omp-conductor 0.18.2 → 0.19.0

package/src/commands/release-composition.ts

@@ -0,0 +1,232 @@
+/**
+ * `release-composition` — the operator's explicit lifecycle for a project's
+ * active release (#850).
+ *
+ * A reliability patch is only trustworthy while nothing unrelated slips into
+ * it, so a project can declare one active release composition: a campaign
+ * identifier plus the exact PRs allowed into it. While one is active,
+ * `conductor_pr_merge` refuses every other PR with the
+ * `outside-active-release` refusal — this command family is the only way to
+ * move that guard: `declare` it, admit exactly one extra PR with `override`,
+ * or retire it with `complete` / `cancel`. Every transition is written to the
+ * store as durable state that survives daemon restarts and recorded as an
+ * immutable material event as its audit trail; a merge call's free-form
+ * reason is never an override.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { dbPath, openStore } from "../store.ts";
+
+/** Every `--pr URL` / `--pr=URL` value in the invocation tail, in order. */
+function prUrls(argv: readonly string[]): string[] {
+  const urls: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i]!;
+    if (token === "--pr") {
+      const value = argv[i + 1];
+      if (value !== undefined && !value.startsWith("-")) {
+        urls.push(value);
+        i++;
+      }
+    } else if (token.startsWith("--pr=")) {
+      urls.push(token.slice("--pr=".length));
+    }
+  }
+  return urls;
+}
+
+/** A full pull-request URL — the exact shape the merge gate compares against. */
+function isFullPrUrl(url: string): boolean {
+  return /^https:\/\/[^/]+\/.+\/pull\/\d+$/.test(url);
+}
+
+const USAGE_LINE =
+  "omp-conductor: release-composition needs a subcommand: " +
+  "declare | override | complete | cancel | status\n";
+
+export async function releaseCompositionCommand(ctx: CommandContext): Promise<void> {
+  const sub = ctx.argv[1];
+  if (sub === undefined || sub.length === 0 || sub.startsWith("-")) {
+    process.stderr.write(USAGE_LINE);
+    process.exit(2);
+  }
+
+  // Argument shape is validated before anything opens: a malformed invocation
+  // never touches the store, and every store-backed refusal below still runs
+  // the `close()` in the finally before the process exits.
+  let campaign: string | undefined;
+  let urls: string[] = [];
+  if (sub === "declare") {
+    campaign = ctx.flag("campaign");
+    if (campaign === undefined || campaign.length === 0) {
+      process.stderr.write(
+        "omp-conductor: release-composition declare needs --campaign ID, e.g. v0.18.1-reliability\n",
+      );
+      process.exit(2);
+    }
+    urls = prUrls(ctx.argv.slice(2));
+    const malformed = urls.filter((url) => !isFullPrUrl(url));
+    if (malformed.length > 0) {
+      process.stderr.write(
+        "omp-conductor: --pr takes full pull-request URLs like https://github.com/owner/repo/pull/7; " +
+          `refusing: ${malformed.join(", ")}\n`,
+      );
+      process.exit(2);
+    }
+  }
+  if (sub === "override") {
+    urls = prUrls(ctx.argv.slice(2));
+    if (urls.length !== 1 || !isFullPrUrl(urls[0]!)) {
+      process.stderr.write(
+        "omp-conductor: release-composition override needs exactly one full --pr URL " +
+          "(https://github.com/owner/repo/pull/N)\n",
+      );
+      process.exit(2);
+    }
+  }
+
+  const cfg = loadConfig();
+  const project = findProject(cfg, ctx.projectFlag);
+  const store = openStore(dbPath());
+  let failed = false;
+  try {
+    const now = Date.now();
+    switch (sub) {
+      case "status": {
+        const active = store.activeReleaseComposition(project.name);
+        if (active === undefined) {
+          process.stdout.write(
+            `${project.name}: no active release composition — merges are ungated by release scope.\n`,
+          );
+          break;
+        }
+        const overrides = store.releaseCompositionOverrides(project.name, active.campaign);
+        process.stdout.write(
+          `${project.name}: active release "${active.campaign}", declared ` +
+            `${new Date(active.declaredAt).toISOString()}${active.declaredBy ? ` by ${active.declaredBy}` : ""}. ` +
+            `Allowed PRs (${active.allowedPrUrls.length}): ` +
+            `${active.allowedPrUrls.length === 0 ? "none yet" : active.allowedPrUrls.join(", ")}. ` +
+            `Operator overrides: ${overrides.length === 0 ? "none" : overrides.map((o) => o.prUrl).join(", ")}. ` +
+            "conductor_pr_merge refuses every other PR until complete|cancel.\n",
+        );
+        break;
+      }
+      case "declare": {
+        const conflict = store.declareReleaseComposition(project.name, {
+          campaign: campaign!,
+          allowedPrUrls: urls,
+          declaredBy: "operator",
+          declaredAt: now,
+        });
+        if (conflict !== undefined) {
+          process.stderr.write(
+            `release-composition: ${project.name} already has an active release "${conflict.campaign}" ` +
+              `(declared ${new Date(conflict.declaredAt).toISOString()}, ${conflict.allowedPrUrls.length} PR(s) allowed). ` +
+              "One release at a time: complete or cancel it first with " +
+              "`omp-conductor release-composition complete|cancel`.\n",
+          );
+          failed = true;
+          break;
+        }
+        store.recordMaterialEvent({
+          project: project.name,
+          category: "release-composition",
+          summary: `operator declared release ${campaign} (${urls.length} PR(s) allowed)`,
+          evidence:
+            `An operator declared the active release composition "${campaign}" for ${project.name} with ` +
+            `${urls.length} allowed PR(s): ${urls.length === 0 ? "none yet" : urls.join(", ")}. While it is ` +
+            "active, conductor_pr_merge refuses every other PR with outside-active-release until the " +
+            "release completes, is cancelled, or a PR is explicitly overridden.",
+          occurredAt: now,
+          recordedAt: now,
+        });
+        process.stdout.write(
+          `release-composition: ${project.name} now assembling release "${campaign}" with ` +
+            `${urls.length} allowed PR(s). Unrelated merges are refused until complete|cancel.\n`,
+        );
+        break;
+      }
+      case "override": {
+        const active = store.activeReleaseComposition(project.name);
+        if (active === undefined) {
+          process.stderr.write(
+            `release-composition: ${project.name} has no active release to override — ` +
+              "merges are already ungated by release scope.\n",
+          );
+          failed = true;
+          break;
+        }
+        const reason = ctx.flag("reason") ?? "operator-override";
+        const granted = store.grantReleaseCompositionOverride(project.name, {
+          campaign: active.campaign,
+          prUrl: urls[0]!,
+          by: "operator",
+          reason,
+          at: now,
+        });
+        store.recordMaterialEvent({
+          project: project.name,
+          category: "release-composition",
+          summary: `operator overrode release ${active.campaign} for ${granted.prUrl}`,
+          evidence:
+            `An operator admitted ${granted.prUrl} into the active release "${active.campaign}" of ` +
+            `${project.name} with reason "${reason}". The override bypasses only the composition check — ` +
+            "authority, pause, base-red-freeze, exact-head, green-checks and single-flight still apply.",
+          occurredAt: now,
+          recordedAt: now,
+        });
+        process.stdout.write(
+          `release-composition: ${granted.prUrl} is now allowed into release "${active.campaign}" ` +
+            `in ${project.name} (reason: ${reason}). Every other merge gate still applies.\n`,
+        );
+        break;
+      }
+      case "complete":
+      case "cancel": {
+        const retired =
+          sub === "complete"
+            ? store.completeReleaseComposition(
+                project.name,
+                "operator",
+                ctx.flag("reason") ?? "operator-completed",
+                now,
+              )
+            : store.cancelReleaseComposition(
+                project.name,
+                "operator",
+                ctx.flag("reason") ?? "operator-cancelled",
+                now,
+              );
+        if (!retired) {
+          process.stdout.write(
+            `${project.name}: no active release composition — nothing to ${sub}. Merges are ungated by release scope.\n`,
+          );
+          break;
+        }
+        store.recordMaterialEvent({
+          project: project.name,
+          category: "release-composition",
+          summary: `operator ${sub === "complete" ? "completed" : "cancelled"} the active release`,
+          evidence:
+            `An operator ${sub}d the active release composition of ${project.name} with reason ` +
+            `"${ctx.flag("reason") ?? `operator-${sub}d`}". conductor_pr_merge merges are no longer ` +
+            "restricted by that release's scope; the audit trail keeps the closed row and its overrides.",
+          occurredAt: now,
+          recordedAt: now,
+        });
+        process.stdout.write(
+          `release-composition: ${project.name}'s active release ${sub}d. Merges are no longer gated ` +
+            "by release scope; overrides stay in the audit trail scoped to their campaign.\n",
+        );
+        break;
+      }
+      default:
+        process.stderr.write(USAGE_LINE);
+        process.exit(2);
+    }
+  } finally {
+    store.close();
+  }
+  if (failed) process.exit(2);
+}

package/src/commands/resume.ts

@@ -13,32 +13,7 @@
 
 import type { CommandContext } from "./context.ts";
 import { armState, clearPaneHaltIfResolvable, releaseHold } from "../fleet.ts";
-import { livingDaemon } from "../lifecycle.ts";
-
-/** Wakes a running daemon, returning the human line that states what happened.
- *  State-only clients (no live daemon) get an honest fallback rather than an
- *  error: the hold is already cleared and the next pass or daemon start
- *  claims without this poke. */
-async function wakeDaemon(projectName: string): Promise<string> {
-  const daemon = livingDaemon();
-  if (daemon === undefined) {
-    return "daemon not running — claiming starts when the daemon next starts or ticks";
-  }
-  let response: Response;
-  try {
-    response = await fetch(`http://127.0.0.1:${daemon.port}/wake`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ project: projectName }),
-    });
-  } catch {
-    return "daemon wake failed — daemon unreachable; the next scheduled pass will claim";
-  }
-  if (!response.ok) {
-    return `daemon wake failed (HTTP ${response.status}); the next scheduled pass will claim`;
-  }
-  return "daemon dispatch loop woken — claiming starts on an immediate pass";
-}
+import { wakeDispatch } from "../wake.ts";
 
 export async function resumeCommand(ctx: CommandContext): Promise<void> {
 for (const project of ctx.targetProjects()) {
@@ -46,7 +21,7 @@ for (const project of ctx.targetProjects()) {
   const pin = clearPaneHaltIfResolvable(project.name);
   const arm = armState(project.name);
   process.stdout.write(
-    `resumed — claiming allowed — ${await wakeDaemon(project.name)}\n` +
+    `resumed — claiming allowed — ${await wakeDispatch(project.name)}\n` +
       (pin.wasHalted
         ? `pane recovery pin cleared — ${pin.path}\n`
         : "no pane recovery pin to clear\n") +

package/src/commands/setup.ts

@@ -6,13 +6,13 @@
  * changed from the original bodies.
  */
 
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, join } from "node:path";
 
 import type { CommandContext } from "./context.ts";
 import type { CompletionShell } from "./complete.ts";
-import { findProject, loadConfig, resolveCaps } from "../config.ts";
+import { configPath, findProject, loadConfig, resolveCaps, stateDir } from "../config.ts";
 import { AMEND_AREA_IDS, type AmendAreaId } from "../setup.ts";
 import { runGraphInstall, runHostInstall, type InstallOutcome } from "../setup-install.ts";
 import { DEFAULT_PROBES, NO_PROBES, setup } from "../setup-wizard.ts";
@@ -21,8 +21,11 @@ import {
   answersUi,
   guardNonInteractiveUi,
   loadAnswersFile,
+  readSetupResume,
   recordingAnswersUi,
   saveAnswersFile,
+  saveSetupResume,
+  setupConfigHash,
   type RecordedAnswersUi,
 } from "../setup-answers.ts";
 import { terminalUi, type WizardUi } from "../wizard-ui.ts";
@@ -39,7 +42,7 @@ const SETUP_USAGE = `omp-conductor setup — interview, then write config.json,
 and the staged host files behind one confirm.
 
 usage:
-  omp-conductor setup [area] [--no-ai] [--answers FILE] [--save-answers FILE] [--project NAME]
+  omp-conductor setup [area] [--no-ai] [--answers FILE] [--save-answers FILE] [--resume FILE] [--project NAME]
   omp-conductor setup host [NAME] [--project NAME]
   omp-conductor setup graph [--no-seed] [--print] [--project NAME]
 
@@ -57,7 +60,9 @@ flags:
                        for \`setup host\`)
   --no-ai              ask every question, propose nothing (no AI repo reads)
   --answers FILE       answer every prompt from JSON; never opens a prompt
-  --save-answers FILE  save successful prompt answers as replayable JSON`;
+  --save-answers FILE  save successful prompt answers as replayable JSON
+  --resume FILE        replay the answers a failed apply kept, bound to the
+                       config they were given against; refuses a changed config`;
 
 /**
  * Resolve the project an install subcommand (`setup host`, `setup graph`)
@@ -126,7 +131,37 @@ async function offerCompletionInstall(ui: WizardUi): Promise<void> {
   ui.notify(`Installed completions at ${installed.scriptPath}; sourced from ${installed.rcPath}.`);
 }
 
-function setupValueFlag(argv: readonly string[], name: "--answers" | "--save-answers"): string | undefined {
+/** This build's version — the schema fence a resume file is checked against. */
+const PACKAGE_VERSION: string = ((): string => {
+  try {
+    const raw: unknown = JSON.parse(readFileSync(join(import.meta.dir, "..", "..", "package.json"), "utf8"));
+    const version = raw !== null && typeof raw === "object" ? Reflect.get(raw, "version") : undefined;
+    return typeof version === "string" && version.length > 0 ? version : "unknown";
+  } catch {
+    return "unknown";
+  }
+})();
+
+/** The live config generation a resume file must match, or `absent`. */
+function liveSetupConfigHash(): string {
+  return setupConfigHash(() => {
+    try {
+      return readFileSync(configPath(), "utf8");
+    } catch {
+      return undefined;
+    }
+  });
+}
+
+/**
+ * Where a failed post-interview apply leaves its answers (#864), per project so
+ * two fleets on one host cannot resume each other's interview.
+ */
+export function setupResumePath(project: string | undefined): string {
+  return join(stateDir(), `setup-resume-${project ?? "host"}.json`);
+}
+
+function setupValueFlag(argv: readonly string[], name: "--answers" | "--save-answers" | "--resume"): string | undefined {
   const inline = argv.find((arg) => arg.startsWith(`${name}=`));
   const at = argv.indexOf(name);
   if (inline !== undefined && at !== -1) throw new Error(`${name} may be passed only once`);
@@ -154,18 +189,42 @@ const positional = sub !== undefined && !sub.startsWith("--") ? sub : undefined;
 // protocol, while --answers installs a prompt-free driver.
 const answersPath = setupValueFlag(ctx.argv, "--answers");
 const saveAnswersPath = setupValueFlag(ctx.argv, "--save-answers");
-const useClack = answersPath === undefined && interactiveUi();
-const baseUi = answersPath
-  ? answersUi(loadAnswersFile(answersPath))
-  : useClack
-    ? (await import("../clack-ui.ts")).clackUi()
-    : terminalUi();
-const guardedUi = answersPath === undefined && !process.stdin.isTTY ? guardNonInteractiveUi(baseUi) : baseUi;
-const recording: RecordedAnswersUi | undefined =
-  saveAnswersPath === undefined ? undefined : recordingAnswersUi(guardedUi);
-const ui = recording?.ui ?? guardedUi;
+// `--resume` is `--answers` bound to the config it was answered against (#864):
+// the apply phase failed, the interview did not, and re-typing it is the cost
+// this flag removes. The binding is checked before a single prompt is skipped,
+// because replaying answers over a config that changed since is how an old plan
+// silently overwrites newer policy.
+const resumePath = setupValueFlag(ctx.argv, "--resume");
+const resumed =
+  resumePath === undefined
+    ? undefined
+    : readSetupResume(resumePath, liveSetupConfigHash(), PACKAGE_VERSION);
+if (resumed !== undefined && !resumed.ok) {
+  process.stderr.write(`omp-conductor: setup: ${resumed.problem}\n`);
+  process.exitCode = 2;
+  return;
+}
+const scriptedAnswers = resumed?.ok === true ? resumed.file.answers : undefined;
+const useClack = answersPath === undefined && scriptedAnswers === undefined && interactiveUi();
+const baseUi = scriptedAnswers
+  ? answersUi(scriptedAnswers)
+  : answersPath
+    ? answersUi(loadAnswersFile(answersPath))
+    : useClack
+      ? (await import("../clack-ui.ts")).clackUi()
+      : terminalUi();
+const guardedUi =
+  answersPath === undefined && scriptedAnswers === undefined && !process.stdin.isTTY
+    ? guardNonInteractiveUi(baseUi)
+    : baseUi;
+// Always recording now, not only under `--save-answers`: the answers of a failed
+// apply are exactly what the retry needs, and a flag nobody passed in advance
+// cannot help the failure that has already happened.
+const recording: RecordedAnswersUi = recordingAnswersUi(guardedUi);
+const ui = recording.ui;
 let saveCompletedAnswers = false;
 let closeMessage = "Setup failed.";
+let applyFailed = false;
 try {
   // `host` and `graph` are install subcommands, checked BEFORE the amend
   // areas. They are not areas — routing them through the area validation
@@ -244,12 +303,38 @@ try {
   }
   saveCompletedAnswers = completed;
   closeMessage = completed ? "Setup complete." : "Setup incomplete.";
+} catch (err) {
+  // The interview succeeded and the apply phase did not — the shape of the
+  // 2026-08-21 incident, where five retries re-asked every question while the
+  // real fault was a runtime gate. Keep the answers, bound to the config they
+  // were given against, and name the exact command that replays them.
+  applyFailed = true;
+  throw err;
 } finally {
   try {
-    if (saveCompletedAnswers && saveAnswersPath !== undefined && recording !== undefined) {
+    if (applyFailed && Object.keys(recording.answers).length > 0) {
+      const path = setupResumePath(ctx.projectFlag);
+      saveSetupResume(path, {
+        configHash: liveSetupConfigHash(),
+        version: PACKAGE_VERSION,
+        ...(positional === undefined ? {} : { area: positional }),
+        ...(ctx.projectFlag === undefined ? {} : { project: ctx.projectFlag }),
+        answers: recording.answers,
+      });
+      ui.notify(
+        `Answers kept — retry without re-answering:\n  omp-conductor setup${
+          positional === undefined ? "" : ` ${positional}`
+        }${ctx.projectFlag === undefined ? "" : ` --project ${ctx.projectFlag}`} --resume ${path}`,
+        "warning",
+      );
+    }
+    if (saveCompletedAnswers && saveAnswersPath !== undefined) {
       saveAnswersFile(saveAnswersPath, recording.answers);
       ui.notify(`Saved setup answers to ${saveAnswersPath}.`);
     }
+    // A completed setup retires its own resume file: a stale one invites a
+    // replay of answers that have already been applied.
+    if (saveCompletedAnswers) rmSync(setupResumePath(ctx.projectFlag), { force: true });
   } catch (err) {
     closeMessage = "Setup failed.";
     throw err;

package/src/commands/stats.ts

@@ -12,7 +12,7 @@
 import type { CommandContext } from "./context.ts";
 import { findProject, loadConfig } from "../config.ts";
 import { dbPath, openStore, utcDay } from "../store.ts";
-import { computeStats, renderStatsHuman, type StatsWindow } from "../stats.ts";
+import { type StatsWindow, computeStats, parseStatsWindow, renderStatsHuman } from "../stats.ts";
 import { heading } from "../ui/style.ts";
 
 const DAY_MS = 24 * 60 * 60 * 1_000;
@@ -48,30 +48,6 @@ flags:
 When nothing settled in the window the report says so explicitly ("empty:
 true" in --json) rather than printing zeros that could read as measurements.`;
 
-/** `--since` to a window. The bare date form means from 00:00:00Z of that day;
- *  the duration form (`7d`) is now minus whole days. Anything else exits 2,
- *  because silently defaulting a typo'd window would measure the wrong week. */
-function sinceWindow(raw: string, now: number): Pick<StatsWindow, "sinceDay" | "sinceEpochMs"> {
-  const duration = DURATION_FORM.exec(raw);
-  if (duration !== null) {
-    const days = Number(duration[1]);
-    if (days >= 1) {
-      const sinceEpochMs = now - days * DAY_MS;
-      return { sinceEpochMs, sinceDay: utcDay(sinceEpochMs) };
-    }
-  }
-  if (DATE_FORM.test(raw)) {
-    const sinceEpochMs = Date.parse(`${raw}T00:00:00Z`);
-    if (Number.isFinite(sinceEpochMs)) {
-      return { sinceEpochMs, sinceDay: raw };
-    }
-  }
-  process.stderr.write(
-    `omp-conductor: stats --since needs 7d, 30d or YYYY-MM-DD, got "${raw}"\n`,
-  );
-  process.exit(2);
-}
-
 export async function statsCommand(ctx: CommandContext): Promise<void> {
   // Help first: parsing stops before any config read or store open.
   if (ctx.argv[1] === "--help" || ctx.argv[1] === "-h") {
@@ -108,11 +84,16 @@ export async function statsCommand(ctx: CommandContext): Promise<void> {
     process.stderr.write(`omp-conductor: stats --since needs 7d, 30d or YYYY-MM-DD\n`);
     process.exit(2);
   }
-  const window: StatsWindow = {
-    ...sinceWindow(rawSince ?? "7d", now),
-    untilEpochMs: now,
-    untilDay: utcDay(now),
-  };
+  // One parser for the CLI and the dashboard endpoint (#297): two would
+  // eventually disagree about what `30d` means, and the dashboard's numbers are
+  // required to equal these for the same window.
+  const window = parseStatsWindow(rawSince ?? "7d", now);
+  if (window === undefined) {
+    process.stderr.write(
+      `omp-conductor: stats --since needs 7d, 30d or YYYY-MM-DD, got "${rawSince ?? ""}"\n`,
+    );
+    process.exit(2);
+  }
   const store = openStore(dbPath());
   try {
     const report = computeStats({

package/src/commands/tail.ts

@@ -153,6 +153,21 @@ function styleTailLine(line: string): string {
   return line;
 }
 
+/** A poll delay that ends early when the follow is aborted. */
+function sleepUntilAbort(ms: number, signal?: AbortSignal): Promise<void> {
+  if (signal === undefined) return new Promise((resolve) => setTimeout(resolve, ms));
+  const abort = signal;
+  return new Promise((resolve) => {
+    const done = (): void => {
+      clearTimeout(timer);
+      abort.removeEventListener("abort", done);
+      resolve();
+    };
+    const timer = setTimeout(done, ms);
+    abort.addEventListener("abort", done, { once: true });
+  });
+}
+
 /**
  * Follow one run's transcripts the way `tail -f` follows a log: the worker's
  * own transcript plus any `__advisor*.jsonl` sitting beside it (the mid-run
@@ -181,6 +196,16 @@ export async function tailRun(
     quietMs?: number;
     /** Where rendered lines go; the CLI writes to stdout, tests capture. */
     write?: (line: string) => void;
+    /**
+     * Stops the follow before the run is terminal (#296).
+     *
+     * The CLI passes none: `tail` runs until the run ends or the operator hits
+     * Ctrl-C, and SIGINT's default is immediate exit. The dashboard's SSE stream
+     * passes the request's signal, because a browser that closed its tab must
+     * not leave a poll loop holding file descriptors until the run finishes —
+     * repeated opens would accumulate one follow each.
+     */
+    signal?: AbortSignal;
   } = {},
 ): Promise<void> {
   const store = deps.store ?? openStore(dbPath());
@@ -204,6 +229,9 @@ export async function tailRun(
       let lastChange = Date.now();
 
       for (;;) {
+        // Checked at the top as well as after the sleep: a signal that was
+        // already aborted must not buy one whole poll's worth of work.
+        if (deps.signal?.aborted === true) return;
         let changed = false;
         const primaryDelta = followLines(primary, path);
         changed = primaryDelta.changed || changed;
@@ -264,7 +292,9 @@ export async function tailRun(
           write(`run ended: ${state}`);
           return;
         }
-        await new Promise<void>((resolve) => setTimeout(resolve, pollMs));
+        // Wakes on the signal rather than after the full poll: a closed browser
+        // should release the descriptors now, not up to a second later.
+        await sleepUntilAbort(pollMs, deps.signal);
       }
     } finally {
       closeSync(primary.fd);

package/src/commands/upgrade.ts

@@ -10,14 +10,31 @@ import type { CommandContext } from "./context.ts";
 import { upgradeConductor } from "../upgrade.ts";
 
 export async function upgradeCommand(ctx: CommandContext): Promise<void> {
+// `--bootstrap SHA --source PATH` installs an exact source/build identity
+// instead of a published semver (#908): the path that exists because a
+// reliability release cannot be cut when the installed conductor is what is
+// broken. Both flags or neither — a sha with no source has nothing to run the
+// package's own checks against, and a source with no sha is not an identity.
+const sha = ctx.flag("bootstrap");
+const source = ctx.flag("source");
+if ((sha === undefined) !== (source === undefined)) {
+  process.stderr.write(
+    "upgrade: --bootstrap SHA and --source PATH go together — the sha is the identity, the source is " +
+      "the tree its checks run against\n",
+  );
+  process.exitCode = 1;
+  return;
+}
 const result = await upgradeConductor({
   version: ctx.flag("to"),
+  ...(sha === undefined || source === undefined ? {} : { bootstrap: { sha, source } }),
   project: ctx.projectFlag,
 });
+const spec = sha === undefined ? `omp-conductor@${result.version}` : `${result.version} @ ${result.gitHead.slice(0, 12)}`;
 process.stdout.write(
-  `${result.alreadyCurrent ? "already current" : "upgrade complete"}:\n` +
-    `  Bun-global CLI     omp-conductor@${result.version}\n` +
-    `  omp plugin         omp-conductor@${result.version}\n` +
+  `${result.alreadyCurrent ? "already current" : sha === undefined ? "upgrade complete" : "bootstrap complete"}:\n` +
+    `  Bun-global CLI     ${spec}\n` +
+    `  omp plugin         ${spec}\n` +
     `  Herdr plugin       herdr-conductor@${result.gitHead}\n` +
     `  orchestrator brief managed ORCHESTRATOR.md floor current; POLICY.md preserved\n` +
     `  dispatch           ${result.dispatch}${result.alreadyCurrent ? "" : " restored"}\n`,

package/src/commands/verb.ts

@@ -9,7 +9,7 @@
 import type { CommandContext } from "./context.ts";
 import { findProject, loadConfig } from "../config.ts";
 import { isPaused, pausedAt } from "../daemon.ts";
-import { readBaseChain } from "../gitops.ts";
+import { probeRunLane, readBaseChain } from "../gitops.ts";
 import { dbPath, openStore } from "../store.ts";
 import { makeTracker } from "../tracker/github.ts";
 import { VERB_NAMES } from "../types.ts";
@@ -70,6 +70,7 @@ try {
       log: (m) => process.stderr.write(`${m}\n`),
       now: () => Date.now(),
       chain: { readBaseChain },
+      lane: { probeRunLane },
     },
     channel,
     { verb: name, args },

package/src/config-schema.ts

@@ -125,6 +125,14 @@ const capsSchema = z
       .min(0)
       .nullable()
       .describe(`Rolling-day spend ceiling; null means no spend gate (default ${DEFAULT_CAPS.dailySpendUsd})`),
+    maxRunSpendUsd: z
+      .number()
+      .positive()
+      .nullable()
+      .describe(
+        "Ceiling on one run, reserved from the daily budget before it launches; " +
+          "null derives it from dailySpendUsd. Must not exceed dailySpendUsd",
+      ),
     planUsage: z.union([planUsageCap, z.null()]).describe(`Plan-allowance guard, or null for unmetered`),
     workerMaxTurns: z.number().min(0).describe(`Turn ceiling for one worker (default ${DEFAULT_CAPS.workerMaxTurns})`),
     workerMaxTurnsCeiling: z.number().min(0).describe(`Maximum turn budget assignable to one issue's next attempt`),
@@ -399,6 +407,17 @@ const projectSchema = z
     // usable, exactly like `workerModel`.
     modelFallbacks: z.unknown().optional(),
     modelFallbackThreshold: z.unknown().optional(),
+    // One stronger opaque omp selector the first spinning cap in a chain
+    // retries on (#807). Normalised (trimmed, blank dropped) by the loader
+    // like `workerModel`, and deliberately separate from `modelFallbacks`:
+    // that chain answers provider faults only.
+    workerEscalationModel: z.unknown().optional(),
+    // Providers that must bill to a subscription credential (#852). Normalised
+    // by the loader (trimmed, blanks and non-strings dropped) like
+    // `modelFallbacks`, so a malformed entry weakens the fence's *scope* rather
+    // than failing the whole config load — and an entry that survives is one the
+    // fence will actually enforce.
+    requireOauthProviders: z.unknown().optional(),
     // The fleet-owned omp settings overlay (#537): an opaque map omp's own
     // schema owns. Conductor validates YAML shape only — the loader keeps it
     // when it is a mapping and drops anything else, like `modelFallbacks`.