omp-conductor 0.5.6 → 0.7.0

package/README.md

@@ -204,6 +204,26 @@ Also required on the host:
     unconfigured rather than guessed at, on the grounds that a health row which
     reads green over a broken contract is worse than one that overstates a fault.
 
+  - **A fleet that answers instead of narrating** needs one key, set once:
+    `/telegram set profile daemon` (omp-telegram 0.11.0 or newer). Without it the
+    bridge behaves as it does on a laptop: it finalizes a real Telegram message
+    per assistant turn for as long as a conversation is active — so one answer
+    arrives as several messages, and a message that lands mid-tick keeps relaying
+    that tick's internal turns — and it posts every local run's closing text to
+    `notifyChat`, which on a host whose runs are heartbeat ticks means each tick's
+    working prose. The profile switches all of it off at the transport: text
+    reaches Telegram only through `telegram_send` / `telegram_ask`, the idle post
+    is suppressed, and `telegram_ask` stays mounted and aimed at the paired owner
+    on every turn — including a locally injected tick, so it also removes the need
+    for `notifyMode` above. Approval and blocked-input pings still fire; those
+    mean a human is needed, which is the point of the channel.
+
+    `omp-conductor status` reports an interactive profile on the `telegram` row,
+    and every tick composed on one carries a prompt line saying so. Note the two
+    settings pull against each other before the profile exists: setting
+    `notifyMode` to make `telegram_ask` mountable is exactly what arms the idle
+    post, so the correctly askable fleet was also the loud one.
+
   With neither, tier 2 degrades to a comment on the issue. Nothing is broken in
   that configuration: it is supported, just slower to reach you.
 
@@ -1898,6 +1918,7 @@ omp-conductor release-pane [--project NAME]
 omp-conductor tail <issue> [--project NAME]
 omp-conductor extend <issue> --turns N [--project NAME]
 omp-conductor unblock <issue> [--force] [--project NAME]
+omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
 omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
 omp-conductor report --text TEXT [--kind material|digest] [--project NAME]
 omp-conductor decision open --question TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
@@ -1929,6 +1950,7 @@ omp-conductor help
 | `tail <issue>` | Follow the newest run for that issue: the worker's assistant text as `assistant: …` and each tool it calls as `tool: <name>`, printed as they land. Workers are omp sessions inside the daemon rather than terminals, so this is the only way to watch one live — a herdr pane running it becomes an observation window. Starts from the top of the transcript, not the end, so attaching to a run that is already ten turns in shows those ten turns. Exits `1` with `no run recorded for #N` when the issue has never been dispatched, or `no transcript yet (state: …)` when the attempt has not opened one. Otherwise it runs until `Ctrl-C`, or until the run has finished and its transcript has been silent for five seconds, and prints `run ended: <state>`. |
 | `extend <issue> --turns N [--project NAME]` | Monotonically raise that live worker's effective turn ceiling through its owning daemon. The current omp session keeps running; no restart or continuation is created. The daemon persists the new ceiling for `status` and rejects missing, settled, cap-killed, equal, or lower requests instead of implying that an immutable session changed. |
 | `unblock <issue> [--force]` | Remove that issue's `blocked` and `failed` labels so an answered escalation can be claimed again. `agent:in-progress` comes off too, but only when the newest recorded run is terminal — that row is the proof no worker still owns the issue, so a live run keeps the label, and so does an issue with no run row at all. Run history remains intact: blocks consume the independent continuation budget, not failed implementation attempts. The output reports both budgets and warns when either will make the next tick escalate instead of dispatch. **Refuses, clearing nothing and exiting `3`, when the newest attempt's work could not be committed and its worktree is the only copy** — re-claiming removes that tree. `--force` records the operator's acceptance on the run row and then clears; the salvage failure stays in history. Exits `2` when the issue number is missing or malformed. |
+| `verb <conductor_*> [--arg k=v ...]` | Run one [mediated verb](#the-mediated-verbs-126) as the orchestrator, from the CLI — the external-orchestrator half of the verb surface. Every argument goes in as a `--arg k=v` string; an orchestrator can merge (`conductor_pr_merge`), label (`conductor_label`), release (`conductor_release`), update a branch (`conductor_pr_update_branch`) or title/body (`conductor_pr_update`), or read PR state (`conductor_pr_status`). The daemon applies the same checks and writes the same ledger rows a session's call would; a missing `--arg` is refused exactly as a missing tool argument is, worker-only verbs (`conductor_push`, `conductor_pr_create`) are refused with `role-not-allowed`, and a refusal exits `3`. An unknown verb exits `2`. |
 | `friction <kind> --detail TEXT [--issue N]` | Record one bounded judgment the daemon cannot infer: an escalation belonged in a digest, or a tick report was noise/surprising. The detail is limited to 160 characters. One event never changes policy; three observations inside seven days make the aggregate eligible for one Learning-loop prompt, followed by a seven-day cooldown. |
 | `report --text TEXT [--kind material|digest]` | Hand a rendered report to the daemon's durable outbox. The text is persisted **before** anything is sent and the command prints a report id; the daemon then owns delivery, retries on a bounded backoff, and records the Telegram message id it actually got back. Delivery is [at-least-once](#report-delivery-the-outbox) — a crash mid-send is retried and the retry says it may be a repeat — so `delivered` is never proof of exactly one message. `--kind digest` is accepted at most once per local day, decided from the ledger rather than from what the session remembers sending; an unknown `--kind` exits `2` rather than quietly becoming a material report. Anything undelivered shows in `status` with its age. |
 | `decision open --question TEXT [--blocks TEXT] [--resolves-when COND]` | Record a question the orchestrator has put to you, and print its id. A question that lives only in a session's context is lost at the next compaction — after which it is either asked twice or dropped silently. `--resolves-when` attaches a machine-checkable condition: `pr-merged:<https url>`, `issue-closed:<n>`, or `npm-version:<pkg>@<version>`; anything else exits `2` listing the three forms. See [The decision ledger](#the-decision-ledger-136). |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.5.6",
+  "version": "0.7.0",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/approval-surface.ts

@@ -33,6 +33,17 @@
  * The legacy `away: true` boolean counts: `loadAccess()` migrates it to
  * `notifyMode: "away"` on read, so a fleet still carrying it resolves a target
  * and must not be reported as broken.
+ *
+ * Since omp-telegram 0.11.0 there is a second way for a locally injected turn to
+ * resolve a target, and it counts here for the same reason the legacy boolean
+ * does: `profile: "daemon"` makes `notifyTarget()` resolve without `notifyMode`
+ * at all, because the profile *is* the headless contract — explicit-only
+ * outbound, no idle notify post, and `telegram_ask` targeted at the paired owner
+ * on every turn including a cron tick. A fleet carrying it has the surface #114
+ * was about, so demanding `notifyMode` beside it would be the false alarm this
+ * file exists to avoid. The `notifyMode` paths are all still live: an older
+ * plugin ignores the `profile` key entirely, and a host running one keeps
+ * working unchanged.
  */
 
 import { readFileSync } from "node:fs";
@@ -44,7 +55,22 @@ import { dirname, join } from "node:path";
  *  says whether it can be called must name the same thing. */
 export const TELEGRAM_APPROVAL_TOOL = "telegram_ask";
 
-export type ApprovalSurface = { kind: "ready" } | { kind: "missing"; reason: string };
+export type ApprovalSurface =
+  | { kind: "ready"; /** `notifyMode` from access.json, when the surface read it
+                        (#169): whether end-of-turn text reaches the operator's
+                        chat, so the tick's delivery rule can say so truthfully. */
+      notifyMode?: string }
+  | { kind: "missing"; reason: string };
+
+/** Whether the Telegram bridge is running the headless contract, or merely
+ *  configured well enough to answer a question.
+ *
+ *  Two questions, not one, which is why this is a separate answer from
+ *  {@link ApprovalSurface}: a fleet can be perfectly *askable* and still be
+ *  narrating every turn into its operator's chat. `interactive` carries the
+ *  reason because both readers of it — a tick prompt and a status row — have to
+ *  name the remedy, and one spelling of it keeps them in agreement. */
+export type DaemonProfileSurface = { kind: "daemon" } | { kind: "interactive"; reason: string };
 
 /** One checked read of a JSON property, so nothing below asserts a shape the
  *  parse never proved. Anything that is not a plain object, or a key that is
@@ -156,7 +182,20 @@ export function readApprovalSurface(path: string): ApprovalSurface {
     };
   }
   const mode = field(access, "notifyMode");
-  const active = mode === "away" || mode === "always" || field(access, "away") === true;
+  // Three spellings of the same fact, and none of them is redundant.
+  // `notifyMode` is what an interactive host sets; `away: true` is the retired
+  // boolean `loadAccess()` migrates on read; `profile: "daemon"` is the headless
+  // contract, which omp-telegram ≥ 0.11.0 treats as its own reason to resolve a
+  // notify target (`notifyTarget()` gates on `notifyMode || profile === "daemon"`
+  // and `before_agent_start` mounts `telegram_ask` on the same disjunction). A
+  // daemon-profile fleet with no `notifyMode` is therefore *more* answerable than
+  // the configuration #114 asked for, not less, and reporting it broken would be
+  // the every-interval false alarm this file was written to prevent.
+  const active =
+    mode === "away" ||
+    mode === "always" ||
+    field(access, "away") === true ||
+    field(access, "profile") === "daemon";
   if (!active) {
     return {
       kind: "missing",
@@ -223,7 +262,7 @@ export function readApprovalSurface(path: string): ApprovalSurface {
           "set notifyChat to the paired owner id",
       };
     }
-    return { kind: "ready" };
+    return { kind: "ready", notifyMode: mode === undefined ? undefined : String(mode) };
   }
 
   // A group destination needs a policy entry, and that policy must admit the
@@ -249,5 +288,60 @@ export function readApprovalSurface(path: string): ApprovalSurface {
         `paired owner (${owner}) in its allowFrom, so their answer would be rejected`,
     };
   }
-  return { kind: "ready" };
+  return { kind: "ready", notifyMode: mode === undefined ? undefined : String(mode) };
+}
+
+/**
+ * Reads the same access file and answers the other question: does visible
+ * assistant text stay out of the operator's chat?
+ *
+ * A separate read rather than a field on {@link ApprovalSurface}, because the
+ * two faults have different remedies and a caller may care about only one. This
+ * one is about *noise*: without the profile, omp-telegram relays a real Telegram
+ * message per assistant turn for as long as a conversation is marked active
+ * (`outbound.ts` `onTurnEnd`), and — because the fleet sets `notifyMode` for the
+ * approval surface above — posts every local run's closing text to the notify
+ * chat from its `agent_end` handler. So a correctly *askable* fleet is exactly
+ * the one that narrates: the two settings pull against each other, which is why
+ * both are checked and only the profile silences the second.
+ *
+ * One key decides it, deliberately. `profile: "daemon"` is omp-telegram ≥ 0.11.0's
+ * whole headless contract — explicit-only outbound, no idle/final notify post,
+ * `telegram_ask` targeted at the paired owner on every turn — so verifying it is
+ * one comparison rather than three inferences about `streaming`, `notifyMode` and
+ * turn origin that would drift the moment the plugin changes. Anything other
+ * than the literal string is `interactive`: `loadAccess()` drops every other
+ * value to undefined, so `"DAEMON"` and `5` are not the contract on the host
+ * either, and reporting them as one would promise a suppression nothing applied.
+ *
+ * Never throws, and never writes: conductor reads this file, the operator's
+ * `/telegram set profile daemon` is what changes it. An unreadable or corrupt
+ * file answers `interactive` for the reason the whole module fails closed — a
+ * green signal over an unproven contract is what #114 was.
+ */
+export function readDaemonProfile(accessPath: string): DaemonProfileSurface {
+  const remedy = "assistant text can auto-relay to Telegram — run `/telegram set profile daemon`";
+  let access: unknown;
+  try {
+    access = JSON.parse(readFileSync(accessPath, "utf8"));
+  } catch {
+    return {
+      kind: "interactive",
+      reason: `cannot read or parse ${accessPath}, so no telegram profile is proven; ${remedy}`,
+    };
+  }
+  if (access === null || typeof access !== "object" || Array.isArray(access)) {
+    return {
+      kind: "interactive",
+      reason: `${accessPath} is not an object, so no telegram profile is proven; ${remedy}`,
+    };
+  }
+  const profile = field(access, "profile");
+  if (profile === "daemon") return { kind: "daemon" };
+  // An absent key reads as "default" rather than "undefined": that is the word
+  // the plugin's own `/telegram status` line and its `profile: daemon | default`
+  // help text use, and an operator matching a status row against this reason
+  // should not have to translate.
+  const observed = profile === undefined ? "default" : JSON.stringify(profile);
+  return { kind: "interactive", reason: `telegram profile is ${observed}; ${remedy}` };
 }

package/src/board.ts

@@ -1,4 +1,4 @@
-import { closeSync, openSync, readSync, statSync } from "node:fs";
+import { closeSync, existsSync, openSync, readSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { emitKeypressEvents } from "node:readline";
 import { findProject, loadConfig, resolveCaps } from "./config.ts";
@@ -16,10 +16,21 @@ import { dbPath, openStore } from "./store.ts";
 import { formatTranscriptLine } from "./transcript.ts";
 import { makeTracker } from "./tracker/github.ts";
 import { planUsageBadge, readPlanUsage, sharedUsageSource } from "./usage.ts";
-import type { AdmissionHoldReason, ProjectConfig, RunRecord, RunState, Store } from "./types.ts";
+import type {
+  AdmissionHoldReason,
+  PrVerification,
+  ProjectConfig,
+  RunRecord,
+  RunState,
+  Store,
+} from "./types.ts";
 
 const REFRESH_MS = 1_000;
 const HEALTH_REFRESH_MS = 10_000;
+/** Cadence for re-verifying pushed rows against GitHub — deliberately slower
+ *  than the board's health/label probe: it is one `gh` call per pushed row, and
+ *  pull-request state does not move at 1 Hz. #173. */
+const PR_REFRESH_MS = 60_000;
 const MERGED_HISTORY_MS = 24 * 60 * 60_000;
 const TRANSCRIPT_BYTES = 64 * 1024;
 const MIN_WIDTH = 50;
@@ -53,6 +64,7 @@ const COLUMN_DEFS = [
   { key: "blocked", title: "BLOCKED" },
   { key: "failed", title: "FAILED" },
   { key: "orphaned", title: "ORPHANED" },
+  { key: "parked", title: "PARKED" },
   { key: "merged", title: "MERGED" },
   { key: "history", title: "HISTORY" },
 ] as const satisfies readonly { key: string; title: string }[];
@@ -69,6 +81,23 @@ const LIVE_LANES: Partial<Record<RunState, BoardLane>> = {
   "pushed-green": "green",
 };
 
+/** Terminal run states that park an issue nobody has acted on: a human cleared
+ *  the state labels but the issue is still open, so its last run is the story
+ *  that has to stay visible — #173. Differs from {@link LIVE_LANES} in that
+ *  these are rows, never current work, and from MERGED in that they are not a
+ *  happy resolution. */
+const PARKED_STATES = new Set<RunState>(["blocked", "failed", "killed", "orphaned"]);
+
+/** Whether a terminal blocked/failed run is wearing its own state label. When
+ *  the label is absent the run row is the only record of what happened, so the
+ *  card and detail header say "last run: <state>" rather than presenting it as
+ *  current — #173, the same distinction that parks the lane. */
+function isLastRun(run: RunRecord, labels: BoardLabels): boolean {
+  if (run.state === "blocked") return !labels.blocked.has(run.issue);
+  if (run.state === "failed") return !labels.failed.has(run.issue);
+  return false;
+}
+
 type DaemonBoardState = "stopped" | "ok" | "unreachable" | "other-project";
 
 /**
@@ -114,6 +143,11 @@ export interface BoardLabels {
   inProgress: ReadonlySet<number>;
   blocked: ReadonlySet<number>;
   failed: ReadonlySet<number>;
+  /** Issues whose newest run is terminal and unlabelled but that are still open
+   *  on the tracker — the PARKED lane (#173), probed on the same 10s cadence as
+   *  the label sets. An issue missing from this set (closed, or the probe could
+   *  not tell) keeps today's HISTORY/undefined behaviour rather than parking. */
+  open: ReadonlySet<number>;
   /** Epoch ms of the last read that succeeded; 0 when none has. */
   readAt: number;
   /** Message from the most recent failed read. The sets above are then the last
@@ -129,6 +163,7 @@ const UNREAD_LABELS: BoardLabels = {
   inProgress: new Set<number>(),
   blocked: new Set<number>(),
   failed: new Set<number>(),
+  open: new Set<number>(),
   readAt: 0,
 };
 
@@ -137,10 +172,18 @@ export interface BoardSnapshot {
   status: StatusSnapshot;
   health: BoardHealth;
   labels: BoardLabels;
+  /** Live re-verification of pushed rows (#173): run id → what the tracker says
+   *  the PR looks like now. Rendered as a `now:` suffix on the card. */
+  pr: ReadonlyMap<string, { status: PrVerification["status"]; reason: string }>;
   runs: RunRecord[];
   now: number;
 }
 
+/** The card state a {@link PrVerification.status} reads as in the UI. */
+function prLabel(status: PrVerification["status"]): string {
+  return status === "green" ? "green" : status === "failed" ? "red" : "pending";
+}
+
 export interface BoardCursor {
   column: number;
   card: number;
@@ -166,6 +209,7 @@ function ansiColor(key: BoardLane): string {
     case "claimed":
     case "blocked":
     case "orphaned":
+    case "parked":
       return YELLOW;
     case "failed":
       return RED;
@@ -266,6 +310,13 @@ function laneOf(
   if (queued.has(issue)) return "queue";
   if (run?.state === "merged") return "merged";
   if (run === undefined) return undefined;
+  // PARKED (#173): a terminal run row with no state or queue label left on it,
+  // on an issue the tracker says is still open. A human cleared the labels but
+  // has not acted — the blank lane the four labels used to imply is a lie, and
+  // closed or unreadable issues keep the HISTORY/undefined fallthrough below.
+  // Deliberately not subject to MERGED_HISTORY_MS: parked work does not stop
+  // being the issue's last word after 24 hours.
+  if (PARKED_STATES.has(run.state) && labels.open.has(issue)) return "parked";
   // What is left is a terminal run row with no current claim on it — a closed
   // issue, or one a human already cleared. Recent rows stay readable under
   // HISTORY for the same 24 hours MERGED uses; older ones are not news.
@@ -424,6 +475,21 @@ function runCardLines(run: RunRecord, snapshot: BoardSnapshot): string[] {
     `attempt ${run.attempt} · ${run.turns}/${run.maxTurns}t`,
     `$${run.spendUsd.toFixed(2)} · ${duration}`,
   ];
+  // #173: a live re-verification of a pushed row, when the 60s probe has one.
+  // Guarded on the pushed states: a stale entry must not follow a row that
+  // settled into another lane and keep claiming "now: green" about a PR that
+  // already merged or failed.
+  const live =
+    run.state === "pushed-green" || run.state === "pushed-pending" ? snapshot.pr.get(run.id) : undefined;
+  if (live !== undefined) {
+    const reason = live.reason.split(/\s+/, 1)[0] ?? "";
+    lines.push(
+      live.status === "failed" ? `now: red — ${reason === "" ? "failed" : reason}` : `now: ${prLabel(live.status)}`,
+    );
+  }
+  // #173: a terminal blocked/failed run whose state label is gone reads as the
+  // lane it sits in — which the label being absent made PARKED, not the truth.
+  if (isLastRun(run, snapshot.labels)) lines.push(`last run: ${run.state}`);
   // Ordered by what needs a human first. An unsalvaged tree outranks even a
   // last error: the error describes a run that is over, the tree is work that
   // is still at risk and an issue that will not dispatch (#118).
@@ -567,6 +633,9 @@ function renderBoardColumns(snapshot: BoardSnapshot, cursor: BoardCursor, width:
 
 function readTranscript(run: RunRecord): string[] {
   if (run.sessionFile === undefined) return [`No transcript yet (state: ${run.state}).`];
+  // #172: a row name that never materialised is "not yet", not a read error —
+  // rendering it as `Transcript unavailable` would blame the file for existing.
+  if (!existsSync(run.sessionFile)) return [`No transcript yet (state: ${run.state}).`];
   let fd: number | undefined;
   try {
     const size = statSync(run.sessionFile).size;
@@ -617,8 +686,11 @@ function renderDetail(snapshot: BoardSnapshot, cursor: BoardCursor, width: numbe
   }
 
   const run = card.run;
+  // #173: a blocked/failed run whose label is gone is the reason this card is
+  // parked; the header says so rather than presenting the state as current.
+  const stateShown = isLastRun(run, snapshot.labels) ? `last run: ${run.state}` : run.state;
   const metadata = [
-    styledCell(` RUN #${run.issue}  ${run.repo}  ${run.state} `, width, `${BOLD}${REVERSE}`),
+    styledCell(` RUN #${run.issue}  ${run.repo}  ${stateShown} `, width, `${BOLD}${REVERSE}`),
     styledCell(`attempt ${run.attempt}  ·  ${run.turns}/${run.maxTurns} turns  ·  $${run.spendUsd.toFixed(2)}  ·  ${humanDuration((run.endedAt ?? snapshot.now) - run.startedAt)}`, width),
     styledCell(`branch ${run.branch}`, width, DIM),
     styledCell(`worktree ${run.worktree || "removed"}`, width, DIM),
@@ -739,7 +811,11 @@ async function probeBoardHealth(project: ProjectConfig): Promise<BoardHealth> {
  * why, because blanking QUEUE and FAILED is a louder lie than showing them
  * stale — {@link labelFact} puts the staleness in the header.
  */
-async function probeBoardLabels(project: ProjectConfig, previous?: BoardLabels): Promise<BoardLabels> {
+async function probeBoardLabels(
+  project: ProjectConfig,
+  store: Store,
+  previous?: BoardLabels,
+): Promise<BoardLabels> {
   const openIssuesLabelled = async (label: string): Promise<Set<number>> =>
     new Set((await makeTracker({ ...project, queueLabel: label }).listReady()).map((issue) => issue.number));
   try {
@@ -749,7 +825,26 @@ async function probeBoardLabels(project: ProjectConfig, previous?: BoardLabels):
       openIssuesLabelled(project.stateLabels.blocked),
       openIssuesLabelled(project.stateLabels.failed),
     ]);
-    return { queued, inProgress, blocked, failed, readAt: Date.now() };
+    // PARKED candidates: the newest run per issue, terminal, non-merged, and
+    // wearing no state or queue label. Exactly the rows {@link laneOf} would
+    // otherwise fall through on. Bounded by `recentRuns`' own recentJobs limit,
+    // issued in parallel, and cached: a failed read keeps the last set.
+    const labelled = new Set([...queued, ...inProgress, ...blocked, ...failed]);
+    const newestRun = new Map<number, RunRecord>();
+    for (const run of store.recentRuns(project.name, Date.now() - MERGED_HISTORY_MS)) {
+      if (!newestRun.has(run.issue)) newestRun.set(run.issue, run);
+    }
+    const parkedCandidates = [...newestRun.values()].filter(
+      (run) => PARKED_STATES.has(run.state) && !labelled.has(run.issue),
+    );
+    const open = new Set<number>();
+    await Promise.all(
+      parkedCandidates.map(async (run) => {
+        const state = await makeTracker(project).issueState(run.issue);
+        if (state === "open") open.add(run.issue);
+      }),
+    );
+    return { queued, inProgress, blocked, failed, open, readAt: Date.now() };
   } catch (err) {
     return {
       ...(previous ?? UNREAD_LABELS),
@@ -827,11 +922,17 @@ export async function runBoard(projectName?: string): Promise<void> {
   let notice = "";
   let [health, labels, planUsage] = await Promise.all([
     probeBoardHealth(project),
-    probeBoardLabels(project),
+    probeBoardLabels(project, store),
     readPlanUsage(caps.planUsage, sharedUsageSource()),
   ]);
   let healthAt = Date.now();
   let healthRefresh: Promise<void> | undefined;
+  // Live re-verification of pushed rows (#173): cached per run id, refreshed on
+  // the slow PR cadence so a `gh` call per pushed row does not ride the 1 Hz
+  // repaint or the 10 s health gate.
+  const prProbe = new Map<string, { status: PrVerification["status"]; reason: string }>();
+  let prProbeAt = 0;
+  let prProbeRun: Promise<void> | undefined;
 
   emitKeypressEvents(process.stdin);
   const onKey = (_text: string, key: KeyInput): void => enqueue(queue, key, wake);
@@ -855,7 +956,7 @@ export async function runBoard(projectName?: string): Promise<void> {
         healthAt = now;
         healthRefresh = Promise.all([
           probeBoardHealth(project),
-          probeBoardLabels(project, labels),
+          probeBoardLabels(project, store, labels),
           // On the health cadence, not the 1s repaint: the provider read is a
           // subprocess, and an allowance does not move at 1 Hz.
           readPlanUsage(caps.planUsage, sharedUsageSource()),
@@ -873,11 +974,37 @@ export async function runBoard(projectName?: string): Promise<void> {
             healthRefresh = undefined;
           });
       }
+      // #173: re-verify pushed rows against the tracker on their own slow
+      // cadence, so red-shown-as-green and a moved head surface without paying
+      // for the read every second. A failed probe leaves the last verdicts in
+      // place (blanking a card's `now:` is a quieter lie than nothing).
+      if (now - prProbeAt >= PR_REFRESH_MS && prProbeRun === undefined) {
+        prProbeAt = now;
+        const rows = store.recentRuns(project.name, now - MERGED_HISTORY_MS).filter(
+          (run) => (run.state === "pushed-green" || run.state === "pushed-pending") && run.prUrl !== undefined && run.headSha !== undefined,
+        );
+        prProbeRun = (async () => {
+          const tracker = makeTracker(project);
+          await Promise.all(
+            rows.map(async (run) => {
+              const verified = await tracker.verifyPr(run.prUrl!, run.headSha!);
+              if (verified !== undefined) prProbe.set(run.id, { status: verified.status, reason: verified.reason });
+            }),
+          );
+        })()
+          .catch((err: unknown) => {
+            notice = `PR probe failed: ${err instanceof Error ? err.message : String(err)}`;
+          })
+          .finally(() => {
+            prProbeRun = undefined;
+          });
+      }
       const snapshot: BoardSnapshot = {
         project,
         status: statusSnapshotFromStore(project, caps, store, planUsage),
         health,
         labels,
+        pr: prProbe,
         runs: store.recentRuns(project.name, now - MERGED_HISTORY_MS),
         now,
       };

package/src/briefs/orchestrator.md

@@ -208,18 +208,23 @@ sent that way is undetectable when it does not arrive.
 
 ## Human messages
 
-A human writing to you between ticks is not a tick. Answer the question they
-actually asked, in one message, from evidence you already hold or go and fetch.
-
-Then stop. Do not continue loop narration in the same reply, and do not restate
-in-progress work unless they asked for it. The loop resumes on the next tick.
+A human writing to you between ticks is not a tick. Answer with a **single
+`telegram_send` call** — one message, the answer only, from evidence you already
+hold or go and fetch. Never answer as plain end-of-turn text: on this session,
+text you merely write reaches nobody — if you do not call `telegram_send`, the
+person gets silence. While handling any turn, produce no visible commentary
+between tool calls — reasoning stays in thinking, actions stay in tools.
+
+If the answer needs a decision from the operator (a choice, a yes/no, an
+approval), ask it with `telegram_ask` — never a numbered-options message via
+`telegram_send`, and never the generic `ask` UI. A cancelled or errored
+`telegram_ask` is a delivery failure, not an answer.
 
 A message may also reach you **mid-tick** (delivery is steering: it arrives
 between two of your tool calls). Treat it as an interrupt, not a new tick:
-answer it immediately with `telegram_send` in one message, then return to the
-duty you were in the middle of and finish it. Never abandon or restart the tick
-because a message arrived, and never batch the answer "for the report" — the
-person is waiting now.
+`telegram_send` the answer immediately, then return to the duty you were in the
+middle of and finish it. Never abandon or restart the tick because a message
+arrived, and never batch the answer "for the report" — the person is waiting now.
 
 ## Escalation tiers
 
@@ -285,6 +290,22 @@ what you asked for and what it decided — readable with `omp-conductor ledger`,
 including the refusals. That record is the point: a merge or a release the
 dispatcher did not perform is one nobody can account for afterwards.
 
+An external orchestrator (a session outside the daemon) runs the same verbs, with
+the same checks and the same ledger rows, through the CLI:
+
+```
+omp-conductor verb conductor_pr_merge --arg prUrl=<url> --arg headSha=<sha> --arg reason=<reason>
+omp-conductor verb conductor_label --arg issueUrl=<url> --arg label=<name> --arg action=add --arg reason=<reason>
+omp-conductor verb conductor_release --arg shape=git-tag --arg repo=<name> --arg reason=<reason> --arg tag=<tag>
+omp-conductor verb conductor_pr_update_branch --arg prUrl=<url>
+omp-conductor verb conductor_pr_update --arg prUrl=<url> --arg title=<title>
+```
+
+Each `--arg k=v` is one argument, read as a string. Worker-only verbs
+(`conductor_push`, `conductor_pr_create`) are refused with `role-not-allowed` —
+an external orchestrator never pushes or opens a PR, exactly as this floor's
+sessions do not.
+
 | Tool | Yours when | What the dispatcher checks before acting |
 | --- | --- | --- |
 | `conductor_pr_status` | always | Nothing to gate: it reads. |

package/src/briefs/policy.md

@@ -74,10 +74,11 @@ Your report scope is **`{{REPORT_SCOPE}}`**. All three scopes, spelled out:
   issue you pulled off the queue, a cap that stopped the fleet. A tick where
   nothing changed still says nothing — "no change" is not an event.
 
-**Delivery.** Your end-of-turn text reaches your operator only on a turn that
-*began* as an inbound Telegram message. A tick did not: it is injected locally,
-so a report you merely write at the end of one is read by nobody, however well
-you wrote it. Hand every reportable event to the conductor's outbox instead:
+**Delivery.** Never rely on end-of-turn text reaching anyone. The only delivery
+paths are `omp-conductor report` (reports — persisted, daemon-retried),
+`telegram_send` (a person who is waiting), and `telegram_ask` (a decision).
+Everything else is noise or silence. Hand every reportable event to the
+conductor's outbox:
 
 ```
 omp-conductor report --text "<the whole report>"          # a material event