omp-conductor 0.4.5 → 0.5.1

package/README.md

@@ -149,25 +149,26 @@ be present. If you run omp, it is.
 Also required on the host:
 
 - `bun`: the CLI and the daemon run on it (`Bun.serve` backs `/healthz`).
-- **A model credential a *session* can reach.** Sessions run with `$HOME`
-  redirected into a per-run tree, so the harness never reads the operator's own
-  configuration — that is what keeps a credential-bearing MCP server out of every
-  session. It also means a login recorded only in `~/.omp/agent/agent.db` is
-  invisible to a worker, which then dies at turn 0 with `No model selected`. Two
-  supported shapes:
-  - a model API key in the **daemon's** environment (`ANTHROPIC_API_KEY`,
-    `OPENAI_API_KEY`, …); these are deliberately not scrubbed, unlike the GitHub
-    and npm keys.
-  - the harness's **auth broker** — `omp auth-broker serve` plus `omp auth-broker
-    token`, or `auth.broker.url` / `auth.broker.token` in
-    `~/.omp/agent/config.yml`. The conductor resolves that connection and injects
-    it into each session. Refresh tokens stay in the broker and a session receives
-    only short-lived access tokens, which is exactly what per-run isolation wants.
-
-  With neither, `omp-conductor status` reports the hold and **nothing is
-  dispatched** — no issue is claimed and no attempt is spent. Copying `agent.db`
-  into each run is deliberately not how this works: the harness rotates the OAuth
-  credentials in it, so a copy goes stale and can invalidate the original.
+- **A model credential the *daemon's own account* can reach.** Sessions are child
+  processes of the daemon and inherit its environment and `$HOME` unmodified, so a
+  session authenticates with exactly what the daemon authenticates with — nothing
+  is injected and nothing is scrubbed. Any shape the harness itself understands
+  works, including the ordinary one:
+  - an **OAuth login** already recorded for that account (`omp` login state under
+    its `~/.omp/agent`). This is the common case and needs no configuration.
+  - a model **API key** in the daemon's environment (`ANTHROPIC_API_KEY`,
+    `OPENAI_API_KEY`, …). Note systemd starts the service with a clean
+    environment, so it has to be an `Environment=` line on the unit, not something
+    exported in your shell.
+  - the harness's **auth broker**, configured in that account's
+    `~/.omp/agent/config.yml`.
+
+  The account matters more than the shape: a login recorded under a *different*
+  account is invisible to the service. A unit running `User=fleet` cannot see
+  `root`'s login, and workers then die at turn 0 with `No model selected`. Such a
+  run is classified `env-start-failure` and charges **neither** the failure budget
+  nor a continuation — an environment fault is not a failed implementation — but
+  nothing dispatches successfully until the credential is reachable.
 - `gh`, already authenticated: every tracker operation shells out to it, so the
   daemon never handles a GitHub token itself.
 - `git`: mirrors and worktrees.
@@ -889,10 +890,12 @@ bad merge.
 
 ## Host sizing and memory
 
-Workers are **in-process** omp sessions inside the daemon's single PID (plus one
-long-lived orchestrator session). systemd's Memory peak for `omp-conductor.service`
-is therefore daemon + every live worker + the orchestrator + any MCP stdio
-children those sessions mount — not a separate worker process list.
+Workers are **child processes** of the daemon (plus one long-lived orchestrator
+session), each its own pid, talking back over a unix socket. They are still
+inside the service's cgroup, so systemd's Memory peak for
+`omp-conductor.service` is daemon + every live worker + the orchestrator + any
+MCP stdio children those sessions mount. `MemoryMax=` governs that whole total,
+not one process.
 
 On the reference deploy that produced [issue #51](https://github.com/TerrifiedBug/conductor/issues/51):
 
@@ -929,7 +932,7 @@ rest. `0` is a real value (a hard stop), not "unset".
 
 | Cap | Default | What it protects |
 | --- | --- | --- |
-| `maxConcurrentWorkers` | `2` (setup may write `1` on <16 GiB hosts) | Parallel in-process omp sessions inside the daemon PID. Two, because **CI runner slots, not model tokens, are the usual throughput ceiling** — a third worker would starve its own PR checks on a small self-hosted runner pool. On hosts under ~16 GiB RAM, prefer `1` so the unit stays out of swap ([host sizing](#host-sizing-and-memory)). Raise it only if you actually have the runners *and* the RAM. |
+| `maxConcurrentWorkers` | `2` (setup may write `1` on <16 GiB hosts) | Parallel omp sessions, each a child process of the daemon and all inside its cgroup. Two, because **CI runner slots, not model tokens, are the usual throughput ceiling** — a third worker would starve its own PR checks on a small self-hosted runner pool. On hosts under ~16 GiB RAM, prefer `1` so the unit stays out of swap ([host sizing](#host-sizing-and-memory)). Raise it only if you actually have the runners *and* the RAM. |
 | `dailySpendUsd` | `25` | Rolling-day spend ceiling in USD, or `null` for no spend gate. `0` is a hard stop. Metered from assistant `usage.cost.total`. |
 | `planUsage` | `null` (unmetered) | Subscription/plan allowance guard: `{ "windowId": "anthropic:7d", "maxUsedFraction": 0.85 }`, or `null` for no plan gate. Independent of `dailySpendUsd` — see [Plan allowance](#plan-allowance-planusage) below. |
 | `workerMaxTurns` | `120` | Startup ceiling for each new worker. Catches a session looping without converging; use `omp-conductor extend` to raise one live run without changing this default. |
@@ -1557,9 +1560,6 @@ A complete, valid config for one project with two target repos:
         "github-release": "human",
         "deploy": "human"
       },
-      "credentials": {
-        "isolation": "per-run"
-      },
       "policy": {
         "merge": {
           "requiredChecks": ["build", "lint"],
@@ -1917,7 +1917,7 @@ omp-conductor help
 | `stop` | Prefer `systemctl stop omp-conductor.service` when that unit's MainPID is the live daemon — systemd then owns the stop and will not schedule a restart for the exit it just requested. Otherwise `SIGTERM`, then `SIGKILL` after a 10-second grace period. Prints `not running` when there is nothing to stop, and tags the confirmation with `(via systemctl)` when the unit path was used. |
 | `restart` | Prefer `systemctl restart` when the unit owns the live pid so the replacement stays supervised; otherwise `stop` then `start`, inheriting the running daemon's port and project unless a flag overrides them. The new process **salvages dirty live worktrees before orphaning** those rows — see [Deploying a new package onto a busy fleet](#deploying-a-new-package-onto-a-busy-fleet). |
 | `upgrade [--to VERSION] [--project NAME]` | Deterministically update the Bun-global CLI, omp plugin, Herdr recovery plugin, and managed brief as one release. Resolves the npm version and exact `gitHead`, pauses only new claims, drains active workers, installs all surfaces, reloads Herdr and the daemon, waits for pane recovery, verifies identities and fleet health twice, then restores the original dispatch state. A no-op when already current. Failure leaves dispatch paused. Must run outside a Herdr-managed session. |
-| `status [--project NAME]` | Layered fleet report first: `dispatch` / `ticks` / next scheduled tick / `pane` / `recovery` / `herdr` / `telegram` / `boundary` / `brief` / `decisions` / optional `failure classes` and `code graph` / `daemon`, then the project body. The project body includes the latest completed dispatch timestamp, ready/routed/admitted counts, and bounded hold groups; API failures are marked `DEGRADED` so queue starvation cannot look idle. The next tick comes from the live heartbeat process, not a guess from log timestamps. Telegram health uses `getMe` to prove API authentication without sending a message and reports inbound bridge configuration separately. Configured graphs report prerequisites, indexed repos, timer state, and refresh freshness without blocking dispatch. A `reports` block lists everything the outbox has not delivered, with its age, and prints `pending` (nobody has it) differently from `SENDING` (outcome unknown, it may already have arrived) — see [Report delivery](#report-delivery-the-outbox). The daemon block includes `rss` from `/healthz`; live workers add a busy-deploy warning. A `.conductor-stalled` marker adds an `orchestrator STALLED since …` line. |
+| `status [--project NAME]` | Layered fleet report first: `dispatch` / `ticks` / next scheduled tick / `pane` / `recovery` / `herdr` / `telegram` / `brief` / `decisions` / optional `failure classes` and `code graph` / `daemon`, then the project body. The project body includes the latest completed dispatch timestamp, ready/routed/admitted counts, and bounded hold groups; API failures are marked `DEGRADED` so queue starvation cannot look idle. The next tick comes from the live heartbeat process, not a guess from log timestamps. Telegram health uses `getMe` to prove API authentication without sending a message and reports inbound bridge configuration separately. Configured graphs report prerequisites, indexed repos, timer state, and refresh freshness without blocking dispatch. A `reports` block lists everything the outbox has not delivered, with its age, and prints `pending` (nobody has it) differently from `SENDING` (outcome unknown, it may already have arrived) — see [Report delivery](#report-delivery-the-outbox). The daemon block includes `rss` from `/healthz`; live workers add a busy-deploy warning. A `.conductor-stalled` marker adds an `orchestrator STALLED since …` line. |
 | `ledger [--issue N] [--limit N]` | Every [mediated-verb](#the-mediated-verbs-126) call and how the daemon decided it: the verb, the arguments it was given, allow or refuse, the named refusal reason, and any resulting SHA. Sessions cannot push, open a PR, merge, label or release except through those verbs, so this is the record of what they *tried* as well as what they did — the thing an escalation cites. Reads (`conductor_pr_status`) are deliberately absent: a poll every thirty seconds would bury the refusals. `--issue` narrows to one issue's run; `--limit` defaults to 50. The newest few also appear in `status`. |
 | `board [--project NAME]` | Live keyboard-driven kanban over the same SQLite and `/healthz` truth as `status`, plus the tracker's current labels: Queue, Claimed, Running, Green, Blocked, Failed, Orphaned, and the last 24 hours of Merged and History. Columns are mutually exclusive and describe current state, not the newest run row, so a requeued issue is queued rather than failed and a closed issue is neither. Refreshes run/spend/turn values every second, and health plus the label read every ten seconds. `Enter` follows the selected transcript in place; `u` invokes the existing unblock workflow on a Blocked, Failed, or Orphaned card; `i` / `p` open the issue / PR; `r` refreshes health; `?` shows all keys. Requires an interactive terminal of at least 50×20. |
 | `hold [--project NAME]` | Soft stop: pause claiming **and** disarm ticks. Daemon and pane stay up. Prefer this over `pause` when the intent is "stop the conductor" without killing processes. See [Stop the conductor](#stop-the-conductor-hold--halt). |
@@ -2119,29 +2119,14 @@ Unconfined means auditable, not licensed. `orchestratorReadPaths` is retired: it
 is still accepted in a config and ignored, so a fleet carrying it upgrades
 without editing anything.
 
-**One conditional exception, and it is a credential boundary rather than a tool
-gate.** When the *daemon* starts the orchestrator (`escalation.orchestrator:
-"embedded"`) on a fleet whose `credentials.isolation` resolves to an isolating
-mechanism, that session also runs as its own OS principal with
-`workspaceRoot`, `mirrorRoot` and the host credential denied — a syscall-level
-refusal `bash` cannot talk its way around, which is why it is worth keeping
-where it applies. It does not apply to an external orchestrator, and it does not
-apply on a host `status` reports as `unprotected`. The installed package is
-readable either way: reading your own dispatcher's source to file an accurate
-bug is exactly what should never be refused (#143).
-
-The workers are the sessions that are gated — a mechanical worktree confinement
-on structured tools, plus their own OS principal under
-`credentials.isolation: "per-run"`. That asymmetry is the design: a worker is
-dispatched code it did not write and runs unattended, while the orchestrator is
-the session the operator is reading.
-
 ## The mediated verbs (#126)
 
-With the credential boundary in place a session can no longer mutate GitHub by
-accident or by malice — and can no longer do its job either. These verbs are the
-only sanctioned way back, and the point of them is *where the checks run*: in
-the daemon, across a process boundary, not in a prompt the model can rewrite.
+A session can reach `gh`: it inherits the daemon's environment, credentials and
+all. It is told not to publish with it. These verbs are the sanctioned route
+instead, because the dispatcher owns the settlement record — a push or a PR the
+daemon did not perform is a run it cannot account for, and the checks that would
+have refused it never ran. The point of them is *where those checks run*: in the
+daemon, across a process boundary, not in a prompt the model can rewrite.
 
 ### The verbs
 
@@ -2169,35 +2154,45 @@ on run X asking to merge run Y's PR is not merely wrong, it is unexpressible.
 
 ```
 <state dir>/verbs/                 daemon-owned, mode 0711
-  run-7-9a783d877d422b9e.sock      0600, owned by run 7's principal
-  run-9-1c40e2a5b6d3f018.sock      0600, owned by run 9's principal
-  orchestrator-4b1f...c2.sock      0600, a third, distinct one
+  run-7-9a783d877d422b9e.sock      0600, bound for run 7
+  run-9-1c40e2a5b6d3f018.sock      0600, bound for run 9
+  orchestrator-4b1f...c2.sock      0600, the orchestrator's
 ```
 
-`0711` is load-bearing and the obvious `0700` does not work: *connecting* needs
-**search** (`+x`) on every path component, not read. Searchable by run
-principals, listable by none, and writable by none but the daemon — that last
-one is what stops a run unlinking a sibling's socket or binding an impostor in
-its place. A per-run *directory* owned by the run principal would hand exactly
-that power back, and is deliberately not used.
+**What these modes buy, and what they do not.** They keep every *other local
+account* out: `0711` on the parent is traversable but not listable, so no other
+user can enumerate the fleet's sockets, the suffixes are unguessable, and only
+the daemon's uid can connect to a `0600` socket at all.
+
+They are **not** a boundary between runs. Sessions are child processes of the
+daemon running as its own uid, so a session matches the owner class on all of
+these: it could list the directory and connect to a sibling's socket. Each run is
+*handed* its own path and nothing else, which is a convention the run has no
+reason to break — not an enforcement. What makes breaking it visible is the
+[ledger](#the-ledger): every call is recorded with the channel it
+arrived on, so a worker calling on another run's socket is in the record.
+
+Closing that properly needs the sessions to be different OS principals. A
+per-run credential boundary that did exactly this shipped and was removed in
+0.5.0 — it worked, and the cost was that it also hid the operator's own model
+credential from every session, so nothing could start. It is not worth
+re-litigating without solving that first.
 
 Before binding, the daemon verifies every component of the path is owned by
 itself (or root), free of symlinks, and unwritable by anyone else; a failed
-check **refuses dispatch** rather than degrading. Where the run has its own
-principal it also verifies the chain is traversable, and says which directory to
-`chmod o+x` when it is not. Paths are unguessably suffixed, and only the daemon
-ever unlinks one.
+check **refuses dispatch** rather than degrading. Paths are unguessably
+suffixed, and only the daemon ever unlinks one.
 
 Peer credentials are asserted server-side — `getpeereid` on macOS, `SO_PEERCRED`
-on Linux — against the uid allocated for that run. A mismatch closes the
-connection with no reply and logs an impersonation attempt. Where the host has
-no per-run principals there is no distinct uid to compare, and the daemon says
-so at startup rather than implying a guarantee it is not making:
+on Linux — and the daemon states at startup exactly what that buys rather than
+implying more. Sessions are child processes running under the daemon's own uid,
+so the peer check proves the caller is a local process on this host; it is the
+socket, not the uid, that says which run is calling. A connection whose peer
+cannot be read at all is closed with no reply and logged.
 
 ```
 verb transport: verb sockets in ~/.omp/conductor/verbs (mode 711); each socket
-0600 under the daemon's own uid (no per-run principals on this host); peer uid
-asserted with getpeereid
+0600 under the daemon's own uid; peer uid asserted with getpeereid
 ```
 
 **No mutation route exists on the HTTP port**, and none may be added. That
@@ -2205,8 +2200,8 @@ surface is unauthenticated loopback TCP reachable by any local user; a `PUT` or
 `POST` at any verb path answers 404, pinned by a test.
 
 The child-side tool handler is a thin client only. It forwards arguments and
-renders the answer — no policy branch, no credential, no local fallback. With no
-socket it fails closed and says so, rather than reaching for `git push`.
+renders the answer — no policy branch, no local fallback, no second route. With
+no socket it fails closed and says so, rather than reaching for `git push`.
 
 ### The ledger
 
@@ -2237,210 +2232,6 @@ leaves a durable record that something tried. It is no longer what *stops* a
 release. Treat a block there as evidence about a session's intentions; the
 daemon is what prevented it.
 
-## The credential boundary (`credentials`)
-
-Every prose rule about what a worker "may not" do reduces to one fact: until
-this existed, **model-executed code held the operator's own GitHub write
-credential.** Sessions ran inside the daemon process, as the same OS user, with
-the same `$HOME` and the same filesystem view — and the daemon authenticates by
-shelling out to the logged-in `gh`, so a worker's `bash` reached the same
-credential by running the same binary.
-
-Scrubbing `GH_TOKEN` does not fix that, and this package will not describe it as
-if it did. Code running as the same uid defeats an environment variable in one
-line (`GH_CONFIG_DIR=$HOME/.config/gh gh pr merge …`), and the login keychain,
-`~/.ssh` and `~/.git-credentials` need no environment at all. **The boundary is
-an OS principal.** The environment scrubbing that ships alongside it is
-accident-prevention: it makes the common mistakes fail immediately and legibly,
-and it stops nothing that is trying.
-
-### What actually changed
-
-- Worker and orchestrator sessions are **child processes**, launched under a
-  principal scoped to one run. They are still supervised exactly as before —
-  turn caps, wall-clock caps, spend accounting, salvage, transcript paths — and
-  a session that outlives its daemon is not possible: the child exits when its
-  control socket closes.
-- A run's checkout is **its own git repository**, borrowing objects read-only
-  from the shared mirror through git alternates. It used to be a linked worktree
-  of that mirror, which needs write access to the mirror's refs and therefore
-  handed every run write access to every other run's.
-- **Publishing is the daemon's.** The worker commits locally; the daemon fetches
-  the run branch out of the run's repository into the mirror and pushes it to
-  GitHub, fast-forward only. There is no force path anywhere in this package. A
-  rejected push settles the run `failed` with git's stderr verbatim.
-- One function, `credentialedEnv()`, is the only construction site of credential
-  material in the daemon. `gh`, the mirror's clone and fetch, the daemon-side
-  push and the mediated verbs all go through it, so "what can reach the
-  credential" is answered by its call sites rather than by an audit.
-
-### `credentials.isolation`
-
-| Value | Meaning |
-|---|---|
-| `"per-run"` | Every session runs as its own OS principal. The daemon refuses to dispatch if this host cannot provide one. |
-| `"none"` | Sessions run as the daemon's user. `status` reports the fleet as **unprotected**, every time. |
-
-There is deliberately no third value. The degraded `group-mode` mechanism below
-is something the *host probe* can report, never something a config can ask for,
-so an operator cannot believe they configured the full boundary and get the
-weaker one.
-
-**A config written before this key existed is migrated, not rejected.** On the
-first start it resolves to `"none"`, the key is written into the file
-explicitly, and the daemon logs the migration once by project name. The answer
-then lives on disk rather than being inherited from a default nobody chose — and
-no running fleet stops dispatching on upgrade. A fleet that upgrades and does
-nothing else is unprotected and says so in `status`; turning that into a refusal
-would have been an outage caused by a security feature.
-
-### `credentials.readToken`
-
-Optional, and absent by default. The boundary removes GitHub *reads* too, so a
-worker with no token works from its dispatch brief — which already carries the
-issue body and the acceptance criteria — and from the mediated verbs. Set this
-to a **read-scoped** token to give sessions `gh` reads back.
-
-This package cannot verify the scope. A write-scoped token here re-opens exactly
-the hole the rest of this section closes.
-
-### Mechanisms, and what each one does not protect
-
-The daemon probes the host at startup, states the mechanism, and proves it by
-running the composed launcher against a trivial child before reporting it
-available. A mechanism whose argv the host rejects resolves *down* at probe time
-rather than failing every dispatch at run time.
-
-| Mechanism | Where | Contains a determined escape? |
-|---|---|---|
-| `uid-pool` | Linux, with the capabilities and accounts below | **Yes** |
-| `sandbox-exec` | macOS | **Yes**, within a deprecated Apple interface |
-| `group-mode` | Linux, groups but no capabilities | **No** — cross-run separation only |
-| `none` | anywhere else | **No** |
-
-`group-mode` exists so an operator who cannot grant capabilities still gets
-cross-run checkout separation. It runs sessions as the daemon's own uid, so it
-bounds accidents and does not stop a determined same-uid escape. `status` says
-which one is live, and lists what it does not close.
-
-### Deploying `per-run` on a Linux fleet host
-
-See `systemd/omp-conductor.service.example` for the copy-pasteable version. In
-summary:
-
-1. **Capabilities on the existing unprivileged account.** The unit grants
-   `CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SETPCAP`. They exist to be *dropped
-   into* run children, never inherited by them. A capability grant on the
-   `fleet` account is a narrower blast radius than running as root or shipping a
-   setuid binary.
-
-   `CAP_SETPCAP` is there solely so the launcher can empty the child's
-   capability **bounding** set, which `PR_CAPBSET_DROP` requires. A host that
-   withholds it takes a documented fallback: the launcher omits
-   `--bounding-set=-all`, the child still ends with every other set empty behind
-   `NoNewPrivs`, the leftover `CapBnd` is inert, and `status` reports it as a
-   named residual.
-
-2. **`setpriv` (util-linux) must be on `PATH`.** Every run child is launched
-   through it: group list, then gid, then uid, then empty the
-   permitted/effective/inheritable/ambient sets, drop the bounding set, set
-   `PR_SET_NO_NEW_PRIVS`, then `exec`. Without `setpriv` the probe reports
-   `none`. There is deliberately no `spawn({uid,gid})` fallback — ambient
-   capabilities survive `execve` for ordinary binaries, so a child launched that
-   way holds `CAP_SETUID` itself and can `setuid()` back to a sibling run or to
-   the daemon, voiding the boundary while appearing to work.
-
-3. **Provision with the shipped command, not by hand.**
-   `omp-conductor boundary-setup --slots <n>` prints the exact idempotent root
-   commands, generated from the same constants the startup probe checks, so the
-   instructions cannot drift from what the daemon then demands.
-
-   ```bash
-   omp-conductor boundary-setup --slots 2              # read it first
-   omp-conductor boundary-setup --slots 2 | sudo bash
-   sudo systemctl restart omp-conductor.service
-   ```
-
-   It needs no config and must run **before** `setup`: setup writes worktree and
-   mirror paths into the shared root this creates. What it establishes:
-
-4. **One account per run slot**, `conductor-agent-<n>` for each concurrent
-   worker plus `conductor-agent-orch` for the orchestrator. `maxConcurrentWorkers`
-   is 2 by default, so the pool is small. The orchestrator's account is distinct
-   precisely so it has no read or write access to any run checkout, and it is
-   launched with no supplementary group at all.
-
-5. **Two groups**, and the split between them is the whole filesystem model:
-
-   | Group | Members | Purpose |
-   |---|---|---|
-   | `conductor-daemon` | the daemon account **only** | lets it reach every run repo — fetch the branch, salvage, reclaim the tree |
-   | `conductor-runs` | every slot principal | read-only access to the shared mirror |
-
-   A slot principal must **never** be in `conductor-daemon`. That membership is
-   the only thing keeping sibling runs out of each other's checkouts, and its
-   absence is asserted from a live session by the probe suite.
-
-   Supplementary group membership is fixed when a process starts, so this
-   **requires a service restart**. Without it the daemon's live credentials lack
-   the group even though `getent` shows it, and it would chown every run repo to
-   a group it cannot itself use — the probe checks the running process's own
-   credentials for exactly this reason, and every run additionally write-tests
-   its tree after the ownership handoff.
-
-6. **Layout.** Run repos are `conductor-agent-<slot>:conductor-daemon`,
-   directories `2770` (setgid, so what the worker creates inherits the group)
-   and files `0660` with execute bits preserved. The shared mirror is
-   daemon-owned, group `conductor-runs`, `0750`/`0640`.
-
-   Everything a slot must reach lives under **`/var/lib/omp-conductor`** (mode
-   `0711`): worktrees, mirrors, per-run session transcripts and per-run boundary
-   homes. It is deliberately outside the state directory, which stays `0700`
-   because it holds `conductor.db` and the WAL files SQLite recreates at
-   runtime — making that searchable would publish fleet history to every local
-   account. Override with `$OMP_CONDUCTOR_SHARED`. Uninstall is therefore two
-   paths, not one.
-
-7. **The daemon's home is `0711`, with its credential leaves closed**
-   (`.ssh`, `.config/gh` at `0700`; `.npmrc`, `.git-credentials` at `0600`).
-   Searchable because the runtime and the installed package live in it — a
-   `0700` home kills every worker before it connects, and no shell-based probe
-   notices — and closed at the leaves because that is where the boundary
-   actually rests. The daemon re-checks this empirically at dispatch, asking the
-   slot principal itself whether it can read any credential path, and refuses
-   the run if it can.
-
-Verify with `omp-conductor status`: the `boundary` row names the live mechanism
-and lists its residuals.
-
-### macOS dev hosts
-
-`sandbox-exec` is Apple-deprecated and is still the only thing on a stock host
-that denies a *read*, which is what this needs. The generated profile makes the
-run's checkout the only writable path and denies `~/.ssh`, `~/.config/gh`,
-`~/.git-credentials`, `~/.npmrc`, the other run checkouts, and mach lookups of
-the keychain services. Verified on darwin 25.5.0 against the full probe list.
-
-A dev host may also simply run `credentials.isolation: "none"`, in which case
-`status` reports it unprotected. That is a legitimate choice for a machine that
-is not a fleet host; it is not a default.
-
-### The residual, stated plainly
-
-A run can **read** another run's git objects out of the shared mirror. That is
-the price of not cloning the repository per run, and it is bounded: same source,
-no write path, no credential. It is asserted as *permitted* by the probe suite,
-so nobody can quietly "fix" it by weakening the mirror's modes.
-
-### MCP servers are inside the blast radius
-
-A GitHub MCP server carrying its own PAT re-opens the hole. Sessions discover
-MCP configuration from the **agent principal's** config root — the redirected
-`$HOME` this package creates per session, not the operator's — and dispatch
-**refuses with a named error** when a credential-bearing GitHub server is found
-there or in the run's checkout. Put servers you want sessions to have in the
-agent principal's root, without credentials.
-
 
 ## Limitations
 
@@ -2468,18 +2259,6 @@ Known and deliberate in this version:
 - **No cross-process lock on the mirrors.** Two dispatch loops fetching the same
   repo at the same instant can collide on git's ref locks; the run fails and is
   retried rather than corrupted.
-- **A run can read another run's git objects.** The shared mirror is one object
-  store, so the isolation is on writes and credentials, not reads. See
-  [The residual, stated plainly](#the-residual-stated-plainly).
-- **`group-mode` does not contain a determined escape.** It separates run
-  checkouts by group and mode while sessions still run as the daemon's uid. Only
-  `uid-pool` and `sandbox-exec` make the stronger claim, and `status` says which
-  one is live.
-- **A fleet that upgrades and changes nothing is unprotected.** The
-  `credentials` migration resolves to `"none"` and writes it down rather than
-  refusing to dispatch, because an outage caused by a security feature is worse
-  than the day before it shipped. `status` reports it every tick until an
-  operator provisions the host and sets `"per-run"`.
 - **Uniquely local mirror branches are retained.** Terminal runs are reaped
   automatically only after every commit exists on a remote ref. A failed salvage
   push deliberately leaves its branch and tree for an operator rather than
@@ -2497,7 +2276,7 @@ Known and deliberate in this version:
   "nobody reads it until morning" path the orchestrator exists to avoid. The warning
   is in `daemon.log`; nothing pages you about it.
 - **Workers are not terminal panes, so you cannot watch them there.** Each
-  worker is an in-process omp session started by `createSession`. The resident
+  worker is an omp session the daemon starts as a child process. The resident
   daemon tracks workers in a background pool so the five-minute loop keeps
   settling PRs and checking capacity; shutdown waits for that pool. Herdr still
   shows exactly one pane (the orchestrator's) regardless of concurrency.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.4.5",
+  "version": "0.5.1",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/skills/conductor-onboarding/SKILL.md

@@ -513,62 +513,6 @@ lose the substituted coordinates and the overwrite confirmation.
 
 ---
 
-## Step 5b — offer the credential boundary, and be honest about its cost
-
-Ask this once, plainly, because the default is not the safe answer — it is the
-*non-breaking* one:
-
-> Should worker and orchestrator sessions run under their own OS accounts, so a
-> session that goes rogue in bash holds no credential capable of merging,
-> pushing, releasing or reading your `gh` config?
-
-`credentials.isolation` is `none` unless someone says otherwise, and `status`
-reports such a fleet **unprotected** on every tick. That is deliberate: a fleet
-that refuses to dispatch the moment it upgrades is worse than one that is
-honestly unprotected.
-
-Say what it costs before they answer:
-
-- **Linux only** for the real thing. macOS dev hosts get `sandbox-exec`, which
-  is Apple-deprecated but is still the only stock mechanism that denies a *read*.
-- **Root, once**, to create the accounts and groups.
-- **A service restart**, because supplementary group membership is fixed when a
-  process starts.
-- Worktrees and mirrors move to `/var/lib/omp-conductor`. Uninstall becomes two
-  paths instead of one.
-
-If they say yes, the order matters and getting it wrong looks like a bug:
-
-```bash
-omp-conductor boundary-setup --slots <maxConcurrentWorkers>   # read it first
-omp-conductor boundary-setup --slots <maxConcurrentWorkers> | sudo bash
-sudo systemctl restart omp-conductor.service
-```
-
-**Then open a fresh shell before running the wizard.** The setup probe reads its
-*own* process credentials, so a stale login will refuse to offer `per-run` and
-that reads like a broken install rather than an un-refreshed session.
-
-Only then run `/conductor setup` and choose `per-run`. That single amend writes
-the isolation, relocates the roots, and regenerates the systemd unit *with* the
-capabilities the launcher needs — the unit is not optional, and a fleet
-configured `per-run` whose unit lacks them probes down to `group-mode` and
-refuses every issue. Install the unit with the commands the wizard prints, then
-confirm:
-
-```bash
-omp-conductor status     # boundary: per-run — uid-pool
-```
-
-`status` reports the **daemon's** boundary, read from `/healthz`, not a probe of
-whatever shell you are standing in — capabilities belong to the process, and an
-interactive shell has none of the unit's. If no daemon is running it falls back
-to a local probe and says so; that line is not the fleet's answer.
-
-If it says anything else, the reason names the missing capability, group or
-path. Do not guess at it, and never "fix" it by widening the state directory —
-that is where `conductor.db` lives.
-
 ## Step 6 — check the worker brief's assumptions against reality
 
 The worker brief makes concrete claims to a session that has no other context. If

package/skills/conductor-update/SKILL.md

@@ -26,10 +26,10 @@ two-pass verification, and restoration of the previous dispatch state.
 ## When it fails on the systemd unit
 
 Since 0.4.0 the command also verifies the unit systemd actually booted from, not
-just the staged copy. A fleet configured `credentials.isolation: "per-run"`
-whose installed unit predates the capability grant probes down to `group-mode`
-and then refuses every issue — and package identities, services, pane and ticks
-all look perfectly healthy around it, which is why it needed its own check.
+just the staged copy. A unit installed before a directive the current
+configuration requires keeps running without it, and package identities,
+services, pane and ticks all look perfectly healthy around it, which is why it
+needed its own check.
 
 The error names the missing directives. Fix it by re-staging rather than by
 hand-editing the live unit:
@@ -45,11 +45,6 @@ omp-conductor upgrade       # re-run; it now verifies clean
 Only directives this configuration *requires* are checked, so an operator's own
 `MemoryMax`, `After=` or extra `Environment=` never fails an upgrade.
 
-What the command deliberately does **not** do is create the accounts and groups
-the boundary needs. That is `omp-conductor boundary-setup`, it needs root, and
-the daemon runs unprivileged on purpose — so it detects and instructs rather
-than escalating.
-
 Report the command's result. Do not reproduce its lifecycle as an AI checklist,
 edit installed files, publish npm, or substitute separate install/restart steps.
 If it fails, report the exact error and leave dispatch paused as the command

package/src/briefs/orchestrator.md

@@ -237,8 +237,8 @@ Not yours to relax:
 
 - **Workers stop at a green PR.** `conductor_pr_merge`, `conductor_label` and
   `conductor_release` refuse a worker session mechanically, whatever any config
-  says, and a worker holds no credential to go around them with. This one is
-  absolute. A worker sees one issue, so it cannot judge whether a release is
+  says, and a worker that reaches for `gh` instead has committed a reportable
+  breach. This one is absolute. A worker sees one issue, so it cannot judge whether a release is
   worth cutting, and a session that merges its own work has removed every review
   the PR existed to get. Release work is never delegated downward: if any of it
   is delegated at all, it is delegated to **you**.
@@ -279,9 +279,11 @@ Not yours to relax:
 
 ## Your verb surface
 
-You hold no GitHub credential. Everything below happens through conductor tools
-whose checks run in the dispatcher, and each one records what you asked for and
-what it decided — readable with `omp-conductor ledger`, including the refusals.
+You can reach `gh`, and you do not publish with it. Everything below happens
+through conductor tools whose checks run in the dispatcher, and each one records
+what you asked for and what it decided — readable with `omp-conductor ledger`,
+including the refusals. That record is the point: a merge or a release the
+dispatcher did not perform is one nobody can account for afterwards.
 
 | Tool | Yours when | What the dispatcher checks before acting |
 | --- | --- | --- |
@@ -307,20 +309,12 @@ the SHA that produced it. Never work around one: there is no path around it, and
 the attempt is in the ledger.
 
 **Your file tools are not gated — the workers' are.** Every worker session runs
-under a mechanical worktree gate and, under `credentials.isolation: "per-run"`,
-its own OS principal. Your structured tools are gated by nothing, and that is a
-deliberate operator decision rather than an oversight. What holds YOUR
-boundaries is this brief, the verb ledger every `conductor_*` call writes, and
-the operator reading both. Never read or edit a worker's checkout or the mirror
-cache — when you need a run's code, read its PR. Unconfined means auditable, not
-licensed.
-
-One caveat, so you never assume more protection than you have: if this daemon
-started you *and* the fleet runs an isolating credentials mechanism, you are
-also a separate OS principal that genuinely cannot reach a run checkout, the
-mirror or the host credential — `omp-conductor status` names that mechanism on
-its `boundary` line. Started by your operator, or on a host that reports
-`unprotected`, nothing stops those reads but the paragraph above.
+under a mechanical worktree gate. Your structured tools are gated by nothing,
+and that is a deliberate operator decision rather than an oversight. What holds
+YOUR boundaries is this brief, the verb ledger every `conductor_*` call writes,
+and the operator reading both. Never read or edit a worker's checkout or the
+mirror cache — when you need a run's code, read its PR. Unconfined means
+auditable, not licensed.
 
 **Your own** merge and release authority is not decided here, and not by this
 brief either. It is whatever your operator granted at setup time, and the