omp-conductor 0.18.0 → 0.18.1

package/src/setup-install.ts

@@ -52,6 +52,8 @@ import {
   agentRenameVerdict,
   checkEscalation,
   DEFAULT_AGENT_RENAME_DEPS,
+  defaultIdentityProbes,
+  defaultServiceRuntime,
   planHostRuntime,
   totalConfiguredWorkers,
   writeHostRuntime,
@@ -61,6 +63,7 @@ import {
   type AgentRenameDeps,
   type EscalationDeps,
   type ServiceRuntime,
+  type WorkerIdentityProbes,
 } from "./setup-host.ts";
 import type { WizardUi } from "./wizard-ui.ts";
 import type { Caps, ProjectConfig, Store } from "./types.ts";
@@ -81,6 +84,14 @@ export interface InstallDeps {
   escalation?: EscalationDeps;
   /** `"linux"` gates the systemd half. Injectable so the refusal is testable. */
   platform?: () => string;
+  /**
+   * The worker identity plan's probes (#798). `undefined` means the real
+   * host's read-only facts — production: every `setup host` installs and
+   * grants the dedicated worker account. `null` disables the identity plan
+   * entirely (the historical step list, for tests pinning it), and an object
+   * is used as given (tests pinning a specific host state).
+   */
+  workerIdentityProbes?: WorkerIdentityProbes | null;
   unitDir?: string;
   /**
    * Where the recovery playbook installs. Injectable so the idempotency gate
@@ -188,6 +199,13 @@ export async function runHostInstall(
   // happens only after consent (#510), so the prompt's "Nothing has been run
   // yet" is true of the staged tree when it is printed, and a declined run
   // leaves every staged file byte-identical.
+  // The worker identity plan rides the same consent (#798): production probes
+  // the real host (account present? grants current?); a test may pass its own
+  // probes, or `null` to plan the historical step list only.
+  const identityProbes: WorkerIdentityProbes | null =
+    deps.workerIdentityProbes === null
+      ? null
+      : deps.workerIdentityProbes ?? defaultIdentityProbes(deps.runtime ?? defaultServiceRuntime(telegramStateDir));
   const plan = planHostRuntime(
     project,
     caps,
@@ -197,6 +215,7 @@ export async function runHostInstall(
     unitDir,
     deps.recoverScriptInstallPath ?? RECOVER_SCRIPT_INSTALL_PATH,
     deps.multiProject ?? hostMultiProject(),
+    identityProbes,
   );
   // No pane-shell key is planned (unusable login shell, unparseable config):
   // the operator hears why before the consent prompt, not after an install
@@ -298,6 +317,15 @@ export async function runHostInstall(
                 ]),
           ]),
       "The unit runs as the account that staged it; nothing here changes that.",
+      ...(plan.workerIdentity === undefined
+        ? []
+        : [
+            `Establishes the dedicated worker identity ${plan.workerIdentity.account}: every worker session runs under it, ` +
+              "never under the daemon's account, and it is granted search/read access to exactly the fleet paths a worker needs.",
+            ...(plan.workerIdentity.current
+              ? ["The worker identity is already in place — nothing to change."]
+              : plan.workerIdentity.pending),
+          ]),
       "",
       liveWorkers === 0
         ? "No workers are live — nothing to drain before the restart."

package/src/setup-wizard.ts

@@ -979,6 +979,7 @@ function seedFromDiscovery(seed: SetupAnswers, found: DiscoveredFacts): SetupAns
       inProgress: labels.get(seed.stateLabels.inProgress.toLowerCase()) ?? seed.stateLabels.inProgress,
       blocked: labels.get(seed.stateLabels.blocked.toLowerCase()) ?? seed.stateLabels.blocked,
       failed: labels.get(seed.stateLabels.failed.toLowerCase()) ?? seed.stateLabels.failed,
+      backlog: labels.get(seed.stateLabels.backlog.toLowerCase()) ?? seed.stateLabels.backlog,
     },
     targetRepos,
     policy: {
@@ -1094,19 +1095,28 @@ const askTrackerAndRepos: AreaAsker = async (ui, a, probes) => {
 
   // One confirm instead of three prompts: the namespaced defaults are right for
   // almost everyone, and three dialogs of Enter-to-accept is how a wizard earns
-  // its reputation.
+  // its reputation. The park label is in the same confirm, with its ownership
+  // stated — it is not conductor-written, but it has to exist for the operator
+  // to have the gesture (#507).
   const stateLabels: SetupAnswers["stateLabels"] = { ...a.stateLabels };
   const customiseStates = await askYesNo(
     ui,
     "customise-state-labels",
     "State labels",
     `The conductor writes back "${stateLabels.inProgress}", "${stateLabels.blocked}" and ` +
-      `"${stateLabels.failed}" so the tracker alone shows live state. Rename them?`,
+      `"${stateLabels.failed}" so the tracker alone shows live state; "${stateLabels.backlog}" is ` +
+      `yours — the conductor never writes it, but an issue carrying it is never claimed. Rename them?`,
   );
   if (customiseStates) {
     stateLabels.inProgress = await ask(ui, "state-label-in-progress", "Label for a run in progress", stateLabels.inProgress);
     stateLabels.blocked = await ask(ui, "state-label-blocked", "Label for a run parked on a human", stateLabels.blocked);
     stateLabels.failed = await ask(ui, "state-label-failed", "Label for a run that gave up", stateLabels.failed);
+    stateLabels.backlog = await ask(
+      ui,
+      "state-label-backlog",
+      "Label the operator applies to park an issue (the conductor never writes it)",
+      stateLabels.backlog,
+    );
   }
 
   const routingLabelPrefix = await ask(
@@ -2516,6 +2526,7 @@ function captureInventory(
   };
   captureIfWritten(plan.runtime.service);
   captureIfWritten(plan.runtime.herdrUnit);
+  captureIfWritten(plan.runtime.harnessMount);
   captureIfWritten(plan.runtime.herdrConfig);
   captureIfWritten(plan.runtime.herdrEnv);
   captureIfWritten(plan.runtime.recoverUnit);

package/src/setup.ts

@@ -39,7 +39,6 @@ import {
 import {
   clonePolicy,
   configPath,
-  DEFAULT_STATE_LABELS,
   defaultMirrorRoot,
   defaultWorkspaceRoot,
   resolveArmProof,
@@ -144,7 +143,7 @@ export interface SetupAnswers {
   /** Tracker repo as `owner/repo` — the only spelling `gh` takes without a host. */
   trackerRepo: string;
   queueLabel: string;
-  stateLabels: { inProgress: string; blocked: string; failed: string };
+  stateLabels: { inProgress: string; blocked: string; failed: string; backlog: string };
   routingLabelPrefix: string;
   targetRepos: {
     name: string;
@@ -318,7 +317,12 @@ export interface LabelPlan {
  *  cannot drift apart: one spelling of "ready-for-agent" in the package. */
 export const SETUP_DEFAULTS = {
   queueLabel: "ready-for-agent",
-  stateLabels: { inProgress: "agent:in-progress", blocked: "agent:blocked", failed: "agent:failed" },
+  stateLabels: {
+    inProgress: "agent:in-progress",
+    blocked: "agent:blocked",
+    failed: "agent:failed",
+    backlog: "backlog",
+  },
   routingLabelPrefix: "repo:",
   defaultBranch: "main",
   /** Both authorities start with the human; the wizard asks to move each one. */
@@ -578,13 +582,15 @@ const POLICY_TEMPLATE_PATH = join(import.meta.dir, "briefs", "policy.md");
 const REQUIRED_SCOPES = ["repo", "project"] as const;
 
 /** GitHub's own palette, so the tracker reads at a glance: green means queued,
- *  blue means moving, amber means waiting on you, red means it gave up, and
- *  purple is routing — the operator's input, the one label the loop never writes. */
+ *  blue means moving, amber means waiting on you, red means it gave up, grey
+ *  means the operator parked it, and purple means routing — the operator's
+ *  input, the label the loop never writes. */
 const LABEL_COLOURS = {
   queue: "0e8a16",
   inProgress: "1d76db",
   blocked: "fbca04",
   failed: "b60205",
+  backlog: "8b949e",
   routing: "6f42c1",
 } as const;
 
@@ -668,14 +674,15 @@ export async function checkTokenScopes(): Promise<ScopeCheck> {
 
 /**
  * Every label setup wants on the tracker, before existence is known: the queue
- * and state labels the loop reads and writes, plus one routing label per routed
- * repo. Pure — the prefix and the repo keys are already answered at this point
- * in the interview — which is what lets a test pin the whole set without `gh`.
+ * and state labels the loop reads and writes, the operator's park label (which
+ * the loop must never write), plus one routing label per routed repo. Pure —
+ * the prefix and the repo keys are already answered at this point in the
+ * interview — which is what lets a test pin the whole set without `gh`.
  *
- * Routing labels are provisioned, never applied: `route()` requires exactly one
- * `<prefix><repo>` label per issue and treats zero or two as unroutable, so a
- * tracker without them can queue nothing. Creating them queues nothing either —
- * applying one, with the queue label, stays the operator's sign-off.
+ * The park label is provisioned like the rest but owned the other way round:
+ * it exists so the operator has a gesture, and the conductor never applies or
+ * removes it (#507). Creating it queues nothing either — applying one, with
+ * the queue label, stays the operator's sign-off.
  */
 export function wantedLabels(a: SetupAnswers): Omit<LabelPlan, "exists">[] {
   return [
@@ -699,6 +706,11 @@ export function wantedLabels(a: SetupAnswers): Omit<LabelPlan, "exists">[] {
       colour: LABEL_COLOURS.failed,
       description: "The conductor gave up on this issue after its retry budget",
     },
+    {
+      name: a.stateLabels.backlog,
+      colour: LABEL_COLOURS.backlog,
+      description: "Parked by the operator — never claimed, only the operator may set or clear it",
+    },
     ...a.targetRepos.map((r) => ({
       name: `${a.routingLabelPrefix}${r.name}`,
       colour: LABEL_COLOURS.routing,
@@ -973,7 +985,11 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     name: a.projectName,
     tracker: { kind: "github", repo: a.trackerRepo },
     queueLabel: a.queueLabel,
-    stateLabels: { ...a.stateLabels, backlog: DEFAULT_STATE_LABELS.backlog },
+    // The park label is now an answer like the other three: the wizard offers
+    // it and every answers constructor carries it, so writing the answers as
+    // they stand is the single source — slice 1's hardcoded default bridge is
+    // gone (#507 slice 2).
+    stateLabels: { ...a.stateLabels },
     routing: { labelPrefix: a.routingLabelPrefix, repos },
     caps,
     ...(a.workerModel !== undefined && a.workerModel.trim().length > 0

package/src/shell.ts

@@ -0,0 +1,15 @@
+/**
+ * One CLI argument rendered exactly as an operator would type it, for surfaces
+ * that print executable commands.
+ *
+ * A command a surface prints is a command the reader copies, so an argument
+ * that could mean something else is a defect: a project named `odd $fleet`
+ * must not render `--project odd $fleet` (two arguments, and a `$` that the
+ * shell would read). Safe characters pass through unquoted; anything else is
+ * wrapped in single quotes, folding an embedded quote with the standard
+ * `'\''` — the same convention the privileged-step renderer applies to its
+ * printed `sudo …` lines (#810).
+ */
+export function shellQuote(value: string): string {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}

package/src/status-render.ts

@@ -24,7 +24,7 @@ import type { CodeGraphHealth } from "./graph-health.ts";
 import { formatDigestBacklog, formatOpenReports } from "./reports.ts";
 import { formatDownDuration, formatOrchestratorDown } from "./orchestrator-down.ts";
 import { planUsageLine } from "./usage.ts";
-import { SYSTEMD_UNIT, type UnitOwnership } from "./lifecycle.ts";
+import { HEALTH_TIMEOUT_MS, SYSTEMD_UNIT, type UnitOwnership } from "./lifecycle.ts";
 import type { WorkerPausePhase } from "./worker.ts";
 import { formatRss, rssBytesFromHealthz } from "./host.ts";
 import {
@@ -90,6 +90,14 @@ export function formatCodeGraphHealth(graph: CodeGraphHealth, now = Date.now()):
     `code graph  ${graph.status}  ${indexed}/${graph.repos.length} repos indexed`,
     `  indexer   ${graph.prerequisites.indexer}`,
     `  MCP mount ${graph.prerequisites.mcpMount}`,
+    // The runtime half of the mount finding (#726): what dispatched sessions
+    // actually held in their registries. Rendered only when a run recorded
+    // it — "observed" is never claimed without evidence.
+    ...(graph.session.recorded === 0
+      ? []
+      : [
+          `  session   observed in ${graph.session.recorded} run(s): present ${graph.session.present} / absent ${graph.session.absent}`,
+        ]),
     `  timer     ${graph.timer.enabled} / ${graph.timer.active}`,
     `  refresh   ${refresh}`,
     ...graph.reasons.map((reason) => `  - ${reason}`),
@@ -108,6 +116,7 @@ export type DaemonProjectHealth =
   | { kind: "stopped" }
   | { kind: "ok" }
   | { kind: "unreachable" }
+  | { kind: "unresponsive" }
   | { kind: "other-project"; serves?: string };
 
 /**
@@ -122,6 +131,14 @@ export type FleetDaemonProbe = {
   unit?: UnitOwnership;
 };
 
+/**
+ * #685: the healthz timeout is a probe outcome, never a death verdict — the
+ * same discipline the indexer probe uses when it reports `probe timed out`
+ * instead of declaring the indexer missing.
+ */
+const UNRESPONSIVE_HEALTHZ =
+  `unresponsive (healthz timed out after ${HEALTH_TIMEOUT_MS / 1000}s)`;
+
 function formatDaemonHealthz(probe: FleetDaemonProbe | undefined): string {
   if (probe === undefined) return "unprobed";
   switch (probe.project.kind) {
@@ -129,6 +146,8 @@ function formatDaemonHealthz(probe: FleetDaemonProbe | undefined): string {
       return "stopped";
     case "ok":
       return "ok";
+    case "unresponsive":
+      return UNRESPONSIVE_HEALTHZ;
     case "unreachable":
       return "unreachable — the process is up but not serving";
     case "other-project":
@@ -239,8 +258,13 @@ export function formatFleetStatus(
     // not this project's daemon facts (#379).
     const rss =
       daemon?.project.kind === "ok" ? rssBytesFromHealthz(daemon.body) : undefined;
+    // Three states, never two (#685): `not running` is reserved for a pid
+    // that is actually gone, and a timed-out `/healthz` is its own state —
+    // a healthy fleet that answers slowly must not read as stopped.
+    const state =
+      daemon?.project.kind === "unresponsive" ? UNRESPONSIVE_HEALTHZ : "running";
     daemonBlock = [
-      "daemon",
+      `daemon    ${state}`,
       `  pid       ${layers.daemon.pid}`,
       `  port      ${layers.daemon.port ?? "?"}`,
       ...(rss === undefined ? [] : [`  rss       ${formatRss(rss)}`]),
@@ -319,6 +343,31 @@ function formatDigestScheduleStatus(s: StatusSnapshot): string[] {
   ];
 }
 
+/** The reporting row: which categories interrupt the operator's phone, and
+ *  where everything else goes. It reads the snapshot's effective summary —
+ *  the legacy preset name is a label, never the source of truth: an explicit
+ *  policy without `scopePreset` renders truthfully from `interruptOn` and the
+ *  digest cadence, so a routine outcome under `decisions` explains itself as
+ *  digest-only instead of reading like a broken Telegram (#633). */
+function formatReportingStatus(s: StatusSnapshot): string[] {
+  const r = s.reporting;
+  if (r === undefined) return [];
+  const interrupt =
+    r.interruptOn.length === 0 ? "nothing interrupts" : `${r.interruptOn.join(", ")} interrupt`;
+  const label = r.scopePreset === undefined ? "reporting —" : `reporting ${r.scopePreset} —`;
+  let consequence: string;
+  if (r.interruptOn.includes("material")) {
+    consequence = "no outcome waits for the digest";
+  } else if (r.digest.cadence === "daily") {
+    consequence = "material outcomes wait for the daily digest";
+  } else if (r.digest.cadence === "none") {
+    consequence = "material outcomes are held; no digest is configured";
+  } else {
+    consequence = "material outcomes wait for the per-tick digest";
+  }
+  return [`${label} ${interrupt}; ${consequence}`];
+}
+
 /**
  * The shared-daemon visibility row (#545). When the daemon also serves sibling
  * projects, tell the reader how many runs each has live, so they can tell "my
@@ -342,6 +391,14 @@ function formatProjectBody(
   const lines = [
     `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
     ...(s.pauseReason === undefined ? [] : [`paused    ${s.pauseReason}`]),
+    // Structured-exposure half of the drain surface (#484): a plain row for
+    // the renderer, so the active drain is visible in `status` before the
+    // human-wording work of the later #484 child lands.
+    ...(s.drain === undefined
+      ? []
+      : [
+          `drain     active — expires ${new Date(s.drain.expiresAt).toISOString()}, ${s.drain.remainingRuns} run(s) remaining`,
+        ]),
     `config    ${s.configPath}`,
     `state     ${s.stateDir}`,
     ...(siblingLine === undefined ? [] : [siblingLine]),
@@ -350,6 +407,7 @@ function formatProjectBody(
     ...(s.orchestratorDown === undefined
       ? []
       : formatOrchestratorDown(s.orchestratorDown, now)),
+    ...formatReportingStatus(s),
     ...formatAvailabilityStatus(s),
     ...formatDigestScheduleStatus(s),
     "",
@@ -433,20 +491,29 @@ function formatProjectBody(
         : round !== undefined
           ? `review-revision ${round}`
           : r.state;
-      // Turn rate (#730): a stalled run and a fast one used to render
-      // identically as a bare turn count. The rate is the lifetime average
-      // over the elapsed shown — the snapshot carries no checkpoint from
-      // which a recent-interval rate could be derived — so it is labelled
-      // `avg`, and `elapsed` is elapsed since claim, never "remaining wall
-      // clock": a paused worker banks its budget, which the snapshot cannot
-      // know. A paused run gets neither number, because its elapsed includes
-      // banked pause time and its state already says `paused`.
+      // Turn rate and cap projection (#730/#767): a stalled run and a fast one
+      // used to render identically as a bare turn count. The rate is the
+      // lifetime average over the elapsed shown — the snapshot carries no
+      // checkpoint from which a recent-interval rate could be derived — so it
+      // is labelled `avg`, and `elapsed` is elapsed since claim, never
+      // "remaining wall clock": a paused worker banks its budget, which the
+      // snapshot cannot know. #767 adds the projection #518 asked for: the
+      // same claim-elapsed rate held forward to the wall-clock budget
+      // (`caps.workerWallClockMs`, rendered in the caps block) as the turn
+      // count the run would reach at that cap — trajectory math over
+      // elapsed-so-far, so reading it against the run's `maxTurns` tells
+      // which cap fires first. A paused run gets neither number, because its
+      // elapsed includes banked pause time and its state already says
+      // `paused`.
       const elapsedMs = Math.max(0, now - r.startedAt);
       const progress = paused
         ? ""
         : `  ${formatDownDuration(elapsedMs)} elapsed  ${(
             (r.turns * 60_000) / Math.max(elapsedMs, 1_000)
-          ).toFixed(1)} turns/min avg`;
+          ).toFixed(1)} turns/min avg` +
+          `  projects ${Math.round(
+            (r.turns * s.caps.workerWallClockMs) / Math.max(elapsedMs, 1_000),
+          )} turns at cap`;
       lines.push(
         `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
           `${r.turns}/${r.maxTurns} turns${progress}  ${r.spendUsd.toFixed(2)}  ${r.branch}` +