@bridge_gpt/mcp-server 0.2.34 → 0.2.37

package/build/worktree-core.js

@@ -144,6 +144,13 @@ export async function isExistingBranchSafeToReuse(deps, branch, baseStartPoint)
  * instead of being silently reused as-is. This stays executor-agnostic: no
  * job-type logic lives here — the caller decides the start point, the stale
  * guard, and the freshen behavior.
+ *
+ * BAPI-727: each of the two RESET paths is followed by an untracked-file cleanup
+ * (see {@link cleanUntrackedWorktree}). That coupling is what keeps `resume`
+ * excluded BY CONSTRUCTION rather than by a job-type check: the resume caller
+ * supplies neither `freshenFromOrigin` nor `alignExistingBranchTo`, so it reaches
+ * neither reset and therefore neither cleanup, and its unpushed local work is
+ * preserved exactly as before.
  */
 /**
  * Hard-reset the branch checked out in `worktreePath` onto `ref`. Returns null on
@@ -159,6 +166,64 @@ async function hardResetWorktree(deps, worktreePath, ref) {
     }
     return null;
 }
+/** The one fixed, sanitized diagnostic emitted for ANY cleanup failure. */
+const CLEANUP_FAILURE_DIAGNOSTIC = "untracked-file cleanup did not complete; continuing with the reset worktree";
+/**
+ * BAPI-727: remove untracked residue from a worktree that was just hard-reset.
+ *
+ * `git reset --hard` restores TRACKED files but leaves untracked ones in place, so
+ * a reused worktree carried a prior attempt's scratch files into the next run. This
+ * removes them with exactly `git clean -fd`.
+ *
+ * `-x` IS FORBIDDEN, and `-fdx` doubly so: ignored paths in a prepared worktree are
+ * precisely the executor-owned assets — `.mcp.json` / `.cursor/mcp.json`
+ * registrations, worker environment files, installed dependencies, worker logs, and
+ * the provisioned `.claude/commands/` assets. `-fdx` would destroy all of them.
+ *
+ * Note that `.claude/settings.local.json` is NOT ignored by this repository, so
+ * plain `-fd` may remove it on some hosts. That is safe only because of WHERE this
+ * runs: cleanup happens during worktree PREPARATION, before command assets, deny
+ * settings, MCP registrations/trust, and worker logging are provisioned again — so
+ * anything cleanup removes is re-created by the provisioning that follows it.
+ *
+ * Stale, non-ignored `.conductor/result.json` and `.conductor/critique.md` from a
+ * prior attempt are removed intentionally: a leftover verdict artifact read by a
+ * later attempt would be a prior run's answer presented as this one's.
+ *
+ * FAIL-OPEN. Pre-change behavior performed no cleanup at all, so being unable to
+ * clean must never change the worktree row or the job outcome. Every failure path —
+ * a non-zero exit, a thrown runner — emits the one fixed diagnostic and returns
+ * normally, and the throw is caught HERE so the outer `createWorktreeForTicket()`
+ * catch cannot convert it into `create-failed`.
+ */
+async function cleanUntrackedWorktree(deps, worktreePath) {
+    const emit = deps.onCleanupDiagnostic;
+    const report = (message) => {
+        if (emit)
+            emit(message);
+    };
+    try {
+        const result = await deps.runCommand("git", ["clean", "-fd"], { cwd: worktreePath });
+        // Report removals even when the command later failed: paths Git printed on
+        // stdout were genuinely removed, and losing that record would make a partial
+        // cleanup invisible. Only lines with Git's standard `Removing ` prefix are
+        // read; all other output is discarded rather than serialized.
+        for (const line of result.stdout.split(/\r?\n/)) {
+            if (!line.startsWith("Removing "))
+                continue;
+            const removed = line.slice("Removing ".length).trim();
+            if (removed.length > 0)
+                report(`removed untracked path: ${removed}`);
+        }
+        if (!commandSucceeded(result))
+            report(CLEANUP_FAILURE_DIAGNOSTIC);
+    }
+    catch {
+        // Never interpolate the thrown exception: a command-runner error message can
+        // carry an environment dump or an argv fragment.
+        report(CLEANUP_FAILURE_DIAGNOSTIC);
+    }
+}
 /**
  * BAPI-586: resolve the worktree's `HEAD^{commit}` and the `expected` ref/commit
  * and confirm they are equal. Returns null when they match, or a bounded,
@@ -223,6 +288,10 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
             if (resetError) {
                 return { key, branch, status: "create-failed", error: resetError };
             }
+            // BAPI-727: the reset restored tracked files; drop the untracked residue a
+            // prior attempt left behind. Only after a SUCCESSFUL reset — a failed reset
+            // returns above, so a worktree in an unknown state is never cleaned.
+            await cleanUntrackedWorktree(deps, worktreePath);
         }
         // BAPI-586 (fresh dispatch): a guard-approved pre-existing branch is an
         // ancestor of base but may sit at an OLDER tip. Align it EXACTLY to the
@@ -235,6 +304,10 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
             if (resetError) {
                 return { key, branch, status: "create-failed", error: resetError };
             }
+            // BAPI-727: same cleanup on the fresh-dispatch alignment path. The resulting
+            // fresh-dispatch order is: stale-branch guard, Worktrunk switch, hard reset,
+            // untracked clean, then `verifyHeadMatches` below.
+            await cleanUntrackedWorktree(deps, worktreePath);
         }
         // BAPI-586 (fresh dispatch): verify the worktree actually starts at the
         // pinned base. If Worktrunk seeded from an unexpected sibling despite

package/docs/CONDUCTOR.md

@@ -25,6 +25,23 @@ v2 splits the old local tick into two halves:
 | **Reconciler** | **Server-side**, on the Bridge API worker dyno, every 30s | Selects every epic run whose status is `active`, evaluates gates, and enqueues executor jobs. Nothing to install or schedule. |
 | **Executor** | **Locally**, on your machine | Polls for jobs, claims them, spawns worker agents, heartbeats. This is the only piece you run. |
 
+> **⚠️ For a run against a LOCAL server, do NOT use `npx`.** The npm-published
+> package routinely lags `main` — that is the normal steady state right after any
+> conductor ticket merges. When the server is built from a newer `main` it mints
+> `prompt_spec` placeholders the older published executor rejects, and the job dies
+> instantly with `ContractError.Prompt` (`prompt_spec for job N declares unsupported
+> placeholder '…'`). Confirmed on the BAPI-716 run: published `0.2.34` vs. local
+> `0.2.35`, over BAPI-699's `RELATED_CONTEXT`. Build and run the local tree so the
+> executor and server come from the same commit:
+>
+> ```
+> cd mcp_server && npm run build
+> node mcp_server/build/index.js executor --repo <name>
+> ```
+
+For a run against a deployed server whose version you match, the published CLI is
+fine:
+
 ```
 npx -y @bridge_gpt/mcp-server executor --repo <name>
 ```
@@ -47,17 +64,126 @@ pipeline step. `setup-epic` validates it locally (unique ticket keys, resolvable
 `depends_on`/edge references, acyclicity) before sending anything, so a malformed
 plan fails legibly instead of as a bare HTTP 400.
 
+Since BAPI-754 it then calls the server's **real** validator
+(`POST /jira/epic-runs/plan/validate`) before creating anything, so a plan the
+server would reject — a node missing `status`, say, which the local checks do not
+cover — no longer creates a run and incurs an automation-start charge on its way
+to failing.
+
 It is **idempotent**: re-running it on an epic that already has a live run reuses
-that run rather than minting a second one. Use `--dry-run` to validate a plan and
-preview the calls without mutating anything.
+that run rather than minting a second one. Use `--dry-run` to run that
+authoritative validation and preview the calls without mutating anything; add
+`--local-only` to skip the server entirely, which reports
+`partial (local checks only)` and is never a substitute for the server's verdict.
 
 Once the plan is approved the run becomes `active`, the server-side reconciler
 picks it up within ~30s, and your local `executor` starts claiming jobs.
 
-> **A caveat worth knowing before you plan an epic.** Conductor has no
-> merge-conflict handling, and plan-time file-overlap serialization is currently
-> dark (the planner does not yet emit the `touched_files` metadata it needs). If
-> two sibling tickets touch the same files, do not let them dispatch in parallel.
+### `touched_files` — optional, but declare it anyway
+
+**Plan-time file-overlap serialization is live and on by default.**
+`planner_file_overlap_serialization_enabled` (BAPI-495, defaulted on by BAPI-677 /
+migration 0126, on `config_code_repositories`) makes overlapping siblings gain a
+`depends_on`/edge on each other *before* the DAG is validated, hashed, and stored,
+while siblings with disjoint files stay parallel.
+
+`touched_files` is the plan-time metadata that pass reads. It is a **best-effort
+prediction, never reconciled against the real diff**, so BAPI-722 made it optional.
+Three outcomes, and the difference between the first two is the point
+(`_extract_predicted_touched_files`, `api/library/db/epic_runs.py:3195`):
+
+| In the node | Meaning | Result |
+|---|---|---|
+| Field **absent** | The node **opts out** of preemptive serialization | **Accepted.** Every pair involving it is skipped (`undeclared_pairs_skipped`); no edge is added in either direction |
+| `"touched_files": []` | A deliberate "this ticket predicts no file overlap" | Accepted as a *declared* node with an empty set |
+| Field present but **malformed** | A non-list, or a list holding a blank, absolute, or non-string path | **400** — `EpicRunConflictError(code="VALIDATION")` |
+
+Only omission is relaxed. Data you *did* supply must be well-formed. Paths are
+repo-root-relative.
+
+```json
+{
+  "plan_version": 1,
+  "nodes": [
+    { "ticket_key": "BAPI-405", "status": "planned", "depends_on": [],
+      "touched_files": ["api/routes/jira_api.py"] }
+  ],
+  "edges": []
+}
+```
+
+> **`setup-epic --dry-run` warns on a missing `touched_files`, and that warning is
+> a planning-quality signal, not a predicted failure.** The server accepts the
+> plan. What you lose is scheduling protection: an undeclared node is never
+> pre-serialized against its siblings.
+
+Declare it anyway. Serialization only ever **adds** edges — it never removes an
+authored one — so hand-authored `depends_on` and `touched_files` compose safely.
+Author both: the edges as your reviewable statement of intent, `touched_files` so
+the scheduler can catch overlaps you did not anticipate.
+
+> **Serialization is a scheduling optimization, not a safety mechanism.** It avoids
+> *dispatching* file-overlapping siblings in parallel; it does not resolve a
+> conflict once one exists. The safety net is reactive and independent of any
+> prediction: a PR that a sibling's merge turns `CONFLICTING` is observed live and
+> routed to `JOB_TYPE_REBASE` (`_merge_entry_failure_requires_rebase` in the
+> reconciler). That backstop covers declared and undeclared nodes alike — which is
+> exactly why omitting `touched_files` is safe to accept.
+
+## The conductor CI gate — `conductor-ci / gate` (BAPI-695)
+
+**Before driving a run you want CI-gated, wire its policy.** The reconciler's
+per-ticket `ci` gate reads **`policy_json.required_checks`** (a declared
+`RunPolicy` key) and observes those check-run conclusions at the ticket PR's
+**current head SHA**. If that list is empty, the observer short-circuits to
+`PASSED` with `{"no_required_checks": true}` and **runs no CI at all** — the loop
+merges on hand-verification only. `.github/workflows/conductor-ci.yml` publishes
+the real, always-reporting required context **`conductor-ci / gate`**; set
+
+```json
+"policy_json": { "required_checks": ["conductor-ci / gate"] }
+```
+
+on every run you want gated. The workflow existing is not enough — the context has
+to be in the run policy.
+
+> **Wire it at creation with `--policy-file` (BAPI-754).** There is still no
+> `--required-checks` option, but `setup-epic --policy-file <path>` sends the
+> **complete** run policy on the create that mints the run, so the run is born with
+> `required_checks` already in force. A run created *without* a policy still starts
+> with an **empty** `required_checks` and a `ci` gate that short-circuits to
+> `PASSED` — and because `setup-epic` also approves the plan, making the run
+> `active` and visible to the reconciler within ~30s, there is no comfortable window
+> to fix that afterwards. Supply the policy file up front.
+>
+> To change the policy on a run that is already live, re-run with `--policy-file`:
+> an identical policy is a no-op, and a divergent one is **refused** with a redacted
+> diff unless you also pass `--replace-policy` (which applies it as a complete
+> replacement).
+
+> **This is NOT `done_gate_config`.** The per-run `policy_json.required_checks`
+> read by the reconciler `ci` gate is a *different* surface from the supervisor
+> `done_gate_config.required_ci_checks_green` documented under "Supervisor config"
+> below. BAPI-695 wires only the former, per run; it does **not** change
+> `done_gate_config` defaults, repo-default policy, or GitHub branch protection.
+
+**Once gated, expect this behavior:**
+
+- The `ci` gate now waits for `conductor-ci / gate` on the ticket PR's current head.
+  A complete **red** aggregator enters the bounded `ci_fix` remediation path; a
+  **missing or still-running** current-head context stays pending (never a hard
+  fail).
+- A **green from an older head** can never satisfy the gate after a rebase or
+  force-push — the poll is bound to the current head SHA, and the workflow's per-PR
+  concurrency cancels the superseded run so the new head publishes a fresh context.
+- Out-of-scope PRs (forks, `dependabot/*`, non-`feature/BAPI-*`) get an intentional
+  fast green — cost control, **not** proof the suites ran.
+
+For the exact new-run/PATCH procedure (and the **whole-object `policy_json`
+replacement** caution — GET, merge `required_checks` locally, PATCH the whole
+object), and the immutable case-sensitive matching of the context string, see the
+operator runbook, **§4a "Wire the conductor CI required check"**
+([`docs/claude/epic-conductor-v2-operator-runbook.md`](../../docs/claude/epic-conductor-v2-operator-runbook.md)).
 
 ## Conductor observability (opt-in via `--conductor`, BAPI-394)
 

package/docs/install/mcp-tool-integrations.md

@@ -48,26 +48,31 @@ marked **— none**.
 
 ## Profiles (a form of BLOCK)
 
-The server registers **90 tools** total, gated by `BRIDGE_MCP_PROFILE`
-(comma-separated group list, resolved once at startup by
-`mcp_server/src/mcp-profile.ts`). A tool outside
-the active profile is **not registered at all** — an absolute block until the group is
+Tool registration is gated by `BRIDGE_MCP_PROFILE` (comma-separated group list,
+resolved once at startup by `mcp_server/src/mcp-profile.ts`). A tool outside the
+active profile is **not registered at all** — an absolute block until the group is
 activated. `core` is always implicitly included.
 
-| Profile | Tools | Registered when |
-|---|---|---|
-| `core` | **57** | always |
-| `pipeline-authoring` | **+5** | `BRIDGE_MCP_PROFILE` includes `pipeline-authoring` or `full` |
-| `conductor` | **+8** | includes `conductor` or `full` |
-| `sfcc` | **+20** (2 diagnostics ship in `core`; 18 gated) | includes `sfcc` or `full` |
+| Profile | Registered when |
+|---|---|
+| `core` | always |
+| `pipeline-authoring` | `BRIDGE_MCP_PROFILE` includes `pipeline-authoring` or `full` |
+| `conductor` | includes `conductor` or `full` |
+| `sfcc` | includes `sfcc` or `full` (2 diagnostics ship in `core`; the rest are gated) |
+
+The `pipeline-authoring` tools live in `index.ts` alongside core, gated by
+`ACTIVE_GROUPS.has("pipeline-authoring")`.
 
-(57 core + 5 + 8 + 20 = 90. The 5 pipeline-authoring tools live in `index.ts` alongside
-core, gated by `ACTIVE_GROUPS.has("pipeline-authoring")`, so `index.ts` holds 62
-`registerTool` calls.)
+> **This document deliberately states no tool counts.** Counts drift on every
+> ticket that adds or moves a tool, and nothing here is generated, so a number
+> written down is a number that goes stale. For the authoritative surface, read
+> `api/library/config/mcp_tool_catalog.json` (the committed catalog, kept in sync
+> by `scripts/sync_mcp_tool_catalog.py --check`) or call `tools/list` against a
+> running server. The per-tool rows below are what this document is for.
 
 ---
 
-## Core profile (57)
+## Core profile
 
 ### Connectivity, config & setup — no integration deps
 
@@ -78,6 +83,8 @@ These are never gated (`NEVER_GATED_ROUTE_KEYS`) or run entirely locally.
 | `ping` | — none |
 | `get_project_standards` | — none |
 | `get_my_role` | — none |
+| `invite_member` | — none (mints a scoped key in the Bridge DB; admin-only) |
+| `resolve_target_status` | — none (status resolution over the repo's configured mapping) |
 | `config_field` (get/update/list) | — none |
 | `get_install_manifest` | — none |
 | `apply_install_manifest` | — none |
@@ -87,6 +94,7 @@ These are never gated (`NEVER_GATED_ROUTE_KEYS`) or run entirely locally.
 | `track_ticket` | — none (Bridge DB tracking record) |
 | `update_ticket_state` | — none (Bridge DB) |
 | `get_ticket_state` | — none (Bridge DB) |
+| `get_ticket_state_tree` | — none (Bridge DB; live projection over existing rows) |
 | `get_ticket_model_tier` | — none (Bridge DB difficulty) |
 | `get_pipeline_recipe` | — none (`LOCAL`, bundled recipes) |
 | `generate_decision_page` | — none (`LOCAL` HTML) |
@@ -186,7 +194,7 @@ These orchestrate an idea → ticket → review → start chain, so they inherit
 
 ---
 
-## `pipeline-authoring` profile (5)
+## `pipeline-authoring` profile
 
 Profile-gated **[BLOCK]** to register at all. `run_pipeline` / `resume_pipeline`
 additionally inherit the dependencies of whatever steps the invoked pipeline runs
@@ -203,7 +211,7 @@ Run state is persisted via the Bridge API.
 
 ---
 
-## `conductor` profile (8)
+## `conductor` profile
 
 Profile-gated **[BLOCK]** to register. Most operate on the **local** conductor ledger
 (`~/.config/bridge/events.db`), so beyond the profile gate they have no remote
@@ -222,7 +230,7 @@ integration dependency.
 
 ---
 
-## `sfcc` group (20)
+## `sfcc` group
 
 ### Always-on diagnostics (ship in `core`)
 
@@ -231,13 +239,13 @@ integration dependency.
 | `sfcc_setup_status` | — none (its purpose is to report which SFCC prerequisites are missing) |
 | `check_permissions` | SFCC OCAPI **[BLOCK]** (probes OCAPI; reports not-OK without access / version config) |
 
-### Gated behind the `sfcc` group (18)
+### Gated behind the `sfcc` group
 
 All are profile-gated **[BLOCK]** to register, and all require SFCC OCAPI creds +
 `version` config + a reachable sandbox → SFCC OCAPI **[BLOCK]**. Writes are
 sandbox-only and destructive.
 
-**Reads (8):**
+**Reads:**
 
 | Tool | Dependencies (class) |
 |---|---|
@@ -264,7 +272,7 @@ sandbox-only and destructive.
 | `custom_object_definition_attribute_update` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
 | `site_preference_values_set` | Profile-gated **[BLOCK]** · SFCC OCAPI write **[BLOCK]** |
 
-**Logs (1):**
+**Logs:**
 
 | Tool | Dependencies (class) |
 |---|---|
@@ -283,7 +291,7 @@ sandbox-only and destructive.
 | **SFCC OCAPI** | `check_permissions` + all 16 SFCC read/write tools | — |
 | **SFCC WebDAV logs** | `sfcc_log_query` | — |
 | **Deep-research flag** | `request_deep_research`, `get_deep_research` | — |
-| **Profile gating** | all `pipeline-authoring` (5), `conductor` (8), gated `sfcc` (18) tools | — |
+| **Profile gating** | all `pipeline-authoring`, `conductor`, and gated `sfcc` tools | — |
 
 ## Notes & caveats
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.34",
+  "version": "0.2.37",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -20,13 +20,16 @@
     "docs/",
     "LICENSE"
   ],
+  "//test": "The `test` script delegates to the bounded launcher (scripts/run-unit-tests.js → src/run-unit-tests-launcher.ts, BAPI-683), which discovers build/*.test.js at runtime and spawns them in size-bounded batches so the argv never exceeds Windows' ~8191-char command-line limit. Two determinism rules from the pre-launcher script are preserved INSIDE the launcher: (1) multi-file batches run WITHOUT --test-force-exit, because that flag makes node:test exit before aggregating per-subprocess summaries and the tally becomes nondeterministic (failures still surface and still set exit 1, but the count cannot be trusted as a completeness signal); (2) build/secret-safety.test.js leaks a handle that holds the event loop ~60s after its tests finish (they run in ~147ms), so the launcher quarantines it into its own single-file --test-force-exit invocation (FORCE_EXIT_QUARANTINE in src/run-unit-tests-launcher.ts) where the tally stays exact. Do NOT add --test-force-exit to batched invocations, and do NOT remove the quarantine, until the underlying handle leak is fixed.",
   "scripts": {
-    "build": "node scripts/bundle-version.js && node scripts/bundle-readme.js && node scripts/bundle-pipelines.js && node scripts/bundle-commands.js && node scripts/bundle-agents.js && node scripts/bundle-docs.js && tsc && node scripts/bundle-esbuild.js",
+    "build": "node scripts/bundle-version.js && node scripts/bundle-readme.js && node scripts/bundle-pipelines.js && node scripts/bundle-commands.js && node scripts/bundle-agents.js && node scripts/bundle-docs.js && tsc && node scripts/sync-agent-mirrors.js && node scripts/bundle-esbuild.js",
     "check:version-generated": "node scripts/bundle-version.js && node scripts/check-version-generated.js",
     "postbuild": "node scripts/prepend-shebang.cjs",
     "start": "node build/index.js",
-    "test": "node --test --test-force-exit build/pipeline-utils.test.js build/backend-warnings.test.js build/update-check.test.js build/cli-upgrade.test.js build/decision-page-schema.test.js build/decision-page-template.test.js build/bundle-pipelines.test.js build/instructions-contract.test.js build/pipeline-orchestrator-persistence.test.js build/pipeline-orchestrator-execution.test.js build/pipeline-orchestrator-integration.test.js build/index-static.test.js build/config-fields.static.test.js build/request-brainstorm.static.test.js build/execute-plan-instructions.static.test.js build/index-resolvers.test.js build/index-project-root.test.js build/index-pipelines.test.js build/index.test.js build/bridge-config.test.js build/credential-store.test.js build/agent-config-credential-migration.test.js build/mcp-invoke.test.js build/mcp-provisioning.test.js build/mcp-server-invocation.test.js build/third-party-mcp-targets.test.js build/git-ignore-utils.test.js build/command-provisioning.test.js build/command-assets-doctor.test.js build/credential-materialization.test.js build/mcp-registration-doctor.test.js build/mcp-host-targets.test.js build/mcp-install-state.test.js build/mcp-host-config.test.js build/secret-safety.test.js build/base-ref.test.js build/pr-base-contract.test.js build/start-tickets.test.js build/review-tickets.test.js build/start-tickets-base-branch.test.js build/agent-registry.test.js build/agent-registry.model-routing.test.js build/start-tickets.shell-model-routing.test.js build/start-tickets.bridge-api-model-routing.test.js build/start-tickets.tier-fetch-model-routing.test.js build/start-tickets.resolve-model-routing.test.js build/start-tickets.orchestrate-model-routing.test.js build/start-tickets.routing-diagnostics.test.js build/start-tickets-repo.test.js build/start-tickets-credential-invariants.static.test.js build/credentials-cli.test.js build/start-tickets-prereqs.test.js build/regression-check.test.js build/doctor.test.js build/install-doctor.test.js build/install-bridge.test.js build/install-bridge-invite.test.js build/install-bridge-prompt.test.js build/install-bridge-tools.test.js build/install-bridge-join-static.test.js build/init.test.js build/init-docs.test.js build/resolveUploadAttachment.test.js build/package-static.test.js build/chain-utils.test.js build/chain-orchestrator.test.js build/scheduler-backends/types.test.js build/scheduler-backends/escaping.test.js build/scheduler-backends/launchd.test.js build/scheduler-backends/task-scheduler.test.js build/scheduler-backends/systemd-user.test.js build/scheduler-backends/at-fallback.test.js build/scheduler-backends/index.test.js build/command-catalog.test.js build/scheduled-prompt.test.js build/agent-launchers/claude.test.js build/agent-launchers/cursor.test.js build/agent-launchers/index.test.js build/schedule-store.test.js build/schedule-run.test.js build/setup-epic.test.js build/conductor-bundle-artifacts.test.js build/conductor-bundle-cli.test.js build/agent-capabilities/cli.test.js build/agent-capabilities/runner.test.js build/agent-capabilities/probes.test.js build/agent-capabilities/probe-context.test.js build/agent-capabilities/reporter.test.js build/conductor/taxonomy-and-errors.test.js build/conductor/github-mergeability.test.js build/conductor/merge-conflict-routing.test.js build/conductor/redaction-normalization.test.js build/conductor/claude-hook.test.js build/conductor/git-ci-types.test.js build/conductor/done-gate.test.js build/conductor/git-ci-taxonomy-payload.test.js build/conductor/bridge-api-client.test.js build/conductor/plan.test.js build/conductor/producer-ledger.test.js build/conductor/spec-review-producer.test.js build/conductor/git-producer.test.js build/conductor/git-hooks.test.js build/conductor/store-migration.test.js build/conductor/pr-discovery.test.js build/conductor/pr-ci-producer.test.js build/conductor/pr-review-producer.test.js build/conductor/doctor.test.js build/conductor/deny-enforcement-preflight.test.js build/conductor/errors.test.js build/conductor/store.test.js build/conductor/index-poll-ci-producer.test.js build/start-tickets-conductor.test.js build/start-tickets-conductor.spawn.test.js build/start-tickets-conductor-node-propagation.test.js build/start-tickets.non-mutating-base.test.js build/start-tickets-live-source-guard.test.js build/conductor/worker-ledger-cli.test.js build/conductor/supervisor-config.test.js build/conductor/supervisor-ledger.test.js build/conductor/supervisor-state-reducer.test.js build/conductor/supervisor-housekeeping-projection.test.js build/conductor/supervisor-escalation.test.js build/conductor/supervisor-retired-judgment.static.test.js build/conductor/supervisor-runtime.test.js build/conductor/supervisor-store-projection.test.js build/conductor/supervisor-cli.test.js build/conductor/supervisor-start-tickets.test.js build/conductor/supervisor-message-relay.test.js build/conductor/supervisor-state-message-events.test.js build/conductor/store-message-relay.test.js build/start-tickets-message-relay.test.js build/conductor/event-accessors.test.js build/conductor/merge-ledger.test.js build/conductor/deterministic-completion.static.test.js build/conductor/deterministic-completion.integration.test.js build/conductor/local-merge.test.js build/conductor/local-merge.static.test.js build/conductor/supervisor-merge.test.js build/conductor/bridge-api-merge-client.test.js build/conductor/bridge-api-epic-client.test.js build/conductor/supervisor-merge-runtime-state.test.js build/conductor/epic-state.test.js build/executor/claude-settings.test.js build/executor/cli.test.js build/executor/credentials.test.js build/executor/echo-acceptance.test.js build/executor/env.test.js build/executor/base-branch.test.js build/executor/heartbeat.test.js build/executor/http-client.test.js build/executor/job-runner.test.js build/executor/job-runner.payload-timeout.test.js build/executor/worker-finalization.test.js build/executor/job-runner.static.test.js build/executor/prompt-spec.test.js build/executor/job-types.test.js build/executor/recovery-job.static.test.js build/executor/observation.test.js build/executor/permissions.test.js build/executor/preflight.test.js build/executor/process.test.js build/executor/results.test.js build/executor/runner.test.js build/executor/terminal-mutation.test.js build/executor/worker-command.test.js build/executor/worktree-core.test.js build/executor/worktree.test.js build/executor/job-errors.test.js build/executor/worktree-inspection.test.js build/executor/resume-pre-spawn.test.js build/executor/verdict-artifact.test.js build/executor/worker-log.test.js build/executor/job-log-registry.test.js build/executor/viewer-tabs.test.js build/executor/watch-cli.test.js build/executor/merge-job.test.js build/executor/job-runner.merge.test.js build/executor/worktree-gc.test.js build/executor/runner.job-behaviors.test.js build/conductor/cli-freeze.test.js build/conductor/epic-reconcile.test.js build/conductor/epic-runtime.test.js build/conductor/epic-tick-sequence.test.js build/conductor/epic-runtime-post-action.test.js build/conductor/file-scope-guard.test.js build/conductor/file-scope-guard.integration.test.js build/mcp-profile.test.js build/mcp-profile-registration.test.js build/env-flags.test.js build/bridge-api-urls.test.js build/tool-surface-gating.test.js build/tools-budget.test.js build/visual-diff-worker.test.js build/visual-diff.test.js build/estimate-epic.test.js build/integration/measure-tools.test.js build/sfcc/config.test.js build/sfcc/ocapi-shape.test.js build/sfcc/output.test.js build/sfcc/credentials.test.js build/sfcc/ocapi-write-faults.test.js build/sfcc/write-guard.test.js build/sfcc/write-grants.test.js build/sfcc/write-result.test.js build/sfcc/writes.test.js build/sfcc/writes-system-object-payloads.test.js build/sfcc/writes-payloads.test.js build/sfcc/log-gate.test.js build/sfcc/log-query.test.js && node --experimental-test-module-mocks --test --test-force-exit build/index-heavy-read-truncation.test.js build/index-artifacts.test.js build/automation-progress.test.js build/recovery-formatting.test.js build/wait-for-result.test.js build/ticket-wait-recovery.test.js build/council-wait-recovery.test.js build/index.review-rounds.test.js build/index-brainstorm-filenames.test.js build/index-output-path.test.js build/index-generate-decision-page.test.js build/index-generate-decision-page.integration.test.js build/visual-diff.registration.test.js build/visual-diff.attachment-adapter.test.js build/attachment-download.test.js build/attachment-upload.test.js build/conductor/paths.test.js build/conductor/store-lifecycle.test.js build/conductor/store-queries.test.js build/conductor/tools.test.js build/conductor/cli.test.js build/conductor/security-regressions.test.js build/conductor/git-inspection.test.js build/conductor/tools-done-gate.test.js build/conductor/pr-ci-producer-emit-seam.test.js build/conductor/cli-git-hooks.test.js build/sfcc/client.test.js build/sfcc/tool-wrapper.test.js build/sfcc/setup-status.test.js build/sfcc/permissions.test.js build/sfcc/register.test.js build/sfcc/reads-system-object.test.js build/sfcc/reads-custom-object-def.test.js build/sfcc/reads-site-preference.test.js build/sfcc/writes-system-object.test.js build/sfcc/writes-custom-object-def.test.js build/sfcc/writes-site-preference.test.js build/connect-github.test.js build/connect-github-api.test.js build/connect-github-handoff.test.js build/connect-github-dispatch.static.test.js",
-    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/command-provisioning.integration.test.js build/integration/start-tickets.integration.test.js build/integration/start-tickets-tier-handoff.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js build/integration/dependent-ticket-fresh-base.integration.test.js build/integration/execute-plan-instructions.integration.test.js build/integration/conductor-bundle-artifacts.integration.test.js build/integration/install-bridge-repo-resolution.integration.test.js build/integration/capability-report-contract.integration.test.js build/integration/request-brainstorm-general.integration.test.js build/integration/request-council-trigger-drop.integration.test.js build/integration/install-bridge-onboarding-launch.integration.test.js build/integration/install-bridge-failure-guards.integration.test.js build/integration/learn-repository-pipeline.integration.test.js build/integration/visual-diff-mcp.integration.test.js",
+    "test": "npm run test:normal && npm run test:module-mocks",
+    "test:normal": "node scripts/run-unit-tests.js normal",
+    "test:module-mocks": "node scripts/run-unit-tests.js module-mocks",
+    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/command-provisioning.integration.test.js build/integration/start-tickets.integration.test.js build/integration/start-tickets-tier-handoff.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js build/integration/dependent-ticket-fresh-base.integration.test.js build/integration/execute-plan-instructions.integration.test.js build/integration/implement-ticket-finalization-order.integration.test.js build/integration/conductor-bundle-artifacts.integration.test.js build/integration/install-bridge-repo-resolution.integration.test.js build/integration/capability-report-contract.integration.test.js build/integration/request-brainstorm-general.integration.test.js build/integration/request-council-trigger-drop.integration.test.js build/integration/install-bridge-onboarding-launch.integration.test.js build/integration/install-bridge-conductor.integration.test.js build/integration/install-bridge-failure-guards.integration.test.js build/integration/learn-repository-pipeline.integration.test.js build/integration/visual-diff-mcp.integration.test.js build/integration/executor-mcp-provisioning.integration.test.js build/integration/executor-worktree-reentry.integration.test.js build/integration/sfcc-read-error-contract.integration.test.js build/integration/sfcc-response-envelope.integration.test.js build/integration/sfcc-total-error-contract.integration.test.js build/integration/serve-stdio.integration.test.js build/integration/install-alias.integration.test.js build/integration/setup-epic-validation.integration.test.js build/integration/plane-cli.integration.test.js",
     "test:smoke": "node --test build/integration/packaged-cli-smoke.test.js",
     "canary:agent-capabilities": "npm run build && node scripts/agent-capabilities-canary.mjs",
     "prepublishOnly": "node scripts/bundle-assets.js && npm run build && node scripts/verify-shebang.cjs"
@@ -52,8 +55,8 @@
     "node": ">=18.0.0"
   },
   "overrides": {
-    "fast-uri": ">=3.1.2",
-    "hono": ">=4.12.31",
+    "fast-uri": ">=4.1.1",
+    "hono": ">=4.13.1",
     "@hono/node-server": "^1.19.13",
     "ip-address": ">=10.1.1"
   },

package/pipelines/implement-ticket.json

@@ -1,7 +1,7 @@
 {
   "name": "implement-ticket",
-  "description": "Generate plan, execute implementation, commit, open PR, and monitor CI.",
-  "variables": ["ticket_key", "docs_dir"],
+  "description": "Generate plan, produce artifacts, checkpoint them to origin, run the plan's remaining verification faithfully, commit, open PR, close post-PR gaps, and monitor CI. Re-entrant: recovery jobs (ci_fix/remediate/rebase) safely re-run this whole recipe from step 1 — the plan-generation step reuses a fresh existing plan (reused: true, no new run) and the produce phase recognizes work already recorded in the durable ledger instead of redoing it.",
+  "variables": ["ticket_key", "docs_dir", "provider"],
   "steps": [
     {
       "type": "mcp_call",
@@ -18,12 +18,22 @@
         "save_locally": true,
         "provider": "{provider}"
       },
-      "description": "Generate implementation plan"
+      "description": "Generate implementation plan. Re-entry-safe: a non-forced request against a fresh existing plan returns reused: true and runs nothing new — the expected fast path on recovery re-entry. force is reserved for deliberate regeneration; this step never sets it. On a GATEWAY_TIMEOUT/504 response, poll get_plan (or the response's recovery_get URL) until a terminal result — never reissue this step."
     },
     {
       "type": "agent_task",
       "instruction_file": "execute-plan.md",
-      "description": "Execute the implementation plan"
+      "description": "Produce the plan's implementation artifacts"
+    },
+    {
+      "type": "agent_task",
+      "instruction_file": "checkpoint-work.md",
+      "description": "Checkpoint produced work to origin before verification begins"
+    },
+    {
+      "type": "agent_task",
+      "instruction_file": "execute-plan-verification.md",
+      "description": "Execute the plan's remaining review, test, and rendered-UI steps before the PR opens"
     },
     {
       "type": "agent_task",
@@ -36,6 +46,11 @@
       "instruction_file": "create-pr.md",
       "description": "Create a pull request with a title derived from the commit subject"
     },
+    {
+      "type": "agent_task",
+      "instruction_file": "verify-plan.md",
+      "description": "Close post-PR plan gaps and push any correction"
+    },
     {
       "type": "mcp_call",
       "tool": "update_jira_status",

package/build/conductor/supervisor-judgment-python.js

@@ -1,141 +0,0 @@
-/**
- * TypeScript-to-Python judgment adapter (BAPI-396, conductor C4).
- *
- * Lets the Node conductor CLI invoke the approved Python LLM boundary
- * (`src.python.conductor.supervisor_judgment`) WITHOUT any direct model-provider
- * code in TypeScript. The compact judgment request is passed to the Python
- * module over stdin as JSON, the module is spawned with `shell: false` and a
- * list of arguments (never a shell string), and stdout is validated through the
- * shared {@link parseSupervisorJudgmentResponse}.
- *
- * Every boundary failure (missing Python, timeout, non-zero exit, malformed
- * output) is converted to a SANITIZED {@link SupervisorJudgmentError}: the
- * caller ({@link assessSupervisorCandidate}) catches it and degrades to a
- * deterministic assessment. Secrets, stderr text, and stack traces are never
- * placed in the thrown error.
- */
-import { spawn as nodeSpawn } from "node:child_process";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { SupervisorJudgmentError, parseSupervisorJudgmentResponse, } from "./supervisor-judgment.js";
-/** The Python module the adapter invokes via `python -m <module>`. */
-export const SUPERVISOR_JUDGMENT_PYTHON_MODULE = "src.python.conductor.supervisor_judgment";
-function nonEmpty(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-/**
- * Resolve the Python executable. Prefers the explicit, safe env override
- * `BAPI_CONDUCTOR_PYTHON`; otherwise falls back to `python3`. No shell string is
- * ever constructed — the returned value is used as `spawn`'s `command` arg.
- */
-export function resolveSupervisorJudgmentCommand(env = process.env) {
-    if (nonEmpty(env.BAPI_CONDUCTOR_PYTHON))
-        return env.BAPI_CONDUCTOR_PYTHON.trim();
-    return "python3";
-}
-/**
- * Resolve the working directory the Python module runs from (the repo root, so
- * `src.python...` imports resolve). Prefers the explicit `BAPI_CONDUCTOR_PYTHON_CWD`
- * override; otherwise derives the repo root relative to this compiled module
- * (`<repo>/mcp_server/build/conductor/<file>.js` -> `<repo>`).
- */
-export function resolveSupervisorJudgmentCwd(env = process.env) {
-    if (nonEmpty(env.BAPI_CONDUCTOR_PYTHON_CWD))
-        return env.BAPI_CONDUCTOR_PYTHON_CWD.trim();
-    const here = fileURLToPath(import.meta.url);
-    // dirname=conductor, ../=build, ../../=mcp_server, ../../../=repo root.
-    return path.resolve(path.dirname(here), "..", "..", "..");
-}
-/** Build the secret-free stdin payload for the Python module. */
-function buildRequestPayload(request, env) {
-    const payload = {
-        run_id: request.run_id,
-        candidate: request.candidate,
-        worker: request.worker,
-    };
-    if (nonEmpty(env.BAPI_CONDUCTOR_REPO_NAME))
-        payload.repo_name = env.BAPI_CONDUCTOR_REPO_NAME.trim();
-    if (nonEmpty(env.BAPI_CONDUCTOR_RUN_ID))
-        payload.session_id = env.BAPI_CONDUCTOR_RUN_ID.trim();
-    return payload;
-}
-/**
- * Spawn the Python judgment module and resolve with the validated response.
- * Rejects with a sanitized {@link SupervisorJudgmentError} on any boundary
- * failure. The request is passed over stdin (keeping payloads out of the process
- * argument list); the timeout is `config.llm_timeout_ms`.
- */
-export function requestPythonSupervisorJudgment(request, config, deps = {}) {
-    const spawnFn = deps.spawn ?? nodeSpawn;
-    const env = deps.env ?? process.env;
-    const command = resolveSupervisorJudgmentCommand(env);
-    const cwd = resolveSupervisorJudgmentCwd(env);
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        let stdout = "";
-        let child;
-        try {
-            child = spawnFn(command, ["-m", SUPERVISOR_JUDGMENT_PYTHON_MODULE], {
-                cwd,
-                shell: false,
-                stdio: ["pipe", "pipe", "pipe"],
-            });
-        }
-        catch {
-            reject(new SupervisorJudgmentError("python judgment process could not be started"));
-            return;
-        }
-        const finish = (fn, value) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            fn(value);
-        };
-        // NOTE: the timer is intentionally NOT unref'd. It must keep the event loop
-        // alive so the timeout actually fires and rejects when the Python subprocess
-        // hangs (and so the deterministic degraded path is taken). The timer is
-        // always cleared in `finish`, so it never outlives a settled judgment.
-        const timer = setTimeout(() => {
-            try {
-                child.kill("SIGKILL");
-            }
-            catch {
-                /* best-effort */
-            }
-            finish(reject, new SupervisorJudgmentError("python judgment timed out"));
-        }, config.llm_timeout_ms);
-        child.on("error", () => finish(reject, new SupervisorJudgmentError("python judgment process error")));
-        child.stdout?.on("data", (chunk) => {
-            stdout += String(chunk);
-        });
-        child.on("close", (code) => {
-            if (code !== 0) {
-                finish(reject, new SupervisorJudgmentError("python judgment exited non-zero"));
-                return;
-            }
-            try {
-                const parsed = parseSupervisorJudgmentResponse(stdout.trim());
-                finish(resolve, parsed);
-            }
-            catch {
-                finish(reject, new SupervisorJudgmentError("python judgment returned malformed output"));
-            }
-        });
-        try {
-            child.stdin?.write(JSON.stringify(buildRequestPayload(request, env)));
-            child.stdin?.end();
-        }
-        catch {
-            finish(reject, new SupervisorJudgmentError("python judgment stdin write failed"));
-        }
-    });
-}
-/**
- * Build the default injectable judgment client used by the runtime. The returned
- * function matches {@link SupervisorJudgmentClient}; it forwards each request to
- * {@link requestPythonSupervisorJudgment} with the resolved config/deps.
- */
-export function createDefaultSupervisorJudgmentClient(config, deps = {}) {
-    return (request) => requestPythonSupervisorJudgment(request, config, deps);
-}