@bridge_gpt/mcp-server 0.2.18 → 0.2.19

package/build/conductor/epic-runtime.js

@@ -24,6 +24,7 @@ import { observePrCiOnce } from "./pr-ci-producer.js";
 import { runGhCommand } from "./pr-discovery.js";
 import { isPrMergeConflict, parseGhPrMergeabilityFields, } from "./github-mergeability.js";
 import { makeLocalMergeExecutor, resolveLocalMergeMethod } from "./local-merge.js";
+import { getHeadSha, getPrNumber } from "./event-accessors.js";
 import { emitConductorEventIfNew } from "./producer-ledger.js";
 import { rebuildObservedState, extractWorkerLiveness, } from "./epic-state.js";
 import { reconcileEpic } from "./epic-reconcile.js";
@@ -130,6 +131,200 @@ export function resolveTicketPrBindingFromGh(ticketKey, options = {}) {
     }
     return null;
 }
+// ---------------------------------------------------------------------------
+// Dispatched/running done-gate backstop (BAPI-525 Change B)
+// ---------------------------------------------------------------------------
+/** Conservative default quiescence window (ticks) for the dispatched backstop. */
+const DEFAULT_DISPATCHED_BACKSTOP_QUIESCENCE_TICKS = 3;
+/** The conservative default (disabled) dispatched-backstop policy. */
+export const DEFAULT_DISPATCHED_BACKSTOP_POLICY = {
+    enabled: false,
+    quiescence_ticks: DEFAULT_DISPATCHED_BACKSTOP_QUIESCENCE_TICKS,
+    quiescence_ms: null,
+};
+/** Accept only a positive integer; every other shape (0, negative, float, string, NaN) → null. */
+function parsePositiveInt(value) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
+}
+/**
+ * Resolve the dispatched-backstop policy from an epic run's `policy_json`.
+ * Fail-closed to {@link DEFAULT_DISPATCHED_BACKSTOP_POLICY} on any missing/malformed
+ * shape. Only a literal boolean `true` enables the path; `quiescence_ticks` /
+ * `quiescence_ms` accept only positive integers and otherwise fall back to the
+ * conservative default (ticks) / `null` (ms). Mirrors the defensive style used for
+ * `policy_json.post_action_waits.parse_after_merge`.
+ */
+export function resolveDispatchedBackstopPolicy(policyJson) {
+    const doneGate = policyJson && typeof policyJson === "object" && !Array.isArray(policyJson)
+        ? policyJson.done_gate
+        : undefined;
+    const cfg = doneGate && typeof doneGate === "object" && !Array.isArray(doneGate)
+        ? doneGate.dispatched_backstop
+        : undefined;
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) {
+        return { ...DEFAULT_DISPATCHED_BACKSTOP_POLICY };
+    }
+    const record = cfg;
+    return {
+        enabled: record.enabled === true,
+        quiescence_ticks: parsePositiveInt(record.quiescence_ticks) ?? DEFAULT_DISPATCHED_BACKSTOP_QUIESCENCE_TICKS,
+        quiescence_ms: parsePositiveInt(record.quiescence_ms),
+    };
+}
+/** Reuse the single active-worker status set as the backstop admission set. */
+export function isActiveWorkerStatus(status) {
+    return ACTIVE_WORKER_STATUSES.has(status);
+}
+/**
+ * The base done-gate statuses (`ready_for_review`/`blocked`) whose behavior is
+ * unchanged by BAPI-525 — no quiescence gate is applied to them.
+ */
+export function isBaseDoneGateStatus(status) {
+    return status === "ready_for_review" || status === "blocked";
+}
+/**
+ * Head-changing event families used to compute stable-head quiescence. `getHeadSha`
+ * reads the canonical `data.details.head_sha` regardless of the typed details
+ * family, so `git.commit_created` (details-less in the accessor map) still yields a
+ * head when the raw envelope carries one.
+ */
+const HEAD_CHANGING_EVENT_TYPES = new Set([
+    "git.pr_opened",
+    "git.commit_created",
+    "ci.passed",
+    "review.passed",
+    "gate.met",
+]);
+/**
+ * Build a local-first PR binding resolver for the dispatched backstop (BAPI-525
+ * Change B, Requirement 5). Resolution order per ticket:
+ *   1. dispatch/run-state PR binding — SKIPPED: `EpicDispatch`/`EpicTicketStatus`
+ *      carry no PR number/head SHA and `pr_bindings` is a legacy always-null seam,
+ *      so there is no durable PR binding on run state to consult (documented here so
+ *      a future state-model addition knows to wire it in first).
+ *   2. the newest local ledger event (by `seq`) carrying BOTH a valid `pr_number`
+ *      and `head_sha` (e.g. a `gate.met`), read through the typed `getPrNumber` /
+ *      `getHeadSha` accessors and normalized fail-closed.
+ *   3. a `gh pr view feature/<KEY>` lookup, with NEGATIVE results cached per tick so
+ *      a ticket with no open PR is never polled twice in the same tick.
+ * A local binding carries `mergeable`/`mergeStateStatus: null` (unknown without the
+ * gh call); a conflict check treats `null` as non-conflicting.
+ */
+export function buildTicketPrBindingResolver(deps) {
+    // Precompute ticket_key -> newest local (pr_number, head_sha) binding.
+    const localByTicket = new Map();
+    for (const ev of deps.events) {
+        const prNumber = getPrNumber(ev);
+        const headSha = getHeadSha(ev);
+        if (prNumber === null || headSha === null)
+            continue;
+        let ticketKey = null;
+        if (typeof ev.run_id === "string" && deps.resolveTicketForRunId) {
+            ticketKey = deps.resolveTicketForRunId(ev.run_id);
+        }
+        if (!ticketKey && typeof ev.subject === "string" && ev.subject.trim().length > 0) {
+            ticketKey = ev.subject;
+        }
+        if (!ticketKey)
+            continue;
+        const prev = localByTicket.get(ticketKey);
+        if (!prev || ev.seq >= prev.seq) {
+            localByTicket.set(ticketKey, {
+                seq: ev.seq,
+                binding: {
+                    prNumber,
+                    headSha: headSha.toLowerCase(),
+                    mergeable: null,
+                    mergeStateStatus: null,
+                },
+            });
+        }
+    }
+    // Per-tick gh cache: memoize BOTH hits and misses so a missing PR is looked up at
+    // most once per ticket per tick (Requirement 5 — no gh/CI thrash on dispatched).
+    const ghCache = new Map();
+    return (ticketKey) => {
+        const local = localByTicket.get(ticketKey);
+        if (local)
+            return local.binding;
+        if (ghCache.has(ticketKey))
+            return ghCache.get(ticketKey) ?? null;
+        const gh = deps.resolveFromGh(ticketKey);
+        ghCache.set(ticketKey, gh);
+        return gh;
+    };
+}
+/**
+ * Build the active-ticket quiescence resolver (BAPI-525 Change B, Requirement 6).
+ * A `dispatched`/`running` ticket is folded toward `ready_for_review` ONLY when its
+ * PR-bound completion evidence (resolved by the caller) is accompanied by a
+ * quiescence signal — NEVER on green-PR evidence alone, because workers are
+ * interactive and may still be pushing follow-up commits:
+ *
+ *   - an explicit implementation `run.stopped` for the ticket's impl run, OR
+ *   - a head SHA that MATCHES the candidate PR head AND has been stable for at least
+ *     `policy.quiescence_ms` since the latest head-changing ledger event.
+ *
+ * `quiescence_ticks` is parsed and carried on the policy but is NOT used here: the
+ * conductor has no durable per-tick marker to count "N consecutive ticks" against,
+ * and tick stability MUST NOT be faked from process memory (it would not survive a
+ * restart). When only `quiescence_ticks` is configured (no `quiescence_ms`), the
+ * stable-head path cannot prove quiescence and only `run.stopped` folds the ticket.
+ * Worker MCP heartbeats (`message.delivered`/`message.acked`) are deliberately NOT
+ * used as the reliable primitive — that channel is exactly what fails in Issue 1.
+ */
+export function buildActiveTicketQuiescenceResolver(deps) {
+    return (ticketKey, prBinding) => {
+        if (!deps.policy.enabled)
+            return { quiescent: false, reason: "policy_disabled" };
+        const implRunId = deps.resolveImplRunId(ticketKey);
+        // Select the ticket's implementation-run events. Prefer the impl run_id (which
+        // excludes any `:review` run); fall back to subject match when no run is known.
+        const matchesTicket = (ev) => implRunId !== null
+            ? ev.run_id === implRunId
+            : ev.subject === ticketKey;
+        // Explicit completion evidence: an implementation `run.stopped`.
+        for (const ev of deps.events) {
+            if (ev.type === "run.stopped" && matchesTicket(ev)) {
+                return { quiescent: true, reason: "run.stopped" };
+            }
+        }
+        // Stable-head evidence: latest head-changing event for the impl run.
+        let latest = null;
+        for (const ev of deps.events) {
+            if (!HEAD_CHANGING_EVENT_TYPES.has(ev.type) || !matchesTicket(ev))
+                continue;
+            const headSha = getHeadSha(ev);
+            if (headSha === null)
+                continue;
+            const timeMs = typeof ev.time === "string" ? Date.parse(ev.time) : NaN;
+            if (Number.isNaN(timeMs))
+                continue;
+            if (!latest || ev.seq >= latest.seq) {
+                latest = { headSha: headSha.toLowerCase(), timeMs, seq: ev.seq };
+            }
+        }
+        if (!latest)
+            return { quiescent: false, reason: "no_signal" };
+        if (latest.headSha !== prBinding.headSha.toLowerCase()) {
+            return { quiescent: false, reason: "unstable_head", last_head_event_time: latest.timeMs };
+        }
+        // Head matches the candidate PR head. Prove stability via the ms window only.
+        if (deps.policy.quiescence_ms === null) {
+            return { quiescent: false, reason: "no_signal", last_head_event_time: latest.timeMs };
+        }
+        const stableMs = deps.nowMs - latest.timeMs;
+        if (stableMs >= deps.policy.quiescence_ms) {
+            return {
+                quiescent: true,
+                reason: "stable_head",
+                stable_ms: stableMs,
+                last_head_event_time: latest.timeMs,
+            };
+        }
+        return { quiescent: false, reason: "unstable_head", last_head_event_time: latest.timeMs };
+    };
+}
 /**
  * For each `ready_for_review` ticket — and (BAPI-487) each `blocked` ticket whose
  * live PR head has advanced past the head that blocked it — ask the conductor to
@@ -151,14 +346,39 @@ export function resolveTicketPrBindingFromGh(ticketKey, options = {}) {
  * PR binding, are skipped.
  */
 export async function runConductorDoneGatePass(ticketStatuses, deps) {
+    const backstopEnabled = deps.dispatchedBackstopPolicy?.enabled === true;
     for (const [ticketKey, status] of ticketStatuses) {
-        if (status !== "ready_for_review" && status !== "blocked")
+        // BAPI-525 Change B: admit the base statuses (ready_for_review/blocked) always;
+        // admit the active statuses (dispatched/running) ONLY when the dispatched
+        // backstop is enabled. Every other status (terminal, planned, reviewing, …) is
+        // skipped before any PR binding / CI observation, exactly as before.
+        const isActive = isActiveWorkerStatus(status);
+        if (!isBaseDoneGateStatus(status) && !(isActive && backstopEnabled))
             continue;
-        const prBinding = deps.resolvePrBinding(ticketKey);
+        // Base statuses always resolve the CURRENT head via gh-discovery (unchanged).
+        // Active statuses use the local-first resolver (BAPI-525 Change B) so a
+        // dispatched ticket with no local PR binding is not re-polled every tick.
+        const prBinding = isActive
+            ? (deps.resolveActivePrBinding ?? deps.resolvePrBinding)(ticketKey)
+            : deps.resolvePrBinding(ticketKey);
         if (prBinding === null) {
             deps.log(`[epic-tick] done-gate poll for ${ticketKey}: skipped (no PR binding)`);
             continue;
         }
+        // BAPI-525 Change B: an admitted active ticket is folded ONLY when quiescent
+        // (explicit run.stopped or a stable head) — never on green-PR evidence alone, so
+        // an interactive worker still pushing commits is not yanked out from under.
+        if (isActive) {
+            const quiescence = deps.resolveActiveTicketQuiescence?.(ticketKey, prBinding) ?? {
+                quiescent: false,
+                reason: "no_signal",
+            };
+            if (!quiescence.quiescent) {
+                deps.log(`[epic-tick] done-gate poll for ${ticketKey}: skipped (${status} not quiescent: ${quiescence.reason})`);
+                continue;
+            }
+            deps.log(`[epic-tick] done-gate backstop for ${ticketKey}: ${status} quiescent (${quiescence.reason}); evaluating done-gate at head ${prBinding.headSha}`);
+        }
         // BAPI-487: gate a `blocked` ticket's re-evaluation on its head advancing.
         if (status === "blocked") {
             const blockedHead = deps.resolveBlockedHeadSha?.(ticketKey) ?? null;
@@ -175,12 +395,13 @@ export async function runConductorDoneGatePass(ticketStatuses, deps) {
                     `superseded by current head ${prBinding.headSha}; re-evaluating`);
             }
         }
-        // Stamp the ticket's run_id AND worker_id onto the emitted gate.met via a
-        // per-ticket env override (observePrCiOnce reads BAPI_CONDUCTOR_RUN_ID/
-        // _WORKER_ID from env, env taking precedence). run_id correlates the fold to
-        // the ticket; a non-empty worker_id is required for the merge to enqueue
-        // (merge-ledger extractMergeActionIdentityFromGateEvent). Both must be present
-        // or the conductor-emitted gate.met folds/merges to nothing.
+        // Stamp the ticket's run_id and (when available) worker_id onto the emitted
+        // gate.met via a per-ticket env override (observePrCiOnce reads
+        // BAPI_CONDUCTOR_RUN_ID/_WORKER_ID from env, env taking precedence). run_id
+        // correlates the fold to the ticket. worker_id is attribution ONLY: BAPI-525
+        // Change A removed the worker_id requirement from merge-identity extraction, so
+        // a missing worker_id no longer blocks the merge — the backstop stamps real
+        // attribution when it can resolve it and merges regardless when it cannot.
         const runId = deps.resolveRunId?.(ticketKey) ?? null;
         const workerId = deps.resolveWorkerId?.(ticketKey) ?? null;
         // BAPI-494: a `ready_for_review` PR that is already un-mergeable
@@ -439,7 +660,6 @@ export async function runEpicTick(options, deps = {}) {
         const isParseWaitEnabled = pamConfig?.enabled === true;
         if (isParseWaitEnabled) {
             const maxWaitMs = typeof pamConfig?.max_wait_ms === "number" ? pamConfig.max_wait_ms : 10 * 60 * 1000;
-            const settleMs = 5000;
             const fetchParseStatusFn = deps.fetchParseStatus ?? fetchParseStatus;
             const triggerParseFn = deps.triggerParse ?? triggerRepositoryParse;
             for (let i = 0; i < observed.unfolded_terminal_signals.length; i++) {
@@ -476,26 +696,52 @@ export async function runEpicTick(options, deps = {}) {
                     e.run_id === mergeRunId &&
                     new Date(e.time).getTime() >= mergeTimeMs);
                 const elapsedMs = nowFn() - mergeTimeMs;
-                // Budget exhaustion (measured from the durable merge.succeeded time):
-                // escalate once (gated on the durable Postgres status, not an in-memory
-                // flag) then block. A subsequent tick finds it already blocked and drops
-                // the signal without re-escalating or re-CASing.
-                if (elapsedMs > maxWaitMs) {
+                // BAPI-527: enter (or hold at) the explicit parse_pending state. This
+                // replaces the old "revert to ready_for_review and hold" behavior — a
+                // merged ticket whose post-merge parse is queued/running is now DURABLY
+                // parse_pending, so the state is observable between stateless epic-tick
+                // processes. When the ticket is ALREADY durably parse_pending we hold
+                // WITHOUT a churny re-CAS (revert drops the signal, leaving the Postgres row
+                // untouched); otherwise we retag the merge.succeeded fold to parse_pending so
+                // reconcile CASes it there.
+                const holdOrEnterParsePending = () => {
+                    if (currentPgStatus === "parse_pending") {
+                        revertSignal();
+                        return;
+                    }
+                    signal.next_status = "parse_pending";
+                    observed.ticket_statuses.set(ticketKey, "parse_pending");
+                };
+                // BAPI-527: fold to `blocked` for a terminal parse failure or an exhausted
+                // wait budget. Escalates exactly once, gated on the durable Postgres status
+                // (not an in-memory flag): a later tick that finds the ticket already
+                // `blocked` drops the signal without re-escalating or re-CASing. EVERY
+                // terminal failure/timeout path routes through here, so a permanent parse
+                // failure can never silently wedge the epic at parse_pending. `reason` is a
+                // bounded, secret-free summary — never subprocess stderr/traceback.
+                const foldToBlocked = async (reason) => {
                     if (currentPgStatus === "blocked") {
                         observed.ticket_statuses.set(ticketKey, "blocked");
                         observed.unfolded_terminal_signals.splice(i, 1);
                         i -= 1;
-                        continue;
+                        return;
                     }
-                    await escalateOnce(epic_key, `parse-after-merge budget exhausted for ${ticketKey}`);
+                    await escalateOnce(epic_key, reason);
                     signal.next_status = "blocked";
                     observed.ticket_statuses.set(ticketKey, "blocked");
                     // Let the signal remain so the reconcile pass CASes once to blocked.
+                };
+                // Budget exhaustion (measured from the durable merge.succeeded time):
+                // escalate once then block with a parse-timeout reason.
+                if (elapsedMs > maxWaitMs) {
+                    await foldToBlocked(`parse-after-merge timed out (budget exhausted) for ${ticketKey}`);
                     continue;
                 }
                 if (!parseTriggeredEvent) {
-                    // No durable trigger for this merge yet — fire the parse and record the
-                    // marker, then hold at ready_for_review for a later tick to fold.
+                    // No durable trigger for this merge yet — fire the parse, record the
+                    // marker, and set the ticket to parse_pending. DO NOT poll parse status
+                    // in the SAME tick as the trigger, so parse_pending is always observable
+                    // after merge before any success/failure fold.
                     try {
                         await triggerParseFn(access);
                         emitConductorEventFn({
@@ -520,16 +766,20 @@ export async function runEpicTick(options, deps = {}) {
                             run_id: mergeRunId ?? undefined,
                             commit_sha: mergeHeadSha,
                         });
-                        log(`[epic-tick] triggered parse-after-merge for ${ticketKey} in epic=${epic_key}`);
+                        log(`[epic-tick] triggered parse-after-merge for ${ticketKey} in epic=${epic_key}; holding at parse_pending`);
+                        holdOrEnterParsePending();
                     }
                     catch (err) {
                         const safeMsg = err instanceof Error ? err.constructor.name : "trigger error";
                         errorLog(`[epic-tick] parse trigger failed (${safeMsg}) for ${ticketKey}; will retry next tick`);
+                        // Transient trigger failure: hold the merge.succeeded signal for the
+                        // next tick rather than folding to done/blocked.
+                        revertSignal();
                     }
-                    revertSignal();
                     continue;
                 }
-                // A durable parse.triggered exists for this merge — poll the live lock.
+                // A durable parse.triggered exists for this merge — poll the durable parse
+                // status surface (BAPI-527: idle | queued | in_progress | succeeded | failed).
                 let parseStatusResult;
                 try {
                     parseStatusResult = await fetchParseStatusFn(access);
@@ -537,30 +787,84 @@ export async function runEpicTick(options, deps = {}) {
                 catch (err) {
                     const safeMsg = err instanceof Error ? err.constructor.name : "fetch error";
                     errorLog(`[epic-tick] parse-status check failed (${safeMsg}) for ${ticketKey}; will retry next tick`);
-                    revertSignal();
+                    // Transient status-fetch failure: hold in parse_pending for the next tick.
+                    holdOrEnterParsePending();
                     continue;
                 }
-                if (parseStatusResult.status === "in_progress") {
-                    // Parse still running — hold.
-                    revertSignal();
+                if (parseStatusResult.status === "failed") {
+                    // Terminal parse failure — emit a compact parse.failed marker, then fold
+                    // to blocked (escalate-once). `last_error` is already a bounded, sanitized
+                    // backend summary; the marker carries no stdout/stderr/stack/command.
+                    emitConductorEventFn({
+                        source: PARSE_WAIT_EVENT_SOURCE,
+                        type: "parse.failed",
+                        subject: ticketKey,
+                        run_id: mergeRunId,
+                        worker_id: mergeEvent.worker_id ?? null,
+                        producer: PARSE_WAIT_EVENT_PRODUCER,
+                        observed_via: "supervisor",
+                        time: new Date(nowFn()).toISOString(),
+                        data: {
+                            summary: `parse-after-merge failed for ${ticketKey}`,
+                            status: "failed",
+                            reason: "parse_failed",
+                            details: {
+                                epic_key,
+                                ticket_key: ticketKey,
+                                ...(mergeHeadSha ? { head_sha: mergeHeadSha } : {}),
+                                ...(typeof parseStatusResult.last_error === "string"
+                                    ? { last_error: parseStatusResult.last_error }
+                                    : {}),
+                                ...(typeof parseStatusResult.attempt_count === "number"
+                                    ? { attempt_count: parseStatusResult.attempt_count }
+                                    : {}),
+                            },
+                        },
+                    }, {
+                        event_type: "parse.failed",
+                        run_id: mergeRunId ?? undefined,
+                        commit_sha: mergeHeadSha,
+                    });
+                    await foldToBlocked(`parse-after-merge failed for ${ticketKey}`);
                     continue;
                 }
-                // status === "idle". If the marker is younger than the settle window, the
-                // async parse may not have acquired its lock yet (idle is a false negative)
-                // — hold one more tick. Past the settle window, idle means the post-merge
-                // parse has completed (or finished instantly), so let the merge.succeeded
-                // signal proceed to CAS → done.
-                //
-                // KNOWN LIMITATION: /jira/parse-status only reports {in_progress, idle} —
-                // it cannot distinguish a FAILED parse from a completed one, so an instant
-                // parse failure folds to `done` here. Pre-existing; tracked as P2 (surface
-                // a parse failure/last_error from parse-status).
-                const msSinceTrigger = nowFn() - new Date(parseTriggeredEvent.time).getTime();
-                if (msSinceTrigger < settleMs) {
-                    revertSignal();
+                if (parseStatusResult.status === "succeeded") {
+                    // Terminal parse success — emit a compact parse.succeeded marker and let
+                    // the original merge.succeeded signal proceed with next_status="done".
+                    emitConductorEventFn({
+                        source: PARSE_WAIT_EVENT_SOURCE,
+                        type: "parse.succeeded",
+                        subject: ticketKey,
+                        run_id: mergeRunId,
+                        worker_id: mergeEvent.worker_id ?? null,
+                        producer: PARSE_WAIT_EVENT_PRODUCER,
+                        observed_via: "supervisor",
+                        time: new Date(nowFn()).toISOString(),
+                        data: {
+                            summary: `parse-after-merge succeeded for ${ticketKey}`,
+                            status: "succeeded",
+                            reason: "parse_succeeded",
+                            details: {
+                                epic_key,
+                                ticket_key: ticketKey,
+                                ...(mergeHeadSha ? { head_sha: mergeHeadSha } : {}),
+                            },
+                        },
+                    }, {
+                        event_type: "parse.succeeded",
+                        run_id: mergeRunId ?? undefined,
+                        commit_sha: mergeHeadSha,
+                    });
+                    log(`[epic-tick] parse-after-merge succeeded for ${ticketKey}; folding merge.succeeded → done`);
+                    // Do NOT revert: signal.next_status stays "done" (from the merge.succeeded
+                    // fold) so reconcile CASes the ticket to done.
                     continue;
                 }
-                // Completed: do not revert — the signal proceeds to CAS → done.
+                // status is queued | in_progress | idle. All are NON-terminal for a
+                // triggered parse: queued/in_progress are self-evidently still running, and
+                // BAPI-527 treats `idle` as unknown/not-yet-terminal — NEVER fold to done
+                // from idle (only an explicit `succeeded` does that). Hold at parse_pending.
+                holdOrEnterParsePending();
             }
         }
         // Step 4: Fetch + assert plan integrity (only if fetchPlan injected)
@@ -726,8 +1030,11 @@ export async function runEpicTick(options, deps = {}) {
             // caught per-ticket so it can never crash or block the reconcile loop, and
             // `observePrCiOnce` emits nothing on an unavailable/ambiguous/stale-head signal.
             // run_id → worker_id from the ledger (first worker_id seen per run) so the
-            // conductor-emitted gate.met carries the real worker's id; fall back to a
-            // synthetic conductor id so the merge-identity presence check always passes.
+            // conductor-emitted gate.met carries the real worker's id for ATTRIBUTION.
+            // BAPI-525 Change A: merge eligibility no longer depends on worker_id, so an
+            // unresolved worker maps to `null` (real attribution or nothing) — the old
+            // synthetic `conductor:${tk}` fallback existed only to satisfy the now-removed
+            // merge-identity presence check and is no longer needed.
             const runIdToWorkerId = new Map();
             for (const ev of localEvents) {
                 if (ev.run_id && ev.worker_id && !runIdToWorkerId.has(ev.run_id)) {
@@ -739,11 +1046,54 @@ export async function runEpicTick(options, deps = {}) {
                 const rid = resolveTicketRunId(tk);
                 if (rid && runIdToWorkerId.has(rid))
                     return runIdToWorkerId.get(rid);
-                return `conductor:${tk}`;
+                return null;
+            };
+            // BAPI-525 Change A: durable worker attribution for a `gate.met` that carries
+            // no worker_id (e.g. the autonomous git-hook chain). Used ONLY to stamp the
+            // emitted `merge.*` ledger events for audit — NEVER a merge gate. Resolves via
+            // the event's run_id, else the event subject's implementation dispatch run,
+            // else null (a null attribution is tolerated end-to-end).
+            const resolveWorkerIdForGateEvent = (event, _identity) => {
+                const directRid = typeof event.run_id === "string" && event.run_id.trim().length > 0
+                    ? event.run_id
+                    : null;
+                const rid = directRid ??
+                    (typeof event.subject === "string" && event.subject.trim().length > 0
+                        ? resolveTicketRunId(event.subject)
+                        : null);
+                if (rid && runIdToWorkerId.has(rid))
+                    return runIdToWorkerId.get(rid);
+                return null;
             };
+            // BAPI-525 Change B: resolve the per-run dispatched-backstop policy (default
+            // OFF). When enabled, the done-gate pass ALSO admits dispatched/running
+            // tickets, gated by quiescence. Invert the impl-dispatch maps so ledger
+            // events can be attributed back to a ticket for local-first PR binding.
+            const dispatchedBackstopPolicy = resolveDispatchedBackstopPolicy(epicRunState.epic_run.policy_json);
+            const ticketForRunId = new Map();
+            for (const [tk, rid] of ticketRunIdMap)
+                ticketForRunId.set(rid, tk);
+            for (const [tk, info] of latestDispatchByTicket)
+                ticketForRunId.set(info.runId, tk);
+            const resolveActivePrBinding = buildTicketPrBindingResolver({
+                events: localEvents,
+                resolveTicketForRunId: (rid) => ticketForRunId.get(rid) ?? null,
+                resolveFromGh: resolvePrBinding,
+            });
+            const resolveActiveTicketQuiescence = buildActiveTicketQuiescenceResolver({
+                events: localEvents,
+                nowMs: nowFn(),
+                policy: dispatchedBackstopPolicy,
+                resolveImplRunId: resolveTicketRunId,
+            });
             await runConductorDoneGatePass(observed.ticket_statuses, {
                 observePrCi: observePrCiSeamFn,
                 resolvePrBinding,
+                // BAPI-525 Change B: local-first binding + quiescence gate for the new
+                // dispatched/running admission (policy default OFF ⇒ no behavior change).
+                resolveActivePrBinding,
+                dispatchedBackstopPolicy,
+                resolveActiveTicketQuiescence,
                 // BAPI-487: re-evaluate a blocked ticket only when its PR head advanced
                 // past the head recorded on its latest blocking signal.
                 resolveBlockedHeadSha: (tk) => observed.ticket_blocked_heads?.get(tk) ?? null,
@@ -900,8 +1250,12 @@ export async function runEpicTick(options, deps = {}) {
                                     method: resolveLocalMergeMethod(localCfg.method),
                                     approvalRequired: localCfg.approval_required === true,
                                 }, { env: process.env }),
+                                // BAPI-525 Change A: durable attribution for a worker_id-less gate.met.
+                                resolveWorkerIdForGateEvent,
                             });
                         }
+                        // Default (backend-route) path, with durable merge attribution wired in.
+                        return processGateMetMerge(acc, event, { resolveWorkerIdForGateEvent });
                     }
                     return processMergeFn(acc, event);
                 },
@@ -1292,8 +1646,14 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
                 // code. With refreshMain:false the worktree was cut from a STALE local
                 // `main` (never fetched/ff'd after the predecessor merged on origin), so
                 // dependents built without the predecessor's code — defeating the whole
-                // merge-gated handoff. Refresh (fetch origin + ff local base) before cut.
+                // merge-gated handoff. Refresh (fetch origin) before cut.
                 refreshMain: true,
+                // BAPI-527 (Step 10): unattended conductor dispatch must NOT mutate the
+                // operator's local checkout. `nonMutatingBase: true` resolves origin/<base>
+                // via a fetch-only immutable SHA and cuts new worktrees from it — never a
+                // `git merge --ff-only` / `git branch --force` / branch switch on the host
+                // checkout. Interactive start-tickets keeps the old refreshBaseBranch path.
+                nonMutatingBase: true,
                 branchOverrides: {},
                 baseBranch: "main",
                 conductorEnabled: true,

package/build/conductor/epic-state.js

@@ -46,6 +46,13 @@ const NON_TERMINAL_STATUSES = new Set([
     // reviewing ticket is mid-flight, not ready. Stranded reviewing tickets are
     // re-driven by reconcile's dedicated reviewing re-entry branch.
     "reviewing",
+    // BAPI-527: asynchronous post-merge parse. Non-terminal so the durable
+    // merge.succeeded signal keeps re-folding across ticks until parse-after-merge
+    // resolves it to `done` (terminal parse success) or `blocked` (permanent parse
+    // failure/timeout). computeReadySet only ever returns `planned`/`ready`, so a
+    // parse_pending ticket is never (re)dispatched, and only `done` satisfies a
+    // dependency — a merged-but-not-yet-parsed predecessor cannot unblock dependents.
+    "parse_pending",
 ]);
 const TERMINAL_SIGNAL_TYPES = new Set([
     "gate.met",