fix(upgrade): doctor fetches tags before deciding latest + post-flight asserts served version (#173)

Two fixes for the two halves of issue #173, both from live incidents during the
2026-07-17 fleet update:

1. scripts/doctor.mjs — `git show origin/main:package.json` reads the LOCALLY
   CACHED remote ref; without a fetch first, any machine that hadn't pulled since
   the last release saw latest == current and reported "Already at latest" (live
   repro: Oracle VM at 3.21.1 with v3.22.1 released). The doctor now runs
   `git fetch --tags --quiet` (15s timeout) before comparing, gated on
   !opts.skipNetwork; on failure (offline/auth) it falls through to the cached
   ref — the pre-existing behavior. All existing doctor tests pass mockLatest +
   skipNetwork, so no test touches the network.

2. scripts/upgrade.mjs — post-flight accepted any healthy /health (auth.ok only),
   so a stale process holding the port passed post-flight while still serving the
   OLD version (live repro: a Jul-7 nohup-fallback orphan held :3456; upgrade
   "succeeded", /health kept serving 3.21.1). New exported predicate
   postFlightOk(body, target): auth.ok AND /health.version === target (leading-v
   tolerant; empty target degrades to the auth-only check, never blocks). The
   failure message now reports the last-seen version and points at the
   stale-process diagnosis (`ss -ltnp` / `lsof -i`).

Tests: +4, mutation-proven — reverting the predicate to auth-only fails the
"orphan case" test (337/1). Full suite 338 passed / 0 failed.

No server.mjs change — scripts layer only; no cli.js operation involved, so no
citation applies.

Closes #173

Co-Authored-By: Claude <claude-opus-4-8> <noreply@anthropic.com>

README.md

@@ -228,7 +228,6 @@ The canonical list lives in [`models.json`](./models.json) — the single source
 | `CLAUDE_ALLOWED_TOOLS` | `Bash,Read,...,Agent` | Comma-separated tools to pre-approve |
 | `CLAUDE_SKIP_PERMISSIONS` | `false` | Bypass all permission checks |
 | `CLAUDE_MCP_CONFIG` | *(unset)* | Path to an MCP server config JSON, passed to the spawned `claude` as `--mcp-config` (both the `-p` path and TUI `OCP_TUI_FULL_TOOLS` panes) |
-| `CLAUDE_SYSTEM_PROMPT` | *(unset)* | Operator-wide system-prompt text appended (last) to every request's composed system prompt on the default `-p` path. TUI-mode panes are unaffected (they keep the interactive CLI's own system prompt). Echoed truncated on `/health.systemPrompt`. Note: the response cache key does not include server config — after changing this value, flush the cache (`ocp clear`) or let TTL expire. |
 | `CLAUDE_NO_CONTEXT` | `false` | Suppress CLAUDE.md and auto-memory injection (pure API mode) |
 | `PROXY_API_KEY` | *(unset)* | Bearer token for shared-mode authentication |
 | `PROXY_ANONYMOUS_KEY` | *(unset)* | Well-known anonymous key (multi mode) — this exact string bypasses `validateKey()` and grants public access. Exposed via `/health.anonymousKey` only to localhost, or to all callers when `PROXY_ADVERTISE_ANON_KEY=1`. Full setup + security notes: [docs/lan-mode.md § Anonymous Access](docs/lan-mode.md#anonymous-access-optional). |

lib/prompt.mjs

@@ -1,17 +0,0 @@
-// lib/prompt.mjs — pure operator-append step for the system prompt.
-//
-// Extracted so the rule is unit-testable (the suite never imports server.mjs — it
-// boots a listener). server.mjs composes wrapper + client system messages exactly as
-// before, then passes the result through this. With CLAUDE_SYSTEM_PROMPT unset the
-// return is the INPUT STRING UNCHANGED — the default path stays byte-for-byte
-// identical, which is the repo's bar for touching a request-shaping function.
-//
-// The operator prompt goes LAST deliberately: a server-wide directive ("answer in
-// Chinese") should read as the final instruction, not something a client system
-// message overrides by coming later. Whitespace-only values are treated as unset —
-// a stray space in a service unit's Environment= line must not inject "\n\n " into
-// every request.
-export function appendOperatorPrompt(base, operatorAppend) {
-  const op = typeof operatorAppend === "string" ? operatorAppend.trim() : "";
-  return op ? `${base}\n\n${op}` : base;
-}

server.mjs

@@ -49,7 +49,6 @@ import { TuiSemaphore, SemaphoreAbortError, recordTuiEntrypoint, buildTuiHealthB
 import { TuiPanePool, resolvePoolSize, POOL_MAX_SIZE } from "./lib/tui/pool.mjs";
 import { TuiDeltaAssembler, DEFAULT_HOLDBACK_CHARS, resolveStreamHoldback } from "./lib/tui/stream.mjs";
 import { createSerialMutex, createTtlCache, isTokenExpiring, orderLabelsLastGoodFirst } from "./lib/spawn-auth.mjs";
-import { appendOperatorPrompt } from "./lib/prompt.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const _pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
@@ -196,19 +195,17 @@ function resolveClaude() {
 const OCP_SYSTEM_PROMPT_WRAPPER = `You are accessed via the OCP HTTP proxy. You do NOT have access to any local filesystem, working directory, shell, git status, or machine environment. Do not infer or invent such information from any context you observe. Respond only based on the conversation provided.`;
 
 // Build the full system-prompt string: OCP_SYSTEM_PROMPT_WRAPPER prepended,
-// then any system-role messages from the request appended (separated by blank line),
+// then any system-role messages from the request appended (separated by blank line).
-// then the operator-wide CLAUDE_SYSTEM_PROMPT appended LAST (lib/prompt.mjs — a
+// ADR 0009 Amendment 1 analogue § "OLP system prompt wrapper".
-// no-op returning the same string when the var is unset, so the default path is
-// byte-for-byte unchanged). ADR 0009 Amendment 1 analogue § "OLP system prompt wrapper".
 function extractSystemPrompt(messages) {
   const systemMessages = (messages ?? []).filter(m => m.role === "system");
   if (systemMessages.length === 0) {
-    return appendOperatorPrompt(OCP_SYSTEM_PROMPT_WRAPPER, SYSTEM_PROMPT);
+    return OCP_SYSTEM_PROMPT_WRAPPER;
   }
   const clientContent = systemMessages.map(m =>
     contentToText(m.content)
   ).join("\n\n");
-  return appendOperatorPrompt(`${OCP_SYSTEM_PROMPT_WRAPPER}\n\n${clientContent}`, SYSTEM_PROMPT);
+  return `${OCP_SYSTEM_PROMPT_WRAPPER}\n\n${clientContent}`;
 }
 
 // ── NDJSON line buffer parser (Phase 6c port) ─────────────────────────────

test-features.mjs

@@ -821,32 +821,6 @@ test("doctor falls back to currentVersion when origin/main unreachable (no stale
   assert.equal(result.next_action.kind, "noop");
 });
 
-// ── System-prompt operator append (CLAUDE_SYSTEM_PROMPT wiring) ─────────────
-// The var was documented + echoed on /health but never reached a request (dead
-// since APPEND_SYSTEM_PROMPT was retired — caught in PR #170 review). The wiring
-// contract lives in lib/prompt.mjs. Mutation-proof: make appendOperatorPrompt
-// return `base` unconditionally and the first test fails; make it stop trimming
-// and the whitespace test fails.
-import { appendOperatorPrompt } from "./lib/prompt.mjs";
-
-console.log("\nSystem-prompt operator append:");
-
-test("appendOperatorPrompt: appends the operator prompt LAST, blank-line separated", () => {
-  assert.equal(appendOperatorPrompt("WRAPPER\n\nclient", "Answer in Chinese."), "WRAPPER\n\nclient\n\nAnswer in Chinese.");
-});
-
-test("appendOperatorPrompt: unset/empty/whitespace-only → base returned BYTE-IDENTICAL", () => {
-  const base = "WRAPPER\n\nclient sys";
-  assert.equal(appendOperatorPrompt(base, undefined), base);
-  assert.equal(appendOperatorPrompt(base, ""), base);
-  assert.equal(appendOperatorPrompt(base, "   \n "), base, "a stray space in a service unit must not inject anything");
-  assert.equal(appendOperatorPrompt(base, null), base);
-});
-
-test("appendOperatorPrompt: operator value is trimmed before appending", () => {
-  assert.equal(appendOperatorPrompt("W", "  hi  "), "W\n\nhi");
-});
-
 // ── Upgrade Tests ──
 import { runUpgrade, postFlightOk } from "./scripts/upgrade.mjs";