omp-conductor 0.3.24 → 0.4.0

package/src/cli.ts

@@ -6,6 +6,7 @@
  * cannot drift apart.
  */
 import { closeSync, openSync, readFileSync, readSync, statSync } from "node:fs";
+import { userInfo } from "node:os";
 import { dirname, join } from "node:path";
 import { runBoard } from "./board.ts";
 import {
@@ -21,7 +22,8 @@ import {
   repairPolicyBannerCrumbs,
   writeMergedBrief,
 } from "./brief-upgrade.ts";
-import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
+import { findProject, loadConfig, resolveCaps, sharedRoot, stateDir } from "./config.ts";
+import { boundarySetupScript } from "./credentials.ts";
 import { runDaemon, setPaused } from "./daemon.ts";
 import {
   armTicks,
@@ -45,6 +47,7 @@ import {
   writeRecord,
 } from "./lifecycle.ts";
 import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
+import { digestDedupeKey } from "./reports.ts";
 import {
   briefPathForProject,
   policyPathForProject,
@@ -54,8 +57,10 @@ import {
 } from "./setup.ts";
 import { dbPath, LIVE_STATES, openStore } from "./store.ts";
 import { formatTranscriptLine } from "./transcript.ts";
+import { formatVerbLedgerEntry } from "./verbs/ledger.ts";
 import { makeTracker } from "./tracker/github.ts";
-import type { ProjectConfig } from "./types.ts";
+import { REPORT_KINDS } from "./types.ts";
+import type { ProjectConfig, ReportKind } from "./types.ts";
 import { formatUnblock, unblockIssue } from "./unblock.ts";
 import { upgradeConductor } from "./upgrade.ts";
 
@@ -87,6 +92,7 @@ usage:
   omp-conductor upgrade [--to VERSION] [--project NAME]
   omp-conductor board [--project NAME]
   omp-conductor status [--project NAME]
+  omp-conductor ledger [--issue N] [--limit N] [--project NAME]
   omp-conductor hold [--project NAME]
   omp-conductor halt [--pane] [--project NAME]
   omp-conductor arm [--project NAME]
@@ -94,13 +100,14 @@ usage:
   omp-conductor release-pane [--project NAME]
   omp-conductor tail <issue> [--project NAME]
   omp-conductor extend <issue> --turns N [--project NAME]
-  omp-conductor unblock <issue> [--project NAME]
+  omp-conductor unblock <issue> [--force] [--project NAME]
   omp-conductor daemon [--once] [--port N] [--project NAME]
   omp-conductor pause
   omp-conductor resume
   omp-conductor graph-setup [--project NAME] [--write]
   omp-conductor brief-upgrade [--migrate|--retrofit] [--apply] [--file PATH] [--project NAME]
   omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
+  omp-conductor report --text TEXT [--kind material|digest] [--project NAME]
   omp-conductor help
 
   upgrade  update the Bun-global CLI, omp plugin, Herdr recovery plugin, and
@@ -124,6 +131,11 @@ usage:
   board    open the live keyboard-driven fleet board. It renders queue holds,
            every run lifecycle stage, recent merges, spend and health; Enter
            follows a selected transcript without leaving the board.
+  ledger   every conductor-verb call and how the daemon decided it: the verb,
+           the arguments, allow or refuse, the named refusal reason, and the
+           resulting sha. Sessions cannot push, open, merge, label or release
+           except through those verbs, so this is the record of what they tried
+           as well as what they did. --issue narrows it to one issue's run.
   hold     soft stop: pause claiming AND disarm ticks. Daemon and pane stay up.
            This is "stop the conductor overnight" without killing processes.
   halt     hold, then stop the dispatch daemon (systemctl-aware). Pane stays up
@@ -150,6 +162,15 @@ usage:
            and why the brief's "never hand-edit a state label" rule can stay
            absolute. Run history is kept; answered blocks consume the separate
            operational-continuation budget, not failed implementation attempts.
+           Refuses when the newest attempt's work could not be committed and
+           its worktree is the only copy: re-claiming removes that tree. Use
+           --force once you have recovered it or accepted the loss.
+  report   hand a rendered report to the daemon's durable outbox. The report is
+           persisted before anything is sent, delivered by the daemon with
+           bounded retries, and shown by status until it lands. Delivery is
+           at-least-once: a crash mid-send is retried and the retry says it may
+           be a repeat. --kind digest is accepted at most once per local day,
+           decided from the ledger rather than from what you remember sending.
   friction record a bounded observation the daemon cannot classify itself:
            an escalation that belonged in a digest, or a tick report that was
            noise/surprising. Repeated observations feed the existing Learning
@@ -508,6 +529,91 @@ try {
       break;
     }
 
+    case "boundary-setup": {
+      // Printed, never executed: it creates system accounts, so it is the
+      // operator's `sudo` and their chance to read it first — same posture as
+      // `graph-setup`. Generated from the same constants the probe checks, so
+      // the instructions cannot drift from what the daemon then demands (#125).
+      //
+      // Nothing is read from the config unless a flag was omitted, and that is
+      // the point rather than an optimisation: per-run provisioning has to
+      // happen BEFORE `setup`, because setup writes worktree and mirror paths
+      // into the privileged shared root this command creates. Loading the
+      // config unconditionally would be a bootstrap cycle — provision needs a
+      // config, the config needs the provisioned root.
+      const slotsFlag = flag(argv, "slots");
+      let slots: number;
+      if (slotsFlag === undefined) {
+        const cfg = loadConfig();
+        slots = resolveCaps(findProject(cfg, flag(argv, "project")), cfg.defaults).maxConcurrentWorkers;
+      } else if (/^\d+$/.test(slotsFlag) && Number.parseInt(slotsFlag, 10) >= 1) {
+        // Whole string, not a prefix: `parseInt("2workers")` is 2, and silently
+        // provisioning a different pool than the operator typed is worse than
+        // refusing.
+        slots = Number.parseInt(slotsFlag, 10);
+      } else {
+        console.error(`boundary-setup: --slots must be a positive integer, got ${JSON.stringify(slotsFlag)}`);
+        process.exitCode = 2;
+        break;
+      }
+      // Both explicit where given, because neither can be inferred safely here.
+      // Under `sudo` the invoking user is root, so `userInfo()` would provision
+      // the wrong account and hand the daemon group to root; and the shared
+      // root must be the *same* string the daemon later resolves, not one
+      // derived from however this process happened to be invoked.
+      const daemonUser = flag(argv, "daemon-user") ?? process.env["SUDO_USER"] ?? userInfo().username;
+      const root = flag(argv, "shared-root") ?? sharedRoot();
+      process.stdout.write(boundarySetupScript({ slots, sharedRoot: root, daemonUser }));
+      break;
+    }
+    /**
+     * The action ledger (#126): every conductor-verb call, what it asked for,
+     * and how the daemon decided it.
+     *
+     * Its own command as well as a block in `status`, because the two questions
+     * are different sizes. `status` answers "is anything being refused right
+     * now"; this answers "what did run 3 actually try to do", which is the
+     * question an escalation about a run asks, and it needs the whole record
+     * rather than the newest five lines of every run at once.
+     */
+    case "ledger": {
+      const cfg = loadConfig();
+      const p = findProject(cfg, flag(argv, "project"));
+      const issueFlag = flag(argv, "issue");
+      const issue = issueFlag === undefined ? undefined : issueArg("ledger", issueFlag);
+      const limitFlag = flag(argv, "limit");
+      const limit = limitFlag === undefined ? 50 : Number.parseInt(limitFlag, 10);
+      if (!Number.isSafeInteger(limit) || limit < 1) {
+        process.stderr.write(`omp-conductor: ledger --limit needs a positive integer, got "${limitFlag ?? ""}"\n`);
+        process.exitCode = 1;
+        break;
+      }
+      // Read-only, WAL, same as `tail`: this never contends with the daemon
+      // writing the rows it is printing.
+      const store = openStore(dbPath());
+      try {
+        const entries = store.verbLedger(p.name, {
+          ...(issue === undefined ? {} : { issue }),
+          limit,
+        });
+        if (entries.length === 0) {
+          process.stdout.write(
+            `no conductor-verb calls recorded for ${p.name}` +
+              `${issue === undefined ? "" : ` on #${String(issue)}`}\n`,
+          );
+          break;
+        }
+        const refused = entries.filter((e) => e.decision === "refused").length;
+        process.stdout.write(
+          `${p.name} — ${entries.length} verb call(s), ${refused} refused (newest first)\n` +
+            `${entries.flatMap(formatVerbLedgerEntry).join("\n")}\n`,
+        );
+      } finally {
+        store.close();
+      }
+      break;
+    }
+
     case "board":
       await runBoard(flag(argv, "project"));
       break;
@@ -636,8 +742,62 @@ try {
       const project = findProject(cfg, flag(argv, "project"));
       const store = openStore(dbPath());
       try {
-        const outcome = await unblockIssue(project, makeTracker(project), store, issue);
+        const outcome = await unblockIssue(project, makeTracker(project), store, issue, {
+          force: argv.includes("--force"),
+        });
         process.stdout.write(`${formatUnblock(issue, outcome, project, resolveCaps(project, cfg.defaults))}\n`);
+        // A refusal must not read as success to a script or a board keypress.
+        if (outcome.refused !== undefined) process.exitCode = 3;
+      } finally {
+        store.close();
+      }
+      break;
+    }
+
+    /**
+     * The handover point. Authorship stays with the model; from here the daemon
+     * owns delivery, so "I sent the report" stops being a claim the model makes
+     * about a tool call it may never have run and becomes a row anyone can read
+     * back out of the store (#123).
+     */
+    case "report": {
+      const rawText = flag(argv, "text");
+      const body = rawText?.trim();
+      if (body === undefined || body.length === 0 || rawText?.startsWith("--") === true) {
+        process.stderr.write("omp-conductor: report needs --text with the rendered report\n");
+        process.exit(2);
+      }
+      const rawKind = flag(argv, "kind") ?? "material";
+      // Fail closed on an unknown kind rather than defaulting to `material`: a
+      // typo'd `--kind diggest` that silently became a material report would
+      // bypass the daily-digest guard, which is the one thing the kind is for.
+      if (!(REPORT_KINDS as readonly string[]).includes(rawKind)) {
+        process.stderr.write(
+          `omp-conductor: report --kind must be one of: ${REPORT_KINDS.join(", ")}\n`,
+        );
+        process.exit(2);
+      }
+      const kind = rawKind as ReportKind;
+      const project = findProject(loadConfig(), flag(argv, "project"));
+      const store = openStore(dbPath());
+      try {
+        const at = Date.now();
+        const { report, deduped } = store.enqueueReport({
+          project: project.name,
+          kind,
+          body,
+          // Only the digest is at-most-once. A material report describes one
+          // event as it happens, and two of those in a day are two events.
+          ...(kind === "digest" ? { dedupeKey: digestDedupeKey(at) } : {}),
+          at,
+        });
+        process.stdout.write(
+          deduped
+            ? `today's digest was already handed over as report ${report.id} (${report.state}) — nothing queued\n` +
+                "the ledger decides this, not your memory of the last tick; use --kind material for a second event\n"
+            : `report ${report.id} queued for ${project.name} (${kind})\n` +
+                "the daemon owns delivery from here; omp-conductor status shows it until it lands\n",
+        );
       } finally {
         store.close();
       }