@bridge_gpt/mcp-server 0.2.21 → 0.2.23

package/build/start-tickets.js

@@ -71,6 +71,7 @@ import { WORKTRUNK_BINARY_OVERRIDE_ENV, WINDOWS_TERMINAL_COMMAND, WINDOWS_POWERS
 import { DEFAULT_AGENT_NAME, resolveAgentSpec, isAgentName, formatValidAgentNames, resolveModelAlias, isValidModelAlias, isModelTier, } from "./agent-registry.js";
 import { createStartTicketsConductorContext, provisionConductorHooksForRows, emitStartTicketsRunStarted, injectConductorEnvIntoShellCommand, buildSupervisorTabCommand, isSupervisorLaunchEnabled, supervisorSpawnKey, } from "./start-tickets-conductor.js";
 import { transitionEpicDispatch, resolveConductorBridgeApiAccess, } from "./conductor/bridge-api-client.js";
+import { PR_BASE_BRANCH_ENV_VAR, buildPrBaseContractLaunchInstruction, } from "./pr-base-contract.js";
 // Re-export the shared prereq surface (constants, platform helpers, command
 // probes) so existing import sites that read them from "./start-tickets.js"
 // keep working unchanged.
@@ -101,6 +102,8 @@ export function getStartTicketsUsage() {
         "",
         "Flags:",
         "  --agent claude|cursor-agent Agent command to launch in each worktree (default: claude)",
+        "  --workflow implement|review-and-implement  Slash command each spawned worktree runs (default: implement). review-and-implement runs /review-ticket then, after a per-ticket halt gate, /implement-ticket in the same session; --auto applies to the selected workflow.",
+        "  --rounds 1|2                Review round count forwarded to the review phase; review-only, valid only with --workflow review-and-implement",
         "  --terminal terminal|iterm   Override the macOS terminal app (default: auto-detect via $TERM_PROGRAM); honored on macOS only",
         "  --dry-run                   Print intended actions; creates no worktrees and opens no tabs, but DOES resolve model routing read-only (may compute+cache a ticket's difficulty) to preview the --model each tab would use",
         "  --branch KEY=BRANCH         Use BRANCH instead of feature/KEY for that ticket (repeatable)",
@@ -151,6 +154,8 @@ export function parseStartTicketsArgs(argv) {
     let agentName = DEFAULT_AGENT_NAME;
     let baseBranch = "main";
     let conductorEnabled = false;
+    let workflow = "implement";
+    let reviewRoundsRaw;
     const branchEntries = [];
     const keys = [];
     for (let i = 0; i < argv.length; i++) {
@@ -183,6 +188,49 @@ export function parseStartTicketsArgs(argv) {
             agentName = value;
             continue;
         }
+        if (arg === "--workflow" || arg.startsWith("--workflow=")) {
+            let value;
+            if (arg.startsWith("--workflow=")) {
+                value = arg.slice("--workflow=".length);
+            }
+            else {
+                value = takeValue();
+                if (value === undefined) {
+                    return {
+                        status: "error",
+                        message: "--workflow requires a value (allowed values: implement, review-and-implement).",
+                    };
+                }
+            }
+            if (value !== "implement" && value !== "review-and-implement") {
+                return {
+                    status: "error",
+                    message: `Invalid --workflow value: '${value}' (allowed values: implement, review-and-implement).`,
+                };
+            }
+            workflow = value;
+            continue;
+        }
+        if (arg === "--rounds" || arg.startsWith("--rounds=")) {
+            let value;
+            if (arg.startsWith("--rounds=")) {
+                value = arg.slice("--rounds=".length);
+            }
+            else {
+                value = takeValue();
+                if (value === undefined) {
+                    return { status: "error", message: "--rounds requires a value (allowed values: 1, 2)." };
+                }
+            }
+            if (value !== "1" && value !== "2") {
+                return {
+                    status: "error",
+                    message: `Invalid --rounds value: '${value}' (allowed values: 1, 2).`,
+                };
+            }
+            reviewRoundsRaw = value;
+            continue;
+        }
         if (arg === "--terminal" || arg.startsWith("--terminal=")) {
             let value;
             if (arg.startsWith("--terminal=")) {
@@ -337,29 +385,38 @@ export function parseStartTicketsArgs(argv) {
         }
         branchOverrides[overrideKey] = branchName;
     }
+    // --- rounds validation: review-only, checked after the full argument scan
+    // so flag order (e.g. --rounds before --workflow) never affects validation.
+    let reviewRounds;
+    if (reviewRoundsRaw !== undefined) {
+        if (workflow !== "review-and-implement") {
+            return {
+                status: "error",
+                message: "--rounds is only valid with --workflow review-and-implement.",
+            };
+        }
+        reviewRounds = reviewRoundsRaw === "1" ? 1 : 2;
+    }
     return {
         status: "ok",
-        options: { keys, terminal, dryRun, autoApprove, refreshMain, maxParallel, branchOverrides, agentName, baseBranch, conductorEnabled },
+        options: {
+            keys,
+            terminal,
+            dryRun,
+            autoApprove,
+            refreshMain,
+            maxParallel,
+            branchOverrides,
+            agentName,
+            baseBranch,
+            conductorEnabled,
+            workflow,
+            reviewRounds,
+        },
     };
 }
-/** Returns an error string for an unsafe branch name, or null when valid. */
-export function validateBranchName(branch) {
-    if (branch.trim().length === 0)
-        return "branch name must not be empty.";
-    if (branch.length > 255)
-        return "branch name must be 255 characters or fewer.";
-    if (branch.startsWith("-"))
-        return "branch name must not start with '-'.";
-    // Reject ASCII control characters (0x00-0x1F and 0x7F) without embedding
-    // raw control bytes in source.
-    for (let i = 0; i < branch.length; i++) {
-        const code = branch.charCodeAt(i);
-        if (code <= 0x1f || code === 0x7f) {
-            return "branch name must not contain control characters.";
-        }
-    }
-    return null;
-}
+// `validateBranchName` moved to `base-ref.ts` (BAPI-586); imported + re-exported
+// above. See the import block near the worktree-core re-exports.
 /**
  * Determine which macOS terminal to drive. An explicit choice wins; otherwise
  * auto-detect iTerm from `$TERM_PROGRAM` (case-insensitive), defaulting to
@@ -403,19 +460,27 @@ export function getDefaultSpawnTerminalTabForPlatform(platform) {
 export function resolveStartTicketsPlatformConfig(deps, agent, autoApprove = false, conductorEnabled = false, repoName = null, 
 // BAPI-494: a conductor remediation re-dispatch. Appends the full-suite finalize
 // instruction to the resume-mode worker's prompt.
-resumeMode = false) {
+resumeMode = false, workflow = "implement", reviewRounds, 
+// BAPI-586: the effective run base branch (incl. epic.base_branch override).
+// Injected as BAPI_BASE_BRANCH for conductor workers so their PR targets it,
+// and threaded (BAPI-593) into the spawned workflow command.
+baseBranch) {
     if (!isSupportedStartTicketsPlatform(deps.platform)) {
         return { ok: false, error: unsupportedPlatformMessage(deps.platform) };
     }
     const platform = deps.platform;
+    // Only conductor dispatch uses the PR-base contract; interactive dispatch omits
+    // the BAPI_BASE_BRANCH assignment so its worker launch is unchanged.
+    const prBaseBranch = conductorEnabled ? baseBranch : null;
     return {
         ok: true,
         config: {
             platform,
             worktrunkBinary: resolveWorktrunkBinary(platform, deps.env),
             // Inject the resolved repo identity so the spawned worktree session never
-            // falls back to the basename-derived repo name (the 403 root cause).
-            buildAgentShellCommand: (key, worktreePath, modelAlias) => prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled, resumeMode), repoName, platform),
+            // falls back to the basename-derived repo name (the 403 root cause), and
+            // (BAPI-586) the run base so the conductor worker opens its PR against it.
+            buildAgentShellCommand: (key, worktreePath, modelAlias) => prependBaseBranchEnvAssignment(prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch), repoName, platform), prBaseBranch, platform),
             spawnTerminalTab: deps.spawnTerminalTab,
         },
     };
@@ -445,6 +510,24 @@ export function prependRepoNameEnvAssignment(command, repoName, platform = "darw
     }
     return `export BAPI_REPO_NAME='${shSquoteInner(repoName)}' && ${command}`;
 }
+/**
+ * BAPI-586: prepend a `BAPI_BASE_BRANCH` environment assignment to a spawned
+ * conductor worker's shell command so the worker can open its PR against the run
+ * base via `gh pr create --base "$BAPI_BASE_BRANCH"` (paired with the PR-base
+ * launch instruction), instead of inferring the repo default branch. Platform
+ * correct — `$env:VAR = '…'; …` on PowerShell, `export VAR='…' && …` on POSIX —
+ * with the value quoted by the same escaper used for the rest of the command.
+ * Fail-open: a null/empty `baseBranch` returns the command unchanged (interactive
+ * dispatch does not use the PR-base contract).
+ */
+export function prependBaseBranchEnvAssignment(command, baseBranch, platform = "darwin") {
+    if (!baseBranch)
+        return command;
+    if (platform === "win32") {
+        return `$env:${PR_BASE_BRANCH_ENV_VAR} = ${powershellSquote(baseBranch)}; ${command}`;
+    }
+    return `export ${PR_BASE_BRANCH_ENV_VAR}='${shSquoteInner(baseBranch)}' && ${command}`;
+}
 /**
  * Escape a string for inclusion inside a single-quoted shell context: each
  * embedded single-quote becomes the sequence `'\''`. Returns only the inner
@@ -725,42 +808,10 @@ export async function refreshBaseBranch(deps, options) {
 export async function refreshMainBranch(deps, options) {
     return refreshBaseBranch(deps, { refreshMain: options.refreshMain, baseBranch: "main" });
 }
-/**
- * Non-mutating counterpart to {@link refreshBaseBranch}: fetches
- * `origin/<baseBranch>` and resolves the fetched tip to an immutable commit
- * SHA, WITHOUT ever fast-forwarding or force-moving any local branch ref (no
- * `git merge --ff-only`, no `git branch --force`). Used by review-grounding
- * (BAPI-474), which must read a pinned base tree without touching the user's
- * working tree, index, stash, or local branch refs.
- *
- * Validates `baseBranch` with {@link validateBranchName} first so an
- * injection-shaped ref name is rejected before any git invocation. Every git
- * call uses an argv array (never a shell string), consistent with
- * {@link refreshBaseBranch}.
- */
-export async function fetchAndResolveBaseSha(deps, baseBranch) {
-    const validationError = validateBranchName(baseBranch);
-    if (validationError) {
-        return { ok: false, error: `Invalid base branch '${baseBranch}': ${validationError}` };
-    }
-    const fetch = await deps.runCommand("git", ["fetch", "origin", baseBranch], {
-        cwd: deps.cwd,
-    });
-    if (!commandSucceeded(fetch)) {
-        return {
-            ok: false,
-            error: `git fetch origin ${baseBranch} failed. Check your network and 'git remote get-url origin', or pass --no-refresh-base to skip.`,
-        };
-    }
-    const resolve = await deps.runCommand("git", ["rev-parse", "--verify", `origin/${baseBranch}^{commit}`], { cwd: deps.cwd });
-    if (!commandSucceeded(resolve)) {
-        return {
-            ok: false,
-            error: `Failed to resolve origin/${baseBranch} to a commit SHA after fetch (git rev-parse --verify failed).`,
-        };
-    }
-    return { ok: true, base_sha: resolve.stdout.trim() };
-}
+// `fetchAndResolveBaseSha` + `FetchAndResolveBaseShaResult` moved to
+// `base-ref.ts` (BAPI-586) and re-exported above. The shared helper now also
+// serializes the fetch per repository via an async mutex so concurrent executor
+// fresh jobs against one clone cannot collide on git lock files.
 // ---------------------------------------------------------------------------
 // Concurrency + worktree creation
 // ---------------------------------------------------------------------------
@@ -798,6 +849,13 @@ export async function runWithConcurrency(items, limit, worker) {
 // same function references.
 import { resolveBranchForTicket, branchExists, buildWtSwitchArgs, pathApiForPlatform, extractWorktreePath, isExistingBranchSafeToReuse, createWorktreeForTicket, } from "./worktree-core.js";
 export { resolveBranchForTicket, branchExists, buildWtSwitchArgs, pathApiForPlatform, extractWorktreePath, isExistingBranchSafeToReuse, createWorktreeForTicket, };
+// BAPI-586: base-ref resolution now lives in the focused `base-ref.ts` module so
+// the executor can depend on it without pulling in this large CLI module. We
+// import the VALUES here (so internal uses keep working) and re-export the same
+// references so existing importers of `./start-tickets.js` (index.ts,
+// review-tickets.ts) and the pinned start-tickets tests are unaffected.
+import { validateBranchName, fetchAndResolveBaseSha } from "./base-ref.js";
+export { validateBranchName, fetchAndResolveBaseSha };
 /**
  * Create / switch worktrees for every ticket, throttled to `maxParallel`, using
  * the resolved Worktrunk binary. Returns one row per ticket in original key
@@ -811,7 +869,17 @@ export { resolveBranchForTicket, branchExists, buildWtSwitchArgs, pathApiForPlat
  * historical branch-name behavior unchanged.
  */
 export async function createWorktrees(deps, options, worktrunkBinary, baseStartPoint = options.baseBranch) {
-    return runWithConcurrency(options.keys, options.maxParallel, (key) => createWorktreeForTicket(deps, key, options.branchOverrides, worktrunkBinary, baseStartPoint, options.guardStaleWorktree === true));
+    // BAPI-586: for guard-enabled Conductor fresh dispatch the caller has already
+    // resolved `baseStartPoint` to an immutable base SHA (`nonMutatingBase`). Align
+    // any safe pre-existing branch exactly to that SHA and verify the resulting
+    // head against it, so a dependent ticket starts at fresh `origin/<base>` rather
+    // than at a stale ancestor or a sibling seed. Interactive dispatch (a moving
+    // branch name, guard off) keeps the historical reuse-as-is behavior.
+    const exactBase = options.guardStaleWorktree === true && options.nonMutatingBase === true;
+    const behavior = exactBase
+        ? { alignExistingBranchTo: baseStartPoint, verifyHeadMatches: baseStartPoint }
+        : {};
+    return runWithConcurrency(options.keys, options.maxParallel, (key) => createWorktreeForTicket(deps, key, options.branchOverrides, worktrunkBinary, baseStartPoint, options.guardStaleWorktree === true, behavior));
 }
 /**
  * Resume-mode worktree resolution (BAPI-441). Instead of creating worktrees,
@@ -931,10 +999,26 @@ export function buildAgentPrompt(key, opts = {}) {
     // `modelAlias` is accepted for signature consistency only — the model is
     // injected as a `--model` flag (see buildAgentInvocationArgv), never embedded
     // in the prompt text.
-    const command = `/implement-ticket ${key}${opts.autoApprove ? " --auto" : ""}`;
+    const workflow = opts.workflow ?? "implement";
+    const head = workflow === "review-and-implement" ? "/review-and-implement" : "/implement-ticket";
+    let command = `${head} ${key}${opts.autoApprove ? " --auto" : ""}`;
+    // Review-only arguments (`--rounds`, non-default `--base-branch`) must never
+    // leak into the legacy `/implement-ticket` prompt.
+    if (workflow === "review-and-implement") {
+        if (opts.reviewRounds !== undefined) {
+            command += ` --rounds=${opts.reviewRounds}`;
+        }
+        if (opts.baseBranch !== undefined && opts.baseBranch !== "main") {
+            command += ` --base-branch='${shSquoteInner(opts.baseBranch)}'`;
+        }
+    }
     const parts = [command];
-    if (opts.conductorEnabled)
+    if (opts.conductorEnabled) {
         parts.push(buildConductorMessageRelayLaunchInstruction());
+        // BAPI-586: conductor implementation workers must open their PR against the
+        // run base (injected as BAPI_BASE_BRANCH), never the repo default branch.
+        parts.push(buildPrBaseContractLaunchInstruction());
+    }
     if (opts.resumeMode)
         parts.push(buildResumeModeRemediationFinalizeInstruction());
     return parts.join(" ");
@@ -976,13 +1060,13 @@ export function buildAgentInvocation(agent, prompt, quote, modelAlias) {
     }
 }
 /** POSIX agent shell command: `cd '<path>' && <agent> [--model '<alias>'] '<prompt>'`. */
-export function buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false) {
-    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode }), (p) => `'${shSquoteInner(p)}'`, modelAlias);
+export function buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch) {
+    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch }), (p) => `'${shSquoteInner(p)}'`, modelAlias);
     return `cd '${shSquoteInner(worktreePath)}' && ${invocation}`;
 }
 /** PowerShell agent shell command: `Set-Location -LiteralPath '<path>'; <agent> [--model '<alias>'] '<prompt>'`. */
-export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false) {
-    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode }), powershellSquote, modelAlias);
+export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch) {
+    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch }), powershellSquote, modelAlias);
     return `Set-Location -LiteralPath ${powershellSquote(worktreePath)}; ${invocation}`;
 }
 /**
@@ -993,10 +1077,10 @@ export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoA
  * injected as `--model` at the spawn boundary. `conductorEnabled` appends the
  * BAPI-397 message-relay instruction to the prompt (opt-in via `--conductor`).
  */
-export function buildAgentShellCommand(agent, key, worktreePath, platform = "darwin", autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false) {
+export function buildAgentShellCommand(agent, key, worktreePath, platform = "darwin", autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch) {
     if (platform === "win32")
-        return buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode);
-    return buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode);
+        return buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch);
+    return buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch);
 }
 /**
  * Build the shell command run inside a spawned tab/session for an ARBITRARY
@@ -1518,14 +1602,16 @@ export function buildDryRunResults(keys, overrides) {
  * PowerShell on Windows, `wt` + POSIX on macOS/Linux, and a non-throwing `wt` +
  * POSIX fallback for unsupported platforms.
  */
-export function getDryRunPlatformDetails(agent, platform = process.platform, env = process.env, autoApprove = false, conductorEnabled = false, repoName = null) {
+export function getDryRunPlatformDetails(agent, platform = process.platform, env = process.env, autoApprove = false, conductorEnabled = false, repoName = null, workflow = "implement", reviewRounds, baseBranch) {
     return {
         worktrunkBinary: resolveWorktrunkBinary(platform, env),
         // The builder accepts an optional resolved modelAlias; the dry-run caller
         // now passes the previewed tier's alias so `--model` shows in the preview.
         // The resolved repo name (when known) is injected as a BAPI_REPO_NAME prefix
-        // so the dry-run preview matches the real spawn command exactly.
-        buildAgentShellCommand: (key, worktreePath, modelAlias) => prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled), repoName, platform),
+        // so the dry-run preview matches the real spawn command exactly. Reuses the
+        // same buildAgentShellCommand/buildAgentPrompt path as a real spawn — dry-run
+        // is never special-cased — so the previewed workflow prompt is exact.
+        buildAgentShellCommand: (key, worktreePath, modelAlias) => prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled, false, workflow, reviewRounds, baseBranch), repoName, platform),
     };
 }
 /**
@@ -1563,8 +1649,8 @@ export function buildDryRunMcpProvisioningLines(worktreePath, platform = process
  * the secret-free MCP provisioning preview. Pure platform formatting only — no
  * preflight, no routing failures.
  */
-export function buildDryRunDetailLines(agent, key, branch, platform = process.platform, env = process.env, baseBranch = "main", autoApprove = false, modelAlias = null, conductorEnabled = false, repoName = null, mcpServerInvocation) {
-    const { worktrunkBinary, buildAgentShellCommand: build } = getDryRunPlatformDetails(agent, platform, env, autoApprove, conductorEnabled, repoName);
+export function buildDryRunDetailLines(agent, key, branch, platform = process.platform, env = process.env, baseBranch = "main", autoApprove = false, modelAlias = null, conductorEnabled = false, repoName = null, mcpServerInvocation, workflow = "implement", reviewRounds) {
+    const { worktrunkBinary, buildAgentShellCommand: build } = getDryRunPlatformDetails(agent, platform, env, autoApprove, conductorEnabled, repoName, workflow, reviewRounds, baseBranch);
     const wtArgs = buildWtSwitchArgs(branch, false, baseBranch);
     const agentInvocation = build(key, "<worktree-path>", modelAlias);
     return [
@@ -2504,7 +2590,10 @@ export async function orchestrateStartTickets(deps, options, overrides = {}) {
     }
     const platformConfig = resolveStartTicketsPlatformConfig(deps, agent, options.autoApprove, options.conductorEnabled ?? false, resolvedRepoName, 
     // BAPI-494: resume-mode dispatches get the full-suite remediation finalize prompt.
-    options.resumeMode ?? false);
+    options.resumeMode ?? false, options.workflow, options.reviewRounds, 
+    // BAPI-586: the effective run base (already carries any epic.base_branch
+    // override applied above) so conductor workers get BAPI_BASE_BRANCH.
+    options.baseBranch);
     if (!platformConfig.ok)
         return { ok: false, error: platformConfig.error };
     // BAPI-527: resolve the base start point new worktrees are cut from BEFORE any
@@ -2707,7 +2796,7 @@ export async function runStartTicketsCli(argv, overrides = {}) {
             const branch = resolveBranchForTicket(key, options.branchOverrides);
             const routedRow = routedByKey.get(key);
             const modelAlias = routedRow?.modelAlias ?? null;
-            for (const line of buildDryRunDetailLines(agent, key, branch, deps.platform, deps.env, options.baseBranch, options.autoApprove, modelAlias, options.conductorEnabled ?? false, dryRunRepoName, dryRunMcpInvocation)) {
+            for (const line of buildDryRunDetailLines(agent, key, branch, deps.platform, deps.env, options.baseBranch, options.autoApprove, modelAlias, options.conductorEnabled ?? false, dryRunRepoName, dryRunMcpInvocation, options.workflow, options.reviewRounds)) {
                 log(line);
             }
             log(`DRY-RUN:   model routing: ${formatModelRoutingLine(routedRow ?? { key, branch, status: "dry-run" }, agent)}`);

package/build/version.generated.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.21";
+export const VERSION = "0.2.23";

package/build/worktree-core.js

@@ -145,6 +145,44 @@ export async function isExistingBranchSafeToReuse(deps, branch, baseStartPoint)
  * job-type logic lives here — the caller decides the start point, the stale
  * guard, and the freshen behavior.
  */
+/**
+ * Hard-reset the branch checked out in `worktreePath` onto `ref`. Returns null on
+ * success or a bounded, secret-free `create-failed` error string on failure.
+ * Shared by the recovery freshen path and the BAPI-586 fresh-dispatch alignment.
+ */
+async function hardResetWorktree(deps, worktreePath, ref) {
+    const resetArgs = ["reset", "--hard", ref];
+    const reset = await deps.runCommand("git", resetArgs, { cwd: worktreePath });
+    if (!commandSucceeded(reset)) {
+        const reason = (reset.stderr || reset.stdout || "").trim();
+        return `git ${resetArgs.join(" ")} failed${reason ? `: ${reason}` : ""}`;
+    }
+    return null;
+}
+/**
+ * BAPI-586: resolve the worktree's `HEAD^{commit}` and the `expected` ref/commit
+ * and confirm they are equal. Returns null when they match, or a bounded,
+ * secret-free `create-failed` error string otherwise. Short-SHA fragments in the
+ * message are safe (they are public commit identifiers, not secrets).
+ */
+async function verifyWorktreeHead(deps, worktreePath, expected) {
+    const headRes = await deps.runCommand("git", ["rev-parse", "--verify", "HEAD^{commit}"], { cwd: worktreePath });
+    if (!commandSucceeded(headRes)) {
+        return "failed to resolve worktree HEAD after creation (git rev-parse HEAD^{commit} failed).";
+    }
+    const expectedRes = await deps.runCommand("git", ["rev-parse", "--verify", `${expected}^{commit}`], { cwd: worktreePath });
+    if (!commandSucceeded(expectedRes)) {
+        return "failed to resolve the expected base commit after creation (git rev-parse --verify failed).";
+    }
+    const head = headRes.stdout.trim();
+    const want = expectedRes.stdout.trim();
+    if (head !== want) {
+        return (`worktree head ${head.slice(0, 12)} does not match the pinned base ${want.slice(0, 12)}; ` +
+            `Worktrunk seeded the worktree from an unexpected start point. Refusing to hand a mis-seeded ` +
+            `worktree to a worker.`);
+    }
+    return null;
+}
 export async function createWorktreeForTicket(deps, key, branchOverrides, worktrunkBinary, baseStartPoint = "main", guardStaleWorktree = false, behavior = {}) {
     const branch = resolveBranchForTicket(key, branchOverrides);
     try {
@@ -181,16 +219,30 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
         // `origin/<branch>`), so this only applies when the local branch pre-existed.
         // Run inside the switched worktree (the branch is checked out there).
         if (exists && behavior.freshenFromOrigin) {
-            const resetArgs = ["reset", "--hard", behavior.freshenFromOrigin];
-            const reset = await deps.runCommand("git", resetArgs, { cwd: worktreePath });
-            if (!commandSucceeded(reset)) {
-                const reason = (reset.stderr || reset.stdout || "").trim();
-                return {
-                    key,
-                    branch,
-                    status: "create-failed",
-                    error: `git ${resetArgs.join(" ")} failed${reason ? `: ${reason}` : ""}`,
-                };
+            const resetError = await hardResetWorktree(deps, worktreePath, behavior.freshenFromOrigin);
+            if (resetError) {
+                return { key, branch, status: "create-failed", error: resetError };
+            }
+        }
+        // BAPI-586 (fresh dispatch): a guard-approved pre-existing branch is an
+        // ancestor of base but may sit at an OLDER tip. Align it EXACTLY to the
+        // pinned base SHA so a fresh implementation starts at base, not at a stale
+        // ancestor. The stale-branch guard above already ran (and refused unsafe
+        // branches) before this destructive reset. Absent branches were created
+        // straight from `baseStartPoint`, so no alignment is needed there.
+        if (exists && behavior.alignExistingBranchTo) {
+            const resetError = await hardResetWorktree(deps, worktreePath, behavior.alignExistingBranchTo);
+            if (resetError) {
+                return { key, branch, status: "create-failed", error: resetError };
+            }
+        }
+        // BAPI-586 (fresh dispatch): verify the worktree actually starts at the
+        // pinned base. If Worktrunk seeded from an unexpected sibling despite
+        // `-b <sha>`, fail CLOSED before the worktree is handed to a worker.
+        if (behavior.verifyHeadMatches) {
+            const verifyError = await verifyWorktreeHead(deps, worktreePath, behavior.verifyHeadMatches);
+            if (verifyError) {
+                return { key, branch, status: "create-failed", error: verifyError };
             }
         }
         return { key, branch, status: "created", path: worktreePath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -27,8 +27,8 @@
     "check:version-generated": "node scripts/bundle-version.js && node scripts/check-version-generated.js",
     "postbuild": "node scripts/prepend-shebang.cjs",
     "start": "node build/index.js",
-    "test": "node --test --test-force-exit build/pipeline-utils.test.js build/backend-warnings.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/config-fields.static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/mcp-server-invocation.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/regression-check.test.js build/doctor.test.js build/install-doctor.test.js build/install-bridge.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/probe-context.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/github-mergeability.test.js build/conductor/merge-conflict-routing.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/deny-enforcement-preflight.test.js build/conductor/errors.test.js build/conductor/store.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/start-tickets-conductor-node-propagation.test.js build/start-tickets.non-mutating-base.test.js build/start-tickets-live-source-guard.test.js build/conductor/worker-ledger-cli.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-retired-judgment.static.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/event-accessors.test.js build/conductor/merge-ledger.test.js build/conductor/deterministic-completion.static.test.js build/conductor/deterministic-completion.integration.test.js build/conductor/local-merge.test.js build/conductor/local-merge.static.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/executor/claude-settings.test.js build/executor/cli.test.js build/executor/credentials.test.js build/executor/echo-acceptance.test.js build/executor/env.test.js build/executor/heartbeat.test.js build/executor/http-client.test.js build/executor/job-runner.test.js build/executor/job-runner.payload-timeout.test.js build/executor/worker-finalization.test.js build/executor/job-runner.static.test.js build/executor/prompt-spec.test.js build/executor/job-types.test.js build/executor/recovery-job.static.test.js build/executor/observation.test.js build/executor/permissions.test.js build/executor/preflight.test.js build/executor/process.test.js build/executor/results.test.js build/executor/runner.test.js build/executor/terminal-mutation.test.js build/executor/worker-command.test.js build/executor/worktree-core.test.js build/executor/worktree.test.js build/executor/job-errors.test.js build/executor/worktree-inspection.test.js build/executor/resume-pre-spawn.test.js build/executor/verdict-artifact.test.js build/executor/worker-log.test.js build/executor/job-log-registry.test.js build/executor/viewer-tabs.test.js build/executor/watch-cli.test.js build/executor/merge-job.test.js build/executor/job-runner.merge.test.js build/executor/worktree-gc.test.js build/executor/runner.job-behaviors.test.js build/conductor/cli-freeze.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/conductor/file-scope-guard.test.js build/conductor/file-scope-guard.integration.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/visual-diff-worker.test.js build/visual-diff.test.js build/estimate-epic.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js build/sfcc/ocapi-write-faults.test.js build/sfcc/write-guard.test.js build/sfcc/write-grants.test.js build/sfcc/write-result.test.js build/sfcc/writes.test.js build/sfcc/writes-system-object-payloads.test.js build/sfcc/writes-payloads.test.js && node --experimental-test-module-mocks --test --test-force-exit build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index.review-rounds.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/visual-diff.registration.test.js build/visual-diff.attachment-adapter.test.js build/attachment-download.test.js build/attachment-upload.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/pr-ci-producer-emit-seam.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js build/sfcc/writes-system-object.test.js build/sfcc/writes-custom-object-def.test.js build/sfcc/writes-site-preference.test.js",
-    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/start-tickets.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js",
+    "test": "node --test --test-force-exit build/pipeline-utils.test.js build/backend-warnings.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/config-fields.static.test.js build/execute-plan-instructions.static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/mcp-server-invocation.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/secret-safety.test.js build/base-ref.test.js build/pr-base-contract.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/regression-check.test.js build/doctor.test.js build/install-doctor.test.js build/install-bridge.test.js build/install-bridge-invite.test.js build/install-bridge-prompt.test.js build/init.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/setup-epic.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/probe-context.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/github-mergeability.test.js build/conductor/merge-conflict-routing.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/deny-enforcement-preflight.test.js build/conductor/errors.test.js build/conductor/store.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/start-tickets-conductor-node-propagation.test.js build/start-tickets.non-mutating-base.test.js build/start-tickets-live-source-guard.test.js build/conductor/worker-ledger-cli.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-retired-judgment.static.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/event-accessors.test.js build/conductor/merge-ledger.test.js build/conductor/deterministic-completion.static.test.js build/conductor/deterministic-completion.integration.test.js build/conductor/local-merge.test.js build/conductor/local-merge.static.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/executor/claude-settings.test.js build/executor/cli.test.js build/executor/credentials.test.js build/executor/echo-acceptance.test.js build/executor/env.test.js build/executor/base-branch.test.js build/executor/heartbeat.test.js build/executor/http-client.test.js build/executor/job-runner.test.js build/executor/job-runner.payload-timeout.test.js build/executor/worker-finalization.test.js build/executor/job-runner.static.test.js build/executor/prompt-spec.test.js build/executor/job-types.test.js build/executor/recovery-job.static.test.js build/executor/observation.test.js build/executor/permissions.test.js build/executor/preflight.test.js build/executor/process.test.js build/executor/results.test.js build/executor/runner.test.js build/executor/terminal-mutation.test.js build/executor/worker-command.test.js build/executor/worktree-core.test.js build/executor/worktree.test.js build/executor/job-errors.test.js build/executor/worktree-inspection.test.js build/executor/resume-pre-spawn.test.js build/executor/verdict-artifact.test.js build/executor/worker-log.test.js build/executor/job-log-registry.test.js build/executor/viewer-tabs.test.js build/executor/watch-cli.test.js build/executor/merge-job.test.js build/executor/job-runner.merge.test.js build/executor/worktree-gc.test.js build/executor/runner.job-behaviors.test.js build/conductor/cli-freeze.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/conductor/file-scope-guard.test.js build/conductor/file-scope-guard.integration.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/tools-budget.test.js build/visual-diff-worker.test.js build/visual-diff.test.js build/estimate-epic.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js build/sfcc/ocapi-write-faults.test.js build/sfcc/write-guard.test.js build/sfcc/write-grants.test.js build/sfcc/write-result.test.js build/sfcc/writes.test.js build/sfcc/writes-system-object-payloads.test.js build/sfcc/writes-payloads.test.js && node --experimental-test-module-mocks --test --test-force-exit build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/index.review-rounds.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/visual-diff.registration.test.js build/visual-diff.attachment-adapter.test.js build/attachment-download.test.js build/attachment-upload.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/pr-ci-producer-emit-seam.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js build/sfcc/writes-system-object.test.js build/sfcc/writes-custom-object-def.test.js build/sfcc/writes-site-preference.test.js",
+    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/start-tickets.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js build/integration/dependent-ticket-fresh-base.integration.test.js build/integration/execute-plan-instructions.integration.test.js",
     "test:smoke": "node --test build/integration/packaged-cli-smoke.test.js",
     "prepublishOnly": "node scripts/bundle-assets.js && npm run build && node scripts/verify-shebang.cjs"
   },

package/public/js/main.min.js

@@ -5321,12 +5321,12 @@ function populateCiFollowupConfig(rawValue) {
 // ladder below are kept byte-identical to the backend
 // (api/library/review_ticket_policy.py) so a stored override round-trips exactly.
 const REVIEW_POLICY_BUCKETS = Object.freeze([
-    { name: 'Very Easy', slug: 'very-easy', range: '1' },
-    { name: 'Easy', slug: 'easy', range: '2' },
-    { name: 'Easy-Moderate', slug: 'easy-moderate', range: '3-4' },
-    { name: 'Moderate', slug: 'moderate', range: '5' },
-    { name: 'Moderate-Hard', slug: 'moderate-hard', range: '6' },
-    { name: 'Hard', slug: 'hard', range: '7-10' },
+    { name: 'Very Easy', slug: 'very-easy', range: '1-2' },
+    { name: 'Easy', slug: 'easy', range: '3-4' },
+    { name: 'Easy-Moderate', slug: 'easy-moderate', range: '5' },
+    { name: 'Moderate', slug: 'moderate', range: '6' },
+    { name: 'Moderate-Hard', slug: 'moderate-hard', range: '7' },
+    { name: 'Hard', slug: 'hard', range: '8-10' },
 ]);
 
 // The two per-bucket automations and their coarse per-round tiers. `clarify` must
@@ -5345,9 +5345,9 @@ const REVIEW_POLICY_DEFAULT_NEW_TIER = 'basic';
 const DEFAULT_REVIEW_POLICY_LADDER = Object.freeze({
     'Very Easy': { clarify: ['basic'], critique: [] },
     'Easy': { clarify: ['basic', 'basic'], critique: [] },
-    'Easy-Moderate': { clarify: ['premium', 'basic'], critique: [] },
-    'Moderate': { clarify: ['premium', 'premium'], critique: ['basic'] },
-    'Moderate-Hard': { clarify: ['premium'], critique: ['premium'] },
+    'Easy-Moderate': { clarify: ['basic', 'basic'], critique: ['basic'] },
+    'Moderate': { clarify: ['premium', 'basic'], critique: ['premium'] },
+    'Moderate-Hard': { clarify: ['premium', 'basic'], critique: ['premium', 'basic'] },
     'Hard': { clarify: ['premium', 'premium'], critique: ['premium', 'premium'] },
 });