omp-conductor 0.18.1 → 0.18.2

package/src/doctor.ts

@@ -46,9 +46,11 @@ import {
   dbBackupDirFor,
   findProject,
   loadConfig,
+  resolveArmProof,
   resolveCaps,
   stateDir,
 } from "./config.ts";
+import { observeArmChallenge } from "./arm-challenge.ts";
 import { ompSettingsOverlay, sessionRootDir } from "./omp-settings.ts";
 import {
   DEFAULT_HERDR_UNIT,
@@ -85,10 +87,7 @@ import {
   SYSTEMD_UNIT_DIR,
   tickCwdForProject,
   totalConfiguredWorkers,
-  workerAclHealth,
-  type WorkerAclHealth,
 } from "./setup-host.ts";
-import { WORKER_ACCOUNT } from "./host.ts";
 import { checkTokenScopes, type ScopeCheck } from "./setup.ts";
 import { DB_SNAPSHOT_STEM, dbPath, LIVE_STATES } from "./store.ts";
 import { telegramReportSend, type ReportSend } from "./reports.ts";
@@ -101,7 +100,7 @@ import {
   type HerdrAgentList,
 } from "./orchestrator-tick.ts";
 import type { ConductorConfig, ProjectConfig, RepoTarget, RunState } from "./types.ts";
-
+import { DEFAULT_ARM_PROOF, type ArmProof } from "./types.ts";
 /**
  * `doctor`'s finding vocabulary. `pass`/`warn`/`fail` — a warning renders the
  * same but never flips the exit code; exit is nonzero iff any finding fails.
@@ -256,8 +255,10 @@ export interface DoctorDeps {
   /** The topic id an arm challenge would send into for this project —
    *  resolveProjectTopicId's pin-or-live-claim; undefined means flat chat. */
   armSendTopic?: (project: ProjectConfig) => number | undefined;
-  /** The session directories arm scans for the challenge reply on this
-   *  project — tick-cwd-derived plus the live claim's own directory. */
+  /** The session surface the claim-only plumbing verdict judges for this
+   *  project — tick-cwd-derived plus the live claim's own directory. The
+   *  challenge proof reads conductor state instead (#614), so this feeds
+   *  claim-only verdict checks only. */
   armScanDirs?: (project: ProjectConfig) => readonly string[];
   /** Whether a recorded claim or dm-owner pid is live, with omp-telegram's
    *  topics.ts semantics (EPERM is dead). */
@@ -275,13 +276,6 @@ export interface DoctorDeps {
   tickAgentName?: (project: ProjectConfig) => string | undefined;
   /** Clock, so a run is deterministic in tests. */
   now?: () => number;
-  /** The linked worker config paths' effective-ACL verdict for the dedicated
-   *  worker account (#835): `checkable` paths judged, `missing` the ones that
-   *  do not currently grant the worker's needed effective access. Read-only
-   *  and injectable so no test ever touches the host's ACLs; the production
-   *  wiring is the identity plan's own getfacl probe, so `doctor` and
-   *  `setup host` cannot disagree about an ACL. */
-  workerAclHealth?: () => WorkerAclHealth;
   /** The one opt-in side effect: send one self-identified Telegram probe. */
   probeTelegram?: boolean;
 }
@@ -762,6 +756,12 @@ function unresolvableShell(unit: string): boolean {
  * state resolved at staging time, so a rendered value doctor cannot reproduce
  * is excluded from both sides rather than reported as a difference — an
  * unresolvable canonical is "cannot compare", never drift (#511).
+ *
+ * The service `PATH=` line has no such exemption: since #879 it is canonical
+ * on both sides (`defaultServiceRuntime` composes it from the resolved fleet
+ * binaries plus the standard system directories, never from the rendering
+ * process's environment), so a differing installed value is genuine drift and
+ * must fail here with the value named.
  */
 export function unitDrift(installed: string, canonical: string): { differences: string[] } {
   const want = canonical
@@ -916,36 +916,6 @@ function ownershipProbe(probes: Probes): Finding {
   return failFinding("systemd-ownership", summary, fix);
 }
 
-/**
- * The dedicated worker account's path ACLs (#835): every linked worker config
- * path must grant the worker its *effective* search/read permissions. The
- * installed OMP harness chmods its agent config dir back to 0700 on every
- * open, and a chmod rewrites the ACL mask — the named entry survives as
- * `user:omp-worker:--x  #effective:---` while the worker's access silently
- * vanishes, which is exactly the incident this finding exists to catch
- * (`${INCIDENTS.workerAcl}`). The verdict comes from the identity plan's own
- * probe through the read-only {@link DoctorDeps.workerAclHealth} seam, so a
- * pass here is a pass the plan agrees with and a fail names the paths whose
- * mask is stripping the grant.
- */
-function workerAclProbeFinding(probes: Probes): Finding {
-  const health = probes.workerAclHealth();
-  if (health.checkable === 0) {
-    return passFinding("worker-acl", "no linked worker config paths on this host yet — nothing to check");
-  }
-  if (health.missing.length === 0) {
-    return passFinding(
-      "worker-acl",
-      `${health.checkable} linked worker config path(s) grant ${WORKER_ACCOUNT} effective search/read access`,
-    );
-  }
-  return failFinding(
-    "worker-acl",
-    `the ${WORKER_ACCOUNT} account's ACL is not effective on ${health.missing.join(", ")} — a named entry the ACL mask strips is ` +
-      "unreachable by the worker, and the next admitted worker dies on EACCES before connecting",
-    "re-run `omp-conductor setup host`: the transaction re-applies the ACL grants (mask included) after the final fleet restart",
-  );
-}
 
 /** IANA timezone in reporting config — an invalid zone silently mis-schedules
  *  the availability window and the daily digest (#273). */
@@ -1173,91 +1143,43 @@ function herdrAgentNameProbe(probes: Probes, p: ProjectConfig): Finding {
 }
 
 /**
- * #600 check — the orchestrator's claimed session file vs the directory arm
- * scans.
+ * #614 check — the state of this project's arming acknowledgement transaction.
  *
- * A pane resumed from a session created elsewhere keeps the original transcript
- * path (herdr pins the pane to it), so the claimed file can live outside the
- * session directory the tick cwd implies. arm follows the claim, so the
- * mismatch alone is handled — but it is exactly the shape of host that once
- * made arming silently impossible, and an operator reading transcript paths
- * should not have to rediscover it. A claimed file *outside the session tree*
- * is worse: arm refuses to arm there (the reply could never be seen), so
- * doctor fails rather than letting the fleet sit disarmed.
+ * The challenge proof is conductor-owned state now: the host records a pending
+ * challenge and waits for the acknowledgement the orchestrator's inbound
+ * adapter writes. No transcript location is diagnosed any more — where (or
+ * whether) a session file lives is not part of arming — so what is worth
+ * reporting is a transaction left open: a challenge still pending and whether
+ * it has been acknowledged, or an expired record nothing settled. Every shape
+ * is inert by construction (a reply past expiry, or for a replaced id, is
+ * refused), so this informs; only the stale leftover warns.
  */
-function armSessionDirProbe(probes: Probes, p: ProjectConfig): Finding {
-  const result = probes.claimedTopics();
-  if (result.kind !== "ok") {
-    // The registry could not be read, so the claim's session file is unknown,
-    // not known-absent. Arm scans the tick-cwd directory either way, but the
-    // finding must stay diagnostic — this is exactly the shape that once made
-    // arming silently impossible, and "no claim" would certify it as fine. A
-    // missing registry is the same unknown to this probe: the bridge may never
-    // have claimed, but nothing proves the claim names no session file.
+function armAckProbe(probes: Probes, p: ProjectConfig): Finding {
+  const now = probes.now();
+  const sighting = observeArmChallenge(p.name);
+  if (sighting === undefined) {
+    return passFinding("arm-ack", `[${p.name}] no pending arm challenge — the acknowledgement handshake is idle`);
+  }
+  const window =
+    sighting.sentAt === undefined || sighting.expiresAt === undefined
+      ? "an unreadable record window"
+      : `sent ${new Date(sighting.sentAt).toISOString()}, expires ${new Date(sighting.expiresAt).toISOString()}`;
+  if (sighting.expiresAt !== undefined && now >= sighting.expiresAt) {
     return warnFinding(
-      "arm-session-dir",
-      `[${p.name}] ` +
-        (result.kind === "missing"
-          ? `omp-telegram has no claim registry (threads.json in its state dir) — arm scans the tick-cwd session directory, but doctor cannot tell whether the claim names a session file elsewhere`
-          : `omp-telegram's claim registry is unreadable (${result.problem}) — arm scans the tick-cwd session directory, but doctor cannot tell whether the claim names a session file elsewhere`),
-      `check omp-telegram's claim registry (threads.json in its state dir) is readable and the bridge is running, then re-run doctor`,
+      "arm-ack",
+      `[${p.name}] an arming challenge from ${window} expired without being settled — it is inert (replies past expiry are refused), but it lingers until this project's next arm replaces it`,
+      `no action needed; the next \`arm\` for this project settles it — re-run doctor afterwards to confirm`,
     );
   }
-  if (result.claims.length === 0) {
+  if (sighting.acknowledgedAt !== undefined) {
     return passFinding(
-      "arm-session-dir",
-      `[${p.name}] no live omp-telegram claim — arm scans the tick-cwd session directory`,
-    );
-  }
-  const claims = result.claims;
-  const match = resolveProjectClaim(claims, p.name);
-  const scanDir = sessionDirForCwd(tickCwdForProject(p));
-  if (match.kind === "ambiguous") {
-    // Several live claims answer to the project, so the claim's session file
-    // cannot be told from a sibling pane's. Arm scans the tick-cwd directory
-    // either way, but certifying that fallback as the scan is the miss this
-    // probe exists to surface: the resumed transcript may live under another
-    // claim while doctor reads the fallback as the whole story (#626).
-    return warnFinding(
-      "arm-session-dir",
-      `[${p.name}] several live claims answer to this project (topics ${match.claimants.map((c) => c.threadId).join(", ")}), so the claim's session file is a coin toss — arm scans the tick-cwd session directory, but the resumed transcript may live elsewhere`,
-      `make exactly one live claim answer to this project: rename the other panes' herdr spaces or re-claim them one at a time, then re-run doctor — or start the orchestrator pane's session from the tick cwd ${scanDir}`,
-    );
-  }
-  const claim = match.kind === "match" ? match.claim : undefined;
-  if (claim === undefined) {
-    return passFinding(
-      "arm-session-dir",
-      `[${p.name}] no live omp-telegram claim answers to this project — arm scans the tick-cwd session directory`,
-    );
-  }
-  if (claim.sessionFile === undefined) {
-    return passFinding(
-      "arm-session-dir",
-      `[${p.name}] the live claim names no session file — arm scans the tick-cwd session directory`,
-    );
-  }
-  const root = sessionsRoot();
-  const claimDir = dirname(claim.sessionFile);
-  if (claimDir !== root && !claimDir.startsWith(join(root, sep))) {
-    return failFinding(
-      "arm-session-dir",
-      `[${p.name}] the orchestrator's claimed session file ${claim.sessionFile} is outside the session tree arm scans (${root}) — ` +
-        `arm cannot arm while the reply can only land there`,
-      `start the orchestrator pane's session under ${root}, or from the tick cwd ${scanDir}`,
-    );
-  }
-  if (claimDir !== scanDir) {
-    return warnFinding(
-      "arm-session-dir",
-      `[${p.name}] the orchestrator's claimed session file ${claim.sessionFile} lives in ${claimDir}, not the tick-cwd session directory ${scanDir} — ` +
-        `arm follows the claim, so arming works, but this is the resumed-pane shape #600 names`,
-      `optional tidy-up: start the pane's session from the tick cwd so transcript and cwd agree again`,
+      "arm-ack",
+      `[${p.name}] an arm challenge is pending (${window}) and was acknowledged ${new Date(sighting.acknowledgedAt).toISOString()} — the host consumes it on settle`,
     );
   }
   return passFinding(
-    "arm-session-dir",
-    `[${p.name}] the orchestrator's claimed session file is inside the session directory arm scans`,
+    "arm-ack",
+    `[${p.name}] an arm challenge is pending (${window}), not yet acknowledged — live if \`arm\` is running right now, otherwise its window simply runs out`,
   );
 }
 
@@ -1379,9 +1301,20 @@ function telegramPlumbingProbe(probes: Probes, p: ProjectConfig): Finding {
       `[${p.name}] outbound-only paging — no tick accessFile to arm, so no live claim, DM owner or poll ownership is required`,
     );
   }
+  // Transcript-surface identity checks belong to the claim-only proof alone:
+  // since #614 the challenge proof reads conductor acknowledgement state, so
+  // judging it by where a transcript lives could report arming impossible
+  // while `arm` succeeds. An unreadable config keeps the default proof —
+  // fail-safe to the stricter verdict, exactly like armTicks.
+  let proof: ArmProof = DEFAULT_ARM_PROOF;
+  try {
+    proof = resolveArmProof(p);
+  } catch {
+    /* unreadable config — keep today's stricter default */
+  }
   const verdict = telegramPlumbingVerdict(
     probes.armSendTopic(p),
-    { dirs: probes.armScanDirs(p) },
+    proof === "claim-only" ? { dirs: probes.armScanDirs(p) } : undefined,
     {
       channel: probes.channelState(p),
       registry: probes.claimedTopics(),
@@ -1663,7 +1596,7 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
       passFinding("herdr-agent-name", projectProblem === undefined ? "no project resolved — nothing to check" : `agent name uncheckable: ${projectProblem}`),
     );
     findings.push(
-      passFinding("arm-session-dir", projectProblem === undefined ? "no project resolved — nothing to check" : `arm session dir uncheckable: ${projectProblem}`),
+      passFinding("arm-ack", projectProblem === undefined ? "no project resolved — nothing to check" : `arm acknowledgement uncheckable: ${projectProblem}`),
     );
     findings.push(
       passFinding("topic-pin", projectProblem === undefined ? "no project resolved — nothing to check" : `topic pin uncheckable: ${projectProblem}`),
@@ -1678,7 +1611,7 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
     for (const p of projects) {
       findings.push(await labelProbe(probes, p));
       findings.push(herdrAgentNameProbe(probes, p));
-      findings.push(armSessionDirProbe(probes, p));
+      findings.push(armAckProbe(probes, p));
       findings.push(topicPinProbe(probes, p));
       findings.push(telegramPlumbingProbe(probes, p));
       findings.push(ompSettingsProbe(p, sessionRootState));
@@ -1690,10 +1623,6 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
   findings.push(unitProbe(probes, projects[0], cfg));
   findings.push(recoveryProbe(probes));
   findings.push(ownershipProbe(probes));
-  // The worker's path ACLs are a host-wide fact like the unit ownership: one
-  // shared daemon account, one shared worker identity, one shared set of
-  // linked config paths. A finding once, never once per project.
-  findings.push(workerAclProbeFinding(probes));
   // #541 seam checks, host-global: the live herdr config and the plugin's
   // config.env are single files on the host, not per-project facts.
   findings.push(herdrResumeProbe(probes));
@@ -1737,9 +1666,6 @@ export function defaultProbes(): Probes {
     readUnit: defaultReadUnit,
     stat: defaultStat,
     uidOf: defaultUidOf,
-    // The same effective-ACL read the identity plan plans with — doctor and
-    // setup cannot disagree about a worker grant (#835).
-    workerAclHealth: () => workerAclHealth(join(homedir(), ".omp", "agent")),
     dbIntegrity: defaultDbIntegrity,
     snapshotDirState: defaultSnapshotDirState,
     sessionRootState: defaultSessionRootState,

package/src/escalate.ts

@@ -1040,13 +1040,14 @@ export interface TelegramPlumbingProbe {
 }
 
 /**
- * The session surface the arm waiter actually scans for the challenge reply:
- * {@link armTicks} polls every `.jsonl` transcript *directly inside* these
- * directories — the tick-cwd-derived session directory plus, when the
- * project's claim names a session file elsewhere, that file's directory. The
- * recipient of the reply (a claim's, the DM owner's, or the local poll
- * owner's session file) must land in this set, or the reply can never satisfy
- * the challenge even though inbound works.
+ * The transcript-surface input for {@link telegramPlumbingVerdict}'s session
+ * identity checks: the directories the claim-only proof judges recipients
+ * against (a claim's, the DM owner's, or the local poll owner's session file
+ * must land inside, or a flat reply could land where no challenge would have
+ * looked). Since #614 the *challenge* proof reads conductor acknowledgement
+ * state and never opens a transcript, so callers judging challenge-mode
+ * plumbing omit this — passing it there could report arming impossible while
+ * `arm` succeeds.
  */
 export type TelegramPlumbingScan = { dirs: readonly string[] };
 
@@ -1074,7 +1075,7 @@ export type TelegramPlumbingScan = { dirs: readonly string[] };
  */
 export function telegramPlumbingVerdict(
   sendTopic: number | undefined,
-  scan: TelegramPlumbingScan,
+  scan: TelegramPlumbingScan | undefined,
   probe: TelegramPlumbingProbe,
 ): TelegramPlumbingVerdict {
   const { registry, poll, dmOwner, channel, alive, lockAlive, fresh } = probe;
@@ -1085,14 +1086,21 @@ export function telegramPlumbingVerdict(
     const claim = registry.claims.find((c) => c.threadId === sendTopic);
     if (claim === undefined) return { ok: false, reason: "no-topic-claim" };
     if (claim.pid === undefined || !alive(claim.pid)) return { ok: false, reason: "claim-dead" };
-    if (claim.sessionFile !== undefined && !sessionWithinScan(claim.sessionFile, scan.dirs)) {
+    if (
+      scan !== undefined &&
+      claim.sessionFile !== undefined &&
+      !sessionWithinScan(claim.sessionFile, scan.dirs)
+    ) {
       return { ok: false, reason: "claim-session-outside" };
     }
     recipient = "claim";
   } else {
     if (dmOwner.kind === "ok") {
       if (dmOwner.owner.pid === undefined || !alive(dmOwner.owner.pid)) return { ok: false, reason: "dm-owner-dead" };
-      if (dmOwner.owner.sessionFile === undefined || !sessionWithinScan(dmOwner.owner.sessionFile, scan.dirs)) {
+      if (
+        scan !== undefined &&
+        (dmOwner.owner.sessionFile === undefined || !sessionWithinScan(dmOwner.owner.sessionFile, scan.dirs))
+      ) {
         return { ok: false, reason: "dm-owner-unrelated" };
       }
       recipient = "dm-owner";
@@ -1102,7 +1110,10 @@ export function telegramPlumbingVerdict(
       // record must name that session. A daemon-only or unrelated owner is no
       // recipient: the reply would land in a transcript arm never scans.
       if (poll.kind !== "ok") return { ok: false, reason: "no-dm-owner" };
-      if (poll.owner.sessionFile === undefined || !sessionWithinScan(poll.owner.sessionFile, scan.dirs)) {
+      if (
+        scan !== undefined &&
+        (poll.owner.sessionFile === undefined || !sessionWithinScan(poll.owner.sessionFile, scan.dirs))
+      ) {
         return { ok: false, reason: "no-dm-owner" };
       }
       recipient = "poller";