omp-conductor 0.4.4 → 0.5.0

package/src/briefs/worker.md

@@ -17,25 +17,24 @@ inside your own worktree.
 - **Your branch:** `{{BRANCH}}` — already created for you off the repo's default
   branch. Never switch branches and never touch a path outside the worktree (write/edit/read/grep/glob are also blocked mechanically outside this checkout; `bash` is still a must-not — do not use it to escape).
 
-**You are running without GitHub credentials.** That is deliberate, not a
-misconfiguration (#125): this session is a separate OS principal from the
-dispatcher, and the dispatcher performs every network operation on your behalf.
-So `gh auth status` failing, `git push` failing, and `~/.ssh` being unreadable
-are all the system working. Do not try to work around any of them — there is
-nothing to find, and the turns are better spent on the issue.
+**You have this host's GitHub credentials, and you must not publish with them.**
+Every push and every PR goes through the four `conductor_*` tools below, because
+the dispatcher owns the settlement record: work it did not perform is work it
+cannot account for, and the checks that would have refused a bad push never ran.
+Reading with `gh` is fine; `git push`, `gh pr create` and `gh pr merge` are not
+yours to run.
 
 Read the issue first. **This brief is your copy of it**: the acceptance criteria
 below were rendered from the issue at dispatch, so you already have what you
-need. If a read-scoped token has been configured for this fleet, `gh` reads also
-work and are worth one call for the discussion the brief did not copy down:
+need. One `gh` read is still worth the call, for the discussion the brief did
+not copy down:
 
 ```bash
 gh issue view {{ISSUE_NUMBER}} --repo {{TRACKER_REPO}} --comments
 ```
 
-If that command reports you are not logged in, that is the expected default.
-Work from this brief and say so in your report rather than treating it as a
-blocker.
+If that command fails, work from this brief and say so in your report rather
+than treating it as a blocker.
 
 Then read the repo's own guidance before writing anything: `AGENTS.md`,
 `CLAUDE.md`, `CONTEXT.md`, and any `docs/adr/` entry the issue touches. Those
@@ -106,7 +105,8 @@ or the full test suite on this host. It is shared, and CI owns the heavy gates.
 ## Push and get to green
 
 Your checkout is a git repository of its own. Committing is local and always
-works; **publishing is the dispatcher's job**, because you hold no credential.
+works; **publishing is the dispatcher's job**, and that is a rule, not a missing
+credential.
 
 1. One review pass over your **whole** diff (`git diff origin/HEAD...HEAD`).
    Collect every finding, apply them all, then publish **once**.
@@ -115,7 +115,8 @@ works; **publishing is the dispatcher's job**, because you hold no credential.
    git add -A && git commit -m "<type>: <what changed>"
    ```
    No AI or co-author attribution. Never force-push. Never `git add -f`.
-   Do not run `git push` — it will fail, and it is not how your work ships.
+   Do not run `git push`. It is not how your work ships, and a push the
+   dispatcher did not make is one it cannot account for.
 3. Publish the branch with the `conductor_push` tool. The dispatcher fetches
    your commits out of this repository and pushes them to GitHub fast-forward
    only. If it reports a rejection, read the git error it hands back: a
@@ -142,7 +143,8 @@ works; **publishing is the dispatcher's job**, because you hold no credential.
 
 Editing, building and testing are yours: ordinary `bash` inside your worktree,
 unmediated. What leaves this machine is not. Four tools are the *only* route to
-GitHub, and you hold no credential that would let you take another one:
+GitHub you may take — another one exists on this host, and taking it is a
+reportable breach rather than a shortcut:
 
 | Tool | What it does |
 | --- | --- |
@@ -162,8 +164,8 @@ Three things follow, and they are worth reading once rather than rediscovering:
   remote moved: fetch, rebase in your worktree, push again.
 - **A refusal is the real answer.** These tools decide in the dispatcher, not in
   this prompt, and every call is recorded. When one refuses, it says exactly
-  why. Read it and act on it — do not retry it unchanged, and do not look for
-  another way round it. There isn't one, and looking is itself reportable.
+  why. Read it and act on it — do not retry it unchanged, and do not go round it
+  with `gh` or `git push`. Going round a refusal is itself reportable.
 
 ## You do not merge, release, or deploy
 

package/src/cli.ts

@@ -21,9 +21,8 @@ import {
   proposeRetrofit,
   repairPolicyBannerCrumbs,
 } from "./brief-upgrade.ts";
-import { findProject, loadConfig, resolveCaps, sharedRoot, stateDir } from "./config.ts";
+import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
 import { CONDITION_FORMS, parseCondition } from "./decisions.ts";
-import { boundarySetupScript } from "./credentials.ts";
 import { runDaemon, setPaused } from "./daemon.ts";
 import {
   armTicks,
@@ -105,7 +104,6 @@ usage:
   omp-conductor pause
   omp-conductor resume
   omp-conductor graph-setup [--project NAME] [--write]
-  omp-conductor boundary-setup [--slots N] [--daemon-user USER] [--shared-root PATH]
   omp-conductor brief-upgrade [--migrate|--retrofit] [--apply] [--file PATH] [--project NAME]
   omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
   omp-conductor report --text TEXT [--kind material|digest] [--project NAME]
@@ -202,14 +200,6 @@ usage:
            current. --write writes the two units and the script they run, and
            prints the systemctl line to run — it never runs systemctl itself.
            Exits 1 when no repo in the project has graphProject configured.
-  boundary-setup
-           print the root commands that provision the credential boundary
-           (#125): the per-run slot accounts, the conductor-daemon and
-           conductor-runs groups, the 0711 shared root, and the daemon home's
-           mode. Prints; never runs them — it creates system accounts, so it is
-           your sudo and your chance to read it first. Needs no config, and
-           must run BEFORE setup, which writes worktree and mirror paths into
-           the root this creates. --slots defaults to maxConcurrentWorkers.
   brief-upgrade
            inspect the brief overlay (package floor + POLICY.md). Reports by
            default. --migrate lifts a bannered ORCHESTRATOR.md owned half into
@@ -554,43 +544,6 @@ try {
       break;
     }
 
-    case "boundary-setup": {
-      // Printed, never executed: it creates system accounts, so it is the
-      // operator's `sudo` and their chance to read it first — same posture as
-      // `graph-setup`. Generated from the same constants the probe checks, so
-      // the instructions cannot drift from what the daemon then demands (#125).
-      //
-      // Nothing is read from the config unless a flag was omitted, and that is
-      // the point rather than an optimisation: per-run provisioning has to
-      // happen BEFORE `setup`, because setup writes worktree and mirror paths
-      // into the privileged shared root this command creates. Loading the
-      // config unconditionally would be a bootstrap cycle — provision needs a
-      // config, the config needs the provisioned root.
-      const slotsFlag = flag(argv, "slots");
-      let slots: number;
-      if (slotsFlag === undefined) {
-        const cfg = loadConfig();
-        slots = resolveCaps(findProject(cfg, flag(argv, "project")), cfg.defaults).maxConcurrentWorkers;
-      } else if (/^\d+$/.test(slotsFlag) && Number.parseInt(slotsFlag, 10) >= 1) {
-        // Whole string, not a prefix: `parseInt("2workers")` is 2, and silently
-        // provisioning a different pool than the operator typed is worse than
-        // refusing.
-        slots = Number.parseInt(slotsFlag, 10);
-      } else {
-        console.error(`boundary-setup: --slots must be a positive integer, got ${JSON.stringify(slotsFlag)}`);
-        process.exitCode = 2;
-        break;
-      }
-      // Both explicit where given, because neither can be inferred safely here.
-      // Under `sudo` the invoking user is root, so `userInfo()` would provision
-      // the wrong account and hand the daemon group to root; and the shared
-      // root must be the *same* string the daemon later resolves, not one
-      // derived from however this process happened to be invoked.
-      const daemonUser = flag(argv, "daemon-user") ?? process.env["SUDO_USER"] ?? userInfo().username;
-      const root = flag(argv, "shared-root") ?? sharedRoot();
-      process.stdout.write(boundarySetupScript({ slots, sharedRoot: root, daemonUser }));
-      break;
-    }
     /**
      * The action ledger (#126): every conductor-verb call, what it asked for,
      * and how the daemon decided it.

package/src/config.ts

@@ -20,7 +20,6 @@ import {
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
   CONFIG_VERSION,
-  CREDENTIAL_ISOLATIONS,
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
@@ -36,8 +35,6 @@ import {
   REPORT_SCOPES,
   type Caps,
   type ConductorConfig,
-  type CredentialConfig,
-  type CredentialIsolation,
   type MergePreconditions,
   type PlanUsageCap,
   type ProjectConfig,
@@ -70,7 +67,6 @@ const AUTHORITY_HOLDER_LIST = quoteList(AUTHORITY_HOLDERS);
 const ORCHESTRATOR_MODE_LIST = quoteList(ORCHESTRATOR_MODES);
 const RELEASE_SHAPE_LIST = quoteList(RELEASE_SHAPES);
 const LEGACY_RELEASE_POLICY_LIST = quoteList(LEGACY_RELEASE_POLICIES);
-const CREDENTIAL_ISOLATION_LIST = quoteList(CREDENTIAL_ISOLATIONS);
 const BASE_FRESHNESS_LIST = quoteList(BASE_FRESHNESS);
 const DRAFT_POLICY_LIST = quoteList(DRAFT_POLICIES);
 const BEHIND_BASE_ACTION_LIST = quoteList(BEHIND_BASE_ACTIONS);
@@ -107,45 +103,6 @@ export function stateDir(): string {
   return dirname(configPath());
 }
 
-/**
- * Root of everything a run principal must reach: worktrees, mirrors, per-run
- * session transcripts and per-run boundary homes.
- *
- * **Outside the daemon's home, not a sibling of the state directory**, and both
- * halves of that are load-bearing:
- *
- * - It cannot live *inside* {@link stateDir}, which stays `0700` because it
- *   holds `config.json`, `conductor.db` and the WAL/SHM files SQLite recreates
- *   at runtime with the process umask. Making it searchable — all a slot needs
- *   — would publish fleet, run and report history to every local account, and
- *   chmod-ing the leaves once would not hold.
- * - It cannot live under the daemon's **home** either, which the boundary
- *   requires to be `0700` so a slot cannot reach `gh` config, `~/.ssh` or
- *   `~/.npmrc`. A shared root at `~/.omp/conductor-shared` is unreachable for
- *   exactly the same reason, and the two hardening steps would silently cancel
- *   each other out — the boundary would look correct and no run could start.
- *
- * So it is a system path: `0711` — traversable by a slot that already knows its
- * own path, listable by nobody, writable by nobody but the daemon. Only used
- * when a per-run boundary is active; an `isolation: "none"` fleet keeps every
- * path exactly where it was (#125).
- *
- * `$OMP_CONDUCTOR_SHARED` overrides it, which is how tests and non-FHS hosts
- * relocate it. Uninstall is two paths instead of one, and the README says so.
- */
-export function sharedRoot(): string {
-  const override = process.env["OMP_CONDUCTOR_SHARED"];
-  if (override !== undefined && override.length > 0) return expandHome(override);
-  // Deliberately NOT derived from whether `$OMP_CONDUCTOR_HOME` happens to be
-  // set: generated systemd units set it even for a default install, so keying
-  // the security topology off it lets the CLI, setup and the daemon each pick a
-  // different root depending on how they were invoked. One explicit override,
-  // or the platform default.
-  // Not `/tmp`: a shared root a slot could rename or replace would hand one run
-  // control of another's checkout path.
-  return process.platform === "linux" ? "/var/lib/omp-conductor" : `${stateDir()}-shared`;
-}
-
 /**
  * Where per-run worktrees and bare mirrors live when a project names neither.
  *
@@ -154,14 +111,6 @@ export function sharedRoot(): string {
  * worker checkouts even when the config was too broken to load and say where
  * they are. Two copies of this default would mean a jail guarding the wrong
  * directory on exactly the day the config is broken.
- *
- * `base` is what makes these usable under a per-run boundary. A slot principal
- * cannot traverse the `0700` state directory, and dispatch now refuses rather
- * than widening it — so an isolated fleet whose roots defaulted under the state
- * dir would provision a repository and then fail before launching anything.
- * Setup passes {@link sharedRoot} for those fleets and `stateDir()` for the
- * rest, so an `isolation: "none"` install keeps every path exactly where it was
- * (#125).
  */
 export function defaultWorkspaceRoot(base: string = stateDir()): string {
   return join(base, "worktrees");
@@ -170,18 +119,6 @@ export function defaultWorkspaceRoot(base: string = stateDir()): string {
 export function defaultMirrorRoot(base: string = stateDir()): string {
   return join(base, "mirrors");
 }
-/**
- * The root a project's slot-accessible trees belong under, given its isolation.
- *
- * Only `per-run` moves. `group-mode` runs sessions as the daemon's *own* uid —
- * it separates checkouts by group and mode, not by principal — so it can reach
- * the state directory perfectly well, and sending it to a system path would
- * demand privileged provisioning a group-mode host may deliberately not have.
- * `none` never moves either.
- */
-export function projectTreeBase(isolation: CredentialIsolation): string {
-  return isolation === "per-run" ? sharedRoot() : stateDir();
-}
 
 /**
  * Reads, validates and normalises the config. Throws an `Error` naming the
@@ -481,7 +418,6 @@ function normalizeProject(
   const escalation = normalizeEscalation(raw["escalation"], label, problems);
   const authority = normalizeAuthority(raw["authority"], label, problems);
   const releasePolicy = normalizeReleasePolicy(raw["releasePolicy"], label, problems);
-  const credentials = normalizeCredentials(raw["credentials"], label, problems);
   const policy = normalizeProjectPolicy(raw["policy"], label, problems);
 
   const caps = coerceCaps(raw["caps"], `${label}: caps`, problems, legacyCaps);
@@ -510,18 +446,9 @@ function normalizeProject(
     authority,
     releasePolicy,
     policy,
-    credentials,
     reporting,
-    // Derived from this project's own isolation, not from `stateDir()`: a
-    // hand-written `per-run` config that omits these optional keys would
-    // otherwise resolve under the 0700 private tree and be refused at dispatch,
-    // having never gone through the setup wizard that knows better (#125).
-    workspaceRoot: expandHome(
-      pickString(raw["workspaceRoot"], defaultWorkspaceRoot(projectTreeBase(credentials.isolation))),
-    ),
-    mirrorRoot: expandHome(
-      pickString(raw["mirrorRoot"], defaultMirrorRoot(projectTreeBase(credentials.isolation))),
-    ),
+    workspaceRoot: expandHome(pickString(raw["workspaceRoot"], defaultWorkspaceRoot())),
+    mirrorRoot: expandHome(pickString(raw["mirrorRoot"], defaultMirrorRoot())),
   };
 }
 
@@ -841,159 +768,15 @@ function normalizeNameList(parsed: unknown, at: string, problems: string[]): str
   return names;
 }
 
-
-/**
- * The credential boundary, and the one migration that must never brick a fleet.
- *
- * `omp/systemd/omp-conductor.service.example` runs the daemon as an
- * unprivileged account. A naive "fail closed unless per-run uids are available"
- * release would therefore stop every *existing* fleet from dispatching on
- * upgrade — a production outage caused by a security feature, which is a worse
- * outcome than the day before. The issue's rule ("never the silent default")
- * still holds; it is satisfied by a **migration** rather than by a default:
- *
- * 1. Key present → honoured exactly.
- * 2. Key absent → resolves to `"none"`, and `migrateCredentialsOnDisk` rewrites
- *    the file so the answer is explicit on disk, exactly the way the v1→v2 caps
- *    migration normalises on load. The operator ends up with
- *    `"isolation": "none"` in their config plus one log line naming it, and
- *    nothing stops dispatching.
- * 3. A new config from `setup` asks, and only offers `per-run` as the default
- *    when the host capability probe passes.
- *
- * A malformed value is rejected rather than folded to `"none"`, for the reason
- * every other vocabulary here is: a misspelt `"per_run"` that silently resolved
- * to unprotected would read as configured in the file while the fleet ran open.
- */
-function normalizeCredentials(parsed: unknown, label: string, problems: string[]): CredentialConfig {
-  if (parsed === undefined) return { isolation: "none" };
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    problems.push(
-      `${label}: credentials must be an object with an "isolation" of ${CREDENTIAL_ISOLATION_LIST}, ` +
-        `found ${JSON.stringify(parsed)}`,
-    );
-    return { isolation: "none" };
-  }
-  const raw = parsed as Raw;
-  const isolation = pickLiteral(
-    raw["isolation"],
-    CREDENTIAL_ISOLATIONS,
-    "none",
-    `${label}: credentials.isolation`,
-    CREDENTIAL_ISOLATION_LIST,
-    problems,
-  );
-  const rawToken = raw["readToken"];
-  if (rawToken !== undefined && !nonEmptyString(rawToken)) {
-    problems.push(
-      `${label}: credentials.readToken must be a non-empty string when present — an empty token is not ` +
-        `"no token", it is a token that fails every call`,
-    );
-  }
-  return {
-    isolation,
-    ...(nonEmptyString(rawToken) ? { readToken: rawToken } : {}),
-  };
-}
-
-/**
- * The effective boundary for a project. `loadConfig` always writes one, so this
- * only matters for a `ProjectConfig` some caller hand-built — and it resolves
- * the same way the loader does rather than inventing a second answer.
- */
-export function resolveCredentials(p: ProjectConfig): CredentialConfig {
-  return p.credentials ?? { isolation: "none" };
-}
-
-/**
- * Named projects whose on-disk config predates `credentials` — the input to the
- * migration, and pure so it can be tested against a raw object.
- */
-export function projectsMissingCredentials(parsed: unknown): string[] {
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return [];
-  const projects = (parsed as Raw)["projects"];
-  if (!Array.isArray(projects)) return [];
-  const missing: string[] = [];
-  projects.forEach((p: unknown, i) => {
-    if (typeof p !== "object" || p === null || Array.isArray(p)) return;
-    const raw = p as Raw;
-    const credentials = raw["credentials"];
-    const explicit =
-      typeof credentials === "object" &&
-      credentials !== null &&
-      !Array.isArray(credentials) &&
-      (credentials as Raw)["isolation"] !== undefined;
-    if (!explicit) missing.push(nonEmptyString(raw["name"]) ? raw["name"] : `projects[${String(i)}]`);
-  });
-  return missing;
-}
-
-/**
- * Write the migration through, once. Returns the projects that gained an
- * explicit key, so the caller can log it by name.
- *
- * Separate from `loadConfig` on purpose: `loadConfig` is read-only and is called
- * by every CLI surface, and a loader with a write side-effect is one an
- * operator cannot run against a config they are only inspecting. A failure to
- * persist is logged by the caller and is **not** fatal — the in-memory value is
- * already `"none"`, and refusing to boot because the config file is read-only
- * would be exactly the outage this migration exists to avoid.
- */
-export function migrateCredentialsOnDisk(): { migrated: string[]; path: string } {
-  const path = configPath();
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return { migrated: [], path };
-  }
-  const migrated = projectsMissingCredentials(parsed);
-  if (migrated.length === 0) return { migrated: [], path };
-
-  // A SURGICAL edit: add the one missing key to the projects that lack it and
-  // leave every other byte exactly as the operator wrote it.
-  //
-  // This was `saveConfig(loadConfig())` once, and that round-trip took a live
-  // fleet down. Normalising on the way out rewrites the whole file into the
-  // current dialect — `defaults.planUsage`, `releasePolicy` as a per-shape map
-  // — and the previous release rejects both. The daemon performing the
-  // migration is started *by* an upgrade still running the previous CLI, so
-  // that CLI's next `loadConfig` failed, and its rollback reinstalled a version
-  // which then could not read the file either. A migration must never make a
-  // config unreadable by the release you may have to roll back to.
-  // Verified against the real previous release, not just against this parser:
-  // omp-conductor@0.3.25 loads a config carrying `credentials` and prints
-  // `status` normally, because it ignores unknown *project* keys while
-  // rejecting unknown `defaults` keys and a non-string `releasePolicy` — the
-  // two things the old round-trip wrote. Re-check that with `npm install
-  // omp-conductor@<previous>` before widening what this writes.
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { migrated: [], path };
-  const projects = (parsed as Raw)["projects"];
-  if (!Array.isArray(projects)) return { migrated: [], path };
-  for (const entry of projects) {
-    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
-    const raw = entry as Raw;
-    const credentials = raw["credentials"];
-    const explicit =
-      typeof credentials === "object" &&
-      credentials !== null &&
-      !Array.isArray(credentials) &&
-      (credentials as Raw)["isolation"] !== undefined;
-    if (!explicit) (raw as Record<string, unknown>)["credentials"] = { isolation: "none" };
-  }
-  writeConfigFile(parsed);
-  return { migrated, path };
-}
-
 /**
- * A clone URL carrying credentials voids the entire boundary (#125).
+ * A clone URL carrying a password or token is rejected at load.
  *
  * `git clone` persists whatever is in the URL into the mirror's config, and the
  * run repository inherits `origin` from it — so a `https://<pat>@github.com/…`
- * hands every session the write credential the rest of this release removes,
- * through a file no environment scrub touches. This used to be a `ponytail`
- * note on `worktree.ts`'s `ensureMirror`; a warning is not a boundary, so it is
- * now rejected at load with the field named.
+ * writes the operator's credential into a file on disk that every later run
+ * reads, where nobody is looking for it. This used to be a `ponytail` note on
+ * `worktree.ts`'s `ensureMirror`; a warning nobody reads is not a check, so it
+ * is now rejected at load with the field named.
  *
  * An SSH URL with a plain username (`ssh://git@github.com/o/r`, `git@github.com:o/r`)
  * is not a credential and is left alone — that is how nearly every fleet is

package/src/confinement.ts

@@ -20,9 +20,8 @@
  * `bash` is deliberately not confined here either: its input is an opaque shell
  * string, and parsing it is a false sense of security. This gate does not
  * contain a determined session, and no comment or doc here should claim
- * otherwise — closing that gap is a least-privilege OS principal (a worker uid
- * under `credentials.isolation: "per-run"`), documented beside this module's
- * README section, not a regex over `rm -rf`.
+ * otherwise — closing that gap would take a least-privilege OS principal for
+ * the worker, not a regex over `rm -rf`.
  *
  * What it does buy is a *legible* refusal that holds on hosts where no uid
  * split will ever be deployed: a structured `edit` outside the assigned