omp-conductor 0.4.5 → 0.5.1

package/src/upgrade.ts

@@ -7,11 +7,8 @@ import { configPath, findProject, loadConfig, resolveCaps, writeConfigRaw } from
 import { renderBriefForProject } from "./setup.ts";
 import {
   STAGED_SERVICE_NAME,
-  parseEffectiveUnit,
   planHostRuntime,
-  unitDriftReason,
   writeHostRuntime,
-  type EffectiveUnit,
 } from "./setup-host.ts";
 
 const PACKAGE = "omp-conductor";
@@ -41,15 +38,6 @@ export interface UpgradeResult {
   dispatch: DispatchLayer;
 }
 
-/** What the unit check reads, and how it repairs what it can. */
-export interface UnitFiles {
-  rendered: string;
-  /** What systemd loaded, not what is on disk. Undefined means no systemd here. */
-  effective: EffectiveUnit | undefined;
-  /** Writes the corrected unit to the state dir; returns the commands root must run. */
-  stage?(): readonly string[];
-}
-
 export interface UpgradeDeps {
   run(command: string, args: readonly string[]): Promise<UpgradeCommandResult>;
   snapshot(project?: string): { liveWorkers: number };
@@ -61,12 +49,6 @@ export interface UpgradeDeps {
   sleep(ms: number): Promise<void>;
   env: NodeJS.ProcessEnv;
   log(message: string): void;
-  /**
-   * What this version would render as the unit, and what systemd actually
-   * booted from. Injected so the drift check is testable without a systemd host
-   * — and defaulted, so no production caller has to know it exists.
-   */
-  unitFiles?(): Promise<UnitFiles | undefined> | UnitFiles | undefined;
 }
 
 async function runCommand(command: string, args: readonly string[]): Promise<UpgradeCommandResult> {
@@ -450,51 +432,6 @@ async function rollbackUpgrade(
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 
-/**
- * The rendered-vs-installed pair for {@link unitDriftReason}.
- *
- * Best-effort by design: a host with no config, no project, or no systemd is
- * not a host with a broken unit, and an upgrade must not fail because it could
- * not answer a question that does not apply there.
- */
-async function defaultUnitFiles(deps: UpgradeDeps): Promise<UnitFiles | undefined> {
-  try {
-    const cfg = loadConfig();
-    const project = cfg.projects[0];
-    if (project === undefined) return undefined;
-    const plan = planHostRuntime(project, resolveCaps(project, cfg.defaults), telegramStateDir());
-    const shown = await deps.run("systemctl", [
-      "show",
-      STAGED_SERVICE_NAME,
-      "-p",
-      "AmbientCapabilities",
-      "-p",
-      "CapabilityBoundingSet",
-      "-p",
-      "SupplementaryGroups",
-      "-p",
-      "Environment",
-      "-p",
-      "NeedDaemonReload",
-    ]);
-    return {
-      rendered: plan.service.content,
-      effective: shown.code === 0 ? parseEffectiveUnit(shown.stdout) : undefined,
-      // Staging needs no privilege, so the repair is reduced to the two lines
-      // that genuinely do. Installing the unit is root's, and this command runs
-      // as the fleet user by design — so it goes as far as it can and then says
-      // exactly what is left, rather than sending the operator back through a
-      // wizard to regenerate a file it could write itself.
-      stage: () => {
-        writeHostRuntime(plan);
-        return plan.installCommands;
-      },
-    };
-  } catch {
-    return undefined;
-  }
-}
-
 export async function upgradeConductor(
   options: UpgradeOptions = {},
   overrides: Partial<UpgradeDeps> = {},
@@ -521,22 +458,6 @@ export async function upgradeConductor(
   const surfaces = await inspectSurfaces(deps);
   const brief = deps.brief(project);
   const installNeeded = !surfacesCurrent(surfaces, release.version, release.gitHead);
-  // Computed BEFORE the no-op decision, not inside verification, and that
-  // placement is the whole point. The upgrade that installs a version is run by
-  // the *previous* CLI, so a check living only in the new code never executes
-  // for the release that introduces it — and re-running afterwards would take
-  // the already-current early return and skip it forever. A fleet whose unit is
-  // stale is not current, whatever its package identities say.
-  const files = await (deps.unitFiles === undefined ? defaultUnitFiles(deps) : deps.unitFiles());
-  const drift = files === undefined ? undefined : unitDriftReason(files.rendered, files.effective);
-  if (drift !== undefined) {
-    const commands = files?.stage?.() ?? [];
-    throw new Error(
-      commands.length === 0
-        ? drift
-        : `${drift}\n\nThe corrected unit has been staged. Run:\n${commands.map((c) => `  ${c}`).join("\n")}`,
-    );
-  }
   if (!installNeeded && brief.current) {
     return {
       previousVersion: surfaces.cliVersion,
@@ -631,17 +552,6 @@ export async function upgradeConductor(
       const active = await mustRun(deps, "systemctl", ["is-active", HERDR_UNIT]);
       if (active.stdout.trim() !== "active") throw new Error(`${HERDR_UNIT} is not active after restart`);
     }
-    // The unit is the one surface `upgrade` never looked at, and since 0.4.0 it
-    // is the difference between a working per-run fleet and one that refuses
-    // every issue. Fatal rather than a warning: the whole point of this command
-    // is that a fleet is either upgraded or explicitly left paused, and a
-    // "verified" fleet that cannot dispatch is the worse outcome.
-    // Re-read rather than trust the earlier pass: the daemon has restarted
-    // since, and an operator who installed a unit mid-upgrade should not get a
-    // green verification for a file nobody checked.
-    const after = await (deps.unitFiles === undefined ? defaultUnitFiles(deps) : deps.unitFiles());
-    const stillDrifted = after === undefined ? undefined : unitDriftReason(after.rendered, after.effective);
-    if (stillDrifted !== undefined) throw new Error(stillDrifted);
     await waitForRecovery(deps, initial, project);
     deps.log("verify 2/2: recovered fleet remains stable");
     await deps.sleep(1_000);

package/src/verbs/actions.ts

@@ -14,7 +14,7 @@
  * enough to actually write.
  */
 
-import { credentialedEnv, openRunPr, pushRunBranch, repoSlugFor } from "../credentials.ts";
+import { credentialedEnv, openRunPr, pushRunBranch, repoSlugFor } from "../gitops.ts";
 import type { ProjectConfig, ReleaseShape } from "../types.ts";
 import type { ActionOutcome, ReleaseExecution, VerbActions } from "./server.ts";
 

package/src/verbs/server.ts

@@ -51,21 +51,11 @@ import {
   secureBoundSocket,
   socketFd,
   unlinkStaleSocket,
-  traversalProblem,
   validateSocketPath,
   type PeerReader,
   type SocketOwnership,
 } from "./socket.ts";
 
-/**
- * The OS principal a run was allocated (#125).
- *
- * Imported as a type from the credential boundary rather than redeclared, so
- * there is one definition of "which uid is this run": a second copy is a second
- * place identity is decided, which is the bug both issues exist to remove.
- */
-import type { SlotPrincipal } from "../credentials.ts";
-
 /**
  * How long a merge lock may be held before another daemon may break it.
  *
@@ -101,17 +91,15 @@ export type VerbChannel =
       issue: number;
       /** The routed checkout, for the privileged push/PR half. */
       repo: RepoTarget;
-      /** The run's own repository on disk (#125's per-run clone). */
+      /** The run's own repository on disk. */
       runRepoPath: string;
       branch: string;
-      principal?: SlotPrincipal;
     }
   | {
       kind: "orchestrator";
       path: string;
       project: string;
       role: "orchestrator";
-      principal?: SlotPrincipal;
     };
 
 export type ActionOutcome = { ok: true; sha?: string; detail?: string } | { ok: false; stderr: string };
@@ -946,13 +934,6 @@ export interface ListenOptions {
   daemonUid?: number;
   /** Injected in tests; the real one chowns, which needs privilege. */
   secure?: typeof secureBoundSocket;
-  /**
-   * Injected in tests for the same reason `secure` is: the traversal rule is
-   * about the *deployment's* directory chain, and a test that needs a bound
-   * socket in a developer's `0750` home is not the case it is asserting. The
-   * rule itself is pinned directly in `socket.test.ts`.
-   */
-  traversal?: typeof traversalProblem;
 }
 
 /**
@@ -978,20 +959,6 @@ export async function listenVerbChannel(
         "owned by the daemon (or root), free of symlinks, and unwritable by anyone else.",
     );
   }
-  // Traversal, proven rather than assumed, and only when it can actually fail:
-  // a run with its own principal reaches this socket by searching every
-  // component, and the daemon's state directory is 0700. Refusing here names
-  // the directory and the fix; letting it bind would produce an EACCES inside
-  // a worker turn, about a path nobody was thinking about.
-  if (channel.principal !== undefined) {
-    const blocked = (opts.traversal ?? traversalProblem)(channel.path);
-    if (blocked !== undefined) {
-      throw new VerbSocketRefusal(
-        `dispatch refused: ${blocked.message}. This run has its own OS principal, so it must be able to ` +
-          "traverse to its socket; binding one it cannot reach would take its verbs away silently.",
-      );
-    }
-  }
   // Only the daemon ever unlinks these, and it has just proven the parent is
   // not writable by anyone else — which is what makes unlink-then-bind safe
   // here and a race in a world-writable directory.
@@ -1013,7 +980,7 @@ export async function listenVerbChannel(
   });
 
   const secure = opts.secure ?? secureBoundSocket;
-  const ownership = secure(channel.path, channel.principal);
+  const ownership = secure(channel.path);
 
   return {
     path: channel.path,
@@ -1037,7 +1004,7 @@ function handleConnection(
 ): void {
   const fd = socketFd(socket);
   const peer = fd === undefined || peerReader === undefined ? undefined : peerReader(fd);
-  const verdict = peerVerdict(channel.principal, peer);
+  const verdict = peerVerdict({ uid: process.getuid?.() ?? 0 }, peer);
   if (!verdict.ok) {
     // Not a client error, and deliberately not answered: a caller who is not
     // who the socket was allocated to gets no reply to calibrate against.

package/src/verbs/socket.ts

@@ -1,28 +1,34 @@
 /**
  * The authenticated local transport the mutation verbs ride on (#126).
  *
- * The permission layout is the whole security argument, and the obvious one
- * does not work. A socket `chmod 0600` and `chown`ed to a run's principal is
- * *unreachable* if its parent is the daemon's usual `0700`: connecting needs
- * **search** (`+x`) on every path component, not read. So:
+ * **What the permission layout does and does not buy, stated plainly.** Every
+ * session is a child process running as the daemon's own uid. So the modes here
+ * keep *other local accounts* out; they do not restrain a session, because a
+ * session matches the owner class and owner bits are `rwx`. A session that
+ * wanted to list the socket directory, unlink a sibling's socket and bind an
+ * impostor in its place could do so, and nothing in this file would stop it.
  *
- *  - the parent directory is daemon-owned and mode **`0711`** — searchable by
- *    run principals, listable by none, and **writable by none but the daemon**;
- *  - each socket is `0600`, owned by the principal of the run it belongs to, so
- *    exactly one uid can connect, and the orchestrator's is a third distinct one;
- *  - the parent being non-writable is what stops a run unlinking a sibling's
- *    socket or binding an impostor listener in its place. A per-run directory
- *    owned by the run principal would hand back exactly that power, and is why
- *    the obvious layout is not used here.
+ * That is not a hole this file is hiding — it is the consequence of running
+ * sessions as the daemon. What restrains a session is the mechanical worktree
+ * gate on its structured tools plus the fact that publication only happens
+ * through the daemon, and what makes a bad push *visible* is the verb ledger.
  *
- * Two further rules make that layout hold rather than merely describe it:
- * {@link validateSocketPath} refuses to bind under a path anyone else could
- * have tampered with, and {@link peerVerdict} compares the connecting uid the
- * kernel reports against the uid the daemon allocated for that run.
+ * So the layout is:
  *
- * Every decision in this file is a pure function of `lstat` results or of a
- * credentials struct, so the adversarial cases are testable without root and
- * without a second uid.
+ *  - the parent directory is daemon-owned and mode **`0711`** — searchable so a
+ *    caller reaches a socket it can already name, not listable and not writable
+ *    by any account other than the daemon's;
+ *  - each socket is `0600`, so only the daemon's uid can connect at all;
+ *  - the per-socket suffix is random, so the path is not guessable by a foreign
+ *    account that cannot list the directory.
+ *
+ * Two further rules make that hold rather than merely describe it:
+ * {@link validateSocketPath} refuses to bind under a path anyone else could have
+ * tampered with, and {@link peerVerdict} compares the connecting uid the kernel
+ * reports against the daemon's own.
+ *
+ * Every decision in this file is a pure function of `lstat` results, so the
+ * adversarial cases are testable without root and without a second uid.
  */
 
 import { dlopen, FFIType, ptr, suffix } from "bun:ffi";
@@ -31,10 +37,10 @@ import { chmodSync, chownSync, lstatSync, mkdirSync, rmSync } from "node:fs";
 import type { Stats } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 
-/** Searchable by run principals, listable by none, writable only by the daemon. */
+/** Searchable, but not listable or writable by any account but the daemon's. */
 export const VERB_DIR_MODE = 0o711;
 
-/** One uid may connect. The parent's `0711` is what makes that reachable. */
+/** Only the daemon's uid may connect. The parent's `0711` keeps that reachable. */
 export const VERB_SOCKET_MODE = 0o600;
 
 /**
@@ -196,53 +202,6 @@ export function validateSocketPath(
   return undefined;
 }
 
-/**
- * The first path component a *foreign* uid could not search through, or
- * `undefined` when the whole chain is traversable.
- *
- * Checked rather than assumed, because this is the failure the layout in this
- * file is most likely to hit in the field and the least likely to be noticed:
- * connecting to a socket needs `+x` on **every** component, and the daemon's
- * own state directory is `0700`. A run principal would then be refused at the
- * state directory rather than at the socket, with an `EACCES` that names a
- * directory nobody was thinking about.
- *
- * Only meaningful when the run has a distinct principal. Under one uid the
- * daemon is the caller, so `0700` is traversable by definition — which is
- * exactly why this cannot be left to be discovered on the first fleet that
- * turns per-run principals on.
- *
- * Deliberately reported rather than repaired: the fix is `chmod o+x` on a
- * directory that may be the operator's home, and a daemon that silently
- * widened `$HOME` would be trading a legible refusal for a surprise.
- */
-export function traversalProblem(
-  path: string,
-  lstat: (p: string) => Stats = lstatSync,
-): SocketPathProblem | undefined {
-  for (const component of ancestors(path)) {
-    let stat: Stats;
-    try {
-      stat = lstat(component);
-    } catch {
-      return {
-        component,
-        fault: "missing",
-        message: `verb socket parent ${component} does not exist or cannot be read`,
-      };
-    }
-    if ((stat.mode & 0o001) === 0) {
-      return {
-        component,
-        fault: "not-searchable",
-        message:
-          `verb socket parent ${component} is mode ${(stat.mode & 0o7777).toString(8)}, which a run principal ` +
-          `cannot search through. Connecting needs +x on every component. Run: chmod o+x ${component}`,
-      };
-    }
-  }
-  return undefined;
-}
 
 /**
  * Remove a stale socket at `path`, and only ever one the daemon itself placed.
@@ -256,26 +215,22 @@ export function unlinkStaleSocket(path: string): void {
 }
 
 /**
- * Hand a bound socket to its run's principal.
+ * Restrict a bound socket to the daemon's own uid.
  *
- * Returns which guarantee is actually in force, because #126 asks the daemon to
- * *state* its mechanism at startup rather than guess: with a principal the
- * socket is one-uid; without one it is one-user, and the parent's `0711` plus
- * the unguessable suffix are the whole story. Saying which is the difference
- * between an audited boundary and a hopeful one.
+ * Returns the guarantee in force, because #126 asks the daemon to *state* its
+ * mechanism at startup rather than guess: the socket is `0600` under a `0711`
+ * daemon-owned parent, so it is one-user, and the unguessable suffix plus that
+ * parent are the whole story. Saying so is the difference between an audited
+ * boundary and a hopeful one.
  */
-export type SocketOwnership = "run-principal" | "daemon-user";
+export type SocketOwnership = "daemon-user";
 
 export function secureBoundSocket(
   path: string,
-  principal: { uid: number; gid: number } | undefined,
   chmod: (p: string, mode: number) => void = chmodSync,
-  chown: (p: string, uid: number, gid: number) => void = chownSync,
 ): SocketOwnership {
   chmod(path, VERB_SOCKET_MODE);
-  if (principal === undefined) return "daemon-user";
-  chown(path, principal.uid, principal.gid);
-  return "run-principal";
+  return "daemon-user";
 }
 
 export interface PeerCredentials {
@@ -406,14 +361,14 @@ export function peerVerdict(
     return {
       ok: true,
       basis: "socket-ownership",
-      why: "this run has no distinct OS principal, so peer uid cannot tell two runs apart; the 0600 socket under the daemon-owned 0711 parent is the whole boundary",
+      why: "no uid was named for this socket, so the 0600 mode under the daemon-owned 0711 parent is the whole boundary",
     };
   }
   if (peer === undefined) {
     return {
       ok: true,
       basis: "socket-ownership",
-      why: "this host exposes no peer credentials, so the 0600 socket owned by the run principal is the whole boundary",
+      why: "this host exposes no peer credentials, so the 0600 socket under the daemon-owned 0711 parent is the whole boundary",
     };
   }
   if (peer.uid !== expected.uid) {
@@ -428,19 +383,15 @@ export function peerVerdict(
 }
 
 /** One line naming what the transport can actually enforce on this host. */
-export function transportBanner(
-  dir: string,
-  peerReader: PeerReader | undefined,
-  principals: boolean,
-): string {
+export function transportBanner(dir: string, peerReader: PeerReader | undefined): string {
   const peers =
     peerReader === undefined
       ? `no peer-credential call on ${process.platform}`
       : process.platform === "darwin"
         ? "peer uid asserted with getpeereid"
         : "peer uid asserted with SO_PEERCRED";
-  const owners = principals
-    ? "each socket 0600 and chowned to its run principal"
-    : "each socket 0600 under the daemon's own uid (no per-run principals on this host)";
-  return `verb sockets in ${dir} (mode ${VERB_DIR_MODE.toString(8)}); ${owners}; ${peers}`;
+  return (
+    `verb sockets in ${dir} (mode ${VERB_DIR_MODE.toString(8)}); ` +
+    `each socket 0600 under the daemon's own uid; ${peers}`
+  );
 }

package/src/worker.ts

@@ -10,7 +10,6 @@
  * sliding into a merge queue.
  */
 
-import type { SessionBoundary } from "./credentials.ts";
 import { createSession, disposeSession } from "./omp.ts";
 import type { Caps, ReleaseShape, ResolvedGrants, RunState } from "./types.ts";
 
@@ -54,17 +53,7 @@ export interface WorkerOpts {
   releaseGrants?: ResolvedGrants;
   /** Durable audit sink for rejected release/deploy calls. */
   onReleaseBlocked?: (shape: ReleaseShape) => void;
-  /**
-   * The OS principal this run's session executes as (#125). The worker does not
-   * interpret it — it hands it to {@link createSession}, which is where the
-   * launcher lives. Omitted, the session is still a child process but runs as
-   * the daemon's own user: that is A1's shape and carries no security claim.
-   */
-  boundary?: SessionBoundary;
-  /**
-   * Control socket for that child. The daemon puts it inside the run's own
-   * boundary root, because a slot principal has to be able to reach it.
-   */
+  /** Control socket for that child, beside the run's own session directory. */
   socketPath?: string;
   /**
    * The run's conductor verb socket (#126) — its only route to a push, a PR or
@@ -206,7 +195,6 @@ export async function runWorker(
     role: "worker",
     ...(o.releaseGrants === undefined ? {} : { releaseGrants: o.releaseGrants }),
     ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
-    ...(o.boundary === undefined ? {} : { boundary: o.boundary }),
     ...(o.socketPath === undefined ? {} : { socketPath: o.socketPath }),
     ...(o.verbSocketPath === undefined ? {} : { verbSocketPath: o.verbSocketPath }),
     ...(o.onChildLog === undefined ? {} : { onChildLog: o.onChildLog }),

package/src/worktree.ts

@@ -17,7 +17,7 @@
  * the price of not cloning the repo per run.
  *
  * Publishing is therefore the daemon's job, never the worker's — see
- * `pushRunBranch` in `credentials.ts`. The run repo's `origin` deliberately
+ * `pushRunBranch` in `gitops.ts`. The run repo's `origin` deliberately
  * names the real clone URL rather than the mirror, so a worker's
  * `git push origin HEAD` attempts the network and fails on credentials instead
  * of quietly succeeding into the shared object store.
@@ -26,7 +26,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
-import { credentialedEnv, scrubUserinfo } from "./credentials.ts";
+import { credentialedEnv, scrubUserinfo } from "./gitops.ts";
 import type { RepoTarget } from "./types.ts";
 
 /**
@@ -312,9 +312,11 @@ export async function addRunRepo(
   branch: string,
 ): Promise<{ path: string; reattached: boolean }> {
   const mirrorPath = await ensureMirror(repo, mirrorRoot);
-  // 0711: searchable, so a slot principal can reach its own checkout; not
-  // listable, so it cannot enumerate its siblings; not writable, so it cannot
-  // create or unlink one. Same reasoning as the socket parent directory.
+  // 0711: searchable but not listable, so no *other local account* can
+  // enumerate the fleet's checkouts. It does not stop a session reaching a
+  // sibling's tree: sessions run as the daemon's own uid, so the owner bits are
+  // theirs. What confines a worker to its own checkout is the mechanical
+  // worktree gate on its tools, not this mode.
   mkdirSync(workspaceRoot, { recursive: true, mode: 0o711 });
 
   const runRepo = worktreePathFor(workspaceRoot, issue);
@@ -418,7 +420,7 @@ export async function addRunRepo(
  *
  * Declared here as a function type rather than imported as a concrete
  * implementation so this module stays free of the credential path: provisioning
- * and salvage decide *what* to publish, `credentials.ts` is the only place that
+ * and salvage decide *what* to publish, `gitops.ts` is the only place that
  * decides *how*, and the daemon is the only thing that holds both.
  */
 export type RunPublisher = (

package/systemd/omp-conductor.service.example

@@ -1,13 +1,12 @@
 # Example unit for a supervised omp-conductor daemon.
 #
 # Why MemoryMax exists: worker and orchestrator sessions are child processes of
-# this service (#125 moved them out of the daemon's own process so they can run
-# as a different OS principal). They stay in this unit's cgroup, so MemoryMax
-# still governs the fleet's total footprint — it is just no longer a ceiling on
-# one process. With the default two workers plus the orchestrator session,
-# journald on a reference 7.6 GB host recorded Memory peaks of ~3.2–4.2 GB for
-# this unit (issue #51). That is expected load, not a leak — and on a shared VPS
-# it is enough to thrash swap or OOM the daemon mid-flight (orphan path).
+# this service and stay inside its cgroup, so MemoryMax governs the whole
+# fleet's footprint rather than one process. With the default two workers plus
+# the orchestrator session, journald on a reference 7.6 GB host recorded Memory
+# peaks of ~3.2–4.2 GB for this unit (issue #51). That is expected load, not a
+# leak — and on a shared VPS it is enough to thrash swap or OOM the daemon
+# mid-flight (orphan path).
 #
 # Before enabling:
 #   1. Set User=/Group=/HOME=/PATH for the account that owns ~/.omp/conductor.
@@ -16,66 +15,6 @@
 #      consider MemoryMax=3G.
 #   4. Do not co-locate ClickHouse + other multi-GB services beside a 2-worker
 #      fleet on a ≤8 GB box.
-#   5. For credentials.isolation=per-run, do the one-time provisioning below.
-#      Without it the daemon runs unprotected (isolation=none) and says so in
-#      `omp-conductor status`.
-#
-# One-time provisioning for credentials.isolation=per-run (#125)
-# --------------------------------------------------------------
-# Model-executed code must not run as the account that holds the GitHub
-# credential. Accounts, groups, a shared root and the daemon's own home mode
-# are what make that true; environment scrubbing is only accident-prevention
-# and does not survive a determined session running as the same uid.
-#
-# Do NOT hand-copy the steps. `omp-conductor boundary-setup` prints the exact
-# idempotent commands, generated from the same constants the startup probe then
-# checks — a hand-maintained copy here would drift from what the daemon demands
-# and fail at first dispatch instead of at provisioning time. It needs no config
-# and must be run BEFORE `setup`, because setup writes worktree and mirror paths
-# into the shared root it creates:
-#
-#   omp-conductor boundary-setup --slots 2       # read what it will do
-#   omp-conductor boundary-setup --slots 2 | sudo bash
-#   sudo systemctl restart omp-conductor.service
-#
-# What it establishes, and why each part is load-bearing:
-#
-#   * conductor-agent-<n> per concurrent slot, plus conductor-agent-orch. The
-#     orchestrator's is distinct so it cannot reach a run checkout, and it is
-#     launched with no supplementary group at all.
-#   * conductor-daemon — the daemon account ONLY. Lets it fetch a run branch,
-#     salvage a killed run and reclaim the tree. A slot principal must NEVER be
-#     in it; that absence is what keeps sibling runs apart, and the probe suite
-#     asserts it from a live session.
-#   * conductor-runs — every slot. Read-only access to the shared mirror that
-#     run repos borrow objects from. A run being able to READ another run's
-#     objects there is the documented residual of sharing one object store.
-#   * /var/lib/omp-conductor, mode 0711 — worktrees, mirrors, per-run session
-#     transcripts and per-run boundary homes. OUTSIDE the state directory,
-#     because that stays 0700 (it holds conductor.db and the WAL SQLite keeps
-#     recreating, so a searchable parent would publish fleet history to every
-#     local account), and outside $HOME for the reason below.
-#   * $HOME at 0711 with credential leaves closed (.ssh, .config/gh 0700;
-#     .npmrc, .git-credentials 0600). Searchable because the runtime and the
-#     installed package live in it — a 0700 home kills every worker before it
-#     connects, and no shell-based probe notices — and closed at the leaves
-#     because that is where the boundary actually rests. The daemon re-checks
-#     this empirically at dispatch and refuses if a slot can read any
-#     credential path.
-#
-# The restart is REQUIRED, not tidiness: supplementary group membership is fixed
-# when a process starts, so without it the daemon's live credentials lack
-# conductor-daemon even though `getent` shows it, and it would chown every run
-# repo to a group it cannot itself use.
-#
-#   # util-linux, for the privilege-dropping launcher. Without it the probe
-#   # reports mechanism `none` — there is deliberately no hand-rolled
-#   # spawn({uid,gid}) fallback, because a child launched that way can hold
-#   # CAP_SETUID and setuid() straight back to a sibling run or to the daemon.
-#   sudo apt-get install -y util-linux
-#
-# Verify with `omp-conductor status`: the `boundary` row names the mechanism
-# that is actually live and lists what it does not close.
 #
 # Install:
 #   sudo install -m 0644 omp-conductor.service.example /etc/systemd/system/omp-conductor.service
@@ -95,43 +34,10 @@ Type=simple
 User=fleet
 Group=fleet
 Environment=HOME=/home/fleet
-# systemd's default PATH has no user installs; include wherever `omp` /
-# `omp-conductor`, `gh` and `setpriv` live on this host.
+# systemd's default PATH has no user installs; include wherever `omp`,
+# `omp-conductor` and `gh` live on this host.
 Environment=PATH=/home/fleet/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin
 
-# These capabilities exist to be DROPPED INTO run children, never inherited by
-# them (#125). The daemon stays the unprivileged `fleet` account — a capability
-# grant on an existing account is a narrower blast radius than running as root
-# or shipping a setuid binary, both of which widen exactly what this exists to
-# narrow.
-#
-# Every run child is launched through `setpriv`, which sets the group list, then
-# the gid, then the uid, empties the permitted/effective/inheritable/ambient
-# capability sets, drops the bounding set, sets PR_SET_NO_NEW_PRIVS, and only
-# then execs. DO NOT "simplify" this into a raw spawn({uid,gid}): ambient
-# capabilities survive execve for ordinary binaries, so a child launched that
-# way holds CAP_SETUID itself and can setuid() back to another principal —
-# including a sibling run's. That voids the entire boundary while appearing to
-# work, which is the worst possible outcome for a security change.
-#
-# CAP_SETPCAP is present solely so the launcher can empty the child's capability
-# BOUNDING set (PR_CAPBSET_DROP requires it in the caller's own permitted set).
-# It is dropped along with everything else before the session child execs. A
-# host that refuses to grant it takes the documented fallback instead: the
-# launcher omits --bounding-set=-all, the child still ends with every other set
-# empty behind NoNewPrivs, and `status` reports the non-empty CapBnd as a named
-# residual rather than ignoring it.
-# Supplementary groups are fixed when a process starts, so a daemon that was
-# already running when these accounts were provisioned can never join them --
-# and a unit with no User= gets no initgroups call at all, so it comes up with
-# `Groups: 0` even once /etc/group is correct. Declared here so membership is a
-# property of the unit rather than of how it happened to be started; after a
-# `daemon-reload` and a restart, `omp-conductor status` reports the probed
-# mechanism as uid-pool.
-SupplementaryGroups=conductor-daemon conductor-runs
-AmbientCapabilities=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_SETPCAP
-
 WorkingDirectory=/home/fleet
 
 # Foreground daemon so systemd tracks MainPID. `omp-conductor start` backgrounds;