omp-conductor 0.5.0 → 0.5.2

package/README.md

@@ -149,21 +149,27 @@ be present. If you run omp, it is.
 Also required on the host:
 
 - `bun`: the CLI and the daemon run on it (`Bun.serve` backs `/healthz`).
-- **A model credential a *session* can reach.** Sessions inherit the daemon's
-  environment and `$HOME` unmodified, so a session authenticates with whatever
-  the daemon authenticates with, and with nothing else. A login recorded under a
-  different account's `~/.omp/agent/agent.db` is invisible to the service, and
-  its workers die at turn 0 with `No model selected`. Two supported shapes:
-  - a model API key in the **daemon's** environment (`ANTHROPIC_API_KEY`,
-    `OPENAI_API_KEY`, …).
-  - the harness's **auth broker** — `omp auth-broker serve` plus `omp auth-broker
-    token`, or `auth.broker.url` / `auth.broker.token` in
-    `~/.omp/agent/config.yml`. The conductor resolves that connection and injects
-    it into each session. Refresh tokens stay in the broker and a session receives
-    only short-lived access tokens.
-
-  With neither, `omp-conductor status` reports the hold and **nothing is
-  dispatched** — no issue is claimed and no attempt is spent.
+- **A model credential the *daemon's own account* can reach.** Sessions are child
+  processes of the daemon and inherit its environment and `$HOME` unmodified, so a
+  session authenticates with exactly what the daemon authenticates with — nothing
+  is injected and nothing is scrubbed. Any shape the harness itself understands
+  works, including the ordinary one:
+  - an **OAuth login** already recorded for that account (`omp` login state under
+    its `~/.omp/agent`). This is the common case and needs no configuration.
+  - a model **API key** in the daemon's environment (`ANTHROPIC_API_KEY`,
+    `OPENAI_API_KEY`, …). Note systemd starts the service with a clean
+    environment, so it has to be an `Environment=` line on the unit, not something
+    exported in your shell.
+  - the harness's **auth broker**, configured in that account's
+    `~/.omp/agent/config.yml`.
+
+  The account matters more than the shape: a login recorded under a *different*
+  account is invisible to the service. A unit running `User=fleet` cannot see
+  `root`'s login, and workers then die at turn 0 with `No model selected`. Such a
+  run is classified `env-start-failure` and charges **neither** the failure budget
+  nor a continuation — an environment fault is not a failed implementation, and a
+  run that recorded no turn, no commit and no error did not attempt anything — but
+  nothing dispatches successfully until the credential is reachable.
 - `gh`, already authenticated: every tracker operation shells out to it, so the
   daemon never handles a GitHub token itself.
 - `git`: mirrors and worktrees.
@@ -2149,18 +2155,29 @@ on run X asking to merge run Y's PR is not merely wrong, it is unexpressible.
 
 ```
 <state dir>/verbs/                 daemon-owned, mode 0711
-  run-7-9a783d877d422b9e.sock      0600, run 7's and nothing else's
-  run-9-1c40e2a5b6d3f018.sock      0600, run 9's and nothing else's
-  orchestrator-4b1f...c2.sock      0600, a third, distinct one
+  run-7-9a783d877d422b9e.sock      0600, bound for run 7
+  run-9-1c40e2a5b6d3f018.sock      0600, bound for run 9
+  orchestrator-4b1f...c2.sock      0600, the orchestrator's
 ```
 
-`0711` is load-bearing and the obvious `0700` does not work: *connecting* needs
-**search** (`+x`) on every path component, not read. So the directory is
-traversable by a process that already knows a socket's name, listable by none,
-and writable by none but the daemon — that last one is what stops anything else
-on the host unlinking a socket and binding an impostor in its place. A
-*directory* per run, owned by the run, would hand exactly that power back, and
-is deliberately not used.
+**What these modes buy, and what they do not.** They keep every *other local
+account* out: `0711` on the parent is traversable but not listable, so no other
+user can enumerate the fleet's sockets, the suffixes are unguessable, and only
+the daemon's uid can connect to a `0600` socket at all.
+
+They are **not** a boundary between runs. Sessions are child processes of the
+daemon running as its own uid, so a session matches the owner class on all of
+these: it could list the directory and connect to a sibling's socket. Each run is
+*handed* its own path and nothing else, which is a convention the run has no
+reason to break — not an enforcement. What makes breaking it visible is the
+[ledger](#the-ledger): every call is recorded with the channel it
+arrived on, so a worker calling on another run's socket is in the record.
+
+Closing that properly needs the sessions to be different OS principals. A
+per-run credential boundary that did exactly this shipped and was removed in
+0.5.0 — it worked, and the cost was that it also hid the operator's own model
+credential from every session, so nothing could start. It is not worth
+re-litigating without solving that first.
 
 Before binding, the daemon verifies every component of the path is owned by
 itself (or root), free of symlinks, and unwritable by anyone else; a failed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/failure-class.ts

@@ -65,10 +65,11 @@ function normalise(state: string): string {
 /**
  * Harness start failures, matched on the text it prints.
  *
- * Deliberately a small closed list rather than "anything at turn 0": a run that
- * ended at turn 0 for a reason nobody has named is exactly what `unknown` is for,
- * and quietly declaring it an environment fault would waive an attempt that may
- * have been genuinely spent.
+ * A small closed list rather than "any error at turn 0": a run that ended at
+ * turn 0 with an error nobody has named is exactly what `unknown` is for, and
+ * declaring that an environment fault would waive an attempt that may have been
+ * genuinely spent. A mirror fetch that failed is not a session that never
+ * started.
  */
 const START_FAILURE_SIGNATURES = [
   "no model selected",
@@ -90,6 +91,42 @@ export function startFailure(lastError: string | undefined): string | undefined
   return hit === undefined ? undefined : lastError.split("\n")[0]?.trim();
 }
 
+/**
+ * Evidence that this run never started, or `undefined` when something did happen.
+ *
+ * Two shapes, and the second is the one the reference fleet actually produced.
+ *
+ * 1. Turn zero with a recognised harness start error — the session said why.
+ * 2. Turn zero, **no artifacts and no error text at all**. The row records
+ *    nothing: no turn, no head, no salvage, not even a message. On the reference
+ *    fleet every worker died at turn 0 with `No model selected`, and that string
+ *    went into the tier-1 escalation rather than into `lastError` — so the rows
+ *    for issues 373, 359, 343 and 319 carry no error whatsoever and were logged
+ *    `unknown`, each charging an implementation attempt (#152).
+ *
+ * Shape 2 is a deliberate judgement, not a loosening. There is no evidence an
+ * attempt was spent, so charging one is charging for a run whose only trace is
+ * that it existed; and the two ways of being wrong are not symmetric — being
+ * generous grants an issue one more attempt a human will see, while being strict
+ * leaves it permanently undispatchable for a fault that was never in its code.
+ * A turn-0 run carrying an *unrecognised* error still reads `unknown`, because
+ * there the row does say something happened.
+ *
+ * Shared with the store's one-time repair so history and future agree.
+ */
+export function neverStarted(
+  run: Pick<RunRecord, "turns" | "lastError" | "prUrl" | "headSha" | "salvageSha">,
+): string | undefined {
+  if (run.turns !== 0) return undefined;
+  const detail = startFailure(run.lastError);
+  if (detail !== undefined) return `the session never started: ${detail}`;
+  const produced = run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined;
+  if (!produced && run.lastError === undefined) {
+    return "the session never started: no turns, no commit and no error were recorded";
+  }
+  return undefined;
+}
+
 export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classification {
   const hasArtifacts = run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined;
 
@@ -113,19 +150,14 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
     };
   }
 
-  // Turn zero with an explicit harness start error is the most classifiable
-  // failure there is, and the least deserving of an implementation attempt: the
-  // session never got as far as reading the issue. 27 recoveries on the reference
-  // fleet were this, logged as `unknown` while the session's own output carried
-  // the literal string `No model selected` (#152).
-  if ((run.state === "failed" || run.state === "killed") && run.turns === 0) {
-    const detail = startFailure(run.lastError);
-    if (detail !== undefined) {
-      return {
-        cls: "env-start-failure",
-        recovery: "escalate",
-        evidence: `the session never started: ${detail}`,
-      };
+  // A run that never started is the most classifiable failure there is, and the
+  // least deserving of an implementation attempt: the session did not get as far
+  // as reading the issue. See {@link neverStarted} for the two shapes and why the
+  // second one counts.
+  if (run.state === "failed" || run.state === "killed") {
+    const evidence = neverStarted(run);
+    if (evidence !== undefined) {
+      return { cls: "env-start-failure", recovery: "escalate", evidence };
     }
   }
 

package/src/omp.ts

@@ -428,9 +428,11 @@ export interface CreateSessionOptions {
  */
 export async function createSession(opts: CreateSessionOptions): Promise<AgentSessionLike> {
   const owned = opts.socketPath === undefined;
-  // 0711, not 0700: searchable, so a session reaches its own socket by name, but
-  // not listable — nothing here can enumerate the other sockets, unlink one and
-  // bind an impostor in its place. Same reasoning as the run workspace parent.
+  // 0711, not 0700: searchable but not listable, which keeps *other local
+  // accounts* from enumerating this directory. It is not a restraint on the
+  // session — that runs as this process's own uid, matches the owner class and
+  // therefore has `rwx` here regardless. Same reasoning, and the same limit, as
+  // the run workspace parent.
   const socketDir = owned ? mkdtempSync(join(tmpdir(), "omp-session-")) : dirname(opts.socketPath ?? "");
   const socketPath = opts.socketPath ?? join(socketDir, "s");
   mkdirSync(socketDir, { recursive: true, mode: 0o711 });

package/src/store.ts

@@ -15,7 +15,7 @@ import { dirname, join } from "node:path";
 
 import { stateDir } from "./config.ts";
 import { DECISION_TTL_MS, DEFAULT_CAPS } from "./types.ts";
-import { startFailure } from "./failure-class.ts";
+import { neverStarted } from "./failure-class.ts";
 import type {
   DecisionDraft,
   FailureClass,
@@ -693,18 +693,32 @@ export function openStore(dbPath: string): Store {
   // charged, and an issue sitting at its cap for a fault that was never in its
   // code stays undispatchable forever.
   //
-  // Narrow by construction: `turns = 0` (the session never took a turn), an
-  // error the classifier itself recognises as a start failure, and a class of
+  // Narrow by construction, and narrow through the CLASSIFIER's own predicate
+  // rather than a second copy of the rule: {@link neverStarted}. A class of
   // exactly `unknown` — a row a human or a later release classified as anything
-  // else is left alone. Idempotent for free: afterwards those rows read
-  // `env-start-failure`, which the WHERE no longer matches.
+  // else is left alone — plus zero turns and either a recognised start error or
+  // nothing recorded at all. A turn-0 row carrying an unrecognised error (a
+  // failed mirror fetch, say) is untouched. Idempotent for free: afterwards these
+  // rows read `env-start-failure`, which the WHERE no longer matches.
   const misread = db
     .query<
-      { id: string; lastError: string | null },
+      { id: string; lastError: string | null; prUrl: string | null; headSha: string | null; salvageSha: string | null },
       []
-    >(`SELECT id, lastError FROM runs WHERE failureClass = 'unknown' AND turns = 0 AND lastError IS NOT NULL`)
+    >(
+      `SELECT id, lastError, prUrl, headSha, salvageSha FROM runs
+        WHERE failureClass = 'unknown' AND turns = 0`,
+    )
     .all()
-    .filter((row) => startFailure(row.lastError ?? undefined) !== undefined);
+    .filter(
+      (row) =>
+        neverStarted({
+          turns: 0,
+          ...(row.lastError === null ? {} : { lastError: row.lastError }),
+          ...(row.prUrl === null ? {} : { prUrl: row.prUrl }),
+          ...(row.headSha === null ? {} : { headSha: row.headSha }),
+          ...(row.salvageSha === null ? {} : { salvageSha: row.salvageSha }),
+        }) !== undefined,
+    );
   if (misread.length > 0) {
     const reclassify = db.query<unknown, [string]>(
       `UPDATE runs SET failureClass = 'env-start-failure' WHERE id = ?`,

package/src/verbs/server.ts

@@ -51,7 +51,6 @@ import {
   secureBoundSocket,
   socketFd,
   unlinkStaleSocket,
-  traversalProblem,
   validateSocketPath,
   type PeerReader,
   type SocketOwnership,
@@ -935,13 +934,6 @@ export interface ListenOptions {
   daemonUid?: number;
   /** Injected in tests; the real one chowns, which needs privilege. */
   secure?: typeof secureBoundSocket;
-  /**
-   * Injected in tests for the same reason `secure` is: the traversal rule is
-   * about the *deployment's* directory chain, and a test that needs a bound
-   * socket in a developer's `0750` home is not the case it is asserting. The
-   * rule itself is pinned directly in `socket.test.ts`.
-   */
-  traversal?: typeof traversalProblem;
 }
 
 /**

package/src/verbs/socket.ts

@@ -1,28 +1,34 @@
 /**
  * The authenticated local transport the mutation verbs ride on (#126).
  *
- * The permission layout is the whole security argument, and the obvious one
- * does not work. A socket `chmod 0600` and `chown`ed to a run's principal is
- * *unreachable* if its parent is the daemon's usual `0700`: connecting needs
- * **search** (`+x`) on every path component, not read. So:
+ * **What the permission layout does and does not buy, stated plainly.** Every
+ * session is a child process running as the daemon's own uid. So the modes here
+ * keep *other local accounts* out; they do not restrain a session, because a
+ * session matches the owner class and owner bits are `rwx`. A session that
+ * wanted to list the socket directory, unlink a sibling's socket and bind an
+ * impostor in its place could do so, and nothing in this file would stop it.
  *
- *  - the parent directory is daemon-owned and mode **`0711`** — searchable by
- *    run principals, listable by none, and **writable by none but the daemon**;
- *  - each socket is `0600`, owned by the principal of the run it belongs to, so
- *    exactly one uid can connect, and the orchestrator's is a third distinct one;
- *  - the parent being non-writable is what stops a run unlinking a sibling's
- *    socket or binding an impostor listener in its place. A per-run directory
- *    owned by the run principal would hand back exactly that power, and is why
- *    the obvious layout is not used here.
+ * That is not a hole this file is hiding — it is the consequence of running
+ * sessions as the daemon. What restrains a session is the mechanical worktree
+ * gate on its structured tools plus the fact that publication only happens
+ * through the daemon, and what makes a bad push *visible* is the verb ledger.
  *
- * Two further rules make that layout hold rather than merely describe it:
- * {@link validateSocketPath} refuses to bind under a path anyone else could
- * have tampered with, and {@link peerVerdict} compares the connecting uid the
- * kernel reports against the uid the daemon allocated for that run.
+ * So the layout is:
  *
- * Every decision in this file is a pure function of `lstat` results or of a
- * credentials struct, so the adversarial cases are testable without root and
- * without a second uid.
+ *  - the parent directory is daemon-owned and mode **`0711`** — searchable so a
+ *    caller reaches a socket it can already name, not listable and not writable
+ *    by any account other than the daemon's;
+ *  - each socket is `0600`, so only the daemon's uid can connect at all;
+ *  - the per-socket suffix is random, so the path is not guessable by a foreign
+ *    account that cannot list the directory.
+ *
+ * Two further rules make that hold rather than merely describe it:
+ * {@link validateSocketPath} refuses to bind under a path anyone else could have
+ * tampered with, and {@link peerVerdict} compares the connecting uid the kernel
+ * reports against the daemon's own.
+ *
+ * Every decision in this file is a pure function of `lstat` results, so the
+ * adversarial cases are testable without root and without a second uid.
  */
 
 import { dlopen, FFIType, ptr, suffix } from "bun:ffi";
@@ -31,10 +37,10 @@ import { chmodSync, chownSync, lstatSync, mkdirSync, rmSync } from "node:fs";
 import type { Stats } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 
-/** Searchable by run principals, listable by none, writable only by the daemon. */
+/** Searchable, but not listable or writable by any account but the daemon's. */
 export const VERB_DIR_MODE = 0o711;
 
-/** One uid may connect. The parent's `0711` is what makes that reachable. */
+/** Only the daemon's uid may connect. The parent's `0711` keeps that reachable. */
 export const VERB_SOCKET_MODE = 0o600;
 
 /**
@@ -196,53 +202,6 @@ export function validateSocketPath(
   return undefined;
 }
 
-/**
- * The first path component a *foreign* uid could not search through, or
- * `undefined` when the whole chain is traversable.
- *
- * Checked rather than assumed, because this is the failure the layout in this
- * file is most likely to hit in the field and the least likely to be noticed:
- * connecting to a socket needs `+x` on **every** component, and the daemon's
- * own state directory is `0700`. A run principal would then be refused at the
- * state directory rather than at the socket, with an `EACCES` that names a
- * directory nobody was thinking about.
- *
- * Only meaningful when the run has a distinct principal. Under one uid the
- * daemon is the caller, so `0700` is traversable by definition — which is
- * exactly why this cannot be left to be discovered on the first fleet that
- * turns per-run principals on.
- *
- * Deliberately reported rather than repaired: the fix is `chmod o+x` on a
- * directory that may be the operator's home, and a daemon that silently
- * widened `$HOME` would be trading a legible refusal for a surprise.
- */
-export function traversalProblem(
-  path: string,
-  lstat: (p: string) => Stats = lstatSync,
-): SocketPathProblem | undefined {
-  for (const component of ancestors(path)) {
-    let stat: Stats;
-    try {
-      stat = lstat(component);
-    } catch {
-      return {
-        component,
-        fault: "missing",
-        message: `verb socket parent ${component} does not exist or cannot be read`,
-      };
-    }
-    if ((stat.mode & 0o001) === 0) {
-      return {
-        component,
-        fault: "not-searchable",
-        message:
-          `verb socket parent ${component} is mode ${(stat.mode & 0o7777).toString(8)}, which a run principal ` +
-          `cannot search through. Connecting needs +x on every component. Run: chmod o+x ${component}`,
-      };
-    }
-  }
-  return undefined;
-}
 
 /**
  * Remove a stale socket at `path`, and only ever one the daemon itself placed.

package/src/worktree.ts

@@ -312,9 +312,11 @@ export async function addRunRepo(
   branch: string,
 ): Promise<{ path: string; reattached: boolean }> {
   const mirrorPath = await ensureMirror(repo, mirrorRoot);
-  // 0711: searchable, so a session reaches its own checkout by name; not
-  // listable, so it cannot enumerate its siblings; not writable, so it cannot
-  // create or unlink one. Same reasoning as the socket parent directory.
+  // 0711: searchable but not listable, so no *other local account* can
+  // enumerate the fleet's checkouts. It does not stop a session reaching a
+  // sibling's tree: sessions run as the daemon's own uid, so the owner bits are
+  // theirs. What confines a worker to its own checkout is the mechanical
+  // worktree gate on its tools, not this mode.
   mkdirSync(workspaceRoot, { recursive: true, mode: 0o711 });
 
   const runRepo = worktreePathFor(workspaceRoot, issue);