omp-conductor 0.3.25 → 0.4.0

package/src/daemon.ts

@@ -8,9 +8,24 @@
  * here and enforced before anything is claimed.
  */
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
-import { configPath, findProject, loadConfig, resolveCaps, resolveReleasePolicy, stateDir } from "./config.ts";
+import {
+  configPath,
+  findProject,
+  loadConfig,
+  migrateCredentialsOnDisk,
+  resolveCaps,
+  resolveCredentials,
+  resolveReleaseGrants,
+  stateDir,
+  sharedRoot,
+} from "./config.ts";
+import {
+  analyseSettlement,
+  formatSettlementFlags,
+  settlementFlagSummary,
+} from "./diff-flags.ts";
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
@@ -18,11 +33,13 @@ import { livingDaemon } from "./lifecycle.ts";
 import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
+import { createReportOutbox, formatOpenReports } from "./reports.ts";
 import { recordReleaseBlock } from "./release-policy.ts";
 import { branchName, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
 import { dbPath, openStore } from "./store.ts";
 import { makeTracker } from "./tracker/github.ts";
+import { RELEASE_SHAPES } from "./types.ts";
 import type {
   AdmissionHoldReason,
   Caps,
@@ -30,30 +47,84 @@ import type {
   Escalation,
   OpenCloser,
   PrState,
+  CredentialIsolation,
   ProjectConfig,
   ReadyIssue,
   RepoTarget,
+  ReportRecord,
+  ResolvedGrants,
   RunRecord,
   RunState,
+  SettlementFlag,
   Store,
   Tracker,
+  VerbLedgerEntry,
 } from "./types.ts";
+import { CONDUCTOR_GROUPS } from "./types.ts";
 import { type KilledBy, type WorkerResult, renderBrief, runWorker } from "./worker.ts";
 import {
-  addWorktree,
+  addRunRepo,
   cleanupRetainedWorktree,
   mirrorPathFor,
   removeWorktree,
   salvageWip,
   type RetainedWorktreeCleanup,
+  type RunPublisher,
   type SalvageOutcome,
   worktreePathFor,
 } from "./worktree.ts";
+import { githubVerbActions } from "./verbs/actions.ts";
+import { formatVerbLedger, STATUS_LEDGER_SCAN } from "./verbs/ledger.ts";
+import { listenVerbChannel } from "./verbs/server.ts";
+import type { VerbActions, VerbDeps, VerbListener } from "./verbs/server.ts";
+import {
+  ensureVerbSocketDir,
+  peerCredentialReader,
+  transportBanner,
+  verbSocketPath,
+  type PeerReader,
+} from "./verbs/socket.ts";
+import { homedir } from "node:os";
+
+import {
+  applyRunOwnership,
+  applyMirrorReadAccess,
+  auditMcpRoots,
+  mirrorTraversalRefusal,
+  credentialReadRefusal,
+  spawnCaptured,
+  boundaryRefusal,
+  buildSessionBoundary,
+  createSlotPool,
+  describeBoundary,
+  liveDaemonCredentials,
+  mcpRefusal,
+  mechanismSatisfies,
+  openRunPr,
+  probeHost,
+  pushRunBranch,
+  verifyDaemonAccess,
+  type HostProbe,
+  type RunRepoRef,
+  type SessionBoundary,
+  type SlotPool,
+} from "./credentials.ts";
+import {
+  planUsageLine,
+  readPlanUsage,
+  sharedUsageSource,
+  type PlanUsageStatus,
+  type UsageSource,
+} from "./usage.ts";
 
 /** Long enough that the tracker is not polled raw, short enough that a human
  *  who labels an issue sees it picked up within a coffee break. */
 const TICK_INTERVAL_MS = 5 * 60_000;
 const GRAPH_HEALTH_INTERVAL_MS = 60_000;
+/** Report delivery runs on its own timer, not the five-minute dispatch tick: a
+ *  report an operator is waiting on must not sit in the outbox for the length of
+ *  a poll interval, and delivery is owed even while claiming is paused (#123). */
+const REPORT_DELIVERY_INTERVAL_MS = 30_000;
 const DEFAULT_PORT = 8787;
 const BRIEF_TEMPLATE_PATH = join(import.meta.dir, "briefs", "worker.md");
 
@@ -75,16 +146,95 @@ export interface DaemonOpts {
 
 /** Everything one tick touches, resolved once at startup so a tick never
  *  re-reads config mid-flight and changes its own limits underneath itself. */
+/**
+ * The credential boundary this fleet is running behind (#125), resolved once at
+ * startup like every other dep so a tick cannot change its own protection.
+ *
+ * `paged` is the same one-page-per-episode gate the integrity tripwire uses: a
+ * host that cannot build the boundary the operator asked for holds *every*
+ * candidate on *every* tick, and paging per five minutes forever is paging
+ * nobody reads.
+ */
+export interface FleetBoundary {
+  isolation: CredentialIsolation;
+  probe: HostProbe;
+  slots: SlotPool;
+  paged: boolean;
+}
+
+/**
+ * True when the operator asked for a boundary this host cannot build.
+ *
+ * Asks {@link mechanismSatisfies} rather than testing for `none`, because the
+ * interesting refusal is the near miss: a host offering `group-mode` against a
+ * `per-run` config used to dispatch happily under the weaker boundary, which is
+ * the silent downgrade #125 forbids.
+ */
+export function boundaryRefusesDispatch(boundary: FleetBoundary | undefined): boolean {
+  return boundary !== undefined && !mechanismSatisfies(boundary.isolation, boundary.probe.mechanism);
+}
+
 interface Deps {
   project: ProjectConfig;
   caps: Caps;
+  /**
+   * Optional only so a test can build a `Deps` without a host probe; production
+   * always resolves one in `runDaemon`. Absent means the A1 shape — sessions
+   * are still child processes, but they run as the daemon's own user and no
+   * security claim is made for them.
+   */
+  boundary?: FleetBoundary;
   tracker: Tracker;
   store: Store;
+  /** Provider-reported plan allowance, cached with a TTL. Resolved once at
+   *  startup like every other dep so a tick cannot swap its own meter. */
+  usage: UsageSource;
   escalate(e: Escalation): Promise<void>;
   turnLimits: TurnLimitRegistry;
   integrity: IntegrityGate;
   stall: StallGate;
   cleanup?: RetainedCleanupCursor;
+  /**
+   * Reads the connecting uid off a verb socket (#126). Resolved once at startup
+   * so the mechanism is logged before the first socket exists; absent on a host
+   * exposing no peer-credential call, where the `0600` socket under the
+   * daemon-owned `0711` parent is the whole boundary and `status` says so.
+   */
+  verbPeerReader?: PeerReader;
+  /**
+   * The privileged half the verbs call once their checks pass. Optional only so
+   * a test can build a `Deps` without a repository; `runDaemon` always wires
+   * the real one.
+   */
+  verbActions?: VerbActions;
+}
+
+/**
+ * The daemon-side view a verb call decides against (#126).
+ *
+ * `project` is a thunk, not the resolved value the rest of a tick uses. That is
+ * the whole "fail closed on an unreadable config" rule: a config read once at
+ * boot can never become unreadable, and it cannot pick up an operator who has
+ * just taken merge authority back either. Every verb pays one file read for
+ * the property that its answer reflects the config as it is *now*.
+ *
+ * `fleetStop` is read the same way and for the same reason — inside the verb,
+ * after the model decided to call it. `hold` and `halt` both set the pause
+ * sentinel alongside disarming ticks, so this one read covers both.
+ */
+export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbActions">): VerbDeps {
+  return {
+    project: () => findProject(loadConfig(), d.project.name),
+    store: d.store,
+    tracker: d.tracker,
+    actions: d.verbActions ?? githubVerbActions(d.project),
+    fleetStop: () =>
+      isPaused()
+        ? "claiming is paused for this fleet (omp-conductor pause, hold or halt)"
+        : undefined,
+    log,
+    now: () => Date.now(),
+  };
 }
 
 // ---------------------------------------------------------------- paths & pause
@@ -468,16 +618,37 @@ export async function settleWorktree(
     /** Clause for the commit subject: "killed by the turns cap", "blocked …". */
     ending: string;
     worktree: string;
+    /** The run's branch, so the pre-removal publish names the right ref. */
+    branch: string;
+    /**
+     * Publishes the run branch on the privileged side. Required rather than
+     * optional: since #125 the run's commits live in a repository of its own,
+     * so a removal that did not publish first would delete the only copy —
+     * which is #121's data loss with one extra step. `undefined` is a visible
+     * decision at the call site, never an omission.
+     */
+    publish: RunPublisher | undefined;
   } & (
     | /** Terminal-failure and orphan trees are evidence, and are kept even when clean. */
     { tree: "keep" }
     | { tree: "remove"; mirrorPath: string }
   ),
 ): Promise<WorktreeSettlement> {
-  const { issue, attempt, ending, worktree } = args;
-  const outcome = await salvageWip(worktree, issue, attempt, ending);
+  const { issue, attempt, ending, worktree, branch, publish } = args;
+  const outcome = await salvageWip(worktree, issue, attempt, ending, publish);
   const retained = args.tree === "keep" || outcome.kind === "failed";
-  if (!retained && args.tree === "remove") await removeWorktree(args.mirrorPath, worktree);
+  if (!retained && args.tree === "remove") {
+    // Before the removal, always — not only when salvage found something. A run
+    // that *committed* and could not publish has its work in its own repository
+    // and nowhere else, and salvage never sees a committed tree because it is
+    // clean. The mirror fetch inside `publish` is what preserves it; the push
+    // to GitHub can fail (no network, protected ref) and the work still lives.
+    const published = await publish?.(branch);
+    if (published !== undefined && !published.ok) {
+      log(`#${issue} publish before removal failed, work is preserved in the mirror: ${published.stderr}`);
+    }
+    await removeWorktree(args.mirrorPath, worktree);
+  }
 
   const lines = salvageLines(outcome, worktree, retained);
   log(`#${issue} salvage: ${lines.join(" ")}`);
@@ -494,6 +665,49 @@ export async function settleWorktree(
   };
 }
 
+/**
+ * The probe a session gets when no boundary was resolved at all — a test, or a
+ * `--once` run built without one. Named rather than inlined so the "no
+ * mechanism, no claim" shape is one object every call site shares.
+ */
+const NO_BOUNDARY_PROBE: HostProbe = {
+  mechanism: "none",
+  reasons: ["no host probe was run"],
+  residuals: [],
+  boundingSetDropped: false,
+  slots: [],
+};
+
+/**
+ * Credential paths the macOS profile denies outright.
+ *
+ * Derived from the operator's real home rather than from the session's
+ * redirected one: the point is that the *operator's* `gh` config and keys stay
+ * unreachable even when a session names their absolute path, which is exactly
+ * the probe `GH_CONFIG_DIR=<operator home>/.config/gh gh auth status` in #125.
+ */
+function credentialDenyRoots(): string[] {
+  const home = homedir();
+  return [join(home, ".ssh"), join(home, ".config", "gh"), join(home, ".gnupg"), join(home, ".aws")];
+}
+
+function credentialDenyFiles(): string[] {
+  const home = homedir();
+  return [
+    join(home, ".git-credentials"),
+    join(home, ".npmrc"),
+    join(home, ".netrc"),
+    // Both git config locations, because a token does not only live in
+    // `.git-credentials`: `url.https://<token>@github.com/.insteadOf` is a
+    // perfectly ordinary way to wire one up, and an ordinary `.gitconfig` is
+    // 0644. Hardening chmods it, but hardening is not the claim — this list is
+    // what the empirical recheck actually asks the slot principal about, so a
+    // file missing from here is a credential nobody verified was out of reach.
+    join(home, ".gitconfig"),
+    join(home, ".config", "git", "config"),
+  ];
+}
+
 /**
  * How a run's end is named — in the salvage commit, and to whoever reads it.
  * The whole clause, not a bare reason: a graceful block was not killed by
@@ -654,6 +868,33 @@ export async function verifyPushedGreenClaim(
   };
 }
 
+/**
+ * Audit a worker's own account of its work against the pull request it pushed.
+ *
+ * The thin half of the split #85 established: this fetches, {@link
+ * analyseSettlement} decides. It runs beside {@link verifyPushedGreenClaim} and
+ * shares none of its authority — that function decides a run's state, this one
+ * cannot, by construction. It returns evidence and the caller appends it.
+ *
+ * Returns undefined when the audit could not run at all: no PR to read, or a
+ * tracker that could not produce a diff. Undefined is *not* an empty flag list.
+ * An empty list means "read the whole diff, found nothing"; undefined means
+ * "did not look", and the report says so rather than presenting silence as a
+ * clean bill.
+ */
+export async function collectSettlementFlags(
+  tracker: Pick<Tracker, "prDiff">,
+  claim: { prUrl?: string; report: string; issueText: string },
+): Promise<{ flags: SettlementFlag[]; truncated: boolean } | undefined> {
+  if (claim.prUrl === undefined) return undefined;
+  const diff = await tracker.prDiff(claim.prUrl);
+  if (diff === undefined) return undefined;
+  return {
+    flags: analyseSettlement({ report: claim.report, issueText: claim.issueText, diff }),
+    truncated: diff.truncated,
+  };
+}
+
 /**
  * One attempt at one issue, from claim to terminal state. Everything is inside
  * a single try/catch so that a bad issue costs its own run and nothing else.
@@ -672,6 +913,29 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
   const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
   let worktreePath: string | undefined;
   let turnLimit: TurnLimitController | undefined;
+  // #125: the run's own repository, the slot it holds, and the boundary its
+  // session runs behind. Hoisted for the same reason `worktreePath` is — the
+  // catch and finally paths have to release the slot and publish the branch.
+  let runRepo: RunRepoRef | undefined;
+  let slotIndex: number | undefined;
+  let boundary: SessionBoundary | undefined;
+  // #126: the run's own verb socket. Hoisted like the slot, because the catch
+  // and finally paths have to close it — a socket outliving its run is a
+  // channel nobody is authenticating any more.
+  let verbListener: VerbListener | undefined;
+  const credentials = resolveCredentials(project);
+
+  /**
+   * Publishes the run's branch on the privileged side: run repo → mirror →
+   * GitHub, fast-forward only. The worker holds no credential and never
+   * performs a network git operation itself (#125 item 3); this is the only
+   * route its commits take out, and it is also what stops a per-run repository
+   * from being the *only* copy when the tree is removed.
+   */
+  const publish: RunPublisher = async () => {
+    if (runRepo === undefined) return { ok: false, stderr: "the run repository was never provisioned" };
+    return pushRunBranch(project, runRepo);
+  };
 
   try {
     // Claim on the tracker FIRST, before any local work. The label — not the
@@ -701,14 +965,14 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     const runId = run.id;
     turnLimit = d.turnLimits.open(project.name, issue, runId, caps.workerMaxTurns);
 
-    // A run's tree is <workspaceRoot>/<issue> and addWorktree refuses to reuse
+    // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
     // to be cleared first. Both helpers are pure path math and removeWorktree
     // tolerates a mirror or tree that is not there yet, so this is safe on a
-    // first attempt. addWorktree does its own ensureMirror; calling it here too
+    // first attempt. addRunRepo does its own ensureMirror; calling it here too
     // would cost a second network fetch per attempt.
     await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
-    const provisioned = await addWorktree(
+    const provisioned = await addRunRepo(
       r.repo,
       project.mirrorRoot,
       project.workspaceRoot,
@@ -716,12 +980,157 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       branch,
     );
     worktreePath = provisioned.path;
+    runRepo = { repo: r.repo, runRepoPath: worktreePath, branch };
 
     // The SDK names the transcript itself, so the daemon supplies the parent
     // directory and learns the real path back from the result. Inventing one
     // here would put a file that never gets written into an escalation.
-    const sessionDir = join(stateDir(), "sessions");
+    //
+    // Per run rather than one shared directory: under `uid-pool` the session
+    // writes its own transcript as its slot principal, and a directory shared
+    // with every other run would let each read the others'. The daemon still
+    // reads all of them — it owns the group.
+    //
+    // Under `uid-pool` the session runs as a *different uid*, so every tree it
+    // has to reach lives outside the private state directory: that one stays
+    // 0700 because it holds conductor.db and the WAL SQLite keeps recreating,
+    // and making it searchable to let a slot in would publish fleet history to
+    // every local account. `sandbox-exec` and `none` keep the old paths — same
+    // uid, nothing to traverse into (#125).
+    const runTreeRoot = d.boundary?.probe.mechanism === "uid-pool" ? sharedRoot() : stateDir();
+    if (runTreeRoot !== stateDir()) {
+      mkdirSync(runTreeRoot, { recursive: true });
+      chmodSync(runTreeRoot, 0o711);
+    }
+    const sessionDir = join(runTreeRoot, "sessions", `run-${String(runId)}`);
+    const envRoot = join(runTreeRoot, "boundaries", `run-${String(runId)}`);
     mkdirSync(sessionDir, { recursive: true });
+
+    // ---- the credential boundary for this run (#125) --------------------
+    slotIndex = d.boundary?.slots.acquire();
+    boundary = buildSessionBoundary({
+      probe: d.boundary?.probe ?? NO_BOUNDARY_PROBE,
+      isolation: d.boundary?.isolation ?? "none",
+      role: "worker",
+      ...(slotIndex === undefined ? {} : { slot: slotIndex }),
+      envRoot,
+      writeRoots: [worktreePath, sessionDir],
+      // The workspace root, denied wholesale and then re-granted for this run's
+      // own checkout by the trailing allow in `sandboxProfile`. On `uid-pool`
+      // the modes already do this; on macOS the profile is the only thing that
+      // does, because sandbox-exec does not change the uid.
+      //
+      // `mirrorRoot` is deliberately NOT denied. The run repository borrows its
+      // objects from the mirror through git alternates, so denying it would
+      // break every git command in the checkout — and a run being able to read
+      // another run's objects out of that shared store is the residual this
+      // design accepts and documents, not one it pretends to have closed. The
+      // mirror stays unwritable, because it is not in `writeRoots`.
+      denyReadRoots: [...credentialDenyRoots(), project.workspaceRoot],
+      denyReadFiles: credentialDenyFiles(),
+      ...(credentials.readToken === undefined ? {} : { readToken: credentials.readToken }),
+    });
+
+    if (boundary.principal !== undefined) {
+      // Ownership handoff, then proof. `applyRunOwnership` makes the tree
+      // `<slot>:conductor-daemon 2770`, which is also the point of no return:
+      // if this daemon is not an *effective* member of that group it has just
+      // locked itself out of push, salvage and reclaim, and the modes look
+      // perfectly correct while it does. So it writes, reads and removes a
+      // probe file rather than inspecting them (#125).
+      // Both gids come from the probe's own `getent`, never from the daemon's
+      // `egid`. They are different groups: the shipped unit runs
+      // `User=fleet`/`Group=fleet` with `conductor-daemon` merely
+      // supplementary, so `egid` is `fleet` — handing that to
+      // `applyRunOwnership` would make every run repo `<slot>:fleet`, readable
+      // by anyone else in `fleet`, while the probe had validated a group the
+      // modes never used. A uid-pool probe always resolves both, so their
+      // absence here is a contradiction rather than a default to paper over.
+      const { daemonGid, runsGid } = d.boundary?.probe ?? {};
+      if (daemonGid === undefined || runsGid === undefined) {
+        throw new Error(
+          `the credential boundary reported a per-run principal without resolving ` +
+            `${CONDUCTOR_GROUPS.daemon}/${CONDUCTOR_GROUPS.runs} gids — refusing to hand the tree to a group ` +
+            `nobody verified.`,
+        );
+      }
+      applyRunOwnership(worktreePath, boundary.principal, daemonGid);
+      applyRunOwnership(sessionDir, boundary.principal, daemonGid);
+      // The session's own HOME, TMPDIR and gh-config tree.
+      // `prepareSessionEnvRoot` creates them daemon-owned 0700, so without this
+      // the slot principal cannot write its own home and the harness fails at
+      // session startup — which reads like a broken install rather than a
+      // permissions handoff that was one directory short.
+      applyRunOwnership(envRoot, boundary.principal, daemonGid);
+      // The claim, checked rather than assumed. On Linux the principal
+      // separates by DAC alone, so whether the operator's credentials are
+      // actually out of reach depends on modes this package never set. Ask the
+      // slot itself, and refuse the dispatch if the answer is yes.
+      const leaking = await credentialReadRefusal(
+        spawnCaptured,
+        boundary.principal,
+        { boundingSet: d.boundary?.probe.boundingSetDropped ?? false },
+        [...credentialDenyRoots(), ...credentialDenyFiles()],
+      );
+      if (leaking !== undefined) throw new Error(leaking);
+      // The other half of the layout, and it is not optional: the run's git dir
+      // borrows the mirror's objects through `alternates`, so a mirror the slot
+      // principal cannot read makes the checkout look corrupt rather than
+      // forbidden.
+      //
+      // Both trees are checked first, and the check REFUSES rather than
+      // widening the state directory — see `mirrorTraversalRefusal`. A slot
+      // that cannot reach its own checkout is just as broken as one that cannot
+      // read the mirror, and the shipped defaults put both under the private
+      // root.
+      const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
+      for (const tree of [mirrorPath, worktreePath]) {
+        const unreachable = mirrorTraversalRefusal(tree, stateDir());
+        if (unreachable !== undefined) throw new Error(unreachable);
+      }
+      applyMirrorReadAccess(mirrorPath, runsGid);
+      const denied = verifyDaemonAccess(worktreePath);
+      if (denied !== undefined) throw new Error(denied);
+    }
+
+    // An MCP server carrying its own PAT re-opens the hole the principal
+    // closes, so this is a refusal and not a warning. Audited here, after
+    // provisioning, because both roots the harness will discover — the run's
+    // own checkout and the agent principal's config root — exist only now.
+    const mcp = mcpRefusal(
+      auditMcpRoots({ agentHome: boundary.env["HOME"] ?? homedir(), cwd: worktreePath }),
+    );
+    if (mcp !== undefined) throw new Error(mcp);
+
+    // ---- the run's mutation channel (#126) -------------------------------
+    // A shared, daemon-owned 0711 parent with one 0600 socket per run, never a
+    // per-run *directory*: a directory owned by the run principal would hand
+    // back the power to unlink a sibling's socket and bind an impostor in its
+    // place, which is the whole thing the layout buys. `listenVerbChannel`
+    // validates every component before binding and throws rather than
+    // degrading, so a tampered path refuses this dispatch instead of running
+    // the worker with a channel nobody can vouch for.
+    verbListener = await listenVerbChannel(
+      verbDeps(d),
+      {
+        kind: "run",
+        // `runTreeRoot`, not the private state dir: the slot has to *connect*
+        // to this socket, and a 0700 ancestor makes it unreachable however
+        // correct the socket's own mode is. `ensureVerbSocketDir` still owns
+        // the parent and still runs its anti-rebind checks there (#126).
+        path: verbSocketPath(ensureVerbSocketDir(runTreeRoot), `run-${String(issue)}`),
+        project: project.name,
+        role: "worker",
+        runId,
+        issue,
+        repo: r.repo,
+        runRepoPath: worktreePath,
+        branch,
+        ...(boundary.principal === undefined ? {} : { principal: boundary.principal }),
+      },
+      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+    );
+
     store.updateRun(runId, { worktree: worktreePath, state: "running" });
 
     log(
@@ -743,8 +1152,19 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         caps,
         maxTurns: () => turnLimit?.maxTurns() ?? caps.workerMaxTurns,
         sessionDir,
+        boundary,
+        // Inside the run's own boundary root, so a slot principal can reach it
+        // by traversal. A socket under the daemon's 0700 home would be
+        // unreachable to the very process it exists for (#125).
+        // Derived from the hoisted envRoot for the same reason, and because
+        // that tree has already been handed to the slot principal.
+        socketPath: join(envRoot, "ipc.sock"),
+        verbSocketPath: verbListener.path,
+        onChildLog: (line) => {
+          log(`#${issue} ${line}`);
+        },
         ...(project.workerModel === undefined ? {} : { model: project.workerModel }),
-        releasePolicy: resolveReleasePolicy(project),
+        releaseGrants: resolveReleaseGrants(project),
         onReleaseBlocked: (shape) => recordReleaseBlock(project.name, "worker", shape),
         onTurn: (n) => store.updateRun(runId, { turns: n }),
         onSpend: (usd) => store.updateRun(runId, { spendUsd: usd }),
@@ -763,6 +1183,14 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       // PR verification or terminal row writes can leave stale `running` state.
       turnLimit?.close();
       turnLimit = undefined;
+      // The slot IS the principal, so holding it past the session means the
+      // next run could be handed the same uid while this one's tree still
+      // exists — two live runs able to write each other's checkout, which is
+      // the cross-run property this whole change buys.
+      if (slotIndex !== undefined) {
+        d.boundary?.slots.release(slotIndex);
+        slotIndex = undefined;
+      }
     }
 
     // A configured model the harness could not honour means this run was done by
@@ -777,8 +1205,33 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         ? await verifyPushedGreenClaim(tracker, result)
         : { state: result.state };
     const state = verified.state;
-    const finalReport =
-      verified.reason === undefined ? result.report : `${verified.reason}\n\n${result.report}`;
+
+    // The other half of not believing a worker about its own run (#128). The
+    // claim being audited is `state: pushed-green`, so the audit runs on the
+    // worker's claim rather than on what verification made of it: a claim that
+    // GitHub then contradicted is exactly the report whose `changed:` line is
+    // worth reading twice. Advisory throughout — nothing below reads `flags`
+    // when deciding `state`, and the ordering here makes that checkable.
+    const audit =
+      result.state === "pushed-green"
+        ? await collectSettlementFlags(tracker, {
+            prUrl: result.prUrl,
+            report: result.report,
+            issueText: `${r.issue.title}\n${r.issue.body}`,
+          })
+        : undefined;
+    if (result.state === "pushed-green") {
+      if (audit === undefined) log(`#${issue} settlement audit skipped: no readable PR diff`);
+      else if (audit.truncated) log(`#${issue} settlement audit read a truncated PR diff`);
+    }
+    const auditLines =
+      audit === undefined ? [] : formatSettlementFlags(audit.flags, { truncated: audit.truncated });
+
+    const finalReport = [
+      ...(verified.reason === undefined ? [] : [verified.reason, ""]),
+      ...(auditLines.length === 0 ? [] : [...auditLines, ""]),
+      result.report,
+    ].join("\n");
 
     // What becomes of the tree, decided once, before any label or page. A
     // `pushed-*` run is the only end that does not salvage: its deliverable is
@@ -795,11 +1248,24 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
             ending:
               state === "blocked" ? "blocked for an operator decision" : endedBy(result.killedBy),
             worktree: worktreePath,
+            branch,
+            publish,
             ...(state === "failed" || state === "killed"
               ? ({ tree: "keep" } as const)
               : ({ tree: "remove", mirrorPath } as const)),
           });
-    if (settlement === undefined) await removeWorktree(mirrorPath, worktreePath);
+    if (settlement === undefined) {
+      // A `pushed-*` end does not salvage — its deliverable is already on a
+      // remote branch — but its repository still goes away here, so the branch
+      // is published first for the same reason `settleWorktree` does it: the
+      // run repo is no longer a view of the mirror, and anything it holds that
+      // never reached the mirror dies with the directory.
+      const published = await publish(branch);
+      if (!published.ok) {
+        log(`#${issue} publish before removal failed, work is preserved in the mirror: ${published.stderr}`);
+      }
+      await removeWorktree(mirrorPath, worktreePath);
+    }
 
     store.updateRun(runId, {
       state,
@@ -811,6 +1277,9 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       sessionFile: result.sessionFile,
       ...(verified.reason === undefined ? {} : { lastError: verified.reason }),
       ...settlement?.patch,
+      ...(audit === undefined || audit.flags.length === 0
+        ? {}
+        : { settlementFlags: audit.flags }),
     });
 
     const salvaged = settlement?.lines ?? [];
@@ -886,6 +1355,45 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       // A verified or still-pending PR keeps the in-progress label until its
       // checks or merge settle, preventing another worker from duplicating it.
       log(`#${issue} ${state}${result.prUrl ? ` ${result.prUrl}` : ""}`);
+      // A green run's report is the only one nothing ever delivers: it raises no
+      // escalation, and the row it settles into says nothing about what the
+      // worker wrote. That is fine while the report is believed — and it is
+      // exactly wrong once something has stopped believing it. A flagged
+      // settlement is the one case where a `pushed-green` run has news, and it
+      // has it *now*, while the PR is still open and nobody has merged it (#128).
+      //
+      // Tier 1, because the judgement is the orchestrator's: it can read the
+      // diff, it can ask, and it can promote to a human. The state is
+      // deliberately unchanged either way — the run below this line settles
+      // `pushed-green` whether it was flagged or not.
+      //
+      // Findings only. A diff too large to read in full is noted in the log and
+      // in the report, but it is not news for a human: paging "0 flags, could
+      // not read it all" is exactly the kind of line that teaches an
+      // orchestrator to skim past this escalation the next time it carries one.
+      const found = audit?.flags ?? [];
+      if (found.length > 0) {
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary:
+            `#${issue} settled ${state} on attempt ${attempt} with ` +
+            `${found.length} settlement audit flag(s)`,
+          detail: [
+            `${r.issue.title}`,
+            r.issue.url,
+            result.prUrl ?? "(no PR URL)",
+            "",
+            "The run is NOT blocked and its state is unchanged. These are advisory",
+            "findings about the worker's own account of its work — judge them, then",
+            "merge, ask, or close as you would have anyway.",
+            "",
+            finalReport,
+          ].join("\n"),
+        });
+      }
     }
   } catch (err) {
     // Dispatch setup can fail after the controller opens but before runWorker's
@@ -894,6 +1402,13 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     turnLimit = undefined;
     const detail = errText(err);
     log(`#${issue} errored: ${detail}`);
+    // Released here as well: a dispatch that failed before `runWorker` never
+    // reached the `finally` above, and a leaked slot permanently shrinks the
+    // pool until the daemon restarts.
+    if (slotIndex !== undefined) {
+      d.boundary?.slots.release(slotIndex);
+      slotIndex = undefined;
+    }
     // A crash lands anywhere, including mid-edit in a tree holding the only
     // copy of real work. Nothing else on this path so much as looks at it.
     const settlement =
@@ -904,6 +1419,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
             attempt,
             ending: "killed by a dispatch error",
             worktree: worktreePath,
+            branch,
+            publish,
             tree: "keep",
           });
     if (run) {
@@ -937,6 +1454,18 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // a failure path, and whatever it still held is now a commit on the branch.
   } finally {
     turnLimit?.close();
+    // The run is over, so its channel is too. Closed here rather than beside
+    // the session so the crash path closes it as well: a listener left bound
+    // after its run settled is a socket whose `run-not-live` check is the only
+    // thing standing between a stale child and a push.
+    if (verbListener !== undefined) {
+      try {
+        await verbListener.close();
+      } catch (err) {
+        log(`#${issue} verb socket ${verbListener.path} did not close cleanly: ${errText(err)}`);
+      }
+      verbListener = undefined;
+    }
   }
 }
 
@@ -1280,6 +1809,74 @@ export function summarizeDispatch(
   };
 }
 
+/**
+ * What a held plan-usage gate says to a human, if anything.
+ *
+ * Three different problems hide behind one hold, and they want different
+ * tiers. Reaching the threshold is the guard *working*: tier 1, because the
+ * fleet resumes on its own at the provider's reset and nobody needs to get
+ * out of bed. Everything else — a window nothing reports, a window that
+ * resolves to two allowances, a meter that has been unreadable for half an
+ * hour — is dispatch stopped with no self-recovery, which is tier 2.
+ *
+ * Each summary carries the fact that will change when the situation does (the
+ * reset instant, the configured id, the date), because the escalation ledger
+ * dedupes on the summary: a stable one pages once and then goes quiet, which
+ * is right for a repeated tick and wrong for the next window.
+ */
+function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation | undefined {
+  const base = { project, issue: NO_ISSUE };
+  if (plan.state === "at-cap") {
+    const window = plan.window?.id ?? plan.cap?.windowId ?? "the configured window";
+    const resets =
+      plan.resetsAt === undefined
+        ? new Date().toISOString().slice(0, 10)
+        : new Date(plan.resetsAt).toISOString();
+    return {
+      ...base,
+      tier: 1,
+      summary: `Plan allowance cap reached on ${window} — ${project} is not claiming new work (window ${resets})`,
+      detail: [
+        plan.detail,
+        "Running workers finish normally; only new claims are held.",
+        "Dispatch resumes by itself once the provider reports the window reset or usage below the threshold —",
+        "no `resume` needed. Raise `caps.planUsage.maxUsedFraction` only if you mean to spend the rest.",
+      ].join("\n"),
+    };
+  }
+  if (plan.state === "blind") {
+    return {
+      ...base,
+      tier: 2,
+      // Dated: a meter that breaks again next month is a new incident, not a
+      // repeat of this one.
+      summary: `Plan usage source unreadable — ${project} is not claiming new work (${new Date().toISOString().slice(0, 10)})`,
+      detail: [
+        plan.detail,
+        "The guard admitted work while the failure looked transient and has now stopped.",
+        "Check `omp usage --json` on the fleet host, or set `caps.planUsage` to null if this fleet is unmetered.",
+      ].join("\n"),
+    };
+  }
+  if (
+    plan.state === "window-missing" ||
+    plan.state === "window-ambiguous" ||
+    plan.state === "window-uncomparable"
+  ) {
+    return {
+      ...base,
+      tier: 2,
+      summary: `Plan usage cap names an unusable window "${plan.cap?.windowId ?? "?"}" — ${project} is not claiming new work`,
+      detail: [
+        plan.detail,
+        "Run `omp usage --json` and copy an allowance `id` into `caps.planUsage.windowId`,",
+        "or set `caps.planUsage` to null if this fleet is unmetered.",
+      ].join("\n"),
+    };
+  }
+  return undefined;
+}
+
 /**
  * Which routed candidates get a worker this tick — in queue order, never more
  * than `slots` of them. Every non-admission receives a stable reason code.
@@ -1294,7 +1891,7 @@ export function summarizeDispatch(
  * that grows a field has no business breaking these tests.
  */
 export async function admitCandidates(
-  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate">,
+  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage" | "boundary">,
   routed: Routed[],
   slots: number,
 ): Promise<AdmissionPass> {
@@ -1306,6 +1903,50 @@ export async function admitCandidates(
     holds.push({ issue, reason });
   };
 
+  // The fail-closed the issue asks for, and it only ever fires because the
+  // operator asked for a boundary by name. Placed above every other gate,
+  // including the tracker calls: a fleet that must not dispatch must not spend
+  // API budget discovering it, and it must not claim an issue it will refuse.
+  //
+  // Deliberately NOT a downgrade to group-mode. That is a different, weaker
+  // claim, and silently substituting it is how an operator ends up believing
+  // they have a boundary they do not have (#125).
+  if (boundaryRefusesDispatch(d.boundary) && d.boundary !== undefined) {
+    const refusal = boundaryRefusal(d.boundary.probe);
+    for (const r of routed) hold(r.issue.number, "credential-boundary");
+    log(`credential boundary holding ${String(routed.length)} candidate(s): ${refusal}`);
+    if (!d.boundary.paged) {
+      d.boundary.paged = true;
+      await safeEscalate(d, {
+        tier: 2,
+        project: project.name,
+        issue: NO_ISSUE,
+        summary: `${project.name} cannot dispatch: credentials.isolation is "per-run" and this host offers no mechanism`,
+        detail: [refusal, "", "Nothing is dispatched until this is resolved. No work has been claimed."].join("\n"),
+      });
+    }
+    return { admitted: [], holds };
+  }
+
+  // The plan allowance is a fleet-wide question, so it is asked once per pass
+  // and answers for every candidate — unlike every gate below it, which is
+  // per-issue. It sits here rather than beside the spend cap in `tick` for one
+  // reason: the spend cap *pauses the daemon* and waits for a human, and a
+  // weekly plan window resets by itself. A guard that demanded `resume` after
+  // every rollover would cost more operator attention than the guard saves
+  // (#110). Already-running workers are untouched and settle normally.
+  //
+  // Placed after the cheap local busy-set read and before the first tracker
+  // call, so a held fleet spends no GitHub API budget discovering it is held.
+  const plan = await readPlanUsage(caps.planUsage, d.usage);
+  if (plan.blocking) {
+    for (const r of routed) hold(r.issue.number, "plan-usage-cap");
+    log(`plan usage gate holding ${String(routed.length)} candidate(s): ${plan.detail}`);
+    const escalation = planUsageEscalation(project.name, plan);
+    if (escalation !== undefined) await safeEscalate(d, escalation);
+    return { admitted: [], holds };
+  }
+
   // parent -> blocking issue. Seeded from active runs (including pushed-green),
   // then extended by candidates admitted earlier in this same pass so two
   // siblings never both clear the gate in one tick.
@@ -1380,7 +2021,7 @@ export async function admitCandidates(
       continue;
     }
 
-    // Fail closed on work that exists only in a worktree. `addWorktree` clears
+    // Fail closed on work that exists only in a run repo. `addRunRepo` clears
     // the tree at <workspaceRoot>/<issue> before it provisions, so admitting
     // this issue is what finally destroys the copy the salvage could not save
     // (#118). Nothing here can recover it — git already refused once — so the
@@ -1794,28 +2435,83 @@ export async function turnLimitResponse(
   );
 }
 
+export interface DaemonHttpDeps {
+  project: string;
+  store: Pick<Store, "latestRun">;
+  turnLimits: TurnLimitRegistry;
+  health: () => DaemonHealthSnapshot;
+}
+
+/**
+ * The whole HTTP surface, in one named function so a test can pin what is *not*
+ * on it.
+ *
+ * Two routes: a health read, and the turn-limit control. Everything else is
+ * 404, and that is the contract — see the prohibition at the `Bun.serve` call
+ * for why no mutation may be added here. Extracted from the serve callback
+ * precisely so "the daemon's HTTP port exposes no mutation route" is something
+ * a test asserts rather than something a reviewer has to notice (#126).
+ */
+export async function daemonHttpResponse(req: Request, d: DaemonHttpDeps): Promise<Response> {
+  const url = new URL(req.url);
+  if (req.method === "GET" && url.pathname === "/healthz") return Response.json(d.health());
+  const control = await turnLimitResponse(req, d.project, d.store, d.turnLimits);
+  return control ?? new Response("not found\n", { status: 404 });
+}
+
 export interface StatusSnapshot {
   project: string;
   configPath: string;
   stateDir: string;
   paused: boolean;
   caps: Caps;
+  /**
+   * The effective per-shape release grants. On the snapshot rather than re-read
+   * by each renderer because #122 began with a grant nobody had looked at in
+   * weeks: `status` names them so a stale one is visible without opening either
+   * the config or the brief.
+   */
+  releaseGrants: ResolvedGrants;
   /** Occupied issues: live workers plus green PRs awaiting a human merge. */
   activeRuns: RunRecord[];
   /** Newest attempts holding a preserved WIP tip, or a tree that is still the
    *  only copy of work the daemon could not save. */
   salvagedRuns: RunRecord[];
+  /** Reports the operator has not provably received: pending, in-flight with an
+   *  unknown outcome, or written off. An empty list is the only honest way to
+   *  say "everything authored this cycle actually went out" (#123). */
+  openReports: ReportRecord[];
+  /**
+   * The most recent conductor-verb calls and how the daemon decided them
+   * (#126). On `status` rather than only behind `omp-conductor ledger` because
+   * a refused merge is news: it means a session tried to do something the
+   * config does not let it, and an operator who has to know to go looking is an
+   * operator who finds out from the tracker instead.
+   */
+  verbLedger: VerbLedgerEntry[];
   /** Runs backed by a worker process — the number capacity compares against. */
   liveWorkers: number;
   runsToday: number;
   spendTodayUsd: number;
   dispatch?: DispatchSummary;
+  /**
+   * Latest plan-allowance verdict, when the caller read one. Optional because
+   * this snapshot is built synchronously off the store while the provider read
+   * is I/O: a renderer that did not do that work must say "not read" rather
+   * than print a percentage nobody measured (#110).
+   */
+  planUsage?: PlanUsageStatus;
 }
 
 /** Builds a status reading from an already-open store. Long-lived operator
  * surfaces use this path so a one-second refresh does not repeatedly open and
  * initialise SQLite connections. */
-export function statusSnapshotFromStore(p: ProjectConfig, caps: Caps, store: Store): StatusSnapshot {
+export function statusSnapshotFromStore(
+  p: ProjectConfig,
+  caps: Caps,
+  store: Store,
+  planUsage?: PlanUsageStatus,
+): StatusSnapshot {
   const since = startOfToday();
   const dispatch = store.latestDispatch(p.name);
   return {
@@ -1824,12 +2520,16 @@ export function statusSnapshotFromStore(p: ProjectConfig, caps: Caps, store: Sto
     stateDir: stateDir(),
     paused: isPaused(),
     caps,
+    releaseGrants: resolveReleaseGrants(p),
     activeRuns: store.activeRuns(p.name),
     salvagedRuns: store.salvagedRuns(p.name),
+    openReports: store.openReports(p.name),
+    verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
     liveWorkers: store.liveRuns(p.name).length,
     runsToday: store.runsStartedSince(p.name, since),
     spendTodayUsd: store.spendSince(p.name, since),
     ...(dispatch === undefined ? {} : { dispatch }),
+    ...(planUsage === undefined ? {} : { planUsage }),
   };
 }
 
@@ -1895,6 +2595,24 @@ export function formatSalvagedRuns(runs: readonly RunRecord[]): string[] {
   return lines;
 }
 
+/**
+ * The grant table, named shape by shape.
+ *
+ * One renderer for both status surfaces (this one and the fleet view), because
+ * #122 began with a POLICY grant that no longer matched anyone's intent and went
+ * unnoticed: a stale grant has to be visible from `status` alone, and two
+ * renderers would eventually show it in only one of them.
+ */
+export function formatReleaseGrants(grants: ResolvedGrants): string[] {
+  const granted = RELEASE_SHAPES.filter((shape) => grants[shape] === "orchestrator");
+  return [
+    granted.length === 0
+      ? "release   no shape granted — every release/deploy tool call is blocked"
+      : `release   granted to the orchestrator: ${granted.join(", ")}`,
+    ...RELEASE_SHAPES.map((shape) => `  ${shape.padEnd(19)}${grants[shape]}`),
+  ];
+}
+
 export function formatStatus(s: StatusSnapshot): string {
   const lines = [
     `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
@@ -1907,11 +2625,17 @@ export function formatStatus(s: StatusSnapshot): string {
     s.caps.dailySpendUsd === null
       ? `  spend today        $${s.spendTodayUsd.toFixed(2)} (no daily cap)`
       : `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
+    // Its own row, never folded into the spend row: they are two independent
+    // controls, and an operator has to be able to see which one stopped the
+    // fleet (#110).
+    `  plan usage         ${planUsageLine(s.planUsage)}`,
     `  new worker turns   ${s.caps.workerMaxTurns}`,
     `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
     `  failed attempts    ${s.caps.maxAttemptsPerIssue}`,
     `  continuations      ${s.caps.maxContinuationsPerIssue}`,
     "",
+    ...formatReleaseGrants(s.releaseGrants),
+    "",
     formatDispatchSummary(s.dispatch),
     "",
   ];
@@ -1925,9 +2649,16 @@ export function formatStatus(s: StatusSnapshot): string {
           `${r.turns}/${r.maxTurns} turns  $${r.spendUsd.toFixed(2)}  ${r.branch}` +
           (r.prUrl ? `  ${r.prUrl}` : ""),
       );
+      // Its escalation was deduplicated the moment it was delivered, so this
+      // line is the only place a flagged run stays visible while its PR waits
+      // for a merge — which is precisely the window the flag is about (#128).
+      const flagged = settlementFlagSummary(r.settlementFlags);
+      if (flagged !== undefined) lines.push(`      ${flagged}`);
     }
   }
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
+  lines.push(...formatOpenReports(s.openReports));
+  lines.push(...formatVerbLedger(s.verbLedger));
   // Deploy hint: a restart while workers are live orphans them (salvage runs
   // first — #35). Prefer pause + drain to zero live workers when you can wait.
   if (s.liveWorkers > 0) {
@@ -2025,6 +2756,13 @@ export function prepareConductor(): void {
 export async function reconcileOrphanedRuns(
   store: Store,
   project: string,
+  /**
+   * Resolves the privileged publisher for one orphaned run. Optional because a
+   * test driving the row transitions has no repo to publish to; production
+   * always passes it, and without it a salvaged WIP commit stays local — which
+   * is the half of #121 that reaches a human.
+   */
+  publish?: (run: RunRecord) => RunPublisher,
 ): Promise<RunRecord[]> {
   // Live runs only: `pushed-green` holds no process, so it cannot be orphaned by
   // a process dying — it is finished work waiting on a human merge.
@@ -2043,6 +2781,11 @@ export async function reconcileOrphanedRuns(
             attempt: r.attempt,
             ending: "killed by a daemon restart",
             worktree: r.worktree,
+            branch: r.branch,
+            // An orphan's tree is kept, so its commits are not about to be
+            // deleted — but a WIP salvage still has to reach GitHub, which is
+            // #121's whole point and is now the daemon's hop to make.
+            publish: publish?.(r),
             tree: "keep",
           });
     store.updateRun(r.id, { state: "orphaned", endedAt, ...settlement?.patch });
@@ -2053,12 +2796,63 @@ export async function reconcileOrphanedRuns(
 // ------------------------------------------------------------------- the daemon
 
 export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
+  // Before anything reads the config for real: a file written before #125 gains
+  // an explicit `credentials.isolation` here, so the answer lives on disk
+  // rather than being inherited from a default nobody chose. Non-fatal by
+  // design — a config the daemon cannot rewrite still loads as `"none"` and
+  // still dispatches, because an outage caused by a security feature is worse
+  // than the day before it shipped.
+  try {
+    const migration = migrateCredentialsOnDisk();
+    if (migration.migrated.length > 0) {
+      log(
+        `migrated ${migration.migrated.join(", ")} to an explicit credentials.isolation: "none" in ` +
+          `${migration.path} — this fleet is UNPROTECTED: sessions run as this daemon's user and can reach ` +
+          `its GitHub credential. Set credentials.isolation to "per-run" once the host is provisioned (README).`,
+      );
+    }
+  } catch (err) {
+    log(`could not persist the credentials migration (${errText(err)}) — continuing with isolation "none"`);
+  }
+
   const cfg = loadConfig();
   const project = findProject(cfg, o.project);
   const caps = resolveCaps(project, cfg.defaults);
   const store = openStore(dbPath());
   const tracker = makeTracker(project);
 
+  // The host capability probe, once, at startup. It states the mechanism
+  // rather than guessing, and it proves the launcher works against a trivial
+  // child before reporting one available — a mechanism whose argv the host
+  // rejects looks identical here and then fails every dispatch at run time.
+  const credentials = resolveCredentials(project);
+  const probe = await probeHost({ slots: caps.maxConcurrentWorkers });
+  const boundary: FleetBoundary = {
+    isolation: credentials.isolation,
+    probe,
+    slots: createSlotPool(caps.maxConcurrentWorkers),
+    paged: false,
+  };
+  const described = describeBoundary(credentials.isolation, probe);
+  log(`credential boundary: ${described.headline}`);
+  for (const line of described.detail) log(`credential boundary: ${line}`);
+
+  // #126's transport, stated at startup rather than guessed at first use. The
+  // banner names what this host can actually enforce — whether the kernel will
+  // vouch for a caller's uid, and whether runs get distinct principals at all —
+  // because "peer credentials asserted" is a claim, and a claim nobody printed
+  // is one nobody can check against the host it is running on.
+  const verbPeerReader = peerCredentialReader();
+  const verbActions = githubVerbActions(project);
+  let orchestratorVerbs: VerbListener | undefined;
+  log(
+    `verb transport: ${transportBanner(
+      ensureVerbSocketDir(stateDir()),
+      verbPeerReader,
+      probe.mechanism === "uid-pool",
+    )}`,
+  );
+
   // Recorded here, before a single tick runs, so that the deploy an operator
   // *means* to do never trips the tripwire: installing a new build and
   // restarting the unit re-records this from the new files. What it catches is
@@ -2073,7 +2867,17 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // daemon must not orphan that daemon's real, live workers).
   const alive = livingDaemon();
   if (alive === undefined || alive.pid === process.pid) {
-    for (const r of await reconcileOrphanedRuns(store, project.name)) {
+    // The orphan path salvages, and #121 requires that salvage to reach
+    // GitHub. Since the run's commits now live in its own repository, the hop
+    // is the daemon's: resolve the routed repo by name off the run row.
+    const orphanPublisher = (r: RunRecord): RunPublisher => {
+      const repo = project.routing.repos[r.repo];
+      return async (branch) =>
+        repo === undefined
+          ? { ok: false, stderr: `run ${String(r.id)} names repo "${r.repo}", which this project no longer routes` }
+          : pushRunBranch(project, { repo, runRepoPath: r.worktree, branch });
+    };
+    for (const r of await reconcileOrphanedRuns(store, project.name, orphanPublisher)) {
       log(
         `#${r.issue} orphaned by a previous daemon (attempt ${r.attempt}, was ${r.state}, worktree ${r.worktree}) — ` +
           `slot freed; the ${project.stateLabels.inProgress} label stays until the orchestrator triages what the worker left`,
@@ -2086,6 +2890,9 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // Standing orders. The orchestrator holds none of this file's context, so
   // everything it needs to act — which tracker, which labels, what the fleet
   // does — has to be said once, in words.
+  const releaseGrants = resolveReleaseGrants(project);
+  const grantedShapes = RELEASE_SHAPES.filter((shape) => releaseGrants[shape] === "orchestrator");
+  const deniedShapes = RELEASE_SHAPES.filter((shape) => releaseGrants[shape] !== "orchestrator");
   const brief = [
     `You are the omp-conductor orchestrator for project "${project.name}".`,
     `Tracker: ${project.tracker.repo}. Pass --repo ${project.tracker.repo} to every gh command:`,
@@ -2106,10 +2913,14 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         "a time, freshness-checked against the base branch, per the Releases section of your POLICY.md."
       : "You never edit product code, push a branch, or merge a PR — a worker session edits and pushes, and a " +
         "human merges.",
-    `Release tool gate: releasePolicy=${resolveReleasePolicy(project)}. ` +
-      (resolveReleasePolicy(project) === "none"
-        ? "Release and deploy tool calls are mechanically blocked."
-        : "Release and deploy tool calls are permitted only by the operator brief."),
+    // Named shape by shape rather than as one policy word, so a stale grant is
+    // legible in the transcript instead of only in the config file — the #122
+    // incident began with a grant that no longer matched anyone's intent.
+    `Release tool gate: ${
+      grantedShapes.length === 0
+        ? "every release and deploy shape is mechanically blocked for you"
+        : `you may invoke ${grantedShapes.join(", ")} — and only by the procedure in your POLICY.md`
+    }.` + (deniedShapes.length === 0 ? "" : ` Blocked: ${deniedShapes.join(", ")}.`),
     "Handle each escalation below before the next one.",
   ].join("\n");
 
@@ -2127,10 +2938,87 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     log("orchestrator: external — tier-1 escalations post as issue comments for the external session's drain duty");
   } else {
     try {
+      // Its own principal, distinct from every worker slot. The orchestrator
+      // reads the state directory and its briefs and must have no read or
+      // write access to any run checkout — so `workspaceRoot` and the mirror
+      // are denied outright here, on top of the #127 tool-layer jail. Two
+      // layers because they fail differently: the jail refuses a structured
+      // tool call, the principal refuses the syscall `bash` would make.
+      // Same rule as a worker's, for the same reason: under `uid-pool` the
+      // orchestrator is its own uid, so every tree it must reach lives outside
+      // the 0700 private state directory. Its principal is in `conductor-runs`
+      // and deliberately NOT in the daemon group, so it could not traverse
+      // there even once — and widening the state directory is the one fix that
+      // is not available, because that is where conductor.db lives.
+      const orchTreeRoot = probe.mechanism === "uid-pool" ? sharedRoot() : stateDir();
+      if (orchTreeRoot !== stateDir()) {
+        mkdirSync(orchTreeRoot, { recursive: true });
+        chmodSync(orchTreeRoot, 0o711);
+      }
+      const orchEnvRoot = join(orchTreeRoot, "boundaries", "orchestrator");
+      const orchCwd = join(orchTreeRoot, "orchestrator");
+      mkdirSync(orchCwd, { recursive: true });
+      const orchestratorBoundary = buildSessionBoundary({
+        probe,
+        isolation: credentials.isolation,
+        role: "orchestrator",
+        envRoot: orchEnvRoot,
+        writeRoots: [orchCwd],
+        denyReadRoots: [...credentialDenyRoots(), project.workspaceRoot, project.mirrorRoot],
+        denyReadFiles: credentialDenyFiles(),
+        ...(credentials.readToken === undefined ? {} : { readToken: credentials.readToken }),
+      });
+      if (orchestratorBoundary.principal !== undefined) {
+        const gid = probe.daemonGid;
+        if (gid === undefined) {
+          throw new Error(
+            `the orchestrator principal was allocated without a resolved ${CONDUCTOR_GROUPS.daemon} gid`,
+          );
+        }
+        applyRunOwnership(orchEnvRoot, orchestratorBoundary.principal, gid);
+        applyRunOwnership(orchCwd, orchestratorBoundary.principal, gid);
+        // The same empirical gate a worker gets. The orchestrator is the
+        // session with merge and release authority, so "it cannot reach the
+        // credential" matters more here, not less — and it was the half that
+        // was never checked. `sharedGroup: false` because it is launched with
+        // no supplementary group at all, so the probe has to run under exactly
+        // that identity rather than a worker's.
+        const orchLeaking = await credentialReadRefusal(
+          spawnCaptured,
+          orchestratorBoundary.principal,
+          { boundingSet: probe.boundingSetDropped, sharedGroup: false },
+          [...credentialDenyRoots(), ...credentialDenyFiles()],
+        );
+        if (orchLeaking !== undefined) throw new Error(orchLeaking);
+      }
+      // A third socket, distinct from every run's, in the same daemon-owned
+      // 0711 parent. This is what makes "merge authority is the orchestrator's"
+      // a property of the channel: the daemon knows which session is speaking
+      // because of where the connection arrived, and no payload can move a
+      // worker's call onto this one (#126).
+      orchestratorVerbs = await listenVerbChannel(
+        verbDeps({ project, store, tracker, verbActions }),
+        {
+          kind: "orchestrator",
+          path: verbSocketPath(ensureVerbSocketDir(orchTreeRoot), "orchestrator"),
+          project: project.name,
+          role: "orchestrator",
+          ...(orchestratorBoundary.principal === undefined
+            ? {}
+            : { principal: orchestratorBoundary.principal }),
+        },
+        { ...(verbPeerReader === undefined ? {} : { peerReader: verbPeerReader }) },
+      );
       orchestrator = await startOrchestrator({
-        cwd: stateDir(),
+        cwd: orchCwd,
         brief,
-        releasePolicy: resolveReleasePolicy(project),
+        releaseGrants,
+        boundary: orchestratorBoundary,
+        socketPath: join(orchEnvRoot, "ipc.sock"),
+        verbSocketPath: orchestratorVerbs.path,
+        onChildLog: (line) => {
+          log(`orchestrator ${line}`);
+        },
         onReleaseBlocked: (shape) => recordReleaseBlock(project.name, "orchestrator", shape),
       });
       const transcript = orchestrator.sessionFile();
@@ -2146,14 +3034,45 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   }
 
   const escalator = createEscalator(project, tracker, store, orchestrator);
+
+  // Report delivery is the daemon's, not the model's (#123). Built beside the
+  // escalator because a report nobody can deliver pages through it, and driven
+  // on its own timer rather than inside `tick()`: a paused fleet claims nothing
+  // but still owes its operator the report it was handed, and five minutes is a
+  // long time to sit on a page.
+  const outbox = createReportOutbox({
+    project,
+    store,
+    escalate: (e) => escalator.escalate(e),
+    log,
+  });
+
+  // Every row still `sending` when a daemon boots belonged to a process that is
+  // gone, so its outcome will never be learned — retry it and say so in the
+  // message. Guarded exactly like the orphan reconciliation above and for the
+  // same reason: a row belonging to a *live* daemon is genuinely in flight, and
+  // stealing it would page the operator twice for one report.
+  if (alive === undefined || alive.pid === process.pid) {
+    for (const r of outbox.recover(Date.now())) {
+      log(
+        `report ${r.id} was left mid-send by a previous daemon (attempt ${r.attempts}) — ` +
+          `retrying; its message will say it may be a repeat`,
+      );
+    }
+  }
+
   const turnLimits = createTurnLimitRegistry((runId, maxTurns) => {
     store.updateRun(runId, { maxTurns });
   });
   const d: Deps = {
     project,
     caps,
+    boundary,
     tracker,
     store,
+    // Process-wide, so a `status` served off this daemon's own HTTP surface
+    // reuses the tick's reading instead of shelling out again.
+    usage: sharedUsageSource(),
     escalate: (e) => escalator.escalate(e),
     turnLimits,
     integrity,
@@ -2161,13 +3080,20 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     // page again about a stall that is still on disk.
     stall: { paged: false },
     cleanup: { next: 0 },
+    ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
+    verbActions,
   };
 
   if (o.once) {
     try {
       await tick(d);
+      // A single tick still owes the outbox a pass: a drill that leaves a
+      // report undelivered teaches an operator the wrong thing about the
+      // mechanism it is drilling.
+      await outbox.deliverDue();
     } finally {
       await orchestrator?.dispose();
+      await orchestratorVerbs?.close();
       store.close();
     }
     return;
@@ -2194,6 +3120,25 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   refreshCodeGraph();
   const graphTimer = setInterval(refreshCodeGraph, GRAPH_HEALTH_INTERVAL_MS);
 
+  // Overlap-guarded like the graph probe: a pass that is still waiting on
+  // Telegram must not have a second pass started on top of it, or one report
+  // would be claimed, reclaimed and sent twice by this process alone.
+  let reportPass: Promise<void> | undefined;
+  const drainReports = (): void => {
+    if (reportPass !== undefined) return;
+    reportPass = outbox
+      .deliverDue()
+      .then(() => {})
+      .catch((err: unknown) => {
+        log(`report delivery pass failed: ${errText(err)}`);
+      })
+      .finally(() => {
+        reportPass = undefined;
+      });
+  };
+  drainReports();
+  const reportTimer = setInterval(drainReports, REPORT_DELIVERY_INTERVAL_MS);
+
   const workers = createWorkerPool();
   let stopping = false;
   let wake: (() => void) | undefined;
@@ -2206,17 +3151,31 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   process.on("SIGINT", stop);
   process.on("SIGTERM", stop);
 
+  // ── NO MUTATION ROUTE BELONGS ON THIS PORT ────────────────────────────────
+  //
+  // This is unauthenticated loopback TCP. Every local user can reach it, it
+  // carries no credential of any kind, and it cannot tell one caller from
+  // another: `127.0.0.1` is not an identity. `turnLimitResponse` already shows
+  // what that costs — it trusts a body-supplied `project`, which is exactly the
+  // shape "identity from the payload" takes when nobody is watching, and it is
+  // tolerable only because raising a turn ceiling is bounded and reversible.
+  //
+  // A merge, a push, a release or a label is none of those things. Do not add
+  // one here, and do not add "just a small one" behind a shared secret either:
+  // a secret readable by the process that would be attacking you is not
+  // authentication. Mutations go over the per-run unix sockets in
+  // `verbs/socket.ts`, where the kernel says who the caller is and the daemon
+  // derives project, run and role from the channel rather than the body (#126).
   const server = Bun.serve({
     hostname: "127.0.0.1",
     port: o.port ?? DEFAULT_PORT,
-    async fetch(req) {
-      const url = new URL(req.url);
-      if (req.method === "GET" && url.pathname === "/healthz") {
-        return Response.json(daemonHealthSnapshot(store, project.name, undefined, undefined, codeGraph));
-      }
-      const control = await turnLimitResponse(req, project.name, store, turnLimits);
-      return control ?? new Response("not found\n", { status: 404 });
-    },
+    fetch: (req) =>
+      daemonHttpResponse(req, {
+        project: project.name,
+        store,
+        turnLimits,
+        health: () => daemonHealthSnapshot(store, project.name, undefined, undefined, codeGraph),
+      }),
   });
   log(`serving /healthz on :${server.port}, project ${project.name}`);
 
@@ -2243,11 +3202,20 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     process.off("SIGINT", stop);
     process.off("SIGTERM", stop);
     clearInterval(graphTimer);
+    clearInterval(reportTimer);
+    // Before the store closes, like the orchestrator below: a pass mid-send has
+    // a `markReportDelivered` still to write, and losing that write is exactly
+    // how a delivered report comes back as an ambiguous one on the next boot.
+    await reportPass;
     await workers.drain();
     await server.stop(true);
     // Before the store closes: a queued injection that rejects on the way out
     // falls back to an issue comment, and that path writes the dedup marker.
     await orchestrator?.dispose();
+    // After the session it belongs to is gone. A bound socket outliving its
+    // orchestrator is a channel accepting merges for a session that no longer
+    // exists.
+    await orchestratorVerbs?.close();
     store.close();
     log("stopped");
     // A handled SIGTERM still leaves some runtimes with a non-zero default