omp-conductor 0.4.5 → 0.5.0

package/src/daemon.ts

@@ -14,12 +14,9 @@ import {
   configPath,
   findProject,
   loadConfig,
-  migrateCredentialsOnDisk,
   resolveCaps,
-  resolveCredentials,
   resolveReleaseGrants,
   stateDir,
-  sharedRoot,
 } from "./config.ts";
 import {
   analyseSettlement,
@@ -49,7 +46,6 @@ import type {
   Escalation,
   OpenCloser,
   PrState,
-  CredentialIsolation,
   ProjectConfig,
   ReadyIssue,
   RepoTarget,
@@ -64,7 +60,6 @@ import type {
   Tracker,
   VerbLedgerEntry,
 } from "./types.ts";
-import { CONDUCTOR_GROUPS, type IsolationMechanism } from "./types.ts";
 import { type KilledBy, type WorkerResult, renderBrief, runWorker } from "./worker.ts";
 import {
   addRunRepo,
@@ -90,31 +85,7 @@ import {
 } from "./verbs/socket.ts";
 import { homedir } from "node:os";
 
-import {
-  applyRunOwnership,
-  applyMirrorReadAccess,
-  auditMcpRoots,
-  mirrorTraversalRefusal,
-  credentialReadRefusal,
-  spawnCaptured,
-  boundaryRefusal,
-  buildSessionBoundary,
-  createSlotPool,
-  describeBoundary,
-  liveDaemonCredentials,
-  mcpRefusal,
-  mechanismSatisfies,
-  openRunPr,
-  probeHost,
-  pushRunBranch,
-  resolveModelCredential,
-  verifyDaemonAccess,
-  type HostProbe,
-  type ModelCredential,
-  type RunRepoRef,
-  type SessionBoundary,
-  type SlotPool,
-} from "./credentials.ts";
+import { pushRunBranch, type RunRepoRef } from "./gitops.ts";
 import {
   planUsageLine,
   readPlanUsage,
@@ -152,44 +123,9 @@ export interface DaemonOpts {
 
 /** Everything one tick touches, resolved once at startup so a tick never
  *  re-reads config mid-flight and changes its own limits underneath itself. */
-/**
- * The credential boundary this fleet is running behind (#125), resolved once at
- * startup like every other dep so a tick cannot change its own protection.
- *
- * `paged` is the same one-page-per-episode gate the integrity tripwire uses: a
- * host that cannot build the boundary the operator asked for holds *every*
- * candidate on *every* tick, and paging per five minutes forever is paging
- * nobody reads.
- */
-export interface FleetBoundary {
-  isolation: CredentialIsolation;
-  probe: HostProbe;
-  slots: SlotPool;
-  paged: boolean;
-}
-
-/**
- * True when the operator asked for a boundary this host cannot build.
- *
- * Asks {@link mechanismSatisfies} rather than testing for `none`, because the
- * interesting refusal is the near miss: a host offering `group-mode` against a
- * `per-run` config used to dispatch happily under the weaker boundary, which is
- * the silent downgrade #125 forbids.
- */
-export function boundaryRefusesDispatch(boundary: FleetBoundary | undefined): boolean {
-  return boundary !== undefined && !mechanismSatisfies(boundary.isolation, boundary.probe.mechanism);
-}
-
 interface Deps {
   project: ProjectConfig;
   caps: Caps;
-  /**
-   * Optional only so a test can build a `Deps` without a host probe; production
-   * always resolves one in `runDaemon`. Absent means the A1 shape — sessions
-   * are still child processes, but they run as the daemon's own user and no
-   * security claim is made for them.
-   */
-  boundary?: FleetBoundary;
   tracker: Tracker;
   store: Store;
   /** Provider-reported plan allowance, cached with a TTL. Resolved once at
@@ -200,17 +136,6 @@ interface Deps {
   integrity: IntegrityGate;
   stall: StallGate;
   cleanup?: RetainedCleanupCursor;
-  /**
-   * How sessions authenticate a model, resolved once at startup so every child of
-   * one tick agrees — and so a fleet with none is refused at admission instead of
-   * discovering it at turn 0 (#152).
-   *
-   * Optional exactly as {@link Deps.boundary} is: absent means no resolution was
-   * made, which is the shape a unit test that does not exercise this gate wants.
-   * `runDaemon` always resolves one. `paged` is the page-once latch, so a fleet
-   * held for an environment fault says so once rather than every five minutes.
-   */
-  model?: { credential?: ModelCredential; paged: boolean };
   /**
    * Reads the connecting uid off a verb socket (#126). Resolved once at startup
    * so the mechanism is logged before the first socket exists; absent on a host
@@ -682,48 +607,6 @@ export async function settleWorktree(
   };
 }
 
-/**
- * The probe a session gets when no boundary was resolved at all — a test, or a
- * `--once` run built without one. Named rather than inlined so the "no
- * mechanism, no claim" shape is one object every call site shares.
- */
-const NO_BOUNDARY_PROBE: HostProbe = {
-  mechanism: "none",
-  reasons: ["no host probe was run"],
-  residuals: [],
-  boundingSetDropped: false,
-  slots: [],
-};
-
-/**
- * Credential paths the macOS profile denies outright.
- *
- * Derived from the operator's real home rather than from the session's
- * redirected one: the point is that the *operator's* `gh` config and keys stay
- * unreachable even when a session names their absolute path, which is exactly
- * the probe `GH_CONFIG_DIR=<operator home>/.config/gh gh auth status` in #125.
- */
-function credentialDenyRoots(): string[] {
-  const home = homedir();
-  return [join(home, ".ssh"), join(home, ".config", "gh"), join(home, ".gnupg"), join(home, ".aws")];
-}
-
-function credentialDenyFiles(): string[] {
-  const home = homedir();
-  return [
-    join(home, ".git-credentials"),
-    join(home, ".npmrc"),
-    join(home, ".netrc"),
-    // Both git config locations, because a token does not only live in
-    // `.git-credentials`: `url.https://<token>@github.com/.insteadOf` is a
-    // perfectly ordinary way to wire one up, and an ordinary `.gitconfig` is
-    // 0644. Hardening chmods it, but hardening is not the claim — this list is
-    // what the empirical recheck actually asks the slot principal about, so a
-    // file missing from here is a credential nobody verified was out of reach.
-    join(home, ".gitconfig"),
-    join(home, ".config", "git", "config"),
-  ];
-}
 
 /**
  * How a run's end is named — in the salvage commit, and to whoever reads it.
@@ -962,24 +845,21 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
   const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
   let worktreePath: string | undefined;
   let turnLimit: TurnLimitController | undefined;
-  // #125: the run's own repository, the slot it holds, and the boundary its
-  // session runs behind. Hoisted for the same reason `worktreePath` is — the
-  // catch and finally paths have to release the slot and publish the branch.
+  // The run's own repository. Hoisted for the same reason `worktreePath` is —
+  // the catch and finally paths have to publish the branch.
   let runRepo: RunRepoRef | undefined;
-  let slotIndex: number | undefined;
-  let boundary: SessionBoundary | undefined;
-  // #126: the run's own verb socket. Hoisted like the slot, because the catch
+  // #126: the run's own verb socket. Hoisted like the run repo, because the catch
   // and finally paths have to close it — a socket outliving its run is a
   // channel nobody is authenticating any more.
   let verbListener: VerbListener | undefined;
-  const credentials = resolveCredentials(project);
 
   /**
    * Publishes the run's branch on the privileged side: run repo → mirror →
-   * GitHub, fast-forward only. The worker holds no credential and never
-   * performs a network git operation itself (#125 item 3); this is the only
-   * route its commits take out, and it is also what stops a per-run repository
-   * from being the *only* copy when the tree is removed.
+   * GitHub, fast-forward only. The dispatcher performs every network git
+   * operation for a run so the settlement record and the branch cannot
+   * disagree (#126); this is the only route a worker's commits take out, and it
+   * is also what stops a per-run repository from being the *only* copy when the
+   * tree is removed.
    */
   const publish: RunPublisher = async () => {
     if (runRepo === undefined) return { ok: false, stderr: "the run repository was never provisioned" };
@@ -1035,126 +915,12 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // directory and learns the real path back from the result. Inventing one
     // here would put a file that never gets written into an escalation.
     //
-    // Per run rather than one shared directory: under `uid-pool` the session
-    // writes its own transcript as its slot principal, and a directory shared
-    // with every other run would let each read the others'. The daemon still
-    // reads all of them — it owns the group.
-    //
-    // Under `uid-pool` the session runs as a *different uid*, so every tree it
-    // has to reach lives outside the private state directory: that one stays
-    // 0700 because it holds conductor.db and the WAL SQLite keeps recreating,
-    // and making it searchable to let a slot in would publish fleet history to
-    // every local account. `sandbox-exec` and `none` keep the old paths — same
-    // uid, nothing to traverse into (#125).
-    const runTreeRoot = d.boundary?.probe.mechanism === "uid-pool" ? sharedRoot() : stateDir();
-    if (runTreeRoot !== stateDir()) {
-      mkdirSync(runTreeRoot, { recursive: true });
-      chmodSync(runTreeRoot, 0o711);
-    }
+    // Per run rather than one shared directory, so one run's transcript cannot
+    // be truncated or replaced by the next.
+    const runTreeRoot = stateDir();
     const sessionDir = join(runTreeRoot, "sessions", `run-${String(runId)}`);
-    const envRoot = join(runTreeRoot, "boundaries", `run-${String(runId)}`);
     mkdirSync(sessionDir, { recursive: true });
 
-    // ---- the credential boundary for this run (#125) --------------------
-    slotIndex = d.boundary?.slots.acquire();
-    boundary = buildSessionBoundary({
-      probe: d.boundary?.probe ?? NO_BOUNDARY_PROBE,
-      isolation: d.boundary?.isolation ?? "none",
-      role: "worker",
-      ...(slotIndex === undefined ? {} : { slot: slotIndex }),
-      envRoot,
-      writeRoots: [worktreePath, sessionDir],
-      // The workspace root, denied wholesale and then re-granted for this run's
-      // own checkout by the trailing allow in `sandboxProfile`. On `uid-pool`
-      // the modes already do this; on macOS the profile is the only thing that
-      // does, because sandbox-exec does not change the uid.
-      //
-      // `mirrorRoot` is deliberately NOT denied. The run repository borrows its
-      // objects from the mirror through git alternates, so denying it would
-      // break every git command in the checkout — and a run being able to read
-      // another run's objects out of that shared store is the residual this
-      // design accepts and documents, not one it pretends to have closed. The
-      // mirror stays unwritable, because it is not in `writeRoots`.
-      denyReadRoots: [...credentialDenyRoots(), project.workspaceRoot],
-      denyReadFiles: credentialDenyFiles(),
-      ...(credentials.readToken === undefined ? {} : { readToken: credentials.readToken }),
-      // Resolved from the operator's own home at startup, because the session's
-      // redirected $HOME cannot see it (#152). Admission already refused the whole
-      // pass when it is absent, so undefined here is a fleet not dispatching.
-      ...(d.model?.credential === undefined ? {} : { model: d.model.credential }),
-    });
-
-    if (boundary.principal !== undefined) {
-      // Ownership handoff, then proof. `applyRunOwnership` makes the tree
-      // `<slot>:conductor-daemon 2770`, which is also the point of no return:
-      // if this daemon is not an *effective* member of that group it has just
-      // locked itself out of push, salvage and reclaim, and the modes look
-      // perfectly correct while it does. So it writes, reads and removes a
-      // probe file rather than inspecting them (#125).
-      // Both gids come from the probe's own `getent`, never from the daemon's
-      // `egid`. They are different groups: the shipped unit runs
-      // `User=fleet`/`Group=fleet` with `conductor-daemon` merely
-      // supplementary, so `egid` is `fleet` — handing that to
-      // `applyRunOwnership` would make every run repo `<slot>:fleet`, readable
-      // by anyone else in `fleet`, while the probe had validated a group the
-      // modes never used. A uid-pool probe always resolves both, so their
-      // absence here is a contradiction rather than a default to paper over.
-      const { daemonGid, runsGid } = d.boundary?.probe ?? {};
-      if (daemonGid === undefined || runsGid === undefined) {
-        throw new Error(
-          `the credential boundary reported a per-run principal without resolving ` +
-            `${CONDUCTOR_GROUPS.daemon}/${CONDUCTOR_GROUPS.runs} gids — refusing to hand the tree to a group ` +
-            `nobody verified.`,
-        );
-      }
-      applyRunOwnership(worktreePath, boundary.principal, daemonGid);
-      applyRunOwnership(sessionDir, boundary.principal, daemonGid);
-      // The session's own HOME, TMPDIR and gh-config tree.
-      // `prepareSessionEnvRoot` creates them daemon-owned 0700, so without this
-      // the slot principal cannot write its own home and the harness fails at
-      // session startup — which reads like a broken install rather than a
-      // permissions handoff that was one directory short.
-      applyRunOwnership(envRoot, boundary.principal, daemonGid);
-      // The claim, checked rather than assumed. On Linux the principal
-      // separates by DAC alone, so whether the operator's credentials are
-      // actually out of reach depends on modes this package never set. Ask the
-      // slot itself, and refuse the dispatch if the answer is yes.
-      const leaking = await credentialReadRefusal(
-        spawnCaptured,
-        boundary.principal,
-        { boundingSet: d.boundary?.probe.boundingSetDropped ?? false },
-        [...credentialDenyRoots(), ...credentialDenyFiles()],
-      );
-      if (leaking !== undefined) throw new Error(leaking);
-      // The other half of the layout, and it is not optional: the run's git dir
-      // borrows the mirror's objects through `alternates`, so a mirror the slot
-      // principal cannot read makes the checkout look corrupt rather than
-      // forbidden.
-      //
-      // Both trees are checked first, and the check REFUSES rather than
-      // widening the state directory — see `mirrorTraversalRefusal`. A slot
-      // that cannot reach its own checkout is just as broken as one that cannot
-      // read the mirror, and the shipped defaults put both under the private
-      // root.
-      const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
-      for (const tree of [mirrorPath, worktreePath]) {
-        const unreachable = mirrorTraversalRefusal(tree, stateDir());
-        if (unreachable !== undefined) throw new Error(unreachable);
-      }
-      applyMirrorReadAccess(mirrorPath, runsGid);
-      const denied = verifyDaemonAccess(worktreePath);
-      if (denied !== undefined) throw new Error(denied);
-    }
-
-    // An MCP server carrying its own PAT re-opens the hole the principal
-    // closes, so this is a refusal and not a warning. Audited here, after
-    // provisioning, because both roots the harness will discover — the run's
-    // own checkout and the agent principal's config root — exist only now.
-    const mcp = mcpRefusal(
-      auditMcpRoots({ agentHome: boundary.env["HOME"] ?? homedir(), cwd: worktreePath }),
-    );
-    if (mcp !== undefined) throw new Error(mcp);
-
     // ---- the run's mutation channel (#126) -------------------------------
     // A shared, daemon-owned 0711 parent with one 0600 socket per run, never a
     // per-run *directory*: a directory owned by the run principal would hand
@@ -1179,7 +945,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         repo: r.repo,
         runRepoPath: worktreePath,
         branch,
-        ...(boundary.principal === undefined ? {} : { principal: boundary.principal }),
       },
       { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
     );
@@ -1205,13 +970,9 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         caps,
         maxTurns: () => turnLimit?.maxTurns() ?? caps.workerMaxTurns,
         sessionDir,
-        boundary,
-        // Inside the run's own boundary root, so a slot principal can reach it
-        // by traversal. A socket under the daemon's 0700 home would be
-        // unreachable to the very process it exists for (#125).
-        // Derived from the hoisted envRoot for the same reason, and because
-        // that tree has already been handed to the slot principal.
-        socketPath: join(envRoot, "ipc.sock"),
+        // The session's control socket, under the daemon's own state directory —
+        // a child process of the daemon reaches it directly.
+        socketPath: join(sessionDir, "ipc.sock"),
         verbSocketPath: verbListener.path,
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
@@ -1236,14 +997,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       // PR verification or terminal row writes can leave stale `running` state.
       turnLimit?.close();
       turnLimit = undefined;
-      // The slot IS the principal, so holding it past the session means the
-      // next run could be handed the same uid while this one's tree still
-      // exists — two live runs able to write each other's checkout, which is
-      // the cross-run property this whole change buys.
-      if (slotIndex !== undefined) {
-        d.boundary?.slots.release(slotIndex);
-        slotIndex = undefined;
-      }
     }
 
     // A configured model the harness could not honour means this run was done by
@@ -1459,13 +1212,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     turnLimit = undefined;
     const detail = errText(err);
     log(`#${issue} errored: ${detail}`);
-    // Released here as well: a dispatch that failed before `runWorker` never
-    // reached the `finally` above, and a leaked slot permanently shrinks the
-    // pool until the daemon restarts.
-    if (slotIndex !== undefined) {
-      d.boundary?.slots.release(slotIndex);
-      slotIndex = undefined;
-    }
     // A crash lands anywhere, including mid-edit in a tree holding the only
     // copy of real work. Nothing else on this path so much as looks at it.
     const settlement =
@@ -1948,7 +1694,7 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  * that grows a field has no business breaking these tests.
  */
 export async function admitCandidates(
-  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage" | "boundary" | "model">,
+  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage">,
   routed: Routed[],
   slots: number,
 ): Promise<AdmissionPass> {
@@ -1960,73 +1706,6 @@ export async function admitCandidates(
     holds.push({ issue, reason });
   };
 
-  // The fail-closed the issue asks for, and it only ever fires because the
-  // operator asked for a boundary by name. Placed above every other gate,
-  // including the tracker calls: a fleet that must not dispatch must not spend
-  // API budget discovering it, and it must not claim an issue it will refuse.
-  //
-  // Deliberately NOT a downgrade to group-mode. That is a different, weaker
-  // claim, and silently substituting it is how an operator ends up believing
-  // they have a boundary they do not have (#125).
-  if (boundaryRefusesDispatch(d.boundary) && d.boundary !== undefined) {
-    const refusal = boundaryRefusal(d.boundary.probe);
-    for (const r of routed) hold(r.issue.number, "credential-boundary");
-    log(`credential boundary holding ${String(routed.length)} candidate(s): ${refusal}`);
-    if (!d.boundary.paged) {
-      d.boundary.paged = true;
-      await safeEscalate(d, {
-        tier: 2,
-        project: project.name,
-        issue: NO_ISSUE,
-        summary: `${project.name} cannot dispatch: credentials.isolation is "per-run" and this host offers no mechanism`,
-        detail: [refusal, "", "Nothing is dispatched until this is resolved. No work has been claimed."].join("\n"),
-      });
-    }
-    return { admitted: [], holds };
-  }
-
-  // One layer down from the boundary above: that asks whether this host can run a
-  // session as its own principal, this asks whether a session can do anything at
-  // all once started. Every worker on the reference fleet died at turn 0 with
-  // "No model selected" and consumed an issue attempt for it — three issues in
-  // eleven minutes, while the fleet looked busy (#152).
-  //
-  // Above the tracker calls for the same reason as the boundary: a fleet that
-  // cannot dispatch must not claim an issue it will fail, and must not spend API
-  // budget discovering that.
-  if (d.model !== undefined && d.model.credential === undefined) {
-    for (const r of routed) hold(r.issue.number, "no-model-credential");
-    log(`no model credential holding ${String(routed.length)} candidate(s)`);
-    if (!d.model.paged) {
-      d.model.paged = true;
-      await safeEscalate(d, {
-        tier: 2,
-        project: project.name,
-        issue: NO_ISSUE,
-        summary: `${project.name} cannot dispatch: no model credential is reachable from a worker session`,
-        detail: [
-          "Sessions run with $HOME redirected into a per-run tree, so the harness never reads the",
-          "operator's own configuration — that is what keeps a credential-bearing MCP server out of",
-          "every session. It also means a login recorded only in ~/.omp/agent/agent.db is invisible to",
-          "a worker, which then dies at turn 0 with \"No model selected\".",
-          "",
-          "Two supported shapes, either of which fixes it:",
-          "  * a model API key in the daemon's environment (ANTHROPIC_API_KEY, OPENAI_API_KEY, …)",
-          "  * the harness's auth broker — `omp auth-broker serve` plus `omp auth-broker token`, or",
-          "    auth.broker.url / auth.broker.token in ~/.omp/agent/config.yml. Refresh tokens stay in",
-          "    the broker and each session gets a short-lived access token, which is what per-run",
-          "    isolation wants.",
-          "",
-          "Copying agent.db into each run is deliberately NOT how this works: the harness rotates the",
-          "OAuth credentials in it, so a copy goes stale and can invalidate the original.",
-          "",
-          "Nothing is dispatched until then. No work has been claimed, and no attempt was spent.",
-        ].join("\n"),
-      });
-    }
-    return { admitted: [], holds };
-  }
-
   // The plan allowance is a fleet-wide question, so it is asked once per pass
   // and answers for every candidate — unlike every gate below it, which is
   // per-issue. It sits here rather than beside the spend cap in `tick` for one
@@ -2492,20 +2171,6 @@ export interface DaemonHealthSnapshot {
   rssBytes: number;
   dispatch?: DispatchSummary;
   codeGraph?: CodeGraphHealth;
-  /**
-   * The boundary THIS daemon resolved at startup.
-   *
-   * Published because capabilities are a property of the process, not the host:
-   * `omp-conductor status` runs in an interactive shell with none of the unit's
-   * ambient capabilities and no conductor groups, so re-probing there reports
-   * `group-mode` on a fleet that is genuinely `uid-pool`. The operator's
-   * verification step would say the boundary failed while it was working.
-   *
-   * It is also the only answer that survives a `daemon-reload` without a
-   * restart: the config on disk can say anything, this is what the running
-   * process actually got.
-   */
-  boundary?: { isolation: CredentialIsolation; mechanism: IsolationMechanism; headline: string };
 }
 
 export function daemonHealthSnapshot(
@@ -2514,7 +2179,6 @@ export function daemonHealthSnapshot(
   paused = isPaused(),
   rssBytes = process.memoryUsage().rss,
   codeGraph?: CodeGraphHealth,
-  boundary?: DaemonHealthSnapshot["boundary"],
 ): DaemonHealthSnapshot {
   const dispatch = store.latestDispatch(project);
   return {
@@ -2525,7 +2189,6 @@ export function daemonHealthSnapshot(
     rssBytes,
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(codeGraph?.configured === true ? { codeGraph } : {}),
-    ...(boundary === undefined ? {} : { boundary }),
   };
 }
 
@@ -3272,47 +2935,12 @@ export async function reconcileOrphanedRuns(
 // ------------------------------------------------------------------- the daemon
 
 export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
-  // Before anything reads the config for real: a file written before #125 gains
-  // an explicit `credentials.isolation` here, so the answer lives on disk
-  // rather than being inherited from a default nobody chose. Non-fatal by
-  // design — a config the daemon cannot rewrite still loads as `"none"` and
-  // still dispatches, because an outage caused by a security feature is worse
-  // than the day before it shipped.
-  try {
-    const migration = migrateCredentialsOnDisk();
-    if (migration.migrated.length > 0) {
-      log(
-        `migrated ${migration.migrated.join(", ")} to an explicit credentials.isolation: "none" in ` +
-          `${migration.path} — this fleet is UNPROTECTED: sessions run as this daemon's user and can reach ` +
-          `its GitHub credential. Set credentials.isolation to "per-run" once the host is provisioned (README).`,
-      );
-    }
-  } catch (err) {
-    log(`could not persist the credentials migration (${errText(err)}) — continuing with isolation "none"`);
-  }
-
   const cfg = loadConfig();
   const project = findProject(cfg, o.project);
   const caps = resolveCaps(project, cfg.defaults);
   const store = openStore(dbPath());
   const tracker = makeTracker(project);
 
-  // The host capability probe, once, at startup. It states the mechanism
-  // rather than guessing, and it proves the launcher works against a trivial
-  // child before reporting one available — a mechanism whose argv the host
-  // rejects looks identical here and then fails every dispatch at run time.
-  const credentials = resolveCredentials(project);
-  const probe = await probeHost({ slots: caps.maxConcurrentWorkers });
-  const boundary: FleetBoundary = {
-    isolation: credentials.isolation,
-    probe,
-    slots: createSlotPool(caps.maxConcurrentWorkers),
-    paged: false,
-  };
-  const described = describeBoundary(credentials.isolation, probe);
-  log(`credential boundary: ${described.headline}`);
-  for (const line of described.detail) log(`credential boundary: ${line}`);
-
   // #126's transport, stated at startup rather than guessed at first use. The
   // banner names what this host can actually enforce — whether the kernel will
   // vouch for a caller's uid, and whether runs get distinct principals at all —
@@ -3321,13 +2949,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   const verbPeerReader = peerCredentialReader();
   const verbActions = githubVerbActions(project);
   let orchestratorVerbs: VerbListener | undefined;
-  log(
-    `verb transport: ${transportBanner(
-      ensureVerbSocketDir(stateDir()),
-      verbPeerReader,
-      probe.mechanism === "uid-pool",
-    )}`,
-  );
+  log(`verb transport: ${transportBanner(ensureVerbSocketDir(stateDir()), verbPeerReader)}`);
 
   // Recorded here, before a single tick runs, so that the deploy an operator
   // *means* to do never trips the tripwire: installing a new build and
@@ -3335,19 +2957,6 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // the other thing — the package changing while the daemon that dispatches
   // work is holding it open, whether that is a worker that wandered out of its
   // worktree or a human editing the live install "just to test something".
-  // Resolved once, here, for the same reason the host probe above is: every
-  // session of every tick must agree, and a fleet with no way to authenticate a
-  // model must refuse at admission rather than burn an attempt per dispatch
-  // (#152).
-  const model: { credential?: ModelCredential; paged: boolean } = { paged: false };
-  const resolvedModel = resolveModelCredential();
-  if (resolvedModel !== undefined) model.credential = resolvedModel;
-  log(
-    resolvedModel === undefined
-      ? "model credential: NONE reachable from a session — dispatch is held until an API key or an auth broker is configured"
-      : `model credential: ${resolvedModel.kind === "env" ? "from this daemon's environment" : "auth broker, injected per session"}`,
-  );
-
   const integrity: IntegrityGate = { baseline: packageManifest(), paged: false };
   log(`package integrity baseline: ${integrity.baseline.size} files under ${import.meta.dir}`);
 
@@ -3427,64 +3036,12 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     log("orchestrator: external — tier-1 escalations post as issue comments for the external session's drain duty");
   } else {
     try {
-      // Its own principal, distinct from every worker slot. The orchestrator
-      // reads the state directory and its briefs and must have no read or
-      // write access to any run checkout — so `workspaceRoot` and the mirror
-      // are denied outright here. This is the ONLY mechanical file gate an
-      // orchestrator gets: the tool-layer jail was deleted in 0.4.3 (#143)
-      // because it could only be installed in sessions this daemon spawns, and
-      // the principal refuses the syscall `bash` would make anyway, which the
-      // jail never did. It is also conditional, and honestly so: on a host with
-      // no isolating mechanism there is no principal and no gate, which is what
-      // `status` reports as `unprotected`.
-      // Same rule as a worker's, for the same reason: under `uid-pool` the
-      // orchestrator is its own uid, so every tree it must reach lives outside
-      // the 0700 private state directory. Its principal is in `conductor-runs`
-      // and deliberately NOT in the daemon group, so it could not traverse
-      // there even once — and widening the state directory is the one fix that
-      // is not available, because that is where conductor.db lives.
-      const orchTreeRoot = probe.mechanism === "uid-pool" ? sharedRoot() : stateDir();
-      if (orchTreeRoot !== stateDir()) {
-        mkdirSync(orchTreeRoot, { recursive: true });
-        chmodSync(orchTreeRoot, 0o711);
-      }
-      const orchEnvRoot = join(orchTreeRoot, "boundaries", "orchestrator");
+      // The orchestrator is a child process of this daemon running as its own
+      // user. Nothing mechanically stops it reading a run checkout — what holds
+      // it is its brief and the verb ledger (#143).
+      const orchTreeRoot = stateDir();
       const orchCwd = join(orchTreeRoot, "orchestrator");
       mkdirSync(orchCwd, { recursive: true });
-      const orchestratorBoundary = buildSessionBoundary({
-        probe,
-        isolation: credentials.isolation,
-        role: "orchestrator",
-        envRoot: orchEnvRoot,
-        writeRoots: [orchCwd],
-        denyReadRoots: [...credentialDenyRoots(), project.workspaceRoot, project.mirrorRoot],
-        denyReadFiles: credentialDenyFiles(),
-        ...(credentials.readToken === undefined ? {} : { readToken: credentials.readToken }),
-        ...(model.credential === undefined ? {} : { model: model.credential }),
-      });
-      if (orchestratorBoundary.principal !== undefined) {
-        const gid = probe.daemonGid;
-        if (gid === undefined) {
-          throw new Error(
-            `the orchestrator principal was allocated without a resolved ${CONDUCTOR_GROUPS.daemon} gid`,
-          );
-        }
-        applyRunOwnership(orchEnvRoot, orchestratorBoundary.principal, gid);
-        applyRunOwnership(orchCwd, orchestratorBoundary.principal, gid);
-        // The same empirical gate a worker gets. The orchestrator is the
-        // session with merge and release authority, so "it cannot reach the
-        // credential" matters more here, not less — and it was the half that
-        // was never checked. `sharedGroup: false` because it is launched with
-        // no supplementary group at all, so the probe has to run under exactly
-        // that identity rather than a worker's.
-        const orchLeaking = await credentialReadRefusal(
-          spawnCaptured,
-          orchestratorBoundary.principal,
-          { boundingSet: probe.boundingSetDropped, sharedGroup: false },
-          [...credentialDenyRoots(), ...credentialDenyFiles()],
-        );
-        if (orchLeaking !== undefined) throw new Error(orchLeaking);
-      }
       // A third socket, distinct from every run's, in the same daemon-owned
       // 0711 parent. This is what makes "merge authority is the orchestrator's"
       // a property of the channel: the daemon knows which session is speaking
@@ -3497,9 +3054,6 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
           path: verbSocketPath(ensureVerbSocketDir(orchTreeRoot), "orchestrator"),
           project: project.name,
           role: "orchestrator",
-          ...(orchestratorBoundary.principal === undefined
-            ? {}
-            : { principal: orchestratorBoundary.principal }),
         },
         { ...(verbPeerReader === undefined ? {} : { peerReader: verbPeerReader }) },
       );
@@ -3507,8 +3061,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         cwd: orchCwd,
         brief,
         releaseGrants,
-        boundary: orchestratorBoundary,
-        socketPath: join(orchEnvRoot, "ipc.sock"),
+        socketPath: join(orchCwd, "ipc.sock"),
         verbSocketPath: orchestratorVerbs.path,
         onChildLog: (line) => {
           log(`orchestrator ${line}`);
@@ -3561,8 +3114,6 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   const d: Deps = {
     project,
     caps,
-    boundary,
-    model,
     tracker,
     store,
     // Process-wide, so a `status` served off this daemon's own HTTP surface
@@ -3669,12 +3220,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         project: project.name,
         store,
         turnLimits,
-        health: () =>
-          daemonHealthSnapshot(store, project.name, undefined, undefined, codeGraph, {
-            isolation: boundary.isolation,
-            mechanism: boundary.probe.mechanism,
-            headline: describeBoundary(boundary.isolation, boundary.probe).headline,
-          }),
+        health: () => daemonHealthSnapshot(store, project.name, undefined, undefined, codeGraph),
       }),
   });
   log(`serving /healthz on :${server.port}, project ${project.name}`);