line>
-next:    <nothing | the specific decision needed>
+End your run by yielding the settlement through the `yield` tool — one
+structured call, and the schema is the contract: the harness showed it to you
+at session start. The expected shape:
+
+```json
+{
+  "status": "green",
+  "prUrl": "https://github.com/.../pull/N",
+  "headSha": "<the 40-char head you watched go green>",
+  "summary": "What you changed and why — the narrative a reviewer reads.",
+  "proof": ["bun test omp/src/worker.test.ts"]
+}
 ```
 
-The `changed:` line is not yours to write from memory: the settlement replaces
-it with the actual file list from the PR's diff. Omit it, or write it wrongly —
-the settled report carries the diff's list either way. The narrative in your
-report (what you changed and why, above these lines) is the part only you can
-write, and it is the part a reviewer reads.
-
-Never report success you have not observed. "Should pass CI" is not a state, and
-`pushed-green` means you watched the checks go green — not that you expect them
+Call it as `yield({ result: { data: <the object> } })` with no `type` — the
+usual terminal yield. `status: "green"` means you pushed and **watched the
+checks go green**, and it requires both `prUrl` and `headSha`. Use `blocked`
+(with `blockers`) when a decision or credential is missing, `failed` when the
+run could not complete. The dispatcher renders your yielded settlement into
+the stored report, so `summary` is what a reviewer reads and `proof` is the
+evidence; the `changed:` file list is derived from the PR's own diff, never
+written by you.
+
+Never report success you have not observed. "Should pass CI" is not a state,
+and `green` means you watched the checks go green — not that you expect them
 to.

package/src/command-help.ts

@@ -168,9 +168,16 @@ export const COMMAND_DETAILS = `  setup    interview, then write config.json, th
            condition the daemon checks for you; a met watch wakes the next tick
            with its note, exactly as a met question does, but it is listed under
            its own heading and never under "Open operator decisions", and it has
-           no seven-day expiry. \`watch list\` shows open watches.
+           no seven-day expiry. \`watch list\` shows open watches; \`watch
+           withdraw <id>\` ends one with a recorded reason — the verb that
+           creates a watch is the verb that ends it (watches are decision rows,
+           so \`decision withdraw <id>\` also works). A watch whose PR condition
+           can no longer be observed — the PR merged or closed before the
+           condition was seen — is withdrawn by the daemon itself with the
+           reason recorded.
              watch add --note TEXT [--blocks TEXT] [--resolves-when COND]
              watch list
+             watch withdraw <id> [--reason TEXT]
   intake   keep a raw idea durably before it becomes anything: record it now
            with \`omp-conductor intake "<text>"\`, list what is still pending,
            dismiss what turned out to be nothing. Backed by the sqlite store,

package/src/command-manifest.ts

@@ -390,24 +390,27 @@ export const COMMAND_MANIFEST: readonly CommandManifestEntry[] = [
   },
   {
     name: "watch",
-    description: "record or list orchestrator-only conditions and carry notes",
+    description: "record, list, or withdraw orchestrator-only conditions and carry notes",
     scope: "project",
     usage: [
       "watch add --note TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]",
       "watch list [--project NAME] [--json]",
+      "watch withdraw <id> [--reason TEXT] [--project NAME]",
     ],
     subcommands: [
       { name: "add", description: "record a watch" },
       { name: "list", description: "list open watches" },
+      { name: "withdraw", description: "withdraw an obsolete watch" },
     ],
     flags: [
       value("--note", "note carried when the watch resolves"),
       value("--blocks", "what the watch blocks"),
       value("--resolves-when", "automatic resolution condition"),
+      value("--reason", "withdrawal reason"),
       toggle("--json", "print watch list as stable JSON"),
       project(),
     ],
-    positionals: [{ name: "action" }],
+    positionals: [{ name: "action" }, { name: "id" }],
   },
   {
     name: "intake",

package/src/commands/watch.ts

@@ -10,6 +10,12 @@
  * next tick should read, neither of which ever needs an operator answer. It is
  * distinguished durably by its `kind`, never by whether it carries a
  * condition — a real question may carry one too.
+ *
+ * Watches are decision rows with `kind === "watch"`, so `watch withdraw`
+ * delegates to the same store resolution `decision withdraw` uses rather than
+ * inventing a second mechanism: both verbs write the same durable terminal
+ * state with a recorded reason, and a watch id remains acceptable to `decision
+ * withdraw` for anyone who learned that vocabulary first (#664).
  */
 
 import type { CommandContext } from "./context.ts";
@@ -17,8 +23,25 @@ import { findProject, loadConfig } from "../config.ts";
 import { CONDITION_FORMS, parseCondition } from "../decisions.ts";
 import { dbPath, openStore } from "../store.ts";
 
+const WATCH_USAGE = `omp-conductor watch — set a condition or carry note for the orchestrator itself.
+
+usage:
+  omp-conductor watch add --note TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
+  omp-conductor watch list [--project NAME] [--json]
+  omp-conductor watch withdraw <id> [--reason TEXT] [--project NAME]
+
+add records a row the daemon checks for you and the next tick reads, with no
+operator answer needed. list shows open watches, oldest first. withdraw ends
+one with a recorded reason — the verb that creates a watch is the verb that
+ends it. A watch whose PR condition can no longer be observed (the PR merged
+or closed first) is withdrawn by the daemon itself.`;
+
 export async function watchCommand(ctx: CommandContext): Promise<void> {
   const sub = ctx.argv[1];
+  if (sub === "--help" || sub === "-h") {
+    process.stdout.write(WATCH_USAGE);
+    return;
+  }
   const project = findProject(loadConfig(), ctx.projectFlag);
   const store = openStore(dbPath());
   try {
@@ -45,7 +68,9 @@ export async function watchCommand(ctx: CommandContext): Promise<void> {
         at: Date.now(),
       });
       const wake = condition === undefined ? "read by the next tick" : "the daemon wakes the next tick when it is met";
-      process.stdout.write(`watch ${watch.id} added — ${wake} (no operator answer needed)\n`);
+      process.stdout.write(
+        `watch ${watch.id} added — ${wake} (no operator answer needed); end with: omp-conductor watch withdraw ${watch.id}\n`,
+      );
       return;
     }
 
@@ -70,14 +95,48 @@ export async function watchCommand(ctx: CommandContext): Promise<void> {
       for (const watch of watches) {
         process.stdout.write(
           `${watch.id}  ${watch.ageHours}h  blocks:${watch.blocks ?? "-"}  ` +
-            `condition:${watch.condition ?? "-"}  ${watch.note}\n`,
+            `condition:${watch.condition ?? "-"}  ${watch.note}  (end: omp-conductor watch withdraw ${watch.id})\n`,
+        );
+      }
+      return;
+    }
+
+    if (sub === "withdraw") {
+      const id = ctx.argv[2];
+      if (id === undefined || id.startsWith("--")) {
+        process.stderr.write("omp-conductor: watch withdraw needs the watch id\n");
+        process.exit(2);
+      }
+      const row = store.decision(id);
+      if (row !== undefined && row.kind !== "watch") {
+        // The same underlying row, but a question answers to a human: the
+        // watch verb must not silently close an operator decision.
+        process.stderr.write(
+          `omp-conductor: watch withdraw targets watches — ${id} is an operator decision; use decision withdraw\n`,
+        );
+        process.exit(2);
+      }
+      const reason = ctx.flag("reason")?.trim();
+      const ok = store.resolveDecision(
+        id,
+        "withdrawn",
+        reason === undefined || reason.length === 0 ? "withdrawn" : reason,
+        Date.now(),
+      );
+      if (!ok) {
+        // A watch that is not open is a different mistake from an id that
+        // never existed, and the operator can only act on one of them.
+        process.stderr.write(
+          `omp-conductor: no open watch ${id} for ${project.name} — it was already withdrawn, or the id is wrong\n`,
         );
+        process.exit(1);
       }
+      process.stdout.write(`watch ${id} withdrawn\n`);
       return;
     }
 
     process.stderr.write(
-      `omp-conductor: unknown watch subcommand "${sub}" — expected add or list\n`,
+      `omp-conductor: unknown watch subcommand "${sub}" — expected add, list or withdraw\n`,
     );
     process.exit(2);
   } finally {

package/src/config-schema.ts

@@ -31,6 +31,8 @@ import {
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
+  DEFAULT_REVIEW_MAX_ROUNDS,
+  DEFAULT_REVIEW_STRICTNESS,
   DRAFT_POLICIES,
   INTERRUPT_CATEGORIES,
   LEGACY_RELEASE_POLICIES,
@@ -39,6 +41,9 @@ import {
   RELEASE_REQUIREMENTS,
   RELEASE_SHAPES,
   REPORT_SCOPES,
+  REVIEW_MAX_ROUNDS_MAX,
+  REVIEW_MAX_ROUNDS_MIN,
+  REVIEW_STRICTNESS,
   WEEKDAYS,
   DIGEST_CADENCES,
 } from "./types.ts";
@@ -65,6 +70,7 @@ const RELEASE_REQUIREMENT_LIST = quoteList(RELEASE_REQUIREMENTS);
 const RELEASE_SHAPE_LIST = quoteList(RELEASE_SHAPES);
 const ORCHESTRATOR_MODE_LIST = quoteList(ORCHESTRATOR_MODES);
 const LEGACY_RELEASE_POLICY_LIST = quoteList(LEGACY_RELEASE_POLICIES);
+const REVIEW_STRICTNESS_LIST = quoteList(REVIEW_STRICTNESS);
 
 // ---------------------------------------------------------------------------
 // Closed vocabularies — every one built from the exported `as const` array in
@@ -83,6 +89,7 @@ const releaseRequirementEnum = z.enum([...RELEASE_REQUIREMENTS]);
 const releaseShapeEnum = z.enum([...RELEASE_SHAPES]);
 const orchestratorModeEnum = z.enum([...ORCHESTRATOR_MODES]);
 const releasePolicyLegacyEnum = z.enum([...LEGACY_RELEASE_POLICIES]);
+const reviewStrictnessEnum = z.enum([...REVIEW_STRICTNESS]);
 
 /** The 24-hour `HH:MM` shape `digest.at` / `availability.start/end` take. */
 const HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
@@ -256,6 +263,27 @@ const armSchema = z
   .strict()
   .describe("How `arm` proves a human just approved arming");
 
+/**
+ * The per-project review policy (#678): how strictly green PRs are reviewed
+ * and returned, and the hard ceiling on review rounds per PR lifecycle. Absent
+ * or a legacy config without the key loads as `medium` with
+ * {@link DEFAULT_REVIEW_MAX_ROUNDS} rounds — the recommended default for a new
+ * project, materialised deterministically for every existing one, with the
+ * schema bounds and the runtime defaults read from the same constants.
+ */
+const reviewSchema = z
+  .object({
+    strictness: reviewStrictnessEnum.default(DEFAULT_REVIEW_STRICTNESS),
+    maxRounds: z
+      .number()
+      .int()
+      .min(REVIEW_MAX_ROUNDS_MIN)
+      .max(REVIEW_MAX_ROUNDS_MAX)
+      .default(DEFAULT_REVIEW_MAX_ROUNDS),
+  })
+  .strict()
+  .describe("Review strictness and round ceiling for green PRs");
+
 const releasePolicySchema = z.union([
   releasePolicyLegacyEnum,
   z.record(z.string(), authorityHolderEnum),
@@ -304,6 +332,7 @@ const stateLabelsSchema = z
     inProgress: z.unknown(),
     blocked: z.unknown(),
     failed: z.unknown(),
+    backlog: z.unknown(),
   })
   .partial();
 
@@ -350,6 +379,9 @@ const projectSchema = z
     // How `arm` proves a human approved arming (#613); absent loads as
     // `challenge`, preserving today's authenticated round-trip.
     arm: armSchema.optional(),
+    // Review strictness and the round ceiling (#678); absent loads as the
+    // documented migration default.
+    review: reviewSchema.optional(),
     authority: authoritySchema.optional(),
     releasePolicy: releasePolicySchema.optional(),
     policy: projectPolicySchema.optional(),
@@ -448,4 +480,5 @@ export {
   RELEASE_SHAPE_LIST,
   ORCHESTRATOR_MODE_LIST,
   LEGACY_RELEASE_POLICY_LIST,
+  REVIEW_STRICTNESS_LIST,
 };