omp-conductor 0.6.0 → 0.7.1

package/README.md

@@ -1918,6 +1918,7 @@ omp-conductor release-pane [--project NAME]
 omp-conductor tail <issue> [--project NAME]
 omp-conductor extend <issue> --turns N [--project NAME]
 omp-conductor unblock <issue> [--force] [--project NAME]
+omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
 omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
 omp-conductor report --text TEXT [--kind material|digest] [--project NAME]
 omp-conductor decision open --question TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
@@ -1949,6 +1950,7 @@ omp-conductor help
 | `tail <issue>` | Follow the newest run for that issue: the worker's assistant text as `assistant: …` and each tool it calls as `tool: <name>`, printed as they land. Workers are omp sessions inside the daemon rather than terminals, so this is the only way to watch one live — a herdr pane running it becomes an observation window. Starts from the top of the transcript, not the end, so attaching to a run that is already ten turns in shows those ten turns. Exits `1` with `no run recorded for #N` when the issue has never been dispatched, or `no transcript yet (state: …)` when the attempt has not opened one. Otherwise it runs until `Ctrl-C`, or until the run has finished and its transcript has been silent for five seconds, and prints `run ended: <state>`. |
 | `extend <issue> --turns N [--project NAME]` | Monotonically raise that live worker's effective turn ceiling through its owning daemon. The current omp session keeps running; no restart or continuation is created. The daemon persists the new ceiling for `status` and rejects missing, settled, cap-killed, equal, or lower requests instead of implying that an immutable session changed. |
 | `unblock <issue> [--force]` | Remove that issue's `blocked` and `failed` labels so an answered escalation can be claimed again. `agent:in-progress` comes off too, but only when the newest recorded run is terminal — that row is the proof no worker still owns the issue, so a live run keeps the label, and so does an issue with no run row at all. Run history remains intact: blocks consume the independent continuation budget, not failed implementation attempts. The output reports both budgets and warns when either will make the next tick escalate instead of dispatch. **Refuses, clearing nothing and exiting `3`, when the newest attempt's work could not be committed and its worktree is the only copy** — re-claiming removes that tree. `--force` records the operator's acceptance on the run row and then clears; the salvage failure stays in history. Exits `2` when the issue number is missing or malformed. |
+| `verb <conductor_*> [--arg k=v ...]` | Run one [mediated verb](#the-mediated-verbs-126) as the orchestrator, from the CLI — the external-orchestrator half of the verb surface. Every argument goes in as a `--arg k=v` string; an orchestrator can merge (`conductor_pr_merge`), label (`conductor_label`), release (`conductor_release`), update a branch (`conductor_pr_update_branch`) or title/body (`conductor_pr_update`), or read PR state (`conductor_pr_status`). The daemon applies the same checks and writes the same ledger rows a session's call would; a missing `--arg` is refused exactly as a missing tool argument is, worker-only verbs (`conductor_push`, `conductor_pr_create`) are refused with `role-not-allowed`, and a refusal exits `3`. An unknown verb exits `2`. |
 | `friction <kind> --detail TEXT [--issue N]` | Record one bounded judgment the daemon cannot infer: an escalation belonged in a digest, or a tick report was noise/surprising. The detail is limited to 160 characters. One event never changes policy; three observations inside seven days make the aggregate eligible for one Learning-loop prompt, followed by a seven-day cooldown. |
 | `report --text TEXT [--kind material|digest]` | Hand a rendered report to the daemon's durable outbox. The text is persisted **before** anything is sent and the command prints a report id; the daemon then owns delivery, retries on a bounded backoff, and records the Telegram message id it actually got back. Delivery is [at-least-once](#report-delivery-the-outbox) — a crash mid-send is retried and the retry says it may be a repeat — so `delivered` is never proof of exactly one message. `--kind digest` is accepted at most once per local day, decided from the ledger rather than from what the session remembers sending; an unknown `--kind` exits `2` rather than quietly becoming a material report. Anything undelivered shows in `status` with its age. |
 | `decision open --question TEXT [--blocks TEXT] [--resolves-when COND]` | Record a question the orchestrator has put to you, and print its id. A question that lives only in a session's context is lost at the next compaction — after which it is either asked twice or dropped silently. `--resolves-when` attaches a machine-checkable condition: `pr-merged:<https url>`, `issue-closed:<n>`, or `npm-version:<pkg>@<version>`; anything else exits `2` listing the three forms. See [The decision ledger](#the-decision-ledger-136). |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/approval-surface.ts

@@ -55,7 +55,12 @@ import { dirname, join } from "node:path";
  *  says whether it can be called must name the same thing. */
 export const TELEGRAM_APPROVAL_TOOL = "telegram_ask";
 
-export type ApprovalSurface = { kind: "ready" } | { kind: "missing"; reason: string };
+export type ApprovalSurface =
+  | { kind: "ready"; /** `notifyMode` from access.json, when the surface read it
+                        (#169): whether end-of-turn text reaches the operator's
+                        chat, so the tick's delivery rule can say so truthfully. */
+      notifyMode?: string }
+  | { kind: "missing"; reason: string };
 
 /** Whether the Telegram bridge is running the headless contract, or merely
  *  configured well enough to answer a question.
@@ -257,7 +262,7 @@ export function readApprovalSurface(path: string): ApprovalSurface {
           "set notifyChat to the paired owner id",
       };
     }
-    return { kind: "ready" };
+    return { kind: "ready", notifyMode: mode === undefined ? undefined : String(mode) };
   }
 
   // A group destination needs a policy entry, and that policy must admit the
@@ -283,7 +288,7 @@ export function readApprovalSurface(path: string): ApprovalSurface {
         `paired owner (${owner}) in its allowFrom, so their answer would be rejected`,
     };
   }
-  return { kind: "ready" };
+  return { kind: "ready", notifyMode: mode === undefined ? undefined : String(mode) };
 }
 
 /**

package/src/board.ts

@@ -1,4 +1,4 @@
-import { closeSync, openSync, readSync, statSync } from "node:fs";
+import { closeSync, existsSync, openSync, readSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { emitKeypressEvents } from "node:readline";
 import { findProject, loadConfig, resolveCaps } from "./config.ts";
@@ -16,10 +16,21 @@ import { dbPath, openStore } from "./store.ts";
 import { formatTranscriptLine } from "./transcript.ts";
 import { makeTracker } from "./tracker/github.ts";
 import { planUsageBadge, readPlanUsage, sharedUsageSource } from "./usage.ts";
-import type { AdmissionHoldReason, ProjectConfig, RunRecord, RunState, Store } from "./types.ts";
+import type {
+  AdmissionHoldReason,
+  PrVerification,
+  ProjectConfig,
+  RunRecord,
+  RunState,
+  Store,
+} from "./types.ts";
 
 const REFRESH_MS = 1_000;
 const HEALTH_REFRESH_MS = 10_000;
+/** Cadence for re-verifying pushed rows against GitHub — deliberately slower
+ *  than the board's health/label probe: it is one `gh` call per pushed row, and
+ *  pull-request state does not move at 1 Hz. #173. */
+const PR_REFRESH_MS = 60_000;
 const MERGED_HISTORY_MS = 24 * 60 * 60_000;
 const TRANSCRIPT_BYTES = 64 * 1024;
 const MIN_WIDTH = 50;
@@ -53,6 +64,7 @@ const COLUMN_DEFS = [
   { key: "blocked", title: "BLOCKED" },
   { key: "failed", title: "FAILED" },
   { key: "orphaned", title: "ORPHANED" },
+  { key: "parked", title: "PARKED" },
   { key: "merged", title: "MERGED" },
   { key: "history", title: "HISTORY" },
 ] as const satisfies readonly { key: string; title: string }[];
@@ -69,6 +81,23 @@ const LIVE_LANES: Partial<Record<RunState, BoardLane>> = {
   "pushed-green": "green",
 };
 
+/** Terminal run states that park an issue nobody has acted on: a human cleared
+ *  the state labels but the issue is still open, so its last run is the story
+ *  that has to stay visible — #173. Differs from {@link LIVE_LANES} in that
+ *  these are rows, never current work, and from MERGED in that they are not a
+ *  happy resolution. */
+const PARKED_STATES = new Set<RunState>(["blocked", "failed", "killed", "orphaned"]);
+
+/** Whether a terminal blocked/failed run is wearing its own state label. When
+ *  the label is absent the run row is the only record of what happened, so the
+ *  card and detail header say "last run: <state>" rather than presenting it as
+ *  current — #173, the same distinction that parks the lane. */
+function isLastRun(run: RunRecord, labels: BoardLabels): boolean {
+  if (run.state === "blocked") return !labels.blocked.has(run.issue);
+  if (run.state === "failed") return !labels.failed.has(run.issue);
+  return false;
+}
+
 type DaemonBoardState = "stopped" | "ok" | "unreachable" | "other-project";
 
 /**
@@ -114,6 +143,11 @@ export interface BoardLabels {
   inProgress: ReadonlySet<number>;
   blocked: ReadonlySet<number>;
   failed: ReadonlySet<number>;
+  /** Issues whose newest run is terminal and unlabelled but that are still open
+   *  on the tracker — the PARKED lane (#173), probed on the same 10s cadence as
+   *  the label sets. An issue missing from this set (closed, or the probe could
+   *  not tell) keeps today's HISTORY/undefined behaviour rather than parking. */
+  open: ReadonlySet<number>;
   /** Epoch ms of the last read that succeeded; 0 when none has. */
   readAt: number;
   /** Message from the most recent failed read. The sets above are then the last
@@ -129,6 +163,7 @@ const UNREAD_LABELS: BoardLabels = {
   inProgress: new Set<number>(),
   blocked: new Set<number>(),
   failed: new Set<number>(),
+  open: new Set<number>(),
   readAt: 0,
 };
 
@@ -137,10 +172,18 @@ export interface BoardSnapshot {
   status: StatusSnapshot;
   health: BoardHealth;
   labels: BoardLabels;
+  /** Live re-verification of pushed rows (#173): run id → what the tracker says
+   *  the PR looks like now. Rendered as a `now:` suffix on the card. */
+  pr: ReadonlyMap<string, { status: PrVerification["status"]; reason: string }>;
   runs: RunRecord[];
   now: number;
 }
 
+/** The card state a {@link PrVerification.status} reads as in the UI. */
+function prLabel(status: PrVerification["status"]): string {
+  return status === "green" ? "green" : status === "failed" ? "red" : "pending";
+}
+
 export interface BoardCursor {
   column: number;
   card: number;
@@ -166,6 +209,7 @@ function ansiColor(key: BoardLane): string {
     case "claimed":
     case "blocked":
     case "orphaned":
+    case "parked":
       return YELLOW;
     case "failed":
       return RED;
@@ -266,6 +310,13 @@ function laneOf(
   if (queued.has(issue)) return "queue";
   if (run?.state === "merged") return "merged";
   if (run === undefined) return undefined;
+  // PARKED (#173): a terminal run row with no state or queue label left on it,
+  // on an issue the tracker says is still open. A human cleared the labels but
+  // has not acted — the blank lane the four labels used to imply is a lie, and
+  // closed or unreadable issues keep the HISTORY/undefined fallthrough below.
+  // Deliberately not subject to MERGED_HISTORY_MS: parked work does not stop
+  // being the issue's last word after 24 hours.
+  if (PARKED_STATES.has(run.state) && labels.open.has(issue)) return "parked";
   // What is left is a terminal run row with no current claim on it — a closed
   // issue, or one a human already cleared. Recent rows stay readable under
   // HISTORY for the same 24 hours MERGED uses; older ones are not news.
@@ -424,6 +475,21 @@ function runCardLines(run: RunRecord, snapshot: BoardSnapshot): string[] {
     `attempt ${run.attempt} · ${run.turns}/${run.maxTurns}t`,
     `$${run.spendUsd.toFixed(2)} · ${duration}`,
   ];
+  // #173: a live re-verification of a pushed row, when the 60s probe has one.
+  // Guarded on the pushed states: a stale entry must not follow a row that
+  // settled into another lane and keep claiming "now: green" about a PR that
+  // already merged or failed.
+  const live =
+    run.state === "pushed-green" || run.state === "pushed-pending" ? snapshot.pr.get(run.id) : undefined;
+  if (live !== undefined) {
+    const reason = live.reason.split(/\s+/, 1)[0] ?? "";
+    lines.push(
+      live.status === "failed" ? `now: red — ${reason === "" ? "failed" : reason}` : `now: ${prLabel(live.status)}`,
+    );
+  }
+  // #173: a terminal blocked/failed run whose state label is gone reads as the
+  // lane it sits in — which the label being absent made PARKED, not the truth.
+  if (isLastRun(run, snapshot.labels)) lines.push(`last run: ${run.state}`);
   // Ordered by what needs a human first. An unsalvaged tree outranks even a
   // last error: the error describes a run that is over, the tree is work that
   // is still at risk and an issue that will not dispatch (#118).
@@ -567,6 +633,9 @@ function renderBoardColumns(snapshot: BoardSnapshot, cursor: BoardCursor, width:
 
 function readTranscript(run: RunRecord): string[] {
   if (run.sessionFile === undefined) return [`No transcript yet (state: ${run.state}).`];
+  // #172: a row name that never materialised is "not yet", not a read error —
+  // rendering it as `Transcript unavailable` would blame the file for existing.
+  if (!existsSync(run.sessionFile)) return [`No transcript yet (state: ${run.state}).`];
   let fd: number | undefined;
   try {
     const size = statSync(run.sessionFile).size;
@@ -617,8 +686,11 @@ function renderDetail(snapshot: BoardSnapshot, cursor: BoardCursor, width: numbe
   }
 
   const run = card.run;
+  // #173: a blocked/failed run whose label is gone is the reason this card is
+  // parked; the header says so rather than presenting the state as current.
+  const stateShown = isLastRun(run, snapshot.labels) ? `last run: ${run.state}` : run.state;
   const metadata = [
-    styledCell(` RUN #${run.issue}  ${run.repo}  ${run.state} `, width, `${BOLD}${REVERSE}`),
+    styledCell(` RUN #${run.issue}  ${run.repo}  ${stateShown} `, width, `${BOLD}${REVERSE}`),
     styledCell(`attempt ${run.attempt}  ·  ${run.turns}/${run.maxTurns} turns  ·  $${run.spendUsd.toFixed(2)}  ·  ${humanDuration((run.endedAt ?? snapshot.now) - run.startedAt)}`, width),
     styledCell(`branch ${run.branch}`, width, DIM),
     styledCell(`worktree ${run.worktree || "removed"}`, width, DIM),
@@ -739,7 +811,11 @@ async function probeBoardHealth(project: ProjectConfig): Promise<BoardHealth> {
  * why, because blanking QUEUE and FAILED is a louder lie than showing them
  * stale — {@link labelFact} puts the staleness in the header.
  */
-async function probeBoardLabels(project: ProjectConfig, previous?: BoardLabels): Promise<BoardLabels> {
+async function probeBoardLabels(
+  project: ProjectConfig,
+  store: Store,
+  previous?: BoardLabels,
+): Promise<BoardLabels> {
   const openIssuesLabelled = async (label: string): Promise<Set<number>> =>
     new Set((await makeTracker({ ...project, queueLabel: label }).listReady()).map((issue) => issue.number));
   try {
@@ -749,7 +825,26 @@ async function probeBoardLabels(project: ProjectConfig, previous?: BoardLabels):
       openIssuesLabelled(project.stateLabels.blocked),
       openIssuesLabelled(project.stateLabels.failed),
     ]);
-    return { queued, inProgress, blocked, failed, readAt: Date.now() };
+    // PARKED candidates: the newest run per issue, terminal, non-merged, and
+    // wearing no state or queue label. Exactly the rows {@link laneOf} would
+    // otherwise fall through on. Bounded by `recentRuns`' own recentJobs limit,
+    // issued in parallel, and cached: a failed read keeps the last set.
+    const labelled = new Set([...queued, ...inProgress, ...blocked, ...failed]);
+    const newestRun = new Map<number, RunRecord>();
+    for (const run of store.recentRuns(project.name, Date.now() - MERGED_HISTORY_MS)) {
+      if (!newestRun.has(run.issue)) newestRun.set(run.issue, run);
+    }
+    const parkedCandidates = [...newestRun.values()].filter(
+      (run) => PARKED_STATES.has(run.state) && !labelled.has(run.issue),
+    );
+    const open = new Set<number>();
+    await Promise.all(
+      parkedCandidates.map(async (run) => {
+        const state = await makeTracker(project).issueState(run.issue);
+        if (state === "open") open.add(run.issue);
+      }),
+    );
+    return { queued, inProgress, blocked, failed, open, readAt: Date.now() };
   } catch (err) {
     return {
       ...(previous ?? UNREAD_LABELS),
@@ -827,11 +922,17 @@ export async function runBoard(projectName?: string): Promise<void> {
   let notice = "";
   let [health, labels, planUsage] = await Promise.all([
     probeBoardHealth(project),
-    probeBoardLabels(project),
+    probeBoardLabels(project, store),
     readPlanUsage(caps.planUsage, sharedUsageSource()),
   ]);
   let healthAt = Date.now();
   let healthRefresh: Promise<void> | undefined;
+  // Live re-verification of pushed rows (#173): cached per run id, refreshed on
+  // the slow PR cadence so a `gh` call per pushed row does not ride the 1 Hz
+  // repaint or the 10 s health gate.
+  const prProbe = new Map<string, { status: PrVerification["status"]; reason: string }>();
+  let prProbeAt = 0;
+  let prProbeRun: Promise<void> | undefined;
 
   emitKeypressEvents(process.stdin);
   const onKey = (_text: string, key: KeyInput): void => enqueue(queue, key, wake);
@@ -855,7 +956,7 @@ export async function runBoard(projectName?: string): Promise<void> {
         healthAt = now;
         healthRefresh = Promise.all([
           probeBoardHealth(project),
-          probeBoardLabels(project, labels),
+          probeBoardLabels(project, store, labels),
           // On the health cadence, not the 1s repaint: the provider read is a
           // subprocess, and an allowance does not move at 1 Hz.
           readPlanUsage(caps.planUsage, sharedUsageSource()),
@@ -873,11 +974,37 @@ export async function runBoard(projectName?: string): Promise<void> {
             healthRefresh = undefined;
           });
       }
+      // #173: re-verify pushed rows against the tracker on their own slow
+      // cadence, so red-shown-as-green and a moved head surface without paying
+      // for the read every second. A failed probe leaves the last verdicts in
+      // place (blanking a card's `now:` is a quieter lie than nothing).
+      if (now - prProbeAt >= PR_REFRESH_MS && prProbeRun === undefined) {
+        prProbeAt = now;
+        const rows = store.recentRuns(project.name, now - MERGED_HISTORY_MS).filter(
+          (run) => (run.state === "pushed-green" || run.state === "pushed-pending") && run.prUrl !== undefined && run.headSha !== undefined,
+        );
+        prProbeRun = (async () => {
+          const tracker = makeTracker(project);
+          await Promise.all(
+            rows.map(async (run) => {
+              const verified = await tracker.verifyPr(run.prUrl!, run.headSha!);
+              if (verified !== undefined) prProbe.set(run.id, { status: verified.status, reason: verified.reason });
+            }),
+          );
+        })()
+          .catch((err: unknown) => {
+            notice = `PR probe failed: ${err instanceof Error ? err.message : String(err)}`;
+          })
+          .finally(() => {
+            prProbeRun = undefined;
+          });
+      }
       const snapshot: BoardSnapshot = {
         project,
         status: statusSnapshotFromStore(project, caps, store, planUsage),
         health,
         labels,
+        pr: prProbe,
         runs: store.recentRuns(project.name, now - MERGED_HISTORY_MS),
         now,
       };

package/src/briefs/orchestrator.md

@@ -290,6 +290,22 @@ what you asked for and what it decided — readable with `omp-conductor ledger`,
 including the refusals. That record is the point: a merge or a release the
 dispatcher did not perform is one nobody can account for afterwards.
 
+An external orchestrator (a session outside the daemon) runs the same verbs, with
+the same checks and the same ledger rows, through the CLI:
+
+```
+omp-conductor verb conductor_pr_merge --arg prUrl=<url> --arg headSha=<sha> --arg reason=<reason>
+omp-conductor verb conductor_label --arg issueUrl=<url> --arg label=<name> --arg action=add --arg reason=<reason>
+omp-conductor verb conductor_release --arg shape=git-tag --arg repo=<name> --arg reason=<reason> --arg tag=<tag>
+omp-conductor verb conductor_pr_update_branch --arg prUrl=<url>
+omp-conductor verb conductor_pr_update --arg prUrl=<url> --arg title=<title>
+```
+
+Each `--arg k=v` is one argument, read as a string. Worker-only verbs
+(`conductor_push`, `conductor_pr_create`) are refused with `role-not-allowed` —
+an external orchestrator never pushes or opens a PR, exactly as this floor's
+sessions do not.
+
 | Tool | Yours when | What the dispatcher checks before acting |
 | --- | --- | --- |
 | `conductor_pr_status` | always | Nothing to gate: it reads. |

package/src/cli.ts

@@ -23,7 +23,7 @@ import {
 } from "./brief-upgrade.ts";
 import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
 import { CONDITION_FORMS, parseCondition } from "./decisions.ts";
-import { runDaemon, setPaused } from "./daemon.ts";
+import { isPaused, pausedAt, runDaemon, setPaused } from "./daemon.ts";
 import {
   armTicks,
   clearPaneHalt,
@@ -58,7 +58,9 @@ import { dbPath, LIVE_STATES, openStore } from "./store.ts";
 import { formatTranscriptLine } from "./transcript.ts";
 import { formatVerbLedgerEntry } from "./verbs/ledger.ts";
 import { makeTracker } from "./tracker/github.ts";
-import { REPORT_KINDS } from "./types.ts";
+import { githubVerbActions } from "./verbs/actions.ts";
+import { handleVerbCall, type VerbChannel } from "./verbs/server.ts";
+import { REPORT_KINDS, VERB_NAMES } from "./types.ts";
 import type { ProjectConfig, ReportKind } from "./types.ts";
 import { formatUnblock, unblockIssue } from "./unblock.ts";
 import { upgradeConductor } from "./upgrade.ts";
@@ -100,6 +102,7 @@ usage:
   omp-conductor tail <issue> [--project NAME]
   omp-conductor extend <issue> --turns N [--project NAME]
   omp-conductor unblock <issue> [--force] [--project NAME]
+  omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
   omp-conductor daemon [--once] [--port N] [--project NAME]
   omp-conductor pause
   omp-conductor resume
@@ -168,6 +171,13 @@ usage:
            Refuses when the newest attempt's work could not be committed and
            its worktree is the only copy: re-claiming removes that tree. Use
            --force once you have recovered it or accepted the loss.
+  verb     run one conductor_* verb as the orchestrator, from the CLI: the same
+           checks and the same ledger rows a session's call would get. This is
+           how an external orchestrator merges, labels, releases or reads PR
+           state without a raw gh call that skips every gate. Arguments are
+           strings, one per --arg (e.g. --arg prUrl=https://x --arg headSha=y).
+           A refusal exits 3. See conductor_pr_merge/conductor_label/
+           conductor_release/conductor_pr_update_branch in the brief.
   report   hand a rendered report to the daemon's durable outbox. The report is
            persisted before anything is sent, delivered by the daemon with
            bounded retries, and shown by status until it lands. Delivery is
@@ -732,6 +742,89 @@ try {
       break;
     }
 
+    /**
+     * The external-orchestrator half of the verbs (#167): run any
+     * `conductor_*` verb from the CLI, through the daemon's own checks and
+     * ledger. An orchestrator that merges, labels or releases through this
+     * gets exactly the same refusals a session would and writes the same
+     * ledger rows — the raw `gh pr merge` a session reaches for instead is
+     * invisible to both.
+     *
+     * Worker-only verbs (conductor_push, conductor_pr_create) refuse with
+     * `role-not-allowed` — correct, and deliberately not special-cased here.
+     *
+     * Accepted limitation: the daemon's in-process one-merge-per-project slot
+     * does not span the daemon and a concurrent CLI merge. The execution-time
+     * head re-read (`--match-head-commit` in prMergeVerb) is the cross-process
+     * guard, so a CLI merge races a daemon merge exactly as two daemon merges
+     * would.
+     */
+    case "verb": {
+      const name = argv[1];
+      if (name === undefined || !VERB_NAMES.some((n) => n === name)) {
+        process.stderr.write(
+          `omp-conductor: unknown verb "${name ?? ""}". Known verbs: ${VERB_NAMES.join(", ")}\n`,
+        );
+        process.exit(2);
+      }
+      const cfg = loadConfig();
+      const project = findProject(cfg, flag(argv, "project"));
+      const args: Record<string, string> = {};
+      for (let i = 2; i < argv.length; i++) {
+        const token = argv[i];
+        if (token === "--arg") {
+          const pair = argv[i + 1];
+          if (pair === undefined || !pair.includes("=")) {
+            process.stderr.write(`omp-conductor: verb --arg needs k=v, got "${pair ?? ""}"\n`);
+            process.exit(2);
+          }
+          const eq = pair.indexOf("=");
+          args[pair.slice(0, eq)] = pair.slice(eq + 1);
+          i++;
+        } else if (token === "--project" || token?.startsWith("--project=") === true) {
+          // Consumed by `flag(argv, "project")` above; both spellings skip here.
+          if (token === "--project") i++;
+        } else {
+          process.stderr.write(
+            `omp-conductor: verb: unexpected argument "${token ?? ""}" (pass verb arguments as --arg k=v)\n`,
+          );
+          process.exit(2);
+        }
+      }
+      const store = openStore(dbPath());
+      try {
+        const channel: VerbChannel = {
+          kind: "orchestrator",
+          path: "cli",
+          project: project.name,
+          role: "orchestrator",
+        };
+        const reply = await handleVerbCall(
+          {
+            project: () => findProject(loadConfig(), project.name),
+            store,
+            tracker: makeTracker(project),
+            actions: githubVerbActions(project),
+            fleetStop: () =>
+              isPaused()
+                ? "claiming is paused for this fleet (omp-conductor pause, hold or halt)"
+                : undefined,
+            pausedAt,
+            log: (m) => process.stderr.write(`${m}\n`),
+            now: () => Date.now(),
+          },
+          channel,
+          { verb: name, args },
+        );
+        process.stdout.write(`${reply.text}\n`);
+        // A refusal must not read as success to a script calling this.
+        if (!reply.ok) process.exitCode = 3;
+      } finally {
+        store.close();
+      }
+      break;
+    }
+
     /**
      * The handover point. Authorship stays with the model; from here the daemon
      * owns delivery, so "I sent the report" stops being a claim the model makes