🎩 Deliver with Conductor (structupath.conductor)

Attended Stage 3 delivery. Conductor 0.4.0 coordinates task-bound builders, validators, and reviewers as visible Herdr agent panes, then supports an explicitly approved fast-forward of one local ref. An operator drives every transition and records each approval receipt. It requires exactly Herdr 0.7.5, protocol 17, API schema 1; it is not an authenticated approval system, suite adapter, unattended pipeline, general automatic recovery service, cryptographic attestation system, or same-user security boundary.

Repo: StructuPath/herdr-conductor · Detailed reference: the repo README

Pinned evidence

The retained Stage 2 source manifest and installed-Herdr live contract report remain historical compatibility evidence. The pinned commit requires exactly 0.7.5; local development changes do not revise its release claim or evidence.

A separate developer smoke on 2026-09-14 exercised all seven installed actions on a running Herdr 0.7.5 server, including Stage 3 preview, approval refusal, attended single-ref apply, replay, and completed stand-down. It found and fixed the omitted stand-down reason after apply. The smoke used synthetic local worker sessions and operator-produced deterministic reports, not a real model agent. This bounded observation is not independent-human review, formal release attestation, live crash-recovery proof, or broader production certification.

Unreleased dual-runtime development candidate

The local Conductor checkout now retains the exact 0.7.5/protocol 17/schema 1 path and adds an exact 0.9.3/protocol 22/schema 1 path gated by a healthy, matching running server and the required API request/response shape. An isolated 0.7.5 server passed the retained runtime gate; the existing 0.7.5 installed-action smoke above remains the completed-lifecycle evidence for that version. This is not a release-pin change or a claim about 0.8.2.

On an isolated named 0.9.3 server with its own temporary HOME, XDG state, socket, and plugin registry, all seven Conductor actions registered. A fresh disposable-repository run completed installed assemble, status, board, producer report/harvest, exact-SHA validator report/harvest, preview, refusal to apply without a receipt, recorded attended approval, one local-ref apply CAS, apply replay, stand-down of two worker panes, and stand-down replay. The 0.9.3 macOS Apple-silicon runtime asset SHA-256 was 5173a3e0ae42d5d1ab7ebfa5d5e6329f7c3d23f8e1a3677c7ce3231da2884157. The development smoke retained its private synthetic repository/state for inspection and removed its temporary shell profiles, plugin link, and workspace. Earlier synthetic startup attempts stopped in needs_attention; their failed journals were not replayed or treated as approval.

These are bounded developer observations using a local shell impersonating Pi and unauthenticated synthetic worker assertions. They do not validate real Pi/model integration, external review, broad crash recovery, or formal release readiness. Keep the proven 0.7.5 Conductor path and the reviewed release pin until separate release evidence and operator selection exist. To roll back a test, unlink only the isolated candidate plugin, close only its disposable workspace, and stop only its named test server; leave the default 0.8.2 server and 0.7.5 runtime untouched. Never point an older CLI at a newer default server and infer compatibility from the CLI's version alone.

All seven actions

Conductor owns this lifecycle. It does not invoke Swarm or provide an automatic Conductor→Swarm pipeline. Supported composition remains human-selected and sequential.

Attended quickstart

Use Herdr exactly 0.7.5, Node.js 20 or current LTS, Python 3.11+, and Git with 40-hex SHA-1 object IDs. Create .herdr-conductor.json in a clean Git repository. This first-run example explicitly disables apply:

{
  "version": 3,
  "apply": null,
  "state_root": { "kind": "default" },
  "worktree_root": ".conductor-worktrees",
  "roles": [
    {
      "name": "builder",
      "contract_role": "builder",
      "kind": "pi",
      "mode": "write",
      "assignment": {
        "title": "Implement the owned change",
        "mission": "Complete only the attended task.",
        "acceptance_criteria": [
          { "id": "behavior", "text": "The requested behavior is verified." }
        ],
        "owned_paths": ["src"],
        "forbidden_paths": ["secrets"],
        "required_commands": [
          { "id": "test", "command": "npm test" }
        ]
      },
      "validator_artifacts": []
    },
    {
      "name": "validator",
      "contract_role": "validator",
      "kind": "pi",
      "mode": "gated",
      "assignment": {
        "title": "Validate the exact integration",
        "mission": "Run the attended exact-SHA gate.",
        "acceptance_criteria": [],
        "owned_paths": [],
        "forbidden_paths": [],
        "required_commands": []
      },
      "validator_artifacts": []
    }
  ]
}

Commit .herdr-conductor.json before assembly so the repository is clean, then explicitly drive the lifecycle from that Herdr workspace:

herdr plugin action invoke assemble --plugin structupath.conductor
herdr plugin action invoke status --plugin structupath.conductor
herdr plugin action invoke board --plugin structupath.conductor
# Complete the published task and pipe canonical report JSON to the returned publisher command.
herdr plugin action invoke harvest --plugin structupath.conductor
# Complete exact-SHA gate tasks, publish their reports, and harvest again.
herdr plugin action invoke harvest --plugin structupath.conductor
herdr plugin action invoke stand-down --plugin structupath.conductor

assemble returns exact task paths, source roots, outbox slots, and task-bound publisher commands. Reports are closed canonical JSON supplied through bounded stdin. Producer collection and exact-SHA gate collection may require separate attended harvest invocations. Harvest and stand-down are mutating attended actions. Failed or uncertain external effects become needs_attention and are never silently replayed.

Optional attended apply

To enable apply for a new run, set apply to { "target_ref": "refs/heads/release" } before assembly. The named local branch must already exist, differ from the integration branch, be checked out in no worktree, and remain exactly at the run's integration base. The proposed change must be a nonempty, rename-free fast-forward. Configuration v2 remains supported with apply disabled; do not edit a run-bound configuration mid-run.

After producer and gate collection, use this sequence instead of standing down immediately:

1. Invoke herdr plugin action invoke preview --plugin structupath.conductor.
2. Review the exact target, diff, gate assertions, and preview entry digest.
3. Follow the exact npm run apply:approve command returned by preview and provide the operator's canonical approve or reject receipt through stdin. Do not manufacture a receipt from a generic example or treat a worker's approve report as operator consent.
4. Invoke herdr plugin action invoke apply --plugin structupath.conductor only for the reviewed, approved attempt.
5. Inspect status, then invoke stand-down when finished.

The receipt is consumed durably before any Git effect and cannot be reused. A moved target records an unapplied outcome with zero target changes. Only the attended apply action can resolve an uncertain apply publication from an exact target-SHA observation; other ambiguous operations remain refused. Rejected or voided attempts permit a fresh preview, up to eight attempts. Apply never pushes, tags, publishes, deploys, or updates multiple refs.

Trust and completion limits

• State is strict, non-executable private JSON indexed by physical Git common-directory and Herdr workspace identity. Atomic writes, repository locks, generations, canonical digests, and hash-chained journals are cooperative coordination controls—not authentication.
• Tasks and reports are closed, bounded, duplicate-key-rejecting, identity-bound documents. Worker command results, criteria, delivered, approve, and pass values remain unauthenticated assertions—not proof, approval receipts, or authorization.
• Reviewer and validator sources are retained detached worktrees at the exact observed integration SHA. Read-only modes and separate writable outboxes prevent ordinary accidental writes; they do not constrain a malicious same-UID process.
• Missing, malformed, duplicate, foreign, stale, replayed, ambiguous, dirty, or durability-uncertain authority fails closed. Integration performs exactly zero or one target compare-and-swap.
• Herdr 0.7.5 closes by pane_id. Conductor re-reads the full workspace, pane, terminal, agent, cwd, run, and generation tuple immediately before close, but a same-user TOCTOU window remains.
• The repository lock does not stop unrelated Git or same-user processes. Worktrees are review boundaries, not sandboxes. Guard observes rendered text and cannot prove prevention.
• Stage 3 receipts are unauthenticated same-user operator records, not signatures or authorization proof. Apply changes one configured local ref; it does not provide general automatic recovery, suite adapters, unattended orchestration, automatic cleanup/prune, or Browser promotion.
• Stand-down closes only identity-proven panes and archives authority. It does not remove worktrees, branches, tasks, outboxes, reports, gate sources, artifacts, recordings, logs, or Guard files; retained resources continue consuming disk.