omp-conductor 0.4.5 → 0.5.0

package/src/setup-host.ts

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
-import { configPath, resolveCredentials, sharedRoot, stateDir } from "./config.ts";
+import { configPath, stateDir } from "./config.ts";
 import { isPaused, runDaemon, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
 import { DEFAULT_FLEET_AGENT_NAME } from "./fleet.ts";
 import {
@@ -18,7 +18,7 @@ import {
   TICK_CONFIG_FILE,
   type TickConfig,
 } from "./orchestrator-tick.ts";
-import { CONDUCTOR_GROUPS, type Caps, type ProjectConfig } from "./types.ts";
+import type { Caps, ProjectConfig } from "./types.ts";
 
 export const DEFAULT_TICK_INTERVAL_SECONDS = 900;
 export const STAGED_SERVICE_NAME = "omp-conductor.service";
@@ -110,39 +110,6 @@ export function renderDaemonService(
     `Environment=${systemdQuote(`PATH=${runtime.path}`)}`,
     `Environment=${systemdQuote(`OMP_CONDUCTOR_HOME=${runtime.conductorHome}`)}`,
     `Environment=${systemdQuote(`OMP_TELEGRAM_STATE_DIR=${runtime.telegramStateDir}`)}`,
-    // Both of these are per-run only, and grouped so the managed set stays one
-    // idea. The shared root is baked in so a custom location survives systemd's
-    // clean environment — without it the daemon resolves the platform default
-    // while the operator provisioned somewhere else, and every dispatch is
-    // refused for a path nobody chose. It is meaningless under `none`, where
-    // nothing resolves it, and rendering it there would make every unit
-    // installed before 0.4.0 look drifted for no reason (#125).
-    //
-    // The capabilities exist to be DROPPED INTO run children by the
-    // privilege-dropping launcher, never inherited by them — see `setprivArgv`.
-    // Rendered only for `per-run`, because that is the only isolation that
-    // changes uid; granting them to a fleet that does not need them widens the
-    // daemon for nothing. Without them the probe honestly reports `group-mode`
-    // and a configured per-run fleet refuses every dispatch, which is the
-    // failure an operator following setup would otherwise hit first.
-    //
-    // `SupplementaryGroups=` is declared rather than left to initgroups, and that
-    // is not belt-and-braces. Supplementary groups are fixed when a process
-    // starts, so a daemon that was running when the accounts were provisioned can
-    // never join them — and a unit with no `User=` gets no initgroups call at
-    // all, so it comes up with `Groups: 0` even after the group database is
-    // correct. `probeHost` then reports `none` forever, the wizard cannot offer
-    // `uid-pool`, and the fleet quietly keeps the fail-closed value (#153).
-    // Declaring the membership makes it a property of the unit instead of a
-    // property of how the unit happened to be written.
-    ...(resolveCredentials(project).isolation === "per-run"
-      ? [
-          `Environment=${systemdQuote(`OMP_CONDUCTOR_SHARED=${sharedRoot()}`)}`,
-          `SupplementaryGroups=${CONDUCTOR_GROUPS.daemon} ${CONDUCTOR_GROUPS.runs}`,
-          "AmbientCapabilities=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
-          "CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP",
-        ]
-      : []),
     `WorkingDirectory=${systemdQuote(stateDir())}`,
     `ExecStart=${command.map(systemdQuote).join(" ")}`,
     "Restart=on-failure",
@@ -321,160 +288,3 @@ export async function runSetupSmoke(
 export function installedUnitPath(): string {
   return join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME);
 }
-
-/**
- * Why the *live* systemd unit no longer matches what this version would render.
- *
- * `planHostRuntime` compares against the **staged** copy under the state dir,
- * which says nothing about the file systemd booted from. That gap is not
- * cosmetic since 0.4.0: a fleet configured `per-run` whose installed unit
- * predates the capability grant probes down to `group-mode` and then refuses
- * every dispatch — and `upgrade` would happily verify package identities,
- * services, pane and ticks around it, because none of those look at the unit.
- *
- * Checked by directive rather than by whole-file equality on purpose. An
- * operator is entitled to hand-tune `MemoryMax`, add `After=`, or set an
- * `Environment=` of their own, and failing an upgrade over that would teach
- * them to stop running upgrades. What is reported is the set of directives this
- * configuration *requires* and the live unit lacks.
- *
- * `undefined` means either "no drift that matters" or "no installed unit at
- * all" — a host running `omp-conductor start` without systemd is not broken,
- * and must not be told it is.
- */
-/**
- * What systemd has actually loaded for the unit, as `systemctl show` reports it.
- *
- * Deliberately not the file on disk. A unit installed without `daemon-reload`
- * can match the rendered text byte for byte while the manager still runs the
- * previous configuration, and a drop-in under `…service.d/` changes what runs
- * without touching the file at all. Both read clean from the filesystem.
- */
-export interface EffectiveUnit {
-  /** `systemctl show -p AmbientCapabilities`; empty string when unset. */
-  ambientCapabilities: string;
-  capabilityBoundingSet: string;
-  /** `systemctl show -p SupplementaryGroups`; empty string when unset. */
-  supplementaryGroups: string;
-  /** `systemctl show -p Environment`, newline- or space-joined. */
-  environment: string;
-  needDaemonReload: boolean;
-}
-
-/** Whitespace-separated names as a comparable set; systemd reorders them. */
-function nameSet(text: string): Set<string> {
-  return new Set(text.split(/[\s,]+/).map((n) => n.trim()).filter((n) => n.length > 0));
-}
-
-/** Capability names as a comparable set: systemd reports them lowercased, `cap_`-prefixed and reordered. */
-function capabilitySet(text: string): Set<string> {
-  return new Set(
-    text
-      .split(/[\s,]+/)
-      .map((name) => name.trim().toLowerCase().replace(/^cap_/, ""))
-      .filter((name) => name.length > 0),
-  );
-}
-
-function renderedDirective(rendered: string, key: string): string | undefined {
-  for (const line of rendered.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith(`${key}=`)) return trimmed.slice(key.length + 1);
-  }
-  return undefined;
-}
-
-/**
- * Why what systemd loaded no longer matches what this version would render.
- *
- * Three asymmetries, each for a reason:
- *
- * - **Ambient capabilities are compared exactly, both ways.** Missing them
- *   breaks a per-run fleet; *leftover* ones are worse. Roll back to `none` and
- *   there is no `setpriv` launcher at all, so ambient capabilities on the unit
- *   are inherited straight into model-executed code, which can then `setuid()`
- *   to any account. `systemctl` reports an empty string when unset, so the
- *   rollback case is unambiguous.
- * - **The bounding set is checked only when this version sets it.** systemd
- *   reports the full default set when a unit does not, so comparing both ways
- *   would flag every ordinary host.
- * - **Only directives this configuration manages are considered**, so an
- *   operator's own `MemoryMax`, `After=` or drop-in never fails an upgrade.
- */
-export function unitDriftReason(rendered: string, effective: EffectiveUnit | undefined): string | undefined {
-  if (effective === undefined) return undefined;
-  const problems: string[] = [];
-
-  // Missing groups only, never extra: an operator may legitimately add their own,
-  // and unlike a leftover capability a spare group grants nothing this package
-  // relies on. Missing ones are load-bearing — without them the probe resolves to
-  // `none` and a configured per-run fleet refuses every dispatch (#153).
-  const wantGroups = nameSet(renderedDirective(rendered, "SupplementaryGroups") ?? "");
-  const haveGroups = nameSet(effective.supplementaryGroups);
-  const missingGroups = [...wantGroups].filter((g) => !haveGroups.has(g));
-  if (missingGroups.length > 0) {
-    problems.push(
-      `SupplementaryGroups is missing ${missingGroups.join(", ")} — supplementary groups are fixed at ` +
-        `process start, so the running daemon cannot be a member and the credential boundary probe ` +
-        `resolves to none until the unit is reloaded and the service restarted`,
-    );
-  }
-
-  const wantAmbient = capabilitySet(renderedDirective(rendered, "AmbientCapabilities") ?? "");
-  const haveAmbient = capabilitySet(effective.ambientCapabilities);
-  const missingAmbient = [...wantAmbient].filter((c) => !haveAmbient.has(c));
-  const extraAmbient = [...haveAmbient].filter((c) => !wantAmbient.has(c));
-  if (missingAmbient.length > 0) {
-    problems.push(`AmbientCapabilities is missing ${missingAmbient.join(", ")}`);
-  }
-  if (extraAmbient.length > 0) {
-    problems.push(
-      `AmbientCapabilities grants ${extraAmbient.join(", ")} that this configuration does not — with ` +
-        `isolation off there is no privilege-dropping launcher, so these are inherited by model-executed code`,
-    );
-  }
-
-  const wantBounding = renderedDirective(rendered, "CapabilityBoundingSet");
-  if (wantBounding !== undefined) {
-    const missing = [...capabilitySet(wantBounding)].filter(
-      (c) => !capabilitySet(effective.capabilityBoundingSet).has(c),
-    );
-    if (missing.length > 0) problems.push(`CapabilityBoundingSet is missing ${missing.join(", ")}`);
-  }
-
-  const wantShared = rendered
-    .split("\n")
-    .map((l) => l.trim())
-    .find((l) => l.includes("OMP_CONDUCTOR_SHARED="));
-  if (wantShared !== undefined) {
-    const value = wantShared.slice(wantShared.indexOf("OMP_CONDUCTOR_SHARED=")).replace(/"$/, "");
-    if (!effective.environment.includes(value)) {
-      problems.push(`Environment is missing ${value}`);
-    }
-  }
-
-  if (effective.needDaemonReload) {
-    problems.push("systemd reports the unit needs a daemon-reload, so what runs is not what is on disk");
-  }
-
-  if (problems.length === 0) return undefined;
-  return (
-    `what systemd loaded for ${STAGED_SERVICE_NAME} does not match this configuration: ${problems.join("; ")}.`
-  );
-}
-
-/** Parse `systemctl show -p …` key=value output into an {@link EffectiveUnit}. */
-export function parseEffectiveUnit(stdout: string): EffectiveUnit {
-  const values = new Map<string, string>();
-  for (const line of stdout.split("\n")) {
-    const at = line.indexOf("=");
-    if (at > 0) values.set(line.slice(0, at).trim(), line.slice(at + 1).trim());
-  }
-  return {
-    ambientCapabilities: values.get("AmbientCapabilities") ?? "",
-    capabilityBoundingSet: values.get("CapabilityBoundingSet") ?? "",
-    supplementaryGroups: values.get("SupplementaryGroups") ?? "",
-    environment: values.get("Environment") ?? "",
-    needDaemonReload: (values.get("NeedDaemonReload") ?? "no") === "yes",
-  };
-}

package/src/setup.ts

@@ -35,11 +35,11 @@ import {
 import {
   clonePolicy,
   configPath,
+  defaultMirrorRoot,
+  defaultWorkspaceRoot,
   resolveCaps,
-  resolveCredentials,
   resolvePolicy,
   resolveReleaseGrants,
-  projectTreeBase,
   stateDir,
 } from "./config.ts";
 import { graphProjectPath, graphRepos } from "./graph.ts";
@@ -51,8 +51,6 @@ import {
   DEFAULT_REPORT_SCOPE,
   DENIED_RELEASE_GRANTS,
   RELEASE_SHAPES,
-  type CredentialConfig,
-  type CredentialIsolation,
   type BaseFreshness,
   type BehindBaseAction,
   type Caps,
@@ -103,13 +101,6 @@ export interface SetupAnswers {
    * leave one to be defaulted by whichever reader gets there first.
    */
   policy: ProjectPolicy;
-  /**
-   * Whether model-executed code runs under its own OS principal (#125). The
-   * wizard offers `per-run` only when the host probe says this box can build
-   * the boundary, because an answer the host cannot honour is a fleet that
-   * refuses to dispatch rather than a fleet that is protected.
-   */
-  credentials: CredentialConfig;
   /**
    * Whether to render `ORCHESTRATOR.md` into the project's workspace root. Not
    * part of the config — the brief is the operator's file, and the conductor
@@ -174,13 +165,6 @@ export const SETUP_DEFAULTS = {
   releaseGrants: DENIED_RELEASE_GRANTS,
   /** The strictest reading of the prose these conditions replaced (#129). */
   policy: DEFAULT_PROJECT_POLICY,
-  /**
-   * No boundary until an operator asks for one on a host that can build it.
-   * `none` is the honest default rather than the safe-sounding one: writing
-   * `per-run` into a fresh config on a box with no mechanism would produce a
-   * conductor that installs cleanly and then declines every issue (#125).
-   */
-  credentials: { isolation: "none" } as CredentialConfig,
   /** The daemon runs its own triage session unless an operator already runs one. */
   orchestratorMode: "embedded",
 } as const;
@@ -520,11 +504,6 @@ export async function createMissingLabels(trackerRepo: string, plan: LabelPlan[]
  * with {@link answersFromProject} — the pair an amend's carry-through rests on.
  */
 export function buildProject(a: SetupAnswers): ProjectConfig {
-  // Under a per-run boundary the worktrees and mirrors have to sit where a slot
-  // principal can actually traverse to them. Defaulting them under the 0700
-  // state directory would provision a repository and then be refused at
-  // dispatch, which looks like a broken install rather than a layout choice.
-  const dir = projectTreeBase(a.credentials.isolation);
 
   const repos: Record<string, RepoTarget> = {};
   const graphRoot = a.graphRoot?.trim();
@@ -580,14 +559,13 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // Written out in full for the same reason: the file then says what a merge
     // and a release require without anyone having to know a default (#129).
     policy: clonePolicy(a.policy),
-    // Written out even when it is the default, so `status` reporting the fleet
-    // unprotected always has a line in the file to point at (#125).
-    credentials: { ...a.credentials },
+    // Written out even when it is the default, so an operator amending the
+    // volume has a line in the file to point at.
     reporting: { scope: a.reportScope },
     // Both under the state dir so one `rm -rf ~/.omp/conductor` is a complete
     // uninstall, and neither can land in a repo the daemon then tries to commit.
-    workspaceRoot: join(dir, "worktrees"),
-    mirrorRoot: join(dir, "mirrors"),
+    workspaceRoot: defaultWorkspaceRoot(),
+    mirrorRoot: defaultMirrorRoot(),
   };
 }
 
@@ -641,7 +619,6 @@ export function defaultAnswers(projectName: string): SetupAnswers {
     authority: { ...SETUP_DEFAULTS.authority },
     releaseGrants: { ...SETUP_DEFAULTS.releaseGrants },
     policy: clonePolicy(SETUP_DEFAULTS.policy),
-    credentials: { ...SETUP_DEFAULTS.credentials },
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
     reportScope: SETUP_DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -689,7 +666,6 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     authority: { ...p.authority },
     releaseGrants: resolveReleaseGrants(p),
     policy: resolvePolicy(p),
-    credentials: resolveCredentials(p),
     orchestratorMode: p.escalation.orchestrator,
     reportScope: p.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -808,46 +784,6 @@ export function renderOrchestratorBrief(a: SetupAnswers): string {
  * that dialog's answer un-actionable — an operator who says "yes, overwrite it"
  * must get an overwrite.
  */
-/**
- * Carry a fleet's own `POLICY.md` to a workspace root that just moved.
- *
- * `workspaceRoot` is derived from `credentials.isolation`: `none` puts it under
- * the 0700 state directory, `per-run` under the shared root a slot principal can
- * traverse. So switching a fleet to worker isolation *relocates* the briefs, and
- * the operator's half must go with them.
- *
- * Without this, amending isolation on an external-orchestrator fleet was a
- * deadlock with a data-loss escape hatch. The setup gate refused because neither
- * file existed at the new root; the only way past it was approving a brief write
- * in the same pass, and {@link writeOrchestratorBrief} renders a *fresh* POLICY.md
- * scaffold — silently replacing the operator's release procedure and amendment
- * log, and orphaning the real one at the old root.
- *
- * `ORCHESTRATOR.md` is recomposed rather than copied, because it is derived from
- * the package floor plus that policy on every tick anyway. The source is left in
- * place: this package does not delete an operator's file, and a stale copy under
- * the old root is inert once nothing reads it.
- *
- * Returns the moved path, or undefined when nothing needed moving — the roots
- * match, there was no policy to carry, or the destination already has one.
- */
-export function relocateBriefIfMoved(
-  previous: ProjectConfig | undefined,
-  next: ProjectConfig,
-): { from: string; to: string } | undefined {
-  if (previous === undefined) return undefined;
-  if (previous.workspaceRoot === next.workspaceRoot) return undefined;
-  const from = policyPathForProject(previous);
-  const to = policyPathForProject(next);
-  if (!existsSync(from) || existsSync(to)) return undefined;
-
-  const policy = readFileSync(from, "utf8");
-  mkdirSync(dirname(to), { recursive: true });
-  writeFileSync(to, policy);
-  writeFileSync(briefPathForProject(next), composeOrchestrator(renderFloorForProject(next), policy));
-  return { from, to };
-}
-
 export function writeOrchestratorBrief(a: SetupAnswers): string {
   const project = buildProject(a);
   const policyPath = policyPathForProject(project);
@@ -1177,7 +1113,6 @@ export const AMEND_AREA_IDS = [
   "graph",
   "authority",
   "policy",
-  "credentials",
   "escalation",
   "reporting",
   "brief",
@@ -1283,16 +1218,6 @@ export const AMEND_AREAS: {
       );
     },
   },
-  credentials: {
-    name: "credential isolation",
-    asks: "whether worker and orchestrator sessions run under their own OS principal, or as the daemon's own user",
-    describe: (p) => {
-      const c = resolveCredentials(p);
-      return c.isolation === "per-run"
-        ? `per-run principals${c.readToken === undefined ? "" : ", with a read-scoped token"}`
-        : "none — sessions run as the daemon's user and can reach its credentials";
-    },
-  },
   escalation: {
     name: "escalation & triage",
     asks: "the tier-2 Telegram chat, whether escalations also comment, and where the orchestrator session lives",

package/src/store.ts

@@ -15,6 +15,7 @@ import { dirname, join } from "node:path";
 
 import { stateDir } from "./config.ts";
 import { DECISION_TTL_MS, DEFAULT_CAPS } from "./types.ts";
+import { startFailure } from "./failure-class.ts";
 import type {
   DecisionDraft,
   FailureClass,
@@ -678,6 +679,39 @@ export function openStore(dbPath: string): Store {
     }
   }
 
+  // One-time repair, and the reason it lives here rather than in the classifier:
+  // a turn-0 environment fault that was ALREADY classified `unknown` and
+  // escalated is never revisited. `runsNeedingClassification` only offers a row
+  // whose class is NULL, or one whose recovery has not run yet — an
+  // `unknown`/`escalate` row with `recoveredAt` set satisfies neither, so no
+  // upgrade and no later tick would ever correct it.
+  //
+  // That mattered on a real fleet. The per-run `$HOME` redirect this release
+  // deletes hid the harness's own credentials, so every dispatch died before it
+  // read its issue and each one still spent an implementation attempt. Deleting
+  // the redirect stops the bleeding; it does not give back attempts already
+  // charged, and an issue sitting at its cap for a fault that was never in its
+  // code stays undispatchable forever.
+  //
+  // Narrow by construction: `turns = 0` (the session never took a turn), an
+  // error the classifier itself recognises as a start failure, and a class of
+  // exactly `unknown` — a row a human or a later release classified as anything
+  // else is left alone. Idempotent for free: afterwards those rows read
+  // `env-start-failure`, which the WHERE no longer matches.
+  const misread = db
+    .query<
+      { id: string; lastError: string | null },
+      []
+    >(`SELECT id, lastError FROM runs WHERE failureClass = 'unknown' AND turns = 0 AND lastError IS NOT NULL`)
+    .all()
+    .filter((row) => startFailure(row.lastError ?? undefined) !== undefined);
+  if (misread.length > 0) {
+    const reclassify = db.query<unknown, [string]>(
+      `UPDATE runs SET failureClass = 'env-start-failure' WHERE id = ?`,
+    );
+    for (const row of misread) reclassify.run(row.id);
+  }
+
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,

package/src/tracker/github.ts

@@ -21,7 +21,7 @@
  * `gh auth token`; the eleven Tracker methods above it stay untouched.
  */
 
-import { credentialedEnv } from "../credentials.ts";
+import { credentialedEnv } from "../gitops.ts";
 import { parsePrDiff } from "../diff-flags.ts";
 import type {
   IssueState,

package/src/types.ts

@@ -457,76 +457,6 @@ export type ReleaseJustification = VerbJustification<ReleaseReason>;
 
 export type LabelJustification = VerbJustification<LabelReason>;
 
-/**
- * How hard a boundary separates model-executed code from the operator's GitHub
- * write credential (#125).
- *
- * Three values, ordered strongest first, because the difference between them is
- * a difference in what anyone can honestly claim:
- *
- * - `per-run` — every session runs as its own OS principal that cannot read the
- *   daemon's `gh` config, keychain, `~/.ssh` or `~/.npmrc`, and cannot write a
- *   sibling run's checkout. Satisfied **only** by the `uid-pool` and
- *   `sandbox-exec` mechanisms.
- * - `group-mode` — same uid as the daemon, cross-run separation by group and
- *   mode only. It bounds accidents and does **not** contain a determined bash
- *   escape. It exists as a config value rather than as a fallback so that an
- *   operator who takes it has said the weaker sentence out loud: a `per-run`
- *   request that quietly resolved to this would let somebody believe they had
- *   configured the full boundary and shipped the lesser one, which is precisely
- *   the "never the silent default" failure #125 exists to end.
- * - `none` — the session runs as the daemon's own user and the env scrubbing in
- *   `credentials.ts` is *all* that stands between the model and the credential,
- *   which same-uid code defeats in one line.
- *
- * A request is never downgraded. If the host cannot build what was asked for,
- * dispatch refuses and names the missing mechanism.
- */
-export const CREDENTIAL_ISOLATIONS = ["per-run", "group-mode", "none"] as const;
-
-export type CredentialIsolation = (typeof CREDENTIAL_ISOLATIONS)[number];
-
-/**
- * What the host can actually enforce, decided by the startup probe rather than
- * by config. Kept separate from {@link CREDENTIAL_ISOLATIONS} on purpose: the
- * operator asks for a boundary, the host says which one it can build, and
- * `status` reports the difference instead of letting either side guess.
- *
- * - `uid-pool` — one unprivileged account per run slot, entered through a
- *   privilege-dropping launcher. The only mechanism that claims to contain a
- *   determined bash escape on Linux.
- * - `group-mode` — same uid as the daemon, cross-run separation by group and
- *   mode only. Bounds accidents, does **not** contain an escape.
- * - `sandbox-exec` — the macOS equivalent of `uid-pool` for a dev host.
- * - `none` — no boundary at all.
- */
-export const ISOLATION_MECHANISMS = ["uid-pool", "group-mode", "sandbox-exec", "none"] as const;
-
-export type IsolationMechanism = (typeof ISOLATION_MECHANISMS)[number];
-
-/**
- * The two groups the filesystem model needs, named once so the probe, the
- * provisioning docs and the adversarial tests cannot drift apart (#125).
- *
- * `daemon` holds the daemon account **only** and is what lets it fetch, salvage
- * and reclaim every run repo. `runs` holds every slot principal and grants
- * read-only access to the shared mirror. A slot principal in `daemon` would
- * void the whole cross-run boundary, so the probe asserts the absence.
- */
-export const CONDUCTOR_GROUPS = { daemon: "conductor-daemon", runs: "conductor-runs" } as const;
-
-/** Per-project credential boundary settings. See {@link CREDENTIAL_ISOLATIONS}. */
-export interface CredentialConfig {
-  isolation: CredentialIsolation;
-  /**
-   * Optional **read-scoped** token handed to sessions so they can look things
-   * up on GitHub. Absent is the default and the safe reading: a worker then
-   * works from its dispatch brief and the daemon's mediated verbs, which is
-   * why the brief must not tell it to run `gh pr view`.
-   */
-  readToken?: string;
-}
-
 /**
  * Where the session that triages escalations lives. `embedded` is the daemon's
  * own child session; `external` means an operator already runs one — a visible
@@ -601,16 +531,6 @@ export interface ProjectConfig {
    * `resolveReportScope` rather than reaching for `.scope` directly.
    */
   reporting?: { scope: ReportScope };
-  /**
-   * The credential boundary this project's sessions run behind (#125).
-   *
-   * Optional only on disk, and only for one release: a config written before
-   * this key existed is migrated to an explicit `{ isolation: "none" }` and
-   * rewritten, so the operator ends up with the answer in the file rather than
-   * inheriting a silent default. Never read directly — go through
-   * `resolveCredentials`, which is where that migration is spelled once.
-   */
-  credentials?: CredentialConfig;
   /** Parent directory for per-run worktrees. */
   workspaceRoot: string;
   /** Cache of bare clones, so N runs share one fetch instead of N. */
@@ -1001,16 +921,6 @@ export type AdmissionHoldReason =
   | "unsalvaged-wip"
   | "daily-spend-cap"
   | "plan-usage-cap"
-  /** `credentials.isolation: "per-run"` on a host whose probe found no
-   *  mechanism. The operator asked for a boundary this host cannot build, so
-   *  dispatch refuses rather than running unprotected under a config that says
-   *  otherwise (#125). */
-  | "credential-boundary"
-  /** No model credential is reachable from a session's redirected `$HOME`, so
-   *  every worker would die at turn 0 with "No model selected" and spend an issue
-   *  attempt doing it (#152). Held rather than dispatched: an environment fault
-   *  is not a failed implementation. */
-  | "no-model-credential"
   | "unroutable:no-repo-label"
   | "unroutable:multiple-repo-labels"
   | "unroutable:unknown-repo";