omp-conductor 0.17.1 → 0.18.1

package/src/diff-flags.ts

@@ -37,7 +37,7 @@
  * repository.
  */
 
-import type { PrDiff, PrDiffFile, SettlementFlag } from "./types.ts";
+import type { FileLane, PrDiff, PrDiffFile, SettlementFlag } from "./types.ts";
 
 // ------------------------------------------------------------------ diff parse
 
@@ -496,6 +496,23 @@ export interface SettlementAudit {
   /** The dispatching issue's title and body — the attribution source. */
   issueText: string;
   diff: PrDiff;
+  /** The pull request body, or undefined when the tracker could not read one.
+   *  The claims audited below live here, so absent means no proof commands are
+   *  extracted — the flag family stays silent, never cries wolf on nothing. */
+  prBody?: string;
+  /** The run's session transcript (the raw JSONL), or undefined when the run
+   *  had none or it could not be read. Absent means no claimed command can be
+   *  checked — same silence, for the same reason. */
+  transcript?: string;
+  /**
+   * The effective file lane admission resolved for this run at dispatch
+   * (`effectiveLane` — a pre-dispatch comment declaration supersedes an older
+   * body one) and persisted on the row (#744/#758): the exact snapshot the
+   * gate enforced and the worker brief rendered. Absent means the issue was
+   * admitted with no declaration (fail open) — never "empty lane" — and no
+   * diff can then be outside it.
+   */
+  lane?: FileLane;
 }
 
 /**
@@ -513,6 +530,8 @@ export interface SettlementAudit {
 export function analyseSettlement(audit: SettlementAudit): SettlementFlag[] {
   const flags: SettlementFlag[] = [];
   detectWeakening(audit, flags);
+  detectClaimedProof(audit, flags);
+  detectLaneEscape(audit, flags);
   return flags;
 }
 
@@ -529,6 +548,70 @@ export const UNREADABLE_TREE_FLAG: SettlementFlag = {
     "the settlement could not read the PR's diff, so no `changed:` file list could be derived",
 };
 
+// ---------------------------------------------------------- declared file lane
+
+/**
+ * Whether a diff path counts as inside the declared lane: an explicitly
+ * declared path, or the co-located test of one — `foo.ts` vouches for
+ * `foo.test.ts`, which is the "obviously intended" case. Other test shapes
+ * (`.spec.ts`, pytest's `test_` prefix) are not vouched for: the rule is the
+ * shape the fleet actually uses, and a lane that wants a differently-shaped
+ * sibling declares it. Deliberately one-directional: a lane that declares a
+ * *test* file does not vouch for its source, because declaring the test alone
+ * is a narrower promise and widening it silently is exactly what this flag
+ * exists to name. A containing directory never vouches for its contents
+ * either — the lane grammar names files, and a lane that means "everything
+ * under `src/`" fails open exactly as an undeclared one would if it cannot
+ * name them.
+ */
+function withinLane(path: string, declared: readonly string[]): boolean {
+  if (declared.includes(path)) return true;
+  for (const d of declared) {
+    if (coLocatedTest(d) === path) return true;
+  }
+  return false;
+}
+
+/** `omp/src/verbs/server.ts` → `omp/src/verbs/server.test.ts`; undefined when
+ *  the declared path has no file extension to splice before, since the
+ *  co-located-test shape is defined by an extension. */
+function coLocatedTest(declared: string): string | undefined {
+  const dot = declared.lastIndexOf(".");
+  const slash = declared.lastIndexOf("/");
+  if (dot <= slash + 1) return undefined;
+  return `${declared.slice(0, dot)}.test${declared.slice(dot)}`;
+}
+
+/**
+ * A diff that escapes its issue's declared file lane (#739).
+ *
+ * The lane is the effective declaration admission resolved at dispatch —
+ * `effectiveLane(body, comments)`, so a pre-dispatch comment beats an older
+ * body declaration — and the flag uses that resolved snapshot, never a re-parse
+ * of the body. The finding names every delivered file outside it, which is the
+ * part a reviewer is worst placed to notice: the diff's own file list is the
+ * only surface that shows the escape, and reading PR file lists by hand is
+ * exactly what nothing else in the loop does.
+ *
+ * Fail-open, like admission: an issue with no lane declaration has nothing to
+ * escape, so no flag — a flag on every undeclared run would be noise within a
+ * day, worse than no flag. Advisory like every other flag here: a widened lane
+ * is often legitimate, and the orchestrator is the judge this exists to brief.
+ */
+function detectLaneEscape(audit: SettlementAudit, flags: SettlementFlag[]): void {
+  const lane = audit.lane;
+  if (lane === undefined || lane.files.length === 0) return;
+  const outside = audit.diff.files
+    .map((f) => f.path)
+    .filter((path) => !withinLane(path, lane.files));
+  if (outside.length === 0) return;
+  flags.push({
+    kind: "lane-escape",
+    file: "(lane)",
+    detail: `PR diff touches files outside the declared file lane: ${outside.join(", ")}`,
+  });
+}
+
 function detectWeakening(audit: SettlementAudit, flags: SettlementFlag[]): void {
   // A test file that left one path and arrived at another is a move, not a
   // deletion. `status: renamed` covers the renames git detected; the basename
@@ -671,6 +754,347 @@ function scanHunks(
   }
 }
 
+// ------------------------------------------------------- claimed proof commands
+
+/**
+ * The proof claims a PR body makes, checked against the run's transcript.
+ *
+ * A worker's Verified section is what the orchestrator merges on, and until
+ * this check nothing compared its claims against what the session actually ran
+ * (#582). The audit is the same family as the test-weakening rules: advisory,
+ * never a state change, and resolving ambiguity towards silence. Every PR
+ * body carries backticked prose, so the false-positive pressure here is real —
+ * an extractor that reads any backtick span in the narrative as a claim would
+ * flag every run within a day.
+ *
+ * Three tolerances make the matcher honest rather than decorative:
+ *
+ * - Claims are extracted only from a verified section — a `## Verified`-style
+ *   heading or an inline `Verified:` label — never from the narrative. This is
+ *   the second named fake of the issue (one-heading parsing), asserted for
+ *   both shapes below.
+ * - Matching is on meaningful shell tokens, not string equality: a claimed
+ *   `bun test src/worker.test.ts` is satisfied by a transcript invocation of
+ *   `cd …/omp && bun test src/worker.test.ts src/session-host.test.ts`,
+ *   because a `cd` pair, shell operators and wrappers are dropped from both
+ *   sides and the claim's tokens must then be a subset of one invocation's.
+ *   Flag order is thereby free, which string equality could never be.
+ * - A claimed command whose invocation the transcript shows was refused by the
+ *   shared-host guard is `claimed-proof-blocked`, not `claimed-proof-missing`:
+ *   the worker *tried* and the guard stopped it (the honest #566/#570 shape,
+ *   whose own words are "CI owns them"), which is not the same finding as a
+ *   claim with no attempt at all.
+ */
+
+/** The verified-section markers a claim must live under: a heading whose text
+ *  contains a `veri*`/`proof` root (`## Verified`, `## Verification`,
+ *  `## How verified`, `## Verification & proof`), or an inline
+ *  `Verified:` / `**Verified:**` label row. `## Tests` is deliberately not
+ *  one — a section describing the diff's test impact is narrative, not proof. */
+const VERIFIED_MARKER =
+  /^(?:#{1,6}\s+.*\b(?:verif|proof)\w*\b.*$|^\s*(?:\*\*)?(?:Verif(?:ied|ication)|Proof)(?:\*\*)?\s*[:.])/im;
+
+/**
+ * The slice of a PR body that can carry proof claims: from the first
+ * verified-section marker to the end of its block. Claims live under backticks,
+ * so the region is what keeps narrative code spans out of the audit — a
+ * backticked `retry.modelFallback: true` in a design explanation is commentary,
+ * never a command somebody claimed to run.
+ */
+function claimRegion(body: string): string {
+  const marker = VERIFIED_MARKER.exec(body);
+  if (marker === null) return "";
+  const start = marker.index;
+  const rest = body.slice(start);
+  // The next-heading scan starts after the marker's own match, or `## Verified`
+  // would cut its own block to nothing — the marker line is a heading too.
+  const after = rest.slice(marker[0].length);
+  const next = /^#{1,6}\s+/m.exec(after);
+  return next === null ? rest : rest.slice(0, marker[0].length + next.index);
+}
+
+/** One backticked span that reads as a whole command: at least two shell words
+ *  and a first word that is an executable (no path separator, or a `./` one).
+ *  A span that names a single file or a config key is not a command claim. */
+function claimedCommand(span: string): boolean {
+  const words = span.split(/\s+/).filter((word) => word.length > 0);
+  if (words.length < 2) return false;
+  const first = words[0] ?? "";
+  return first.startsWith("./") || !first.includes("/");
+}
+
+/**
+ * The commands a PR body claims as proof, each deduplicated by its exact span.
+ * Only spans inside the verified region count, and only command-shaped ones
+ * — the two filters are what keep `## Verified`-island prose out of the audit.
+ */
+function claimedProofCommands(body: string): string[] {
+  const region = claimRegion(body);
+  const claims: string[] = [];
+  const seen = new Set<string>();
+  for (const match of region.matchAll(/`([^`\n]+)`/g)) {
+    const span = (match[1] ?? "").trim();
+    if (span === "" || seen.has(span) || !claimedCommand(span)) continue;
+    seen.add(span);
+    claims.push(span);
+  }
+  return claims;
+}
+
+/**
+ * Split a shell command into its meaningful words: whitespace-separated, quote
+ * characters removed so `bun test "src/my file.ts"` stays one word. Deliberately
+ * not a shell parser — the wide net is fine because the comparison is a subset
+ * in one direction only (see {@link satisfiedBy}).
+ */
+function shellWords(command: string): string[] {
+  const words: string[] = [];
+  let current = "";
+  let quote: string | undefined;
+  for (const ch of command) {
+    if (quote !== undefined) {
+      if (ch === quote) quote = undefined;
+      else current += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (current !== "") {
+        words.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += ch;
+  }
+  if (current !== "") words.push(current);
+  return words;
+}
+
+/** A token that is shell plumbing rather than a command word: `&&`, `|`,
+ *  `;`, redirects, grouping — anything made only of the metacharacter
+ *  alphabet. `2>&1` is kept (it carries a number), so stripping never eats a
+ *  word that discriminates one command from another. */
+const SHELL_PUNCT = /^[&|;<>()$!`]+$/;
+
+/**
+ * The meaningful tokens of one command: shell punctuation dropped, and a
+ * `cd <dir>` pair consumed as binding context rather than a command word —
+ * the tolerated-variant half of the acceptance criteria. Wrapper verbs
+ * (`timeout 300`, `env -i`) survive tokenisation because a *transcript* side
+ * carrying them never hurts a subset check; only a claimed side spelling them
+ * would, which is a shape this fleet's bodies do not produce.
+ */
+function commandTokens(command: string): string[] {
+  const words = shellWords(command);
+  const tokens: string[] = [];
+  for (let i = 0; i < words.length; i++) {
+    const word = words[i] ?? "";
+    if (word === "cd") {
+      i++; // its target is binding context too
+      continue;
+    }
+    if (SHELL_PUNCT.test(word)) continue;
+    tokens.push(word);
+  }
+  return tokens;
+}
+
+/**
+ * The shell-executing tools whose invocations can satisfy a claimed command.
+ * The shared-host guard's own invocation prefixes, minus `source` — a dot
+ * script has no command text of its own worth matching.
+ */
+const SHELL_TOOLS = new Set(["bash", "sh", "zsh"]);
+
+/**
+ * Whether a shell command ran in parse-only mode — a leading `bash -n`,
+ * `sh -n` after the `cd`-stripping, before the first non-flag token. This is
+ * the one how-vs-whether distinction the incident itself turned on: the
+ * shared-host guard explicitly permits `bash -n` on a guarded script while
+ * executing it is refused, and the *path token appears in both forms*, so a
+ * subset match alone would let a parse invocation satisfy a claim of having
+ * run the suite. The shared-host refusal wording makes the same explicit
+ * ("parsing never executes").
+ */
+function parseOnly(tokens: string[]): boolean {
+  const first = tokens[0];
+  if (first === undefined || !SHELL_TOOLS.has(first)) return false;
+  return tokens.slice(1).includes("-n");
+}
+
+/** Whether one claimed command is satisfied by one transcript invocation: the
+ *  claim's tokens are a subset (order-free, multiplicity-checked) of the
+ *  invocation's. Subset rather than subsequence is what makes differing flag
+ *  order harmless; multiplicity is what keeps `bun test a a` from being
+ *  satisfied by `bun test a`.
+ *
+ *  The one semantic guard on top of the subset: a claim that the worker *ran*
+ *  a command is never satisfied by an invocation that only parsed it
+ *  (`bash -n`), for the reason {@link parseOnly} states. A parse claim is
+ *  still satisfied by a parse invocation. */
+function satisfiedBy(claimTokens: string[], invocationTokens: string[]): boolean {
+  if (claimTokens.length === 0 || invocationTokens.length === 0) return false;
+  if (parseOnly(invocationTokens) && !parseOnly(claimTokens)) return false;
+  const remaining = [...invocationTokens];
+  for (const token of claimTokens) {
+    const at = remaining.indexOf(token);
+    if (at < 0) return false;
+    remaining.splice(at, 1);
+  }
+  return true;
+}
+
+interface TranscriptCall {
+  /** The tool-call id, present when the record carries one — links an
+   *  invocation to its tool result for the refused-detection below. */
+  id?: string;
+  /** The command text of the invocation, or undefined when the record's shape
+   *  carries none (a synthetic/aborted call, a record this parser does not
+   *  recognise). */
+  command?: string;
+}
+
+/** The command text a content block or top-level record carries, whatever the
+ *  harness's spelling for it — `input` (tool_use), `arguments` (toolCall) or a
+ *  bare `command` — and undefined when the shape is unrecognised. */
+function commandField(record: { readonly [key: string]: unknown }): string | undefined {
+  for (const key of ["input", "arguments"] as const) {
+    const field = record[key];
+    if (field !== null && typeof field === "object") {
+      // The harness's unvalidated transcript shapes; read as unknowns, like the
+      // daemon's other transcript readers.
+      const args = field as { readonly [key: string]: unknown };
+      const command = args["command"];
+      if (typeof command === "string") return command;
+    }
+  }
+  const direct = record["command"];
+  return typeof direct === "string" ? direct : undefined;
+}
+
+/**
+ * Every shell invocation a transcript records, plus every tool-result that a
+ * shared-host guard refusal produced. Defensive, in the module header's sense:
+ * the transcript is the harness's file, so both shapes this package already
+ * reads (a top-level `{toolName}` event and a `tool_use`/`toolCall` content
+ * block inside an assistant message) are recognised, and an unknown shape is
+ * skipped rather than TypeErroring the audit.
+ */
+export function transcriptCalls(text: string): { calls: TranscriptCall[]; refusals: Set<string> } {
+  const calls: TranscriptCall[] = [];
+  const refusals = new Set<string>();
+  for (const line of text.split("\n")) {
+    if (line.length === 0) continue;
+    let row: unknown;
+    try {
+      row = JSON.parse(line) as unknown;
+    } catch {
+      continue;
+    }
+    if (row === null || typeof row !== "object") continue;
+    const rec = row as { readonly [key: string]: unknown };
+
+    const toolName = rec["toolName"];
+    if (typeof toolName === "string") {
+      if (SHELL_TOOLS.has(toolName)) {
+        const id = rec["id"];
+        const command = commandField(rec);
+        calls.push({
+          ...(typeof id === "string" ? { id } : {}),
+          ...(command === undefined ? {} : { command }),
+        });
+      }
+      continue;
+    }
+    if (rec["type"] !== "message") continue;
+    const message = rec["message"];
+    if (message === null || typeof message !== "object") continue;
+    const m = message as { readonly [key: string]: unknown };
+
+    const content = m["content"];
+    if (Array.isArray(content) && m["role"] === "assistant") {
+      for (const part of content) {
+        if (part === null || typeof part !== "object") continue;
+        const p = part as { readonly [key: string]: unknown };
+        const name = p["name"];
+        if (typeof name !== "string" || !SHELL_TOOLS.has(name)) continue;
+        const id = p["id"];
+        const command = commandField(p);
+        calls.push({
+          ...(typeof id === "string" ? { id } : {}),
+          ...(command === undefined ? {} : { command }),
+        });
+      }
+      continue;
+    }
+
+    // A shared-host refusal arrives as a tool result carrying the guard's
+    // own marker. Keyed by the tool-call id so the refused invocation is the
+    // one identified, never its neighbour.
+    if (m["role"] === "toolResult") {
+      const toolCallId = m["toolCallId"];
+      if (typeof toolCallId !== "string") continue;
+      const parts = Array.isArray(content) ? content : [];
+      const refused = parts.some((part): boolean => {
+        if (part === null || typeof part !== "object") return false;
+        const block = part as { readonly [key: string]: unknown };
+        const text = block["text"];
+        return typeof text === "string" && text.includes("sharedHostPolicy");
+      });
+      if (refused) refusals.add(toolCallId);
+    }
+  }
+  return { calls, refusals };
+}
+
+/**
+ * The claimed-proof half of the settlement audit: one finding per claimed
+ * command whose transcript is silent, and a distinct finding (the honest
+ * shape) for one the guard refused. The presence direction — a claim satisfied
+ * by any invocation — produces nothing, which is the whole point of the flag
+ * existing: silence is what a true Verified section earns.
+ */
+function detectClaimedProof(audit: SettlementAudit, flags: SettlementFlag[]): void {
+  if (audit.prBody === undefined || audit.transcript === undefined) return;
+  const claims = claimedProofCommands(audit.prBody);
+  if (claims.length === 0) return;
+  const { calls, refusals } = transcriptCalls(audit.transcript);
+  const invocations = calls
+    .filter((call) => call.command !== undefined)
+    .map((call) => {
+      const tracked = call as { id?: string; command: string };
+      return { ...tracked, tokens: commandTokens(tracked.command) };
+    });
+
+  for (const claim of claims) {
+    const claimTokens = commandTokens(claim);
+    if (claimTokens.length === 0) continue;
+    const matched = invocations.filter((call) => satisfiedBy(claimTokens, call.tokens));
+    if (matched.length > 0) {
+      // A claimed command the guard refused is an attempted-and-blocked report,
+      // never a fabricated one: the worker's own words were "CI owns them",
+      // and a reviewer should be pointing at the guard, not the worker.
+      if (matched.some((call) => call.id !== undefined && refusals.has(call.id))) {
+        flags.push({
+          kind: "claimed-proof-blocked",
+          file: "(transcript)",
+          detail: `\`${evidence(claim)}\` was attempted, but the shared-host guard refused it (CI owns it)`,
+        });
+      }
+      continue;
+    }
+    flags.push({
+      kind: "claimed-proof-missing",
+      file: "(transcript)",
+      detail: `\`${evidence(claim)}\` is claimed as proof, but no command matching it appears in the run's transcript`,
+    });
+  }
+}
+
 // -------------------------------------------------------------------- printing
 
 /** Beyond this the report is a wall of text nobody reads; the count still tells

package/src/digest-schedule.ts

@@ -58,6 +58,43 @@ export function localDayKey(at: number, timezone?: string): string {
   return localDigestMinute(at, timezone).day;
 }
 
+/** The durable day-marker key for the db-snapshot cadence (#289), mirroring
+ *  the `digest:<day>` dedupe keys in the report outbox. */
+export function dbSnapshotMarkerKey(dayKey: string): string {
+  return `db-snapshot:${dayKey}`;
+}
+
+/**
+ * Whether the conductor.db snapshot cadence is due now.
+ *
+ * The store is the ledger — the verb ledger, the decision rows and the run
+ * history have no other copy — so it is snapshotted once per day, aligned to
+ * the digest tick: a daily digest applies the exact {@link digestDue}
+ * predicate (same day boundary, same `at`, same timezone), so the snapshot
+ * lands on the same tick the digest goes out. A `none` or `per-tick` digest
+ * still leaves the ledger on a daily schedule — durability does not follow
+ * the reporting preference — bounded by the policy-zone day key (host zone
+ * when the policy carries none), with no `at`. The zone must be the
+ * policy's: the caller writes the `db-snapshot:<day>` marker with
+ * {@link localDayKey localDayKey(now, policy.digest.timezone)}, so a
+ * host-zone read here would disagree with it whenever the two zones fall on
+ * different days, and a `{cadence: "per-tick", timezone: "Europe/London"}`
+ * policy on a UTC host would re-snapshot on every tick during the offset
+ * window, pruning the retained set to nothing.
+ *
+ * Pure by construction, like {@link digestDue}: the last-run fact arrives as
+ * the day key (`db-snapshot:<day>` marker present for today ⟺ last run was
+ * today), never a clock the caller read an hour ago.
+ */
+export function dbSnapshotDue(
+  policy: Pick<ReportingPolicy, "digest">,
+  lastSnapshotDayKey: string | undefined,
+  now: number,
+): boolean {
+  if (policy.digest.cadence === "daily") return digestDue(policy, lastSnapshotDayKey, now);
+  return localDayKey(now, policy.digest.timezone) !== lastSnapshotDayKey;
+}
+
 /**
  * Whether the digest is due now.
  *

package/src/doctor.ts

@@ -85,7 +85,10 @@ import {
   SYSTEMD_UNIT_DIR,
   tickCwdForProject,
   totalConfiguredWorkers,
+  workerAclHealth,
+  type WorkerAclHealth,
 } from "./setup-host.ts";
+import { WORKER_ACCOUNT } from "./host.ts";
 import { checkTokenScopes, type ScopeCheck } from "./setup.ts";
 import { DB_SNAPSHOT_STEM, dbPath, LIVE_STATES } from "./store.ts";
 import { telegramReportSend, type ReportSend } from "./reports.ts";
@@ -142,6 +145,10 @@ const INCIDENTS = {
   spend:
     "spend telemetry was once absent, so the USD cap never fired — $0.00 spend is not proof of no spend",
   ghauth: "gh auth expired under a live daemon and every tracker call failed silently",
+  workerAcl:
+    "the #835 incident: a setup host granted the worker's path ACLs before restarting the fleet, an OMP startup chmod'd " +
+    "the agent config dir back to 0700 and rewrote the ACL mask, and the next two admitted workers died on EACCES " +
+    "before connecting — the named ACL entry was still there, only its effective permissions were gone",
 } as const;
 
 // ------------------------------------------------------------------ dependencies
@@ -268,6 +275,13 @@ export interface DoctorDeps {
   tickAgentName?: (project: ProjectConfig) => string | undefined;
   /** Clock, so a run is deterministic in tests. */
   now?: () => number;
+  /** The linked worker config paths' effective-ACL verdict for the dedicated
+   *  worker account (#835): `checkable` paths judged, `missing` the ones that
+   *  do not currently grant the worker's needed effective access. Read-only
+   *  and injectable so no test ever touches the host's ACLs; the production
+   *  wiring is the identity plan's own getfacl probe, so `doctor` and
+   *  `setup host` cannot disagree about an ACL. */
+  workerAclHealth?: () => WorkerAclHealth;
   /** The one opt-in side effect: send one self-identified Telegram probe. */
   probeTelegram?: boolean;
 }
@@ -902,6 +916,37 @@ function ownershipProbe(probes: Probes): Finding {
   return failFinding("systemd-ownership", summary, fix);
 }
 
+/**
+ * The dedicated worker account's path ACLs (#835): every linked worker config
+ * path must grant the worker its *effective* search/read permissions. The
+ * installed OMP harness chmods its agent config dir back to 0700 on every
+ * open, and a chmod rewrites the ACL mask — the named entry survives as
+ * `user:omp-worker:--x  #effective:---` while the worker's access silently
+ * vanishes, which is exactly the incident this finding exists to catch
+ * (`${INCIDENTS.workerAcl}`). The verdict comes from the identity plan's own
+ * probe through the read-only {@link DoctorDeps.workerAclHealth} seam, so a
+ * pass here is a pass the plan agrees with and a fail names the paths whose
+ * mask is stripping the grant.
+ */
+function workerAclProbeFinding(probes: Probes): Finding {
+  const health = probes.workerAclHealth();
+  if (health.checkable === 0) {
+    return passFinding("worker-acl", "no linked worker config paths on this host yet — nothing to check");
+  }
+  if (health.missing.length === 0) {
+    return passFinding(
+      "worker-acl",
+      `${health.checkable} linked worker config path(s) grant ${WORKER_ACCOUNT} effective search/read access`,
+    );
+  }
+  return failFinding(
+    "worker-acl",
+    `the ${WORKER_ACCOUNT} account's ACL is not effective on ${health.missing.join(", ")} — a named entry the ACL mask strips is ` +
+      "unreachable by the worker, and the next admitted worker dies on EACCES before connecting",
+    "re-run `omp-conductor setup host`: the transaction re-applies the ACL grants (mask included) after the final fleet restart",
+  );
+}
+
 /** IANA timezone in reporting config — an invalid zone silently mis-schedules
  *  the availability window and the daily digest (#273). */
 function timezoneProbe(project: ProjectConfig | undefined): Finding {
@@ -1645,6 +1690,10 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
   findings.push(unitProbe(probes, projects[0], cfg));
   findings.push(recoveryProbe(probes));
   findings.push(ownershipProbe(probes));
+  // The worker's path ACLs are a host-wide fact like the unit ownership: one
+  // shared daemon account, one shared worker identity, one shared set of
+  // linked config paths. A finding once, never once per project.
+  findings.push(workerAclProbeFinding(probes));
   // #541 seam checks, host-global: the live herdr config and the plugin's
   // config.env are single files on the host, not per-project facts.
   findings.push(herdrResumeProbe(probes));
@@ -1688,6 +1737,9 @@ export function defaultProbes(): Probes {
     readUnit: defaultReadUnit,
     stat: defaultStat,
     uidOf: defaultUidOf,
+    // The same effective-ACL read the identity plan plans with — doctor and
+    // setup cannot disagree about a worker grant (#835).
+    workerAclHealth: () => workerAclHealth(join(homedir(), ".omp", "agent")),
     dbIntegrity: defaultDbIntegrity,
     snapshotDirState: defaultSnapshotDirState,
     sessionRootState: defaultSessionRootState,

package/src/escalate.ts

@@ -403,11 +403,17 @@ function errText(e: unknown): string {
  *
  * Exported for the report outbox (#123), which pages over the same bot and must
  * resolve the token the same way. Two readers of one `.env` is fine; two
- * *implementations* of the parse below is how they drift.
+ * *implementations* of the parse below is how they drift. The state dir is the
+ * shared resolution both the token read and the interactive ask surface (#722)
+ * need, so it is one function rather than a second copy of the override.
  */
-export function readTelegramToken(): string | undefined {
+export function telegramStateDir(): string {
   const override = process.env.OMP_TELEGRAM_STATE_DIR?.trim();
-  const dir = override ? override : join(homedir(), ".omp", "agent", "telegram");
+  return override ? override : join(homedir(), ".omp", "agent", "telegram");
+}
+
+export function readTelegramToken(): string | undefined {
+  const dir = telegramStateDir();
   let raw: string;
   try {
     raw = readFileSync(join(dir, ".env"), "utf8");