@bridge_gpt/mcp-server 0.2.10 → 0.2.13

package/build/conductor/epic-runtime.js

@@ -20,6 +20,8 @@
 import { spawnSync } from "child_process";
 import { resolveConductorBridgeApiAccess, claimEpicSupervisionLease, fetchEpicRunState, advanceEpicTicketStatus, createEpicTicketStatus, recordEpicDispatch, transitionEpicDispatch, fetchParseStatus, triggerRepositoryParse, getEpicPlan, buildEpicDispatchKey, fetchEffectiveSupervisorConfig, fetchEffectiveSupervisorSetup, fetchPrReviewStatus, remediateEpicTicket, deletePullRequestBranch, transitionJiraStatus, } from "./bridge-api-client.js";
 import { processGateMetMerge } from "./supervisor-merge.js";
+import { makeLocalMergeExecutor, resolveLocalMergeMethod } from "./local-merge.js";
+import { emitConductorEventIfNew } from "./producer-ledger.js";
 import { rebuildObservedState, extractWorkerLiveness, } from "./epic-state.js";
 import { reconcileEpic } from "./epic-reconcile.js";
 import { buildSupervisorRemediationWorkerMessage } from "./supervisor-message-relay.js";
@@ -38,12 +40,15 @@ const DEFAULT_LEASE_TTL_SECONDS = 120;
 const DEFAULT_MAX_DRIFT_MS = 30_000;
 const DEFAULT_DISPATCH_KEY_TTL_SECONDS = 300; // independent of supervision lease TTL
 const ACTIVE_WORKER_STATUSES = new Set(["dispatched", "running"]);
+// ---------------------------------------------------------------------------
+// Module-private helpers
+// ---------------------------------------------------------------------------
 /**
- * Module-level transient map keyed by `"${epicKey}:${ticketKey}"`. Cleared on
- * parse completion or budget exhaustion. Process-restart safe: re-derived from
- * the parse lock status on the next tick.
+ * Source + producer tags for the durable `parse.triggered` marker that the
+ * parse-after-merge wait emits from the epic-tick process.
  */
-const parseWaitStateMap = new Map();
+const PARSE_WAIT_EVENT_SOURCE = "conductor-supervisor";
+const PARSE_WAIT_EVENT_PRODUCER = "epic-parse-wait";
 function defaultLeaseOwner() {
     return `epic-tick-${process.pid}`;
 }
@@ -75,6 +80,9 @@ export async function runEpicTick(options, deps = {}) {
     const errorLog = deps.errorLog ?? ((msg) => process.stderr.write(`${msg}\n`));
     const escalateOnce = deps.escalateOnce ?? defaultEscalateOnce;
     const dispatchSeam = deps.dispatchSeam ?? defaultDispatchSeam;
+    // BAPI-445: optional review dispatch seam. When absent the spec re-review
+    // sequencing gate stays off (a ready ticket dispatches implementation directly).
+    const dispatchReviewSeamFn = deps.dispatchReviewSeam;
     const processMergeFn = deps.processMerge ?? processGateMetMerge;
     const postActionWaitSeam = deps.postActionWaitSeam ?? defaultPostActionWaitSeam;
     const fetchLocalEvents = deps.fetchLocalEvents ??
@@ -203,7 +211,7 @@ export async function runEpicTick(options, deps = {}) {
         const dispatchedRunIds = epicRunState.dispatches
             .map((d) => d.run_id)
             .filter((rid) => typeof rid === "string" && rid.length > 0);
-        const localEvents = fetchLocalEvents(epic_key, dispatchedRunIds);
+        const localEvents = await fetchLocalEvents(epic_key, dispatchedRunIds);
         const observed = rebuildObservedState(epicRunState, localEvents, nowFn());
         workerCount = [...observed.ticket_statuses.values()].filter((s) => ACTIVE_WORKER_STATUSES.has(s)).length;
         // Step 3.5: Run post-action waits (parse-after-merge)
@@ -217,17 +225,22 @@ export async function runEpicTick(options, deps = {}) {
             const settleMs = 5000;
             const fetchParseStatusFn = deps.fetchParseStatus ?? fetchParseStatus;
             const triggerParseFn = deps.triggerParse ?? triggerRepositoryParse;
+            const emitConductorEventFn = deps.emitConductorEvent ?? emitConductorEventIfNew;
             for (let i = 0; i < observed.unfolded_terminal_signals.length; i++) {
                 const signal = observed.unfolded_terminal_signals[i];
                 if (signal.signal_type !== "merge.succeeded")
                     continue;
                 const ticketKey = signal.ticket_key;
-                const stateKey = `${epic_key}:${ticketKey}`;
-                let pState = parseWaitStateMap.get(stateKey);
-                if (!pState) {
-                    pState = {};
-                    parseWaitStateMap.set(stateKey, pState);
-                }
+                const mergeEvent = signal.event;
+                const mergeTimeMs = new Date(mergeEvent.time).getTime();
+                // rebuildObservedState only surfaces a merge.succeeded whose run_id maps to
+                // a tracked dispatch, so mergeRunId is non-null and in the run-scoped
+                // localEvents read — binding the parse.triggered marker to it guarantees a
+                // later tick re-reads it. The merged PR head SHA (pre-merge) lives under
+                // the merge.* event's data.details; used only as an extra dedupe dimension.
+                const mergeRunId = mergeEvent.run_id ?? null;
+                const mergeDetails = mergeEvent.data?.details;
+                const mergeHeadSha = typeof mergeDetails?.head_sha === "string" ? mergeDetails.head_sha : undefined;
                 const revertSignal = () => {
                     const origStatus = epicRunState.ticket_statuses.find((ts) => ts.ticket_key === ticketKey)?.status ??
                         "running";
@@ -235,27 +248,72 @@ export async function runEpicTick(options, deps = {}) {
                     observed.unfolded_terminal_signals.splice(i, 1);
                     i -= 1;
                 };
-                const elapsedMs = nowFn() - new Date(signal.event.time).getTime();
-                // Budget exhaustion: escalate once, then permanently block
+                const currentPgStatus = epicRunState.ticket_statuses.find((ts) => ts.ticket_key === ticketKey)?.status ?? null;
+                // DURABLE wait state (replaces the former in-memory parseWaitStateMap, which
+                // was lost between stateless epic-tick processes → re-triggered the parse on
+                // every idle tick and never folded to `done`). The marker is a
+                // `parse.triggered` ledger event correlated to this ticket's dispatch run_id
+                // and emitted strictly after the merge — so its presence is the skew-free
+                // signal that the post-merge parse was already kicked off.
+                const parseTriggeredEvent = localEvents.find((e) => e.type === "parse.triggered" &&
+                    e.subject === ticketKey &&
+                    e.run_id === mergeRunId &&
+                    new Date(e.time).getTime() >= mergeTimeMs);
+                const elapsedMs = nowFn() - mergeTimeMs;
+                // Budget exhaustion (measured from the durable merge.succeeded time):
+                // escalate once (gated on the durable Postgres status, not an in-memory
+                // flag) then block. A subsequent tick finds it already blocked and drops
+                // the signal without re-escalating or re-CASing.
                 if (elapsedMs > maxWaitMs) {
-                    if (!pState.escalated) {
-                        await escalateOnce(epic_key, `parse-after-merge budget exhausted for ${ticketKey}`);
-                        pState.escalated = true;
-                        signal.next_status = "blocked";
+                    if (currentPgStatus === "blocked") {
                         observed.ticket_statuses.set(ticketKey, "blocked");
-                        // Let the signal remain so the reconcile pass CASes once to blocked
-                        continue;
-                    }
-                    else {
-                        // Already escalated: map to blocked and skip redundant CAS
-                        observed.ticket_statuses.set(ticketKey, "blocked");
-                        parseWaitStateMap.delete(stateKey);
                         observed.unfolded_terminal_signals.splice(i, 1);
                         i -= 1;
                         continue;
                     }
+                    await escalateOnce(epic_key, `parse-after-merge budget exhausted for ${ticketKey}`);
+                    signal.next_status = "blocked";
+                    observed.ticket_statuses.set(ticketKey, "blocked");
+                    // Let the signal remain so the reconcile pass CASes once to blocked.
+                    continue;
                 }
-                // Poll the parse lock
+                if (!parseTriggeredEvent) {
+                    // No durable trigger for this merge yet — fire the parse and record the
+                    // marker, then hold at ready_for_review for a later tick to fold.
+                    try {
+                        await triggerParseFn(access);
+                        emitConductorEventFn({
+                            source: PARSE_WAIT_EVENT_SOURCE,
+                            type: "parse.triggered",
+                            subject: ticketKey,
+                            run_id: mergeRunId,
+                            worker_id: mergeEvent.worker_id ?? null,
+                            producer: PARSE_WAIT_EVENT_PRODUCER,
+                            observed_via: "supervisor",
+                            time: new Date(nowFn()).toISOString(),
+                            data: {
+                                summary: `parse-after-merge triggered for ${ticketKey}`,
+                                details: {
+                                    epic_key,
+                                    ticket_key: ticketKey,
+                                    ...(mergeHeadSha ? { head_sha: mergeHeadSha } : {}),
+                                },
+                            },
+                        }, {
+                            event_type: "parse.triggered",
+                            run_id: mergeRunId ?? undefined,
+                            commit_sha: mergeHeadSha,
+                        });
+                        log(`[epic-tick] triggered parse-after-merge for ${ticketKey} in epic=${epic_key}`);
+                    }
+                    catch (err) {
+                        const safeMsg = err instanceof Error ? err.constructor.name : "trigger error";
+                        errorLog(`[epic-tick] parse trigger failed (${safeMsg}) for ${ticketKey}; will retry next tick`);
+                    }
+                    revertSignal();
+                    continue;
+                }
+                // A durable parse.triggered exists for this merge — poll the live lock.
                 let parseStatusResult;
                 try {
                     parseStatusResult = await fetchParseStatusFn(access);
@@ -267,38 +325,26 @@ export async function runEpicTick(options, deps = {}) {
                     continue;
                 }
                 if (parseStatusResult.status === "in_progress") {
-                    pState.seenInProgress = true;
+                    // Parse still running — hold.
                     revertSignal();
                     continue;
                 }
-                // status === "idle" — evaluate race guard and completion
-                if (pState.seenInProgress) {
-                    // Previously observed in_progress: the parse finished normally
-                    parseWaitStateMap.delete(stateKey);
-                    continue; // let the signal proceed to CAS → done
-                }
-                if (pState.triggeredAt !== undefined) {
-                    const msSinceTrigger = nowFn() - pState.triggeredAt;
-                    if (msSinceTrigger < settleMs) {
-                        // Idle observed before the async job acquired its lock (race window)
-                        revertSignal();
-                        continue;
-                    }
-                    // Settle window elapsed without in_progress: treat as instantaneous completion
-                    parseWaitStateMap.delete(stateKey);
-                    continue; // let the signal proceed to CAS → done
-                }
-                // No trigger yet — fire it now
-                try {
-                    await triggerParseFn(access);
-                    pState.triggeredAt = nowFn();
-                    log(`[epic-tick] triggered parse-after-merge for ${ticketKey} in epic=${epic_key}`);
-                }
-                catch (err) {
-                    const safeMsg = err instanceof Error ? err.constructor.name : "trigger error";
-                    errorLog(`[epic-tick] parse trigger failed (${safeMsg}) for ${ticketKey}; will retry next tick`);
+                // status === "idle". If the marker is younger than the settle window, the
+                // async parse may not have acquired its lock yet (idle is a false negative)
+                // — hold one more tick. Past the settle window, idle means the post-merge
+                // parse has completed (or finished instantly), so let the merge.succeeded
+                // signal proceed to CAS → done.
+                //
+                // KNOWN LIMITATION: /jira/parse-status only reports {in_progress, idle} —
+                // it cannot distinguish a FAILED parse from a completed one, so an instant
+                // parse failure folds to `done` here. Pre-existing; tracked as P2 (surface
+                // a parse failure/last_error from parse-status).
+                const msSinceTrigger = nowFn() - new Date(parseTriggeredEvent.time).getTime();
+                if (msSinceTrigger < settleMs) {
+                    revertSignal();
+                    continue;
                 }
-                revertSignal();
+                // Completed: do not revert — the signal proceeds to CAS → done.
             }
         }
         // Step 4: Fetch + assert plan integrity (only if fetchPlan injected)
@@ -386,19 +432,35 @@ export async function runEpicTick(options, deps = {}) {
                 if (ts.dispatch_run_id)
                     ticketRunIdMap.set(ts.ticket_key, ts.dispatch_run_id);
             }
+            // BAPI-445: split dispatch records by role. `:review`-suffixed dispatch keys
+            // are the pre-implementation spec re-review runs; they must be EXCLUDED from
+            // the implementation liveness map (so BAPI-441 remediation liveness only ever
+            // targets the implementation run) and tracked in a separate review map +
+            // per-ticket attempt counter consumed by the reviewing recovery branch.
             const latestDispatchByTicket = new Map();
+            const reviewLatestDispatchByTicket = new Map();
+            const reviewAttemptCounts = new Map();
             for (const d of epicRunState.dispatches) {
+                const isReview = d.dispatch_key.endsWith(":review");
+                if (isReview) {
+                    reviewAttemptCounts.set(d.ticket_key, (reviewAttemptCounts.get(d.ticket_key) ?? 0) + 1);
+                }
                 if (!d.run_id)
                     continue;
                 const updatedAt = new Date(d.updated_at).getTime();
-                const prev = latestDispatchByTicket.get(d.ticket_key);
+                const target = isReview ? reviewLatestDispatchByTicket : latestDispatchByTicket;
+                const prev = target.get(d.ticket_key);
                 if (!prev || updatedAt >= prev.updatedAt) {
-                    latestDispatchByTicket.set(d.ticket_key, { runId: d.run_id, updatedAt });
+                    target.set(d.ticket_key, { runId: d.run_id, updatedAt });
                 }
             }
             for (const [tk, info] of latestDispatchByTicket) {
                 ticketRunIdMap.set(tk, info.runId);
             }
+            const reviewTicketRunIdMap = new Map();
+            for (const [tk, info] of reviewLatestDispatchByTicket) {
+                reviewTicketRunIdMap.set(tk, info.runId);
+            }
             const resolvePrNumber = (ticketKey) => {
                 const raw = prBindings[ticketKey];
                 if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1)
@@ -435,13 +497,30 @@ export async function runEpicTick(options, deps = {}) {
                         planVersion,
                     });
                 },
-                claimDispatchKey: async (ek, tk, planVersion) => recordEpicDispatch(access, {
+                claimDispatchKey: async (ek, tk, planVersion, role, attempt = 0) => recordEpicDispatch(access, {
                     epicKey: ek,
                     ticketKey: tk,
                     planVersion,
                     leaseOwner: lease_owner,
                     ttlSeconds: DEFAULT_DISPATCH_KEY_TTL_SECONDS,
+                    attempt,
+                    // BAPI-445: a review-role claim appends ":review" to the dispatch key
+                    // so the run-id maps above can separate review runs from impl runs.
+                    reviewRole: role === "review",
                 }),
+                // BAPI-445 spec re-review seams. dispatchReviewSeam is wired only when the
+                // factory provides it (gate stays off otherwise); the liveness + attempt
+                // accessors read the review-scoped maps built above.
+                dispatchReviewSeam: dispatchReviewSeamFn
+                    ? async (ek, tk, attempt = 0) => dispatchReviewSeamFn(ek, tk, attempt)
+                    : undefined,
+                readReviewWorkerLiveness: async (_ek, tk) => {
+                    const runId = reviewTicketRunIdMap.get(tk);
+                    if (!runId)
+                        return { alive: false, workerId: null };
+                    return extractWorkerLiveness(localEvents, runId, nowFn(), livenessWindowSeconds);
+                },
+                countReviewAttempts: (tk) => reviewAttemptCounts.get(tk) ?? 0,
                 correlateRunId: async (dispatchKey, runId) => {
                     await transitionEpicDispatch(access, {
                         dispatchKey,
@@ -450,7 +529,27 @@ export async function runEpicTick(options, deps = {}) {
                     });
                 },
                 dispatchSeam: async (ek, tk, attempt = 0) => dispatchSeam(ek, tk, attempt),
-                processMerge: async (acc, event) => processMergeFn(acc, event),
+                processMerge: async (acc, event) => {
+                    // F4: when policy_json.local_merge.enabled is set (opt-in, default OFF)
+                    // and the caller did not inject a processMerge stub, run the real merge
+                    // pipeline with a LOCAL executor swapped in for the backend route — the
+                    // merge happens here using the agent's own `gh` credentials, so the
+                    // hosted backend never needs global GitHub write scope. Otherwise the
+                    // default backend-route path is unchanged for all existing users.
+                    if (deps.processMerge === undefined) {
+                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                        const localCfg = epicRunState.epic_run.policy_json?.local_merge;
+                        if (localCfg?.enabled === true) {
+                            return processGateMetMerge(acc, event, {
+                                merge: makeLocalMergeExecutor({
+                                    method: resolveLocalMergeMethod(localCfg.method),
+                                    approvalRequired: localCfg.approval_required === true,
+                                }, { env: process.env }),
+                            });
+                        }
+                    }
+                    return processMergeFn(acc, event);
+                },
                 postActionWaitSeam: async (ek, tk) => postActionWaitSeam(ek, tk),
                 escalateOnce: async (ek, reason) => escalateOnce(ek, reason),
                 log,
@@ -776,12 +875,21 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
                 dryRun: dispatchDryRun,
                 autoApprove: true,
                 maxParallel: 1,
-                refreshMain: false,
+                // F-base: a merge-gated dependent MUST cut from the predecessor's merged
+                // code. With refreshMain:false the worktree was cut from a STALE local
+                // `main` (never fetched/ff'd after the predecessor merged on origin), so
+                // dependents built without the predecessor's code — defeating the whole
+                // merge-gated handoff. Refresh (fetch origin + ff local base) before cut.
+                refreshMain: true,
                 branchOverrides: {},
                 baseBranch: "main",
                 conductorEnabled: true,
                 // BAPI-441: re-dispatch reuses the existing branch/worktree.
                 resumeMode: isResume,
+                // F7: on a FRESH dispatch, refuse a stale leftover `feature/<KEY>` branch
+                // (e.g. a prior run's worktree) rather than silently building on it. No
+                // effect on resume (which reuses a located worktree via a different path).
+                guardStaleWorktree: !isResume,
             }, {
                 createConductorContext: createStartTicketsConductorContext,
                 provisionConductorHooksForRows,
@@ -802,7 +910,53 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         }
         return runId;
     };
-    const fetchLocalEvents = (_ek, runIds) => {
+    const dispatchReviewSeam = async (ek, tk, attempt = 0) => {
+        // BAPI-445: spawn the pre-implementation spec re-review as the review-tickets
+        // automation kind — ALWAYS a review, regardless of the ticket's own plan-node
+        // automation kind (which is an implementation kind). fetchPlan must have run
+        // first so cachedPlanVersion is populated (same guard as dispatchSeam).
+        if (cachedPlanVersion === 0) {
+            throw new Error(`dispatchReviewSeam called before fetchPlan for epic ${ek} ticket ${tk}; cachedPlanVersion is 0`);
+        }
+        const dispatchDryRun = process.env.BAPI_CONDUCTOR_DISPATCH_DRY_RUN === "1";
+        // Deliberately omit `dispatch_key` from the identity: the reconcile pass owns
+        // the idempotent :review key claim (recordEpicDispatch with reviewRole) and the
+        // run_spawned correlation. orchestrateReviewTickets still mints the run_id and
+        // injects BAPI_CONDUCTOR_RUN_ID into the review agent's environment, which is
+        // exactly the correlation channel the Python review orchestrator reads to stamp
+        // the spec_review.* verdict event with this review run's id (Phase 2).
+        const identity = {
+            epic_key: ek,
+            epic_run_id: ek,
+            plan_version: cachedPlanVersion,
+        };
+        const deps = createDefaultStartTicketsDeps();
+        const result = await orchestrateReviewTickets(deps, {
+            keys: [tk],
+            epic: identity,
+            agentName: "claude",
+            dryRun: dispatchDryRun,
+            maxParallel: 1,
+            auto: true,
+            // Product directive: the spec re-review is `/review-ticket --auto --rounds=2`.
+            rounds: 2,
+            reviewOverrides: {},
+        });
+        if (!result.ok) {
+            throw new Error(`spec re-review dispatch failed: ${result.error}`);
+        }
+        let runId = result.rows[0]?.runId;
+        if (!runId && dispatchDryRun) {
+            // Dry-run produced no real run_id; substitute a synthetic, attempt-scoped id
+            // so the reconcile correlate step still records the :review dispatch row.
+            runId = `dry-run:review:${ek}:${tk}:${cachedPlanVersion}:r${attempt}`;
+        }
+        if (!runId) {
+            throw new Error(`spec re-review dispatch returned no runId for ticket ${tk}`);
+        }
+        return runId;
+    };
+    const fetchLocalEvents = async (_ek, runIds) => {
         // Workers and the epic-tick process share the same local SQLite ledger
         // (~/.config/bridge/events.db). pollConductorEvents opens it read-only.
         //
@@ -831,7 +985,7 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         // cap total iterations defensively against a non-advancing cursor.
         const MAX_PAGES = 10_000;
         for (let page = 0; page < MAX_PAGES; page += 1) {
-            const result = pollConductorEvents({
+            const result = await pollConductorEvents({
                 data_mode: "full",
                 since_seq: sinceSeq,
                 limit: POLL_LIMIT_MAX,
@@ -897,6 +1051,7 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
     return {
         fetchPlan,
         dispatchSeam,
+        dispatchReviewSeam,
         fetchLocalEvents,
         escalateOnce,
         postActionWaitSeam,

package/build/conductor/epic-state.js

@@ -30,6 +30,12 @@ const NON_TERMINAL_STATUSES = new Set([
     "running",
     "blocked",
     "ready_for_review",
+    // BAPI-445: mid-flight pre-implementation spec re-review. Non-terminal so a
+    // review verdict / completion signal can still advance it on a later tick, but
+    // deliberately NOT a status computeReadySet returns for normal dispatch — a
+    // reviewing ticket is mid-flight, not ready. Stranded reviewing tickets are
+    // re-driven by reconcile's dedicated reviewing re-entry branch.
+    "reviewing",
 ]);
 const TERMINAL_SIGNAL_TYPES = new Set([
     "gate.met",
@@ -37,18 +43,42 @@ const TERMINAL_SIGNAL_TYPES = new Set([
     "ci.failed",
     "run.stopped",
     "review.changes_requested",
+    // BAPI-445: pre-implementation spec re-review verdicts, scoped to review runs.
+    "spec_review.passed",
+    "spec_review.changes_requested",
 ]);
 function isNonTerminal(status) {
     return NON_TERMINAL_STATUSES.has(status);
 }
-export function signalToNextStatus(signalType) {
+/**
+ * Map a terminal ledger signal to the next ticket status.
+ *
+ * `isReviewRun` marks signals correlated to a `:review`-suffixed dispatch
+ * (BAPI-445 Obstacle 2). The spec re-review verdicts fold explicitly:
+ *   - `spec_review.passed`            → `ready`   (verdict: proceed to implementation)
+ *   - `spec_review.changes_requested` → `blocked` (verdict: reject; reconcile escalates)
+ *
+ * FAIL-SAFE (BAPI-445): a review run's INCIDENTAL terminals (`run.stopped`,
+ * `gate.met`, …) are filtered out of folding entirely by `rebuildObservedState`
+ * BEFORE this function is called — a review session merely *ending* must never
+ * advance a `reviewing` ticket, or implementation would proceed regardless of
+ * the review's outcome (fail-open). So for a review run this is only ever called
+ * with a `spec_review.*` verdict; `isReviewRun` is retained for caller clarity.
+ * For implementation runs the BAPI-436 mapping is unchanged.
+ */
+export function signalToNextStatus(signalType, isReviewRun = false) {
+    void isReviewRun; // review-run incidental terminals are filtered before this call
+    if (signalType === "spec_review.passed")
+        return "ready";
+    if (signalType === "spec_review.changes_requested")
+        return "blocked";
     if (signalType === "ci.failed")
         return "blocked";
     if (signalType === "review.changes_requested")
         return "blocked";
     if (signalType === "merge.succeeded")
         return "done";
-    return "ready_for_review"; // gate.met and run.stopped: awaiting merge
+    return "ready_for_review"; // gate.met and (implementation) run.stopped: awaiting merge
 }
 // ---------------------------------------------------------------------------
 // computeReadySet
@@ -74,6 +104,13 @@ export function computeReadySet(plan, ticketStatuses) {
     }
     return ready;
 }
+/**
+ * Default ceiling for spec re-review dispatch attempts on a stranded `reviewing`
+ * ticket (BAPI-445). Counts the initial review dispatch plus liveness-recovery
+ * re-dispatches; once reached, the reviewing recovery branch escalates instead
+ * of re-dispatching. Deliberately independent of the BAPI-441 remediation budget.
+ */
+export const DEFAULT_MAX_SPEC_REVIEW_ATTEMPTS = 3;
 /**
  * Pure, deterministic remediation decision (no I/O, no clock). Given the current
  * budget counters, the ledger-derived worker liveness, and the configured
@@ -124,11 +161,20 @@ export function extractWorkerLiveness(events, runId, nowMs, windowSeconds) {
  */
 export function rebuildObservedState(postgresState, events, _now) {
     const { epic_run, ticket_statuses, dispatches } = postgresState;
-    // Build run_id → ticket_key lookup from dispatch records
+    // Build run_id → {ticket_key, isReview} lookup from dispatch records.
+    // BAPI-445 (Obstacle 2): a review run's dispatch_key carries a ":review"
+    // suffix, so the same run_id map can distinguish a pre-implementation
+    // spec-review run from the implementation run. This is correctness-critical:
+    // it lets the fold below route a review run's run.stopped to "ready" (review
+    // complete → proceed) instead of mis-folding it as implementation completion
+    // ("ready_for_review", awaiting merge), which would skip implementation.
     const runIdToTicketKey = new Map();
     for (const dispatch of dispatches) {
         if (dispatch.run_id) {
-            runIdToTicketKey.set(dispatch.run_id, dispatch.ticket_key);
+            runIdToTicketKey.set(dispatch.run_id, {
+                ticketKey: dispatch.ticket_key,
+                isReview: dispatch.dispatch_key.endsWith(":review"),
+            });
         }
     }
     // Populate base maps from Postgres
@@ -147,6 +193,14 @@ export function rebuildObservedState(postgresState, events, _now) {
     const pendingMergeEvents = [];
     // Track which tickets already have a folded signal (one override per ticket)
     const foldedTicketKeys = new Set();
+    // Track which tickets already have a gate.met queued for merge this tick, so a
+    // second gate.met for the same ticket never double-enqueues. Distinct from
+    // foldedTicketKeys: a prior run.stopped fold (→ ready_for_review) must NOT
+    // suppress a later gate.met's merge enqueue (both map to ready_for_review;
+    // only gate.met enqueues a merge, and the worker frequently emits run.stopped
+    // BEFORE a post-hoc gate.met). Only a fold to a non-mergeable status (blocked)
+    // suppresses the merge — handled via the effective-status check below.
+    const mergeQueuedTicketKeys = new Set();
     // BAPI-441: per-ticket latest blocking reason (ci.failed / review.changes_requested),
     // tracked across the full ledger so an already-blocked ticket still carries a
     // reason for the remediation pass to frame the nudge.
@@ -154,37 +208,72 @@ export function rebuildObservedState(postgresState, events, _now) {
     for (const event of events) {
         if (!TERMINAL_SIGNAL_TYPES.has(event.type))
             continue;
-        // Map event → ticket via run_id
+        // Map event → ticket via run_id, resolving the dispatch role (review vs.
+        // implementation) so the fold can treat review-run terminals distinctly.
         const runId = typeof event.run_id === "string" ? event.run_id : null;
-        const ticketKey = runId ? runIdToTicketKey.get(runId) : undefined;
-        if (!ticketKey)
+        const mapped = runId ? runIdToTicketKey.get(runId) : undefined;
+        if (!mapped)
+            continue;
+        const ticketKey = mapped.ticketKey;
+        const isReview = mapped.isReview;
+        // BAPI-445 FAIL-SAFE: a review run's INCIDENTAL terminals (run.stopped,
+        // gate.met, …) must never advance a `reviewing` ticket — ONLY an explicit
+        // spec_review.* verdict does. A review session merely ending must not fold
+        // reviewing → ready and dispatch implementation regardless of whether the
+        // review requested changes (that would be fail-OPEN). When the verdict is
+        // not (yet) emitted, the ticket stays in `reviewing` and the reconcile
+        // liveness-recovery / escalation path surfaces it for operator attention —
+        // implementation never silently proceeds without a pass verdict.
+        const isSpecVerdict = event.type === "spec_review.passed" ||
+            event.type === "spec_review.changes_requested";
+        if (isReview && !isSpecVerdict)
             continue;
         // Record the blocking reason (latest wins; events are seq-ordered) regardless
         // of fold state, so a ticket blocked on a prior tick still resolves a reason.
         if (event.type === "ci.failed" || event.type === "review.changes_requested") {
             ticketBlockedReasons.set(ticketKey, event.type);
         }
+        else if (event.type === "spec_review.changes_requested") {
+            // BAPI-445: spec-review rejection. Tagged distinctly so reconcile escalates
+            // it without spending the BAPI-441 implementation remediation budget.
+            ticketBlockedReasons.set(ticketKey, "spec_review.changes_requested");
+        }
         const postgresStatus = ticketStatusMap.get(ticketKey) ?? "planned";
         if (!isNonTerminal(postgresStatus))
             continue;
-        // Only queue for merge actioning if this ticket hasn't already been folded
-        // this tick. Without this guard, two gate.met events for the same ticket
-        // would both enqueue, and a ci.failed → gate.met sequence would enqueue a
-        // merge action for a ticket whose effective status is "blocked".
-        if (event.type === "gate.met" && !foldedTicketKeys.has(ticketKey)) {
+        // Queue gate.met for merge actioning unless (a) this ticket's effective
+        // status this tick is non-mergeable ("blocked" — e.g. a ci.failed that
+        // folded earlier in the same batch, or a Postgres-blocked ticket whose
+        // ci.failed re-folds every tick), or (b) a gate.met for it is already
+        // queued. `postgresStatus` already reflects same-tick folds (the loop
+        // mutates `ticketStatusMap`), so a prior run.stopped fold leaves it
+        // "ready_for_review" and the merge proceeds — fixing the deadlock where a
+        // worker's run.stopped (lower seq) suppressed a later operator/CI gate.met.
+        if (event.type === "gate.met" &&
+            postgresStatus !== "blocked" &&
+            !mergeQueuedTicketKeys.has(ticketKey)) {
             pendingMergeEvents.push(event);
+            mergeQueuedTicketKeys.add(ticketKey);
         }
         const signalType = event.type;
-        const nextStatus = signalToNextStatus(signalType);
+        const nextStatus = signalToNextStatus(signalType, isReview);
         if (foldedTicketKeys.has(ticketKey)) {
-            // Allow a same-tick upgrade from ready_for_review → done when
-            // merge.succeeded arrives after gate.met in the same ledger batch.
+            // Allow a bounded same-tick upgrade of an already-folded ticket:
+            //   1. ready_for_review → done when merge.succeeded arrives after gate.met
+            //      in the same ledger batch.
+            //   2. (BAPI-445) <any review fold> → blocked when a review run's
+            //      spec_review.changes_requested arrives after its run.stopped in the
+            //      same batch. A spec-review rejection must dominate plain completion
+            //      so a changes-requested verdict is never lost to event ordering.
             // First-signal-wins for everything else: if ci.failed arrived first,
             // currentLocalStatus is "blocked" (not "ready_for_review"), so the
             // upgrade guard below is false and merge.succeeded is intentionally
             // dropped — a failed-CI ticket must not be silently advanced to done.
             const currentLocalStatus = ticketStatusMap.get(ticketKey);
-            if (currentLocalStatus === "ready_for_review" && nextStatus === "done") {
+            const mergeUpgrade = currentLocalStatus === "ready_for_review" && nextStatus === "done";
+            const specRejectUpgrade = signalType === "spec_review.changes_requested" &&
+                currentLocalStatus !== "blocked";
+            if (mergeUpgrade || specRejectUpgrade) {
                 const existingIdx = unfoldedSignals.findIndex((s) => s.ticket_key === ticketKey);
                 if (existingIdx >= 0) {
                     unfoldedSignals[existingIdx] = {

package/build/conductor/errors.js

@@ -64,6 +64,18 @@ function isSqliteBusyError(error) {
  *     the raw error text, stack, and any secret material are discarded.
  */
 export function toConductorErrorEnvelope(error) {
+    // Optional-native-binding degradation (BAPI-451): the conductor `store.ts`
+    // throws ConductorPersistenceUnavailableError when `better-sqlite3` could not be
+    // loaded. Detected by name (not instanceof) to avoid an import cycle with
+    // store.ts. Surfaced as a retryable-shaped 503 with a fixed, secret-free message
+    // so the caller learns persistence is unavailable instead of getting an opaque 500.
+    if (error instanceof Error && error.name === "ConductorPersistenceUnavailableError") {
+        return {
+            error: "PERSISTENCE_UNAVAILABLE",
+            status: 503,
+            message: "Conductor persistence is unavailable (the optional better-sqlite3 native module is not loaded). Conductor coordination features are disabled; core tools are unaffected.",
+        };
+    }
     if (error instanceof ConductorValidationError) {
         // Validation messages are conductor-authored and name the offending field,
         // never its value — but redact defensively so an adversarial/secret-bearing

package/build/conductor/git-ci-types.js

@@ -33,6 +33,16 @@ export const DEFAULT_GATE_NAME = "done";
 export const REVIEW_PASSED = "review.passed";
 /** Event type emitted when a reviewer requests changes. */
 export const REVIEW_CHANGES_REQUESTED = "review.changes_requested";
+/**
+ * BAPI-445 pre-implementation SPEC re-review verdict event types. Emitted by the
+ * spec re-review run (``/review-ticket --auto``), correlated to that review run,
+ * and kept distinct from the PR-review {@link REVIEW_PASSED} /
+ * {@link REVIEW_CHANGES_REQUESTED} verdicts so a spec-review outcome is never
+ * folded as the implementation PR's review state.
+ */
+export const SPEC_REVIEW_PASSED = "spec_review.passed";
+/** Event type emitted when a spec re-review requests changes. */
+export const SPEC_REVIEW_CHANGES_REQUESTED = "spec_review.changes_requested";
 /** Matches ASCII control characters (C0 range plus DEL). */
 const CONTROL_CHAR_RE = /[\u0000-\u001F\u007F]/;
 /** Matches a 40- or 64-character hex string (git SHA-1 / SHA-256 object ids). */