omp-conductor 0.4.4 → 0.5.0

package/src/setup-host.ts

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
-import { configPath, resolveCredentials, sharedRoot, stateDir } from "./config.ts";
+import { configPath, stateDir } from "./config.ts";
 import { isPaused, runDaemon, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
 import { DEFAULT_FLEET_AGENT_NAME } from "./fleet.ts";
 import {
@@ -110,28 +110,6 @@ export function renderDaemonService(
     `Environment=${systemdQuote(`PATH=${runtime.path}`)}`,
     `Environment=${systemdQuote(`OMP_CONDUCTOR_HOME=${runtime.conductorHome}`)}`,
     `Environment=${systemdQuote(`OMP_TELEGRAM_STATE_DIR=${runtime.telegramStateDir}`)}`,
-    // Both of these are per-run only, and grouped so the managed set stays one
-    // idea. The shared root is baked in so a custom location survives systemd's
-    // clean environment — without it the daemon resolves the platform default
-    // while the operator provisioned somewhere else, and every dispatch is
-    // refused for a path nobody chose. It is meaningless under `none`, where
-    // nothing resolves it, and rendering it there would make every unit
-    // installed before 0.4.0 look drifted for no reason (#125).
-    //
-    // The capabilities exist to be DROPPED INTO run children by the
-    // privilege-dropping launcher, never inherited by them — see `setprivArgv`.
-    // Rendered only for `per-run`, because that is the only isolation that
-    // changes uid; granting them to a fleet that does not need them widens the
-    // daemon for nothing. Without them the probe honestly reports `group-mode`
-    // and a configured per-run fleet refuses every dispatch, which is the
-    // failure an operator following setup would otherwise hit first.
-    ...(resolveCredentials(project).isolation === "per-run"
-      ? [
-          `Environment=${systemdQuote(`OMP_CONDUCTOR_SHARED=${sharedRoot()}`)}`,
-          "AmbientCapabilities=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
-          "CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
-        ]
-      : []),
     `WorkingDirectory=${systemdQuote(stateDir())}`,
     `ExecStart=${command.map(systemdQuote).join(" ")}`,
     "Restart=on-failure",
@@ -310,137 +288,3 @@ export async function runSetupSmoke(
 export function installedUnitPath(): string {
   return join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME);
 }
-
-/**
- * Why the *live* systemd unit no longer matches what this version would render.
- *
- * `planHostRuntime` compares against the **staged** copy under the state dir,
- * which says nothing about the file systemd booted from. That gap is not
- * cosmetic since 0.4.0: a fleet configured `per-run` whose installed unit
- * predates the capability grant probes down to `group-mode` and then refuses
- * every dispatch — and `upgrade` would happily verify package identities,
- * services, pane and ticks around it, because none of those look at the unit.
- *
- * Checked by directive rather than by whole-file equality on purpose. An
- * operator is entitled to hand-tune `MemoryMax`, add `After=`, or set an
- * `Environment=` of their own, and failing an upgrade over that would teach
- * them to stop running upgrades. What is reported is the set of directives this
- * configuration *requires* and the live unit lacks.
- *
- * `undefined` means either "no drift that matters" or "no installed unit at
- * all" — a host running `omp-conductor start` without systemd is not broken,
- * and must not be told it is.
- */
-/**
- * What systemd has actually loaded for the unit, as `systemctl show` reports it.
- *
- * Deliberately not the file on disk. A unit installed without `daemon-reload`
- * can match the rendered text byte for byte while the manager still runs the
- * previous configuration, and a drop-in under `…service.d/` changes what runs
- * without touching the file at all. Both read clean from the filesystem.
- */
-export interface EffectiveUnit {
-  /** `systemctl show -p AmbientCapabilities`; empty string when unset. */
-  ambientCapabilities: string;
-  capabilityBoundingSet: string;
-  /** `systemctl show -p Environment`, newline- or space-joined. */
-  environment: string;
-  needDaemonReload: boolean;
-}
-
-/** Capability names as a comparable set: systemd reports them lowercased, `cap_`-prefixed and reordered. */
-function capabilitySet(text: string): Set<string> {
-  return new Set(
-    text
-      .split(/[\s,]+/)
-      .map((name) => name.trim().toLowerCase().replace(/^cap_/, ""))
-      .filter((name) => name.length > 0),
-  );
-}
-
-function renderedDirective(rendered: string, key: string): string | undefined {
-  for (const line of rendered.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith(`${key}=`)) return trimmed.slice(key.length + 1);
-  }
-  return undefined;
-}
-
-/**
- * Why what systemd loaded no longer matches what this version would render.
- *
- * Three asymmetries, each for a reason:
- *
- * - **Ambient capabilities are compared exactly, both ways.** Missing them
- *   breaks a per-run fleet; *leftover* ones are worse. Roll back to `none` and
- *   there is no `setpriv` launcher at all, so ambient capabilities on the unit
- *   are inherited straight into model-executed code, which can then `setuid()`
- *   to any account. `systemctl` reports an empty string when unset, so the
- *   rollback case is unambiguous.
- * - **The bounding set is checked only when this version sets it.** systemd
- *   reports the full default set when a unit does not, so comparing both ways
- *   would flag every ordinary host.
- * - **Only directives this configuration manages are considered**, so an
- *   operator's own `MemoryMax`, `After=` or drop-in never fails an upgrade.
- */
-export function unitDriftReason(rendered: string, effective: EffectiveUnit | undefined): string | undefined {
-  if (effective === undefined) return undefined;
-  const problems: string[] = [];
-
-  const wantAmbient = capabilitySet(renderedDirective(rendered, "AmbientCapabilities") ?? "");
-  const haveAmbient = capabilitySet(effective.ambientCapabilities);
-  const missingAmbient = [...wantAmbient].filter((c) => !haveAmbient.has(c));
-  const extraAmbient = [...haveAmbient].filter((c) => !wantAmbient.has(c));
-  if (missingAmbient.length > 0) {
-    problems.push(`AmbientCapabilities is missing ${missingAmbient.join(", ")}`);
-  }
-  if (extraAmbient.length > 0) {
-    problems.push(
-      `AmbientCapabilities grants ${extraAmbient.join(", ")} that this configuration does not — with ` +
-        `isolation off there is no privilege-dropping launcher, so these are inherited by model-executed code`,
-    );
-  }
-
-  const wantBounding = renderedDirective(rendered, "CapabilityBoundingSet");
-  if (wantBounding !== undefined) {
-    const missing = [...capabilitySet(wantBounding)].filter(
-      (c) => !capabilitySet(effective.capabilityBoundingSet).has(c),
-    );
-    if (missing.length > 0) problems.push(`CapabilityBoundingSet is missing ${missing.join(", ")}`);
-  }
-
-  const wantShared = rendered
-    .split("\n")
-    .map((l) => l.trim())
-    .find((l) => l.includes("OMP_CONDUCTOR_SHARED="));
-  if (wantShared !== undefined) {
-    const value = wantShared.slice(wantShared.indexOf("OMP_CONDUCTOR_SHARED=")).replace(/"$/, "");
-    if (!effective.environment.includes(value)) {
-      problems.push(`Environment is missing ${value}`);
-    }
-  }
-
-  if (effective.needDaemonReload) {
-    problems.push("systemd reports the unit needs a daemon-reload, so what runs is not what is on disk");
-  }
-
-  if (problems.length === 0) return undefined;
-  return (
-    `what systemd loaded for ${STAGED_SERVICE_NAME} does not match this configuration: ${problems.join("; ")}.`
-  );
-}
-
-/** Parse `systemctl show -p …` key=value output into an {@link EffectiveUnit}. */
-export function parseEffectiveUnit(stdout: string): EffectiveUnit {
-  const values = new Map<string, string>();
-  for (const line of stdout.split("\n")) {
-    const at = line.indexOf("=");
-    if (at > 0) values.set(line.slice(0, at).trim(), line.slice(at + 1).trim());
-  }
-  return {
-    ambientCapabilities: values.get("AmbientCapabilities") ?? "",
-    capabilityBoundingSet: values.get("CapabilityBoundingSet") ?? "",
-    environment: values.get("Environment") ?? "",
-    needDaemonReload: (values.get("NeedDaemonReload") ?? "no") === "yes",
-  };
-}

package/src/setup.ts

@@ -35,11 +35,11 @@ import {
 import {
   clonePolicy,
   configPath,
+  defaultMirrorRoot,
+  defaultWorkspaceRoot,
   resolveCaps,
-  resolveCredentials,
   resolvePolicy,
   resolveReleaseGrants,
-  projectTreeBase,
   stateDir,
 } from "./config.ts";
 import { graphProjectPath, graphRepos } from "./graph.ts";
@@ -51,8 +51,6 @@ import {
   DEFAULT_REPORT_SCOPE,
   DENIED_RELEASE_GRANTS,
   RELEASE_SHAPES,
-  type CredentialConfig,
-  type CredentialIsolation,
   type BaseFreshness,
   type BehindBaseAction,
   type Caps,
@@ -103,13 +101,6 @@ export interface SetupAnswers {
    * leave one to be defaulted by whichever reader gets there first.
    */
   policy: ProjectPolicy;
-  /**
-   * Whether model-executed code runs under its own OS principal (#125). The
-   * wizard offers `per-run` only when the host probe says this box can build
-   * the boundary, because an answer the host cannot honour is a fleet that
-   * refuses to dispatch rather than a fleet that is protected.
-   */
-  credentials: CredentialConfig;
   /**
    * Whether to render `ORCHESTRATOR.md` into the project's workspace root. Not
    * part of the config — the brief is the operator's file, and the conductor
@@ -174,13 +165,6 @@ export const SETUP_DEFAULTS = {
   releaseGrants: DENIED_RELEASE_GRANTS,
   /** The strictest reading of the prose these conditions replaced (#129). */
   policy: DEFAULT_PROJECT_POLICY,
-  /**
-   * No boundary until an operator asks for one on a host that can build it.
-   * `none` is the honest default rather than the safe-sounding one: writing
-   * `per-run` into a fresh config on a box with no mechanism would produce a
-   * conductor that installs cleanly and then declines every issue (#125).
-   */
-  credentials: { isolation: "none" } as CredentialConfig,
   /** The daemon runs its own triage session unless an operator already runs one. */
   orchestratorMode: "embedded",
 } as const;
@@ -520,11 +504,6 @@ export async function createMissingLabels(trackerRepo: string, plan: LabelPlan[]
  * with {@link answersFromProject} — the pair an amend's carry-through rests on.
  */
 export function buildProject(a: SetupAnswers): ProjectConfig {
-  // Under a per-run boundary the worktrees and mirrors have to sit where a slot
-  // principal can actually traverse to them. Defaulting them under the 0700
-  // state directory would provision a repository and then be refused at
-  // dispatch, which looks like a broken install rather than a layout choice.
-  const dir = projectTreeBase(a.credentials.isolation);
 
   const repos: Record<string, RepoTarget> = {};
   const graphRoot = a.graphRoot?.trim();
@@ -580,14 +559,13 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // Written out in full for the same reason: the file then says what a merge
     // and a release require without anyone having to know a default (#129).
     policy: clonePolicy(a.policy),
-    // Written out even when it is the default, so `status` reporting the fleet
-    // unprotected always has a line in the file to point at (#125).
-    credentials: { ...a.credentials },
+    // Written out even when it is the default, so an operator amending the
+    // volume has a line in the file to point at.
     reporting: { scope: a.reportScope },
     // Both under the state dir so one `rm -rf ~/.omp/conductor` is a complete
     // uninstall, and neither can land in a repo the daemon then tries to commit.
-    workspaceRoot: join(dir, "worktrees"),
-    mirrorRoot: join(dir, "mirrors"),
+    workspaceRoot: defaultWorkspaceRoot(),
+    mirrorRoot: defaultMirrorRoot(),
   };
 }
 
@@ -641,7 +619,6 @@ export function defaultAnswers(projectName: string): SetupAnswers {
     authority: { ...SETUP_DEFAULTS.authority },
     releaseGrants: { ...SETUP_DEFAULTS.releaseGrants },
     policy: clonePolicy(SETUP_DEFAULTS.policy),
-    credentials: { ...SETUP_DEFAULTS.credentials },
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
     reportScope: SETUP_DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -689,7 +666,6 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     authority: { ...p.authority },
     releaseGrants: resolveReleaseGrants(p),
     policy: resolvePolicy(p),
-    credentials: resolveCredentials(p),
     orchestratorMode: p.escalation.orchestrator,
     reportScope: p.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -1137,7 +1113,6 @@ export const AMEND_AREA_IDS = [
   "graph",
   "authority",
   "policy",
-  "credentials",
   "escalation",
   "reporting",
   "brief",
@@ -1243,16 +1218,6 @@ export const AMEND_AREAS: {
       );
     },
   },
-  credentials: {
-    name: "credential isolation",
-    asks: "whether worker and orchestrator sessions run under their own OS principal, or as the daemon's own user",
-    describe: (p) => {
-      const c = resolveCredentials(p);
-      return c.isolation === "per-run"
-        ? `per-run principals${c.readToken === undefined ? "" : ", with a read-scoped token"}`
-        : "none — sessions run as the daemon's user and can reach its credentials";
-    },
-  },
   escalation: {
     name: "escalation & triage",
     asks: "the tier-2 Telegram chat, whether escalations also comment, and where the orchestrator session lives",

package/src/store.ts

@@ -15,6 +15,7 @@ import { dirname, join } from "node:path";
 
 import { stateDir } from "./config.ts";
 import { DECISION_TTL_MS, DEFAULT_CAPS } from "./types.ts";
+import { startFailure } from "./failure-class.ts";
 import type {
   DecisionDraft,
   FailureClass,
@@ -678,6 +679,39 @@ export function openStore(dbPath: string): Store {
     }
   }
 
+  // One-time repair, and the reason it lives here rather than in the classifier:
+  // a turn-0 environment fault that was ALREADY classified `unknown` and
+  // escalated is never revisited. `runsNeedingClassification` only offers a row
+  // whose class is NULL, or one whose recovery has not run yet — an
+  // `unknown`/`escalate` row with `recoveredAt` set satisfies neither, so no
+  // upgrade and no later tick would ever correct it.
+  //
+  // That mattered on a real fleet. The per-run `$HOME` redirect this release
+  // deletes hid the harness's own credentials, so every dispatch died before it
+  // read its issue and each one still spent an implementation attempt. Deleting
+  // the redirect stops the bleeding; it does not give back attempts already
+  // charged, and an issue sitting at its cap for a fault that was never in its
+  // code stays undispatchable forever.
+  //
+  // Narrow by construction: `turns = 0` (the session never took a turn), an
+  // error the classifier itself recognises as a start failure, and a class of
+  // exactly `unknown` — a row a human or a later release classified as anything
+  // else is left alone. Idempotent for free: afterwards those rows read
+  // `env-start-failure`, which the WHERE no longer matches.
+  const misread = db
+    .query<
+      { id: string; lastError: string | null },
+      []
+    >(`SELECT id, lastError FROM runs WHERE failureClass = 'unknown' AND turns = 0 AND lastError IS NOT NULL`)
+    .all()
+    .filter((row) => startFailure(row.lastError ?? undefined) !== undefined);
+  if (misread.length > 0) {
+    const reclassify = db.query<unknown, [string]>(
+      `UPDATE runs SET failureClass = 'env-start-failure' WHERE id = ?`,
+    );
+    for (const row of misread) reclassify.run(row.id);
+  }
+
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
@@ -725,12 +759,12 @@ export function openStore(dbPath: string): Store {
   const countFailures = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state = 'failed'
-        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck'))`,
+        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck', 'env-start-failure'))`,
   );
   const countContinuations = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state IN ('killed', 'orphaned', 'blocked')
-        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck'))`,
+        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck', 'env-start-failure'))`,
   );
   // Newest first, and bounded: every row this returns costs `gh` calls to gather
   // facts for, so a fleet with a long unclassified history classifies over

package/src/tracker/github.ts

@@ -21,7 +21,7 @@
  * `gh auth token`; the eleven Tracker methods above it stay untouched.
  */
 
-import { credentialedEnv } from "../credentials.ts";
+import { credentialedEnv } from "../gitops.ts";
 import { parsePrDiff } from "../diff-flags.ts";
 import type {
   IssueState,

package/src/types.ts

@@ -457,76 +457,6 @@ export type ReleaseJustification = VerbJustification<ReleaseReason>;
 
 export type LabelJustification = VerbJustification<LabelReason>;
 
-/**
- * How hard a boundary separates model-executed code from the operator's GitHub
- * write credential (#125).
- *
- * Three values, ordered strongest first, because the difference between them is
- * a difference in what anyone can honestly claim:
- *
- * - `per-run` — every session runs as its own OS principal that cannot read the
- *   daemon's `gh` config, keychain, `~/.ssh` or `~/.npmrc`, and cannot write a
- *   sibling run's checkout. Satisfied **only** by the `uid-pool` and
- *   `sandbox-exec` mechanisms.
- * - `group-mode` — same uid as the daemon, cross-run separation by group and
- *   mode only. It bounds accidents and does **not** contain a determined bash
- *   escape. It exists as a config value rather than as a fallback so that an
- *   operator who takes it has said the weaker sentence out loud: a `per-run`
- *   request that quietly resolved to this would let somebody believe they had
- *   configured the full boundary and shipped the lesser one, which is precisely
- *   the "never the silent default" failure #125 exists to end.
- * - `none` — the session runs as the daemon's own user and the env scrubbing in
- *   `credentials.ts` is *all* that stands between the model and the credential,
- *   which same-uid code defeats in one line.
- *
- * A request is never downgraded. If the host cannot build what was asked for,
- * dispatch refuses and names the missing mechanism.
- */
-export const CREDENTIAL_ISOLATIONS = ["per-run", "group-mode", "none"] as const;
-
-export type CredentialIsolation = (typeof CREDENTIAL_ISOLATIONS)[number];
-
-/**
- * What the host can actually enforce, decided by the startup probe rather than
- * by config. Kept separate from {@link CREDENTIAL_ISOLATIONS} on purpose: the
- * operator asks for a boundary, the host says which one it can build, and
- * `status` reports the difference instead of letting either side guess.
- *
- * - `uid-pool` — one unprivileged account per run slot, entered through a
- *   privilege-dropping launcher. The only mechanism that claims to contain a
- *   determined bash escape on Linux.
- * - `group-mode` — same uid as the daemon, cross-run separation by group and
- *   mode only. Bounds accidents, does **not** contain an escape.
- * - `sandbox-exec` — the macOS equivalent of `uid-pool` for a dev host.
- * - `none` — no boundary at all.
- */
-export const ISOLATION_MECHANISMS = ["uid-pool", "group-mode", "sandbox-exec", "none"] as const;
-
-export type IsolationMechanism = (typeof ISOLATION_MECHANISMS)[number];
-
-/**
- * The two groups the filesystem model needs, named once so the probe, the
- * provisioning docs and the adversarial tests cannot drift apart (#125).
- *
- * `daemon` holds the daemon account **only** and is what lets it fetch, salvage
- * and reclaim every run repo. `runs` holds every slot principal and grants
- * read-only access to the shared mirror. A slot principal in `daemon` would
- * void the whole cross-run boundary, so the probe asserts the absence.
- */
-export const CONDUCTOR_GROUPS = { daemon: "conductor-daemon", runs: "conductor-runs" } as const;
-
-/** Per-project credential boundary settings. See {@link CREDENTIAL_ISOLATIONS}. */
-export interface CredentialConfig {
-  isolation: CredentialIsolation;
-  /**
-   * Optional **read-scoped** token handed to sessions so they can look things
-   * up on GitHub. Absent is the default and the safe reading: a worker then
-   * works from its dispatch brief and the daemon's mediated verbs, which is
-   * why the brief must not tell it to run `gh pr view`.
-   */
-  readToken?: string;
-}
-
 /**
  * Where the session that triages escalations lives. `embedded` is the daemon's
  * own child session; `external` means an operator already runs one — a visible
@@ -601,16 +531,6 @@ export interface ProjectConfig {
    * `resolveReportScope` rather than reaching for `.scope` directly.
    */
   reporting?: { scope: ReportScope };
-  /**
-   * The credential boundary this project's sessions run behind (#125).
-   *
-   * Optional only on disk, and only for one release: a config written before
-   * this key existed is migrated to an explicit `{ isolation: "none" }` and
-   * rewritten, so the operator ends up with the answer in the file rather than
-   * inheriting a silent default. Never read directly — go through
-   * `resolveCredentials`, which is where that migration is spelled once.
-   */
-  credentials?: CredentialConfig;
   /** Parent directory for per-run worktrees. */
   workspaceRoot: string;
   /** Cache of bare clones, so N runs share one fetch instead of N. */
@@ -877,6 +797,7 @@ export interface Tracker {
  * answers instead of re-investigating.
  */
 export const FAILURE_CLASSES = [
+  "env-start-failure",
   "turn-cap-progress",
   "turn-cap-spinning",
   "admin-kill",
@@ -1000,11 +921,6 @@ export type AdmissionHoldReason =
   | "unsalvaged-wip"
   | "daily-spend-cap"
   | "plan-usage-cap"
-  /** `credentials.isolation: "per-run"` on a host whose probe found no
-   *  mechanism. The operator asked for a boundary this host cannot build, so
-   *  dispatch refuses rather than running unprotected under a config that says
-   *  otherwise (#125). */
-  | "credential-boundary"
   | "unroutable:no-repo-label"
   | "unroutable:multiple-repo-labels"
   | "unroutable:unknown-repo";

package/src/upgrade.ts

@@ -7,11 +7,8 @@ import { configPath, findProject, loadConfig, resolveCaps, writeConfigRaw } from
 import { renderBriefForProject } from "./setup.ts";
 import {
   STAGED_SERVICE_NAME,
-  parseEffectiveUnit,
   planHostRuntime,
-  unitDriftReason,
   writeHostRuntime,
-  type EffectiveUnit,
 } from "./setup-host.ts";
 
 const PACKAGE = "omp-conductor";
@@ -41,15 +38,6 @@ export interface UpgradeResult {
   dispatch: DispatchLayer;
 }
 
-/** What the unit check reads, and how it repairs what it can. */
-export interface UnitFiles {
-  rendered: string;
-  /** What systemd loaded, not what is on disk. Undefined means no systemd here. */
-  effective: EffectiveUnit | undefined;
-  /** Writes the corrected unit to the state dir; returns the commands root must run. */
-  stage?(): readonly string[];
-}
-
 export interface UpgradeDeps {
   run(command: string, args: readonly string[]): Promise<UpgradeCommandResult>;
   snapshot(project?: string): { liveWorkers: number };
@@ -61,12 +49,6 @@ export interface UpgradeDeps {
   sleep(ms: number): Promise<void>;
   env: NodeJS.ProcessEnv;
   log(message: string): void;
-  /**
-   * What this version would render as the unit, and what systemd actually
-   * booted from. Injected so the drift check is testable without a systemd host
-   * — and defaulted, so no production caller has to know it exists.
-   */
-  unitFiles?(): Promise<UnitFiles | undefined> | UnitFiles | undefined;
 }
 
 async function runCommand(command: string, args: readonly string[]): Promise<UpgradeCommandResult> {
@@ -450,49 +432,6 @@ async function rollbackUpgrade(
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 
-/**
- * The rendered-vs-installed pair for {@link unitDriftReason}.
- *
- * Best-effort by design: a host with no config, no project, or no systemd is
- * not a host with a broken unit, and an upgrade must not fail because it could
- * not answer a question that does not apply there.
- */
-async function defaultUnitFiles(deps: UpgradeDeps): Promise<UnitFiles | undefined> {
-  try {
-    const cfg = loadConfig();
-    const project = cfg.projects[0];
-    if (project === undefined) return undefined;
-    const plan = planHostRuntime(project, resolveCaps(project, cfg.defaults), telegramStateDir());
-    const shown = await deps.run("systemctl", [
-      "show",
-      STAGED_SERVICE_NAME,
-      "-p",
-      "AmbientCapabilities",
-      "-p",
-      "CapabilityBoundingSet",
-      "-p",
-      "Environment",
-      "-p",
-      "NeedDaemonReload",
-    ]);
-    return {
-      rendered: plan.service.content,
-      effective: shown.code === 0 ? parseEffectiveUnit(shown.stdout) : undefined,
-      // Staging needs no privilege, so the repair is reduced to the two lines
-      // that genuinely do. Installing the unit is root's, and this command runs
-      // as the fleet user by design — so it goes as far as it can and then says
-      // exactly what is left, rather than sending the operator back through a
-      // wizard to regenerate a file it could write itself.
-      stage: () => {
-        writeHostRuntime(plan);
-        return plan.installCommands;
-      },
-    };
-  } catch {
-    return undefined;
-  }
-}
-
 export async function upgradeConductor(
   options: UpgradeOptions = {},
   overrides: Partial<UpgradeDeps> = {},
@@ -519,22 +458,6 @@ export async function upgradeConductor(
   const surfaces = await inspectSurfaces(deps);
   const brief = deps.brief(project);
   const installNeeded = !surfacesCurrent(surfaces, release.version, release.gitHead);
-  // Computed BEFORE the no-op decision, not inside verification, and that
-  // placement is the whole point. The upgrade that installs a version is run by
-  // the *previous* CLI, so a check living only in the new code never executes
-  // for the release that introduces it — and re-running afterwards would take
-  // the already-current early return and skip it forever. A fleet whose unit is
-  // stale is not current, whatever its package identities say.
-  const files = await (deps.unitFiles === undefined ? defaultUnitFiles(deps) : deps.unitFiles());
-  const drift = files === undefined ? undefined : unitDriftReason(files.rendered, files.effective);
-  if (drift !== undefined) {
-    const commands = files?.stage?.() ?? [];
-    throw new Error(
-      commands.length === 0
-        ? drift
-        : `${drift}\n\nThe corrected unit has been staged. Run:\n${commands.map((c) => `  ${c}`).join("\n")}`,
-    );
-  }
   if (!installNeeded && brief.current) {
     return {
       previousVersion: surfaces.cliVersion,
@@ -629,17 +552,6 @@ export async function upgradeConductor(
       const active = await mustRun(deps, "systemctl", ["is-active", HERDR_UNIT]);
       if (active.stdout.trim() !== "active") throw new Error(`${HERDR_UNIT} is not active after restart`);
     }
-    // The unit is the one surface `upgrade` never looked at, and since 0.4.0 it
-    // is the difference between a working per-run fleet and one that refuses
-    // every issue. Fatal rather than a warning: the whole point of this command
-    // is that a fleet is either upgraded or explicitly left paused, and a
-    // "verified" fleet that cannot dispatch is the worse outcome.
-    // Re-read rather than trust the earlier pass: the daemon has restarted
-    // since, and an operator who installed a unit mid-upgrade should not get a
-    // green verification for a file nobody checked.
-    const after = await (deps.unitFiles === undefined ? defaultUnitFiles(deps) : deps.unitFiles());
-    const stillDrifted = after === undefined ? undefined : unitDriftReason(after.rendered, after.effective);
-    if (stillDrifted !== undefined) throw new Error(stillDrifted);
     await waitForRecovery(deps, initial, project);
     deps.log("verify 2/2: recovered fleet remains stable");
     await deps.sleep(1_000);

package/src/verbs/actions.ts

@@ -14,7 +14,7 @@
  * enough to actually write.
  */
 
-import { credentialedEnv, openRunPr, pushRunBranch, repoSlugFor } from "../credentials.ts";
+import { credentialedEnv, openRunPr, pushRunBranch, repoSlugFor } from "../gitops.ts";
 import type { ProjectConfig, ReleaseShape } from "../types.ts";
 import type { ActionOutcome, ReleaseExecution, VerbActions } from "./server.ts";