omp-conductor 0.18.0 → 0.18.2

package/src/commands/worker.ts

@@ -2,13 +2,13 @@
  * `worker` — pause/resume/stop one live worker session through the daemon's run-control HTTP endpoints.
  *
  * Moved out of cli.ts's switch by the per-verb module split (#462);
- * only the case wrapper, the injected `ctx` lookups and the imports
- * changed from the original bodies.
+ * the daemon discovery resolves through {@link requireDaemonControl} so a
+ * live systemd-run daemon stays reachable when its pidfile is missing (#811).
  */
 
 import type { CommandContext } from "./context.ts";
 import { findProject, loadConfig } from "../config.ts";
-import { livingDaemon } from "../lifecycle.ts";
+import { requireDaemonControl } from "../lifecycle.ts";
 
 export async function workerCommand(ctx: CommandContext): Promise<void> {
 const sub = ctx.argv[1];
@@ -28,13 +28,12 @@ if (sub === "stop" && (reason === undefined || reason === "" || reason.length >
   process.exit(2);
 }
 const project = findProject(loadConfig(), ctx.projectFlag);
-const daemon = livingDaemon();
-if (daemon === undefined) throw new Error("daemon is not running");
-if (daemon.project !== undefined && daemon.project !== project.name) {
-  throw new Error(
-    `daemon serves project "${daemon.project}", not requested project "${project.name}"`,
-  );
-}
+// The pidfile is authoritative when it names a live process; a missing or
+// stale record falls back to the systemd unit, proved through its own
+// /healthz answer, so a live unit-owned daemon is never reported stopped
+// because the runtime directory was wiped (#811). The refusal chain is
+// shared with `extend` through requireDaemonControl.
+const daemon = await requireDaemonControl(project.name);
 const response = await fetch(
   `http://127.0.0.1:${daemon.port}/runs/${issue}/${sub}`,
   {

package/src/config-schema.ts

@@ -31,6 +31,7 @@ import {
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
+  DEFAULT_REVIEW_ADJUDICATOR_ROLE,
   DEFAULT_REVIEW_MAX_ROUNDS,
   DEFAULT_REVIEW_STRICTNESS,
   DRAFT_POLICIES,
@@ -41,6 +42,7 @@ import {
   RELEASE_REQUIREMENTS,
   RELEASE_SHAPES,
   REPORT_SCOPES,
+  REVIEW_ADJUDICATOR_RE,
   REVIEW_MAX_ROUNDS_MAX,
   REVIEW_MAX_ROUNDS_MIN,
   REVIEW_STRICTNESS,
@@ -265,11 +267,15 @@ const armSchema = z
 
 /**
  * The per-project review policy (#678): how strictly green PRs are reviewed
- * and returned, and the hard ceiling on review rounds per PR lifecycle. Absent
- * or a legacy config without the key loads as `medium` with
- * {@link DEFAULT_REVIEW_MAX_ROUNDS} rounds — the recommended default for a new
- * project, materialised deterministically for every existing one, with the
- * schema bounds and the runtime defaults read from the same constants.
+ * and returned, the hard ceiling on review rounds per PR lifecycle, and which
+ * OMP model role carries the terminal review-ceiling adjudication (#875).
+ * Absent or a legacy config without the keys loads as `medium` with
+ * {@link DEFAULT_REVIEW_MAX_ROUNDS} rounds and
+ * {@link DEFAULT_REVIEW_ADJUDICATOR_ROLE} as adjudicator — the recommended
+ * defaults for a new project, materialised deterministically for every
+ * existing one, with the schema bounds and the runtime defaults read from the
+ * same constants. The adjudicator names a role only; a provider/model is
+ * refused here, because OMP owns exact provider selection.
  */
 const reviewSchema = z
   .object({
@@ -280,9 +286,16 @@ const reviewSchema = z
       .min(REVIEW_MAX_ROUNDS_MIN)
       .max(REVIEW_MAX_ROUNDS_MAX)
       .default(DEFAULT_REVIEW_MAX_ROUNDS),
+    adjudicator: z
+      .string()
+      .regex(
+        REVIEW_ADJUDICATOR_RE,
+        "must name one OMP model role — a single role token like \"task\" (never a provider/model, which omp owns)",
+      )
+      .default(DEFAULT_REVIEW_ADJUDICATOR_ROLE),
   })
   .strict()
-  .describe("Review strictness and round ceiling for green PRs");
+  .describe("Review strictness, round ceiling and adjudicator role for green PRs");
 
 const releasePolicySchema = z.union([
   releasePolicyLegacyEnum,
@@ -336,6 +349,25 @@ const stateLabelsSchema = z
   })
   .partial();
 
+// ---------------------------------------------------------------------------
+// Host constraints (#721)
+// ---------------------------------------------------------------------------
+
+const hostConstraintsSchema = z
+  .object({
+    description: z.string().min(1).describe("What this host is and what else it runs"),
+    path: z
+      .string()
+      .min(1)
+      .describe('The non-interactive PATH a script or `ssh host "<cmd>"` invocation must export'),
+    conventions: z
+      .record(z.string().min(1), z.string().min(1))
+      .describe("Per-repo command conventions, keyed by the brief's `owner/repo` slug"),
+  })
+  .strict()
+  .partial()
+  .describe("Operator-authored host facts rendered into every worker brief");
+
 // ---------------------------------------------------------------------------
 // Project / root
 // ---------------------------------------------------------------------------
@@ -409,6 +441,11 @@ const configSchema = z
       .min(1, "must name a directory")
       .optional()
       .describe("Absolute directory for restorable conductor.db snapshots; defaults to <stateDir>/backups/db"),
+    // Cores and RAM are derived by host.ts at render time; only what the
+    // operator must type belongs in this block.
+    host: hostConstraintsSchema
+      .optional()
+      .describe("Host facts every worker brief renders; absent renders no section"),
     projects: z.array(projectSchema).min(1, `"projects" must be a non-empty array — the dispatcher has nothing to service otherwise`),
   })
   .loose()

package/src/config.ts

@@ -28,6 +28,7 @@ import {
   DEFAULT_PROJECT_POLICY,
   DEFAULT_REPORT_POLICY,
   DEFAULT_REPORT_SCOPE,
+  DEFAULT_REVIEW_ADJUDICATOR_ROLE,
   DEFAULT_REVIEW_MAX_ROUNDS,
   DEFAULT_REVIEW_POLICY,
   DEFAULT_REVIEW_STRICTNESS,
@@ -49,6 +50,7 @@ import {
   type Caps,
   type ConductorConfig,
   type DigestCadence,
+  type HostConstraints,
   type InterruptCategory,
   type MergePreconditions,
   type PlanUsageCap,
@@ -348,12 +350,20 @@ export function resolveArmProof(p: ProjectConfig): ArmProof {
  * The loader always materialises `review` (finalizeProject), so this is only
  * ever the fallback for a `ProjectConfig` that never went through it — a
  * hand-built one in a test, or a config written before the key existed.
- * Absent resolves to {@link DEFAULT_REVIEW_POLICY}, the documented migration
- * default every existing install deterministically upgrades to. A fresh object
- * each call, so mutating the result cannot reach the config it came from.
+ * Absent (or a legacy config that stopped at strictness and maxRounds)
+ * resolves to {@link DEFAULT_REVIEW_POLICY}, the documented migration default
+ * every existing install deterministically upgrades to — the adjudicator role
+ * included, so no consumer ever reads a policy without one (#875). A fresh
+ * object each call, so mutating the result cannot reach the config it came
+ * from.
  */
 export function resolveReview(p: ProjectConfig): ReviewPolicy {
-  return { ...(p.review ?? DEFAULT_REVIEW_POLICY) };
+  const base = p.review ?? DEFAULT_REVIEW_POLICY;
+  return {
+    strictness: base.strictness ?? DEFAULT_REVIEW_STRICTNESS,
+    maxRounds: base.maxRounds ?? DEFAULT_REVIEW_MAX_ROUNDS,
+    adjudicator: base.adjudicator ?? DEFAULT_REVIEW_ADJUDICATOR_ROLE,
+  };
 }
 
 /**
@@ -888,11 +898,14 @@ function clauseFor(rel: readonly PropertyKey[], issue: {
       return `policy must be an object with "merge" and "release" sections`;
     }
     if (rel.length === 1 && relStr === "review") {
-      return `review must be an object with "strictness" and "maxRounds"`;
+      return `review must be an object with "strictness", "maxRounds" and "adjudicator"`;
     }
     if (rel.length === 2 && rel[0] === "review" && rel[1] === "maxRounds") {
       return `review.maxRounds must be an integer between ${REVIEW_MAX_ROUNDS_MIN} and ${REVIEW_MAX_ROUNDS_MAX}, found ${found()}`;
     }
+    if (rel.length === 2 && rel[0] === "review" && rel[1] === "adjudicator") {
+      return `review.adjudicator must be a string naming one OMP model role, found ${found()}`;
+    }
     if (rel.length === 2 && relStr === "policy") return `${pathStr} must be an object`;
     if (rel.length === 1 && relStr === "caps") return `caps must be an object`;
     if (rel.length === 2 && relStr === "caps" && rel[1] === "planUsage") {
@@ -943,7 +956,7 @@ function clauseFor(rel: readonly PropertyKey[], issue: {
   if (issue.code === "unrecognized_keys") {
     const keys = (issue.keys ?? []).join(", ");
     if (pathStr === "policy") return `policy has unknown key(s): ${keys} — expected "merge" or "release"`;
-    if (pathStr === "review") return `review has unknown key(s): ${keys} — expected "strictness" and "maxRounds"`;
+    if (pathStr === "review") return `review has unknown key(s): ${keys} — expected "strictness", "maxRounds" and "adjudicator"`;
     if (pathStr === "policy.merge") return `${pathStr} has unknown key(s): ${keys} — expected ${POLICY_MERGE_KEYS}`;
     if (pathStr === "policy.release") return `${pathStr} has unknown key(s): ${keys} — expected ${POLICY_RELEASE_KEYS}`;
     if (pathStr === "caps.planUsage") {
@@ -1092,8 +1105,48 @@ function finalize(data: unknown, path: string): ConductorConfig {
     });
   }
 
+  const rawHost = root["host"] as Raw | undefined;
+  const host = finalizeHost(rawHost);
+  const rawDbBackupDir = root["dbBackupDir"];
+  const dbBackupDir = typeof rawDbBackupDir === "string" ? rawDbBackupDir : undefined;
+
   if (problems.length > 0) throw new Error(problemEnvelope(path, problems));
-  return { version: CONFIG_VERSION, defaults, projects };
+  // `ConductorConfig` is rebuilt here, so every optional top-level key must be
+  // spelled out or it silently vanishes from every loaded config. `dbBackupDir`
+  // and `host` are the two today; a third needs its own line below (#773).
+  return {
+    version: CONFIG_VERSION,
+    defaults,
+    projects,
+    ...(dbBackupDir === undefined ? {} : { dbBackupDir }),
+    ...(host === undefined ? {} : { host }),
+  };
+}
+
+/**
+ * The typed host-constraints block (#721), or `undefined` when nothing usable
+ * was configured — matching the schema's "absent renders no section" promise.
+ * Trimming and empty-drop mirror the other hand-edited string fields; an
+ * object whose every key is empty loads as if the field were absent.
+ */
+function finalizeHost(parsed: Raw | undefined): HostConstraints | undefined {
+  if (parsed === undefined) return undefined;
+  const out: HostConstraints = {};
+  const description = parsed["description"];
+  if (typeof description === "string" && description.trim() !== "") out.description = description.trim();
+  const path = parsed["path"];
+  if (typeof path === "string" && path.trim() !== "") out.path = path.trim();
+  const conventions = parsed["conventions"];
+  if (typeof conventions === "object" && conventions !== null && !Array.isArray(conventions)) {
+    const kept: Record<string, string> = {};
+    for (const [slug, value] of Object.entries(conventions as Record<string, unknown>)) {
+      if (typeof value === "string" && value.trim() !== "" && slug.trim() !== "") {
+        kept[slug.trim()] = value.trim();
+      }
+    }
+    if (Object.keys(kept).length > 0) out.conventions = kept;
+  }
+  return Object.keys(out).length === 0 ? undefined : out;
 }
 
 function finalizeProject(
@@ -1279,14 +1332,17 @@ function finalizeArm(parsed: Raw | undefined): ProjectConfig["arm"] {
  * {@link DEFAULT_REVIEW_POLICY}, the documented migration default, so an
  * upgrade changes no existing project's behaviour beyond what its operators
  * then choose in setup. zod has already rejected anything outside the
- * strictness vocabulary or the validated round range, so this only fills the
- * absent-case default.
+ * strictness vocabulary, the validated round range or the adjudicator role
+ * token grammar, so this only fills the absent-case defaults — the
+ * adjudicator included (#875), deterministically the same role a new
+ * project's setup starts from.
  */
 function finalizeReview(parsed: Raw | undefined): ProjectConfig["review"] {
   if (parsed === undefined) return { ...DEFAULT_REVIEW_POLICY };
   return {
     strictness: (parsed["strictness"] as ReviewStrictness | undefined) ?? DEFAULT_REVIEW_STRICTNESS,
     maxRounds: (parsed["maxRounds"] as number | undefined) ?? DEFAULT_REVIEW_MAX_ROUNDS,
+    adjudicator: (parsed["adjudicator"] as string | undefined) ?? DEFAULT_REVIEW_ADJUDICATOR_ROLE,
   };
 }