omp-conductor 0.5.0 → 0.5.1

package/README.md

@@ -149,21 +149,26 @@ be present. If you run omp, it is.
 Also required on the host:
 
 - `bun`: the CLI and the daemon run on it (`Bun.serve` backs `/healthz`).
-- **A model credential a *session* can reach.** Sessions inherit the daemon's
-  environment and `$HOME` unmodified, so a session authenticates with whatever
-  the daemon authenticates with, and with nothing else. A login recorded under a
-  different account's `~/.omp/agent/agent.db` is invisible to the service, and
-  its workers die at turn 0 with `No model selected`. Two supported shapes:
-  - a model API key in the **daemon's** environment (`ANTHROPIC_API_KEY`,
-    `OPENAI_API_KEY`, …).
-  - the harness's **auth broker** — `omp auth-broker serve` plus `omp auth-broker
-    token`, or `auth.broker.url` / `auth.broker.token` in
-    `~/.omp/agent/config.yml`. The conductor resolves that connection and injects
-    it into each session. Refresh tokens stay in the broker and a session receives
-    only short-lived access tokens.
-
-  With neither, `omp-conductor status` reports the hold and **nothing is
-  dispatched** — no issue is claimed and no attempt is spent.
+- **A model credential the *daemon's own account* can reach.** Sessions are child
+  processes of the daemon and inherit its environment and `$HOME` unmodified, so a
+  session authenticates with exactly what the daemon authenticates with — nothing
+  is injected and nothing is scrubbed. Any shape the harness itself understands
+  works, including the ordinary one:
+  - an **OAuth login** already recorded for that account (`omp` login state under
+    its `~/.omp/agent`). This is the common case and needs no configuration.
+  - a model **API key** in the daemon's environment (`ANTHROPIC_API_KEY`,
+    `OPENAI_API_KEY`, …). Note systemd starts the service with a clean
+    environment, so it has to be an `Environment=` line on the unit, not something
+    exported in your shell.
+  - the harness's **auth broker**, configured in that account's
+    `~/.omp/agent/config.yml`.
+
+  The account matters more than the shape: a login recorded under a *different*
+  account is invisible to the service. A unit running `User=fleet` cannot see
+  `root`'s login, and workers then die at turn 0 with `No model selected`. Such a
+  run is classified `env-start-failure` and charges **neither** the failure budget
+  nor a continuation — an environment fault is not a failed implementation — but
+  nothing dispatches successfully until the credential is reachable.
 - `gh`, already authenticated: every tracker operation shells out to it, so the
   daemon never handles a GitHub token itself.
 - `git`: mirrors and worktrees.
@@ -2149,18 +2154,29 @@ on run X asking to merge run Y's PR is not merely wrong, it is unexpressible.
 
 ```
 <state dir>/verbs/                 daemon-owned, mode 0711
-  run-7-9a783d877d422b9e.sock      0600, run 7's and nothing else's
-  run-9-1c40e2a5b6d3f018.sock      0600, run 9's and nothing else's
-  orchestrator-4b1f...c2.sock      0600, a third, distinct one
+  run-7-9a783d877d422b9e.sock      0600, bound for run 7
+  run-9-1c40e2a5b6d3f018.sock      0600, bound for run 9
+  orchestrator-4b1f...c2.sock      0600, the orchestrator's
 ```
 
-`0711` is load-bearing and the obvious `0700` does not work: *connecting* needs
-**search** (`+x`) on every path component, not read. So the directory is
-traversable by a process that already knows a socket's name, listable by none,
-and writable by none but the daemon — that last one is what stops anything else
-on the host unlinking a socket and binding an impostor in its place. A
-*directory* per run, owned by the run, would hand exactly that power back, and
-is deliberately not used.
+**What these modes buy, and what they do not.** They keep every *other local
+account* out: `0711` on the parent is traversable but not listable, so no other
+user can enumerate the fleet's sockets, the suffixes are unguessable, and only
+the daemon's uid can connect to a `0600` socket at all.
+
+They are **not** a boundary between runs. Sessions are child processes of the
+daemon running as its own uid, so a session matches the owner class on all of
+these: it could list the directory and connect to a sibling's socket. Each run is
+*handed* its own path and nothing else, which is a convention the run has no
+reason to break — not an enforcement. What makes breaking it visible is the
+[ledger](#the-ledger): every call is recorded with the channel it
+arrived on, so a worker calling on another run's socket is in the record.
+
+Closing that properly needs the sessions to be different OS principals. A
+per-run credential boundary that did exactly this shipped and was removed in
+0.5.0 — it worked, and the cost was that it also hid the operator's own model
+credential from every session, so nothing could start. It is not worth
+re-litigating without solving that first.
 
 Before binding, the daemon verifies every component of the path is owned by
 itself (or root), free of symlinks, and unwritable by anyone else; a failed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/omp.ts

@@ -428,9 +428,11 @@ export interface CreateSessionOptions {
  */
 export async function createSession(opts: CreateSessionOptions): Promise<AgentSessionLike> {
   const owned = opts.socketPath === undefined;
-  // 0711, not 0700: searchable, so a session reaches its own socket by name, but
-  // not listable — nothing here can enumerate the other sockets, unlink one and
-  // bind an impostor in its place. Same reasoning as the run workspace parent.
+  // 0711, not 0700: searchable but not listable, which keeps *other local
+  // accounts* from enumerating this directory. It is not a restraint on the
+  // session — that runs as this process's own uid, matches the owner class and
+  // therefore has `rwx` here regardless. Same reasoning, and the same limit, as
+  // the run workspace parent.
   const socketDir = owned ? mkdtempSync(join(tmpdir(), "omp-session-")) : dirname(opts.socketPath ?? "");
   const socketPath = opts.socketPath ?? join(socketDir, "s");
   mkdirSync(socketDir, { recursive: true, mode: 0o711 });

package/src/verbs/server.ts

@@ -51,7 +51,6 @@ import {
   secureBoundSocket,
   socketFd,
   unlinkStaleSocket,
-  traversalProblem,
   validateSocketPath,
   type PeerReader,
   type SocketOwnership,
@@ -935,13 +934,6 @@ export interface ListenOptions {
   daemonUid?: number;
   /** Injected in tests; the real one chowns, which needs privilege. */
   secure?: typeof secureBoundSocket;
-  /**
-   * Injected in tests for the same reason `secure` is: the traversal rule is
-   * about the *deployment's* directory chain, and a test that needs a bound
-   * socket in a developer's `0750` home is not the case it is asserting. The
-   * rule itself is pinned directly in `socket.test.ts`.
-   */
-  traversal?: typeof traversalProblem;
 }
 
 /**

package/src/verbs/socket.ts

@@ -1,28 +1,34 @@
 /**
  * The authenticated local transport the mutation verbs ride on (#126).
  *
- * The permission layout is the whole security argument, and the obvious one
- * does not work. A socket `chmod 0600` and `chown`ed to a run's principal is
- * *unreachable* if its parent is the daemon's usual `0700`: connecting needs
- * **search** (`+x`) on every path component, not read. So:
+ * **What the permission layout does and does not buy, stated plainly.** Every
+ * session is a child process running as the daemon's own uid. So the modes here
+ * keep *other local accounts* out; they do not restrain a session, because a
+ * session matches the owner class and owner bits are `rwx`. A session that
+ * wanted to list the socket directory, unlink a sibling's socket and bind an
+ * impostor in its place could do so, and nothing in this file would stop it.
  *
- *  - the parent directory is daemon-owned and mode **`0711`** — searchable by
- *    run principals, listable by none, and **writable by none but the daemon**;
- *  - each socket is `0600`, owned by the principal of the run it belongs to, so
- *    exactly one uid can connect, and the orchestrator's is a third distinct one;
- *  - the parent being non-writable is what stops a run unlinking a sibling's
- *    socket or binding an impostor listener in its place. A per-run directory
- *    owned by the run principal would hand back exactly that power, and is why
- *    the obvious layout is not used here.
+ * That is not a hole this file is hiding — it is the consequence of running
+ * sessions as the daemon. What restrains a session is the mechanical worktree
+ * gate on its structured tools plus the fact that publication only happens
+ * through the daemon, and what makes a bad push *visible* is the verb ledger.
  *
- * Two further rules make that layout hold rather than merely describe it:
- * {@link validateSocketPath} refuses to bind under a path anyone else could
- * have tampered with, and {@link peerVerdict} compares the connecting uid the
- * kernel reports against the uid the daemon allocated for that run.
+ * So the layout is:
  *
- * Every decision in this file is a pure function of `lstat` results or of a
- * credentials struct, so the adversarial cases are testable without root and
- * without a second uid.
+ *  - the parent directory is daemon-owned and mode **`0711`** — searchable so a
+ *    caller reaches a socket it can already name, not listable and not writable
+ *    by any account other than the daemon's;
+ *  - each socket is `0600`, so only the daemon's uid can connect at all;
+ *  - the per-socket suffix is random, so the path is not guessable by a foreign
+ *    account that cannot list the directory.
+ *
+ * Two further rules make that hold rather than merely describe it:
+ * {@link validateSocketPath} refuses to bind under a path anyone else could have
+ * tampered with, and {@link peerVerdict} compares the connecting uid the kernel
+ * reports against the daemon's own.
+ *
+ * Every decision in this file is a pure function of `lstat` results, so the
+ * adversarial cases are testable without root and without a second uid.
  */
 
 import { dlopen, FFIType, ptr, suffix } from "bun:ffi";
@@ -31,10 +37,10 @@ import { chmodSync, chownSync, lstatSync, mkdirSync, rmSync } from "node:fs";
 import type { Stats } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 
-/** Searchable by run principals, listable by none, writable only by the daemon. */
+/** Searchable, but not listable or writable by any account but the daemon's. */
 export const VERB_DIR_MODE = 0o711;
 
-/** One uid may connect. The parent's `0711` is what makes that reachable. */
+/** Only the daemon's uid may connect. The parent's `0711` keeps that reachable. */
 export const VERB_SOCKET_MODE = 0o600;
 
 /**
@@ -196,53 +202,6 @@ export function validateSocketPath(
   return undefined;
 }
 
-/**
- * The first path component a *foreign* uid could not search through, or
- * `undefined` when the whole chain is traversable.
- *
- * Checked rather than assumed, because this is the failure the layout in this
- * file is most likely to hit in the field and the least likely to be noticed:
- * connecting to a socket needs `+x` on **every** component, and the daemon's
- * own state directory is `0700`. A run principal would then be refused at the
- * state directory rather than at the socket, with an `EACCES` that names a
- * directory nobody was thinking about.
- *
- * Only meaningful when the run has a distinct principal. Under one uid the
- * daemon is the caller, so `0700` is traversable by definition — which is
- * exactly why this cannot be left to be discovered on the first fleet that
- * turns per-run principals on.
- *
- * Deliberately reported rather than repaired: the fix is `chmod o+x` on a
- * directory that may be the operator's home, and a daemon that silently
- * widened `$HOME` would be trading a legible refusal for a surprise.
- */
-export function traversalProblem(
-  path: string,
-  lstat: (p: string) => Stats = lstatSync,
-): SocketPathProblem | undefined {
-  for (const component of ancestors(path)) {
-    let stat: Stats;
-    try {
-      stat = lstat(component);
-    } catch {
-      return {
-        component,
-        fault: "missing",
-        message: `verb socket parent ${component} does not exist or cannot be read`,
-      };
-    }
-    if ((stat.mode & 0o001) === 0) {
-      return {
-        component,
-        fault: "not-searchable",
-        message:
-          `verb socket parent ${component} is mode ${(stat.mode & 0o7777).toString(8)}, which a run principal ` +
-          `cannot search through. Connecting needs +x on every component. Run: chmod o+x ${component}`,
-      };
-    }
-  }
-  return undefined;
-}
 
 /**
  * Remove a stale socket at `path`, and only ever one the daemon itself placed.

package/src/worktree.ts

@@ -312,9 +312,11 @@ export async function addRunRepo(
   branch: string,
 ): Promise<{ path: string; reattached: boolean }> {
   const mirrorPath = await ensureMirror(repo, mirrorRoot);
-  // 0711: searchable, so a session reaches its own checkout by name; not
-  // listable, so it cannot enumerate its siblings; not writable, so it cannot
-  // create or unlink one. Same reasoning as the socket parent directory.
+  // 0711: searchable but not listable, so no *other local account* can
+  // enumerate the fleet's checkouts. It does not stop a session reaching a
+  // sibling's tree: sessions run as the daemon's own uid, so the owner bits are
+  // theirs. What confines a worker to its own checkout is the mechanical
+  // worktree gate on its tools, not this mode.
   mkdirSync(workspaceRoot, { recursive: true, mode: 0o711 });
 
   const runRepo = worktreePathFor(workspaceRoot, issue);