omp-conductor 0.3.25 → 0.4.0

package/src/orchestrator.ts

@@ -31,10 +31,10 @@ import { join } from "node:path";
 
 import { stateDir } from "./config.ts";
 import { formatEscalation } from "./escalate.ts";
+import type { SessionBoundary } from "./credentials.ts";
 import { createSession, disposeSession } from "./omp.ts";
 import type { AgentSessionLike } from "./omp.ts";
-import type { ReleaseShape } from "./release-policy.ts";
-import type { Escalation, ReleasePolicy } from "./types.ts";
+import type { Escalation, ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
 /**
  * The session factory {@link startOrchestrator} uses. Named so the test seam
@@ -45,8 +45,13 @@ export type CreateSessionFn = (opts: {
   sessionDir?: string;
   model?: string;
   resume?: boolean;
-  releasePolicy?: ReleasePolicy;
+  role: SessionRole;
+  releaseGrants?: ResolvedGrants;
   onReleaseBlocked?: (shape: ReleaseShape) => void;
+  boundary?: SessionBoundary;
+  socketPath?: string;
+  verbSocketPath?: string;
+  onChildLog?: (line: string) => void;
 }) => Promise<AgentSessionLike>;
 
 /**
@@ -79,8 +84,25 @@ export interface OrchestratorOpts {
   cwd: string;
   sessionDir?: string;
   model?: string;
-  releasePolicy?: ReleasePolicy;
+  releaseGrants?: ResolvedGrants;
   onReleaseBlocked?: (shape: ReleaseShape) => void;
+  /**
+   * The OS principal this session runs as (#125). Its own, distinct from every
+   * worker slot: the orchestrator reads the state directory and its briefs, and
+   * must have no read or write access to any run checkout — a property the
+   * adversarial probe asserts rather than assumes.
+   */
+  boundary?: SessionBoundary;
+  /** Control socket for the session child. See {@link OrchestratorOpts.boundary}. */
+  socketPath?: string;
+  /**
+   * The orchestrator's own verb socket (#126) — a third, distinct one, never
+   * shared with a run. It is what makes "merge authority is the orchestrator's"
+   * a fact about the channel rather than a claim in a prompt.
+   */
+  verbSocketPath?: string;
+  /** Where the session child's stdout/stderr go. */
+  onChildLog?: (line: string) => void;
   /**
    * Standing orders — which repo, which labels, what the fleet is. Prepended to
    * the *first* injection rather than sent as its own prompt on startup: a
@@ -164,8 +186,13 @@ export async function startOrchestrator(o: OrchestratorOpts): Promise<Orchestrat
     cwd: o.cwd,
     sessionDir,
     ...(o.model === undefined ? {} : { model: o.model }),
-    ...(o.releasePolicy === undefined ? {} : { releasePolicy: o.releasePolicy }),
+    role: "orchestrator",
+    ...(o.releaseGrants === undefined ? {} : { releaseGrants: o.releaseGrants }),
     ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
+    ...(o.boundary === undefined ? {} : { boundary: o.boundary }),
+    ...(o.socketPath === undefined ? {} : { socketPath: o.socketPath }),
+    ...(o.verbSocketPath === undefined ? {} : { verbSocketPath: o.verbSocketPath }),
+    ...(o.onChildLog === undefined ? {} : { onChildLog: o.onChildLog }),
     // The whole point of a persistent orchestrator: a daemon restart must not
     // reset what it knows it has already escalated, or the first tick after a
     // deploy re-litigates every parked issue from scratch.

package/src/plugin.ts

@@ -22,6 +22,7 @@ import {
   writeMergedBrief,
 } from "./brief-upgrade.ts";
 import { configPath, expandHome, findProject, loadConfig, resolveCaps, saveConfig } from "./config.ts";
+import { mechanismSatisfies, probeHost } from "./credentials.ts";
 import { hostRamBytes, recommendedMaxWorkers } from "./host.ts";
 import {
   isPaused,
@@ -51,8 +52,12 @@ import {
 } from "./setup-host.ts";
 import {
   AMEND_AREAS,
+  BASE_FRESHNESS_CHOICES,
+  BEHIND_BASE_CHOICES,
+  DRAFT_POLICY_CHOICES,
   ORCHESTRATOR_BRIEF_NAME,
   POLICY_BRIEF_NAME,
+  RELEASE_REQUIREMENT_CHOICES,
   REPORT_SCOPE_CHOICES,
   SETUP_DEFAULTS,
   amendChoices,
@@ -76,13 +81,22 @@ import {
   type SetupAnswers,
 } from "./setup.ts";
 import {
+  BASE_FRESHNESS,
+  BEHIND_BASE_ACTIONS,
+  CREDENTIAL_ISOLATIONS,
   DEFAULT_CAPS,
+  DRAFT_POLICIES,
+  RELEASE_REQUIREMENTS,
+  RELEASE_SHAPES,
   type Caps,
+  type CredentialIsolation,
   type ConductorConfig,
   type OrchestratorMode,
   type ProjectConfig,
-  type ReleasePolicy,
+  type ProjectPolicy,
+  type ReleaseRequirement,
   type ReportScope,
+  type ResolvedGrants,
 } from "./types.ts";
 
 /**
@@ -319,6 +333,164 @@ async function askReportScope(ctx: CommandContext, current: ReportScope): Promis
   return choice.scope;
 }
 
+/**
+ * One value out of a closed vocabulary, described in the operator's words.
+ *
+ * A select rather than a confirm, and the cursor starts on the configured value
+ * so Enter re-affirms it — the contract every prompt here has. It cannot be a
+ * confirm: a precondition's safe answer is "keep requiring it", and this
+ * harness's confirms always start on no, so a re-run that Entered through them
+ * would quietly relax the gate it was meant to leave alone.
+ *
+ * The label *is* the config value, so the answer the harness hands back needs no
+ * lookup table that could disagree with the vocabulary it was built from.
+ */
+async function askLiteral<T extends string>(
+  ctx: CommandContext,
+  title: string,
+  values: readonly T[],
+  described: { readonly [K in T]: string },
+  current: T,
+): Promise<T> {
+  const at = values.findIndex((v) => v === current);
+  const picked = await ctx.ui.select(
+    title,
+    values.map((v) => ({ label: v, description: described[v] })),
+    { initialIndex: at === -1 ? 0 : at },
+  );
+  if (picked === undefined) throw new Cancelled();
+
+  const hit = values.find((v) => v === picked);
+  if (hit === undefined) {
+    // The harness answered with a label we never offered, which only happens if
+    // the dialog contract changed under us. Keeping the current value is the
+    // answer that changes nothing, and it is said out loud rather than assumed.
+    ctx.ui.notify(`Unrecognised choice "${picked}" — keeping "${current}".`, "warning");
+    return current;
+  }
+  return hit;
+}
+
+/** How an empty list is both shown and typed. A word, because a blank line in
+ *  this wizard means "accept what you see", not "clear it". */
+const EMPTY_LIST = "none";
+
+/** A name list as the prompt shows it and reads it back — one spelling, so the
+ *  pre-filled default and the value it round-trips to cannot drift. */
+function formatNameList(names: readonly string[]): string {
+  return names.length === 0 ? EMPTY_LIST : names.join(", ");
+}
+
+function parseNameList(answer: string): string[] {
+  if (answer.trim().toLowerCase() === EMPTY_LIST) return [];
+  return answer
+    .split(",")
+    .map((name) => name.trim())
+    .filter((name) => name.length > 0);
+}
+
+/** Check names, artefacts, environments: open-ended lists this package cannot
+ *  enumerate, so the only validation is the shape. */
+async function askNameList(ctx: CommandContext, title: string, seed: readonly string[]): Promise<string[]> {
+  return parseNameList(await ask(ctx, title, formatNameList(seed)));
+}
+
+/**
+ * The `requires` set, typed rather than picked one confirm at a time.
+ *
+ * Validated in the dialog against the same array the loader validates against,
+ * and the complaint names every accepted value — an operator who mistyped a
+ * requirement they believed they had set would otherwise find out from a release
+ * that went ahead without it.
+ */
+async function askReleaseRequirements(
+  ctx: CommandContext,
+  prior: readonly ReleaseRequirement[],
+): Promise<ReleaseRequirement[]> {
+  const accepted = RELEASE_REQUIREMENTS.join(", ");
+  // The vocabulary, spelled out where it is being asked for. Built from the same
+  // data the validator reads, so a fifth requirement is offered here the moment
+  // it exists rather than staying invisible to everyone who did not read #129.
+  ctx.ui.notify(
+    RELEASE_REQUIREMENTS.map((r) => `${r} — ${RELEASE_REQUIREMENT_CHOICES[r]}`).join("\n"),
+    "info",
+  );
+  const answered = await askValid(
+    ctx,
+    `Release — what must have landed first (any of ${accepted}, comma separated, or "${EMPTY_LIST}")`,
+    formatNameList(prior),
+    (value) => {
+      const unknown = parseNameList(value).filter((name) => !RELEASE_REQUIREMENTS.some((r) => r === name));
+      return unknown.length === 0 ? undefined : `Not a release requirement: ${unknown.join(", ")}. Accepted: ${accepted}.`;
+    },
+  );
+
+  const chosen = new Set(parseNameList(answered));
+  // The vocabulary's order, not the operator's: two fleets that require the same
+  // three things must read identically in the plan and in a refusal.
+  return RELEASE_REQUIREMENTS.filter((r) => chosen.has(r));
+}
+
+/**
+ * The gating conditions #126's verbs read (#129).
+ *
+ * Asked here rather than left to a hand-edit because the whole point of moving
+ * them out of POLICY.md is that they are config: a condition an operator can
+ * only reach by opening `config.json` is one that stays at its default while
+ * their prose says something else, which is the drift this key ended.
+ */
+async function askPolicyPreconditions(ctx: CommandContext, prior: ProjectPolicy): Promise<ProjectPolicy> {
+  const merge = {
+    requiredChecks: await askNameList(
+      ctx,
+      `Merge — required checks (comma separated, "${EMPTY_LIST}" = every check the PR reports)`,
+      prior.merge.requiredChecks,
+    ),
+    baseFreshness: await askLiteral(
+      ctx,
+      "Merge — must the PR be level with its base?",
+      BASE_FRESHNESS,
+      BASE_FRESHNESS_CHOICES,
+      prior.merge.baseFreshness,
+    ),
+    drafts: await askLiteral(
+      ctx,
+      "Merge — draft pull requests",
+      DRAFT_POLICIES,
+      DRAFT_POLICY_CHOICES,
+      prior.merge.drafts,
+    ),
+    whenBehindBase: await askLiteral(
+      ctx,
+      "Merge — a green PR that fell behind its base",
+      BEHIND_BASE_ACTIONS,
+      BEHIND_BASE_CHOICES,
+      prior.merge.whenBehindBase,
+    ),
+  };
+
+  const release = {
+    requires: await askReleaseRequirements(ctx, prior.release.requires),
+    requiredChecks: await askNameList(
+      ctx,
+      `Release — required checks (comma separated, "${EMPTY_LIST}" = every check the branch reports)`,
+      prior.release.requiredChecks,
+    ),
+    artefacts: await askNameList(
+      ctx,
+      `Release — artefacts this project ships (comma separated, or "${EMPTY_LIST}")`,
+      prior.release.artefacts,
+    ),
+    environments: await askNameList(
+      ctx,
+      `Release — environments a deploy may target (comma separated, or "${EMPTY_LIST}")`,
+      prior.release.environments,
+    ),
+  };
+
+  return { merge, release };
+}
+
 /**
  * Who merges and who releases. Two confirms rather than one four-way list:
  * these are independent grants — delegating merges is routine, delegating
@@ -349,18 +521,53 @@ async function askAuthority(
   return { merge: merge ? "orchestrator" : "human", release: release ? "orchestrator" : "human" };
 }
 
-async function askReleasePolicy(
+/**
+ * What each shape means to the operator being asked about it, in their words
+ * rather than the classifier's. Declared as data over the closed enum so a sixth
+ * shape cannot be added without a question to ask about it — an unasked shape
+ * would silently take the deny default and read as a decision afterwards.
+ *
+ * No fleet vocabulary here on purpose (#122): every one of these is an act the
+ * package can recognise anywhere, not a step in one project's release topology.
+ */
+const RELEASE_SHAPE_QUESTIONS: { readonly [K in (typeof RELEASE_SHAPES)[number]]: string } = {
+  "git-tag": "create git tags (`git tag v1.2.3`)",
+  "git-push-tags": "push tags to the remote (`git push --follow-tags`)",
+  "package-publish": "publish packages (`npm publish` and equivalents)",
+  "github-release": "create GitHub releases (`gh release create`)",
+  deploy:
+    "deploy — change what is running: kubectl/helm/terraform, a deploy device call, a rollout. " +
+    "This is the one grant that mutates a live environment rather than producing an artifact",
+};
+
+/**
+ * The mechanical tool gate, one confirm per shape.
+ *
+ * One binary question used to cover all five, which is how #122 happened: an
+ * operator who meant "it may cut a release" also granted "it may deploy to
+ * production", because there was one switch for both. Asking five times is the
+ * point — each answer is a different blast radius.
+ *
+ * No confirm can start on "yes", so a re-run that Enters through the wizard
+ * revokes rather than renews. The current grant is named in the question, so
+ * that revoke is never a surprise.
+ */
+async function askReleaseGrants(
   ctx: CommandContext,
-  prior: ReleasePolicy,
-): Promise<ReleasePolicy> {
-  const open = await ctx.ui.confirm(
-    "Release tool gate",
-    "Allow worker and orchestrator sessions to invoke release/deploy-shaped tools? Only enable this " +
-      "when the operator brief contains the release procedure they must follow. Default: no, block " +
-      "git tags, tag pushes, package publishing, GitHub release creation and deploy commands" +
-      `${prior === "operator-brief" ? " — currently enabled, answer no to close it" : ""}.`,
-  );
-  return open ? "operator-brief" : "none";
+  prior: ResolvedGrants,
+): Promise<ResolvedGrants> {
+  const grants = { ...prior };
+  for (const shape of RELEASE_SHAPES) {
+    const open = await ctx.ui.confirm(
+      `Release tool gate — ${shape}`,
+      `Allow the orchestrator session to ${RELEASE_SHAPE_QUESTIONS[shape]}? Grant this only when the ` +
+        "operator brief carries the procedure it must follow. A worker session is refused this " +
+        "whatever you answer. Default: no" +
+        `${prior[shape] === "orchestrator" ? " — currently granted, answer no to take it back" : ""}.`,
+    );
+    grants[shape] = open ? "orchestrator" : "human";
+  }
+  return grants;
 }
 
 /**
@@ -647,14 +854,55 @@ const askWorkerModel: AreaAsker = async (ctx, a) => {
   return next;
 };
 
-/** Both grants, asked together because they are the two questions that decide
- *  what an unattended fleet may do without asking anybody. */
+/** The two ownership questions, then the mechanical gate one shape at a time:
+ *  together they are what decides what an unattended fleet may do unasked. */
 const askAuthorityArea: AreaAsker = async (ctx, a) => ({
   ...a,
   authority: await askAuthority(ctx, a.authority),
-  releasePolicy: await askReleasePolicy(ctx, a.releasePolicy),
+  releaseGrants: await askReleaseGrants(ctx, a.releaseGrants),
 });
 
+/** What a merge and a release must satisfy. Asked straight after the grants:
+ *  who may act, then under what conditions (#129). */
+const askPolicy: AreaAsker = async (ctx, a) => ({ ...a, policy: await askPolicyPreconditions(ctx, a.policy) });
+
+/**
+ * Whether model-executed code gets its own OS principal (#125).
+ *
+ * The host is probed before the question is asked, and the answer the box can
+ * actually honour is named in the option itself. That matters because the two
+ * failure modes are asymmetric: choosing `none` gets a fleet that dispatches
+ * and is unprotected, while choosing `per-run` on a host with no mechanism gets
+ * a fleet that refuses every issue. An operator should not have to discover
+ * which one they picked by watching the queue stall.
+ */
+const askCredentials: AreaAsker = async (ctx, a) => {
+  const probe = await probeHost({ slots: a.caps.maxConcurrentWorkers ?? DEFAULT_CAPS.maxConcurrentWorkers });
+  // Each option says whether THIS host can honour it, asked of the same
+  // predicate the dispatch gate uses, so the wizard cannot promise a boundary
+  // the daemon will then refuse to build.
+  const offer = (isolation: CredentialIsolation, claim: string): string =>
+    mechanismSatisfies(isolation, probe.mechanism)
+      ? `${claim} — this host can build it with ${probe.mechanism}`
+      : `${claim} — UNAVAILABLE here (${probe.reasons.join("; ") || "no mechanism found"}); dispatch would refuse every issue`;
+  const described: { readonly [K in CredentialIsolation]: string } = {
+    "per-run": offer("per-run", "each session runs under its own OS principal; it cannot reach the daemon's credentials"),
+    "group-mode": offer(
+      "group-mode",
+      "same uid as the daemon, cross-run separation by group and mode only; bounds accidents, does NOT contain a bash escape",
+    ),
+    none: "sessions run as the daemon's user; env scrubbing only, which same-uid code defeats in one line",
+  };
+  const isolation = await askLiteral(
+    ctx,
+    "Credential isolation for worker and orchestrator sessions",
+    CREDENTIAL_ISOLATIONS,
+    described,
+    a.credentials.isolation,
+  );
+  return { ...a, credentials: { ...a.credentials, isolation } };
+};
+
 /** How a stuck run reaches a human, and who triages it when it does. */
 const askEscalation: AreaAsker = async (ctx, a) => {
   const telegram = detectTelegram();
@@ -710,6 +958,8 @@ const AREA_ASKERS: { readonly [K in AmendAreaId]: AreaAsker } = {
   caps: async (ctx, a) => await askWorkerModel(ctx, await askCaps(ctx, a)),
   graph: askGraph,
   authority: askAuthorityArea,
+  policy: askPolicy,
+  credentials: askCredentials,
   escalation: askEscalation,
   reporting: askReporting,
   brief: askBrief,
@@ -799,6 +1049,8 @@ async function collectAnswers(
   a = await askGraph(ctx, a);
   a = await askCaps(ctx, a);
   a = await askAuthorityArea(ctx, a);
+  a = await askPolicy(ctx, a);
+  a = await askCredentials(ctx, a);
   a = await askWorkerModel(ctx, a);
   a = await askEscalation(ctx, a);
   a = await askReporting(ctx, a);

package/src/release-policy.ts

@@ -1,18 +1,40 @@
+/**
+ * The release/deploy tool-call tripwire.
+ *
+ * **Defence in depth, and no longer load-bearing (#126).** This module works by
+ * pattern-matching a tool name or a shell string inside the session, which is
+ * the weakest place a rule can live: the string is the model's, the matching is
+ * a regex, and `bash` hands it an unbounded alphabet to spell `npm publish` in.
+ * It was the only mechanism there was, and it was never the one anybody should
+ * have had to rely on.
+ *
+ * What actually stops a release now is that the session cannot perform one. It
+ * holds no credential (#125) and its only route to a mutation is the mediated
+ * verbs, whose checks run in the daemon against the configured holder
+ * (`verbs/server.ts`). A worker that talks its way past every regex below still
+ * has nothing to push with.
+ *
+ * It stays installed anyway, for the two things a tripwire is good at and a
+ * boundary is not: it refuses *early*, in the session, with an explanation the
+ * model can act on in the same turn instead of an `EACCES` it may read as
+ * transient; and it leaves a durable record that something tried
+ * ({@link recordReleaseBlock}), which is how drift shows up in a digest rather
+ * than in an incident. Treat a block here as evidence about a session's
+ * intentions, never as proof that the release was prevented — the daemon is
+ * what prevented it.
+ *
+ * {@link releaseRefusal} is the exception to all of the above: it is the shared
+ * grant comparison, and `conductor_release` calls exactly this function, so the
+ * refusal an operator reads is worded once.
+ */
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { stateDir } from "./config.ts";
-import type { ReleasePolicy } from "./types.ts";
+import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
 export const RELEASE_POLICY_AUDIT_FILE = "release-policy-blocks.jsonl";
 
-export type ReleaseShape =
-  | "git-tag"
-  | "git-push-tags"
-  | "package-publish"
-  | "github-release"
-  | "deploy";
-
 export interface ReleaseBlock {
   project: string;
   source: "worker" | "orchestrator";
@@ -66,6 +88,122 @@ export function releaseShapeFromCommand(command: string): ReleaseShape | undefin
   return undefined;
 }
 
+/**
+ * The tokens a tool name or device path is matched on: split on every separator
+ * (`_`, `-`, `.`, `/`, `:`) and on CamelCase boundaries, then lowercased.
+ * `DeployStack` → `[deploy, stack]`; `GetDeploymentStatus` → `[get, deployment,
+ * status]`; `xd://mcp__komodo_DeployStack` → `[xd, mcp, komodo, deploy, stack]`.
+ *
+ * One tokeniser for both branches of {@link releaseShapeFromTool}, because #130
+ * was two matchers disagreeing about the same tool. The device path tested the
+ * whole string with an unbounded `/deploy/i`, so `xd://mcp__komodo_GetDeploymentStatus`
+ * — a read this fleet's orchestrator makes routinely — was *blocked* as a
+ * release action; the native tool name required a delimiter, so
+ * `mcp__komodo_DeployStack`, the real deploy, matched nothing at all. Wrong in
+ * opposite directions, about the same call.
+ *
+ * Exported for the tests: the negative cases are the whole point of this file,
+ * and they are cheaper to state against tokens than against a decision.
+ */
+export function releaseTokens(name: string): string[] {
+  return (
+    name
+      // `DeployStack` → `Deploy Stack`, then `HTTPServer` → `HTTP Server` so an
+      // acronym prefix cannot swallow the verb that follows it.
+      .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+      .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+      .toLowerCase()
+      .split(/[^a-z0-9]+/)
+      .filter((token) => token.length > 0)
+  );
+}
+
+/**
+ * Verbs that make a name a query, whatever nouns follow. `GetDeploymentStatus`,
+ * `ListDeployments` and `describeDeployment` are how an orchestrator reads a
+ * deployment's state, and refusing those as release actions is the live block
+ * #130 was filed for.
+ */
+const READ_VERBS: Record<string, true> = {
+  get: true,
+  list: true,
+  describe: true,
+  inspect: true,
+  read: true,
+  watch: true,
+  show: true,
+  search: true,
+  status: true,
+};
+
+/**
+ * Mutating deploy verbs. The noun `deployment` is deliberately absent: it is
+ * what a read is *about*, never what a call does.
+ *
+ * `apply` and `destroy` are generic enough to catch an unrelated tool
+ * (`ApplyPatch`), and that is the direction this errs on purpose — an
+ * over-refused edit tool is an escalation, a missed IaC call is an incident.
+ */
+const DEPLOY_ACTIONS: Record<string, true> = {
+  deploy: true,
+  redeploy: true,
+  rollout: true,
+  promote: true,
+  apply: true,
+  destroy: true,
+  teardown: true,
+};
+
+/** Publishing an artifact. `published` is a noun and excluded: it is why
+ *  `xd://mcp__x_ListPublishedArtifacts` classified as `package-publish` (#130). */
+const PUBLISH_ACTIONS: Record<string, true> = { publish: true, republish: true };
+
+/** Cutting a GitHub release takes an action *and* the `release` noun, so
+ *  `create_repository` and `list_releases` are each missing half of it. */
+const RELEASE_ACTIONS: Record<string, true> = {
+  create: true,
+  draft: true,
+  cut: true,
+  publish: true,
+  republish: true,
+};
+
+/**
+ * The shape a tokenised tool name or device path names, if any.
+ *
+ * A query name yields nothing whatever its nouns say. The first token drawn from
+ * either vocabulary decides that, because tool names are verb-first
+ * (`ListDeployments`, `DeployStack`) and the leading verb is the act. A trailing
+ * `status` is a query too — `DeployStatus` opens with a mutating verb and still
+ * only asks a question — while a read verb *after* the action verb is not:
+ * `DeployStackAndWatch` deploys.
+ */
+function releaseShapeFromTokens(tokens: readonly string[]): ReleaseShape | undefined {
+  if (tokens[tokens.length - 1] === "status") return undefined;
+  for (const token of tokens) {
+    if (READ_VERBS[token] === true) return undefined;
+    if (
+      DEPLOY_ACTIONS[token] === true ||
+      RELEASE_ACTIONS[token] === true ||
+      PUBLISH_ACTIONS[token] === true
+    ) {
+      break;
+    }
+  }
+
+  // `release` first: `PublishRelease` cuts a GitHub release, it does not publish
+  // a package, and both vocabularies claim `publish`.
+  if (
+    tokens.some((t) => t === "release" || t === "releases") &&
+    tokens.some((t) => RELEASE_ACTIONS[t] === true)
+  ) {
+    return "github-release";
+  }
+  if (tokens.some((t) => PUBLISH_ACTIONS[t] === true)) return "package-publish";
+  if (tokens.some((t) => DEPLOY_ACTIONS[t] === true)) return "deploy";
+  return undefined;
+}
+
 /** Release-shaped device/tool invocations that do not pass through a shell. */
 export function releaseShapeFromTool(
   toolName: string,
@@ -76,37 +214,60 @@ export function releaseShapeFromTool(
     return typeof input.command === "string" ? releaseShapeFromCommand(input.command) : undefined;
   }
 
+  // An MCP tool reached through the device path: the path *is* the tool name, so
+  // it goes through the same tokeniser as a native one. Only `xd://` paths — a
+  // `write` to `src/deploy.ts` is source code, not a deploy.
   const path = typeof input.path === "string" ? input.path : "";
   if (toolName === "write" && path.startsWith("xd://")) {
-    if (/create[_-]release/i.test(path)) return "github-release";
-    if (/publish/i.test(path)) return "package-publish";
-    if (/deploy/i.test(path)) return "deploy";
+    const viaDevice = releaseShapeFromTokens(releaseTokens(path));
+    if (viaDevice !== undefined) return viaDevice;
   }
 
-  const normalized = toolName.toLowerCase().replaceAll("-", "_");
-  if (/create_?release|release_?create/.test(normalized)) return "github-release";
-  if (/(?:^|_)publish(?:$|_)/.test(normalized)) return "package-publish";
-  if (/(?:^|_)deploy(?:$|_)/.test(normalized)) return "deploy";
-  return undefined;
+  return releaseShapeFromTokens(releaseTokens(toolName));
+}
+
+/**
+ * The refusal a `role` session gets for `shape` under `grants`, or `undefined`
+ * when the grant covers it.
+ *
+ * Separate from classification so the external-orchestrator tick can classify
+ * once, consult its own ownership state, and still word the refusal identically.
+ *
+ * The comparison is the whole gate: a grant is an `AuthorityHolder`, so
+ * `"human"` equals no role and refuses every session, and `"worker"` equals no
+ * grant and is refused every shape however permissive the config is (#126).
+ */
+export function releaseRefusal(
+  grants: ResolvedGrants,
+  role: SessionRole,
+  shape: ReleaseShape,
+): ReleaseDecision | undefined {
+  const holder = grants[shape];
+  if (holder === role) return undefined;
+  return {
+    block: true,
+    reason:
+      `Blocked by releasePolicy: ${shape} is granted to "${holder}", and this is a ${role} session. ` +
+      (role === "worker"
+        ? "A worker session never holds a release grant, whatever the config says — report the release " +
+          "as the next step and stop at a green PR."
+        : holder === "human"
+          ? `Only a human may do this. Set releasePolicy.${shape} to "orchestrator" for this project ` +
+            "first, and only once the operator brief carries the procedure to follow."
+          : "Ask the operator which session is meant to hold this grant."),
+  };
 }
 
 export function releaseDecision(
-  policy: ReleasePolicy,
+  grants: ResolvedGrants,
+  role: SessionRole,
   toolName: string,
   input: Record<string, unknown>,
 ): { shape: ReleaseShape; decision: ReleaseDecision } | undefined {
-  if (policy !== "none") return undefined;
   const shape = releaseShapeFromTool(toolName, input);
   if (shape === undefined) return undefined;
-  return {
-    shape,
-    decision: {
-      block: true,
-      reason:
-        `Blocked by releasePolicy=none (${shape}). ` +
-        "Only a human may change the project to operator-brief before release or deploy tools can run.",
-    },
-  };
+  const decision = releaseRefusal(grants, role, shape);
+  return decision === undefined ? undefined : { shape, decision };
 }
 
 interface ReleasePolicyPi {
@@ -121,12 +282,13 @@ interface ReleasePolicyPi {
 
 /** Inline session extension used by workers and the embedded orchestrator. */
 export function releasePolicyTripwire(
-  policy: ReleasePolicy,
+  grants: ResolvedGrants,
+  role: SessionRole,
   onBlocked: (shape: ReleaseShape) => void = () => {},
 ): (pi: ReleasePolicyPi) => void {
   return (pi) => {
     pi.on("tool_call", (event) => {
-      const blocked = releaseDecision(policy, event.toolName, event.input);
+      const blocked = releaseDecision(grants, role, event.toolName, event.input);
       if (blocked === undefined) return undefined;
       try {
         onBlocked(blocked.shape);