omp-conductor 0.18.0 → 0.18.1

package/src/session-host.ts

@@ -21,7 +21,9 @@
 
 import { connect } from "node:net";
 
+import { identityMismatch } from "./host.ts";
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
+import type { GraphToolsObservation } from "./types.ts";
 import type { GateShape, ReleaseBlockContext } from "./release-policy.ts";
 import type { ResolvedGrants, SessionRole } from "./types.ts";
 
@@ -34,6 +36,16 @@ export interface SessionHostSpec {
   socket: string;
   cwd: string;
   role: SessionRole;
+  /**
+   * The kernel identity this session was launched under (#798): the uid/gid
+   * setpriv dropped to before this process started. The child asserts
+   * `process.getuid()/getgid()` against it as its first act, and refuses to
+   * build a session when they differ — a worker session whose kernel identity
+   * is not the one its parent established must not run worker code. Absent,
+   * the session runs as the daemon's own uid, which is what every
+   * non-worker surface (orchestrator, tests) wants.
+   */
+  identity?: { uid: number; gid: number };
   sessionDir?: string;
   model?: string;
   resume?: boolean;
@@ -79,7 +91,35 @@ export type ParentToHost =
 
 /** Child → parent. */
 export type HostToParent =
-  | { t: "ready"; sessionFile?: string; modelFallbackMessage?: string }
+  | {
+      t: "ready";
+      sessionFile?: string;
+      modelFallbackMessage?: string;
+      /**
+       * The omp-conductor version this child process loaded, attested at the
+       * ready handshake (#832): the session host's `ready` is the exact-session
+       * handoff the upgrade verifies against, so the live process's own loaded
+       * module version travels with it instead of being read off disk later.
+       * Absent only when the version cannot be read — absence is "not
+       * attested", never "the newest".
+       */
+      extensionVersion?: string;
+      /** Exact peer entry and package version loaded by this child (#828). */
+      harnessPath?: string;
+      harnessVersion?: string;
+    }
+  | {
+      t: "graph-tools";
+      /**
+       * The code-graph session observation (#726): whether the graph MCP tools
+       * were in this session's registry. Sent once the session's tool registry
+       * settles (it finalises after creation, so the ready handshake never
+       * waits for it). Absent value never travels — no message means no
+       * observation was recorded, never "graph tools absent", which is the
+       * `present: false` truth value.
+       */
+      graphTools: GraphToolsObservation;
+    }
   | { t: "start-error"; message: string }
   | { t: "event"; event: unknown }
   | { t: "session-file"; path: string }
@@ -172,11 +212,17 @@ export interface SessionHostDeps {
  * into the same `Error` the in-process path would have raised, so a missing
  * peer dependency still reads as a deployment mistake rather than as an
  * unexplained child exit.
+ *
+ * Returns `false` when the session refused to start because the identity it
+ * was launched for does not match the kernel identity this process actually
+ * runs under — that refusal is the fail-closed arm of the worker boundary,
+ * and the caller turns it into a non-zero exit so nothing downstream can read
+ * it as a clean session.
  */
 export async function runSessionHost(
   spec: SessionHostSpec,
   deps: SessionHostDeps = { createSession: createLocalSession },
-): Promise<void> {
+): Promise<boolean> {
 
   const socket = connect(spec.socket);
   socket.setNoDelay(true);
@@ -184,6 +230,26 @@ export async function runSessionHost(
     if (!socket.writableEnded) socket.write(encodeFrame(message));
   };
 
+  // The kernel identity check comes as early as there is a socket to report
+  // over and before the harness (`createSession`) has run a single byte of
+  // worker-controlled code. A child whose uid/gid are not the ones its parent
+  // launched it for proves the boundary did not hold — the daemon would be
+  // supervising a session that is not what it thinks it is.
+  const violation = identityMismatch(spec.identity);
+  if (violation !== undefined) {
+    send({ t: "start-error", message: violation });
+    // The frame must reach the parent before this process exits: `process.exit`
+    // does not flush the socket, and a parent that only observes the exit used
+    // to report a bare exit code instead of the child's own words. The parent
+    // resolves the run as failed with no live child — fail closed.
+    await new Promise<void>((resolve) => {
+      socket.once("finish", () => resolve());
+      socket.once("error", () => resolve());
+      socket.end();
+    });
+    return false;
+  }
+
   const { promise: connected, resolve: onConnect, reject: onConnectFail } = Promise.withResolvers<void>();
   socket.once("connect", () => {
     onConnect();
@@ -220,12 +286,15 @@ export async function runSessionHost(
     // The frame must reach the parent before this process exits: `process.exit`
     // does not flush the socket, and a parent that only observes the exit used
     // to report a bare exit code instead of the child's own words.
+    // This is a failed start, not an identity refusal: the process still walks
+    // away with a clean exit code, because the parent's verdict comes from the
+    // frame, not the status — 91 is reserved for the boundary refusal above.
     await new Promise<void>((resolve) => {
       socket.once("finish", () => resolve());
       socket.once("error", () => resolve());
       socket.end();
     });
-    return;
+    return true;
   }
 
   const live = session;
@@ -248,8 +317,28 @@ export async function runSessionHost(
     ...(live.modelFallbackMessage === undefined
       ? {}
       : { modelFallbackMessage: live.modelFallbackMessage }),
+    // The loaded-module attestation (#832): what THIS process's session
+    // machinery actually executes, carried in the exact-session handoff the
+    // upgrade verifies against.
+    ...(live.extensionVersion === undefined ? {} : { extensionVersion: live.extensionVersion }),
+    ...(live.harnessPath === undefined ? {} : { harnessPath: live.harnessPath }),
+    ...(live.harnessVersion === undefined ? {} : { harnessVersion: live.harnessVersion }),
   });
 
+  // The code-graph session observation (#726) rides its own frame: the factory
+  // reads the session's tool registry asynchronously (the harness finalises
+  // MCP wiring after creation), so the ready handshake never waits for it. The
+  // child is the session's own process — this is the runtime observation the
+  // config check in `resolvePrereqs` deliberately is not, and an observation
+  // that never resolves simply never travels: no message is "not recorded",
+  // never "graph tools absent".
+  const graphToolsReady = live.graphToolsReady;
+  if (graphToolsReady !== undefined) {
+    void graphToolsReady.then((graphTools) => {
+      if (graphTools !== undefined) send({ t: "graph-tools", graphTools });
+    });
+  }
+
   const { promise: finished, resolve: finish } = Promise.withResolvers<void>();
   let buffer = "";
   socket.on("data", (chunk: Buffer) => {
@@ -316,6 +405,7 @@ export async function runSessionHost(
     // Teardown noise must not become the run's outcome.
   }
   socket.end();
+  return true;
 }
 
 /** Reads the spec the parent handed over. Argv, not stdin: stdin is the harness's. */
@@ -331,6 +421,10 @@ if (import.meta.main) {
   // Exit code is the parent's only signal when the socket never opened, so a
   // spec that will not parse fails loudly here rather than as a silent hang.
   const spec = specFromArgv(process.argv);
-  await runSessionHost(spec);
-  process.exit(0);
+  const started = await runSessionHost(spec);
+  // A refused start — the launched identity did not match this process's
+  // kernel identity — exits 91 (the same code the rejected cgroup-boundary
+  // launcher used) so an operator reading `ps` or the exit status sees a
+  // boundary refusal, never a clean exit.
+  process.exit(started ? 0 : 91);
 }

package/src/settlement.ts

@@ -23,8 +23,9 @@ import {
   deriveChangedLine,
 } from "./diff-flags.ts";
 import { classifyRun, normalise, type ClassifyFacts } from "./failure-class.ts";
+import { GhPrMissingError } from "./tracker/github.ts";
 import { formatModelsTried, modelsTried } from "./model-fallback.ts";
-import { PR_LOOKUP_WINDOW_MS } from "./verbs/server.ts";
+import { PR_LOOKUP_WINDOW_MS } from "./decisions.ts";
 import {
   removeWorktree,
   salvageWip,
@@ -35,6 +36,7 @@ import type {
   Caps,
   Escalation,
   FailureClass,
+  FileLane,
   MergedPrInfo,
   OpenCloser,
   PrState,
@@ -107,7 +109,7 @@ export interface SettlementAuditResult {
  */
 export async function collectSettlementFlags(
   tracker: Pick<Tracker, "prDiff" | "prBody">,
-  claim: { prUrl?: string; issueText: string; sessionFile?: string },
+  claim: { prUrl?: string; issueText: string; sessionFile?: string; lane?: FileLane },
 ): Promise<SettlementAuditResult> {
   if (claim.prUrl === undefined) return { flags: [UNREADABLE_TREE_FLAG], truncated: false };
   // The diff and the claimed-proof body read in parallel; both are advisory,
@@ -135,6 +137,7 @@ export async function collectSettlementFlags(
       diff,
       ...(prBody === undefined ? {} : { prBody }),
       ...(transcript === undefined ? {} : { transcript }),
+      ...(claim.lane === undefined ? {} : { lane: claim.lane }),
     }),
     truncated: diff.truncated,
     changedLine: deriveChangedLine(diff),
@@ -174,14 +177,24 @@ export interface Settlement {
  *   `returned-for-revision` at settlement. A review decision asks for another
  *   implementation pass, not a failure, so it consumes the continuation budget
  *   instead of the failed-attempt budget.
+ * - `missing` — the claimed PR definitively does not exist (a definitive 404
+ *   from the tracker, never a transient outage). Work was pushed but no PR
+ *   ever appeared, so the honest terminal is the same as `closed`: `failed`,
+ *   work preserved on the branch and the issue returned to the queue as a
+ *   continuation. Nothing retrying can recover — a missing PR does not grow
+ *   back (#779).
  * - `open`, and undefined — nothing changes. Undefined is "could not tell": a
- *   flaky network, a revoked token, a deleted PR. Settling on it would record a
- *   merge that never happened, and the next tick asks again for free. An
- *   ambiguous answer must never settle a row.
+ *   flaky network, a revoked token. Settling on it would record a merge that
+ *   never happened, and the next tick asks again for free. An ambiguous answer
+ *   must never settle a row.
  */
-export function settlementFor(pr: PrState | undefined, prUrl: string): Settlement | undefined {
+export function settlementFor(
+  pr: PrState | "missing" | undefined,
+  prUrl: string,
+): Settlement | undefined {
   if (pr === "merged") return { state: "merged", reason: `${prUrl} merged` };
   if (pr === "closed") return { state: "failed", reason: `${prUrl} closed without merging` };
+  if (pr === "missing") return { state: "failed", reason: `PR ${prUrl} does not exist` };
   return undefined;
 }
 
@@ -311,16 +324,27 @@ export async function settlePushedGreen(
     // must not buy a `gh` call every five minutes forever.
     if (run.prUrl === undefined) continue;
 
-    let pr: PrState | undefined;
+    let pr: PrState | "missing" | undefined;
     try {
       pr = await tracker.prState(run.prUrl);
     } catch (err) {
-      // Per row, like admission's held candidate. The GitHub adapter already
-      // answers undefined instead of throwing, so this catch is the port's
-      // contract rather than that adapter's behaviour — and a tracker that does
-      // throw must cost its own row, not the whole sweep.
-      log(`#${run.issue} not settled: PR state lookup failed (${errText(err)}) — retrying next tick`);
-      continue;
+      // The adapter throws exactly one classified error: `GhPrMissingError`,
+      // an individual REST 404 the adapter has corroborated with a
+      // same-repository pulls-list read, so the claimed PR definitively does
+      // not exist (#779). That is not "could not tell" — retrying can never
+      // conjure the PR — so the row is settled as a missing PR through the
+      // same mapping as a closed one: work preserved on the branch, busy guard
+      // released, issue back on the queue. A raw 404 that was never
+      // corroborated (a hidden repository, a lost token scope) stays "could
+      // not tell": the instance check is the corroboration, and every other
+      // failure retries next tick, per row — a tracker that throws
+      // unclassified must cost its own row, not the whole sweep.
+      if (err instanceof GhPrMissingError) {
+        pr = "missing";
+      } else {
+        log(`#${run.issue} not settled: PR state lookup failed (${errText(err)}) — retrying next tick`);
+        continue;
+      }
     }
 
     const settlement = settlementFor(pr, run.prUrl);
@@ -1297,10 +1321,23 @@ export async function classifyAndRecover(d: SettlementDeps): Promise<number> {
         }
       }
     } catch (err) {
-      // Per row, like every other sweep here: one unreachable PR must not stop
-      // the rest from being classified. The next tick asks again for free.
-      log(`#${run.issue} not classified: fact gathering failed (${errText(err)}) — retrying next tick`);
-      continue;
+      // The tracker throws exactly one classified error: `GhPrMissingError`,
+      // an individual REST 404 the adapter corroborated with a
+      // same-repository pulls-list read, so the claimed PR definitively does
+      // not exist (#779). That is a fact, not "could not tell" — retrying can
+      // never conjure the PR — so it is recorded as the absent-PR fact and
+      // classification proceeds instead of leaving the row in
+      // `selectUnclassified` to be offered forever. Everything else (a 5xx, a
+      // revoked token, an opaque 404) is genuinely unreadable and the next
+      // tick asks again for free.
+      if (err instanceof GhPrMissingError) {
+        facts.pr = "missing";
+      } else {
+        // Per row, like every other sweep here: one unreachable PR must not stop
+        // the rest from being classified. The next tick asks again for free.
+        log(`#${run.issue} not classified: fact gathering failed (${errText(err)}) — retrying next tick`);
+        continue;
+      }
     }
 
     const { cls, recovery, evidence } = classifyRun(classifiedRun, facts, caps);
@@ -1310,6 +1347,21 @@ export async function classifyAndRecover(d: SettlementDeps): Promise<number> {
     // base does move under it.
     if (run.state === "pushed-green" && cls === "unknown") continue;
 
+    // A recovery of `none` is the classifier naming no failure class for the
+    // row at all: a terminal `failed` row whose PR is open and every check is
+    // green is the strongest mechanical success evidence there is short of
+    // merge, so it is not a failed attempt. Restore it to `pushed-green` — the
+    // settle sweep owns the merge decision from there, `failuresFor` stops
+    // counting it, and no `[unknown]` escalation is persisted. Nothing else is
+    // written, so the row stays in the normal `pushed-green` lifecycle
+    // (merge-conflict on a moved base, settle on a merged or closed PR) rather
+    // than being pinned by a class it never had (#766).
+    if (recovery === "none") {
+      store.updateRun(run.id, { state: "pushed-green" });
+      log(`#${run.issue} restored to pushed-green: ${evidence}`);
+      continue;
+    }
+
     const retry = run.failureClass !== undefined;
     store.updateRun(run.id, { failureClass: cls, recoveryAction: recovery });
     log(