omp-conductor 0.4.4 → 0.5.0

package/src/failure-class.ts

@@ -62,6 +62,34 @@ function normalise(state: string): string {
  * makes every other reading of the row wrong — that is the #362 case, where a
  * `pushed-green` row outlived its own PR and held the issue out of dispatch.
  */
+/**
+ * Harness start failures, matched on the text it prints.
+ *
+ * Deliberately a small closed list rather than "anything at turn 0": a run that
+ * ended at turn 0 for a reason nobody has named is exactly what `unknown` is for,
+ * and quietly declaring it an environment fault would waive an attempt that may
+ * have been genuinely spent.
+ */
+const START_FAILURE_SIGNATURES = [
+  "no model selected",
+  "no model configured",
+  "invalid api key",
+  "authentication failed",
+  "could not load its peer dependency",
+] as const;
+
+/**
+ * The first line of a harness start failure, or undefined when this error is not
+ * one. Exported so the store's one-time repair recognises exactly what the
+ * classifier does — two definitions of "the session never started" would drift.
+ */
+export function startFailure(lastError: string | undefined): string | undefined {
+  if (lastError === undefined) return undefined;
+  const text = lastError.toLowerCase();
+  const hit = START_FAILURE_SIGNATURES.find((signature) => text.includes(signature));
+  return hit === undefined ? undefined : lastError.split("\n")[0]?.trim();
+}
+
 export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classification {
   const hasArtifacts = run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined;
 
@@ -85,6 +113,22 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
     };
   }
 
+  // Turn zero with an explicit harness start error is the most classifiable
+  // failure there is, and the least deserving of an implementation attempt: the
+  // session never got as far as reading the issue. 27 recoveries on the reference
+  // fleet were this, logged as `unknown` while the session's own output carried
+  // the literal string `No model selected` (#152).
+  if ((run.state === "failed" || run.state === "killed") && run.turns === 0) {
+    const detail = startFailure(run.lastError);
+    if (detail !== undefined) {
+      return {
+        cls: "env-start-failure",
+        recovery: "escalate",
+        evidence: `the session never started: ${detail}`,
+      };
+    }
+  }
+
   if (run.state === "blocked") {
     return {
       cls: "question",

package/src/fleet.ts

@@ -27,8 +27,7 @@ import {
 import { createInterface } from "node:readline";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { findProject, loadConfig, resolveCredentials, stateDir } from "./config.ts";
-import { describeBoundary, probeHost } from "./credentials.ts";
+import { findProject, loadConfig, stateDir } from "./config.ts";
 import { planUsageLine, readPlanUsage, sharedUsageSource } from "./usage.ts";
 import { readApprovalSurface } from "./approval-surface.ts";
 import { inspectBriefLayout } from "./brief-upgrade.ts";
@@ -956,15 +955,6 @@ export function formatCodeGraphHealth(graph: CodeGraphHealth, now = Date.now()):
   ].join("\n");
 }
 
-/**
- * The credential boundary row (#125): which mechanism is actually live, and the
- * residuals it does *not* close. Passed in rather than probed inside the
- * formatter so the wording is testable without a host.
- */
-export interface BoundaryStatus {
-  headline: string;
-  detail: string[];
-}
 
 export function formatFleetStatus(
   s: StatusSnapshot,
@@ -973,7 +963,6 @@ export function formatFleetStatus(
   telegram: TelegramHealth = { kind: "unprobed" },
   now = Date.now(),
   codeGraph: CodeGraphHealth = { configured: false },
-  boundary: BoundaryStatus | undefined = undefined,
   brief: string | undefined = undefined,
   decisions: string | undefined = undefined,
   failureClasses: string | undefined = undefined,
@@ -1029,15 +1018,6 @@ export function formatFleetStatus(
   }
 
   const graphBlock = formatCodeGraphHealth(codeGraph, now);
-  // Reported every time, never only when it is bad. An operator reading this
-  // has to be able to see "unprotected" on the day they assumed otherwise, and
-  // a line that appears only in the failure case is one whose absence means
-  // nothing (#125). `undefined` here is a status rendered without a host probe,
-  // which is itself worth saying rather than silently omitting.
-  const boundaryLines =
-    boundary === undefined
-      ? ["boundary  unprobed  (no host capability probe was run for this status)"]
-      : [`boundary  ${boundary.headline}`, ...boundary.detail.map((d) => `          ${d}`)];
 
   return [
     `dispatch  ${layers.dispatch}`,
@@ -1047,7 +1027,6 @@ export function formatFleetStatus(
     recoveryLine,
     herdrLine,
     telegramLine,
-    ...boundaryLines,
     ...(brief === undefined ? [] : [brief]),
     ...(decisions === undefined ? [] : [decisions]),
     ...(failureClasses === undefined ? [] : [failureClasses]),
@@ -1128,39 +1107,6 @@ export async function renderStatus(projectName?: string): Promise<string> {
   ]);
   const cached = codeGraphFromHealthz(health?.body, project.name);
   const codeGraph = cached ?? (await probeCodeGraph(project));
-  // The daemon's own answer wins, and this is not an optimisation.
-  //
-  // Capabilities are a property of the PROCESS, not the host. `status` runs in
-  // an interactive shell with none of the unit's ambient capabilities and none
-  // of the conductor groups, so re-probing here reports `group-mode` — or
-  // "REFUSING DISPATCH" — on a fleet whose daemon is genuinely `uid-pool`. An
-  // operator following the documented verification step would conclude the
-  // boundary had failed while it was working perfectly.
-  //
-  // It is also the only answer that survives a `daemon-reload` without a
-  // restart, which no config check can see: this is what the running process
-  // actually got at startup.
-  //
-  // Falling back to a local probe when no daemon is running is still right —
-  // there is a real question to answer then — but it is labelled, because it is
-  // a different question.
-  const credentials = resolveCredentials(project);
-  const live = boundaryFromHealthz(health?.body);
-  const boundary =
-    live ?? {
-      ...describeBoundary(credentials.isolation, await probeHost({ slots: s.caps.maxConcurrentWorkers })),
-      detail:
-        rec === undefined
-          ? [
-              "No daemon is running, so this is THIS SHELL's view, not the fleet's — an interactive shell",
-              "holds none of the unit's capabilities. Start the daemon and re-read before concluding anything.",
-            ]
-          : [
-              "The daemon did not report a boundary (it predates the field), so this is THIS SHELL's view,",
-              "not the fleet's — an interactive shell holds none of the unit's capabilities. Upgrade and",
-              "restart the daemon before concluding anything.",
-            ],
-    };
   return formatFleetStatus(
     { ...s, planUsage },
     layers,
@@ -1168,7 +1114,6 @@ export async function renderStatus(projectName?: string): Promise<string> {
     telegram,
     Date.now(),
     codeGraph,
-    boundary,
     briefStatusLine(project),
     decisionStatusLine(project.name),
     failureClassBlock(project.name),
@@ -1570,32 +1515,3 @@ function probeOmpPane(
   }
 }
 
-/**
- * The boundary the running daemon resolved, out of its `/healthz` body.
- *
- * Same posture as `codeGraphFromHealthz`: an older daemon that predates the
- * field simply does not answer, and the caller falls back to a local probe with
- * that difference stated rather than papered over.
- */
-export function boundaryFromHealthz(
-  body: string | undefined,
-): { headline: string; detail: string[] } | undefined {
-  // `healthCheck` hands back the raw response TEXT, not a parsed object — the
-  // same shape `codeGraphFromHealthz` takes. Type-guarding this on `object`
-  // meant it never matched, so `status` silently fell back to probing the
-  // operator's own shell and printed "No daemon is running" at a fleet whose
-  // daemon was up. Unit tests fed it objects and agreed with themselves.
-  if (body === undefined || body.length === 0) return undefined;
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    return undefined;
-  }
-  if (typeof parsed !== "object" || parsed === null) return undefined;
-  const boundary = (parsed as { boundary?: unknown }).boundary;
-  if (typeof boundary !== "object" || boundary === null) return undefined;
-  const headline = (boundary as { headline?: unknown }).headline;
-  if (typeof headline !== "string" || headline.length === 0) return undefined;
-  return { headline, detail: [] };
-}

package/src/gitops.ts

@@ -0,0 +1,189 @@
+/**
+ * The daemon's own git and `gh` operations.
+ *
+ * Everything here runs as the daemon, with the operator's credentials, and it
+ * is the only place in this package that spawns a credentialed process. That is
+ * the whole organising idea: "what can reach the operator's `gh` credential" is
+ * answered by this file's call sites rather than by auditing every `Bun.spawn`
+ * in the tree.
+ *
+ * Sessions are not gated at the OS level — a worker is a child process of the
+ * daemon and inherits its environment. What keeps a run's publication honest is
+ * that the dispatcher performs it: a push or a pull request the daemon did not
+ * make is a run it cannot account for. The mediated verbs route a worker's
+ * intent through here so the settlement record and the branch cannot disagree.
+ */
+
+import { join } from "node:path";
+
+import type { ProjectConfig, RepoTarget } from "./types.ts";
+
+/**
+ * One process run, captured. Injected everywhere in this module so the
+ * daemon-side push is testable without a network or a credential.
+ */
+export type Exec = (
+  argv: readonly string[],
+  opts?: { cwd?: string; env?: Record<string, string>; stdin?: string },
+) => Promise<{ code: number; stdout: string; stderr: string }>;
+
+/** The real one. Never inherits stdin: an unattended daemon must not block on a prompt. */
+export const spawnCaptured: Exec = async (argv, opts = {}) => {
+  const [command, ...rest] = argv;
+  if (command === undefined) return { code: 127, stdout: "", stderr: "empty argv" };
+  const proc = Bun.spawn([command, ...rest], {
+    ...(opts.cwd === undefined ? {} : { cwd: opts.cwd }),
+    ...(opts.env === undefined ? {} : { env: opts.env }),
+    stdin: new Blob([opts.stdin ?? ""]),
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  return { code, stdout, stderr };
+};
+
+/**
+ * The daemon's own environment, credentials intact. **The only place this
+ * package constructs credential material.**
+ *
+ * There is nothing clever in the body, and that is deliberate: the value is
+ * that it is one named function, so a privileged spawn that does not come
+ * through here is a bug, whatever it happens to do.
+ *
+ * `GIT_TERMINAL_PROMPT=0` rides along because every caller is unattended: a
+ * credential prompt nobody can answer is a hang, not a failure.
+ */
+export function credentialedEnv(
+  extra: Readonly<Record<string, string>> = {},
+  base: Readonly<Record<string, string | undefined>> = process.env,
+): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const [key, value] of Object.entries(base)) {
+    if (value !== undefined) env[key] = value;
+  }
+  env["GIT_TERMINAL_PROMPT"] = "0";
+  return { ...env, ...extra };
+}
+
+// ------------------------------------------------- the privileged publish path
+
+/** One run's own repository, as the daemon addresses it. */
+export interface RunRepoRef {
+  repo: RepoTarget;
+  /** The run's own git repository — not a linked worktree of the mirror. */
+  runRepoPath: string;
+  branch: string;
+}
+
+export type PushOutcome = { ok: true; sha: string } | { ok: false; stderr: string };
+export type PrOutcome = { ok: true; url: string } | { ok: false; stderr: string };
+
+/** A clone URL can carry a token, and it lands in git's own error text. */
+const URL_USERINFO = /([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^\s/@]+@/g;
+
+/** Blank the `user:token@` part of any URL before a string reaches a log or a human. */
+export function scrubUserinfo(text: string): string {
+  return text.replace(URL_USERINFO, "$1***@");
+}
+
+function mirrorPath(project: Pick<ProjectConfig, "mirrorRoot">, repo: RepoTarget): string {
+  return join(project.mirrorRoot, `${repo.name}.git`);
+}
+
+/** GitHub slug parsed off the clone URL, falling back to the routing name. */
+export function repoSlugFor(repo: RepoTarget): string {
+  const m = /(?:[:/])([^/:]+\/[^/]+?)(?:\.git)?$/.exec(repo.cloneUrl);
+  return m?.[1] ?? repo.name;
+}
+
+/**
+ * Publish a run's branch: run repo → mirror → GitHub, **fast-forward only**.
+ *
+ * The worker commits into its own repository, which is durable and local; every
+ * hop that touches the network happens here, so the dispatcher observes the
+ * exact sha it recorded.
+ *
+ * Both hops are fast-forward only and there is no force path anywhere in this
+ * package. The fetch refspec deliberately carries **no leading `+`** — that
+ * single character is the difference between "advance the mirror's copy of this
+ * branch" and "make the mirror's copy whatever the run says it is", and a run
+ * repo is the one place in this system that model-executed code fully controls.
+ * The push carries no `--force` and no `--force-with-lease`: a lease is still a
+ * force, and a rejected push is a decision for a human, not a retry.
+ *
+ * A rejection — non-fast-forward, protected ref, unauthorised — comes back as a
+ * value carrying git's stderr verbatim, because the caller settles the run
+ * `failed` on it and a paraphrase is worthless in that report.
+ */
+export async function pushRunBranch(
+  project: Pick<ProjectConfig, "mirrorRoot">,
+  run: RunRepoRef,
+  exec: Exec = spawnCaptured,
+): Promise<PushOutcome> {
+  const mirror = mirrorPath(project, run.repo);
+  const ref = `refs/heads/${run.branch}`;
+  const env = credentialedEnv();
+
+  const fetched = await exec(["git", "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `${ref}:${ref}`], { env });
+  if (fetched.code !== 0) {
+    return { ok: false, stderr: scrubUserinfo(fetched.stderr.trim() || fetched.stdout.trim() || `git fetch exited ${String(fetched.code)}`) };
+  }
+
+  const resolved = await exec(["git", "-C", mirror, "rev-parse", ref], { env });
+  if (resolved.code !== 0) {
+    return { ok: false, stderr: scrubUserinfo(resolved.stderr.trim() || `git rev-parse ${ref} exited ${String(resolved.code)}`) };
+  }
+  const sha = resolved.stdout.trim();
+
+  const pushed = await exec(["git", "-C", mirror, "push", "origin", `${ref}:${ref}`], { env });
+  if (pushed.code !== 0) {
+    return { ok: false, stderr: scrubUserinfo(pushed.stderr.trim() || pushed.stdout.trim() || `git push exited ${String(pushed.code)}`) };
+  }
+  return { ok: true, sha };
+}
+
+/**
+ * Open the run's pull request from the daemon's side.
+ *
+ * The body goes over stdin, never argv: a body with newlines, backticks or a
+ * leading `-` is ordinary, and interpolating it into a command line is how a
+ * worker's report would become an argument.
+ */
+export async function openRunPr(
+  project: Pick<ProjectConfig, "mirrorRoot">,
+  run: RunRepoRef,
+  opts: { title: string; body: string; base: string },
+  exec: Exec = spawnCaptured,
+): Promise<PrOutcome> {
+  void project;
+  const out = await exec(
+    [
+      "gh",
+      "pr",
+      "create",
+      "--repo",
+      repoSlugFor(run.repo),
+      "--head",
+      run.branch,
+      "--base",
+      opts.base,
+      "--title",
+      opts.title,
+      "--body-file",
+      "-",
+    ],
+    { env: credentialedEnv(), stdin: opts.body },
+  );
+  if (out.code !== 0) {
+    return { ok: false, stderr: scrubUserinfo(out.stderr.trim() || out.stdout.trim() || `gh pr create exited ${String(out.code)}`) };
+  }
+  const url = /https:\/\/github\.com\/\S+\/pull\/\d+/.exec(out.stdout)?.[0];
+  if (url === undefined) {
+    return { ok: false, stderr: `gh pr create succeeded but printed no PR URL: ${out.stdout.trim()}` };
+  }
+  return { ok: true, url };
+}

package/src/omp.ts

@@ -19,7 +19,6 @@ import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 
 import { worktreeConfinement } from "./confinement.ts";
-import type { SessionBoundary } from "./credentials.ts";
 import { releasePolicyTripwire } from "./release-policy.ts";
 import type {
   HostToParent,
@@ -344,14 +343,7 @@ function asRawSession(created: unknown): RawSession {
 
 // --------------------------------------------------------- the session proxy
 
-/**
- * Absolute path of the child entrypoint, resolved against this package.
- *
- * Exported so the boundary suite can assert a slot principal may actually read
- * it. The launcher execs this path under the slot uid, and on a real deployment
- * it sits under the daemon's home — so a home hardened to `0700` makes every
- * worker die before it connects, in a way no shell-based probe notices (#125).
- */
+/** Absolute path of the child entrypoint, resolved against this package. */
 export const SESSION_HOST = join(import.meta.dir, "session-host.ts");
 
 /**
@@ -381,16 +373,9 @@ export interface CreateSessionOptions {
   onReleaseBlocked?: (shape: ReleaseShape) => void;
 
   /**
-   * The OS principal and environment this session runs behind (#125). Omitted,
-   * the child runs as the daemon's own user with the daemon's environment —
-   * which is the A1 shape: out of process, no security claim. The daemon always
-   * passes one, and `status` reports which mechanism it names.
-   */
-  boundary?: SessionBoundary;
-  /**
-   * Where the control socket is bound. The daemon puts it inside the run's own
-   * boundary root so the slot principal can reach it; omitted, a private temp
-   * directory is used, which is what the tests and a `none` fleet want.
+   * Where the control socket is bound. The daemon puts it beside the run's own
+   * session directory; omitted, a private temp directory is used, which is what
+   * the tests want.
    */
   socketPath?: string;
   /**
@@ -442,11 +427,10 @@ export interface CreateSessionOptions {
  * the deployment mistake it is, not as an unexplained exit code.
  */
 export async function createSession(opts: CreateSessionOptions): Promise<AgentSessionLike> {
-  const boundary = opts.boundary;
   const owned = opts.socketPath === undefined;
-  // 0711, not 0700: a slot principal has to *traverse* to its own socket, and
-  // must not be able to list what else is in here or unlink the socket and
-  // bind its own. Same reasoning as the run workspace parent.
+  // 0711, not 0700: searchable, so a session reaches its own socket by name, but
+  // not listable — nothing here can enumerate the other sockets, unlink one and
+  // bind an impostor in its place. Same reasoning as the run workspace parent.
   const socketDir = owned ? mkdtempSync(join(tmpdir(), "omp-session-")) : dirname(opts.socketPath ?? "");
   const socketPath = opts.socketPath ?? join(socketDir, "s");
   mkdirSync(socketDir, { recursive: true, mode: 0o711 });
@@ -469,11 +453,9 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
       resolve();
     });
   });
-  // The socket is the run's own channel: only its principal may speak on it.
+  // The socket is the run's own channel, and the daemon's own uid is the only
+  // one that speaks on it.
   chmodSync(socketPath, 0o600);
-  if (boundary?.principal !== undefined) {
-    chownSync(socketPath, boundary.principal.uid, boundary.principal.gid);
-  }
 
   const spec: SessionHostSpec = {
     socket: socketPath,
@@ -487,12 +469,7 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
   };
 
   const log = opts.onChildLog ?? ((line: string) => process.stderr.write(`${line}\n`));
-  const argv = [
-    ...(boundary?.launcher ?? []),
-    process.execPath,
-    opts.hostModule ?? SESSION_HOST,
-    JSON.stringify(spec),
-  ];
+  const argv = [process.execPath, opts.hostModule ?? SESSION_HOST, JSON.stringify(spec)];
   const child = Bun.spawn(argv, {
     cwd: opts.cwd,
     stdin: "ignore",
@@ -501,7 +478,6 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
     // harness build cannot corrupt it.
     stdout: "pipe",
     stderr: "pipe",
-    ...(boundary === undefined || Object.keys(boundary.env).length === 0 ? {} : { env: boundary.env }),
   });
 
   let stderrTail = "";
@@ -574,7 +550,7 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
             new Error(
               `omp-conductor session child did not connect within ${String(
                 (opts.startupTimeoutMs ?? START_TIMEOUT_MS) / 1000,
-              )}s (launcher: ${argv.slice(0, Math.max(1, (boundary?.launcher ?? []).length)).join(" ") || "none"})`,
+              )}s`,
             ),
           );
         }, opts.startupTimeoutMs ?? START_TIMEOUT_MS).unref?.();

package/src/orchestrator.ts

@@ -31,7 +31,6 @@ import { join } from "node:path";
 
 import { stateDir } from "./config.ts";
 import { formatEscalation } from "./escalate.ts";
-import type { SessionBoundary } from "./credentials.ts";
 import { createSession, disposeSession } from "./omp.ts";
 import type { AgentSessionLike } from "./omp.ts";
 import type { Escalation, ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
@@ -48,7 +47,6 @@ export type CreateSessionFn = (opts: {
   role: SessionRole;
   releaseGrants?: ResolvedGrants;
   onReleaseBlocked?: (shape: ReleaseShape) => void;
-  boundary?: SessionBoundary;
   socketPath?: string;
   verbSocketPath?: string;
   onChildLog?: (line: string) => void;
@@ -92,7 +90,6 @@ export interface OrchestratorOpts {
    * must have no read or write access to any run checkout — a property the
    * adversarial probe asserts rather than assumes.
    */
-  boundary?: SessionBoundary;
   /** Control socket for the session child. See {@link OrchestratorOpts.boundary}. */
   socketPath?: string;
   /**
@@ -189,7 +186,6 @@ export async function startOrchestrator(o: OrchestratorOpts): Promise<Orchestrat
     role: "orchestrator",
     ...(o.releaseGrants === undefined ? {} : { releaseGrants: o.releaseGrants }),
     ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
-    ...(o.boundary === undefined ? {} : { boundary: o.boundary }),
     ...(o.socketPath === undefined ? {} : { socketPath: o.socketPath }),
     ...(o.verbSocketPath === undefined ? {} : { verbSocketPath: o.verbSocketPath }),
     ...(o.onChildLog === undefined ? {} : { onChildLog: o.onChildLog }),

package/src/plugin.ts

@@ -20,7 +20,6 @@ import {
   repairPolicyBannerCrumbs,
 } from "./brief-upgrade.ts";
 import { configPath, expandHome, findProject, loadConfig, resolveCaps, saveConfig } from "./config.ts";
-import { mechanismSatisfies, probeHost } from "./credentials.ts";
 import { hostRamBytes, recommendedMaxWorkers } from "./host.ts";
 import {
   isPaused,
@@ -81,13 +80,11 @@ import {
 import {
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
-  CREDENTIAL_ISOLATIONS,
   DEFAULT_CAPS,
   DRAFT_POLICIES,
   RELEASE_REQUIREMENTS,
   RELEASE_SHAPES,
   type Caps,
-  type CredentialIsolation,
   type ConductorConfig,
   type OrchestratorMode,
   type ProjectConfig,
@@ -864,43 +861,6 @@ const askAuthorityArea: AreaAsker = async (ctx, a) => ({
  *  who may act, then under what conditions (#129). */
 const askPolicy: AreaAsker = async (ctx, a) => ({ ...a, policy: await askPolicyPreconditions(ctx, a.policy) });
 
-/**
- * Whether model-executed code gets its own OS principal (#125).
- *
- * The host is probed before the question is asked, and the answer the box can
- * actually honour is named in the option itself. That matters because the two
- * failure modes are asymmetric: choosing `none` gets a fleet that dispatches
- * and is unprotected, while choosing `per-run` on a host with no mechanism gets
- * a fleet that refuses every issue. An operator should not have to discover
- * which one they picked by watching the queue stall.
- */
-const askCredentials: AreaAsker = async (ctx, a) => {
-  const probe = await probeHost({ slots: a.caps.maxConcurrentWorkers ?? DEFAULT_CAPS.maxConcurrentWorkers });
-  // Each option says whether THIS host can honour it, asked of the same
-  // predicate the dispatch gate uses, so the wizard cannot promise a boundary
-  // the daemon will then refuse to build.
-  const offer = (isolation: CredentialIsolation, claim: string): string =>
-    mechanismSatisfies(isolation, probe.mechanism)
-      ? `${claim} — this host can build it with ${probe.mechanism}`
-      : `${claim} — UNAVAILABLE here (${probe.reasons.join("; ") || "no mechanism found"}); dispatch would refuse every issue`;
-  const described: { readonly [K in CredentialIsolation]: string } = {
-    "per-run": offer("per-run", "each session runs under its own OS principal; it cannot reach the daemon's credentials"),
-    "group-mode": offer(
-      "group-mode",
-      "same uid as the daemon, cross-run separation by group and mode only; bounds accidents, does NOT contain a bash escape",
-    ),
-    none: "sessions run as the daemon's user; env scrubbing only, which same-uid code defeats in one line",
-  };
-  const isolation = await askLiteral(
-    ctx,
-    "Credential isolation for worker and orchestrator sessions",
-    CREDENTIAL_ISOLATIONS,
-    described,
-    a.credentials.isolation,
-  );
-  return { ...a, credentials: { ...a.credentials, isolation } };
-};
-
 /** How a stuck run reaches a human, and who triages it when it does. */
 const askEscalation: AreaAsker = async (ctx, a) => {
   const telegram = detectTelegram();
@@ -957,7 +917,6 @@ const AREA_ASKERS: { readonly [K in AmendAreaId]: AreaAsker } = {
   graph: askGraph,
   authority: askAuthorityArea,
   policy: askPolicy,
-  credentials: askCredentials,
   escalation: askEscalation,
   reporting: askReporting,
   brief: askBrief,
@@ -1048,7 +1007,6 @@ async function collectAnswers(
   a = await askCaps(ctx, a);
   a = await askAuthorityArea(ctx, a);
   a = await askPolicy(ctx, a);
-  a = await askCredentials(ctx, a);
   a = await askWorkerModel(ctx, a);
   a = await askEscalation(ctx, a);
   a = await askReporting(ctx, a);
@@ -1166,6 +1124,7 @@ async function setup(ctx: CommandContext, projectArg: string | undefined): Promi
   const telegram = detectTelegram();
   const nextConfig = buildConfig(answers, existing);
   const project = findProject(nextConfig, answers.projectName);
+  // The same project as it is configured right now, so a moved `workspaceRoot`
   if (
     project.escalation.orchestrator === "external" &&
     !answers.writeOrchestratorBrief &&

package/src/session-host.ts

@@ -1,20 +1,19 @@
 #!/usr/bin/env bun
 /**
- * The child process one omp session runs in (#125 A1).
+ * The child process one omp session runs in.
  *
- * Before this file existed, `createSession` called the harness in the daemon's
- * own process, so every session inherited the daemon's `process.env`, its
- * `$HOME` and its whole filesystem view — and the daemon authenticates by
- * shelling out to the operator's logged-in `gh`. No amount of tool-layer
- * confinement closes that, because `bash` is deliberately unconfined and the
- * credential is reachable by running the same binary the daemon runs.
+ * Sessions run out of process so that one session's memory, crash or runaway
+ * turn is the child's and not the dispatcher's: a harness that exits, hangs or
+ * exhausts its heap takes down a process the daemon supervises rather than the
+ * daemon itself. It is also what lets `MemoryMax` on the unit govern the whole
+ * fleet, and what makes a kill a real kill.
  *
- * So the session moves out of process. This file is the far side: it loads the
- * harness, runs the real session, and speaks a five-verb protocol back over a
- * unix socket to the {@link AgentSessionLike} proxy in `omp.ts`. It holds no
- * conductor state, opens no database, and reads no config — everything it needs
- * arrives in {@link SessionHostSpec}, because under `uid-pool` this process runs
- * as a principal that cannot read the daemon's state directory at all.
+ * This file is the far side: it loads the harness, runs the real session, and
+ * speaks a five-verb protocol back over a unix socket to the
+ * {@link AgentSessionLike} proxy in `omp.ts`. It holds no conductor state, opens
+ * no database, and reads no config — everything it needs arrives in
+ * {@link SessionHostSpec}, so the child's inputs are data a caller can see
+ * rather than ambient state it inherits.
  *
  * The protocol is deliberately tiny. `AgentSessionLike` has five members, so
  * there are five things to carry, and every one of them is data.
@@ -156,12 +155,6 @@ export async function runSessionHost(
   spec: SessionHostSpec,
   deps: SessionHostDeps = { createSession: createLocalSession },
 ): Promise<void> {
-  // umask before anything is created. Under uid-pool the run tree is
-  // `2770 slot:conductor-daemon`, and the setgid bit only decides the *group*
-  // of what this process writes — without `0007` the mode still lands `0644`
-  // and the daemon's access to a file the worker created is silently partial,
-  // which surfaces as a failed salvage in production rather than here.
-  process.umask(0o007);
 
   const socket = connect(spec.socket);
   socket.setNoDelay(true);