omp-conductor 0.2.2 → 0.3.2

package/src/lifecycle.ts

@@ -22,11 +22,13 @@ import { join } from "node:path";
 
 /**
  * Mirrors `DEFAULT_PORT` in ./daemon.ts. Duplicated rather than imported so
- * this module stays free of the dispatcher's dependency tree.
- * // ponytail: two constants that must agree. If a third caller ever needs it,
- * // move it into ./types.ts and import it in both places.
+ * this module stays free of the dispatcher's dependency tree; exported so the
+ * CLI can name the port a foreground daemon will serve on without adding a
+ * third literal.
+ * // ponytail: two constants that must agree. If a third *definition* ever
+ * // appears, move it into ./types.ts and import it everywhere.
  */
-const DEFAULT_PORT = 8787;
+export const DEFAULT_PORT = 8787;
 
 /** How long `startDaemon` waits for the first successful `/healthz`. */
 const READY_TIMEOUT_MS = 15_000;

package/src/orchestrator-tick.ts

@@ -6,12 +6,9 @@
  * loop, so this extension is the heartbeat: every `intervalSeconds` it injects
  * one message that starts a turn.
  *
- * Four properties are worth protecting, and each one is a branch in
+ * Three properties are worth protecting, and each one is a branch in
  * `tickDecision()`:
  *
- * - **Pause is honoured.** `isPaused()` is imported from ./daemon.ts — the exact
- *   function `/conductor pause` writes for and the dispatch loop reads. A second
- *   spelling of "is it paused" here is how a paused fleet keeps working.
  * - **A disarmed fleet is not woken.** The arm marker is a file the operator
  *   controls; missing means "not armed", and a tick then does nothing.
  * - **The human channel must still be there.** Autonomous dispatch is only
@@ -22,21 +19,25 @@
  *   channel that makes running unattended safe.
  * - **Ticks coalesce.** A tick that lands while an earlier one is still queued
  *   would stack prompts on a session that is already behind. `hasPendingMessages()`
- *   makes the tick idempotent under slow turns.
+ *   makes the tick idempotent under slow turns — and, because it is the only
+ *   signal in the process that says whether the last prompt was ever consumed,
+ *   it doubles as the wedge detector: see {@link STALL_MARKER_FILE}.
  *
- * Beyond those four gates, every tick carries the project's `reporting.scope`
+ * Beyond those three gates, every tick carries the project's `reporting.scope`
  * as one explicit constraint line, re-read from the conductor config on each
  * tick so a `/conductor setup` change binds the next heartbeat rather than
- * waiting for a session restart.
+ * waiting for a session restart — and one delivery rule
+ * ({@link TICK_DELIVERY_RULE}), because a tick is injected locally and a report
+ * written as end-of-turn text on such a turn reaches nobody. An operator's own
+ * `message` replaces both, and is re-read per tick for the same reason.
  *
  * The extension is inert unless `<cwd>/.conductor-tick.json` exists, so shipping
  * it inside `omp-conductor` costs an ordinary session nothing.
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 import { findProject, loadConfig } from "./config.ts";
-import { isPaused } from "./daemon.ts";
 import { DEFAULT_REPORT_SCOPE, type ReportScope } from "./types.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
@@ -52,6 +53,43 @@ export const TICK_CUSTOM_TYPE = "omp-conductor.tick";
  */
 export const MIN_INTERVAL_SECONDS = 60;
 
+/**
+ * The stall marker — written beside the activation file, in the session cwd —
+ * and the number of consecutive coalesced ticks that earn it.
+ *
+ * This detects a failure that happened. 2026-08-07: the dogfood fleet's
+ * orchestrator finished a turn, logged `ui.loop-blocked` immediately after an
+ * auto-compaction threshold decision, and never started another. The process
+ * stayed alive, so `herdr-conductor`'s recovery — agent listed AND a
+ * non-shell foreground process — read healthy, and the dispatch daemon is a
+ * different process entirely, so `/healthz` stayed green too. A tick injected
+ * two minutes later and an operator's Telegram message five minutes after that
+ * both sat unconsumed for 23 minutes, until a manual SIGTERM. This extension
+ * had the evidence and threw it away: coalescing logged `tick skipped: tick
+ * already pending`, which reads exactly like healthy backpressure.
+ *
+ * Two in a row is a full hour at the reference 1800s interval — generous by
+ * construction, because a turn that legitimately runs an hour belongs to a
+ * fleet with larger problems than one spurious marker. The escalation has to
+ * leave the session, since a wedged loop cannot report on itself: a file any
+ * out-of-process watchdog can stat, plus an error-level line a log scraper can
+ * match.
+ */
+export const STALL_MARKER_FILE = ".conductor-stalled";
+export const STALL_TICKS = 2;
+
+/**
+ * The marker's one line after its ISO timestamp, and the middle of the error
+ * log. Shared so the file and the log can never describe different failures.
+ */
+const STALL_DIAGNOSIS = `${STALL_TICKS} ticks queued unconsumed — the agent loop is not draining`;
+
+/**
+ * The one skip reason the stall counter reacts to, shared with the decision so
+ * a reworded log line cannot silently disarm the detector.
+ */
+const PENDING_REASON = "tick already pending";
+
 /**
  * The slice of the omp extension API this entry touches, mirroring
  * `ExtensionAPI` / `ExtensionContext` from `@oh-my-pi/pi-coding-agent`.
@@ -146,13 +184,20 @@ export type TickConfigResult =
  * The prompt when the config names none. The timestamp is what makes two
  * consecutive ticks distinguishable in the session log.
  *
+ * "Re-read … from disk" is an order, not colour. A 24/7 session holds a copy of
+ * the brief from its own start (or its last compaction), and a tick that merely
+ * says "run your loop" was observed acting on that cached copy first — which
+ * means an operator's amendment, or a dated standing task added between ticks,
+ * may never bind. The whole point of a file the operator can edit is that the
+ * next tick obeys the file, not the memory of it.
+ *
  * Deliberately silent about reporting volume: that clause is
  * {@link TICK_SCOPE_CONSTRAINTS}, appended per tick from the configured scope.
  * A second spelling of it here would contradict the first inside one prompt the
  * moment a fleet chose `escalations`.
  */
-export function defaultTickMessage(now: Date): string {
-  return `Tick ${now.toISOString()}: run your standing loop from ORCHESTRATOR.md now.`;
+export function defaultTickMessage(now: Date, briefPath = "ORCHESTRATOR.md"): string {
+  return `Tick ${now.toISOString()}: re-read ${briefPath} from disk, then run your standing loop from it.`;
 }
 
 /**
@@ -174,21 +219,49 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
 };
 
 /**
- * The scope this tick carries, and — when it had to fall back — why.
+ * The delivery clause, appended to every default tick prompt.
+ *
+ * End-of-turn text streams to the operator's Telegram only on a turn that
+ * *began* as an inbound Telegram message. A heartbeat tick is injected locally,
+ * so it is never such a turn, and a session that believes otherwise reports
+ * into a void: on 2026-08-06 the fleet this extension runs produced a release
+ * report and two tier-2 escalations as end-of-turn text, and not one of the
+ * three reached anybody. What makes a report real is a tool call the session
+ * watched succeed, so the prompt says so on every tick rather than trusting a
+ * brief that can drift, be edited, or be compacted away.
+ */
+export const TICK_DELIVERY_RULE =
+  "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Deliver anything reportable this turn by calling the telegram_send tool and confirming success; never claim a report was sent otherwise.";
+
+/**
+ * The scope this tick carries, where the brief actually lives, and — when the
+ * config could not answer — why.
  *
  * Read on every tick rather than cached at session start, for the reason the
  * channel gate is: the operator re-runs `/conductor setup` while this session
  * lives, and a heartbeat holding a startup snapshot would keep injecting the
  * old contract until somebody restarted it.
  *
- * Every fault collapses to {@link DEFAULT_REPORT_SCOPE}: no config written yet,
- * an unreadable or invalid one, or several projects with none named — the same
- * ambiguity `findProject` refuses to guess through for `status`. Stopping the
- * heartbeat over a reporting preference would be the worse trade.
+ * `briefPath` exists because the prompt orders a re-read, and an order must
+ * name a file that is really there: the brief lives at
+ * `<workspaceRoot>/ORCHESTRATOR.md`, not in the session cwd — the cwd usually
+ * holds only an `AGENTS.md` symlink to it. The name is spelled here rather than
+ * imported from setup.ts, whose import graph drags the session SDK into an
+ * extension that must stay cheap to load.
+ *
+ * Every fault collapses to {@link DEFAULT_REPORT_SCOPE} and a pathless prompt:
+ * no config written yet, an unreadable or invalid one, or several projects with
+ * none named — the same ambiguity `findProject` refuses to guess through for
+ * `status`. Stopping the heartbeat over either preference would be the worse
+ * trade.
  */
-export function resolveTickScope(): { scope: ReportScope; fallback?: string } {
+export function resolveTickScope(): { scope: ReportScope; briefPath?: string; fallback?: string } {
   try {
-    return { scope: findProject(loadConfig()).reporting?.scope ?? DEFAULT_REPORT_SCOPE };
+    const project = findProject(loadConfig());
+    return {
+      scope: project.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
+      briefPath: join(project.workspaceRoot, "ORCHESTRATOR.md"),
+    };
   } catch (err) {
     return { scope: DEFAULT_REPORT_SCOPE, fallback: err instanceof Error ? err.message : String(err) };
   }
@@ -245,7 +318,7 @@ export function readTickConfig(cwd: string): TickConfigResult {
   }
 
   // Relative paths resolve against the session cwd, so the files can sit beside
-  // the config that names them (`state/armed`) without hard-coding /root/fleet.
+  // the config that names them (`state/armed`) without hard-coding a deploy path.
   const armedFile = optionalPath(raw["armedFile"], "armedFile", cwd, problems);
   const accessFile = optionalPath(raw["accessFile"], "accessFile", cwd, problems);
 
@@ -276,8 +349,18 @@ export function readTickConfig(cwd: string): TickConfigResult {
 /**
  * Whether this tick sends, and why — the whole decision, with no clock, no
  * filesystem and no session in it. The interesting part of a heartbeat is the
- * precedence between "paused", "not armed", "channel down" and "already
- * pending", and that is worth being able to test without a session at all.
+ * precedence between "not armed", "channel down" and "already pending", and
+ * that is worth being able to test without a session at all.
+ *
+ * The pause sentinel is deliberately NOT consulted. `pause` is the dispatch
+ * daemon's flag — "stop claiming; in-flight work finishes" — and this heartbeat
+ * drives a different brain: the supervising session whose duties (groom the
+ * queue, drain escalations, report) are exactly the ones that stay useful while
+ * dispatch is stopped. Honouring it here shipped once, when the tick-driven
+ * session WAS the dispatcher; the day dispatch moved into the daemon, one flag
+ * silencing both brains became a starvation bug: a paused fleet's orchestrator
+ * could neither groom nor even say it was paused. The operator's lever for this
+ * session is the arm marker — `disarm` stops ticks, and only the operator arms.
  *
  * `armed` and `channelOk` are the *satisfied* gates, not the files behind them:
  * a config with no `armedFile` passes the first, and one with no `accessFile`
@@ -286,7 +369,6 @@ export function readTickConfig(cwd: string): TickConfigResult {
  * channel gate means "this session is not the fleet", not "the check is off".
  */
 export function tickDecision(input: {
-  paused: boolean;
   armed: boolean;
   channelOk: boolean;
   hasPending: boolean;
@@ -294,10 +376,9 @@ export function tickDecision(input: {
   send: boolean;
   reason: string;
 } {
-  if (input.paused) return { send: false, reason: "paused" };
   if (!input.armed) return { send: false, reason: "not armed" };
   if (!input.channelOk) return { send: false, reason: "escalation channel down" };
-  if (input.hasPending) return { send: false, reason: "tick already pending" };
+  if (input.hasPending) return { send: false, reason: PENDING_REASON };
   return { send: true, reason: "armed, nothing pending" };
 }
 
@@ -331,18 +412,81 @@ function channelIsUp(path: string): boolean {
 }
 
 /**
- * One tick: gather the four facts, ask `tickDecision`, log the reason either
- * way. Skips are deliberately silent in the UI — a paused fleet would otherwise
- * emit a notification every interval, forever.
+ * The operator's own prompt for this tick, re-read from the session cwd rather
+ * than taken from the startup snapshot — for the reason {@link resolveTickScope}
+ * and the channel gate re-read: the operator of a 24/7 session reconfigures it
+ * out-of-band, and a heartbeat holding a startup copy would keep injecting last
+ * week's prompt until somebody restarted the session.
+ *
+ * A re-read that succeeds owns the answer, "no `message` key any more" included:
+ * deleting the override hands the prompt back to the shipped default. A re-read
+ * that fails keeps the startup value — a mid-edit truncation, a file moved away
+ * or a fault the validator collects must not stop the heartbeat, and must not
+ * silently swap the operator's prompt for ours over a transient bad read.
  *
- * `session` holds the only thing one tick remembers for the next: whether the
- * scope fallback has been logged. Without it, a host with no conductor config
- * would repeat the same line about the same missing file every interval, for as
- * long as the session lives.
+ * `intervalSeconds` is deliberately *not* re-read here: rescheduling a live
+ * managed timer is a different change, so a period edit still needs a restart.
+ */
+function currentMessage(cwd: string, startup: TickConfig): string | undefined {
+  const reread = readTickConfig(cwd);
+  return reread.kind === "ok" ? reread.config.message : startup.message;
+}
+
+/**
+ * Marker writes are best-effort by construction. This runs inside the loop
+ * whose whole job is to keep prompting a session; a read-only filesystem, a
+ * full disk, or a cwd deleted out from under a long-lived process is not a
+ * reason to stop doing that. Both directions log their own failure and carry
+ * on — the error line stands as the record either way, and the marker is only
+ * the copy an out-of-process watchdog can see.
  */
-function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: { scopeFallbackLogged: boolean }): void {
+function writeStallMarker(pi: TickApi, cwd: string): void {
+  const path = join(cwd, STALL_MARKER_FILE);
+  try {
+    writeFileSync(path, `${new Date().toISOString()} ${STALL_DIAGNOSIS}\n`);
+  } catch (err) {
+    pi.logger.error(`[omp-conductor] could not write ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+/**
+ * Cleared by the first consumed tick, whether or not this process wrote it.
+ * Recovery normally arrives as a *new* session — the wedged one was SIGTERM'd
+ * and its transcript resumed — which starts with a zero counter and its
+ * predecessor's marker on disk. Gating removal on this session's own count
+ * would strand that file, and a stall marker nobody clears is a stall marker
+ * nobody believes.
+ */
+function clearStallMarker(pi: TickApi, cwd: string): void {
+  const path = join(cwd, STALL_MARKER_FILE);
+  if (!existsSync(path)) return;
+  try {
+    rmSync(path, { force: true });
+    pi.logger.info("[omp-conductor] orchestrator stall cleared: a tick was consumed");
+  } catch (err) {
+    pi.logger.error(`[omp-conductor] could not remove ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+/** Everything one tick remembers for the next. */
+interface TickSession {
+  /**
+   * Whether the reporting-scope fallback has been logged. Without it, a host
+   * with no conductor config would repeat the same line about the same missing
+   * file every interval, for as long as the session lives.
+   */
+  scopeFallbackLogged: boolean;
+  /** Consecutive {@link PENDING_REASON} skips — see {@link STALL_MARKER_FILE}. */
+  pendingSkips: number;
+}
+
+/**
+ * One tick: gather the three facts, ask `tickDecision`, log the reason either
+ * way. Skips are deliberately silent in the UI — a disarmed fleet would
+ * otherwise emit a notification every interval, forever.
+ */
+function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSession): void {
   const decision = tickDecision({
-    paused: isPaused(),
     armed: config.armedFile === undefined || existsSync(config.armedFile),
     channelOk: config.accessFile === undefined || channelIsUp(config.accessFile),
     hasPending: ctx.hasPendingMessages(),
@@ -350,19 +494,35 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: { scop
 
   if (!decision.send) {
     pi.logger.info(`[omp-conductor] tick skipped: ${decision.reason}`, { reason: decision.reason });
+    // Only a coalesced skip counts. "Not armed" and "channel down" say nothing
+    // about the queue — they are gates the operator or the bridge closed, and
+    // the session behind them may be perfectly awake.
+    if (decision.reason !== PENDING_REASON) return;
+    session.pendingSkips += 1;
+    // Only the crossing writes. A later skip refreshing the timestamp would
+    // keep moving "stalled since" forward, and how long it has been wedged is
+    // the fact the file is read for.
+    if (session.pendingSkips === STALL_TICKS) {
+      pi.logger.error(`[omp-conductor] orchestrator stalled: ${STALL_DIAGNOSIS}; see ${STALL_MARKER_FILE}`, {
+        reason: decision.reason,
+        pendingSkips: session.pendingSkips,
+      });
+      writeStallMarker(pi, ctx.cwd);
+    }
     return;
   }
 
-  // A configured message owns the whole contract, reporting clause included: an
-  // operator who wrote their own prompt did not ask for ours appended to it.
-  let content = config.message;
+  // A configured message owns the whole contract, reporting and delivery clauses
+  // included: an operator who wrote their own prompt did not ask for ours
+  // appended to it.
+  let content = currentMessage(ctx.cwd, config);
   if (content === undefined) {
     const scope = resolveTickScope();
     if (scope.fallback !== undefined && !session.scopeFallbackLogged) {
       session.scopeFallbackLogged = true;
       pi.logger.info(`[omp-conductor] tick reporting scope: using ${DEFAULT_REPORT_SCOPE} — ${scope.fallback}`);
     }
-    content = `${defaultTickMessage(new Date())}\n${TICK_SCOPE_CONSTRAINTS[scope.scope]}`;
+    content = `${defaultTickMessage(new Date(), scope.briefPath)}\n${TICK_SCOPE_CONSTRAINTS[scope.scope]}\n${TICK_DELIVERY_RULE}`;
   }
 
   pi.sendMessage(
@@ -370,6 +530,10 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: { scop
     { triggerTurn: true, deliverAs: "followUp" },
   );
   pi.logger.info(`[omp-conductor] tick sent: ${decision.reason}`, { reason: decision.reason });
+  // An empty queue at send time is the proof the previous tick was consumed, so
+  // this is the only place either the counter or the marker is cleared.
+  session.pendingSkips = 0;
+  clearStallMarker(pi, ctx.cwd);
 }
 
 export default function orchestratorTickExtension(pi: TickApi): void {
@@ -377,9 +541,10 @@ export default function orchestratorTickExtension(pi: TickApi): void {
   // `session_start` cannot install a second heartbeat on the same session.
   let armed = false;
   // Held per registration for the same reason: the "using the default reporting
-  // scope, because ..." line is logged once for this heartbeat, and a second
-  // session in the same process starts with its own count.
-  const session = { scopeFallbackLogged: false };
+  // scope, because ..." line is logged once for this heartbeat, and the stall
+  // counter is about this session's own queue. A second session in the same
+  // process starts with both at zero.
+  const session: TickSession = { scopeFallbackLogged: false, pendingSkips: 0 };
 
   pi.on("session_start", (_event, ctx) => {
     if (armed) return;
@@ -387,11 +552,10 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     // A subagent inherits the orchestrator's cwd, so it finds the same
     // activation file and would arm a heartbeat of its own — one extra tick
     // per worker, each prompting a session whose whole contract is to finish
-    // and yield. The discriminator is omp-telegram's, which has been running
-    // it in production (`isTaskSubagent`, ~/VSCode/omp/plugins/telegram/src/
-    // index.ts:87-90, applied at index.ts:1951-1952): task sessions are
-    // headless *and* always carry the `yield` tool. Neither half suffices
-    // alone — a headless root session (print/RPC mode) has no `yield`, and an
+    // and yield. The discriminator is the one omp-telegram has been running in
+    // production: task sessions are headless *and* always carry the `yield`
+    // tool. Neither half suffices alone — a headless root session (print/RPC
+    // mode) has no `yield`, and an
     // interactive session may well have one. Checked before the config read
     // so the overwhelmingly common case never touches the filesystem.
     if (!ctx.hasUI && pi.getActiveTools().includes("yield")) {

package/src/plugin.ts

@@ -43,6 +43,7 @@ import {
   DEFAULT_REPORT_SCOPE,
   type Caps,
   type ConductorConfig,
+  type OrchestratorMode,
   type ProjectConfig,
   type ReportScope,
 } from "./types.ts";
@@ -239,6 +240,53 @@ async function askReportScope(ctx: CommandContext, current: ReportScope): Promis
   return choice.scope;
 }
 
+/**
+ * Who merges and who releases. Two confirms rather than one four-way list:
+ * these are independent grants — delegating merges is routine, delegating
+ * releases is not — and a menu of four combinations frames them as equally
+ * ordinary choices, which is exactly the framing a release grant must not get.
+ *
+ * Neither confirm can start on "yes", so a re-run that Enters through the
+ * wizard revokes rather than renews. That is the safe direction, and the
+ * current grant is named in the question so the revoke is never a surprise.
+ */
+async function askAuthority(
+  ctx: CommandContext,
+  prior: ProjectConfig["authority"],
+): Promise<ProjectConfig["authority"]> {
+  const merge = await ctx.ui.confirm(
+    "Merge authority",
+    "Delegate PR merging to the orchestrator session? It would land green PRs one at a time, each " +
+      "re-checked against the base branch first. Default: humans merge" +
+      `${prior.merge === "orchestrator" ? " — currently delegated, answer no to take it back" : ""}.`,
+  );
+  const release = await ctx.ui.confirm(
+    "Release authority",
+    "Delegate release cutting to the orchestrator session? It would tag, pin and publish by the " +
+      "procedure you write into its brief — and its brief forbids cutting one before you have. " +
+      "Default: humans release" +
+      `${prior.release === "orchestrator" ? " — currently delegated, answer no to take it back" : ""}.`,
+  );
+  return { merge: merge ? "orchestrator" : "human", release: release ? "orchestrator" : "human" };
+}
+
+/**
+ * Where the session that triages escalations lives. Phrased as a fact about the
+ * host rather than a preference, because that is what it is: answering yes when
+ * no such session exists leaves tier-1 escalations sitting in issue comments
+ * that nobody drains.
+ */
+async function askOrchestratorMode(ctx: CommandContext, prior: OrchestratorMode): Promise<OrchestratorMode> {
+  const external = await ctx.ui.confirm(
+    "Orchestrator session",
+    "Do you already run your own orchestrator session for this project — a visible TUI session, say? " +
+      "Then the daemon starts none of its own, and posts tier-1 escalations as issue comments for yours " +
+      "to drain. Default: no, the daemon runs one" +
+      `${prior === "external" ? " — currently external" : ""}.`,
+  );
+  return external ? "external" : "embedded";
+}
+
 /**
  * Whether to render the operator's own brief, and — separately — whether an
  * existing one may be replaced. Two questions on purpose: that file is where a
@@ -382,6 +430,11 @@ async function collectAnswers(
     );
   }
 
+  // Straight after the caps, and for the same reason they sit together: these
+  // are the two questions that decide what an unattended fleet may do without
+  // asking anybody.
+  const authority = await askAuthority(ctx, prior?.authority ?? SETUP_DEFAULTS.authority);
+
   // Outside the caps block: a model is not a ceiling, and an operator who left
   // the caps alone may still want workers on a cheaper model.
   const answeredModel = await ask(
@@ -417,6 +470,11 @@ async function collectAnswers(
     "Also comment on the issue when a run escalates? Recommended: a chat message you miss is a run nobody sees.",
   );
 
+  const orchestratorMode = await askOrchestratorMode(
+    ctx,
+    prior?.escalation.orchestrator ?? SETUP_DEFAULTS.orchestratorMode,
+  );
+
   const reportScope = await askReportScope(ctx, prior?.reporting?.scope ?? DEFAULT_REPORT_SCOPE);
 
   const answers: SetupAnswers = {
@@ -428,6 +486,8 @@ async function collectAnswers(
     targetRepos,
     caps,
     fallbackToIssueComment,
+    authority,
+    orchestratorMode,
     reportScope,
     // Asked last, and asked with the real path in the question — which needs the
     // rest of the answers to derive, so the decision is folded in below.