omp-conductor 0.19.5 → 0.19.7

package/src/types.ts

@@ -275,8 +275,8 @@ export const RELEASE_SHAPES = [
   "github-release",
   "deploy",
   /**
-   * Replace the running conductor itself: the Bun-global CLI, the omp plugin
-   * and the Herdr plugin, pinned to one published release and executed
+   * Replace the running conductor itself: the discovered CLI package, the omp
+   * plugin and the Herdr plugin, pinned to one published release and executed
    * detached. This is the "nobody patches the running conductor" boundary
    * moved deliberately, not worked around — a session that may cut a release
    * still cannot install one until an operator grants this shape too.
@@ -2354,7 +2354,7 @@ export type ReportKind = (typeof REPORT_KINDS)[number];
  * `failed` is the bounded retry budget running out, and is itself news: a
  * report nobody can deliver escalates as tier 2 in its own right.
  */
-export const REPORT_DELIVERY_STATES = ["pending", "sending", "delivered", "failed"] as const;
+export const REPORT_DELIVERY_STATES = ["pending", "sending", "delivered", "failed", "withdrawn"] as const;
 
 export type ReportDeliveryState = (typeof REPORT_DELIVERY_STATES)[number];
 
@@ -2411,6 +2411,9 @@ export interface ReportRecord {
   deliveredAt?: number;
   /** Bounded text of the last known failure, surfaced verbatim by `status`. */
   lastError?: string;
+  withdrawnAt?: number;
+  withdrawnBy?: string;
+  withdrawReason?: string;
 }
 
 /** What a caller hands over. The store owns identity, state and every timestamp. */
@@ -2431,6 +2434,22 @@ export interface ReportEnqueue {
   deduped: boolean;
 }
 
+export interface HandoffWithdrawal {
+  id: string;
+  project: string;
+  target: "report" | "notice";
+  actor: string;
+  reason: string;
+  at: number;
+  summary: string;
+  detail: string;
+}
+
+export type HandoffWithdrawalResult =
+  | { kind: "withdrawn"; withdrawal: HandoffWithdrawal }
+  | { kind: "not-found" }
+  | { kind: "refused"; target: "report" | "notice"; state: string };
+
 /** Maximum ledger rows of each kind placed in one digest prompt. Older rows
  * stay first, so a busy day drains deterministically over later digests. */
 export const DIGEST_BACKLOG_LIMIT = 20;
@@ -3076,6 +3095,16 @@ export interface Store {
     categories?: readonly InterruptCategory[],
     urgent?: boolean,
   ): HeldNotice[];
+  /** Withdraw one unsent report or unassigned held notice, preserving an audit row. */
+  withdrawHandoff(
+    id: string,
+    project: string,
+    actor: string,
+    reason: string,
+    at: number,
+  ): HandoffWithdrawalResult;
+  /** Recent successful withdrawals, newest first, for status/audit. */
+  handoffWithdrawals(project: string, limit?: number): HandoffWithdrawal[];
   /** Record the install identities this host carried on this pass (#919).
    *  One row, replaced: the question is "what is installed now", and a history
    *  of installs is what the upgrade journal already keeps. */
@@ -3158,6 +3187,13 @@ export interface Store {
   /** Close the open incident and hand back what it accumulated, for the
    *  recovery page's downtime and diverted count. `undefined` when none. */
   closeOrchestratorIncident(project: string, at: number): OrchestratorIncident | undefined;
+  /** The workspace ids conductor recorded as its own worker surface for a
+   *  project, oldest first (#1035 review). Durable across daemon AND Herdr
+   *  restarts: Herdr restores workspaces without their metadata tokens, so
+   *  this record is the discovery leg that survives. */
+  workerWorkspaceIds(project: string): string[];
+  rememberWorkerWorkspace(project: string, workspaceId: string): void;
+  forgetWorkerWorkspace(project: string, workspaceId: string): void;
   /** Append one daemon stop/restart provenance line (#378). Host-wide — never
    *  partitioned by project, so any project's status reads the same records. */
   recordDaemonStop(draft: DaemonStopDraft): DaemonStop;
@@ -3811,6 +3847,18 @@ export const VERB_REFUSALS = [
    *  verb refuses with an actionable syntax error instead of echoing a
    *  fail-open the heading contradicts. */
   "file-lane-unparseable",
+  /**
+   * Adding the queue label was refused because the issue carries a durable
+   * `promotable` grooming verdict whose dispatch brief no longer provably
+   * matches the issue (#1036): the current write lane differs from the
+   * verdict's `fileLane`, the evidence does not recover as a strict
+   * PROMOTABLE result, or the issue could not be read to compare at all. The
+   * durable verdict is the admission contract, so promotion fails closed
+   * before any tracker mutation or daemon wake; the remediation is applying
+   * the verdict's `proposedBrief` to the issue explicitly, never a silent
+   * rewrite, and then adding the label again.
+   */
+  "promotion-brief-mismatch",
   /** The release grant does not permit this shape for this caller. */
   "release-not-granted",
   /** The artefact or environment is not one this project declared (#129). */

package/src/upgrade-journal.ts

@@ -22,6 +22,7 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { stateDir } from "./config.ts";
+import type { ResolvedGrants } from "./types.ts";
 
 /**
  * Where the fleet's upgrade journal lives: one JSONL file per host, because
@@ -80,15 +81,37 @@ export interface UpgradeJournalEntry {
   initial?: JournalFleetState;
   /** The projects the install covers, in the form the upgrade engine uses. */
   selectors?: readonly (string | null)[];
+  /** Host-global install authority resolved before the detached unit started. */
+  installHolder?: ResolvedGrants["install"];
+  /** Every configured project affected by the host-global install, report-only. */
+  installProjects?: readonly string[];
   /** Verification evidence when the post-restart tick closes the transaction. */
   checks?: readonly UpgradeCheck[];
 }
 
+/** Paths and roots discovered before the first install mutation (#1019). */
+export interface InstallSnapshotManagement {
+  cli: {
+    executable: string;
+    target: string;
+    root: string;
+  };
+  omp: {
+    root: string;
+    lock: string;
+  };
+  herdr: {
+    root?: string;
+    installRoot: string;
+  };
+}
+
 /** The installed identities a rollback must restore, verbatim. */
 export interface InstallSnapshotSurfaces {
   cliVersion: string;
   ompVersion?: string;
   herdrSource?: string;
+  management?: InstallSnapshotManagement;
 }
 
 export function upgradeJournalPath(root = stateDir()): string {
@@ -167,7 +190,12 @@ export type UnitSpawnResult = { code: number; stdout: string; stderr: string };
 export type UnitSpawnFn = (argv: readonly string[]) => Promise<UnitSpawnResult>;
 
 export type UnitCommand =
-  | { kind: "install"; version: string }
+  | {
+      kind: "install";
+      version: string;
+      holder?: ResolvedGrants["install"];
+      projects?: readonly string[];
+    }
   | { kind: "rollback"; version: string };
 
 export interface LaunchedUnit {
@@ -199,6 +227,12 @@ export async function launchTransientUnit(
   const setenv = [`PATH=${executorPath(env)}`, `OMP_CONDUCTOR_UNIT=${unit}`];
   const session = env["HERDR_SESSION"];
   if (session !== undefined && session.length > 0) setenv.push(`HERDR_SESSION=${session}`);
+  if (command.kind === "install" && command.holder !== undefined) {
+    setenv.push(`OMP_CONDUCTOR_INSTALL_HOLDER=${command.holder}`);
+  }
+  if (command.kind === "install" && command.projects !== undefined) {
+    setenv.push(`OMP_CONDUCTOR_INSTALL_PROJECTS=${command.projects.join(",")}`);
+  }
   const argv = [
     "systemd-run",
     `--unit=${unit}`,

package/src/upgrade-verify.ts

@@ -203,6 +203,8 @@ export interface PendingUpgradeRequest {
   initialPaused?: boolean;
   pauseKey?: string;
   selectors: readonly (string | undefined)[];
+  installHolder?: UpgradeJournalEntry["installHolder"];
+  installProjects?: readonly string[];
   initial?: UpgradeJournalEntry["initial"];
   configBackup?: string;
   previous?: JournalSurfaces;
@@ -241,15 +243,29 @@ export function pendingUpgradeRequest(
     gitHead: request.gitHead,
     initialPaused: snapshot?.initialPaused,
     pauseKey: snapshot?.pauseKey,
-    selectors: (snapshot?.selectors ?? []).map((selector) => selector ?? undefined),
+    selectors: (snapshot?.selectors ?? request.selectors ?? []).map((selector) => selector ?? undefined),
     pauseSince: pausePhase?.pauseSince,
     initial: snapshot?.initial,
     configBackup: snapshot?.configBackup,
     previous: snapshot?.previous,
+    installHolder: request.installHolder,
+    installProjects: request.installProjects,
     ...(snapshotAt !== undefined && Number.isFinite(snapshotAt) ? { reloadAfterMs: snapshotAt } : {}),
   };
 }
 
+function reportProjects(request: PendingUpgradeRequest): readonly (string | undefined)[] {
+  return request.installProjects ?? request.selectors;
+}
+
+function installAttribution(request: PendingUpgradeRequest): string {
+  const projects =
+    reportProjects(request).length === 0
+      ? "all configured projects"
+      : reportProjects(request).map((selector) => selector ?? "(default)").join(", ");
+  return `Host-global install holder: ${request.installHolder ?? "unknown"}; affected projects: ${projects}.`;
+}
+
 export interface UpgradeRecoveryStatus {
   failedVersion: string;
   phase: string;
@@ -593,10 +609,11 @@ export async function verifyPendingUpgrade(deps: UpgradeVerifyDeps): Promise<Upg
     // without guessing that an upgrade-owned sentinel still belongs to it.
     const abortedAt = now();
     deps.enqueue({
-      project: deps.projectName,
+      project: reportProject(reportProjects(request)),
       kind: "tier2",
       body: [
         `Fleet upgrade to omp-conductor@${request.version} never started (journal: ${upgradeJournalPath(root)}).`,
+        installAttribution(request),
         "The detached install unit died before touching any surface.",
         "Dispatch may still hold an unidentifiable install pause; check `status` and clear it explicitly with `omp-conductor resume`.",
         `Re-run the request, or install by hand with \`omp-conductor upgrade --to ${request.version}\`.`,
@@ -644,10 +661,11 @@ export async function verifyPendingUpgrade(deps: UpgradeVerifyDeps): Promise<Upg
   // after the outcome, the next tick can finish the idempotent resume.
   const verifiedAt = now();
   deps.enqueue({
-    project: deps.projectName,
+    project: reportProject(reportProjects(request)),
     kind: "material",
     body: [
       `omp-conductor@${request.version} is installed and verified on the first tick after the restart.`,
+      installAttribution(request),
       "",
       ...checks.map((check) => `${check.ok ? "ok" : "FAIL"}  ${check.name}${check.detail === undefined ? "" : ` — ${check.detail}`}`),
       "",
@@ -716,10 +734,11 @@ async function verifyRecoveredUpgrade(
 
   const recoveredAt = now();
   deps.enqueue({
-    project: deps.projectName,
+    project: reportProject(reportProjects(request)),
     kind: "material",
     body: [
       `The failed upgrade to omp-conductor@${request.version} is recovered.`,
+      installAttribution(request),
       "",
       ...checks.map((check) => `ok  ${check.name} — ${check.detail ?? "matched"}`),
       "",
@@ -925,10 +944,11 @@ async function triggerUpgradeRollback(
     // and must not be quietly mixed.
     journal({ kind: "outcome", phase: "rollback-unavailable", ok: false, detail: spawned.stderr });
     deps.enqueue({
-      project: deps.projectName,
+      project: reportProject(reportProjects(request)),
       kind: "tier2",
       body: [
         `Fleet upgrade to omp-conductor@${request.version} is INCOMPLETE (${why}) and its detached rollback could not start.`,
+        installAttribution(request),
         `Reason: ${spawned.stderr}`,
         "",
         "Surfaces may be at mixed versions; do not resume dispatch.",
@@ -941,10 +961,11 @@ async function triggerUpgradeRollback(
   }
   journal({ kind: "outcome", phase: "rollback-requested", ok: false, detail: why });
   deps.enqueue({
-    project: deps.projectName,
+    project: reportProject(reportProjects(request)),
     kind: "tier2",
     body: [
       `Fleet upgrade to omp-conductor@${request.version} did not verify (${why}) and is being rolled back by ${spawned.unit}.`,
+      installAttribution(request),
       "Dispatch stays paused until the rollback lands and a later tick verifies the old version.",
       "",
       `Journal: ${upgradeJournalPath(root)}`,