@bridge_gpt/mcp-server 0.2.34 → 0.2.36

package/build/executor/job-runner.js

@@ -20,6 +20,7 @@ import { runHeartbeatLoop } from "./heartbeat.js";
 import { isExecutorNamedError, toExecutorFailure, secretFreeErrorMessage, MissingVerdictArtifact, } from "./job-errors.js";
 import { buildConductorMergeAccessForExecutorJob, buildDefaultMergeLocalDeps, runExecutorMergeJob, MERGE_RETRYABLE, MERGE_FAILED, } from "./merge-job.js";
 import { createObservationState } from "./observation.js";
+import { provisionMcpRegistrationForWorktree } from "../mcp-provisioning.js";
 import { provisionExecutorDenyLayer } from "./permissions.js";
 import { runProcessWithTimeout } from "./process.js";
 import { prepareResumeSpawn } from "./resume-pre-spawn.js";
@@ -35,7 +36,7 @@ import { resolveExecutorJobBaseBranch } from "./base-branch.js";
 import { validateWorkerFinalization } from "./worker-finalization.js";
 import { ensureExecutorWorktree } from "./worktree.js";
 import { buildPrBaseContractLaunchInstruction } from "../pr-base-contract.js";
-import { buildClaudeExecutorArgv, CLAUDE_EXECUTABLE, resolveExecutorModelAlias, resolveExecutorPrompt, } from "./worker-command.js";
+import { buildClaudeExecutorArgv, CLAUDE_EXECUTABLE, resolveExecutorModelAlias, resolveExecutorPrompt, resolveWorkerPermissionPosture, } from "./worker-command.js";
 import { collectGitTelemetry } from "./observation.js";
 /** Default runtime for the no-op smoke process (ms). */
 const DEFAULT_SMOKE_DURATION_MS = 100;
@@ -91,6 +92,57 @@ function buildJobLogRegistryDeps(deps) {
         platform: deps.platform,
     };
 }
+/** Map executor deps into the shared MCP-provisioning filesystem boundary. */
+function buildExecutorMcpProvisioningDeps(deps) {
+    return {
+        readFile: deps.readFile,
+        writeFile: deps.writeFile,
+        mkdir: deps.mkdir,
+        platform: deps.platform,
+        cwd: deps.cwd,
+        mcpServerInvocation: deps.mcpServerInvocation,
+    };
+}
+/**
+ * Provision secret-free Bridge MCP registration + Claude trust pre-approval
+ * (BAPI-724) into a prepared spawn worktree, for every job type that reaches
+ * the shared spawn path. Reuses the exact `start-tickets` provisioning
+ * machinery by constructing a synthetic `created` {@link SummaryRow} for this
+ * job/worktree — no registration serialization or second trust write happens
+ * here.
+ *
+ * Fail-open by construction: a provisioner warning or a `spawn-failed` result
+ * is logged via `deps.errorLog` and this function still returns normally, and
+ * an unexpected thrown exception is caught and reduced to a single fixed,
+ * secret-free diagnostic. Either way `runSpawnJob` proceeds to spawn the
+ * worker — a job that later needs an MCP tool it cannot reach fails loudly
+ * through its own process/gate/timeout/budget path, never here.
+ */
+async function provisionMcpForPreparedSpawn(job, branch, worktreePath, deps, seams) {
+    const provision = seams.provisionMcp ?? provisionMcpRegistrationForWorktree;
+    const row = {
+        key: job.ticket_key ?? String(job.id),
+        branch,
+        status: "created",
+        path: worktreePath,
+    };
+    try {
+        const result = await provision(row, buildExecutorMcpProvisioningDeps(deps));
+        for (const warning of result.warnings ?? []) {
+            deps.errorLog(`MCP provisioning warning: ${warning}`);
+        }
+        if (result.status === "spawn-failed") {
+            deps.errorLog(`MCP provisioning did not complete (${result.error ?? "unknown reason"}); continuing fail-open`);
+        }
+    }
+    catch {
+        // Fail-open, secret-free: a fixed diagnostic only. Never interpolate the
+        // thrown exception, the worktree path, a command/argument, or credential
+        // material — this branch exists precisely so an unexpected provisioning
+        // failure can never leak anything into the executor's own logs.
+        deps.errorLog("MCP provisioning did not complete; continuing fail-open");
+    }
+}
 /**
  * Default merge dispatch: resolve Bridge API access, then run the deterministic
  * merge. Exported for unit tests (access-resolution failure → retryable). The
@@ -401,6 +453,19 @@ async function runMergeJob(job, httpClient, options, deps, ownership, observatio
     });
     return terminalToRunResult(terminal, "failed");
 }
+/**
+ * BAPI-724 design note (deliberate, not an accidental AC-5 gap): `smoke` stays
+ * on this no-worktree, no-real-worker-LLM `createNoopProcess` path and does
+ * NOT receive MCP registration. The ratified requirement anchors MCP
+ * provisioning to "the executor's worktree-preparation path
+ * (`job-runner.ts`), alongside the existing `provisionExecutorDenyLayer` call"
+ * — that call, like the new MCP provisioning call, exists ONLY inside
+ * `runSpawnJob`, which `smoke` never reaches (see `isSpawnJobType` /
+ * `job-types.ts`, and this module's own "no real worker LLM" framing of the
+ * acceptance spine). Converting smoke into a worktree-having, worker-spawning
+ * job to give it something to register MCP into would be a materially larger,
+ * unratified change to that architectural boundary, not a wiring task.
+ */
 async function runSmokeJob(job, httpClient, options, deps, ownership, observation) {
     const timeout = resolveJobTimeoutSeconds(job, options.defaultJobTimeoutSeconds);
     if (!timeout.ok) {
@@ -488,10 +553,18 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
         }
     }
     // Resolve an explicit `payload.prompt` or the `/implement-ticket <KEY> --auto`
-    // synthesis (implement + recovery). `spec_review` matches neither — it is
-    // resolved AFTER worktree preparation from its structured `payload.prompt_spec`
-    // (rendering `{{GIT_LOG}}` needs the prepared worktree), so a non-ok result
-    // here is not yet a failure when a `prompt_spec` is present to render.
+    // synthesis (implement + recovery).
+    //
+    // BAPI-725: `spec_review` now takes the explicit-prompt path like any other job
+    // — the reconciler builds its prompt server-side and ships it in
+    // `payload.prompt`, so it resolves here and returns below without ever reaching
+    // the prompt-spec renderer. A stale `payload.prompt_spec` on an in-flight job
+    // enqueued before this change cannot override that: the explicit prompt wins
+    // unconditionally at the `explicit.ok` return.
+    //
+    // The renderer below is NOT dead. `smoke` and any future structured-prompt job
+    // still reach it, and rendering `{{GIT_LOG}}` is why it must run after worktree
+    // preparation rather than in `resolveExecutorPrompt`.
     const explicit = resolveExecutorPrompt(job);
     const payload = job.payload && typeof job.payload === "object"
         ? job.payload
@@ -529,9 +602,10 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
         return { ok: true, worktreePath: wt.worktreePath, branch: wt.branch, prompt: explicit.prompt };
     }
     // No explicit/synthesized prompt: render the structured `payload.prompt_spec`
-    // against the prepared worktree (the `spec_review` path). A malformed spec
-    // fails loud with `ContractError.Prompt` so we `/fail` rather than spawn a
-    // worker with an empty prompt. Error messages are secret-free by construction.
+    // against the prepared worktree (`smoke`, and any future structured-prompt job;
+    // `spec_review` left this path in BAPI-725). A malformed spec fails loud with
+    // `ContractError.Prompt` so we `/fail` rather than spawn a worker with an empty
+    // prompt. Error messages are secret-free by construction.
     const renderPrompt = seams.renderPromptSpecPrompt ?? renderPromptSpecPrompt;
     try {
         const rendered = await renderPrompt(job, {
@@ -554,6 +628,14 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
         return { ok: false, result: { status: "failed", reason: "prompt_contract" } };
     }
 }
+/**
+ * Final pre-spawn preparation order (BAPI-724): worktree + prompt preparation,
+ * timeout-contract validation, the deny-layer attempt, the MCP registration +
+ * trust-approval attempt, worker-log/viewer setup, then `deps.spawnProcess`.
+ * Failed preparation or an invalid timeout returns BEFORE either the deny
+ * layer or MCP provisioning runs — neither ever touches a worktree that will
+ * not become a runnable worker.
+ */
 async function runSpawnJob(job, httpClient, options, deps, ownership, observation, seams) {
     // --- Per-job base branch (BAPI-586) ----------------------------------
     // Resolve the effective logical base BEFORE any side effect: the persisted
@@ -574,6 +656,26 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
     }
     const effectiveBaseBranch = baseResolution.baseBranch;
     const jobOptions = { ...options, baseBranch: effectiveBaseBranch };
+    // --- Permission posture (BAPI-725) -----------------------------------
+    // Resolved alongside the base branch, BEFORE any side effect, for the same
+    // reason: an unsupported posture is a contract failure, and failing it here
+    // means no worktree is cut, no deny layer is written, and no process is
+    // spawned for a job that can never run correctly. The error text names only
+    // the field — the supplied value never reaches `/fail`.
+    let permissionPosture;
+    try {
+        permissionPosture = resolveWorkerPermissionPosture(job.payload);
+    }
+    catch (err) {
+        await httpClient.fail(job, isExecutorNamedError(err)
+            ? toExecutorFailure(err)
+            : {
+                error_kind: "ContractError.PermissionPosture",
+                error_message: secretFreeErrorMessage(err),
+                classification: "crashed",
+            });
+        return { status: "failed", reason: "permission_posture_contract" };
+    }
     // --- Worktree + prompt (resume pre-spawn protocol or standard) -------
     const prep = await prepareSpawn(job, httpClient, jobOptions, deps, seams);
     if (!prep.ok)
@@ -605,6 +707,11 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
     });
     if (!deny.ok)
         deps.errorLog(deny.warning);
+    // --- MCP registration + trust pre-approval (fail-open, BAPI-724) -----
+    // Unconditional for every job type that reaches this shared spawn path
+    // (implement/resume/spec_review/remediate/ci_fix/rebase) — no job-type
+    // branching, so a future spawn job type inherits the same default access.
+    await provisionMcpForPreparedSpawn(job, branch, worktreePath, deps, seams);
     // --- Worker log tee + watch registry + viewer tab (BAPI-535 §8) ------
     const registryDeps = buildJobLogRegistryDeps(deps);
     const markFinished = seams.markExecutorJobLogFinished ?? markExecutorJobLogFinished;
@@ -670,7 +777,10 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
     };
     // --- Spawn -----------------------------------------------------------
     const alias = resolveExecutorModelAlias(job.payload);
-    const argv = buildClaudeExecutorArgv(prompt, alias);
+    // BAPI-725: the posture resolved at the top of this function — after the deny
+    // layer has already been provisioned above, which is what keeps `acceptEdits`
+    // from being a relaxation of what the worker may do.
+    const argv = buildClaudeExecutorArgv(prompt, alias, permissionPosture);
     // BAPI-586: inject the validated run base as BAPI_BASE_BRANCH so the worker
     // can target it via `gh pr create --base "$BAPI_BASE_BRANCH"`.
     const env = buildExecutorWorkerEnv(deps.env, effectiveBaseBranch);

package/build/executor/permissions.js

@@ -8,6 +8,13 @@
  * liveness never does. (Refusing to claim on `enforced:false` is a SEPARATE,
  * fatal preflight concern — see `preflight.ts`.)
  *
+ * BAPI-724: the worker model is now provisioned with default Bridge MCP access
+ * (see `../mcp-provisioning.js` wiring in `job-runner.ts`), so this module also
+ * denies direct reads of the user-scoped Bridge credential store
+ * (`~/.config/bridge/**`). MCP authentication stays available to the worker
+ * through the separately launched `mcp-invoke` shim process, which resolves the
+ * credential itself — the model process never reads it directly.
+ *
  * The Wave-1 probe on the target machine reports enforcement layer `settings-deny`
  * (claude 2.1.201), so plain `permissions.deny` is provisioned; the PreToolUse
  * fallback is available for CLIs where settings-deny is not enforced.
@@ -16,8 +23,10 @@ import { mergeClaudeSettingsWithCommandHook, provisionClaudeSettingsForWorktree,
 /**
  * The stable executor deny rules. Grammar mirrors the deny-enforcement probe's
  * `Bash(<cmd>:<args-glob>)` / `Read(<path-glob>)` form. Covers: reads under
- * ~/.ssh, ~/.aws, and keychain paths; force-push to the base branch; and
- * destructive `rm -rf` outside the worktree.
+ * ~/.ssh, ~/.aws, and keychain paths; the user-scoped Bridge credential store
+ * (BAPI-724 — the model is denied direct reads, while the separately launched
+ * `mcp-invoke` shim process still resolves it); force-push to the base branch;
+ * and destructive `rm -rf` outside the worktree.
  */
 export function executorDenyRules(inputs) {
     return [
@@ -25,6 +34,7 @@ export function executorDenyRules(inputs) {
         "Read(~/.aws/**)",
         "Read(~/Library/Keychains/**)",
         "Read(/etc/shadow)",
+        "Read(~/.config/bridge/**)",
         `Bash(git push:*--force*${inputs.baseBranch}*)`,
         "Bash(git push:*--force*)",
         "Bash(rm:*-rf /*)",

package/build/executor/preflight.js

@@ -14,8 +14,70 @@
  * allowed reuse surface — it does not pull the v1 event/ledger graph).
  */
 import { runDenyEnforcementPreflight } from "../conductor/deny-enforcement-preflight.js";
-import { resolveAllExecutorApiAccess } from "./credentials.js";
+import { DEFAULT_PROBE_TIMEOUT_MS } from "../agent-capabilities/types.js";
+import { resolveAllExecutorApiAccess, resolveBaseUrl, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
 const VERSION_DETAIL_MAX = 200;
+/**
+ * Environment override for the deny probe's headless timeout (BAPI-722).
+ *
+ * EXECUTOR-PROCESS CONFIGURATION ONLY. It is deliberately excluded from spawned
+ * worker environments by `isExecutorEnvKeyAllowed` — a worker has no deny probe to
+ * time out, and letting a job influence the executor's own safety-probe budget
+ * would be a privilege inversion.
+ */
+export const DENY_PROBE_TIMEOUT_ENV_KEY = "BAPI_CONDUCTOR_DENY_PROBE_TIMEOUT_MS";
+/**
+ * Accepted bounds for the resolved probe timeout. The lower bound keeps a
+ * fat-fingered `1` from turning every probe into an instant HANG (which is FATAL —
+ * the executor would refuse to claim forever); the upper bound keeps a typo from
+ * wedging the claim loop for hours. Anything outside them falls back to the
+ * established capability-probe default rather than being clamped, so a
+ * misconfiguration produces the known-good value instead of a silently different
+ * one the operator never chose.
+ */
+const DENY_PROBE_TIMEOUT_MIN_MS = 1_000;
+const DENY_PROBE_TIMEOUT_MAX_MS = 600_000;
+/**
+ * Resolve the deny probe's timeout from the environment, falling back to the
+ * established capability-probe default (`DEFAULT_PROBE_TIMEOUT_MS`).
+ *
+ * Strict: blank, non-numeric, non-integer, zero, negative, and out-of-range values
+ * all resolve to the default. The result is ALWAYS a finite positive number — never
+ * `undefined`, never `0`, never unbounded — because an unbounded deny probe is
+ * exactly the hang this timeout exists to prevent.
+ *
+ * The value itself is never logged alongside its surrounding environment.
+ */
+export function resolveDenyProbeTimeoutMs(env = {}) {
+    const raw = env[DENY_PROBE_TIMEOUT_ENV_KEY];
+    if (typeof raw !== "string" || raw.trim().length === 0)
+        return DEFAULT_PROBE_TIMEOUT_MS;
+    const parsed = Number(raw.trim());
+    if (!Number.isFinite(parsed) || !Number.isInteger(parsed))
+        return DEFAULT_PROBE_TIMEOUT_MS;
+    if (parsed < DENY_PROBE_TIMEOUT_MIN_MS || parsed > DENY_PROBE_TIMEOUT_MAX_MS) {
+        return DEFAULT_PROBE_TIMEOUT_MS;
+    }
+    return parsed;
+}
+/** True only for a result safe to reuse: genuinely enforced by a real layer. */
+function isCacheableDenyResult(result) {
+    return result.enforced === true && result.layer !== "none";
+}
+/** Create a fresh, empty executor-scoped deny-probe cache. */
+export function createDenyProbeCache() {
+    let cached;
+    return {
+        get: () => cached,
+        set: (result) => {
+            if (isCacheableDenyResult(result))
+                cached = result;
+        },
+        reset: () => {
+            cached = undefined;
+        },
+    };
+}
 function normalizeVersion(stdout, stderr) {
     return (stdout || stderr || "").trim().slice(0, VERSION_DETAIL_MAX);
 }
@@ -61,11 +123,20 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     catch {
         fatalFindings.push("claude could not be probed");
     }
-    // --- Credentials for every configured repo ----------------------------
-    const access = await resolveAllExecutorApiAccess(options.repos, deps);
-    for (const a of access) {
-        if (!a.ok)
-            fatalFindings.push(`credential resolution failed for repo '${a.repoName}'`);
+    // --- Explicit base URL (fatal; never defaults to production, BAPI-676) ---
+    // Resolved before per-repo credentials so a missing URL reports ONCE rather
+    // than once per repo. The remaining probes still run and accumulate findings.
+    const baseUrlResult = resolveBaseUrl(deps.env, options.baseUrl);
+    if (!baseUrlResult.ok) {
+        fatalFindings.push(EXECUTOR_BASE_URL_REQUIRED_MESSAGE);
+    }
+    else {
+        // --- Credentials for every configured repo --------------------------
+        const access = await resolveAllExecutorApiAccess(options.repos, deps, baseUrlResult.baseUrl);
+        for (const a of access) {
+            if (!a.ok)
+                fatalFindings.push(`credential resolution failed for repo '${a.repoName}'`);
+        }
     }
     // --- Disk space (fatal when it cannot be verified) --------------------
     let diskFreeGb = null;
@@ -97,10 +168,26 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         warnings.push("local `gh` is unavailable/unauthenticated; local merges would be degraded");
     }
     // --- Deny-layer enforcement (binding fatal contract) ------------------
+    // BAPI-722: only THIS probe is cached across claim cycles. Every probe above —
+    // tooling, credentials, disk, gh — still runs on each collection, because each of
+    // them can genuinely change between polls (a binary removed, a credential
+    // rotated, a disk filled). Deny-layer enforcement is a property of the machine's
+    // static settings; once verified it does not spontaneously unverify.
     let denyEnforced = false;
     try {
-        const denyProbe = seams.runDenyPreflight ?? runDenyEnforcementPreflight;
-        const deny = await denyProbe();
+        const cache = seams.bypassDenyProbeCache === true ? undefined : seams.denyProbeCache;
+        const cachedDeny = cache?.get();
+        let deny;
+        if (cachedDeny !== undefined) {
+            deny = cachedDeny;
+        }
+        else {
+            const denyProbe = seams.runDenyPreflight ?? runDenyEnforcementPreflight;
+            deny = await denyProbe({ timeoutMs: resolveDenyProbeTimeoutMs(deps.env) });
+            // `set` itself refuses anything that is not a genuine success, so a failure
+            // cannot become sticky even if this call site were later moved.
+            seams.denyProbeCache?.set(deny);
+        }
         denyEnforced = deny.enforced === true;
         if (!deny.enforced) {
             fatalFindings.push(`deny-layer enforcement not verified (enforced=false, layer=${deny.layer}); refusing to claim`);

package/build/executor/prompt-spec.js

@@ -26,6 +26,20 @@ const SUPPORTED_PROMPT_SPEC_VERSION = 1;
 const GIT_LOG_MAX_CHARS = 8_000;
 /** Explicit "no prior revise reasons" value — never an empty string. */
 const REVISE_REASONS_NONE = "(none — this is the first review of the ticket spec)";
+/**
+ * Explicit "no related-ticket context" value (BAPI-699) — never an empty string.
+ *
+ * The server normally renders this section itself (availability header + one
+ * record block per related ticket), so this fallback only fires when a payload
+ * reaches a placeholder-aware executor without a `related_context` field at all
+ * — e.g. a job enqueued by an older server revision. Substituting an empty
+ * string there would hand the reviewer a blank section that reads exactly like
+ * "this ticket has no neighbors", so the fallback states the blindness instead.
+ */
+const RELATED_CONTEXT_NONE = "(no related-ticket context was supplied with this job. This review is " +
+    "PARTIALLY BLIND to the surrounding tickets: do NOT conclude that the ticket " +
+    "has no related tickets, no dependencies, and no already-merged neighbors — " +
+    "that information was simply not provided.)";
 /** The `git log` argv used to resolve `{{GIT_LOG}}` (list-based, never shelled). */
 const GIT_LOG_ARGS = ["log", "--oneline", "--decorate", "--max-count=50"];
 /**
@@ -39,7 +53,21 @@ const SUPPORTED_PLACEHOLDERS = new Set([
     "WORK_BRANCH",
     "GIT_LOG",
     "REVISE_REASONS",
+    "RELATED_CONTEXT",
+    "SPEC_CITATION_FRESHNESS_WARNING",
 ]);
+/**
+ * Explicit "no stale-citation advisory" value (BAPI-722) — never an empty string.
+ *
+ * Unlike `RELATED_CONTEXT`, absence here is the COMMON and entirely healthy case:
+ * most tickets have no predecessor that merged after their spec was written, so the
+ * server omits the field. The substituted text therefore states that plainly rather
+ * than warning about blindness — a reviewer must not read "no advisory" as "the
+ * server could not tell", which would push them toward re-verifying every citation
+ * on every review.
+ */
+const SPEC_CITATION_FRESHNESS_NONE = "(none — no dependency of this ticket merged after this ticket's " +
+    "specification snapshot was taken.)";
 function promptContractError(message) {
     return new ExecutorNamedError(PROMPT_CONTRACT_ERROR, message);
 }
@@ -190,6 +218,29 @@ export async function buildPromptSpecPlaceholderValues(job, spec, context) {
                 values.REVISE_REASONS = formatReviseReasons(payload.reasons);
                 break;
             }
+            case "RELATED_CONTEXT": {
+                // The server renders this section (availability header, per-entry
+                // record blocks, its own bounded trim marker) and records the SHA-256
+                // of EXACTLY the text it rendered. So the value is substituted VERBATIM
+                // — no `.trim()`, no re-wrapping, no re-bounding — otherwise the
+                // recorded display hash would stop describing what the reviewer read.
+                values.RELATED_CONTEXT = isNonBlankString(payload.related_context)
+                    ? payload.related_context
+                    : RELATED_CONTEXT_NONE;
+                break;
+            }
+            case "SPEC_CITATION_FRESHNESS_WARNING": {
+                // OPTIONAL by contract (BAPI-722): an absent field is the normal case and
+                // resolves to the explicit "none" text, NEVER a thrown contract error and
+                // never an empty substitution. This deliberately does not weaken
+                // {{TICKET_SPEC}}, which stays required — a review with no spec is not a
+                // review, whereas a review with no advisory is simply the usual review.
+                // Substituted verbatim: the server composed this text and bounded it.
+                values.SPEC_CITATION_FRESHNESS_WARNING = isNonBlankString(payload.spec_citation_freshness_warning)
+                    ? payload.spec_citation_freshness_warning
+                    : SPEC_CITATION_FRESHNESS_NONE;
+                break;
+            }
         }
     }
     return values;

package/build/executor/runner.js

@@ -6,7 +6,7 @@
  * preflight finding. `once` mode performs one preflight/claim cycle and returns
  * after all active jobs finish. Depends on NO v1 conductor event/ledger module.
  */
-import { collectExecutorPreflight, buildClaimManifest } from "./preflight.js";
+import { collectExecutorPreflight, buildClaimManifest, createDenyProbeCache, } from "./preflight.js";
 import { runClaimedJob } from "./job-runner.js";
 import { sweepExecutorWorktrees } from "./worktree-gc.js";
 /**
@@ -28,6 +28,19 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
             platform: deps.platform,
         }));
     const active = new Map();
+    // BAPI-722: ONE deny-probe cache per `runExecutor` invocation, created OUTSIDE
+    // the claim loop below — that scope is the whole feature. A cache created inside
+    // the loop would be discarded every cycle and re-probe exactly as before; a
+    // module-level cache would leak across invocations and survive a deliberate
+    // restart, which is precisely the escape hatch an operator fixing a broken deny
+    // layer needs. Process lifetime is the correct boundary.
+    //
+    // An injected `preflightSeams.denyProbeCache` (or `bypassDenyProbeCache`) wins,
+    // so a test can force deterministic fresh probes.
+    const preflightSeams = {
+        denyProbeCache: createDenyProbeCache(),
+        ...(seams.preflightSeams ?? {}),
+    };
     /**
      * Run the conservative worktree GC sweep ONLY while the runner owns no active
      * job worktree. Failures are logged to stderr and never abort claiming
@@ -60,7 +73,7 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
         active.set(job.id, promise);
     }
     for (;;) {
-        const report = await collectPreflight(options, deps, seams.preflightSeams ?? {});
+        const report = await collectPreflight(options, deps, preflightSeams);
         if (!report.ok) {
             deps.errorLog(`executor preflight refused claiming: ${report.fatalFindings.join("; ")}`);
         }