omp-conductor 0.3.24 → 0.4.0

package/src/orchestrator-tick.ts

@@ -47,8 +47,13 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import { findProject, loadConfig, resolveReleasePolicy } from "./config.ts";
-import { hasBotToken, readApprovalSurface, TELEGRAM_APPROVAL_TOOL } from "./approval-surface.ts";
+import { findProject, loadConfig, resolveReleaseGrants } from "./config.ts";
+import {
+  bridgeTokenBound,
+  hasBotToken,
+  readApprovalSurface,
+  TELEGRAM_APPROVAL_TOOL,
+} from "./approval-surface.ts";
 import {
   briefPathForProject,
   policyPathForProject,
@@ -56,11 +61,19 @@ import {
 } from "./setup.ts";
 import {
   recordReleaseBlock,
-  releaseDecision,
   releaseDriftDigestLine,
+  releaseRefusal,
+  releaseShapeFromTool,
   type ReleaseDecision,
 } from "./release-policy.ts";
-import { DEFAULT_RELEASE_POLICY, DEFAULT_REPORT_SCOPE, type FrictionSignal, type ReportScope, type Store } from "./types.ts";
+import {
+  DEFAULT_REPORT_SCOPE,
+  DENIED_RELEASE_GRANTS,
+  type FrictionSignal,
+  type ReportScope,
+  type ResolvedGrants,
+  type Store,
+} from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
@@ -334,12 +347,21 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
  * so it is never such a turn, and a session that believes otherwise reports
  * into a void: on 2026-08-06 the fleet this extension runs produced a release
  * report and two tier-2 escalations as end-of-turn text, and not one of the
- * three reached anybody. What makes a report real is a tool call the session
- * watched succeed, so the prompt says so on every tick rather than trusting a
- * brief that can drift, be edited, or be compacted away.
+ * three reached anybody.
+ *
+ * The clause used to name `telegram_send`, and that held — but it was still an
+ * instruction where a mechanism was needed: the same miss recurs whenever the
+ * session is distracted, compacted or interrupted mid-report, and an unsent
+ * report is indistinguishable from a quiet tick. #123 moved delivery to the
+ * daemon, so the clause now names the handover instead. `omp-conductor report`
+ * persists the text before anything is sent and the daemon retries it until it
+ * lands; a handover that returns a report id has therefore *already* survived
+ * the failure mode this rule exists for, which a watched `telegram_send` never
+ * could. `telegram_send` remains the right call for an interactive reply to a
+ * person who is waiting — that is a conversation, not a report.
  */
 export const TICK_DELIVERY_RULE =
-  "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Deliver anything reportable this turn by calling the telegram_send tool and confirming success; never claim a report was sent otherwise.";
+  "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Hand anything reportable this turn to the durable outbox by running `omp-conductor report --text \"<the whole report>\"` (add `--kind digest` for the daily digest) and confirming it printed a report id; the daemon then owns delivery and retries until it lands. Never claim a report was sent otherwise, and never use telegram_send for a report -- that path leaves no record that it went out.";
 
 /** Re-exported so the tick's own contract stays readable from one file: the
  *  constant itself lives beside the check that decides whether it is callable. */
@@ -1054,6 +1076,15 @@ interface TickSession {
    * background noise.
    */
   approvalToolMissingLogged: boolean;
+  /**
+   * Whether omp-telegram could have bound a bot token when this session started.
+   * False means its `telegram_ask` / `telegram_send` are dead for this session
+   * however good `access.json` looks now, because the bridge resolves its token
+   * once in `startBot()`. Defaults true so a session that never reaches
+   * `session_start` — every unit test that calls `tick()` directly — keeps the
+   * behaviour the access file describes.
+   */
+  bridgeTokenAtStart: boolean;
   /** Consecutive {@link PENDING_REASON} skips — see {@link STALL_MARKER_FILE}. */
   pendingSkips: number;
 }
@@ -1153,11 +1184,28 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // approved here is the one that should read last.
   //
   // No access file configured means no fleet channel to judge, so nothing is
-  // claimed: the channel gate above already treats that as "not the fleet". A
-  // missing bot token is likewise not this check's business — it fails the
-  // channel gate outright, so a tick that reaches here can already send, and the
-  // only open question is whether an answer can come back.
-  const approval = config.accessFile === undefined ? undefined : readApprovalSurface(config.accessFile);
+  // claimed: the channel gate above already treats that as "not the fleet".
+  //
+  // Two facts have to hold and the access file carries only one. It says whether
+  // a destination would resolve; it cannot say whether the bridge holds a token
+  // to resolve it with, because omp-telegram binds that once in `startBot()`. A
+  // token written out-of-band after this session started opens the channel gate
+  // — conductor pages tier 2 itself, so that much is honest — while leaving
+  // `telegram_ask` and `telegram_send` dead until `/telegram on`. Trusting the
+  // file alone there puts the tick straight back to mandating a call its surface
+  // cannot make, which is #114 exactly.
+  const approval =
+    config.accessFile === undefined
+      ? undefined
+      : session.bridgeTokenAtStart
+        ? readApprovalSurface(config.accessFile)
+        : ({
+            kind: "missing",
+            reason:
+              `${TELEGRAM_APPROVAL_TOOL} unavailable on local ticks: omp-telegram had no bot token when this ` +
+              "session started, so it bound none and its tools stay dead however complete the access file looks " +
+              "now — run `/telegram on` in this session, or restart it, to rebind the bridge",
+          } as const);
   if (approval?.kind === "missing") {
     content = `${content}\n${TICK_APPROVAL_UNAVAILABLE_RULE}`;
     if (!session.approvalToolMissingLogged) {
@@ -1253,12 +1301,13 @@ export default function orchestratorTickExtension(pi: TickApi): void {
   const session: TickSession = {
     scopeFallbackLogged: false,
     approvalToolMissingLogged: false,
+    bridgeTokenAtStart: true,
     pendingSkips: 0,
   };
   let releaseGateArmed = false;
   // An activation file makes this a fleet directory before Herdr can prove
-  // which pane owns it. The gate therefore starts closed and only honours an
-  // operator-brief policy after ownership is accepted.
+  // which pane owns it. The gate therefore starts closed and only honours a
+  // configured grant after ownership is accepted.
   let releaseAuthorityAccepted = false;
   const armReleaseGate = (): void => {
     if (releaseGateArmed) return;
@@ -1272,35 +1321,38 @@ export default function orchestratorTickExtension(pi: TickApi): void {
         ) => ReleaseDecision | undefined,
       ): void;
     }).on("tool_call", (event) => {
-      // Most tool calls are ordinary tracker/file work. Detect shape first so
-      // they do not re-read config or emit policy diagnostics.
-      const candidate = releaseDecision(DEFAULT_RELEASE_POLICY, event.toolName, event.input);
-      if (candidate === undefined) return undefined;
+      // Most tool calls are ordinary tracker/file work. Classify first so they
+      // do not re-read config or emit policy diagnostics.
+      const shape = releaseShapeFromTool(event.toolName, event.input);
+      if (shape === undefined) return undefined;
       let projectName: string | undefined;
-      let policy = DEFAULT_RELEASE_POLICY;
+      let grants: ResolvedGrants = DENIED_RELEASE_GRANTS;
       let external = true;
       try {
         const project = findProject(loadConfig());
         projectName = project.name;
-        policy = resolveReleasePolicy(project);
+        grants = resolveReleaseGrants(project);
         external = project.escalation.orchestrator === "external";
       } catch (err) {
         // A missing/unreadable config cannot open a release gate. Log only when
         // a release-shaped call actually reaches this handler.
         pi.logger.error(
-          `[omp-conductor] release policy unreadable; enforcing ${DEFAULT_RELEASE_POLICY}: ${
+          `[omp-conductor] release policy unreadable; denying every release shape: ${
             err instanceof Error ? err.message : String(err)
           }`,
         );
       }
-      if (releaseAuthorityAccepted && policy === "operator-brief") return undefined;
+      // Per shape since #122: a fleet may hold `git-tag` and still be refused
+      // `deploy`, so this asks about the shape in hand, not about one policy word.
+      const refusal = releaseRefusal(grants, "orchestrator", shape);
+      if (releaseAuthorityAccepted && refusal === undefined) return undefined;
       // Embedded orchestrators carry the same tripwire inline through
       // `createSession`; suppress this second copy only after this session has
       // proved it owns the external heartbeat.
       if (releaseAuthorityAccepted && !external) return undefined;
       if (projectName !== undefined) {
         try {
-          recordReleaseBlock(projectName, "orchestrator", candidate.shape);
+          recordReleaseBlock(projectName, "orchestrator", shape);
         } catch (err) {
           pi.logger.error(
             `[omp-conductor] could not record release-policy block: ${
@@ -1309,7 +1361,10 @@ export default function orchestratorTickExtension(pi: TickApi): void {
           );
         }
       }
-      return candidate.decision;
+      // Before ownership is proved this session holds no grant at all, so a
+      // covered shape still refuses — with the wording it would get from a
+      // deny-all map rather than a claim about a grant it cannot yet use.
+      return refusal ?? releaseRefusal(DENIED_RELEASE_GRANTS, "orchestrator", shape);
     });
   };
 
@@ -1352,6 +1407,24 @@ export default function orchestratorTickExtension(pi: TickApi): void {
 
     const config = result.config;
 
+    // Whether omp-telegram could have bound a token when this session started,
+    // which is a different question from whether one exists now and is the only
+    // one the approval preflight can honestly ask. The bridge resolves its token
+    // once, in `startBot()`, and rebinds only on `/telegram token` or
+    // `/telegram on` — so a token written into `.env` out-of-band leaves
+    // `telegram_ask` and `telegram_send` dead for the life of this session even
+    // though the file now looks perfect. Sampling here, next to the same
+    // `session_start` omp-telegram binds on, is as close as another package can
+    // get to that fact.
+    //
+    // Conservative on the other transition: an operator who ran `/telegram on`
+    // after start really does have a working bridge, and this snapshot will keep
+    // saying otherwise until the session restarts. That costs a fallback
+    // instruction the orchestrator can follow, where guessing the other way
+    // costs an amendment recorded as approved that nobody ever answered.
+    session.bridgeTokenAtStart =
+      config.accessFile === undefined ? true : bridgeTokenBound(config.accessFile);
+
     // Activation is a property of the directory, so every omp session started in
     // the fleet's cwd used to become a ticker — and with merge and release
     // delegated in config, a shell opened beside the orchestrator believed it

package/src/orchestrator.ts

@@ -31,10 +31,10 @@ import { join } from "node:path";
 
 import { stateDir } from "./config.ts";
 import { formatEscalation } from "./escalate.ts";
+import type { SessionBoundary } from "./credentials.ts";
 import { createSession, disposeSession } from "./omp.ts";
 import type { AgentSessionLike } from "./omp.ts";
-import type { ReleaseShape } from "./release-policy.ts";
-import type { Escalation, ReleasePolicy } from "./types.ts";
+import type { Escalation, ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
 /**
  * The session factory {@link startOrchestrator} uses. Named so the test seam
@@ -45,8 +45,13 @@ export type CreateSessionFn = (opts: {
   sessionDir?: string;
   model?: string;
   resume?: boolean;
-  releasePolicy?: ReleasePolicy;
+  role: SessionRole;
+  releaseGrants?: ResolvedGrants;
   onReleaseBlocked?: (shape: ReleaseShape) => void;
+  boundary?: SessionBoundary;
+  socketPath?: string;
+  verbSocketPath?: string;
+  onChildLog?: (line: string) => void;
 }) => Promise<AgentSessionLike>;
 
 /**
@@ -79,8 +84,25 @@ export interface OrchestratorOpts {
   cwd: string;
   sessionDir?: string;
   model?: string;
-  releasePolicy?: ReleasePolicy;
+  releaseGrants?: ResolvedGrants;
   onReleaseBlocked?: (shape: ReleaseShape) => void;
+  /**
+   * The OS principal this session runs as (#125). Its own, distinct from every
+   * worker slot: the orchestrator reads the state directory and its briefs, and
+   * must have no read or write access to any run checkout — a property the
+   * adversarial probe asserts rather than assumes.
+   */
+  boundary?: SessionBoundary;
+  /** Control socket for the session child. See {@link OrchestratorOpts.boundary}. */
+  socketPath?: string;
+  /**
+   * The orchestrator's own verb socket (#126) — a third, distinct one, never
+   * shared with a run. It is what makes "merge authority is the orchestrator's"
+   * a fact about the channel rather than a claim in a prompt.
+   */
+  verbSocketPath?: string;
+  /** Where the session child's stdout/stderr go. */
+  onChildLog?: (line: string) => void;
   /**
    * Standing orders — which repo, which labels, what the fleet is. Prepended to
    * the *first* injection rather than sent as its own prompt on startup: a
@@ -164,8 +186,13 @@ export async function startOrchestrator(o: OrchestratorOpts): Promise<Orchestrat
     cwd: o.cwd,
     sessionDir,
     ...(o.model === undefined ? {} : { model: o.model }),
-    ...(o.releasePolicy === undefined ? {} : { releasePolicy: o.releasePolicy }),
+    role: "orchestrator",
+    ...(o.releaseGrants === undefined ? {} : { releaseGrants: o.releaseGrants }),
     ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
+    ...(o.boundary === undefined ? {} : { boundary: o.boundary }),
+    ...(o.socketPath === undefined ? {} : { socketPath: o.socketPath }),
+    ...(o.verbSocketPath === undefined ? {} : { verbSocketPath: o.verbSocketPath }),
+    ...(o.onChildLog === undefined ? {} : { onChildLog: o.onChildLog }),
     // The whole point of a persistent orchestrator: a daemon restart must not
     // reset what it knows it has already escalated, or the first tick after a
     // deploy re-litigates every parked issue from scratch.

package/src/plugin.ts

@@ -22,6 +22,7 @@ import {
   writeMergedBrief,
 } from "./brief-upgrade.ts";
 import { configPath, expandHome, findProject, loadConfig, resolveCaps, saveConfig } from "./config.ts";
+import { mechanismSatisfies, probeHost } from "./credentials.ts";
 import { hostRamBytes, recommendedMaxWorkers } from "./host.ts";
 import {
   isPaused,
@@ -51,8 +52,12 @@ import {
 } from "./setup-host.ts";
 import {
   AMEND_AREAS,
+  BASE_FRESHNESS_CHOICES,
+  BEHIND_BASE_CHOICES,
+  DRAFT_POLICY_CHOICES,
   ORCHESTRATOR_BRIEF_NAME,
   POLICY_BRIEF_NAME,
+  RELEASE_REQUIREMENT_CHOICES,
   REPORT_SCOPE_CHOICES,
   SETUP_DEFAULTS,
   amendChoices,
@@ -76,13 +81,22 @@ import {
   type SetupAnswers,
 } from "./setup.ts";
 import {
+  BASE_FRESHNESS,
+  BEHIND_BASE_ACTIONS,
+  CREDENTIAL_ISOLATIONS,
   DEFAULT_CAPS,
+  DRAFT_POLICIES,
+  RELEASE_REQUIREMENTS,
+  RELEASE_SHAPES,
   type Caps,
+  type CredentialIsolation,
   type ConductorConfig,
   type OrchestratorMode,
   type ProjectConfig,
-  type ReleasePolicy,
+  type ProjectPolicy,
+  type ReleaseRequirement,
   type ReportScope,
+  type ResolvedGrants,
 } from "./types.ts";
 
 /**
@@ -319,6 +333,164 @@ async function askReportScope(ctx: CommandContext, current: ReportScope): Promis
   return choice.scope;
 }
 
+/**
+ * One value out of a closed vocabulary, described in the operator's words.
+ *
+ * A select rather than a confirm, and the cursor starts on the configured value
+ * so Enter re-affirms it — the contract every prompt here has. It cannot be a
+ * confirm: a precondition's safe answer is "keep requiring it", and this
+ * harness's confirms always start on no, so a re-run that Entered through them
+ * would quietly relax the gate it was meant to leave alone.
+ *
+ * The label *is* the config value, so the answer the harness hands back needs no
+ * lookup table that could disagree with the vocabulary it was built from.
+ */
+async function askLiteral<T extends string>(
+  ctx: CommandContext,
+  title: string,
+  values: readonly T[],
+  described: { readonly [K in T]: string },
+  current: T,
+): Promise<T> {
+  const at = values.findIndex((v) => v === current);
+  const picked = await ctx.ui.select(
+    title,
+    values.map((v) => ({ label: v, description: described[v] })),
+    { initialIndex: at === -1 ? 0 : at },
+  );
+  if (picked === undefined) throw new Cancelled();
+
+  const hit = values.find((v) => v === picked);
+  if (hit === undefined) {
+    // The harness answered with a label we never offered, which only happens if
+    // the dialog contract changed under us. Keeping the current value is the
+    // answer that changes nothing, and it is said out loud rather than assumed.
+    ctx.ui.notify(`Unrecognised choice "${picked}" — keeping "${current}".`, "warning");
+    return current;
+  }
+  return hit;
+}
+
+/** How an empty list is both shown and typed. A word, because a blank line in
+ *  this wizard means "accept what you see", not "clear it". */
+const EMPTY_LIST = "none";
+
+/** A name list as the prompt shows it and reads it back — one spelling, so the
+ *  pre-filled default and the value it round-trips to cannot drift. */
+function formatNameList(names: readonly string[]): string {
+  return names.length === 0 ? EMPTY_LIST : names.join(", ");
+}
+
+function parseNameList(answer: string): string[] {
+  if (answer.trim().toLowerCase() === EMPTY_LIST) return [];
+  return answer
+    .split(",")
+    .map((name) => name.trim())
+    .filter((name) => name.length > 0);
+}
+
+/** Check names, artefacts, environments: open-ended lists this package cannot
+ *  enumerate, so the only validation is the shape. */
+async function askNameList(ctx: CommandContext, title: string, seed: readonly string[]): Promise<string[]> {
+  return parseNameList(await ask(ctx, title, formatNameList(seed)));
+}
+
+/**
+ * The `requires` set, typed rather than picked one confirm at a time.
+ *
+ * Validated in the dialog against the same array the loader validates against,
+ * and the complaint names every accepted value — an operator who mistyped a
+ * requirement they believed they had set would otherwise find out from a release
+ * that went ahead without it.
+ */
+async function askReleaseRequirements(
+  ctx: CommandContext,
+  prior: readonly ReleaseRequirement[],
+): Promise<ReleaseRequirement[]> {
+  const accepted = RELEASE_REQUIREMENTS.join(", ");
+  // The vocabulary, spelled out where it is being asked for. Built from the same
+  // data the validator reads, so a fifth requirement is offered here the moment
+  // it exists rather than staying invisible to everyone who did not read #129.
+  ctx.ui.notify(
+    RELEASE_REQUIREMENTS.map((r) => `${r} — ${RELEASE_REQUIREMENT_CHOICES[r]}`).join("\n"),
+    "info",
+  );
+  const answered = await askValid(
+    ctx,
+    `Release — what must have landed first (any of ${accepted}, comma separated, or "${EMPTY_LIST}")`,
+    formatNameList(prior),
+    (value) => {
+      const unknown = parseNameList(value).filter((name) => !RELEASE_REQUIREMENTS.some((r) => r === name));
+      return unknown.length === 0 ? undefined : `Not a release requirement: ${unknown.join(", ")}. Accepted: ${accepted}.`;
+    },
+  );
+
+  const chosen = new Set(parseNameList(answered));
+  // The vocabulary's order, not the operator's: two fleets that require the same
+  // three things must read identically in the plan and in a refusal.
+  return RELEASE_REQUIREMENTS.filter((r) => chosen.has(r));
+}
+
+/**
+ * The gating conditions #126's verbs read (#129).
+ *
+ * Asked here rather than left to a hand-edit because the whole point of moving
+ * them out of POLICY.md is that they are config: a condition an operator can
+ * only reach by opening `config.json` is one that stays at its default while
+ * their prose says something else, which is the drift this key ended.
+ */
+async function askPolicyPreconditions(ctx: CommandContext, prior: ProjectPolicy): Promise<ProjectPolicy> {
+  const merge = {
+    requiredChecks: await askNameList(
+      ctx,
+      `Merge — required checks (comma separated, "${EMPTY_LIST}" = every check the PR reports)`,
+      prior.merge.requiredChecks,
+    ),
+    baseFreshness: await askLiteral(
+      ctx,
+      "Merge — must the PR be level with its base?",
+      BASE_FRESHNESS,
+      BASE_FRESHNESS_CHOICES,
+      prior.merge.baseFreshness,
+    ),
+    drafts: await askLiteral(
+      ctx,
+      "Merge — draft pull requests",
+      DRAFT_POLICIES,
+      DRAFT_POLICY_CHOICES,
+      prior.merge.drafts,
+    ),
+    whenBehindBase: await askLiteral(
+      ctx,
+      "Merge — a green PR that fell behind its base",
+      BEHIND_BASE_ACTIONS,
+      BEHIND_BASE_CHOICES,
+      prior.merge.whenBehindBase,
+    ),
+  };
+
+  const release = {
+    requires: await askReleaseRequirements(ctx, prior.release.requires),
+    requiredChecks: await askNameList(
+      ctx,
+      `Release — required checks (comma separated, "${EMPTY_LIST}" = every check the branch reports)`,
+      prior.release.requiredChecks,
+    ),
+    artefacts: await askNameList(
+      ctx,
+      `Release — artefacts this project ships (comma separated, or "${EMPTY_LIST}")`,
+      prior.release.artefacts,
+    ),
+    environments: await askNameList(
+      ctx,
+      `Release — environments a deploy may target (comma separated, or "${EMPTY_LIST}")`,
+      prior.release.environments,
+    ),
+  };
+
+  return { merge, release };
+}
+
 /**
  * Who merges and who releases. Two confirms rather than one four-way list:
  * these are independent grants — delegating merges is routine, delegating
@@ -349,18 +521,53 @@ async function askAuthority(
   return { merge: merge ? "orchestrator" : "human", release: release ? "orchestrator" : "human" };
 }
 
-async function askReleasePolicy(
+/**
+ * What each shape means to the operator being asked about it, in their words
+ * rather than the classifier's. Declared as data over the closed enum so a sixth
+ * shape cannot be added without a question to ask about it — an unasked shape
+ * would silently take the deny default and read as a decision afterwards.
+ *
+ * No fleet vocabulary here on purpose (#122): every one of these is an act the
+ * package can recognise anywhere, not a step in one project's release topology.
+ */
+const RELEASE_SHAPE_QUESTIONS: { readonly [K in (typeof RELEASE_SHAPES)[number]]: string } = {
+  "git-tag": "create git tags (`git tag v1.2.3`)",
+  "git-push-tags": "push tags to the remote (`git push --follow-tags`)",
+  "package-publish": "publish packages (`npm publish` and equivalents)",
+  "github-release": "create GitHub releases (`gh release create`)",
+  deploy:
+    "deploy — change what is running: kubectl/helm/terraform, a deploy device call, a rollout. " +
+    "This is the one grant that mutates a live environment rather than producing an artifact",
+};
+
+/**
+ * The mechanical tool gate, one confirm per shape.
+ *
+ * One binary question used to cover all five, which is how #122 happened: an
+ * operator who meant "it may cut a release" also granted "it may deploy to
+ * production", because there was one switch for both. Asking five times is the
+ * point — each answer is a different blast radius.
+ *
+ * No confirm can start on "yes", so a re-run that Enters through the wizard
+ * revokes rather than renews. The current grant is named in the question, so
+ * that revoke is never a surprise.
+ */
+async function askReleaseGrants(
   ctx: CommandContext,
-  prior: ReleasePolicy,
-): Promise<ReleasePolicy> {
-  const open = await ctx.ui.confirm(
-    "Release tool gate",
-    "Allow worker and orchestrator sessions to invoke release/deploy-shaped tools? Only enable this " +
-      "when the operator brief contains the release procedure they must follow. Default: no, block " +
-      "git tags, tag pushes, package publishing, GitHub release creation and deploy commands" +
-      `${prior === "operator-brief" ? " — currently enabled, answer no to close it" : ""}.`,
-  );
-  return open ? "operator-brief" : "none";
+  prior: ResolvedGrants,
+): Promise<ResolvedGrants> {
+  const grants = { ...prior };
+  for (const shape of RELEASE_SHAPES) {
+    const open = await ctx.ui.confirm(
+      `Release tool gate — ${shape}`,
+      `Allow the orchestrator session to ${RELEASE_SHAPE_QUESTIONS[shape]}? Grant this only when the ` +
+        "operator brief carries the procedure it must follow. A worker session is refused this " +
+        "whatever you answer. Default: no" +
+        `${prior[shape] === "orchestrator" ? " — currently granted, answer no to take it back" : ""}.`,
+    );
+    grants[shape] = open ? "orchestrator" : "human";
+  }
+  return grants;
 }
 
 /**
@@ -647,14 +854,55 @@ const askWorkerModel: AreaAsker = async (ctx, a) => {
   return next;
 };
 
-/** Both grants, asked together because they are the two questions that decide
- *  what an unattended fleet may do without asking anybody. */
+/** The two ownership questions, then the mechanical gate one shape at a time:
+ *  together they are what decides what an unattended fleet may do unasked. */
 const askAuthorityArea: AreaAsker = async (ctx, a) => ({
   ...a,
   authority: await askAuthority(ctx, a.authority),
-  releasePolicy: await askReleasePolicy(ctx, a.releasePolicy),
+  releaseGrants: await askReleaseGrants(ctx, a.releaseGrants),
 });
 
+/** What a merge and a release must satisfy. Asked straight after the grants:
+ *  who may act, then under what conditions (#129). */
+const askPolicy: AreaAsker = async (ctx, a) => ({ ...a, policy: await askPolicyPreconditions(ctx, a.policy) });
+
+/**
+ * Whether model-executed code gets its own OS principal (#125).
+ *
+ * The host is probed before the question is asked, and the answer the box can
+ * actually honour is named in the option itself. That matters because the two
+ * failure modes are asymmetric: choosing `none` gets a fleet that dispatches
+ * and is unprotected, while choosing `per-run` on a host with no mechanism gets
+ * a fleet that refuses every issue. An operator should not have to discover
+ * which one they picked by watching the queue stall.
+ */
+const askCredentials: AreaAsker = async (ctx, a) => {
+  const probe = await probeHost({ slots: a.caps.maxConcurrentWorkers ?? DEFAULT_CAPS.maxConcurrentWorkers });
+  // Each option says whether THIS host can honour it, asked of the same
+  // predicate the dispatch gate uses, so the wizard cannot promise a boundary
+  // the daemon will then refuse to build.
+  const offer = (isolation: CredentialIsolation, claim: string): string =>
+    mechanismSatisfies(isolation, probe.mechanism)
+      ? `${claim} — this host can build it with ${probe.mechanism}`
+      : `${claim} — UNAVAILABLE here (${probe.reasons.join("; ") || "no mechanism found"}); dispatch would refuse every issue`;
+  const described: { readonly [K in CredentialIsolation]: string } = {
+    "per-run": offer("per-run", "each session runs under its own OS principal; it cannot reach the daemon's credentials"),
+    "group-mode": offer(
+      "group-mode",
+      "same uid as the daemon, cross-run separation by group and mode only; bounds accidents, does NOT contain a bash escape",
+    ),
+    none: "sessions run as the daemon's user; env scrubbing only, which same-uid code defeats in one line",
+  };
+  const isolation = await askLiteral(
+    ctx,
+    "Credential isolation for worker and orchestrator sessions",
+    CREDENTIAL_ISOLATIONS,
+    described,
+    a.credentials.isolation,
+  );
+  return { ...a, credentials: { ...a.credentials, isolation } };
+};
+
 /** How a stuck run reaches a human, and who triages it when it does. */
 const askEscalation: AreaAsker = async (ctx, a) => {
   const telegram = detectTelegram();
@@ -710,6 +958,8 @@ const AREA_ASKERS: { readonly [K in AmendAreaId]: AreaAsker } = {
   caps: async (ctx, a) => await askWorkerModel(ctx, await askCaps(ctx, a)),
   graph: askGraph,
   authority: askAuthorityArea,
+  policy: askPolicy,
+  credentials: askCredentials,
   escalation: askEscalation,
   reporting: askReporting,
   brief: askBrief,
@@ -799,6 +1049,8 @@ async function collectAnswers(
   a = await askGraph(ctx, a);
   a = await askCaps(ctx, a);
   a = await askAuthorityArea(ctx, a);
+  a = await askPolicy(ctx, a);
+  a = await askCredentials(ctx, a);
   a = await askWorkerModel(ctx, a);
   a = await askEscalation(ctx, a);
   a = await askReporting(ctx, a);