omp-conductor 0.18.1 → 0.19.0

package/src/setup-wizard.ts

@@ -28,6 +28,7 @@ import {
 import { claimedTelegramTopics } from "./escalate.ts";
 import { hostRamBytes, recommendedMaxWorkers, workerOvercommit } from "./host.ts";
 import {
+  admissionAckPath,
   daemonGeneration,
   isPaused,
   pausedPath,
@@ -40,8 +41,10 @@ import {
   type AdmissionAckRecord,
   type QueuePreview,
 } from "./daemon.ts";
+import { pauseBytesValid } from "./pause.ts";
 import { armedMarkerPath, armTicks, fleetLayers, telegramStateDir } from "./fleet.ts";
 import {
+  daemonControlTarget,
   healthCheck,
   healthServesProject,
   livingDaemon,
@@ -110,11 +113,13 @@ import {
   parseOmpSettingsYaml,
   planAgainstLabels,
   planLabels,
+  readConfiguredOmpRoles,
   summariseAmend,
   summarisePlan,
   wantedLabels,
   writeOrchestratorBrief,
   type AmendAreaId,
+  type ConfiguredOmpRoles,
   type LabelPlan,
   type OperatorJudgment,
   type ScopeCheck,
@@ -126,6 +131,7 @@ import {
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
   DEFAULT_CAPS,
+  DEFAULT_REVIEW_ADJUDICATOR_ROLE,
   DEFAULT_REVIEW_MAX_ROUNDS,
   DEFAULT_REVIEW_STRICTNESS,
   DENIED_RELEASE_GRANTS,
@@ -133,6 +139,7 @@ import {
   RELEASE_REQUIREMENTS,
   INTERRUPT_CATEGORIES,
   RELEASE_SHAPES,
+  REVIEW_ADJUDICATOR_RE,
   REVIEW_MAX_ROUNDS_MAX,
   REVIEW_MAX_ROUNDS_MIN,
   REVIEW_STRICTNESS,
@@ -151,6 +158,7 @@ import {
   type ReviewPolicy,
 } from "./types.ts";
 import { withProgress } from "./ui/progress.ts";
+import { modelRolesIn } from "./omp-settings.ts";
 import type { WizardUi } from "./wizard-ui.ts";
 
 /**
@@ -1431,6 +1439,136 @@ async function askReviewRounds(ui: WizardUi, current: number): Promise<number> {
   throw new Cancelled();
 }
 
+/** The answer-file key the adjudicator question is recorded under. */
+const REVIEW_ADJUDICATOR_KEY = "review-adjudicator-role";
+
+/**
+ * Whether one role is a legitimate adjudicator answer on this host right now:
+ * it must be a single loadable role token (`REVIEW_ADJUDICATOR_RE`) AND a
+ * `modelRoles` key of the daemon's global settings or of the project's omp
+ * overlay — or the deterministic default, which setup must always be able to
+ * write back. Anything else — including a project's current role that was
+ * removed from both surfaces, or a malformed `modelRoles` key the loader
+ * would refuse — is an unavailable role and must not be accepted, whatever
+ * the config says (#875).
+ */
+function isAdjudicatorAvailable(live: ConfiguredOmpRoles, overlay: readonly string[], role: string): boolean {
+  if (!REVIEW_ADJUDICATOR_RE.test(role)) return false;
+  return role === DEFAULT_REVIEW_ADJUDICATOR_ROLE || live.global.includes(role) || overlay.includes(role);
+}
+
+/**
+ * The adjudicator roles the dialog accepts, derived from the live OMP role
+ * configuration — the daemon's global settings, then the project's omp
+ * overlay — with the current answer first and the deterministic default
+ * offered exactly once (#875). The order is the contract: an amend's Enter
+ * re-affirms the current value, and the shipped default stays expressible for
+ * a project whose operator never answered.
+ *
+ * Every role is filtered through the same token grammar the loader enforces:
+ * a `modelRoles` key the config gate would reject must never be offered (or
+ * accepted), because persisting it would write a policy the next loadConfig
+ * refuses and stop the fleet. The current answer leads the list only while it
+ * is still available: a role removed from both the global settings and the
+ * overlay must not be accepted back into the config by a bare Enter — the
+ * caller warns that it cannot be kept, and the accepted set excludes it, so
+ * Entering it refuses exactly like typing any other unavailable role.
+ */
+function adjudicatorChoices(live: ConfiguredOmpRoles, overlay: readonly string[], current: string): string[] {
+  const choices: string[] = [];
+  const seen = new Set<string>();
+  const first = isAdjudicatorAvailable(live, overlay, current) ? [current] : [];
+  for (const role of [...first, ...live.global, ...overlay, DEFAULT_REVIEW_ADJUDICATOR_ROLE]) {
+    if (REVIEW_ADJUDICATOR_RE.test(role) && !seen.has(role)) {
+      seen.add(role);
+      choices.push(role);
+    }
+  }
+  return choices;
+}
+
+/** One role row's description: what makes this role available and why. */
+function adjudicatorDescription(
+  role: string,
+  live: ConfiguredOmpRoles,
+  overlay: readonly string[],
+): string | undefined {
+  if (live.global.includes(role) || overlay.includes(role)) {
+    return role === DEFAULT_REVIEW_ADJUDICATOR_ROLE
+      ? "configured OMP model role — the deterministic default"
+      : "configured OMP model role";
+  }
+  if (role === DEFAULT_REVIEW_ADJUDICATOR_ROLE) {
+    return "the deterministic default every project loads until answered";
+  }
+  return undefined;
+}
+
+/**
+ * Which OMP model role runs a PR's terminal review-ceiling adjudication
+ * (#875). The offered roles are derived from the live OMP role configuration
+ * (the daemon account's global settings and the project's overlay, never a
+ * conductor-owned registry), the prompt opens on the current answer, and any
+ * answer that is not one of those configured roles is refused with the place
+ * to configure it named.
+ *
+ * Driven through `askValid`, not a select, on purpose: a select surface can
+ * only ever return an offered label, so the unconfigured-value refusal would
+ * be unreachable on the real UIs and the answer-file path would fail with a
+ * generic "must be a listed label" before this guidance ran. A validated text
+ * answer gives every surface — terminal, scripted and `--answers` — the same
+ * bounded three tries and the same actionable error naming the settings file.
+ */
+async function askReviewAdjudicator(
+  ui: WizardUi,
+  current: string,
+  live: ConfiguredOmpRoles,
+  overlay: readonly string[],
+): Promise<string> {
+  const choices = adjudicatorChoices(live, overlay, current);
+  if (!live.decoded) {
+    ui.notify(
+      `The daemon's OMP settings at ${live.path} could not be read — only the project's overlay roles and the default are offered.`,
+      "warning",
+    );
+  }
+  // A project whose configured role was removed from both surfaces must not be
+  // allowed to keep it: the warning names the role and the way back, and the
+  // accepted list above already excludes it — Entering it now refuses exactly
+  // like typing any other unavailable role (#875).
+  if (!isAdjudicatorAvailable(live, overlay, current)) {
+    ui.notify(
+      `"${current}" is this project's current adjudicator but not a currently configured OMP model role — it cannot be kept. ` +
+        `Add "${current}" back as a modelRoles key to ${live.path} or this project's omp settings overlay, ` +
+        `or type one of the available roles below.`,
+      "warning",
+    );
+  }
+  ui.notify(
+    choices
+      .map((role) => {
+        const described = adjudicatorDescription(role, live, overlay);
+        return `${role}${role === current ? " (current)" : ""}${described === undefined ? "" : ` — ${described}`}`;
+      })
+      .join("\n"),
+    "info",
+  );
+  return askValid(
+    ui,
+    REVIEW_ADJUDICATOR_KEY,
+    "Adjudicator for a PR at the review ceiling — one configured OMP model role, not a model",
+    current,
+    (value) => {
+      if (choices.some((choice) => choice === value)) return undefined;
+      return (
+        `"${value}" is not one of the OMP model roles available here — add it as a modelRoles key to the daemon's OMP settings ` +
+        `(${live.path}) or this project's omp settings overlay, or type an offered role. ` +
+        `A role is a single token like "task" — never a provider or model.`
+      );
+    },
+  );
+}
+
 /**
  * How green PRs are reviewed (#678), asked with the merge preconditions and
  * the arming proof: they are the same kind of declared policy — a typed,
@@ -1441,7 +1579,10 @@ async function askReviewRounds(ui: WizardUi, current: number): Promise<number> {
  * rather than between three words. The select cursor opens on the current
  * answer (the configured level on a re-run, the recommended default on a
  * first run); the rounds are a validated integer within the same range the
- * loader enforces.
+ * loader enforces; the adjudicator role is offered from the live OMP role
+ * configuration (#875) — the options and their availability come from the
+ * daemon's OMP settings and the project's overlay, never from a conductor
+ * model registry.
  */
 async function askReviewPolicy(ui: WizardUi, a: SetupAnswers): Promise<ReviewPolicy> {
   ui.notify(
@@ -1450,6 +1591,7 @@ async function askReviewPolicy(ui: WizardUi, a: SetupAnswers): Promise<ReviewPol
     ),
     "info",
   );
+  const live = readConfiguredOmpRoles();
   return {
     strictness: await askLiteral(
       ui,
@@ -1460,6 +1602,7 @@ async function askReviewPolicy(ui: WizardUi, a: SetupAnswers): Promise<ReviewPol
       a.review.strictness,
     ),
     maxRounds: await askReviewRounds(ui, a.review.maxRounds),
+    adjudicator: await askReviewAdjudicator(ui, a.review.adjudicator, live, modelRolesIn(a.ompSettings)),
   };
 }
 
@@ -2003,8 +2146,15 @@ interface DerivedPlan {
 export async function ensureSetupArm(
   projectName: string,
   arm: typeof armTicks = armTicks,
+  /**
+   * Where the arm proof's pending heartbeat goes while it waits (#861). Setup
+   * holds dispatch under its own fence across this call, so a silent wait here
+   * is the whole incident: the operator sees a stalled wizard and cannot tell
+   * a live handshake from a dead process.
+   */
+  progress?: (line: string) => void,
 ): Promise<string> {
-  const armed = await arm(projectName);
+  const armed = await arm(projectName, progress === undefined ? {} : { progress });
   return armed.alreadyArmed
     ? `existing heartbeat arm revalidated for owner ${armed.owner} at ${armed.path}`
     : `heartbeat armed for owner ${armed.owner} at ${armed.path}`;
@@ -2207,7 +2357,12 @@ export interface SetupApplyDeps {
   drain: DrainDeps;
   smoke: (project: string) => Promise<SetupSmokeResult>;
   restart: (o: { project?: string }) => Promise<RestartResult>;
-  arm: (project: string) => Promise<string>;
+  /**
+   * Prove the heartbeat channel for one project. `progress` is where the
+   * pending proof's own heartbeat is written while it waits on the operator
+   * (#861) — the wizard owns the surface, so the reporter comes from the call.
+   */
+  arm: (project: string, progress?: (line: string) => void) => Promise<string>;
   hostInstall: (
     project: ProjectConfig,
     caps: Caps,
@@ -2248,7 +2403,15 @@ function defaultSetupDrain(): DrainDeps {
     projectNames: () => loadConfig().projects.map((p) => p.name),
     daemonIdentity: setupDaemonIdentity,
     pauseState: (project) => pauseInstance(project),
-    setPaused: (v, project) => setPaused(v, { source: pauseSourceToken("setup"), reason: "setup apply fence" }, project),
+    setPaused: (v, project) =>
+      // `owner` is this process (#938): the apply fence holds dispatch across
+      // this transaction only, and the 2026-08-21 incident is exactly what an
+      // abandoned one looks like from outside.
+      setPaused(
+        v,
+        { source: pauseSourceToken("setup"), reason: "setup apply fence", owner: process.pid },
+        project,
+      ),
     // The daemon-side admission acknowledgement: the file the running daemon
     // itself writes when it observes the fence at an admission boundary, so
     // the barrier never mistakes a second synchronous count for the daemon's
@@ -2318,7 +2481,7 @@ export const DEFAULT_APPLY: SetupApplyDeps = {
   drain: defaultSetupDrain(),
   smoke: runSetupSmoke,
   restart: (o) => restartDaemon(o),
-  arm: (project) => ensureSetupArm(project),
+  arm: (project, progress) => ensureSetupArm(project, armTicks, progress),
   hostInstall: (project, caps, telegramStateDir, ui) =>
     runHostInstall(project, caps, telegramStateDir, ui),
   graphInstall: (project, ui, options) => runGraphInstall(project, ui, options),
@@ -2347,19 +2510,6 @@ type CapturedPause =
   | { kind: "malformed"; bytes: string; path: string }
   | { kind: "unreadable"; path: string };
 
-/** Whether one sentinel's bytes parse as a valid pause instance — the exact
- *  grammar {@link pauseInstance} reads in `daemon.ts` (a parseable ISO
- *  timestamp line, then a `source=` provenance line). Readable bytes that
- *  fail this are an unreadable-as-state malformed hold: valid bytes are
- *  restored verbatim, malformed ones are refused at entry and never deleted
- *  (#650). */
-function isValidPauseBytes(bytes: string): boolean {
-  const [line1, line2] = bytes.split("\n");
-  if (!Number.isFinite(Date.parse(line1?.trim() ?? ""))) return false;
-  if (line2 === undefined) return false;
-  return /^source=(\S+)(?: reason="(.*)")?$/.test(line2.trim());
-}
-
 /** Reads one pause sentinel, keeping absence, readable-valid bytes, malformed
  *  bytes and unreadability apart — never conflated: collapsing malformed to
  *  absence would let a refusal delete an operator hold it could not parse. */
@@ -2367,7 +2517,7 @@ function readSentinel(p: string): CapturedPause {
   if (!existsSync(p)) return { kind: "absent" };
   try {
     const bytes = readFileSync(p, "utf8");
-    return isValidPauseBytes(bytes) ? { kind: "bytes", bytes } : { kind: "malformed", bytes, path: p };
+    return pauseBytesValid(bytes) ? { kind: "bytes", bytes } : { kind: "malformed", bytes, path: p };
   } catch {
     return { kind: "unreadable", path: p };
   }
@@ -2526,7 +2676,6 @@ function captureInventory(
   };
   captureIfWritten(plan.runtime.service);
   captureIfWritten(plan.runtime.herdrUnit);
-  captureIfWritten(plan.runtime.harnessMount);
   captureIfWritten(plan.runtime.herdrConfig);
   captureIfWritten(plan.runtime.herdrEnv);
   captureIfWritten(plan.runtime.recoverUnit);
@@ -2760,23 +2909,61 @@ const FENCE_ACK_POLL_MS = 250;
  * barrier froze, or `undefined` when it does: the acknowledgement must name
  * the exact pause instance the barrier proved (not some other pause, however
  * similar) and the exact daemon generation the barrier began with (not an
- * older or newer instance's word) (#651 review #3).
+ * older or newer instance's word) (#651 review #3). Every problem names the
+ * observed and expected instances, so an operator can tell "no
+ * acknowledgement yet" from "acknowledged something else" without opening a
+ * debugger (#865).
  */
 function fenceAckProblem(ack: AdmissionAckRecord | undefined, begun: RestartBegun): string | undefined {
-  if (ack === undefined) return "the running daemon has not acknowledged the setup admission fence";
+  if (ack === undefined) {
+    return (
+      "the running daemon has not acknowledged the setup admission fence " +
+      `(fence ${describePauseInstance(begun.pauseToken)}; expected daemon generation ${begun.daemon.generation}; ` +
+      `no readable acknowledgement at ${admissionAckPath()})`
+    );
+  }
   if (
     ack.pause.source !== begun.pauseToken.source ||
     ack.pause.since !== begun.pauseToken.since ||
     ack.pause.reason !== begun.pauseToken.reason
   ) {
-    return "the running daemon acknowledged a different pause than the setup admission fence";
+    return (
+      "the running daemon acknowledged a different pause than the setup admission fence " +
+      `(acknowledged ${describePauseInstance(ack.pause)}; fence ${describePauseInstance(begun.pauseToken)})`
+    );
   }
   if (ack.daemon !== begun.daemon.generation) {
-    return "the running daemon's acknowledgement belongs to a different daemon generation";
+    return (
+      "the running daemon's acknowledgement belongs to a different daemon generation " +
+      `(acknowledged ${ack.daemon}; expected ${begun.daemon.generation})`
+    );
   }
   return undefined;
 }
 
+/** One pause instance as one readable token for refusal diagnostics (#865). */
+function describePauseInstance(pause: { source: string; reason?: string; since: number }): string {
+  const reason = pause.reason === undefined ? "" : ` reason="${pause.reason}"`;
+  return `source=${pause.source}${reason} since=${new Date(pause.since).toISOString()}`;
+}
+
+/**
+ * Where a prompt-pass wake can provably land, or `undefined`: the pidfile
+ * record's port while its process lives, else — a supervised daemon whose
+ * runtime record went missing while the unit stayed active (#651 review #2) —
+ * the run-control endpoint {@link daemonControlTarget} proves by answering
+ * `/healthz`, the same consultation every run-control verb performs (#716).
+ * A port is never guessed: when nothing provable answers, no wake is sent and
+ * the caller's bounded wait covers the daemon's own next pass instead. The
+ * pre-#865 barrier skipped BOTH the wake and the wait whenever the record was
+ * unreadable, so a transient record loss refused three interviews in a row
+ * against a healthy dispatcher that would have acknowledged within one tick.
+ */
+async function reachableWakeEndpoint(): Promise<{ port: number } | undefined> {
+  const target = await daemonControlTarget();
+  return target.kind === "record" || target.kind === "unit" ? { port: target.port } : undefined;
+}
+
 /**
  * Why the acknowledged barrier no longer holds, or `undefined` when it does:
  * a live worker anywhere in scope, the daemon-side admission acknowledgement
@@ -3251,39 +3438,41 @@ export async function setup(
   // boundary and written that observation down — a second synchronous worker
   // count is not an acknowledgement, because a tick already past its own
   // pause gate can claim after it and before setup mutates. A running daemon
-  // that has not yet acknowledged is woken to prompt an immediate pass; one
-  // that cannot be reached (its record is missing) or that still has not
-  // acknowledged by the bounded deadline refuses before anything is written.
+  // that has not yet acknowledged is woken — through any endpoint /healthz
+  // proves, record or record-less (#865) — to prompt an immediate pass; one
+  // that still has not acknowledged by the bounded deadline refuses before
+  // anything is written. The wait itself never depends on the pidfile: a
+  // supervised daemon with a lost record still reaches its own gate within
+  // one tick interval, and skipping the wait for it was the #865 refusal.
   let requireAck = true;
   if (begun.daemon.running) {
     let ack = apply.drain.admissionAck?.(scope.pauseKey);
-    let acknowledged = fenceAckProblem(ack, begun) === undefined;
-    if (!acknowledged) {
-      const reachable = livingDaemon();
-      if (reachable !== undefined) {
-        ui.notify(
-          "The running daemon has not yet acknowledged the setup admission fence — waking it to prompt a pass.",
-          "info",
-        );
-        void wakeDaemon(reachable.port);
-        // `OMP_CONDUCTOR_TEST_FENCE_ACK_WAIT_MS` is the #399 test seam: a
-        // regression proving this refusal burns the short test deadline
-        // instead of the production 60s.
-        const deadline =
-          Date.now() + Number(process.env["OMP_CONDUCTOR_TEST_FENCE_ACK_WAIT_MS"] ?? FENCE_ACK_WAIT_MS);
-        while (!acknowledged && Date.now() < deadline) {
-          await apply.drain.sleep(FENCE_ACK_POLL_MS);
-          ack = apply.drain.admissionAck?.(scope.pauseKey);
-          acknowledged = fenceAckProblem(ack, begun) === undefined;
-        }
+    let problem = fenceAckProblem(ack, begun);
+    if (problem !== undefined) {
+      const wake = await reachableWakeEndpoint();
+      ui.notify(
+        wake !== undefined
+          ? `The running daemon has not yet acknowledged the setup admission fence — waking it on :${wake.port} to prompt a pass.`
+          : "The running daemon has not yet acknowledged the setup admission fence — nothing provable answers /healthz to wake, so waiting for its own dispatch pass.",
+        "info",
+      );
+      if (wake !== undefined) void wakeDaemon(wake.port);
+      // `OMP_CONDUCTOR_TEST_FENCE_ACK_WAIT_MS` is the #399 test seam: a
+      // regression proving this refusal burns the short test deadline
+      // instead of the production 60s.
+      const deadline =
+        Date.now() + Number(process.env["OMP_CONDUCTOR_TEST_FENCE_ACK_WAIT_MS"] ?? FENCE_ACK_WAIT_MS);
+      while (problem !== undefined && Date.now() < deadline) {
+        await apply.drain.sleep(FENCE_ACK_POLL_MS);
+        ack = apply.drain.admissionAck?.(scope.pauseKey);
+        problem = fenceAckProblem(ack, begun);
       }
     }
-    if (!acknowledged) {
+    if (problem !== undefined) {
       restorePause(priorPause, ownedFence);
       ui.notify(
-        "Setup stopped before writing anything: the running daemon has not acknowledged the setup admission " +
-          "fence, so quiescence cannot be proven. Nothing has been changed; stop the daemon, or re-run setup " +
-          "once it has acknowledged the fence.",
+        `Setup stopped before writing anything: ${problem} — quiescence cannot be proven. ` +
+          "Nothing has been changed; stop the daemon, or re-run setup once it has acknowledged the fence.",
         "error",
       );
       return false;
@@ -3528,7 +3717,7 @@ export async function setup(
         "info",
       );
       try {
-        armLine = await apply.arm(plan.project.name);
+        armLine = await apply.arm(plan.project.name, (line) => ui.notify(line, "info"));
       } catch (err) {
         ui.notify(
           [
@@ -3641,6 +3830,18 @@ export async function setup(
       `Heartbeat: ${armLine}.`,
       "",
       "Use the documented toy-issue drill to prove one complete worker path.",
+      "",
+      // The one grooming recommendation setup makes, and it is only a sentence
+      // (#827). Deliberately inert: nothing above or below this line installs,
+      // probes, version-checks or refuses on it, because a conductor guarantee
+      // must never depend on prose that releases on somebody else's cadence
+      // (#506's judgement). Printed only here, on the committed success path,
+      // so a failed or cancelled apply can never imply setup finished.
+      "Optional: the spec-out skills pack at github.com/mattpocock/skills (`npx skills`) adds a",
+      "grooming workflow this fleet has no opinion about — `to-spec` / `to-tickets` for turning a",
+      "rough idea into sized slices, and `grill-me` for the questions worth asking before work",
+      "starts. Nothing was installed or checked just now, and conductor is fully functional",
+      "without it: skip it freely.",
     ].join("\n"),
     "info",
   );

package/src/setup.ts

@@ -50,7 +50,7 @@ import {
   stateDir,
 } from "./config.ts";
 import { graphProjectPath, graphRepos } from "./graph.ts";
-import { ompSettingsOverlay } from "./omp-settings.ts";
+import { modelRolesIn, ompSettingsOverlay } from "./omp-settings.ts";
 import {
   CONFIG_VERSION,
   DEFAULT_ARM_PROOF,
@@ -174,6 +174,12 @@ export interface SetupAnswers {
    */
   modelFallbacks?: string[];
   modelFallbackThreshold?: number;
+  /**
+   * The one stronger tier a spinning cap retries on (#807). Hand-edited like
+   * {@link modelFallbacks}, so it exists here only to survive an amend of some
+   * other area (#369).
+   */
+  workerEscalationModel?: string;
   /**
    * The project's omp settings overlay (#537): an opaque map layered into
    * every worker session via the fleet-owned settings channel. The wizard asks
@@ -241,6 +247,15 @@ export interface SetupAnswers {
    * stale-base interlock from a project that relies on it (#428).
    */
   criticalBase?: ProjectConfig["criticalBase"];
+  /**
+   * Hand-edited providers that must bill to a subscription credential, carried
+   * through setup unchanged like {@link criticalBase} (#852). The wizard never
+   * invents one — which providers a fleet pays for by subscription is the
+   * operator's billing arrangement, not something repo reading can answer — and
+   * dropping it during an unrelated amend would silently remove the fence that
+   * stops a disabled OAuth grant billing to an API key.
+   */
+  requireOauthProviders?: ProjectConfig["requireOauthProviders"];
   /**
    * Whether to render `ORCHESTRATOR.md` into the project's workspace root. Not
    * part of the config — the brief is the operator's file, and the conductor
@@ -1001,6 +1016,12 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // would pin every run of the project onto a dead provider again (#286).
     ...(a.modelFallbacks === undefined ? {} : { modelFallbacks: [...a.modelFallbacks] }),
     ...(a.modelFallbackThreshold === undefined ? {} : { modelFallbackThreshold: a.modelFallbackThreshold }),
+    // Hand-edited like the failover chain, and the same reason to keep it: an
+    // unrelated amend that dropped it would silently take the fleet's only
+    // spinning-cap recovery away (#807).
+    ...(a.workerEscalationModel === undefined
+      ? {}
+      : { workerEscalationModel: a.workerEscalationModel }),
     // The omp settings overlay is an opaque map the wizard collects as free-form
     // YAML; an unrelated amend must not delete it (#537).
     ...(a.ompSettings === undefined ? {} : { ompSettings: a.ompSettings }),
@@ -1026,6 +1047,9 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // Hand-edited safety markers carried unchanged on an unrelated amend
     // (#428): dropping them would silently disarm the stale-base interlock.
     ...(a.criticalBase === undefined ? {} : { criticalBase: [...a.criticalBase] }),
+    ...(a.requireOauthProviders === undefined
+      ? {}
+      : { requireOauthProviders: [...a.requireOauthProviders] }),
     // Written out even when it is the default, so an operator amending the
     // volume has a line in the file to point at. Opting into availability makes
     // the schedule explicit and daily; omitting it preserves the preset's
@@ -1232,6 +1256,7 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
   if (p.groomBelow !== undefined) answers.groomBelow = p.groomBelow;
   if (p.modelFallbacks !== undefined) answers.modelFallbacks = [...p.modelFallbacks];
   if (p.modelFallbackThreshold !== undefined) answers.modelFallbackThreshold = p.modelFallbackThreshold;
+  if (p.workerEscalationModel !== undefined) answers.workerEscalationModel = p.workerEscalationModel;
   if (p.ompSettings !== undefined) answers.ompSettings = { ...p.ompSettings };
   if (p.escalation.telegramChatId !== undefined) answers.telegramChatId = p.escalation.telegramChatId;
   if (p.escalation.telegramTopicId !== undefined) answers.telegramTopicId = p.escalation.telegramTopicId;
@@ -1239,6 +1264,9 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     answers.recoveryMerges = p.recoveryMerges.map((entry) => ({ ...entry }));
   }
   if (p.criticalBase !== undefined) answers.criticalBase = [...p.criticalBase];
+  if (p.requireOauthProviders !== undefined) {
+    answers.requireOauthProviders = [...p.requireOauthProviders];
+  }
   if (p.reporting?.digest.at !== undefined) answers.dailyDigestAt = p.reporting.digest.at;
   if (p.reporting?.digest.timezone !== undefined) {
     answers.reportingTimezone = p.reporting.digest.timezone;
@@ -1575,6 +1603,53 @@ export function detectTelegram(): TelegramPresence {
   return result;
 }
 
+/**
+ * Env override for the daemon account's global omp settings file, exactly the
+ * seam `OMP_TELEGRAM_STATE_DIR` gives telegram discovery: a test (or a second
+ * fleet on the same machine) can redirect the read without touching a real
+ * `~/.omp/agent/config.yml`.
+ */
+export const OMP_GLOBAL_SETTINGS_ENV = "OMP_CONDUCTOR_OMP_SETTINGS_PATH";
+
+/**
+ * The model roles the daemon account's global omp settings actually configure
+ * — the keys of its `modelRoles` stanza (#875) — the "live OMP role
+ * configuration" an adjudicator answer must be checked against. OMP's own
+ * settings file (`~/.omp/agent/config.yml`) is the source rather than any
+ * conductor-owned registry: conductor stores only role names, so the only
+ * place an unrelated role could be invented is here, and reading this file is
+ * what keeps setup from offering (or accepting) a role OMP never configured.
+ *
+ * A missing file is no roles; an unreadable or malformed one is also no roles
+ * but is reported through `decoded: false` so the wizard can say why instead
+ * of silently offering the default alone.
+ */
+export function readConfiguredOmpRoles(): ConfiguredOmpRoles {
+  const override = process.env[OMP_GLOBAL_SETTINGS_ENV]?.trim();
+  const path = override && override.length > 0 ? override : join(homedir(), ".omp", "agent", "config.yml");
+  if (!existsSync(path)) return { path, global: [], decoded: true };
+  try {
+    const parsed = parseYaml(readFileSync(path, "utf8"));
+    return {
+      path,
+      global: [...new Set(modelRolesIn(parsed))].sort(),
+      decoded: true,
+    };
+  } catch {
+    return { path, global: [], decoded: false };
+  }
+}
+
+/** The global omp settings read (`readConfiguredOmpRoles`) reports. */
+export interface ConfiguredOmpRoles {
+  /** The path read (the override, or the default under the operator's home). */
+  readonly path: string;
+  /** The model-role names the file's `modelRoles` stanza declares. */
+  readonly global: readonly string[];
+  /** False when the file exists but could not be read or parsed. */
+  readonly decoded: boolean;
+}
+
 /** True when `.env` carries a non-empty `TELEGRAM_BOT_TOKEN`. The value is
  *  compared against emptiness and then dropped on the floor. */
 function hasTelegramToken(envPath: string): boolean {
@@ -1729,6 +1804,11 @@ export function summarisePlan(
   if (a.workerModel !== undefined && a.workerModel.trim().length > 0) {
     lines.push(`  ${"worker model".padEnd(CAPS_PLAN_KEY_PAD)}${a.workerModel.trim()}  (answered)`);
   }
+  if (a.workerEscalationModel !== undefined && a.workerEscalationModel.trim().length > 0) {
+    lines.push(
+      `  ${"cap escalation".padEnd(CAPS_PLAN_KEY_PAD)}${a.workerEscalationModel.trim()}  (hand-edited)`,
+    );
+  }
 
   lines.push("", "escalation");
   if (a.telegramChatId !== undefined && a.telegramChatId.trim().length > 0) {
@@ -1796,6 +1876,7 @@ export function summarisePlan(
 
   lines.push("", "review", `  strictness     ${a.review.strictness} — ${REVIEW_STRICTNESS_CHOICES[a.review.strictness]}`);
   lines.push(`  max rounds/PR  ${a.review.maxRounds} — at the ceiling the PR is left open, the findings recorded, and it is escalated once`);
+  lines.push(`  adjudicator    ${a.review.adjudicator} — the OMP model role that runs that ceiling adjudication`);
 
   const reporting = project.reporting as ReportingPolicy;
   const briefPath = orchestratorBriefPath(a);
@@ -2013,18 +2094,20 @@ export const AMEND_AREAS: {
   },
   policy: {
     name: "merge & release preconditions",
-    asks: "the checks, base freshness, draft rule and behind-base action for a merge, then what a release requires and what it ships — and how green PRs are reviewed, and how many rounds a PR may be returned",
+    asks: "the checks, base freshness, draft rule and behind-base action for a merge, then what a release requires and what it ships — and how green PRs are reviewed, how many rounds a PR may be returned, and which OMP model role adjudicates a PR at that ceiling",
     describe: (p) => {
       const policy = resolvePolicy(p);
       const review = resolveReview(p);
       // Counted rather than listed: this row is elided at 96 characters, and the
-      // full table is in the plan summary the consent screen shows next.
+      // full table is in the plan summary the consent screen shows next. The
+      // adjudicator is the third review decision, so it is named with the other
+      // two (#875).
       return (
         `merge: ${policy.merge.requiredChecks.length === 0 ? "every check" : `${policy.merge.requiredChecks.length} check(s)`}, ` +
         `base ${policy.merge.baseFreshness}, drafts ${policy.merge.drafts}, behind → ${policy.merge.whenBehindBase}; ` +
         `release: ${policy.release.requires.length} must-land, ${policy.release.artefacts.length} artefact(s), ` +
         `${policy.release.environments.length} env(s); ` +
-        `review ${review.strictness} ×${review.maxRounds}`
+        `review ${review.strictness} ×${review.maxRounds} (adjudicator ${review.adjudicator})`
       );
     },
   },