omp-conductor 0.3.18 → 0.3.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/skills/conductor-onboarding/SKILL.md

@@ -556,56 +556,49 @@ authority confirms; the worker model; the Telegram chat id for tier 2; the
 escalation fallback; whether an orchestrator session already runs elsewhere; the
 report scope; and finally whether to write `ORCHESTRATOR.md` + `POLICY.md`.
 
-Two things about the end of it that you must not smooth over:
-
-- **The dry run is the point.** Before the confirm, it reads the tracker through
-  the same routing code the loop uses and prints exactly what the next tick would
-  pick up, which repo each issue routes to, the branch it would cut, and every
-  issue it cannot route. Walk the operator through that output. Unroutable issues
-  here are the single most useful signal in the whole onboarding: they mean the
-  labels and the routing config disagree, and it is far cheaper to see it now.
-- **Nothing is mutated until they answer.** No label created, no config written,
-  no state database, no arm. If they decline, the machine is untouched. Never
-  answer that confirm on their behalf.
-
-Say yes to writing `ORCHESTRATOR.md` + `POLICY.md`, then **immediately apply the edits you
-drafted in Steps 3, 4 and 5** to the file it wrote, and tell them the path. Note
-the trap for later: a future `/conductor setup` re-run offers to overwrite that
-file, and accepting loses every tailored word. Their brief is now a file worth
-keeping a copy of.
-
-### Then walk arm, pause, and disarm — they are three different things
-
-Operators conflate these, and the failure modes are not the same.
-
-- **Arm** is what that final confirm did, and it is exactly two things: create the
-  state database, and clear the pause flag. It does **not** start the daemon —
-  `omp-conductor start` does, and it does not report success until the daemon
-  answers `GET /healthz`. For a first run, take one tick in the foreground and
-  watch it: `omp-conductor daemon --once`.
-- **Pause is maintenance.** `/conductor pause` (or `omp-conductor pause`) writes a
-  sentinel in the state directory. The dispatch loop checks it first, so no new
-  work is claimed from the next tick; runs already in flight finish rather than
-  being killed. The orchestrator heartbeat reads the *same* flag, so pausing the
-  fleet also silences its heartbeat — one flag, not two. This is the switch for
-  touching a repo, rotating a credential, a release window, or a holiday.
-  `resume` undoes it. Nothing is torn down, nothing is forgotten.
-- **Disarm is channel teardown, and it is not a subcommand.** It is removing the
-  `armedFile` that `.conductor-tick.json` names — the heartbeat then sends nothing
-  and the supervising session simply stops being prompted. Be precise about the
-  asymmetry: **disarming stops the heartbeat, not the dispatch loop.** A disarmed
-  fleet whose daemon is still up keeps claiming issues with nobody supervising, so
-  "stop the fleet" is `pause` (or `omp-conductor stop`) — disarm is "stop waking
-  the orchestrator".
-- **And the gate that disarms itself.** If `.conductor-tick.json` names an
-  `accessFile`, every tick re-reads the Telegram bridge's `access.json` and
-  requires `enabled: true` with exactly **one** paired owner. It fails closed on
-  everything else: missing, unreadable, not JSON, disabled, nobody paired, or
-  several paired (it refuses to guess which human is on the hook). Unattended
-  dispatch is only defensible while a tier-2 escalation can reach a person, so a
-  channel that goes away disarms the heartbeat whether or not anyone intended it.
-  **A fleet deploy always sets `accessFile`.** Leaving it unset passes the gate —
-  that is for ordinary dev sessions, not an off switch.
+The end of the wizard is load-bearing:
+
+- **The dry run is the point.** Before consent, setup reads the tracker with the
+  daemon's routing code. It shows each routable and unroutable issue. Walk the
+  operator through that output. An unroutable issue means that the labels and
+  routing configuration disagree.
+- **Nothing changes before consent.** Setup creates no label, file, database, or
+  arm marker before the operator agrees. Never answer that consent prompt for
+  the operator.
+- **The host plan is part of consent.** For an external orchestrator, setup names
+  the heartbeat file and both safety gates. It also names the staged systemd
+  unit. An invalid existing heartbeat stops setup before any write.
+- **The smoke is automatic and paused.** After consent, setup holds dispatch,
+  runs one daemon tick, proves `/healthz`, reads stored status, and stops the
+  temporary daemon. A running daemon is health-checked and safely restarted only
+  when no worker is live.
+- **External arming proves the real channel.** Every setup run sends the inbound
+  Telegram challenge, even when an arm marker exists. A failed proof leaves
+  dispatch paused and prints the recovery commands.
+
+Ask the operator to approve the `ORCHESTRATOR.md` and `POLICY.md` write. After
+the wizard completes, apply the edits from Steps 3, 4, and 5 to `POLICY.md`.
+Tell the operator its path. A later wizard run asks before it replaces these files.
+
+### Then explain hold, pause, and disarm
+
+These controls have different effects:
+
+- **Setup readiness** means that the paused smoke passed. For external
+  orchestration, the Telegram arm proof also passed. Setup then clears the
+  dispatch pause. It does not install the staged systemd unit. Run the printed
+  install commands on systemd, or run `omp-conductor start` on another host.
+- **Hold** (`omp-conductor hold`) pauses claims and disarms ticks. The daemon and
+  pane stay active. Use this command for maintenance or an overnight stop.
+- **Pause** (`omp-conductor pause`) stops new claims only. Active workers finish,
+  and an armed heartbeat continues its triage and reporting duties.
+- **Disarm** (`omp-conductor disarm`) removes the marker named by
+  `.conductor-tick.json`. The heartbeat stops, but the daemon can still claim
+  work. Use `hold`, not `disarm`, when no orchestrator can supervise dispatch.
+- **The channel gate can stop ticks.** Every fleet heartbeat config names the
+  Telegram `access.json`. Each tick requires `enabled: true` and exactly one
+  paired owner. Missing, invalid, disabled, empty, or ambiguous access stops the
+  heartbeat.
 
 ---
 

package/skills/conductor-update/SKILL.md

@@ -1,179 +1,29 @@
 ---
 name: conductor-update
-description: Update an installed conductor fleet through one operator request. Use when the user asks to update, upgrade, refresh, reinstall, or deploy conductor. Pins one npm release across the Bun-global CLI, omp plugin, and Herdr recovery plugin; converts a local Herdr link when needed; pauses claims, reloads processes, verifies the fleet, and restores the operator's prior pause state.
+description: Update an installed conductor fleet through its deterministic one-command lifecycle. Use when the user asks to update, upgrade, refresh, reinstall, or deploy conductor.
 ---
 
-# Update a conductor fleet
+# Update conductor
 
-The operator interface is one request: **“update conductor.”** Do not hand them
-the implementation as a checklist unless execution is blocked.
-
-One release has three installed surfaces:
-
-1. Bun-global `omp-conductor`: CLI and systemd daemon source.
-2. omp npm plugin `omp-conductor`: slash command and heartbeat loaded by sessions.
-3. Herdr plugin `herdr-conductor`: exact-pane recovery, pinned to the npm
-   release's `gitHead`.
-
-This skill performs the whole swap. It does not publish npm, merge, tag, edit an
-install root, or update unrelated Bun packages.
-
-## Safety boundary
-
-Run from an operator shell or maintenance omp session that is not hosted by the
-target `herdr-fleet.service`. If restarting that unit would kill this updater,
-move to an external session first. Never print npm, Telegram, or bot credentials.
-
-The normal update is:
-
-```text
-inspect → pause claims → drain → pinned installs → reload → verify → restore pause state
-```
-
-Ticks stay in their existing armed or disarmed state. Do not use `hold`,
-`halt --pane`, `disarm`, `arm`, recovery pins, `pkill`, or manual install-root
-edits for a healthy update.
-
-## 1. Resolve one release and inspect every surface
-
-Use the registry latest unless the operator names another published version:
-
-```bash
-version=$(npm view omp-conductor version)
-gitHead=$(npm view "omp-conductor@$version" gitHead)
-npm view "omp-conductor@$version" version gitHead --json
-```
-
-Require `$version` to be nonempty and `$gitHead` to be a full commit SHA before
-changing state.
-
-Inspect, without mutating:
-
-```bash
-omp-conductor --version
-omp plugin list --json
-herdr --session "$session" plugin list
-omp-conductor status [--project NAME]
-```
-
-Honor the installation's existing Herdr session and `HERDR_CONFIG_PATH`; discover
-them from the running unit/config rather than assuming `fleet` or a path.
-
-Record:
-
-- Bun-global CLI version;
-- omp plugin version;
-- Herdr plugin source: GitHub revision, `local:<path>`, or missing;
-- initial dispatch state: running, paused, or stopped;
-- initial ticks state, which this update must not change;
-- active runs and layered health.
-
-Report “already current” only when **all** of these are true:
-
-- Bun-global CLI version equals `$version`;
-- omp plugin version equals `$version`;
-- Herdr source revision equals `$gitHead`;
-- layered status is healthy for the fleet's configured topology.
-
-A current npm version with a linked, missing, or stale Herdr plugin is a partial
-update, not a no-op. If all versions match but status is unhealthy, diagnose the
-reported layer; never call an unhealthy fleet current.
-
-## 2. Pause claims and drain
-
-If dispatch was running:
-
-```bash
-omp-conductor pause [--project NAME]
-```
-
-If it was already paused, preserve that state. If it was stopped, do not start it
-later merely because packages were updated.
-
-Wait for `active runs (none)`. Never kill workers for an update. If a run does not
-drain, stop and report it; leave any pause this skill added in place.
-
-## 3. Replace all three surfaces with the pinned release
-
-Use exact versions. A broad `bun update` is prohibited.
-
-```bash
-bun add -g "omp-conductor@$version"
-omp plugin install "omp-conductor@$version"
-```
-
-For Herdr, inspect the source found in step 1:
-
-- `local:<path>`: unlink the plugin id first;
-- GitHub-managed or missing: do not unlink.
-
-Then install the exact npm release commit. Herdr requires the source argument
-before its options:
-
-```bash
-herdr plugin unlink herdr-conductor  # only when step 1 reported local:<path>
-herdr plugin install TerrifiedBug/conductor/herdr --ref "$gitHead" --yes
-```
-
-If any install fails, do not reload processes and do not restore dispatch.
-Leave the fleet paused, report the failed surface, and give the one retry command.
-The still-running processes keep their already-loaded code until a successful
-reload.
-
-## 4. Reload the installed code
-
-When Herdr is systemd-managed, restart its fleet unit. This reloads the managed
-recovery plugin and causes exact-identity recovery to resume the orchestrator pane
-with the new omp extension:
-
-```bash
-systemctl restart herdr-fleet.service
-```
-
-Wait until Herdr reports its unit active and the exact configured agent live.
-
-If the dispatch daemon was running or paused initially, restart it so its process
-and source-integrity baseline use the new Bun-global package:
+Run the package-owned lifecycle from a shell or maintenance omp session outside
+the target Herdr session:
 
 ```bash
-omp-conductor restart [--project NAME]
+omp-conductor upgrade
 ```
 
-Do not substitute `start` when the daemon was initially stopped.
-
-## 5. Verify before restoring claims
-
-Check every surface again:
-
-```bash
-omp-conductor --version
-omp plugin list --json
-herdr --session "$session" plugin list
-omp-conductor status [--project NAME]
-systemctl is-active herdr-fleet.service
-```
-
-Require:
-
-- global CLI and omp plugin both equal `$version`;
-- Herdr source equals `TerrifiedBug/conductor` at `$gitHead`;
-- exact pane is live and recovery is clear;
-- Herdr and daemon health are OK when managed;
-- ticks equal their initial state;
-- active runs remain empty;
-- dispatch remains paused if this skill paused it.
-
-Run status a second time after recovery settles. Any failed check leaves dispatch
-paused and is reported as a partial update.
-
-Only if dispatch was initially running and every check passed:
+If the user requested a published version, run:
 
 ```bash
-omp-conductor resume [--project NAME]
+omp-conductor upgrade --to X.Y.Z
 ```
 
-Verify `dispatch running` once more. If dispatch was initially paused or stopped,
-preserve that state and report it.
+The command owns the full transaction: release resolution, preflight, pause,
+drain, exact-version installation across the Bun-global CLI, omp plugin, and
+Herdr plugin, managed-brief recomposition, process reload, pane recovery,
+two-pass verification, and restoration of the previous dispatch state.
 
-Finish with one compact result: old → new version, all three installed surfaces,
-final layered status, and whether the original dispatch state was restored.
+Report the command's result. Do not reproduce its lifecycle as an AI checklist,
+edit installed files, publish npm, or substitute separate install/restart steps.
+If it fails, report the exact error and leave dispatch paused as the command
+requires.