omp-conductor 0.20.0 → 0.20.1

package/src/failure-class.ts

@@ -34,6 +34,14 @@ export interface ClassifyFacts {
    *  reachable. Lets the table tell an infrastructure outage (#177) from a
    *  deterministic test failure by the log's own words. */
   failingLog?: string;
+  /** The PR's changed-file list, derived at the settle call site from the
+   *  diff the settlement already fetches (#1059). Lets the table tell a
+   *  Compose dependency-startup failure no PR could have caused from one a
+   *  PR's own diff did — a PR that touches no container configuration cannot
+   *  have broken `docker compose up`. Absent means the diff could not be
+   *  read (or was cut short), which is "could not tell": the conditional
+   *  signature below then stays silent and the attempt is charged. */
+  changedFiles?: string[];
 }
 
 export interface Classification {
@@ -208,6 +216,62 @@ export function infraSignatureVersion(): string {
   return INFRA_LOG_SIGNATURES.join("|");
 }
 
+/**
+ * Compose's own sentence for a dependency that failed its healthcheck during
+ * `docker compose up`: "dependency failed to start: container
+ * chad-postgres-1 is unhealthy" (#1059). Matched with its trailing context,
+ * never a bare `is unhealthy` — that phrase is common enough in application
+ * logs to be unsafe on its own. Shared with the settle call site so the diff
+ * fetch and the classifier can never disagree about which log sentence needs
+ * the changed-file list.
+ */
+export const COMPOSE_DEPENDENCY_STARTUP_SIGNATURE =
+  "dependency failed to start: container ";
+
+/**
+ * A changed path that configures the containers Compose jobs run, or the
+ * workflow that invokes them: a compose file — `docker-compose*.ya?ml`,
+ * Compose v2's default `compose.ya?ml`, or any `*.ya?ml` directly inside a
+ * `compose/` directory (#1071) — anywhere in the tree, a `Dockerfile*`, or
+ * anything under `.github/workflows/`. A PR touching any of these can have
+ * broken `docker compose up` itself — that is what turns the signature below
+ * from infrastructure into a charged, deterministic failure. Matched
+ * case-insensitively: the price of missing a container file is waiving a
+ * genuine attempt, while a false positive (a path merely *named* like one)
+ * only charges one.
+ */
+const CONTAINER_CONFIG_PATH =
+  /(?:^|\/)(?:docker-compose[^/]*\.ya?ml|compose\.ya?ml|compose\/[^/]+\.ya?ml|Dockerfile[^/]*)$|(?:^|\/)\.github\/workflows\//i;
+
+/**
+ * Evidence that a failed check's log names a Compose dependency-startup
+ * failure, or `undefined` when the log does not name one or the PR's own diff
+ * could have caused it (#1059).
+ *
+ * Deliberately conditional on the PR's changed-file list, and deliberately
+ * left out of {@link INFRA_LOG_SIGNATURES}: a job that runs `docker compose`
+ * can be broken by the diff itself — a bad `docker-compose.yml` in a PR
+ * produces this exact sentence — so the blanket signature would waive the
+ * implementation attempt for a real defect. Only when the diff touches no
+ * compose file, no Dockerfile and no workflow is the fault one the PR cannot
+ * have introduced, and the recovery (`rerun-checks`) is bounded by the strike
+ * cap either way.
+ *
+ * Fails closed: `undefined` changedFiles is "could not read the diff", never
+ * "clean", and stays silent — an unknown or truncated diff must not waive an
+ * attempt.
+ */
+export function composeDependencyStartup(
+  log: string,
+  changedFiles: string[] | undefined,
+): string | undefined {
+  if (changedFiles === undefined) return undefined;
+  const lower = log.toLowerCase();
+  if (!lower.includes(COMPOSE_DEPENDENCY_STARTUP_SIGNATURE)) return undefined;
+  if (changedFiles.some((path) => CONTAINER_CONFIG_PATH.test(path))) return undefined;
+  return COMPOSE_DEPENDENCY_STARTUP_SIGNATURE.trim();
+}
+
 /** Lowercased check state — `gh pr checks` has emitted both `failure` and
  *  `FAILURE` across versions, and the classifier's callers must agree on one
  *  spelling so log selection and classification see the same set of checks. */
@@ -601,6 +665,69 @@ export function noVerdictExit(run: RunRecord): string | undefined {
   return `the session ended without delivering a settlement verdict; last words: "${lastWords.slice(0, 80)}"`;
 }
 
+/** A reliable PR reference inside a blocker's prose: a `PR #N`/
+ *  `pull request #N` mention or a GitHub `…/pull/N` URL. Named once so the
+ *  evidence's "the next act is an observation of this PR" claim and the code
+ *  that finds the PR stay one pattern (#1068). */
+const PR_REFERENCE_PATTERN =
+  /(?:PR|pull request)\s+#?\s*\d+|github\.com\/[^\s/]+\/[^\s/]+\/pull\/\d+/i;
+
+/**
+ * The `blockers:` list of a blocked settlement's stored report, in order
+ * (#1068). The worker's structured yield renders one item per blocker as
+ * `  - <item>` under a `blockers:` heading, and prose settlements that use the
+ * same heading parse the same way. `undefined` when the report carries no
+ * such section — a report that names no blockers and a missing report read
+ * identically, which is honest: the worker did not name a condition to
+ * observe.
+ */
+function blockedSettlementBlockers(report: string | undefined): string[] | undefined {
+  if (report === undefined) return undefined;
+  const blockers: string[] = [];
+  let inBlockers = false;
+  for (const line of report.split("\n")) {
+    if (inBlockers) {
+      const item = /^ {2,}-\s+(.*)$/.exec(line);
+      if (item === null) break;
+      blockers.push(item[1]!.trim());
+      continue;
+    }
+    if (/^blockers:\s*$/i.test(line)) inBlockers = true;
+  }
+  return blockers.length === 0 ? undefined : blockers;
+}
+
+/**
+ * An explicit question in the blocked row's own words, or `undefined` when the
+ * row names none (#1068). The worker's question travels in the pre-existing
+ * `lastError` slot, or as a `blockers:` item that ends interrogative; a
+ * blocker that names a condition to observe ("PR #1067 checks still
+ * pending…") is not a question. Quoted verbatim into the escalation evidence,
+ * because the orchestrator answers the worker's own words rather than a
+ * paraphrase.
+ */
+function blockedQuestion(run: RunRecord): string | undefined {
+  if (run.lastError !== undefined && run.lastError.trim() !== "") return run.lastError;
+  return blockedSettlementBlockers(run.report)?.find((b) => /[?？]\s*$/.test(b));
+}
+
+/**
+ * The report's first substantive line: skips the `status:`/`pr:`/`branch:`/
+ * `head:` headers and blank lines a structured settlement puts on top, and
+ * bounds the quote so a prose dump cannot balloon an evidence line. `undefined`
+ * when the report is empty or carries nothing but scaffold.
+ */
+function firstReportContentLine(report: string | undefined): string | undefined {
+  if (report === undefined) return undefined;
+  for (const raw of report.split("\n")) {
+    const line = raw.trim();
+    if (line === "") continue;
+    if (/^(?:status|pr|branch|head):\s*\S/.test(line)) continue;
+    return line.length > 200 ? `${line.slice(0, 200)}…` : line;
+  }
+  return undefined;
+}
+
 export function classifyRun(
   run: RunRecord,
   facts: ClassifyFacts,
@@ -744,10 +871,44 @@ export function classifyRun(
   }
 
   if (run.state === "blocked") {
+    // `blocked` is overloaded (#1068). A worker that finishes its work and
+    // stops because it is waiting on an observable condition — almost always
+    // its PR's checks — records that condition as `blockers:` in its
+    // settlement report; a worker that stops to ask records an actual
+    // question. Only the second shape is a human escalation: the first names
+    // the next act (observe, then the sweep settles the row the way it
+    // settles `settlement-stuck` when the PR resolves), so escalating it
+    // wakes the orchestrator for a question that does not exist and the act
+    // that *is* required appears nowhere. The evidence never claims the
+    // worker "left no report" — it quotes the question or the first blocker,
+    // and when the report genuinely is empty it says which fields are.
+    const question = blockedQuestion(run);
+    if (question !== undefined) {
+      return { cls: "question", recovery: "escalate", evidence: question };
+    }
+    const blockers = blockedSettlementBlockers(run.report);
+    if (blockers !== undefined) {
+      // Prefer the blocker that names a PR: the reader's next act is an
+      // observation of that PR and a merge, and the evidence must say so.
+      const named = blockers.find((b) => PR_REFERENCE_PATTERN.test(b)) ?? blockers[0]!;
+      return {
+        cls: "awaiting-observation",
+        recovery: "observe",
+        evidence: `waiting on ${named}`,
+      };
+    }
+    const reportEmpty = run.report === undefined || run.report.trim() === "";
+    const firstContent = firstReportContentLine(run.report);
     return {
       cls: "question",
       recovery: "escalate",
-      evidence: run.lastError ?? "the worker stopped to ask a question and left no report",
+      evidence: reportEmpty
+        ? `the worker stopped without a run report (run.report is empty${
+            run.lastError === undefined || run.lastError.trim() === "" ? "; lastError is empty too" : ""
+          })`
+        : firstContent === undefined
+          ? "the worker stopped without asking a question or naming a blocker (run.report is non-empty but has no readable content)"
+          : `the worker stopped without asking a question or naming a blocker — ${firstContent}`,
     };
   }
 
@@ -854,6 +1015,26 @@ export function classifyRun(
             evidence: `infrastructure signature in ${check?.name === undefined ? "failed check" : check.name} log: "${signature}"`,
           };
         }
+        // A Compose dependency-startup failure is infra only when the PR's
+        // diff could not have caused it (#1059): a job that runs `docker
+        // compose` is broken by a PR that breaks its own compose file, and
+        // that attempt is genuinely spent. The settlement hands the
+        // classifier the PR's changed-file list, so "did this diff touch any
+        // container configuration" is a fact, not a guess from the log alone.
+        // Absent list (or a log without the sentence) stays silent and the
+        // row reads `ci-deterministic`.
+        const compose = composeDependencyStartup(facts.failingLog, facts.changedFiles);
+        if (compose !== undefined) {
+          const check = checks.find((c) => normalise(c.state) === "failure");
+          return {
+            cls: "ci-infra",
+            recovery: "rerun-checks",
+            // Both halves, so the evidence says *which* sentence matched and
+            // *why* it was not the diff's fault — the changed-file list
+            // showed no container configuration.
+            evidence: `infrastructure signature in ${check?.name === undefined ? "failed check" : check.name} log: "${compose}" — the PR diff touches no container configuration, so the PR cannot have failed this check`,
+          };
+        }
       }
       const failing = unresolved.filter((c) => normalise(c.state) === "failure");
       if (failing.length > 0) {

package/src/fleet.ts

@@ -103,6 +103,7 @@ import {
   resolveArmState,
   TICK_CONFIG_FILE,
   tickConfigMatchesProject,
+  writeArmedMarker,
   type ArmState,
   type TickConfig,
   type TickConfigResult,
@@ -308,9 +309,10 @@ export interface ArmMarkersWritten {
  * A challenge filed and sent, with nothing armed yet.
  *
  * Arming used to block here for up to five minutes on an in-session
- * acknowledgement. With the console owning the operator DM, the reply lands in
- * a session that runs no tick extension, so that wait could never be satisfied
- * — it is now two mechanical steps, and this is the first one's receipt.
+ * acknowledgement. Nothing waits now: the reply is consumed mechanically by
+ * the session whose topic the challenge went to (the orchestrator pane,
+ * #1061), or by `omp-conductor arm --reply` on a console host whose DM the
+ * operator answered in. This is the send half's receipt.
  */
 export interface ArmChallengeSent {
   outcome: "challenge-sent";
@@ -566,7 +568,8 @@ function armReplyCommand(projectName?: string): string {
  * proof cannot weaken it.
  *
  * Like {@link armTicks}, this returns as soon as the challenge is filed and
- * sent: `omp-conductor arm --reply` writes the markers.
+ * sent: the reply settles it mechanically on the orchestrator pane's own
+ * topic, or through `omp-conductor arm --reply` from the console.
  */
 export async function armFleet(
   projectNames: readonly string[],
@@ -709,10 +712,12 @@ export type ArmReplyResult = ArmReplyAccepted | ArmReplyRefused;
  * The verification half of the ceremony: classify the operator's verbatim
  * message and, on a match, arm exactly the projects the challenge recorded.
  *
- * This runs in the console session, which is where the operator's reply lands
- * now that it owns the Telegram DM. No session waits for anything: the
- * challenge is durable state, so the two halves are ordinary commands that can
- * run minutes apart in different processes.
+ * This is the host CLI half, and it is one of two consumers of the same
+ * durable record: the orchestrator session's inbound path settles a reply
+ * sent to the project topic mechanically (#1061), while this command remains
+ * the console's route for a reply that landed in the operator DM. No session
+ * waits for anything: the challenge is durable state, so the halves are
+ * ordinary commands that can run minutes apart in different processes.
  *
  * The security properties are the send half's, unchanged. Only the project's
  * own record and the fleet record are read (no other project's ceremony can be
@@ -3552,18 +3557,6 @@ function armClock(ms: number): string {
   return minutes === 0 ? `${seconds}s` : `${minutes}m${String(seconds).padStart(2, "0")}s`;
 }
 
-/**
- * The one armed-marker write both proofs share: same content, same mode, and
- * the same restamp of the pre-per-project shared marker the heartbeat still
- * honours — a project that just armed must not leave the bare marker around to
- * re-arm future fleets through `disarm` (#316).
- */
-function writeArmedMarker(path: string, owner: string, arm: ArmState): void {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `armed ${new Date().toISOString()} owner=${owner}\n`, { mode: 0o600 });
-  if (arm.legacy === "honoured") rmSync(legacyArmedMarkerPath(), { force: true });
-}
-
 /**
  * The session surface the claim-only verdict judges: the tick-cwd-derived
  * session directory plus, when the live claim's file lives elsewhere in the