omp-conductor 0.3.17 → 0.3.19

package/src/release-policy.ts

@@ -0,0 +1,202 @@
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { stateDir } from "./config.ts";
+import type { ReleasePolicy } from "./types.ts";
+
+export const RELEASE_POLICY_AUDIT_FILE = "release-policy-blocks.jsonl";
+
+export type ReleaseShape =
+  | "git-tag"
+  | "git-push-tags"
+  | "package-publish"
+  | "github-release"
+  | "deploy";
+
+export interface ReleaseBlock {
+  project: string;
+  source: "worker" | "orchestrator";
+  shape: ReleaseShape;
+  at: string;
+}
+
+export type ReleaseDecision = { block: true; reason: string };
+
+const GIT_PUSH_TAG_SHAPE =
+  /(?:--tags\b|--follow-tags\b|refs\/tags\/|(?:^|\s)(?:tag\s+)?v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?(?=[:\s]|$))/;
+
+function commandSegments(command: string): string[] {
+  return command
+    .split(/(?:&&|\|\||[;\n|])/)
+    .map((segment) => segment.trim())
+    .filter((segment) => segment.length > 0);
+}
+
+function stripCommandPrefix(segment: string): string {
+  return segment
+    .replace(/^env\s+/, "")
+    .replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*/, "")
+    .replace(/^sudo\s+/, "");
+}
+
+/** Recognise the explicit release/deploy command shapes this policy promises to gate. */
+export function releaseShapeFromCommand(command: string): ReleaseShape | undefined {
+  for (const raw of commandSegments(command)) {
+    const segment = stripCommandPrefix(raw);
+    if (/^git(?:\s+-[Cc]\s+\S+)*\s+tag(?:\s|$)/.test(segment)) return "git-tag";
+    if (
+      /^git(?:\s+-[Cc]\s+\S+)*\s+push\b/.test(segment) &&
+      GIT_PUSH_TAG_SHAPE.test(segment)
+    ) {
+      return "git-push-tags";
+    }
+    if (/^(?:npm|pnpm|bun)\s+(?:publish|stage\s+publish)\b/.test(segment)) {
+      return "package-publish";
+    }
+    if (/^yarn\s+npm\s+publish\b/.test(segment)) return "package-publish";
+    if (/^gh\s+release\s+create\b/.test(segment)) return "github-release";
+    if (
+      /^(?:kubectl\s+(?:apply|create|replace)|helm\s+(?:install|upgrade)|terraform\s+apply|pulumi\s+up|(?:fly|vercel|wrangler)\s+deploy|docker\s+push)\b/.test(
+        segment,
+      )
+    ) {
+      return "deploy";
+    }
+  }
+  return undefined;
+}
+
+/** Release-shaped device/tool invocations that do not pass through a shell. */
+export function releaseShapeFromTool(
+  toolName: string,
+  input: Record<string, unknown> | undefined,
+): ReleaseShape | undefined {
+  if (input === undefined) return undefined;
+  if (toolName === "bash") {
+    return typeof input.command === "string" ? releaseShapeFromCommand(input.command) : undefined;
+  }
+
+  const path = typeof input.path === "string" ? input.path : "";
+  if (toolName === "write" && path.startsWith("xd://")) {
+    if (/create[_-]release/i.test(path)) return "github-release";
+    if (/publish/i.test(path)) return "package-publish";
+    if (/deploy/i.test(path)) return "deploy";
+  }
+
+  const normalized = toolName.toLowerCase().replaceAll("-", "_");
+  if (/create_?release|release_?create/.test(normalized)) return "github-release";
+  if (/(?:^|_)publish(?:$|_)/.test(normalized)) return "package-publish";
+  if (/(?:^|_)deploy(?:$|_)/.test(normalized)) return "deploy";
+  return undefined;
+}
+
+export function releaseDecision(
+  policy: ReleasePolicy,
+  toolName: string,
+  input: Record<string, unknown>,
+): { shape: ReleaseShape; decision: ReleaseDecision } | undefined {
+  if (policy !== "none") return undefined;
+  const shape = releaseShapeFromTool(toolName, input);
+  if (shape === undefined) return undefined;
+  return {
+    shape,
+    decision: {
+      block: true,
+      reason:
+        `Blocked by releasePolicy=none (${shape}). ` +
+        "Only a human may change the project to operator-brief before release or deploy tools can run.",
+    },
+  };
+}
+
+interface ReleasePolicyPi {
+  on(
+    event: "tool_call",
+    handler: (
+      event: { toolName: string; input: Record<string, unknown> },
+      ctx: unknown,
+    ) => ReleaseDecision | undefined,
+  ): void;
+}
+
+/** Inline session extension used by workers and the embedded orchestrator. */
+export function releasePolicyTripwire(
+  policy: ReleasePolicy,
+  onBlocked: (shape: ReleaseShape) => void = () => {},
+): (pi: ReleasePolicyPi) => void {
+  return (pi) => {
+    pi.on("tool_call", (event) => {
+      const blocked = releaseDecision(policy, event.toolName, event.input);
+      if (blocked === undefined) return undefined;
+      try {
+        onBlocked(blocked.shape);
+      } catch {
+        // Audit is evidence, not the gate. A full disk must not turn a deny into allow.
+      }
+      return blocked.decision;
+    });
+  };
+}
+
+export function recordReleaseBlock(
+  project: string,
+  source: ReleaseBlock["source"],
+  shape: ReleaseShape,
+  root = stateDir(),
+  now = new Date(),
+): void {
+  mkdirSync(root, { recursive: true });
+  const record: ReleaseBlock = { project, source, shape, at: now.toISOString() };
+  appendFileSync(join(root, RELEASE_POLICY_AUDIT_FILE), `${JSON.stringify(record)}\n`, { mode: 0o600 });
+}
+
+export interface ReleaseDriftSummary {
+  count: number;
+  latest: ReleaseBlock;
+}
+
+/** Aggregate today's blocked attempts for the orchestrator's daily digest. */
+export function releaseDriftToday(
+  project: string,
+  root = stateDir(),
+  now = new Date(),
+): ReleaseDriftSummary | undefined {
+  let text: string;
+  try {
+    text = readFileSync(join(root, RELEASE_POLICY_AUDIT_FILE), "utf8");
+  } catch {
+    return undefined;
+  }
+  const day = now.toISOString().slice(0, 10);
+  let count = 0;
+  let latest: ReleaseBlock | undefined;
+  for (const line of text.split("\n")) {
+    if (line.length === 0) continue;
+    try {
+      const value = JSON.parse(line) as Partial<ReleaseBlock>;
+      if (
+        value.project === project &&
+        typeof value.at === "string" &&
+        value.at.startsWith(day) &&
+        (value.source === "worker" || value.source === "orchestrator") &&
+        typeof value.shape === "string"
+      ) {
+        count += 1;
+        latest = value as ReleaseBlock;
+      }
+    } catch {
+      // One torn line does not hide later valid audit records.
+    }
+  }
+  return latest === undefined ? undefined : { count, latest };
+}
+
+export function releaseDriftDigestLine(project: string, root = stateDir(), now = new Date()): string | undefined {
+  const drift = releaseDriftToday(project, root, now);
+  if (drift === undefined) return undefined;
+  return (
+    `Release-policy drift today: ${drift.count} release/deploy tool call(s) were blocked ` +
+    `(latest: ${drift.latest.source} ${drift.latest.shape} at ${drift.latest.at}). ` +
+    "Include this divergence from releasePolicy=none in today's digest."
+  );
+}

package/src/setup-host.ts

@@ -0,0 +1,285 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { dirname, join } from "node:path";
+import { configPath, stateDir } from "./config.ts";
+import { isPaused, runDaemon, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
+import { DEFAULT_FLEET_AGENT_NAME } from "./fleet.ts";
+import {
+  DEFAULT_PORT,
+  healthCheck,
+  livingDaemon,
+  startDaemon,
+  stopDaemon,
+  type DaemonRecord,
+  type StopResult,
+} from "./lifecycle.ts";
+import {
+  readTickConfig,
+  TICK_CONFIG_FILE,
+  type TickConfig,
+} from "./orchestrator-tick.ts";
+import type { Caps, ProjectConfig } from "./types.ts";
+
+export const DEFAULT_TICK_INTERVAL_SECONDS = 900;
+export const STAGED_SERVICE_NAME = "omp-conductor.service";
+export const SYSTEMD_UNIT_DIR = "/etc/systemd/system";
+
+export type PlannedWrite<T> = {
+  path: string;
+  action: "create" | "update" | "keep";
+  content: string;
+  value: T;
+};
+
+export interface HostRuntimePlan {
+  service: PlannedWrite<string>;
+  tick?: PlannedWrite<TickConfig>;
+  installCommands: readonly string[];
+  cliSource: "global" | "plugin";
+}
+
+export interface ServiceRuntime {
+  username: string;
+  home: string;
+  path: string;
+  bun: string;
+  cli?: string;
+  packageCli: string;
+  conductorHome: string;
+  telegramStateDir: string;
+}
+
+function systemdQuote(value: string): string {
+  if (/\r|\n/.test(value)) throw new Error("systemd values cannot contain newlines");
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function actionFor(path: string, content: string): PlannedWrite<string>["action"] {
+  if (!existsSync(path)) return "create";
+  try {
+    return readFileSync(path, "utf8") === content ? "keep" : "update";
+  } catch {
+    return "update";
+  }
+}
+
+function defaultServiceRuntime(telegramStateDir: string): ServiceRuntime {
+  const home = homedir();
+  const bun = process.execPath;
+  const globalCli = Bun.which("omp-conductor");
+  const pathParts = [dirname(bun), ...(process.env["PATH"] ?? "").split(":")].filter(
+    (value, index, all) => value.length > 0 && all.indexOf(value) === index,
+  );
+  return {
+    username: userInfo().username,
+    home,
+    path: pathParts.join(":"),
+    bun,
+    ...(globalCli === null ? {} : { cli: globalCli }),
+    packageCli: join(import.meta.dir, "cli.ts"),
+    conductorHome: dirname(configPath()),
+    telegramStateDir,
+  };
+}
+
+export function renderDaemonService(
+  project: ProjectConfig,
+  caps: Caps,
+  runtime: ServiceRuntime,
+): string {
+  const command =
+    runtime.cli === undefined
+      ? [runtime.bun, runtime.packageCli, "daemon", "--project", project.name, "--port", String(DEFAULT_PORT)]
+      : [runtime.cli, "daemon", "--project", project.name, "--port", String(DEFAULT_PORT)];
+  const memoryMax = caps.maxConcurrentWorkers <= 1 ? "3G" : "5G";
+  return [
+    "[Unit]",
+    "Description=omp-conductor dispatch daemon",
+    "Documentation=https://github.com/TerrifiedBug/conductor",
+    "After=network-online.target",
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `User=${runtime.username}`,
+    `Environment=${systemdQuote(`HOME=${runtime.home}`)}`,
+    `Environment=${systemdQuote(`PATH=${runtime.path}`)}`,
+    `Environment=${systemdQuote(`OMP_CONDUCTOR_HOME=${runtime.conductorHome}`)}`,
+    `Environment=${systemdQuote(`OMP_TELEGRAM_STATE_DIR=${runtime.telegramStateDir}`)}`,
+    `WorkingDirectory=${systemdQuote(stateDir())}`,
+    `ExecStart=${command.map(systemdQuote).join(" ")}`,
+    "Restart=on-failure",
+    "SuccessExitStatus=0 143",
+    "MemoryAccounting=yes",
+    `MemoryMax=${memoryMax}`,
+    "",
+    "[Install]",
+    "WantedBy=multi-user.target",
+    "",
+  ].join("\n");
+}
+
+function tickSearchRoots(project: ProjectConfig): string[] {
+  const roots = [stateDir(), dirname(project.workspaceRoot), project.workspaceRoot];
+  return roots.filter((root, index) => roots.indexOf(root) === index);
+}
+
+function planTick(project: ProjectConfig, telegramStateDir: string): PlannedWrite<TickConfig> {
+  let existing: { path: string; config: TickConfig } | undefined;
+  for (const root of tickSearchRoots(project)) {
+    const result = readTickConfig(root);
+    if (result.kind === "invalid") {
+      throw new Error(`tick config invalid at ${result.path}: ${result.problem}; fix or remove it before setup`);
+    }
+    if (result.kind === "ok") {
+      existing = { path: result.path, config: result.config };
+      break;
+    }
+  }
+
+  const path = existing?.path ?? join(project.workspaceRoot, TICK_CONFIG_FILE);
+  const config: TickConfig = existing === undefined
+    ? {
+        intervalSeconds: DEFAULT_TICK_INTERVAL_SECONDS,
+        armedFile: join(stateDir(), "armed"),
+        accessFile: join(telegramStateDir, "access.json"),
+        agentName: DEFAULT_FLEET_AGENT_NAME,
+      }
+    : {
+        ...existing.config,
+        armedFile: existing.config.armedFile ?? join(stateDir(), "armed"),
+        accessFile: existing.config.accessFile ?? join(telegramStateDir, "access.json"),
+      };
+  const content = `${JSON.stringify(config, null, 2)}\n`;
+  return { path, action: actionFor(path, content), content, value: config };
+}
+
+export function planHostRuntime(
+  project: ProjectConfig,
+  caps: Caps,
+  telegramStateDir: string,
+  runtime: ServiceRuntime = defaultServiceRuntime(telegramStateDir),
+): HostRuntimePlan {
+  const servicePath = join(stateDir(), STAGED_SERVICE_NAME);
+  const serviceContent = renderDaemonService(project, caps, runtime);
+  const service: PlannedWrite<string> = {
+    path: servicePath,
+    action: actionFor(servicePath, serviceContent),
+    content: serviceContent,
+    value: serviceContent,
+  };
+  const installedPath = join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME);
+  return {
+    service,
+    ...(project.escalation.orchestrator === "external"
+      ? { tick: planTick(project, telegramStateDir) }
+      : {}),
+    installCommands: [
+      `sudo install -m 0644 ${shellQuote(servicePath)} ${shellQuote(installedPath)}`,
+      "sudo systemctl daemon-reload",
+      `sudo systemctl enable ${STAGED_SERVICE_NAME}`,
+      `sudo systemctl restart ${STAGED_SERVICE_NAME}`,
+    ],
+    cliSource: runtime.cli === undefined ? "plugin" : "global",
+  };
+}
+
+export function formatHostRuntimePlan(plan: HostRuntimePlan): string {
+  const lines = [
+    "host runtime",
+    `  service        ${plan.service.action} ${plan.service.path}`,
+    `  daemon entry   ${plan.cliSource === "global" ? "installed omp-conductor CLI" : "current installed plugin"}`,
+  ];
+  if (plan.tick !== undefined) {
+    lines.push(
+      `  heartbeat      ${plan.tick.action} ${plan.tick.path}`,
+      `  interval       ${plan.tick.value.intervalSeconds}s`,
+      `  arm gate       ${plan.tick.value.armedFile}`,
+      `  channel gate   ${plan.tick.value.accessFile}`,
+    );
+  } else {
+    lines.push("  heartbeat      embedded orchestrator — no external tick config");
+  }
+  lines.push("  install        staged only; the final result prints the systemd install commands");
+  return lines.join("\n");
+}
+
+function atomicWrite(path: string, content: string, mode: number): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync(tmp, content, { mode });
+    chmodSync(tmp, mode);
+    renameSync(tmp, path);
+    chmodSync(path, mode);
+  } catch (err) {
+    rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+
+export function writeHostRuntime(plan: HostRuntimePlan): string[] {
+  const written: string[] = [];
+  if (plan.service.action !== "keep") {
+    atomicWrite(plan.service.path, plan.service.content, 0o644);
+    written.push(plan.service.path);
+  }
+  if (plan.tick !== undefined && plan.tick.action !== "keep") {
+    atomicWrite(plan.tick.path, plan.tick.content, 0o600);
+    written.push(plan.tick.path);
+  }
+  return written;
+}
+
+export interface SetupSmokeResult {
+  mode: "temporary" | "existing";
+  status: StatusSnapshot;
+  daemon: DaemonRecord;
+}
+
+export interface SetupSmokeDeps {
+  paused(): boolean;
+  runOnce(project: string): Promise<void>;
+  living(): DaemonRecord | undefined;
+  health(port: number): Promise<{ ok: boolean; body?: string }>;
+  start(project: string): Promise<DaemonRecord>;
+  stop(): Promise<StopResult>;
+  status(project: string): StatusSnapshot;
+}
+
+const DEFAULT_SMOKE_DEPS: SetupSmokeDeps = {
+  paused: isPaused,
+  runOnce: async (project) => await runDaemon({ once: true, project }),
+  living: livingDaemon,
+  health: healthCheck,
+  start: async (project) => await startDaemon({ project }),
+  stop: stopDaemon,
+  status: statusSnapshot,
+};
+
+export async function runSetupSmoke(
+  project: string,
+  deps: SetupSmokeDeps = DEFAULT_SMOKE_DEPS,
+): Promise<SetupSmokeResult> {
+  if (!deps.paused()) throw new Error("setup smoke requires paused dispatch");
+  await deps.runOnce(project);
+  const existing = deps.living();
+  if (existing !== undefined) {
+    const health = await deps.health(existing.port);
+    if (!health.ok) throw new Error(`existing daemon on :${existing.port} did not answer /healthz`);
+    return { mode: "existing", status: deps.status(project), daemon: existing };
+  }
+
+  const daemon = await deps.start(project);
+  try {
+    const health = await deps.health(daemon.port);
+    if (!health.ok) throw new Error(`temporary daemon on :${daemon.port} did not answer /healthz`);
+    return { mode: "temporary", status: deps.status(project), daemon };
+  } finally {
+    await deps.stop();
+  }
+}

package/src/setup.ts

@@ -29,20 +29,22 @@ import {
   POLICY_BRIEF_NAME,
   composeOrchestrator,
   policyPathForRoot,
+  refreshComposedBrief,
   renderBriefTemplate,
-  writeWithBackup,
 } from "./brief-upgrade.ts";
-import { configPath, resolveCaps, stateDir } from "./config.ts";
+import { configPath, resolveCaps, resolveReleasePolicy, stateDir } from "./config.ts";
 import { graphProjectPath, graphRepos } from "./graph.ts";
 import {
   CONFIG_VERSION,
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
+  DEFAULT_RELEASE_POLICY,
   DEFAULT_REPORT_SCOPE,
   type Caps,
   type ConductorConfig,
   type OrchestratorMode,
   type ProjectConfig,
+  type ReleasePolicy,
   type ReportScope,
   type RepoTarget,
 } from "./types.ts";
@@ -71,6 +73,8 @@ export interface SetupAnswers {
   fallbackToIssueComment: boolean;
   /** How loud the supervising orchestrator session should be. */
   reportScope: ReportScope;
+  /** Mechanical gate for release/deploy-shaped tool calls. */
+  releasePolicy: ReleasePolicy;
   /**
    * Whether to render `ORCHESTRATOR.md` into the project's workspace root. Not
    * part of the config — the brief is the operator's file, and the conductor
@@ -131,6 +135,8 @@ export const SETUP_DEFAULTS = {
   defaultBranch: "main",
   /** Both authorities start with the human; the wizard asks to move each one. */
   authority: DEFAULT_AUTHORITY,
+  /** Mechanical release/deploy gate stays closed until explicitly opened. */
+  releasePolicy: DEFAULT_RELEASE_POLICY,
   /** The daemon runs its own triage session unless an operator already runs one. */
   orchestratorMode: "embedded",
 } as const;
@@ -465,6 +471,7 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
       : {}),
     escalation,
     authority: { ...a.authority },
+    releasePolicy: a.releasePolicy,
     reporting: { scope: a.reportScope },
     // Both under the state dir so one `rm -rf ~/.omp/conductor` is a complete
     // uninstall, and neither can land in a repo the daemon then tries to commit.
@@ -521,6 +528,7 @@ export function defaultAnswers(projectName: string): SetupAnswers {
     caps: {},
     fallbackToIssueComment: true,
     authority: { ...SETUP_DEFAULTS.authority },
+    releasePolicy: SETUP_DEFAULTS.releasePolicy,
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
     reportScope: DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -566,6 +574,7 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     caps: { ...p.caps },
     fallbackToIssueComment: p.escalation.fallbackToIssueComment,
     authority: { ...p.authority },
+    releasePolicy: resolveReleasePolicy(p),
     orchestratorMode: p.escalation.orchestrator,
     reportScope: p.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -683,25 +692,16 @@ export function writeOrchestratorBrief(a: SetupAnswers): string {
  * Returns false when POLICY.md is missing (caller should migrate or set up).
  */
 export function refreshComposedBriefForProject(p: ProjectConfig): boolean {
-  const policyPath = policyPathForProject(p);
-  if (!existsSync(policyPath)) return false;
-  const orchestratorPath = briefPathForProject(p);
-  mkdirSync(dirname(orchestratorPath), { recursive: true });
-  writeFileSync(
-    orchestratorPath,
-    composeOrchestrator(renderFloorForProject(p), readFileSync(policyPath, "utf8")),
-  );
-  return true;
+  return refreshComposedBrief({
+    policyPath: policyPathForProject(p),
+    orchestratorPath: briefPathForProject(p),
+    floor: renderFloorForProject(p),
+  });
 }
 
 /** @internal test helper — expose compose banner for assertions. */
 export const BRIEF_COMPOSE_BANNER = COMPOSE_BANNER;
 
-/** Backup-aware POLICY write used by migrate paths that already computed text. */
-export function writePolicyFile(path: string, content: string): string | undefined {
-  return writeWithBackup(path, content);
-}
-
 /**
  * What can be told about an omp-telegram install without opening a socket.
  *
@@ -910,6 +910,7 @@ export function summarisePlan(
   lines.push(
     "",
     `authority      merge=${a.authority.merge}  release=${a.authority.release}`,
+    `tool gate      releasePolicy=${a.releasePolicy}`,
     delegated
       ? "               the brief tells that session so, and it must spell the procedure out before acting"
       : "               humans do both; workers and the conductor stop at a green PR",
@@ -1013,7 +1014,7 @@ export const AMEND_AREAS: {
     // The model rides with the caps because it is the other per-worker knob, and
     // an area no menu offers is a setting only a full re-interview can reach.
     name: "caps & worker model",
-    asks: "concurrency, spend, turns, wall clock, attempts per issue — then the worker model",
+    asks: "concurrency, spend, turns, wall clock, failed attempts, continuations — then the worker model",
     describe: (p) => {
       const c = resolveCaps(p, DEFAULT_CAPS);
       const answered = Object.keys(p.caps).length > 0;
@@ -1022,7 +1023,9 @@ export const AMEND_AREAS: {
       return (
         `${c.maxConcurrentWorkers} workers, ${c.workerMaxTurns} turns, ` +
         `${Math.round(c.workerWallClockMs / 60000)}m, ${spend}, ` +
-        `${c.maxAttemptsPerIssue} attempts${answered ? "" : " (all defaults)"} — ` +
+        `${c.maxAttemptsPerIssue} failed attempt${c.maxAttemptsPerIssue === 1 ? "" : "s"}, ` +
+        `${c.maxContinuationsPerIssue} continuation${c.maxContinuationsPerIssue === 1 ? "" : "s"}` +
+        `${answered ? "" : " (all defaults)"} — ` +
         `${p.workerModel === undefined ? "harness default model" : `model ${p.workerModel}`}`
       );
     },
@@ -1039,8 +1042,9 @@ export const AMEND_AREAS: {
   },
   authority: {
     name: "authority",
-    asks: "who lands green PRs, and who cuts releases",
-    describe: (p) => `merge=${p.authority.merge}, release=${p.authority.release}`,
+    asks: "who lands green PRs, who cuts releases, and whether release/deploy tools are mechanically open",
+    describe: (p) =>
+      `merge=${p.authority.merge}, release=${p.authority.release}, releasePolicy=${resolveReleasePolicy(p)}`,
   },
   escalation: {
     name: "escalation & triage",