omp-conductor 0.18.0 → 0.18.2

package/src/doctor.ts

@@ -46,9 +46,11 @@ import {
   dbBackupDirFor,
   findProject,
   loadConfig,
+  resolveArmProof,
   resolveCaps,
   stateDir,
 } from "./config.ts";
+import { observeArmChallenge } from "./arm-challenge.ts";
 import { ompSettingsOverlay, sessionRootDir } from "./omp-settings.ts";
 import {
   DEFAULT_HERDR_UNIT,
@@ -98,7 +100,7 @@ import {
   type HerdrAgentList,
 } from "./orchestrator-tick.ts";
 import type { ConductorConfig, ProjectConfig, RepoTarget, RunState } from "./types.ts";
-
+import { DEFAULT_ARM_PROOF, type ArmProof } from "./types.ts";
 /**
  * `doctor`'s finding vocabulary. `pass`/`warn`/`fail` — a warning renders the
  * same but never flips the exit code; exit is nonzero iff any finding fails.
@@ -142,6 +144,10 @@ const INCIDENTS = {
   spend:
     "spend telemetry was once absent, so the USD cap never fired — $0.00 spend is not proof of no spend",
   ghauth: "gh auth expired under a live daemon and every tracker call failed silently",
+  workerAcl:
+    "the #835 incident: a setup host granted the worker's path ACLs before restarting the fleet, an OMP startup chmod'd " +
+    "the agent config dir back to 0700 and rewrote the ACL mask, and the next two admitted workers died on EACCES " +
+    "before connecting — the named ACL entry was still there, only its effective permissions were gone",
 } as const;
 
 // ------------------------------------------------------------------ dependencies
@@ -249,8 +255,10 @@ export interface DoctorDeps {
   /** The topic id an arm challenge would send into for this project —
    *  resolveProjectTopicId's pin-or-live-claim; undefined means flat chat. */
   armSendTopic?: (project: ProjectConfig) => number | undefined;
-  /** The session directories arm scans for the challenge reply on this
-   *  project — tick-cwd-derived plus the live claim's own directory. */
+  /** The session surface the claim-only plumbing verdict judges for this
+   *  project — tick-cwd-derived plus the live claim's own directory. The
+   *  challenge proof reads conductor state instead (#614), so this feeds
+   *  claim-only verdict checks only. */
   armScanDirs?: (project: ProjectConfig) => readonly string[];
   /** Whether a recorded claim or dm-owner pid is live, with omp-telegram's
    *  topics.ts semantics (EPERM is dead). */
@@ -748,6 +756,12 @@ function unresolvableShell(unit: string): boolean {
  * state resolved at staging time, so a rendered value doctor cannot reproduce
  * is excluded from both sides rather than reported as a difference — an
  * unresolvable canonical is "cannot compare", never drift (#511).
+ *
+ * The service `PATH=` line has no such exemption: since #879 it is canonical
+ * on both sides (`defaultServiceRuntime` composes it from the resolved fleet
+ * binaries plus the standard system directories, never from the rendering
+ * process's environment), so a differing installed value is genuine drift and
+ * must fail here with the value named.
  */
 export function unitDrift(installed: string, canonical: string): { differences: string[] } {
   const want = canonical
@@ -902,6 +916,7 @@ function ownershipProbe(probes: Probes): Finding {
   return failFinding("systemd-ownership", summary, fix);
 }
 
+
 /** IANA timezone in reporting config — an invalid zone silently mis-schedules
  *  the availability window and the daily digest (#273). */
 function timezoneProbe(project: ProjectConfig | undefined): Finding {
@@ -1128,91 +1143,43 @@ function herdrAgentNameProbe(probes: Probes, p: ProjectConfig): Finding {
 }
 
 /**
- * #600 check — the orchestrator's claimed session file vs the directory arm
- * scans.
+ * #614 check — the state of this project's arming acknowledgement transaction.
  *
- * A pane resumed from a session created elsewhere keeps the original transcript
- * path (herdr pins the pane to it), so the claimed file can live outside the
- * session directory the tick cwd implies. arm follows the claim, so the
- * mismatch alone is handled — but it is exactly the shape of host that once
- * made arming silently impossible, and an operator reading transcript paths
- * should not have to rediscover it. A claimed file *outside the session tree*
- * is worse: arm refuses to arm there (the reply could never be seen), so
- * doctor fails rather than letting the fleet sit disarmed.
+ * The challenge proof is conductor-owned state now: the host records a pending
+ * challenge and waits for the acknowledgement the orchestrator's inbound
+ * adapter writes. No transcript location is diagnosed any more — where (or
+ * whether) a session file lives is not part of arming — so what is worth
+ * reporting is a transaction left open: a challenge still pending and whether
+ * it has been acknowledged, or an expired record nothing settled. Every shape
+ * is inert by construction (a reply past expiry, or for a replaced id, is
+ * refused), so this informs; only the stale leftover warns.
  */
-function armSessionDirProbe(probes: Probes, p: ProjectConfig): Finding {
-  const result = probes.claimedTopics();
-  if (result.kind !== "ok") {
-    // The registry could not be read, so the claim's session file is unknown,
-    // not known-absent. Arm scans the tick-cwd directory either way, but the
-    // finding must stay diagnostic — this is exactly the shape that once made
-    // arming silently impossible, and "no claim" would certify it as fine. A
-    // missing registry is the same unknown to this probe: the bridge may never
-    // have claimed, but nothing proves the claim names no session file.
+function armAckProbe(probes: Probes, p: ProjectConfig): Finding {
+  const now = probes.now();
+  const sighting = observeArmChallenge(p.name);
+  if (sighting === undefined) {
+    return passFinding("arm-ack", `[${p.name}] no pending arm challenge — the acknowledgement handshake is idle`);
+  }
+  const window =
+    sighting.sentAt === undefined || sighting.expiresAt === undefined
+      ? "an unreadable record window"
+      : `sent ${new Date(sighting.sentAt).toISOString()}, expires ${new Date(sighting.expiresAt).toISOString()}`;
+  if (sighting.expiresAt !== undefined && now >= sighting.expiresAt) {
     return warnFinding(
-      "arm-session-dir",
-      `[${p.name}] ` +
-        (result.kind === "missing"
-          ? `omp-telegram has no claim registry (threads.json in its state dir) — arm scans the tick-cwd session directory, but doctor cannot tell whether the claim names a session file elsewhere`
-          : `omp-telegram's claim registry is unreadable (${result.problem}) — arm scans the tick-cwd session directory, but doctor cannot tell whether the claim names a session file elsewhere`),
-      `check omp-telegram's claim registry (threads.json in its state dir) is readable and the bridge is running, then re-run doctor`,
+      "arm-ack",
+      `[${p.name}] an arming challenge from ${window} expired without being settled — it is inert (replies past expiry are refused), but it lingers until this project's next arm replaces it`,
+      `no action needed; the next \`arm\` for this project settles it — re-run doctor afterwards to confirm`,
     );
   }
-  if (result.claims.length === 0) {
+  if (sighting.acknowledgedAt !== undefined) {
     return passFinding(
-      "arm-session-dir",
-      `[${p.name}] no live omp-telegram claim — arm scans the tick-cwd session directory`,
-    );
-  }
-  const claims = result.claims;
-  const match = resolveProjectClaim(claims, p.name);
-  const scanDir = sessionDirForCwd(tickCwdForProject(p));
-  if (match.kind === "ambiguous") {
-    // Several live claims answer to the project, so the claim's session file
-    // cannot be told from a sibling pane's. Arm scans the tick-cwd directory
-    // either way, but certifying that fallback as the scan is the miss this
-    // probe exists to surface: the resumed transcript may live under another
-    // claim while doctor reads the fallback as the whole story (#626).
-    return warnFinding(
-      "arm-session-dir",
-      `[${p.name}] several live claims answer to this project (topics ${match.claimants.map((c) => c.threadId).join(", ")}), so the claim's session file is a coin toss — arm scans the tick-cwd session directory, but the resumed transcript may live elsewhere`,
-      `make exactly one live claim answer to this project: rename the other panes' herdr spaces or re-claim them one at a time, then re-run doctor — or start the orchestrator pane's session from the tick cwd ${scanDir}`,
-    );
-  }
-  const claim = match.kind === "match" ? match.claim : undefined;
-  if (claim === undefined) {
-    return passFinding(
-      "arm-session-dir",
-      `[${p.name}] no live omp-telegram claim answers to this project — arm scans the tick-cwd session directory`,
-    );
-  }
-  if (claim.sessionFile === undefined) {
-    return passFinding(
-      "arm-session-dir",
-      `[${p.name}] the live claim names no session file — arm scans the tick-cwd session directory`,
-    );
-  }
-  const root = sessionsRoot();
-  const claimDir = dirname(claim.sessionFile);
-  if (claimDir !== root && !claimDir.startsWith(join(root, sep))) {
-    return failFinding(
-      "arm-session-dir",
-      `[${p.name}] the orchestrator's claimed session file ${claim.sessionFile} is outside the session tree arm scans (${root}) — ` +
-        `arm cannot arm while the reply can only land there`,
-      `start the orchestrator pane's session under ${root}, or from the tick cwd ${scanDir}`,
-    );
-  }
-  if (claimDir !== scanDir) {
-    return warnFinding(
-      "arm-session-dir",
-      `[${p.name}] the orchestrator's claimed session file ${claim.sessionFile} lives in ${claimDir}, not the tick-cwd session directory ${scanDir} — ` +
-        `arm follows the claim, so arming works, but this is the resumed-pane shape #600 names`,
-      `optional tidy-up: start the pane's session from the tick cwd so transcript and cwd agree again`,
+      "arm-ack",
+      `[${p.name}] an arm challenge is pending (${window}) and was acknowledged ${new Date(sighting.acknowledgedAt).toISOString()} — the host consumes it on settle`,
     );
   }
   return passFinding(
-    "arm-session-dir",
-    `[${p.name}] the orchestrator's claimed session file is inside the session directory arm scans`,
+    "arm-ack",
+    `[${p.name}] an arm challenge is pending (${window}), not yet acknowledged — live if \`arm\` is running right now, otherwise its window simply runs out`,
   );
 }
 
@@ -1334,9 +1301,20 @@ function telegramPlumbingProbe(probes: Probes, p: ProjectConfig): Finding {
       `[${p.name}] outbound-only paging — no tick accessFile to arm, so no live claim, DM owner or poll ownership is required`,
     );
   }
+  // Transcript-surface identity checks belong to the claim-only proof alone:
+  // since #614 the challenge proof reads conductor acknowledgement state, so
+  // judging it by where a transcript lives could report arming impossible
+  // while `arm` succeeds. An unreadable config keeps the default proof —
+  // fail-safe to the stricter verdict, exactly like armTicks.
+  let proof: ArmProof = DEFAULT_ARM_PROOF;
+  try {
+    proof = resolveArmProof(p);
+  } catch {
+    /* unreadable config — keep today's stricter default */
+  }
   const verdict = telegramPlumbingVerdict(
     probes.armSendTopic(p),
-    { dirs: probes.armScanDirs(p) },
+    proof === "claim-only" ? { dirs: probes.armScanDirs(p) } : undefined,
     {
       channel: probes.channelState(p),
       registry: probes.claimedTopics(),
@@ -1618,7 +1596,7 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
       passFinding("herdr-agent-name", projectProblem === undefined ? "no project resolved — nothing to check" : `agent name uncheckable: ${projectProblem}`),
     );
     findings.push(
-      passFinding("arm-session-dir", projectProblem === undefined ? "no project resolved — nothing to check" : `arm session dir uncheckable: ${projectProblem}`),
+      passFinding("arm-ack", projectProblem === undefined ? "no project resolved — nothing to check" : `arm acknowledgement uncheckable: ${projectProblem}`),
     );
     findings.push(
       passFinding("topic-pin", projectProblem === undefined ? "no project resolved — nothing to check" : `topic pin uncheckable: ${projectProblem}`),
@@ -1633,7 +1611,7 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
     for (const p of projects) {
       findings.push(await labelProbe(probes, p));
       findings.push(herdrAgentNameProbe(probes, p));
-      findings.push(armSessionDirProbe(probes, p));
+      findings.push(armAckProbe(probes, p));
       findings.push(topicPinProbe(probes, p));
       findings.push(telegramPlumbingProbe(probes, p));
       findings.push(ompSettingsProbe(p, sessionRootState));

package/src/escalate.ts

@@ -403,11 +403,17 @@ function errText(e: unknown): string {
  *
  * Exported for the report outbox (#123), which pages over the same bot and must
  * resolve the token the same way. Two readers of one `.env` is fine; two
- * *implementations* of the parse below is how they drift.
+ * *implementations* of the parse below is how they drift. The state dir is the
+ * shared resolution both the token read and the interactive ask surface (#722)
+ * need, so it is one function rather than a second copy of the override.
  */
-export function readTelegramToken(): string | undefined {
+export function telegramStateDir(): string {
   const override = process.env.OMP_TELEGRAM_STATE_DIR?.trim();
-  const dir = override ? override : join(homedir(), ".omp", "agent", "telegram");
+  return override ? override : join(homedir(), ".omp", "agent", "telegram");
+}
+
+export function readTelegramToken(): string | undefined {
+  const dir = telegramStateDir();
   let raw: string;
   try {
     raw = readFileSync(join(dir, ".env"), "utf8");
@@ -1034,13 +1040,14 @@ export interface TelegramPlumbingProbe {
 }
 
 /**
- * The session surface the arm waiter actually scans for the challenge reply:
- * {@link armTicks} polls every `.jsonl` transcript *directly inside* these
- * directories — the tick-cwd-derived session directory plus, when the
- * project's claim names a session file elsewhere, that file's directory. The
- * recipient of the reply (a claim's, the DM owner's, or the local poll
- * owner's session file) must land in this set, or the reply can never satisfy
- * the challenge even though inbound works.
+ * The transcript-surface input for {@link telegramPlumbingVerdict}'s session
+ * identity checks: the directories the claim-only proof judges recipients
+ * against (a claim's, the DM owner's, or the local poll owner's session file
+ * must land inside, or a flat reply could land where no challenge would have
+ * looked). Since #614 the *challenge* proof reads conductor acknowledgement
+ * state and never opens a transcript, so callers judging challenge-mode
+ * plumbing omit this — passing it there could report arming impossible while
+ * `arm` succeeds.
  */
 export type TelegramPlumbingScan = { dirs: readonly string[] };
 
@@ -1068,7 +1075,7 @@ export type TelegramPlumbingScan = { dirs: readonly string[] };
  */
 export function telegramPlumbingVerdict(
   sendTopic: number | undefined,
-  scan: TelegramPlumbingScan,
+  scan: TelegramPlumbingScan | undefined,
   probe: TelegramPlumbingProbe,
 ): TelegramPlumbingVerdict {
   const { registry, poll, dmOwner, channel, alive, lockAlive, fresh } = probe;
@@ -1079,14 +1086,21 @@ export function telegramPlumbingVerdict(
     const claim = registry.claims.find((c) => c.threadId === sendTopic);
     if (claim === undefined) return { ok: false, reason: "no-topic-claim" };
     if (claim.pid === undefined || !alive(claim.pid)) return { ok: false, reason: "claim-dead" };
-    if (claim.sessionFile !== undefined && !sessionWithinScan(claim.sessionFile, scan.dirs)) {
+    if (
+      scan !== undefined &&
+      claim.sessionFile !== undefined &&
+      !sessionWithinScan(claim.sessionFile, scan.dirs)
+    ) {
       return { ok: false, reason: "claim-session-outside" };
     }
     recipient = "claim";
   } else {
     if (dmOwner.kind === "ok") {
       if (dmOwner.owner.pid === undefined || !alive(dmOwner.owner.pid)) return { ok: false, reason: "dm-owner-dead" };
-      if (dmOwner.owner.sessionFile === undefined || !sessionWithinScan(dmOwner.owner.sessionFile, scan.dirs)) {
+      if (
+        scan !== undefined &&
+        (dmOwner.owner.sessionFile === undefined || !sessionWithinScan(dmOwner.owner.sessionFile, scan.dirs))
+      ) {
         return { ok: false, reason: "dm-owner-unrelated" };
       }
       recipient = "dm-owner";
@@ -1096,7 +1110,10 @@ export function telegramPlumbingVerdict(
       // record must name that session. A daemon-only or unrelated owner is no
       // recipient: the reply would land in a transcript arm never scans.
       if (poll.kind !== "ok") return { ok: false, reason: "no-dm-owner" };
-      if (poll.owner.sessionFile === undefined || !sessionWithinScan(poll.owner.sessionFile, scan.dirs)) {
+      if (
+        scan !== undefined &&
+        (poll.owner.sessionFile === undefined || !sessionWithinScan(poll.owner.sessionFile, scan.dirs))
+      ) {
         return { ok: false, reason: "no-dm-owner" };
       }
       recipient = "poller";

package/src/failure-class.ts

@@ -17,9 +17,14 @@
 
 import type { Caps, FailureClass, RecoveryAction, RunRecord } from "./types.ts";
 
-/** Facts the caller fetched, each only for the rows that need it. */
+/** Facts the caller fetched, each only for the rows that need it.
+ *
+ *  `pr` can also be `"missing"`: the tracker has proven the claimed PR
+ *  definitively does not exist (#779). It is a fact, the same way `"closed"`
+ *  is — a REST 404 the adapter corroborated with a same-repository pulls-list
+ *  read — never a transient "could not tell", which stays `undefined`. */
 export interface ClassifyFacts {
-  pr?: "open" | "merged" | "closed";
+  pr?: "open" | "merged" | "closed" | "missing";
   mergeable?: "conflicting" | "clean" | "unknown";
   checks?: { name: string; state: string; link?: string }[];
   /** Full session error recovered from the transcript. Kept as a fact so a
@@ -142,6 +147,12 @@ const START_FAILURE_SIGNATURES = [
   "invalid api key",
   "authentication failed",
   "could not load its peer dependency",
+  // The pre-launch identity gate (#798/#828): the account is missing, or the
+  // harness binding a worker resolves through is not established. The daemon
+  // refuses before it spawns anything, so no attempt was spent — and the
+  // symptom this replaced (the child dying on the peer import) already read as
+  // a start failure, so charging one here would be a regression dressed as a fix.
+  "worker identity unavailable",
 ] as const;
 
 /**
@@ -512,6 +523,21 @@ export function classifyRun(
   if (run.state === "failed" && facts.pr === "open") {
     const checks = facts.checks ?? [];
     const unresolved = checks.filter((c) => !SUCCESS_CHECK_STATES[normalise(c.state)] === true);
+    if (checks.length > 0 && unresolved.length === 0) {
+      // The PR is open and every check is green: the strongest mechanical
+      // success evidence there is short of merge. The row's `failed` state is
+      // stale — whatever the worker recorded, its work is passing — so this is
+      // not a failure of any class. `none` recovery restores it to
+      // `pushed-green` in classifyAndRecover instead of escalating an
+      // `[unknown]` that charges an attempt (#766). An empty check list is
+      // "could not tell", not all-green, and still falls through to `unknown`
+      // below.
+      return {
+        cls: "unknown",
+        recovery: "none",
+        evidence: `${run.prUrl ?? "the PR"} is open and every check is green`,
+      };
+    }
     if (checks.length > 0 && unresolved.length > 0) {
       // A failed check whose *log* smells like infrastructure — a registry 429,
       // a runner shutdown, a DNS failure (#177). The check has a verdict, so