omp-conductor 0.4.4 → 0.4.5

package/README.md

@@ -149,6 +149,25 @@ be present. If you run omp, it is.
 Also required on the host:
 
 - `bun`: the CLI and the daemon run on it (`Bun.serve` backs `/healthz`).
+- **A model credential a *session* can reach.** Sessions run with `$HOME`
+  redirected into a per-run tree, so the harness never reads the operator's own
+  configuration — that is what keeps a credential-bearing MCP server out of every
+  session. It also means a login recorded only in `~/.omp/agent/agent.db` is
+  invisible to a worker, which then dies at turn 0 with `No model selected`. Two
+  supported shapes:
+  - a model API key in the **daemon's** environment (`ANTHROPIC_API_KEY`,
+    `OPENAI_API_KEY`, …); these are deliberately not scrubbed, unlike the GitHub
+    and npm keys.
+  - the harness's **auth broker** — `omp auth-broker serve` plus `omp auth-broker
+    token`, or `auth.broker.url` / `auth.broker.token` in
+    `~/.omp/agent/config.yml`. The conductor resolves that connection and injects
+    it into each session. Refresh tokens stay in the broker and a session receives
+    only short-lived access tokens, which is exactly what per-run isolation wants.
+
+  With neither, `omp-conductor status` reports the hold and **nothing is
+  dispatched** — no issue is claimed and no attempt is spent. Copying `agent.db`
+  into each run is deliberately not how this works: the harness rotates the OAuth
+  credentials in it, so a copy goes stale and can invalidate the original.
 - `gh`, already authenticated: every tracker operation shells out to it, so the
   daemon never handles a GitHub token itself.
 - `git`: mirrors and worktrees.
@@ -1376,6 +1395,7 @@ persists the class on the row, and performs the one recovery that class names.
 
 | Class | Signals | Recovery | Budget |
 | --- | --- | --- | --- |
+| `env-start-failure` | turn 0 plus an explicit harness start error (`No model selected`, a rejected key) | escalate — the session never read the issue | none |
 | `settlement-stuck` | a row carrying a PR that has since merged | settle: release the label, mark the row merged | none |
 | `merge-conflict` | `pushed-green`, PR open, GitHub reports conflicting | requeue for a rebase continuation | continuation |
 | `question` | the worker stopped to ask something (`blocked`) | escalate, carrying the worker's own report as evidence | none |
@@ -1394,9 +1414,10 @@ cause nobody has named — the behaviour this exists to end.
 
 ### The budgets follow the cause
 
-`failuresFor` (implementation attempts) excludes `ci-infra` and
-`settlement-stuck`; `continuationsFor` excludes `admin-kill` and
-`settlement-stuck`. A merge conflict *is* charged as a continuation, because a
+`failuresFor` (implementation attempts) excludes `ci-infra`, `settlement-stuck`
+and `env-start-failure`; `continuationsFor` excludes `admin-kill`,
+`settlement-stuck` and `env-start-failure`. An environment fault charges neither:
+the session never started, so nothing about the issue was attempted. A merge conflict *is* charged as a continuation, because a
 rebase is real work — just never as a failed implementation attempt.
 
 An **unclassified** row (every row written before 0.4.3) counts exactly as it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/credentials.ts

@@ -37,6 +37,7 @@ import {
   writeFileSync,
   type Stats,
 } from "node:fs";
+import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 
 import {
@@ -207,6 +208,159 @@ export function prepareSessionEnvRoot(root: string): SessionEnvRoot {
   return paths;
 }
 
+/**
+ * Environment variables that carry a model credential directly.
+ *
+ * Deliberately NOT in {@link CREDENTIAL_ENV_KEYS}: those are the ones a session
+ * must never inherit. A model credential is the opposite — without one there is
+ * no session at all.
+ */
+export const MODEL_ENV_KEYS = [
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENROUTER_API_KEY",
+  "XAI_API_KEY",
+  "GEMINI_API_KEY",
+  "GOOGLE_API_KEY",
+] as const;
+
+/** The harness's auth-broker connection, as its own env vars name it. */
+export const BROKER_URL_ENV = "OMP_AUTH_BROKER_URL";
+export const BROKER_TOKEN_ENV = "OMP_AUTH_BROKER_TOKEN";
+
+export type ModelCredential =
+  /** Already in the daemon's environment, so it survives the redirect untouched. */
+  | { kind: "env" }
+  /** Resolved from the operator's own home and injected as broker env vars. */
+  | { kind: "broker"; url: string; token: string };
+
+/**
+ * How a session under a redirected `$HOME` is going to authenticate a model —
+ * or `undefined` when it cannot, which is a fleet that must not dispatch.
+ *
+ * Sessions run with `$HOME` pointed at a per-run tree so the harness never reads
+ * the operator's configuration; that is what kept a GitHub MCP server carrying
+ * its own PAT out of every session. It also hid the harness's *own* credentials,
+ * so every worker died at turn 0 with `No model selected` and spent an issue
+ * attempt doing it — 27 recoveries on the reference fleet, while the fleet looked
+ * busy (#152).
+ *
+ * The fix is emphatically **not** to copy `<agentDir>/agent.db` into each run.
+ * That file holds OAuth credentials the harness rotates, plus threads, jobs and
+ * caches; the first run to refresh a token would update its own private copy and
+ * strand every later run — and the provider may invalidate the old refresh token
+ * as it rotates, so a copy can break the operator's own login too. The harness
+ * ships the right answer: an auth broker whose whole point is that *refresh
+ * tokens never leave it*, handing clients short-lived access tokens. That is also
+ * exactly the shape per-run isolation wants.
+ *
+ * Precedence mirrors the harness's own resolver, narrowly:
+ *   1. broker env vars, or any model API key, already in this process.
+ *   2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml`.
+ *   3. `<configRoot>/auth-broker.token`, paired with a URL from 1 or 2.
+ *
+ * Re-read here rather than imported from the harness because this package must
+ * type-check and publish without its optional peer dependency — `omp.ts` is the
+ * only file allowed to touch it. `!command` indirection is deliberately not
+ * supported: an operator using that has the env-var path, which this honours.
+ */
+export function resolveModelCredential(
+  base: Readonly<Record<string, string | undefined>> = process.env,
+  agentDir = join(homedir(), ".omp", "agent"),
+  configRoot = join(homedir(), ".omp"),
+): ModelCredential | undefined {
+  const envUrl = base[BROKER_URL_ENV];
+  const envToken = base[BROKER_TOKEN_ENV];
+  if ((envUrl ?? "").length > 0 && (envToken ?? "").length > 0) return { kind: "env" };
+  if (MODEL_ENV_KEYS.some((key) => (base[key] ?? "").length > 0)) return { kind: "env" };
+
+  const configured = readBrokerConfig(agentDir);
+  const url = (envUrl ?? "").length > 0 ? envUrl : configured.url;
+  if (url === undefined || url.length === 0) return undefined;
+  const token = configured.token ?? readTokenFile(join(configRoot, "auth-broker.token"));
+  if (token === undefined || token.length === 0) return undefined;
+  return { kind: "broker", url, token };
+}
+
+/**
+ * The two `auth.broker.*` values out of the harness's `config.yml`.
+ *
+ * A deliberately tiny reader rather than a YAML dependency: exactly two scalar
+ * keys under one mapping, and anything it cannot understand simply reads as
+ * absent — which lands on the same refusal as no broker at all, rather than a
+ * parse error during dispatch.
+ */
+function readBrokerConfig(agentDir: string): { url?: string; token?: string } {
+  for (const name of ["config.yml", "config.yaml"]) {
+    const path = join(agentDir, name);
+    if (!existsSync(path)) continue;
+    let text: string;
+    try {
+      text = readFileSync(path, "utf8");
+    } catch {
+      continue;
+    }
+    const found = scanBrokerKeys(text);
+    if (found.url !== undefined || found.token !== undefined) return found;
+  }
+  return {};
+}
+
+/**
+ * `auth.broker.url` / `auth.broker.token` out of a YAML document, in either the
+ * dotted or the nested shape the harness's own docs use.
+ *
+ * An indentation scan rather than a regex or a YAML dependency: two scalar keys
+ * under one known path, and anything it cannot understand reads as absent, which
+ * lands on the same refusal as no broker at all rather than a parse error during
+ * dispatch.
+ */
+function scanBrokerKeys(text: string): { url?: string; token?: string } {
+  const out: { url?: string; token?: string } = {};
+  /** Enclosing mapping keys, innermost last, by indentation. */
+  const path: { indent: number; key: string }[] = [];
+  for (const raw of text.split("\n")) {
+    const line = raw.replace(/\s+$/, "");
+    if (line.trim().length === 0 || line.trim().startsWith("#")) continue;
+    const indent = line.length - line.trimStart().length;
+    const at = line.indexOf(":");
+    if (at < 0) continue;
+    const key = line.slice(indent, at).trim();
+    const value = line.slice(at + 1);
+    while (path.length > 0 && (path.at(-1) as { indent: number }).indent >= indent) path.pop();
+
+    const dotted = key.split(".");
+    const full = [...path.map((p) => p.key), ...dotted];
+    if (value.trim().length === 0) {
+      path.push({ indent, key: dotted.join(".") });
+      continue;
+    }
+    if (full.length !== 3 || full[0] !== "auth" || full[1] !== "broker") continue;
+    const scalar = unquote(value);
+    if (scalar.length === 0) continue;
+    if (full[2] === "url") out.url ??= scalar;
+    else if (full[2] === "token") out.token ??= scalar;
+  }
+  return out;
+}
+
+function unquote(raw: string): string {
+  const text = raw.trim();
+  if (text.startsWith("!")) return "";
+  const quoted = /^(['"])(.*)\1$/.exec(text);
+  return (quoted?.[2] ?? text).trim();
+}
+
+function readTokenFile(path: string): string | undefined {
+  if (!existsSync(path)) return undefined;
+  try {
+    const text = readFileSync(path, "utf8").trim();
+    return text.length === 0 ? undefined : text;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * The environment one session child runs with.
  *
@@ -222,7 +376,7 @@ export function prepareSessionEnvRoot(root: string): SessionEnvRoot {
  */
 export function sessionEnv(
   paths: SessionEnvRoot,
-  opts: { readToken?: string } = {},
+  opts: { readToken?: string; model?: ModelCredential } = {},
   base: Readonly<Record<string, string | undefined>> = process.env,
 ): Record<string, string> {
   const env: Record<string, string> = {};
@@ -244,6 +398,16 @@ export function sessionEnv(
   env["NPM_CONFIG_USERCONFIG"] = paths.npmrc;
   env["TMPDIR"] = paths.tmp;
 
+  // The redirect hides the operator's `config.yml` and token file, so a broker
+  // configured *there* has to be handed over explicitly or the session falls back
+  // to an empty local store and dies at turn 0 (#152). Env vars are the harness's
+  // own highest-precedence shape, and they carry an access-minting token rather
+  // than a refresh credential: the broker keeps that.
+  if (opts.model?.kind === "broker") {
+    env[BROKER_URL_ENV] = opts.model.url;
+    env[BROKER_TOKEN_ENV] = opts.model.token;
+  }
+
   // The one credential a session may be given, and only when an operator
   // configured it. Read-scoped by construction on GitHub's side — this package
   // cannot verify the scope, so the README says plainly that a write-scoped
@@ -1620,6 +1784,13 @@ export interface BoundaryRequest {
   denyReadRoots?: readonly string[];
   denyReadFiles?: readonly string[];
   readToken?: string;
+  /**
+   * How this session authenticates a model. Resolved once by the daemon and
+   * handed down rather than re-read per session, so every child of one tick
+   * agrees — and so a fleet with no credential is refused at admission instead of
+   * discovering it at turn 0 (#152).
+   */
+  model?: ModelCredential;
   /** Where a generated `sandbox-exec` profile is written. */
   profilePath?: string;
 }
@@ -1654,7 +1825,10 @@ export function mechanismSatisfies(
  */
 export function buildSessionBoundary(req: BoundaryRequest): SessionBoundary {
   const paths = prepareSessionEnvRoot(req.envRoot);
-  const env = sessionEnv(paths, req.readToken === undefined ? {} : { readToken: req.readToken });
+  const env = sessionEnv(paths, {
+    ...(req.readToken === undefined ? {} : { readToken: req.readToken }),
+    ...(req.model === undefined ? {} : { model: req.model }),
+  });
 
   if (req.isolation === "none") {
     return { mechanism: "none", launcher: [], env };

package/src/daemon.ts

@@ -107,8 +107,10 @@ import {
   openRunPr,
   probeHost,
   pushRunBranch,
+  resolveModelCredential,
   verifyDaemonAccess,
   type HostProbe,
+  type ModelCredential,
   type RunRepoRef,
   type SessionBoundary,
   type SlotPool,
@@ -198,6 +200,17 @@ interface Deps {
   integrity: IntegrityGate;
   stall: StallGate;
   cleanup?: RetainedCleanupCursor;
+  /**
+   * How sessions authenticate a model, resolved once at startup so every child of
+   * one tick agrees — and so a fleet with none is refused at admission instead of
+   * discovering it at turn 0 (#152).
+   *
+   * Optional exactly as {@link Deps.boundary} is: absent means no resolution was
+   * made, which is the shape a unit test that does not exercise this gate wants.
+   * `runDaemon` always resolves one. `paged` is the page-once latch, so a fleet
+   * held for an environment fault says so once rather than every five minutes.
+   */
+  model?: { credential?: ModelCredential; paged: boolean };
   /**
    * Reads the connecting uid off a verb socket (#126). Resolved once at startup
    * so the mechanism is logged before the first socket exists; absent on a host
@@ -1065,6 +1078,10 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       denyReadRoots: [...credentialDenyRoots(), project.workspaceRoot],
       denyReadFiles: credentialDenyFiles(),
       ...(credentials.readToken === undefined ? {} : { readToken: credentials.readToken }),
+      // Resolved from the operator's own home at startup, because the session's
+      // redirected $HOME cannot see it (#152). Admission already refused the whole
+      // pass when it is absent, so undefined here is a fleet not dispatching.
+      ...(d.model?.credential === undefined ? {} : { model: d.model.credential }),
     });
 
     if (boundary.principal !== undefined) {
@@ -1931,7 +1948,7 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  * that grows a field has no business breaking these tests.
  */
 export async function admitCandidates(
-  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage" | "boundary">,
+  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage" | "boundary" | "model">,
   routed: Routed[],
   slots: number,
 ): Promise<AdmissionPass> {
@@ -1968,6 +1985,48 @@ export async function admitCandidates(
     return { admitted: [], holds };
   }
 
+  // One layer down from the boundary above: that asks whether this host can run a
+  // session as its own principal, this asks whether a session can do anything at
+  // all once started. Every worker on the reference fleet died at turn 0 with
+  // "No model selected" and consumed an issue attempt for it — three issues in
+  // eleven minutes, while the fleet looked busy (#152).
+  //
+  // Above the tracker calls for the same reason as the boundary: a fleet that
+  // cannot dispatch must not claim an issue it will fail, and must not spend API
+  // budget discovering that.
+  if (d.model !== undefined && d.model.credential === undefined) {
+    for (const r of routed) hold(r.issue.number, "no-model-credential");
+    log(`no model credential holding ${String(routed.length)} candidate(s)`);
+    if (!d.model.paged) {
+      d.model.paged = true;
+      await safeEscalate(d, {
+        tier: 2,
+        project: project.name,
+        issue: NO_ISSUE,
+        summary: `${project.name} cannot dispatch: no model credential is reachable from a worker session`,
+        detail: [
+          "Sessions run with $HOME redirected into a per-run tree, so the harness never reads the",
+          "operator's own configuration — that is what keeps a credential-bearing MCP server out of",
+          "every session. It also means a login recorded only in ~/.omp/agent/agent.db is invisible to",
+          "a worker, which then dies at turn 0 with \"No model selected\".",
+          "",
+          "Two supported shapes, either of which fixes it:",
+          "  * a model API key in the daemon's environment (ANTHROPIC_API_KEY, OPENAI_API_KEY, …)",
+          "  * the harness's auth broker — `omp auth-broker serve` plus `omp auth-broker token`, or",
+          "    auth.broker.url / auth.broker.token in ~/.omp/agent/config.yml. Refresh tokens stay in",
+          "    the broker and each session gets a short-lived access token, which is what per-run",
+          "    isolation wants.",
+          "",
+          "Copying agent.db into each run is deliberately NOT how this works: the harness rotates the",
+          "OAuth credentials in it, so a copy goes stale and can invalidate the original.",
+          "",
+          "Nothing is dispatched until then. No work has been claimed, and no attempt was spent.",
+        ].join("\n"),
+      });
+    }
+    return { admitted: [], holds };
+  }
+
   // The plan allowance is a fleet-wide question, so it is asked once per pass
   // and answers for every candidate — unlike every gate below it, which is
   // per-issue. It sits here rather than beside the spend cap in `tick` for one
@@ -2961,15 +3020,38 @@ async function recoverRun(
   }
 
   if (recovery === "continue") {
-    // The branch is retained and its PR is open, so #50's continuation guard
-    // admits it: the next tick reattaches the branch and briefs a rebase.
+    // Two classes recover by continuing, and only one of them has anything left
+    // to do here.
+    //
+    // `turn-cap-progress` was already handed back by the completion path, which
+    // swapped its labels and left the branch retained. There is nothing to
+    // perform, and writing anything would be actively wrong: overwriting
+    // `lastError` with a rebase brief tells the continuation worker to rebase a
+    // run that simply ran out of turns, and re-swapping labels the completion
+    // path already swapped is a pair of no-op `gh` calls. Record-only, so the
+    // sweep stops re-offering it.
+    if (cls === "turn-cap-progress") {
+      store.updateRun(run.id, { recoveredAt: Date.now() });
+      log(`#${run.issue} already continuing from ${cls}: ${evidence}`);
+      return;
+    }
+
+    // `merge-conflict`: the branch is retained and its PR is open, so #50's
+    // continuation guard admits it and the next tick briefs a rebase.
+    //
+    // The tracker write goes FIRST, and that ordering is the whole retry
+    // contract. Writing `recoveredAt` before the swap took the row out of
+    // `runsNeedingClassification` — which selects on `recoveredAt IS NULL` — so a
+    // refused label swap stranded the row permanently under a log line promising
+    // a retry. That was the defect 0.4.4 claimed to have fixed and did not, for
+    // this one recovery.
+    if (!(await swapToQueue(d, run.issue, inProgress))) return;
     store.updateRun(run.id, {
       state: "killed",
       lastError:
         "merge-conflict: base moved under a green PR — rebase, regenerate recorded artifacts, push without force",
       recoveredAt: Date.now(),
     });
-    if (!(await swapToQueue(d, run.issue, inProgress))) return;
     log(`#${run.issue} requeued for a rebase continuation: ${evidence}`);
     return;
   }
@@ -3253,6 +3335,19 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // the other thing — the package changing while the daemon that dispatches
   // work is holding it open, whether that is a worker that wandered out of its
   // worktree or a human editing the live install "just to test something".
+  // Resolved once, here, for the same reason the host probe above is: every
+  // session of every tick must agree, and a fleet with no way to authenticate a
+  // model must refuse at admission rather than burn an attempt per dispatch
+  // (#152).
+  const model: { credential?: ModelCredential; paged: boolean } = { paged: false };
+  const resolvedModel = resolveModelCredential();
+  if (resolvedModel !== undefined) model.credential = resolvedModel;
+  log(
+    resolvedModel === undefined
+      ? "model credential: NONE reachable from a session — dispatch is held until an API key or an auth broker is configured"
+      : `model credential: ${resolvedModel.kind === "env" ? "from this daemon's environment" : "auth broker, injected per session"}`,
+  );
+
   const integrity: IntegrityGate = { baseline: packageManifest(), paged: false };
   log(`package integrity baseline: ${integrity.baseline.size} files under ${import.meta.dir}`);
 
@@ -3365,6 +3460,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         denyReadRoots: [...credentialDenyRoots(), project.workspaceRoot, project.mirrorRoot],
         denyReadFiles: credentialDenyFiles(),
         ...(credentials.readToken === undefined ? {} : { readToken: credentials.readToken }),
+        ...(model.credential === undefined ? {} : { model: model.credential }),
       });
       if (orchestratorBoundary.principal !== undefined) {
         const gid = probe.daemonGid;
@@ -3466,6 +3562,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     project,
     caps,
     boundary,
+    model,
     tracker,
     store,
     // Process-wide, so a `status` served off this daemon's own HTTP surface

package/src/failure-class.ts

@@ -62,6 +62,29 @@ function normalise(state: string): string {
  * makes every other reading of the row wrong — that is the #362 case, where a
  * `pushed-green` row outlived its own PR and held the issue out of dispatch.
  */
+/**
+ * Harness start failures, matched on the text it prints.
+ *
+ * Deliberately a small closed list rather than "anything at turn 0": a run that
+ * ended at turn 0 for a reason nobody has named is exactly what `unknown` is for,
+ * and quietly declaring it an environment fault would waive an attempt that may
+ * have been genuinely spent.
+ */
+const START_FAILURE_SIGNATURES = [
+  "no model selected",
+  "no model configured",
+  "invalid api key",
+  "authentication failed",
+  "could not load its peer dependency",
+] as const;
+
+function startFailure(lastError: string | undefined): string | undefined {
+  if (lastError === undefined) return undefined;
+  const text = lastError.toLowerCase();
+  const hit = START_FAILURE_SIGNATURES.find((signature) => text.includes(signature));
+  return hit === undefined ? undefined : lastError.split("\n")[0]?.trim();
+}
+
 export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classification {
   const hasArtifacts = run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined;
 
@@ -85,6 +108,22 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
     };
   }
 
+  // Turn zero with an explicit harness start error is the most classifiable
+  // failure there is, and the least deserving of an implementation attempt: the
+  // session never got as far as reading the issue. 27 recoveries on the reference
+  // fleet were this, logged as `unknown` while the session's own output carried
+  // the literal string `No model selected` (#152).
+  if ((run.state === "failed" || run.state === "killed") && run.turns === 0) {
+    const detail = startFailure(run.lastError);
+    if (detail !== undefined) {
+      return {
+        cls: "env-start-failure",
+        recovery: "escalate",
+        evidence: `the session never started: ${detail}`,
+      };
+    }
+  }
+
   if (run.state === "blocked") {
     return {
       cls: "question",

package/src/plugin.ts

@@ -70,6 +70,7 @@ import {
   detectTelegram,
   formatGates,
   orchestratorBriefPath,
+  relocateBriefIfMoved,
   planLabels,
   renderBriefForProject,
   summariseAmend,
@@ -1166,9 +1167,20 @@ async function setup(ctx: CommandContext, projectArg: string | undefined): Promi
   const telegram = detectTelegram();
   const nextConfig = buildConfig(answers, existing);
   const project = findProject(nextConfig, answers.projectName);
+  // The same project as it is configured right now, so a moved `workspaceRoot`
+  // can be told apart from a fleet that never had a brief. Switching
+  // `credentials.isolation` moves that root (0700 state dir ⇄ shared root), which
+  // relocates both briefs.
+  const previous = existing?.projects.find((p) => p.name === answers.projectName);
+  const relocating =
+    previous !== undefined &&
+    previous.workspaceRoot !== project.workspaceRoot &&
+    existsSync(policyPathForProject(previous)) &&
+    !existsSync(policyPathForProject(project));
   if (
     project.escalation.orchestrator === "external" &&
     !answers.writeOrchestratorBrief &&
+    !relocating &&
     (!existsSync(briefPathForProject(project)) || !existsSync(policyPathForProject(project)))
   ) {
     ctx.ui.notify(
@@ -1231,6 +1243,10 @@ async function setup(ctx: CommandContext, projectArg: string | undefined): Promi
       answers.writeOrchestratorBrief
         ? `Writes ${orchestratorBriefPath(answers)}, which is then yours to edit.`
         : "",
+      relocating
+        ? `Moves your ${POLICY_BRIEF_NAME} to ${policyPathForProject(project)} (the isolation change moves the workspace root) ` +
+          `and recomposes ${ORCHESTRATOR_BRIEF_NAME} beside it. The copy under ${policyPathForProject(previous)} is left in place.`
+        : "",
       project.escalation.orchestrator === "external"
         ? "Dispatch stays paused until the existing arm marker or a new inbound Telegram proof makes the heartbeat live."
         : "Dispatch resumes after the smoke succeeds.",
@@ -1249,6 +1265,13 @@ async function setup(ctx: CommandContext, projectArg: string | undefined): Promi
   prepareConductor();
   const created = await createMissingLabels(answers.trackerRepo, labels);
   saveConfig(nextConfig);
+  // Before the optional scaffold write, and deliberately: the scaffold renders a
+  // fresh POLICY.md, so writing it first would replace the policy this is trying
+  // to carry across.
+  const moved = relocateBriefIfMoved(previous, project);
+  if (moved !== undefined) {
+    ctx.ui.notify(`Moved ${POLICY_BRIEF_NAME} to ${moved.to} — the previous copy is still at ${moved.from}.`, "info");
+  }
   const briefPath = answers.writeOrchestratorBrief ? writeOrchestratorBrief(answers) : undefined;
   const runtimeFiles = writeHostRuntime(runtime);
   const smoke = await runSetupSmoke(project.name);

package/src/setup-host.ts

@@ -18,7 +18,7 @@ import {
   TICK_CONFIG_FILE,
   type TickConfig,
 } from "./orchestrator-tick.ts";
-import type { Caps, ProjectConfig } from "./types.ts";
+import { CONDUCTOR_GROUPS, type Caps, type ProjectConfig } from "./types.ts";
 
 export const DEFAULT_TICK_INTERVAL_SECONDS = 900;
 export const STAGED_SERVICE_NAME = "omp-conductor.service";
@@ -125,9 +125,20 @@ export function renderDaemonService(
     // daemon for nothing. Without them the probe honestly reports `group-mode`
     // and a configured per-run fleet refuses every dispatch, which is the
     // failure an operator following setup would otherwise hit first.
+    //
+    // `SupplementaryGroups=` is declared rather than left to initgroups, and that
+    // is not belt-and-braces. Supplementary groups are fixed when a process
+    // starts, so a daemon that was running when the accounts were provisioned can
+    // never join them — and a unit with no `User=` gets no initgroups call at
+    // all, so it comes up with `Groups: 0` even after the group database is
+    // correct. `probeHost` then reports `none` forever, the wizard cannot offer
+    // `uid-pool`, and the fleet quietly keeps the fail-closed value (#153).
+    // Declaring the membership makes it a property of the unit instead of a
+    // property of how the unit happened to be written.
     ...(resolveCredentials(project).isolation === "per-run"
       ? [
           `Environment=${systemdQuote(`OMP_CONDUCTOR_SHARED=${sharedRoot()}`)}`,
+          `SupplementaryGroups=${CONDUCTOR_GROUPS.daemon} ${CONDUCTOR_GROUPS.runs}`,
           "AmbientCapabilities=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
           "CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
         ]
@@ -343,11 +354,18 @@ export interface EffectiveUnit {
   /** `systemctl show -p AmbientCapabilities`; empty string when unset. */
   ambientCapabilities: string;
   capabilityBoundingSet: string;
+  /** `systemctl show -p SupplementaryGroups`; empty string when unset. */
+  supplementaryGroups: string;
   /** `systemctl show -p Environment`, newline- or space-joined. */
   environment: string;
   needDaemonReload: boolean;
 }
 
+/** Whitespace-separated names as a comparable set; systemd reorders them. */
+function nameSet(text: string): Set<string> {
+  return new Set(text.split(/[\s,]+/).map((n) => n.trim()).filter((n) => n.length > 0));
+}
+
 /** Capability names as a comparable set: systemd reports them lowercased, `cap_`-prefixed and reordered. */
 function capabilitySet(text: string): Set<string> {
   return new Set(
@@ -387,6 +405,21 @@ export function unitDriftReason(rendered: string, effective: EffectiveUnit | und
   if (effective === undefined) return undefined;
   const problems: string[] = [];
 
+  // Missing groups only, never extra: an operator may legitimately add their own,
+  // and unlike a leftover capability a spare group grants nothing this package
+  // relies on. Missing ones are load-bearing — without them the probe resolves to
+  // `none` and a configured per-run fleet refuses every dispatch (#153).
+  const wantGroups = nameSet(renderedDirective(rendered, "SupplementaryGroups") ?? "");
+  const haveGroups = nameSet(effective.supplementaryGroups);
+  const missingGroups = [...wantGroups].filter((g) => !haveGroups.has(g));
+  if (missingGroups.length > 0) {
+    problems.push(
+      `SupplementaryGroups is missing ${missingGroups.join(", ")} — supplementary groups are fixed at ` +
+        `process start, so the running daemon cannot be a member and the credential boundary probe ` +
+        `resolves to none until the unit is reloaded and the service restarted`,
+    );
+  }
+
   const wantAmbient = capabilitySet(renderedDirective(rendered, "AmbientCapabilities") ?? "");
   const haveAmbient = capabilitySet(effective.ambientCapabilities);
   const missingAmbient = [...wantAmbient].filter((c) => !haveAmbient.has(c));
@@ -440,6 +473,7 @@ export function parseEffectiveUnit(stdout: string): EffectiveUnit {
   return {
     ambientCapabilities: values.get("AmbientCapabilities") ?? "",
     capabilityBoundingSet: values.get("CapabilityBoundingSet") ?? "",
+    supplementaryGroups: values.get("SupplementaryGroups") ?? "",
     environment: values.get("Environment") ?? "",
     needDaemonReload: (values.get("NeedDaemonReload") ?? "no") === "yes",
   };

package/src/setup.ts

@@ -808,6 +808,46 @@ export function renderOrchestratorBrief(a: SetupAnswers): string {
  * that dialog's answer un-actionable — an operator who says "yes, overwrite it"
  * must get an overwrite.
  */
+/**
+ * Carry a fleet's own `POLICY.md` to a workspace root that just moved.
+ *
+ * `workspaceRoot` is derived from `credentials.isolation`: `none` puts it under
+ * the 0700 state directory, `per-run` under the shared root a slot principal can
+ * traverse. So switching a fleet to worker isolation *relocates* the briefs, and
+ * the operator's half must go with them.
+ *
+ * Without this, amending isolation on an external-orchestrator fleet was a
+ * deadlock with a data-loss escape hatch. The setup gate refused because neither
+ * file existed at the new root; the only way past it was approving a brief write
+ * in the same pass, and {@link writeOrchestratorBrief} renders a *fresh* POLICY.md
+ * scaffold — silently replacing the operator's release procedure and amendment
+ * log, and orphaning the real one at the old root.
+ *
+ * `ORCHESTRATOR.md` is recomposed rather than copied, because it is derived from
+ * the package floor plus that policy on every tick anyway. The source is left in
+ * place: this package does not delete an operator's file, and a stale copy under
+ * the old root is inert once nothing reads it.
+ *
+ * Returns the moved path, or undefined when nothing needed moving — the roots
+ * match, there was no policy to carry, or the destination already has one.
+ */
+export function relocateBriefIfMoved(
+  previous: ProjectConfig | undefined,
+  next: ProjectConfig,
+): { from: string; to: string } | undefined {
+  if (previous === undefined) return undefined;
+  if (previous.workspaceRoot === next.workspaceRoot) return undefined;
+  const from = policyPathForProject(previous);
+  const to = policyPathForProject(next);
+  if (!existsSync(from) || existsSync(to)) return undefined;
+
+  const policy = readFileSync(from, "utf8");
+  mkdirSync(dirname(to), { recursive: true });
+  writeFileSync(to, policy);
+  writeFileSync(briefPathForProject(next), composeOrchestrator(renderFloorForProject(next), policy));
+  return { from, to };
+}
+
 export function writeOrchestratorBrief(a: SetupAnswers): string {
   const project = buildProject(a);
   const policyPath = policyPathForProject(project);

package/src/store.ts

@@ -725,12 +725,12 @@ export function openStore(dbPath: string): Store {
   const countFailures = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state = 'failed'
-        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck'))`,
+        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck', 'env-start-failure'))`,
   );
   const countContinuations = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state IN ('killed', 'orphaned', 'blocked')
-        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck'))`,
+        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck', 'env-start-failure'))`,
   );
   // Newest first, and bounded: every row this returns costs `gh` calls to gather
   // facts for, so a fleet with a long unclassified history classifies over

package/src/types.ts

@@ -877,6 +877,7 @@ export interface Tracker {
  * answers instead of re-investigating.
  */
 export const FAILURE_CLASSES = [
+  "env-start-failure",
   "turn-cap-progress",
   "turn-cap-spinning",
   "admin-kill",
@@ -1005,6 +1006,11 @@ export type AdmissionHoldReason =
    *  dispatch refuses rather than running unprotected under a config that says
    *  otherwise (#125). */
   | "credential-boundary"
+  /** No model credential is reachable from a session's redirected `$HOME`, so
+   *  every worker would die at turn 0 with "No model selected" and spend an issue
+   *  attempt doing it (#152). Held rather than dispatched: an environment fault
+   *  is not a failed implementation. */
+  | "no-model-credential"
   | "unroutable:no-repo-label"
   | "unroutable:multiple-repo-labels"
   | "unroutable:unknown-repo";

package/src/upgrade.ts

@@ -471,6 +471,8 @@ async function defaultUnitFiles(deps: UpgradeDeps): Promise<UnitFiles | undefine
       "-p",
       "CapabilityBoundingSet",
       "-p",
+      "SupplementaryGroups",
+      "-p",
       "Environment",
       "-p",
       "NeedDaemonReload",

package/systemd/omp-conductor.service.example

@@ -121,6 +121,14 @@ Environment=PATH=/home/fleet/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin
 # launcher omits --bounding-set=-all, the child still ends with every other set
 # empty behind NoNewPrivs, and `status` reports the non-empty CapBnd as a named
 # residual rather than ignoring it.
+# Supplementary groups are fixed when a process starts, so a daemon that was
+# already running when these accounts were provisioned can never join them --
+# and a unit with no User= gets no initgroups call at all, so it comes up with
+# `Groups: 0` even once /etc/group is correct. Declared here so membership is a
+# property of the unit rather than of how it happened to be started; after a
+# `daemon-reload` and a restart, `omp-conductor status` reports the probed
+# mechanism as uid-pool.
+SupplementaryGroups=conductor-daemon conductor-runs
 AmbientCapabilities=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP
 CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP