omp-conductor 0.19.6 → 0.19.7

package/src/store.ts

@@ -1356,6 +1356,20 @@ CREATE TABLE IF NOT EXISTS orchestrator_incidents (
   diverted INTEGER NOT NULL DEFAULT 0
 );
 
+-- Conductor-owned Herdr worker workspaces (#1035 review). Herdr restores a
+-- session's workspaces and panes across a server restart but drops
+-- report-metadata tokens, so the live-only token cannot remain the only
+-- ownership authority: the restored surface would be invisible to discovery,
+-- a duplicate would be created beside it, and its stale panes could never be
+-- reconciled or removed. One row per workspace conductor created and still
+-- owns; forgotten when the workspace is removed or fails to create cleanly.
+CREATE TABLE IF NOT EXISTS herdr_worker_workspaces (
+  project      TEXT    NOT NULL,
+  workspace_id TEXT    NOT NULL,
+  created_at   INTEGER NOT NULL,
+  PRIMARY KEY (project, workspace_id)
+);
+
 -- Every stop/restart of the shared daemon, and who asked for it and why
 -- (#378). Deliberately NOT partitioned by project: the daemon serves every
 -- configured project, so a record written by one project's CLI must be
@@ -2954,6 +2968,18 @@ export function openStore(dbPath: string): Store {
       WHERE project = ?
       RETURNING project, mode, cause, since, diverted`,
   );
+  // Worker-workspace ownership rows (#1035 review). See the table comment:
+  // the durable half of discovery, so a Herdr restart that drops metadata
+  // tokens cannot orphan the surface conductor created.
+  const selectHerdrWorkerWorkspaces = db.query<{ workspace_id: string }, [string]>(
+    `SELECT workspace_id FROM herdr_worker_workspaces WHERE project = ? ORDER BY created_at ASC, workspace_id ASC`,
+  );
+  const insertHerdrWorkerWorkspace = db.query<unknown, [string, string, number]>(
+    `INSERT OR IGNORE INTO herdr_worker_workspaces (project, workspace_id, created_at) VALUES (?, ?, ?)`,
+  );
+  const deleteHerdrWorkerWorkspace = db.query<unknown, [string, string]>(
+    `DELETE FROM herdr_worker_workspaces WHERE project = ? AND workspace_id = ?`,
+  );
   const upsertDispatch = db.query<unknown, [string, string]>(
     `INSERT INTO dispatch_summaries (project, summary) VALUES (?, ?)
      ON CONFLICT(project) DO UPDATE SET summary = excluded.summary`,
@@ -4849,6 +4875,22 @@ export function openStore(dbPath: string): Store {
       bumpOrchestratorIncident.run(by, project);
     },
 
+    /** The workspace ids conductor recorded as its own worker surface for
+     *  this project, oldest first (#1035 review). Durable across daemon AND
+     *  Herdr restarts, which is the point: Herdr restores workspaces without
+     *  their metadata tokens, so discovery needs a second authority. */
+    workerWorkspaceIds(project: string): string[] {
+      return selectHerdrWorkerWorkspaces.all(project).map((row) => row.workspace_id);
+    },
+
+    rememberWorkerWorkspace(project: string, workspaceId: string): void {
+      insertHerdrWorkerWorkspace.run(project, workspaceId, Date.now());
+    },
+
+    forgetWorkerWorkspace(project: string, workspaceId: string): void {
+      deleteHerdrWorkerWorkspace.run(project, workspaceId);
+    },
+
     closeOrchestratorIncident(project: string, _at: number): OrchestratorIncident | undefined {
       const row = deleteOrchestratorIncident.get(project);
       return row === null ? undefined : toOrchestratorIncident(row);

package/src/types.ts

@@ -3187,6 +3187,13 @@ export interface Store {
   /** Close the open incident and hand back what it accumulated, for the
    *  recovery page's downtime and diverted count. `undefined` when none. */
   closeOrchestratorIncident(project: string, at: number): OrchestratorIncident | undefined;
+  /** The workspace ids conductor recorded as its own worker surface for a
+   *  project, oldest first (#1035 review). Durable across daemon AND Herdr
+   *  restarts: Herdr restores workspaces without their metadata tokens, so
+   *  this record is the discovery leg that survives. */
+  workerWorkspaceIds(project: string): string[];
+  rememberWorkerWorkspace(project: string, workspaceId: string): void;
+  forgetWorkerWorkspace(project: string, workspaceId: string): void;
   /** Append one daemon stop/restart provenance line (#378). Host-wide — never
    *  partitioned by project, so any project's status reads the same records. */
   recordDaemonStop(draft: DaemonStopDraft): DaemonStop;
@@ -3840,6 +3847,18 @@ export const VERB_REFUSALS = [
    *  verb refuses with an actionable syntax error instead of echoing a
    *  fail-open the heading contradicts. */
   "file-lane-unparseable",
+  /**
+   * Adding the queue label was refused because the issue carries a durable
+   * `promotable` grooming verdict whose dispatch brief no longer provably
+   * matches the issue (#1036): the current write lane differs from the
+   * verdict's `fileLane`, the evidence does not recover as a strict
+   * PROMOTABLE result, or the issue could not be read to compare at all. The
+   * durable verdict is the admission contract, so promotion fails closed
+   * before any tracker mutation or daemon wake; the remediation is applying
+   * the verdict's `proposedBrief` to the issue explicitly, never a silent
+   * rewrite, and then adding the label again.
+   */
+  "promotion-brief-mismatch",
   /** The release grant does not permit this shape for this caller. */
   "release-not-granted",
   /** The artefact or environment is not one this project declared (#129). */

package/src/verbs/server.ts

@@ -60,6 +60,7 @@ import {
 import { releaseRefusal } from "../release-policy.ts";
 import { PR_LOOKUP_WINDOW_MS, REVISABLE_RUN_STATES, prReviewReadiness } from "../decisions.ts";
 import { LIVE_STATES } from "../store.ts";
+import { parseToSpecEvidence } from "../to-spec.ts";
 import { DENIED_RELEASE_GRANTS } from "../types.ts";
 import type {
   FileLane,
@@ -1298,10 +1299,23 @@ async function labelVerb(
   let malformed: string | undefined;
   if (action === "add" && label === project.queueLabel) {
     const lane = await laneForEcho(deps, ref.issue);
-    if (lane !== undefined) {
+    if (lane.readable) {
       malformed = lane.malformed;
       echo = laneEcho(lane.lane);
     }
+    // The durable grooming verdict is an admission contract only while the
+    // dispatch brief still matches it (#1036): a stale issue body once
+    // promoted beside a PROMOTABLE verdict whose fileLane had moved on, and
+    // the run dispatched on the stale lane. So before any tracker mutation or
+    // daemon wake, a promotable row must verify against the same parse the
+    // echo reports — exact in both directions, order-insensitive. The syntax
+    // refusal below keeps precedence: fix the section first, then the contract.
+    if (malformed === undefined) {
+      const mismatch = promotionBriefRefusal(deps, project, ref.issue, lane);
+      if (mismatch !== undefined) {
+        return refuse("promotion-brief-mismatch", mismatch, ref.issue);
+      }
+    }
   }
   if (malformed !== undefined) {
     return refuse(
@@ -1354,32 +1368,99 @@ async function labelVerb(
  * The effective file lane admission will enforce for one issue, as the
  * one-line echo (#724), plus the malformed write-lane section marker (#825):
  * the body plus the whole comment thread, the same inputs `effectiveLane`
- * reads at admission. `undefined` when either read fails or the tracker cannot
- * produce the issue — the promotion is never blocked by its own feedback.
+ * reads at admission. `readable` says whether the issue and thread were read
+ * at all — the echo stays best-effort (an unreadable issue never blocks its
+ * own promotion, #724), but the promotion-brief gate (#1036) must be able to
+ * tell "no lane declared" from "could not look", because behind a durable
+ * `promotable` verdict the second is a fail-closed refusal rather than
+ * feedback.
  */
-async function laneForEcho(deps: VerbDeps, issue: number): Promise<
-  | { lane: FileLane | undefined; malformed: string | undefined }
-  | undefined
-> {
+async function laneForEcho(deps: VerbDeps, issue: number): Promise<{
+  readable: boolean;
+  lane: FileLane | undefined;
+  malformed: string | undefined;
+}> {
   let body: string;
   let comments: IssueComment[];
   try {
     const row = await deps.tracker.getIssue(issue);
-    if (row === undefined) return undefined;
+    if (row === undefined) return { readable: false, lane: undefined, malformed: undefined };
     body = row.body;
     comments = await deps.tracker.listComments(issue);
   } catch {
-    return undefined;
+    return { readable: false, lane: undefined, malformed: undefined };
   }
   const lane = effectiveLane(body, comments);
-  if (lane !== undefined) return { lane, malformed: undefined };
+  if (lane !== undefined) return { readable: true, lane, malformed: undefined };
   // No declaration parsed anywhere. If a clearly delimited write-lane section
   // exists anyway, the section tried to declare and failed — the echo must
   // refuse, never claim fail-open.
   const heading =
     writeLaneSectionHeading(body) ??
     comments.map((c) => writeLaneSectionHeading(c.body)).find((h) => h !== undefined);
-  return { lane: undefined, malformed: heading };
+  return { readable: true, lane: undefined, malformed: heading };
+}
+
+/**
+ * The promotion-brief gate (#1036): a durable `promotable` grooming verdict is
+ * an admission contract only while the dispatch brief still matches it, so a
+ * queue-label add must prove the match before any tracker mutation or daemon
+ * wake. Compares the lane admission would enforce (the same parse the echo
+ * reports) against the verdict's `fileLane` as deduplicated,
+ * order-independent path sets, exact in both directions — missing and extra
+ * paths refuse alike. Returns the refusal detail, or `undefined` when
+ * promotion may proceed: no grooming row, a non-`promotable` row, or a
+ * verified match.
+ *
+ * Fail-closed by design: evidence behind a `promotable` row that does not
+ * recover as a strict PROMOTABLE result (`parseToSpecEvidence`, the same
+ * restart round-trip the selection side trusts), or an issue that cannot be
+ * read to compare at all, refuses the promotion rather than dispatching on an
+ * unverifiable brief. The gate never edits the issue — it names both path
+ * sets and points at the verdict's `proposedBrief`; correcting the dispatch
+ * brief is an explicit orchestrator act.
+ */
+function promotionBriefRefusal(
+  deps: VerbDeps,
+  project: ProjectConfig,
+  issue: number,
+  read: { readable: boolean; lane: FileLane | undefined },
+): string | undefined {
+  const row = deps.store.grooming(project.name, issue);
+  if (row?.verdict !== "promotable") return undefined;
+  const result = parseToSpecEvidence(row.evidence);
+  if (result === undefined || result.verdict !== "PROMOTABLE") {
+    return (
+      `refused: ${project.queueLabel} was not added — #${issue}'s durable grooming row reads promotable, but its ` +
+      "evidence does not recover as a strict PROMOTABLE to-spec result, so promotion cannot prove the dispatch " +
+      "brief still matches what was groomed. Re-groom the issue so a fresh verdict replaces the row, then add the label again."
+    );
+  }
+  if (!read.readable) {
+    return (
+      `refused: ${project.queueLabel} was not added — #${issue} carries a durable PROMOTABLE grooming verdict, but ` +
+      "the issue could not be read, so the current brief cannot be compared with the verdict's file lane. " +
+      "Retry when the tracker responds."
+    );
+  }
+  // One closure so both sides of the comparison normalize in lockstep: a set
+  // comparison whose halves dedupe differently lies silently (#1036).
+  const normalizedPaths = (paths: readonly string[]): string[] =>
+    [...new Set(paths.map((path) => path.trim()).filter((path) => path.length > 0))].sort();
+  const brief = normalizedPaths(read.lane?.files ?? []);
+  const verdict = normalizedPaths(result.fileLane);
+  if (
+    brief.length === verdict.length &&
+    brief.every((path, index) => path === verdict[index])
+  ) {
+    return undefined;
+  }
+  return (
+    `refused: ${project.queueLabel} was not added — #${issue}'s current write lane [${brief.join(", ")}] disagrees ` +
+    `with its durable PROMOTABLE verdict's file lane [${verdict.join(", ")}]. The durable verdict is the admission ` +
+    "contract: apply the verdict's proposedBrief to the issue (its ## Exact write lane included), then add the " +
+    "label again. The gate never rewrites the issue itself."
+  );
 }
 
 async function releaseVerb(