@bridge_gpt/mcp-server 0.2.38 → 0.2.39

package/build/executor/job-runner.js

@@ -14,22 +14,25 @@
  * `spec_review`, plus per-job worker-log tee, watch registry, and optional
  * read-only viewer tabs wired around every spawned worker.
  */
+import { rm } from "node:fs/promises";
 import os from "node:os";
-import { buildExecutorWorkerEnv } from "./env.js";
 import { runHeartbeatLoop } from "./heartbeat.js";
-import { isExecutorNamedError, toExecutorFailure, secretFreeErrorMessage, MissingVerdictArtifact, PreSpawnVerification, WorkerConfigIsolation, BridgeCredentialUnavailable, } from "./job-errors.js";
+import { isExecutorNamedError, toExecutorFailure, secretFreeErrorMessage, MissingVerdictArtifact, PreSpawnVerification, RequiredMcpRegistration, McpSurfaceMismatch, WorkerStartupFatal, WORKER_STARTUP_FATAL_MESSAGE, formatMcpSurfaceMismatch, ClaudeNotAuthenticated, CLAUDE_NOT_AUTHENTICATED_MESSAGE, ExecutorAdapterUnavailable, ExecutorNamedError, WorktreeBusy, StaleArtifactCleanupFailed, WORKTREE_BUSY_MESSAGE, } from "./job-errors.js";
 import { buildConductorMergeAccessForExecutorJob, buildDefaultMergeLocalDeps, runExecutorMergeJob, MERGE_RETRYABLE, MERGE_FAILED, } from "./merge-job.js";
 import { createObservationState } from "./observation.js";
-import { getWorktreeMcpRegistrationTargets, pathApiForProvisioningPlatform, provisionMcpRegistrationForWorktree, } from "../mcp-provisioning.js";
-import { evaluateClaudeMcpShadowingPolicy, inspectClaudeUserConfigForMcpShadowing, resolveClaudeUserConfigPath, } from "../claude-user-config-doctor.js";
-import { provisionExecutorDenyLayer } from "./permissions.js";
+import { getWorktreeMcpRegistrationTargets, normalizeWorktreePathForRegistration, provisionMcpRegistrationForWorktree, } from "../mcp-provisioning.js";
+import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
+import { redactAdapterDiagnostic } from "../agent-launchers/executor-adapter.js";
+import { resolveExecutorAgentId } from "./agent-identity.js";
 import { runProcessWithTimeout } from "./process.js";
 import { prepareResumeSpawn } from "./resume-pre-spawn.js";
 import { renderPromptSpecPrompt } from "./prompt-spec.js";
 import { buildGenericSuccessResult, buildSmokeResult, commitResidue, readCompletionArtifacts, resolveJobTimeoutSeconds, } from "./results.js";
 import { sendTerminalMutationWithRetry } from "./terminal-mutation.js";
+import { removeStaleVerdictArtifacts } from "./stale-artifacts.js";
 import { isVerdictJobType, readVerdictArtifact } from "./verdict-artifact.js";
-import { createWorkerLogTee, closeWorkerLogTee, teeAsyncIterable, } from "./worker-log.js";
+import { createWorkerLogTee, closeWorkerLogTee, distinctWorkerLogSessionIds, formatWorkerLogSessionInvariantWarning, teeAsyncIterable, } from "./worker-log.js";
+import { acquireExecutorWorktreeLock, } from "./worktree-lock.js";
 import { registerExecutorJobLog, markExecutorJobLogFinished, } from "./job-log-registry.js";
 import { executorViewerTabsEnabled, openExecutorViewerTab } from "./viewer-tabs.js";
 import { isImplementationStyleJobType, isRecoveryJobType, isSpawnJobType } from "./job-types.js";
@@ -37,10 +40,8 @@ import { resolveExecutorJobBaseBranch } from "./base-branch.js";
 import { validateWorkerFinalization } from "./worker-finalization.js";
 import { ensureExecutorWorktree } from "./worktree.js";
 import { buildPrBaseContractLaunchInstruction } from "../pr-base-contract.js";
-import { buildClaudeExecutorArgv, CLAUDE_EXECUTABLE, resolveExecutorModelAlias, resolveExecutorPrompt, resolveWorkerPermissionPosture, } from "./worker-command.js";
-import { collectGitTelemetry, collectRemoteTrackingSha, evaluatePreSpawnGitVerification, } from "./observation.js";
-import { establishWorkerConfigIsolation, formatWorkerConfigIsolationReason, } from "./worker-config-isolation.js";
-import { resolveBapiCredentials } from "../credential-store.js";
+import { resolveExecutorPrompt, resolveWorkerPermissionPosture, } from "./worker-command.js";
+import { collectGitTelemetry, collectRemoteTrackingSha, createMcpSurfaceObserver, evaluatePreSpawnGitVerification, normalizeMcpServerNames, } from "./observation.js";
 /** Default runtime for the no-op smoke process (ms). */
 const DEFAULT_SMOKE_DURATION_MS = 100;
 /** ProcessClassification maps 1:1 onto the wire ExecutorClassification. */
@@ -136,6 +137,71 @@ function buildExecutorMcpProvisioningDeps(deps, bridgeApiBaseUrl) {
  * inside it: the fixed `catch` below would otherwise convert a confirmed
  * integrity refusal into a logged warning and spawn the worker anyway.
  */
+/**
+ * Bind the worktree lock's filesystem boundaries to the injected executor deps
+ * (BAPI-793), so the lock never reaches for a filesystem global.
+ *
+ * `writeFileExclusive` and `removeFile` are OPTIONAL on `ExecutorDeps` for
+ * source-compatibility with the many existing test deps builders. Omitting them
+ * does NOT disable the lock: the seam is simply left unset and
+ * `acquireExecutorWorktreeLock` falls back to real `node:fs/promises`, which is
+ * the safe direction — a missing seam takes a real lock rather than skipping it.
+ * `isProcessAlive` is deliberately NOT injected here; the real
+ * `process.kill(pid, 0)` probe is correct in production and tests drive it
+ * through the `acquireWorktreeLock` seam instead.
+ */
+function buildWorktreeLockSeams(deps) {
+    return {
+        ...(deps.writeFileExclusive ? { writeFileExclusive: deps.writeFileExclusive } : {}),
+        ...(deps.removeFile ? { removeFile: deps.removeFile } : {}),
+        readFile: deps.readFile,
+        mkdir: deps.mkdir,
+        platform: deps.platform,
+    };
+}
+/**
+ * The stderr diagnostic for a refused spawn (BAPI-793 proposed fix #4).
+ *
+ * Bounded identity ONLY: this job, the conflicting job, the ticket, the repo,
+ * and the worktree's BASENAME. Never the claim token (a fencing credential),
+ * never the lock payload, and never the absolute worktree path (it carries an
+ * operator's home directory). An unattributable holder is reported as such
+ * rather than guessed at.
+ */
+function formatWorktreeBusyDiagnostic(job, worktreePath, owner) {
+    const segments = worktreePath.split(/[\\/]+/).filter((s) => s.length > 0);
+    const worktreeName = segments.length > 0 ? segments[segments.length - 1] : "unknown";
+    const holder = owner === null
+        ? "an unreadable or malformed lock (refused fail-closed)"
+        : `job_id=${owner.jobId} executor_id=${owner.executorId} pid=${owner.ownerPid}`;
+    return ("executor refused to spawn: worktree already held. " +
+        `job_id=${job.id} job_type=${job.job_type} repo_name=${job.repo_name} ` +
+        `ticket_key=${job.ticket_key ?? "none"} worktree=${worktreeName} held_by=${holder}`);
+}
+/**
+ * Read back a finished job's worker log and warn when more than one distinct
+ * Claude session wrote to it (BAPI-793 acceptance criterion 3).
+ *
+ * Fail-open in every direction: no tee, an unreadable log, or a log with zero
+ * parseable sessions all produce nothing. The only reportable state is a
+ * POSITIVE observation of two or more distinct sessions, which cannot happen by
+ * accident.
+ */
+async function reportWorkerLogSessionInvariant(tee, deps) {
+    if (!tee)
+        return;
+    let logText;
+    try {
+        logText = await deps.readFile(tee.logPath);
+    }
+    catch {
+        return;
+    }
+    const sessions = distinctWorkerLogSessionIds(logText);
+    if (sessions.length > 1) {
+        deps.errorLog(formatWorkerLogSessionInvariantWarning(sessions.length));
+    }
+}
 async function provisionMcpForPreparedSpawn(job, branch, worktreePath, deps, seams, bridgeApiBaseUrl) {
     const provision = seams.provisionMcp ?? provisionMcpRegistrationForWorktree;
     const row = {
@@ -162,95 +228,39 @@ async function provisionMcpForPreparedSpawn(job, branch, worktreePath, deps, sea
     }
 }
 /**
- * Adapt `ExecutorDeps` into the isolation module's explicit required interface,
- * or `null` when this executor was constructed without the filesystem
- * boundaries isolation needs.
+ * Confirm the prepared worktree's own `.mcp.json` carries the Bridge shim
+ * registration the worker needs, and capture the spawn contract from it
+ * (BAPI-731 requirement; extended by BAPI-790).
  *
- * Returning `null` (rather than substituting a default) is the fail-closed
- * posture: the optional `ExecutorDeps` members exist so existing embedders and
- * test builders stay source-compatible, NOT so a worker may spawn without
- * isolation. The caller turns `null` into a refusal.
- */
-function buildWorkerConfigIsolationDeps(deps) {
-    const { mkdtemp, chmod, rmRecursive, lstatPath, tmpdir } = deps;
-    if (!mkdtemp || !chmod || !rmRecursive || !lstatPath || !tmpdir)
-        return null;
-    return {
-        platform: deps.platform,
-        env: deps.env,
-        tmpdir,
-        mkdtemp,
-        mkdir: deps.mkdir,
-        chmod,
-        rmRecursive,
-        lstatPath,
-        join: (...segments) => pathApiForProvisioningPlatform(deps.platform).join(...segments),
-        writeFile: deps.writeFile,
-    };
-}
-/**
- * Resolve the repo-scoped Bridge credential to seed into the isolated store.
+ * Read-only. Verifies PRESENCE of the ADAPTER-DECLARED required server name only
+ * (BAPI-781; `bridge-api` for Claude) — it does not filter, rewrite, or narrow
+ * the registered surface, so every other valid worktree-provisioned server
+ * (including supported Tier-2 targets) is preserved exactly as provisioned AND
+ * carried into the expected set. Narrowing the expected set to the required name
+ * would make the assertion fail every spawn on a repository with Tier-2 targets
+ * provisioned.
  *
- * Resolved through the SHARED resolver (`resolveBapiCredentials`) rather than by
- * reading any file directly, per the repository's shell-spawned credential rule:
- * env `BAPI_API_KEY` first, then the user-scoped `bapi:<repo>` store. It runs
- * against the EXECUTOR's own deps/env — deliberately, because the executor is
- * still outside the isolation boundary and is the only party that can still see
- * the operator's store.
+ * The required name is a PARAMETER rather than a module constant because it is a
+ * per-agent fact: a future adapter provisions and requires whatever its own
+ * runtime registers. Both halves of the contract still come from ONE parse of
+ * ONE file, which is what keeps the `--mcp-config` path and the asserted
+ * expected set describing the same file.
  *
- * Returns null when no credential can be resolved. `runSpawnJob` turns null into
- * a pre-spawn `/fail` with `ContractError.BridgeCredentialUnavailable` — it never
- * proceeds to establish isolation with an empty store, because every job type
- * that reaches `runSpawnJob` needs Bridge MCP tools, and a worker without them
- * exits cleanly having done nothing (RUN-FINDINGS-2026-08-05 F2). A resolution
- * exception is swallowed into the same null so no raw error (which could carry a
- * path or a secret) ever reaches a diagnostic; the refusal message is a fixed
- * constant.
+ * Only server NAMES are read. The command, args, and env of each registration are
+ * never retained, so nothing that could carry a secret leaves this function.
  */
-async function resolveSeedBridgeCredential(deps, repoName) {
-    const trimmed = typeof repoName === "string" ? repoName.trim() : "";
-    if (trimmed.length === 0)
-        return null;
-    try {
-        const resolved = await resolveBapiCredentials(trimmed, {
-            env: deps.env,
-            homedir: deps.homedir,
-            platform: deps.platform,
-            readFile: deps.readFile,
-            stat: deps.stat,
-            // Route the resolver's (secret-free) insecure-mode warning through the
-            // executor's own log seam instead of raw process stderr.
-            stderr: (message) => deps.errorLog(message),
-        });
-        if (!resolved.ok)
-            return null;
-        return { repoName: trimmed, apiKey: resolved.credentials.apiKey };
-    }
-    catch {
-        // Never let a credential-resolution error carry a secret into a diagnostic.
-        return null;
+export async function verifyRequiredWorktreeMcpRegistration(worktreePath, deps, requiredServerName = REQUIRED_MCP_SERVER_NAME) {
+    // Normalize through the SAME path semantics the provisioner used to write the
+    // file, so the absolute path handed to `--mcp-config` is the one that actually
+    // exists on disk rather than a differently-spelled equivalent.
+    const normalized = normalizeWorktreePathForRegistration(worktreePath, {
+        platform: deps.platform,
+        cwd: deps.cwd,
+    });
+    if (!normalized.ok) {
+        return { ok: false, message: REQUIRED_MCP_REGISTRATION_MISSING_MESSAGE };
     }
-}
-/**
- * Fixed, secret-free refusal text for `ContractError.BridgeCredentialUnavailable`.
- * Names both supported resolution routes and no value, path fragment, or raw
- * error — this exact text is what `/fail` persists as `error_message`.
- */
-const BRIDGE_CREDENTIAL_UNAVAILABLE_MESSAGE = "no Bridge API credential could be resolved for this job's repository, so an isolated worker " +
-    "would run without Bridge MCP tools and do nothing; set BAPI_API_KEY in the executor's " +
-    "environment or add a bapi:<repo> entry to the user-scoped credential store " +
-    "(~/.config/bridge/credentials.json)";
-/**
- * Confirm the prepared worktree's own `.mcp.json` actually carries the Bridge
- * shim registration the worker needs (BAPI-731 requirement, plan step 10).
- *
- * Read-only. Verifies PRESENCE of the `bridge-api` server name only — it does not
- * filter, rewrite, or narrow the registered surface, so every other valid
- * worktree-provisioned server (including supported Tier-2 targets) is preserved
- * exactly as provisioned.
- */
-async function verifyRequiredWorktreeMcpRegistration(worktreePath, deps) {
-    const [target] = getWorktreeMcpRegistrationTargets(worktreePath, deps.platform);
+    const [target] = getWorktreeMcpRegistrationTargets(normalized.path, deps.platform);
     if (!target) {
         return { ok: false, message: REQUIRED_MCP_REGISTRATION_MISSING_MESSAGE };
     }
@@ -264,8 +274,14 @@ async function verifyRequiredWorktreeMcpRegistration(worktreePath, deps) {
         if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
             return { ok: false, message: REQUIRED_MCP_REGISTRATION_MISSING_MESSAGE };
         }
-        const present = Object.prototype.hasOwnProperty.call(servers, REQUIRED_MCP_SERVER_NAME);
-        return present ? { ok: true } : { ok: false, message: REQUIRED_MCP_REGISTRATION_MISSING_MESSAGE };
+        const names = normalizeMcpServerNames(Object.keys(servers));
+        if (!names.includes(requiredServerName)) {
+            return { ok: false, message: REQUIRED_MCP_REGISTRATION_MISSING_MESSAGE };
+        }
+        return {
+            ok: true,
+            contract: { configPath: target.filePath, expectedServerNames: names },
+        };
     }
     catch {
         // Unreadable or malformed is indistinguishable from absent for this purpose,
@@ -273,53 +289,95 @@ async function verifyRequiredWorktreeMcpRegistration(worktreePath, deps) {
         return { ok: false, message: REQUIRED_MCP_REGISTRATION_MISSING_MESSAGE };
     }
 }
-/** The registration name the provisioner writes and a worker requires. */
+/**
+ * Default required registration name, retained only as the parameter default so
+ * existing direct callers keep working. The SPAWN PATH always passes the
+ * adapter's declared name explicitly — it never relies on this default.
+ */
 const REQUIRED_MCP_SERVER_NAME = "bridge-api";
-/** Fixed, secret-free refusal text (no path, no file contents). */
-const REQUIRED_MCP_REGISTRATION_MISSING_MESSAGE = "worker config isolation active but the required 'bridge-api' MCP registration is missing or " +
-    "unreadable in the prepared worktree; an isolated worker has no operator-scoped registration to " +
-    "fall back to, so refusing to spawn a worker that would run without Bridge tools";
 /**
- * The stable `error_kind` for a claimed job refused because the machine's Claude
- * user configuration can shadow the worker's provisioned MCP registration
- * (BAPI-727). It joins the established `ContractError.*` family every other
- * pre-spawn refusal in `runSpawnJob` already posts — this is the same class of
- * failure: a local precondition that makes the job unrunnable-as-specified, decided
- * before any side effect. The message is fixed and secret-free.
+ * Refuse a spawn shape that is not internally consistent (BAPI-781).
+ *
+ * The checks are deliberately structural rather than agent-aware: a non-empty
+ * executable, a non-empty argv of strings, and a plain string-valued env. The
+ * runner cannot know what a correct argv looks like for an arbitrary agent —
+ * that is the adapter's job — but it CAN refuse a shape that could not spawn
+ * anything sane, and refusing is the only safe response. The alternative is
+ * repairing it from `process.env` or hard-coded flags, which would resurrect
+ * exactly the Claude-shaped defaulting this ticket removes.
+ *
+ * Also verifies the executable matches the adapter's DECLARED executable, so an
+ * invocation capability cannot return a different binary than the one preflight
+ * probed and doctor reported.
  */
-export const MCP_SHADOWING_ERROR_KIND = "ContractError.McpShadowing";
+function assertUsableSpawnShape(shape, adapter) {
+    const fail = (detail) => {
+        throw new ExecutorNamedError(ExecutorAdapterUnavailable, detail);
+    };
+    if (typeof shape?.executable !== "string" || shape.executable.trim().length === 0) {
+        fail("executor adapter returned an empty executable; refusing to spawn");
+    }
+    if (!Array.isArray(shape.argv) || shape.argv.length === 0) {
+        fail("executor adapter returned an empty argv; refusing to spawn");
+    }
+    if (shape.argv.some((entry) => typeof entry !== "string")) {
+        fail("executor adapter returned a non-string argv entry; refusing to spawn");
+    }
+    if (!shape.env || typeof shape.env !== "object" || Array.isArray(shape.env)) {
+        fail("executor adapter returned no worker environment; refusing to spawn");
+    }
+    if (Object.values(shape.env).some((value) => typeof value !== "string")) {
+        fail("executor adapter returned a non-string environment value; refusing to spawn");
+    }
+    const declared = adapter.executable;
+    if (declared?.supported === true && shape.executable !== declared.value.executable) {
+        fail("executor adapter returned an executable inconsistent with its declared executable; " +
+            "refusing to spawn a binary that preflight never probed");
+    }
+}
+/** Fixed, secret-free refusal text (no path, no file contents). */
+const REQUIRED_MCP_REGISTRATION_MISSING_MESSAGE = "the required 'bridge-api' MCP registration is missing or unreadable in the prepared " +
+    "worktree; a worker loads MCP servers strictly from that file, so refusing to spawn a " +
+    "worker that would run without Bridge tools";
 /**
- * Run the read-only Claude user-config inspection against a PREPARED worktree,
+ * Run the ADAPTER's advisory MCP inspection against a PREPARED worktree,
  * covering all three scopes: user, the executor's main checkout (`deps.cwd`), and
  * the concrete worktree this job will run in.
  *
- * Degraded outcomes (unreadable/malformed config) and an enabled override are
- * logged and allowed through — the first is inconclusive, the second is a
- * deliberate operator decision. Only a confirmed collision without the override
- * blocks. An unexpected throw fails OPEN with a fixed diagnostic: the inspector is
- * a guard, and a guard that crashes must not become a new way for jobs to die.
+ * ADVISORY ONLY (BAPI-790). This used to be able to refuse a job with
+ * `ContractError.McpShadowing`, because a same-named operator registration could
+ * genuinely win over the worktree's provisioned `.mcp.json` and point a worker at
+ * the wrong endpoint. It cannot now: the worker is spawned with
+ * `--strict-mcp-config`, so no operator-scoped registration is loaded at any
+ * scope, and the per-spawn init-event assertion verifies the loaded surface
+ * rather than trusting that. Every outcome — a confirmed collision, a degraded
+ * read, or an unexpected throw — is logged and the job continues.
+ *
+ * BAPI-781 routes it through the adapter, so the runner no longer imports
+ * Claude's user-config inspector. An adapter that declares no advisory
+ * capability simply produces no warnings; that is not a failure, because the
+ * capability is optional by design.
+ *
+ * Returns nothing on purpose: there is no verdict left for a caller to branch on,
+ * and a boolean nobody may act on invites someone to start acting on it again.
  */
-async function checkClaudeMcpShadowingForPreparedWorktree(worktreePath, deps, seams) {
+async function checkAdapterMcpAdvisoryForPreparedWorktree(worktreePath, deps, adapter) {
+    const advisory = adapter.advisoryMcpInspection;
+    if (advisory?.supported !== true)
+        return;
     try {
-        const inspect = seams.inspectClaudeUserConfig ?? inspectClaudeUserConfigForMcpShadowing;
-        const inspection = await inspect({
-            claudeConfigPath: resolveClaudeUserConfigPath(deps.homedir(), deps.platform),
+        const result = await advisory.value.inspect({
             platform: deps.platform,
+            homedir: deps.homedir(),
             cwd: deps.cwd,
-            mainRepositoryPath: deps.cwd,
             worktreePath,
-        }, { readFile: deps.readFile });
-        const policy = evaluateClaudeMcpShadowingPolicy(inspection, deps.env);
-        for (const warning of policy.warnings) {
-            deps.errorLog(`Claude MCP shadowing: ${warning}`);
+        });
+        for (const warning of result.warnings) {
+            deps.errorLog(`worker MCP advisory: ${warning}`);
         }
-        if (policy.ok)
-            return { blocked: false };
-        return { blocked: true, message: policy.refusals.join("; ") };
     }
     catch {
-        deps.errorLog("Claude MCP shadowing check did not complete; continuing without a shadowing verdict");
-        return { blocked: false };
+        deps.errorLog("worker MCP advisory inspection did not complete; continuing without an advisory verdict");
     }
 }
 /**
@@ -410,9 +468,18 @@ async function superviseProcess(params) {
         collectRemoteMarker: params.collectRemoteMarker,
         isDone: () => isDoneRef.value,
     });
+    const mcpSurface = params.mcpSurface;
     const result = await runProcessWithTimeout(params.proc, params.timeoutSeconds, params.deps, {
         termGraceMs: params.options.termGraceMs,
         onStdout: (chunk) => params.observation.recordStdout(chunk),
+        ...(mcpSurface
+            ? {
+                onStdoutTerminationCheck: (chunk) => {
+                    mcpSurface.observeStdout(chunk);
+                    return mcpSurface.shouldTerminate();
+                },
+            }
+            : {}),
     });
     isDoneRef.value = true;
     const loopOutcome = await hb;
@@ -456,27 +523,14 @@ export async function runClaimedJob(job, httpClient, options, deps, _report, sea
     // via the shared `isSpawnJobType` policy (`job-types.ts`) AFTER the dedicated
     // `merge` and `smoke` branches so those keep their bespoke handling.
     if (isSpawnJobType(job.job_type)) {
-        // BAPI-731: the per-job isolated Claude config directory is created INSIDE
-        // `runSpawnJob` (it must not exist before the pre-spawn contract passes) but
-        // is disposed HERE, in a `finally` around the whole call. That placement is
-        // the lifetime guarantee: disposal cannot run until the worker process has
-        // terminated, the log tee is finalized, and the terminal report has been
-        // sent — while still covering every exit path, including spawn exceptions,
-        // timeouts, stale claims, dead-man abandonment, server stops, artifact
-        // failures, finalization failures, and terminal-report failures.
-        const isolationHolder = { current: null };
-        try {
-            return await runSpawnJob(job, httpClient, options, deps, ownership, observation, seams, isolationHolder);
-        }
-        finally {
-            if (isolationHolder.current) {
-                // Best-effort by contract: a cleanup failure is logged, never allowed to
-                // replace the job outcome already determined above.
-                const diagnostic = await isolationHolder.current.dispose();
-                if (diagnostic)
-                    deps.errorLog(diagnostic);
-            }
-        }
+        // BAPI-790: no per-job configuration directory is created any more, so there
+        // is nothing to dispose and no `finally` wrapper here. Worker containment is
+        // established by argv (`--strict-mcp-config --mcp-config <worktree>/.mcp.json`)
+        // and verified from the worker's own init event inside `runSpawnJob`. Both
+        // are stateless with respect to the host, which is why the whole
+        // establish/dispose lifetime this branch used to manage simply stopped
+        // existing rather than moving somewhere else.
+        return await runSpawnJob(job, httpClient, options, deps, ownership, observation, seams);
     }
     // Unsupported job type — fail server-side; never spawn.
     await httpClient.fail(job, {
@@ -668,7 +722,8 @@ async function runMergeJob(job, httpClient, options, deps, ownership, observatio
  * on this no-worktree, no-real-worker-LLM `createNoopProcess` path and does
  * NOT receive MCP registration. The ratified requirement anchors MCP
  * provisioning to "the executor's worktree-preparation path
- * (`job-runner.ts`), alongside the existing `provisionExecutorDenyLayer` call"
+ * (`job-runner.ts`), alongside the existing deny-layer provisioning call"
+ * (which BAPI-781 moved behind the adapter's `provisionWorktreeDenyLayer` hook)
  * — that call, like the new MCP provisioning call, exists ONLY inside
  * `runSpawnJob`, which `smoke` never reaches (see `isSpawnJobType` /
  * `job-types.ts`, and this module's own "no real worker LLM" framing of the
@@ -860,7 +915,7 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
  * returns BEFORE either the deny layer or MCP provisioning runs — neither ever
  * touches a worktree that will not become a runnable worker.
  */
-async function runSpawnJob(job, httpClient, options, deps, ownership, observation, seams, isolationHolder) {
+async function runSpawnJob(job, httpClient, options, deps, ownership, observation, seams) {
     // --- Per-job base branch (BAPI-586) ----------------------------------
     // Resolve the effective logical base BEFORE any side effect: the persisted
     // run base (`payload.base_branch`) is authoritative, falling back to the
@@ -869,6 +924,42 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
     // job-scoped options carry that base through worktree seeding, prompt
     // rendering, deny layer, telemetry, env, and finalization so they cannot
     // disagree about the base.
+    // --- Executor adapter (FAIL-CLOSED, FIRST, BAPI-781) ------------------
+    // Resolved and fully validated BEFORE base-branch resolution, worktree
+    // creation, deny provisioning, MCP reads, and the spawn — i.e. before any side
+    // effect at all. Preflight already gates claiming on the same resolution, so
+    // reaching here with an unusable adapter means something changed underneath a
+    // running executor. That is exactly when a defaulting fallback would be most
+    // damaging: it would spawn a real worker under containment nobody declared,
+    // and every assertion downstream would check the default's shape and pass.
+    const agentId = resolveExecutorAgentId(options.agentId);
+    const resolveAdapter = seams.resolveAdapter ??
+        ((id) => resolveExecutorAgentAdapter(id, {
+            // The adapter owns deny provisioning and advisory inspection, but it
+            // owns no I/O boundary of its own — every read/write it performs is one
+            // the runner handed it. That keeps the runner's injected filesystem the
+            // single boundary a test has to fake, and keeps an adapter from quietly
+            // acquiring filesystem access the executor did not grant.
+            claude: {
+                readFile: deps.readFile,
+                denyProvisioningDeps: {
+                    readFile: deps.readFile,
+                    writeFile: deps.writeFile,
+                    mkdir: deps.mkdir,
+                    homedir: deps.homedir,
+                },
+            },
+        }));
+    const adapterResolution = resolveAdapter(agentId);
+    if (!adapterResolution.supported) {
+        await httpClient.fail(job, {
+            error_kind: ExecutorAdapterUnavailable,
+            error_message: adapterResolution.message,
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "executor_adapter_unavailable" };
+    }
+    const adapter = adapterResolution.adapter;
     const baseResolution = resolveExecutorJobBaseBranch(job, options.baseBranch);
     if (!baseResolution.ok) {
         await httpClient.fail(job, {
@@ -905,6 +996,111 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
     if (!prep.ok)
         return prep.result;
     const { worktreePath, branch } = prep;
+    // --- Worktree mutual exclusion (FAIL-CLOSED, BAPI-793) ----------------
+    // The FIRST thing that happens once a canonical worktree path exists, and
+    // ahead of every executor-owned write to it: the deny layer, MCP
+    // provisioning, the `worker.log` truncation, the viewer tab, and the spawn
+    // itself all live inside the lock. `worker.log` in particular is created with
+    // an empty write, so a refused contender that got as far as the tee would
+    // erase the running worker's forensic log without ever spawning — which is
+    // why refusal returns from HERE rather than anywhere downstream.
+    //
+    // Known residual window, stated rather than papered over: `prepareSpawn`
+    // above already ran `ensureWorktree`, which hard-resets and cleans the tree.
+    // Its path comes back FROM Worktrunk, so there is no path to lock before it
+    // without duplicating Worktrunk's layout rules here — a copy that would go
+    // wrong silently. Dispatch exclusion and same-ticket claim serialization
+    // (the Python half of this ticket) are what shrink that window; this lock is
+    // what makes everything after it safe.
+    const acquireLock = seams.acquireWorktreeLock ?? acquireExecutorWorktreeLock;
+    const worktreeLock = await acquireLock({
+        worktreePath,
+        jobId: job.id,
+        claimToken: job.claim_token,
+        executorId: options.executorId,
+        ownerPid: process.pid,
+        acquiredAt: nowIso(deps),
+    }, buildWorktreeLockSeams(deps));
+    if (!worktreeLock.acquired) {
+        // Loud and structured, on OUR stderr, with the identity the fixed
+        // server-bound message deliberately omits (BAPI-793 proposed fix #4).
+        deps.errorLog(formatWorktreeBusyDiagnostic(job, worktreePath, worktreeLock.owner));
+        await httpClient.fail(job, {
+            error_kind: WorktreeBusy,
+            error_message: WORKTREE_BUSY_MESSAGE,
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "worktree_busy" };
+    }
+    try {
+        // --- Stale verdict artifacts (BAPI-814/D1) --------------------------
+        // Inside the lock and BEFORE the worker spawns, on the SHARED attempt path,
+        // so every job type routed through `runSpawnJob` is covered — `implement`,
+        // `resume`, `spec_review`, and the recovery jobs. (`smoke` is deliberately
+        // NOT here: it has its own branch, never acquires a worktree lock, and
+        // synthesizes its verdict in process rather than reading one from disk.)
+        //
+        // `.conductor/` is an ignored path, so worktree preparation's `git clean -fd`
+        // does not remove these files. Without this, a retry whose worker exits `0`
+        // without writing a verdict would have the PREVIOUS attempt's `result.json`
+        // read and posted verbatim as this attempt's answer.
+        //
+        // A failure here stops the attempt rather than continuing: spawning past a
+        // cleanup that did not happen is the precise state being prevented. The
+        // reason is bounded (a filename plus an error code) and reaches the operator
+        // through the executor's normal structured failure path.
+        const cleanupArtifacts = seams.removeStaleVerdictArtifacts ?? removeStaleVerdictArtifacts;
+        const cleaned = await cleanupArtifacts(worktreePath, {
+            // Same fallback direction as the worktree lock: a deps builder that omits
+            // the optional seam gets the real removal, never a silent skip.
+            removeFile: deps.removeFile ?? ((filePath) => rm(filePath, { force: true })),
+            platform: deps.platform,
+        });
+        if (!cleaned.ok) {
+            deps.errorLog(`[executor] job ${job.id}: pre-spawn artifact cleanup failed: ${cleaned.reason}`);
+            await httpClient.fail(job, {
+                error_kind: StaleArtifactCleanupFailed,
+                error_message: cleaned.reason,
+                classification: "crashed",
+            });
+            return { status: "failed", reason: "stale_artifact_cleanup" };
+        }
+        return await runPreparedSpawn({
+            job,
+            httpClient,
+            options,
+            jobOptions,
+            deps,
+            ownership,
+            observation,
+            seams,
+            worktreePath,
+            branch,
+            prep,
+            effectiveBaseBranch,
+            permissionPosture,
+            adapter,
+        });
+    }
+    finally {
+        // Released only here — after supervision has settled and every terminal
+        // mutation above has been attempted — so the worktree is never advertised as
+        // free while this job's worker could still be touching it.
+        await worktreeLock.release();
+    }
+}
+/**
+ * Run a spawn job whose worktree is already prepared AND exclusively locked.
+ *
+ * Split out of {@link runSpawnJob} for exactly one reason: every terminal branch
+ * below — contract refusal, spawn exception, timeout, stale claim, server stop,
+ * MCP surface mismatch, startup fatal, authentication failure, verdict-artifact
+ * failure, finalization failure, clean completion — must run inside the lock's
+ * `try/finally`. Expressing that as a function boundary makes it structural
+ * rather than a 500-line indentation nobody can verify by eye.
+ */
+async function runPreparedSpawn(params) {
+    const { job, httpClient, options, jobOptions, deps, ownership, observation, seams, worktreePath, branch, prep, effectiveBaseBranch, permissionPosture, adapter, } = params;
     // BAPI-586: PR-producing spawn jobs (implement/resume/remediate/ci_fix/rebase)
     // are told to open the PR against the injected run base. Verdict-only
     // `spec_review` produces no PR, so it is excluded from the instruction while
@@ -955,91 +1151,39 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
         return { status: "failed", reason: "pre_spawn_verification" };
     }
     observation.setAttemptStartSha(verification.observedSha);
-    // --- Claude MCP shadow integrity (BLOCKING, BAPI-727) ----------------
-    // Runs against the CONCRETE prepared worktree, after preparation and timeout
-    // validation but BEFORE the deny layer, MCP provisioning, worker-log setup, and
-    // spawn. Placement is the point: a `projects["<this worktree>"]` entry in
-    // ~/.claude.json would silently win over the registration provisioned two steps
-    // below, so the job must be stopped before any of those side effects — not
-    // after them, and not inside `provisionMcpForPreparedSpawn()`, whose fail-open
-    // catch exists to swallow provisioning errors and would swallow this refusal too.
-    const shadow = await checkClaudeMcpShadowingForPreparedWorktree(worktreePath, deps, seams);
-    if (shadow.blocked) {
-        await httpClient.fail(job, {
-            error_kind: MCP_SHADOWING_ERROR_KIND,
-            error_message: shadow.message,
-            classification: "crashed",
-        });
-        return { status: "failed", reason: "mcp_shadowing_contract" };
-    }
-    // --- Worker config isolation (FAIL-CLOSED, BAPI-731 WS-A) ------------
-    // After the retained BAPI-727 shadowing refusal (which stays defense-in-depth
-    // for the named `bridge-api` collision) and before the deny layer, MCP
-    // provisioning, log setup, and spawn.
-    //
-    // FAIL-CLOSED, unlike the fail-OPEN provisioning steps immediately below. The
-    // whole point is that a worker must never fall back to the operator's
-    // configuration: that fallback is how a worker acquired a `dbhub` handle it was
-    // never granted (BAPI-715 finding F4). "Could not isolate" therefore means
-    // "do not run", not "run with less containment".
-    const isolationEstablish = seams.establishWorkerConfigIsolation ?? establishWorkerConfigIsolation;
-    const isolationDeps = buildWorkerConfigIsolationDeps(deps);
-    // BAPI-731 gap: the isolated XDG root is where the Bridge credential store is
-    // looked up, so it must carry this repo's entry or the worker loses every
-    // Bridge MCP tool. Resolved here, outside the boundary, and scoped to one repo.
-    const seedCredential = isolationDeps
-        ? await resolveSeedBridgeCredential(deps, job.repo_name)
-        : null;
-    // FAIL-CLOSED on an unresolvable credential (RUN-FINDINGS-2026-08-05 F2):
-    // establishing isolation with an EMPTY store would succeed, and the worker
-    // would spawn, find no `bapi:<repo>` entry under the redirected XDG root, lose
-    // every Bridge MCP tool, and exit cleanly having done nothing — the original
-    // F2 death, reported as success. Every job type that reaches `runSpawnJob`
-    // needs Bridge MCP (`smoke`/`merge` never come through here), so a distinct
-    // pre-spawn refusal breaks nothing legitimate and makes the cause queryable.
-    if (isolationDeps && !seedCredential) {
-        await httpClient.fail(job, {
-            error_kind: BridgeCredentialUnavailable,
-            error_message: BRIDGE_CREDENTIAL_UNAVAILABLE_MESSAGE,
-            classification: "crashed",
-            ...commitResidue(preSpawnTelemetry),
-            telemetry: observation.snapshot(),
+    // --- Claude MCP shadow advisory (NON-BLOCKING, BAPI-727 -> BAPI-790) -
+    // Still inspected, no longer blocking. Under BAPI-727 a
+    // `projects["<this worktree>"]` entry in ~/.claude.json could silently win
+    // over the registration provisioned two steps below, so the job had to stop
+    // before any side effect. Strict flag-scoped loading removes that possibility
+    // at the mechanism level, and the init-event assertion after the spawn proves
+    // it per spawn rather than assuming it — so the collision is logged with its
+    // remediation and the job continues.
+    await checkAdapterMcpAdvisoryForPreparedWorktree(worktreePath, deps, adapter);
+    // --- Deny layer (fail-open, via the adapter hook, BAPI-781) -----------
+    // Provisioning moved behind the adapter because WHICH file carries the deny
+    // rules is agent-specific (`.claude/settings.local.json` here). The posture is
+    // unchanged and deliberately still fail-OPEN: a provisioning hiccup shrinks
+    // safety margin but must not kill a job. Refusing to CLAIM on unenforced deny
+    // remains a separate, fatal preflight concern.
+    const denyCapability = adapter.denyEnforcement;
+    if (denyCapability?.supported === true) {
+        const deny = await denyCapability.value.provisionWorktreeDenyLayer({
+            worktreePath,
+            baseBranch: effectiveBaseBranch,
+            homedir: deps.homedir(),
         });
-        return { status: "failed", reason: "bridge_credential_unavailable" };
+        // Log on WARNING PRESENCE, not on `!ok` (BAPI-815/R2). The git-exclude
+        // hygiene step can degrade without failing the deny layer — present-but-
+        // unresolvable git metadata is exactly that case — and gating the log on
+        // `!ok` is what made a total failure to ever write the exclude invisible.
+        // The text is bounded at its source (category + worktree path), so it is
+        // emitted verbatim through the executor's existing stderr diagnostic
+        // channel. It never becomes a pre-spawn failure: the posture stays
+        // fail-OPEN and the job continues to the spawn boundary.
+        if (deny.warning)
+            deps.errorLog(deny.warning);
     }
-    const isolationResult = isolationDeps
-        ? await isolationEstablish(isolationDeps, {
-            ...(seedCredential ? { bridgeCredential: seedCredential } : {}),
-        })
-        : {
-            ok: false,
-            platform: String(deps.platform),
-            reason: "missing-filesystem-dependency",
-            message: formatWorkerConfigIsolationReason(String(deps.platform), "missing-filesystem-dependency"),
-        };
-    if (!isolationResult.ok) {
-        await httpClient.fail(job, {
-            error_kind: WorkerConfigIsolation,
-            error_message: isolationResult.message,
-            classification: "crashed",
-            ...commitResidue(preSpawnTelemetry),
-            telemetry: observation.snapshot(),
-        });
-        return { status: "failed", reason: "worker_config_isolation" };
-    }
-    const isolation = isolationResult.isolation;
-    // Hand the handle to the caller's `finally` so it is disposed on EVERY exit
-    // path from here on, including ones that never reach the spawn below.
-    isolationHolder.current = isolation;
-    // --- Deny layer (fail-open) ------------------------------------------
-    const deny = await provisionExecutorDenyLayer(worktreePath, { baseBranch: effectiveBaseBranch }, {
-        readFile: deps.readFile,
-        writeFile: deps.writeFile,
-        mkdir: deps.mkdir,
-        homedir: deps.homedir,
-    });
-    if (!deny.ok)
-        deps.errorLog(deny.warning);
     // --- MCP registration + trust pre-approval (fail-open, BAPI-724) -----
     // Unconditional for every job type that reaches this shared spawn path
     // (implement/resume/spec_review/remediate/ci_fix/rebase) — no job-type
@@ -1048,27 +1192,45 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
     // runtime options to the generated registration, so the worker's MCP server
     // targets the same Bridge API this executor claimed the job from.
     await provisionMcpForPreparedSpawn(job, branch, worktreePath, deps, seams, options.resolvedBaseUrl);
-    // --- Required Bridge MCP registration (FAIL-CLOSED under isolation) ---
+    // --- Required Bridge MCP registration (FAIL-CLOSED) -------------------
     // Provisioning itself stays fail-OPEN: a skipped or malformed Tier-2 target is
-    // a warning, and every valid worktree-provisioned server is kept. But the
-    // REQUIRED `bridge-api` shim registration becomes fail-closed once isolation is
-    // active, because the two changes compose into a new failure mode: before
-    // isolation, a worker missing its worktree registration could still fall back
-    // to an operator-scoped `bridge-api` entry and function; under isolation there
-    // is no fallback at all, so it would run silently toolless and produce
-    // confidently wrong work. Refusing is the only safe reading.
+    // a warning, and every valid worktree-provisioned server is kept. The REQUIRED
+    // `bridge-api` shim registration is fail-CLOSED, and under strict loading it
+    // has to be: the worker is launched with `--mcp-config <this file>`, so if the
+    // file is absent or carries no Bridge shim there is no operator-scoped
+    // registration to fall back to — the worker would run silently toolless and
+    // produce confidently wrong work.
+    //
+    // This is also where the spawn's MCP contract is captured (BAPI-790). The same
+    // parse yields the absolute path passed to `--mcp-config` AND the expected
+    // server names the init-event assertion checks, so the two can never describe
+    // different files.
+    //
+    // BAPI-781: the required server NAME comes from the adapter's declared MCP
+    // scoping capability, not from a module constant, so a future agent requires
+    // whatever its own runtime registers.
     const verifyRegistration = seams.verifyRequiredWorktreeMcpRegistration ?? verifyRequiredWorktreeMcpRegistration;
-    const registration = await verifyRegistration(worktreePath, deps);
+    const mcpScoping = adapter.mcpScoping;
+    if (mcpScoping?.supported !== true) {
+        await httpClient.fail(job, {
+            error_kind: ExecutorAdapterUnavailable,
+            error_message: "executor adapter declares no MCP scoping capability; refusing to spawn",
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "executor_adapter_unavailable" };
+    }
+    const registration = await verifyRegistration(worktreePath, deps, mcpScoping.value.requiredServerName);
     if (!registration.ok) {
         await httpClient.fail(job, {
-            error_kind: WorkerConfigIsolation,
+            error_kind: RequiredMcpRegistration,
             error_message: registration.message,
             classification: "crashed",
             ...commitResidue(preSpawnTelemetry),
             telemetry: observation.snapshot(),
         });
-        return { status: "failed", reason: "worker_config_isolation" };
+        return { status: "failed", reason: "required_mcp_registration" };
     }
+    const mcpContract = registration.contract;
     // --- Worker log tee + watch registry + viewer tab (BAPI-535 §8) ------
     const registryDeps = buildJobLogRegistryDeps(deps);
     const markFinished = seams.markExecutorJobLogFinished ?? markExecutorJobLogFinished;
@@ -1133,35 +1295,101 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
         }
     };
     // --- Spawn -----------------------------------------------------------
-    const alias = resolveExecutorModelAlias(job.payload);
-    // BAPI-725: the posture resolved at the top of this function — after the deny
-    // layer has already been provisioned above, which is what keeps `acceptEdits`
-    // from being a relaxation of what the worker may do.
-    const argv = buildClaudeExecutorArgv(prompt, alias, permissionPosture);
-    // BAPI-586: inject the validated run base as BAPI_BASE_BRANCH so the worker
-    // can target it via `gh pr create --base "$BAPI_BASE_BRANCH"`.
-    // BAPI-731: the Claude/XDG paths come from the isolation handle established
-    // above — never from `deps.env`, which is exactly what makes them
-    // un-overridable by the operator's environment. The API key is read from the
-    // executor's own environment and passed explicitly because isolation removes
-    // the worker's previous (inherited-`HOME`) authentication path entirely; see
-    // the note in `env.ts` and inventory finding 4.
-    const env = buildExecutorWorkerEnv(deps.env, {
-        effectiveBaseBranch,
-        claudeConfigDir: isolation.claudeConfigDir,
-        xdgConfigHome: isolation.xdgConfigHome,
-        anthropicApiKey: deps.env.ANTHROPIC_API_KEY,
-    });
+    // ONE complete spawn shape, requested from the adapter (BAPI-781). The runner
+    // no longer knows Claude's flags, Claude's model policy, or Claude's
+    // credential passthrough — it knows only that an adapter returns
+    // `{ executable, argv, env }`.
+    //
+    // BAPI-725: the posture was resolved at the top of this function — after the
+    // deny layer has already been provisioned above, which is what keeps
+    // `acceptEdits` from being a relaxation of what the worker may do.
+    //
+    // BAPI-790: the argv carries `--strict-mcp-config --mcp-config <path>`, and the
+    // path is the one the registration check just VERIFIED — not a path rebuilt
+    // here. Shape construction is structurally downstream of that check, so a
+    // worker can never be launched pointing at a file that was not confirmed to
+    // exist and to register the required shim.
+    //
+    // BAPI-586: the validated run base travels in as BAPI_BASE_BRANCH so the
+    // worker can target it via `gh pr create --base "$BAPI_BASE_BRANCH"`.
+    const invocation = adapter.headlessInvocation;
+    if (invocation?.supported !== true) {
+        await closeWorkerLogTee(tee);
+        await finalizeRegistry();
+        await httpClient.fail(job, {
+            error_kind: ExecutorAdapterUnavailable,
+            error_message: "executor adapter declares no headless invocation capability",
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "executor_adapter_unavailable" };
+    }
+    let spawnShape;
+    try {
+        const alias = invocation.value.resolveModelAlias(job.payload);
+        spawnShape = invocation.value.buildSpawnShape({
+            prompt,
+            modelAlias: alias,
+            posture: permissionPosture,
+            mcpConfigPath: mcpContract.configPath,
+            effectiveBaseBranch,
+            parentEnv: deps.env,
+        });
+        assertUsableSpawnShape(spawnShape, adapter);
+    }
+    catch (err) {
+        // A spawn shape the adapter could not produce — or produced incompletely —
+        // is NOT repaired here. Filling a missing executable from a host default or
+        // a missing argv from Claude's flags is precisely the defaulting this
+        // extraction removes, and it would spawn a real worker under a shape nobody
+        // declared.
+        await closeWorkerLogTee(tee);
+        await finalizeRegistry();
+        await httpClient.fail(job, {
+            error_kind: ExecutorAdapterUnavailable,
+            error_message: isExecutorNamedError(err)
+                ? err.errorMessage
+                : `executor adapter produced an unusable spawn shape: ${boundedError(err)}`,
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "executor_adapter_unavailable" };
+    }
+    // The per-spawn MCP surface assertion (BAPI-790). Built from the SAME verified
+    // contract that produced the argv path, so the expected set and the loaded file
+    // are the same file by construction. The PARSER is the adapter's; the
+    // expected-versus-observed comparison stays here, so an adapter can never
+    // certify its own containment.
+    const initParsing = adapter.mcpInitParsing;
+    if (initParsing?.supported !== true) {
+        await closeWorkerLogTee(tee);
+        await finalizeRegistry();
+        await httpClient.fail(job, {
+            error_kind: ExecutorAdapterUnavailable,
+            error_message: "executor adapter declares no MCP init-event parser",
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "executor_adapter_unavailable" };
+    }
+    const mcpSurface = createMcpSurfaceObserver(mcpContract.expectedServerNames, (line) => initParsing.value.parseInitEvent(line));
     let proc;
     try {
-        proc = deps.spawnProcess(CLAUDE_EXECUTABLE, argv, { cwd: worktreePath, env });
+        proc = deps.spawnProcess(spawnShape.executable, spawnShape.argv, {
+            cwd: worktreePath,
+            env: spawnShape.env,
+        });
     }
     catch (err) {
         await closeWorkerLogTee(tee);
         await finalizeRegistry();
+        // Redact through the adapter's declared secret names before bounding. A
+        // spawn error can echo the environment it failed to apply, and that
+        // environment may carry the operator's forwarded token.
+        const redactionCapability = adapter.redaction;
+        const raw = `failed to spawn worker: ${boundedError(err)}`;
         await httpClient.fail(job, {
             error_kind: "SpawnError",
-            error_message: `failed to spawn worker: ${boundedError(err)}`,
+            error_message: redactionCapability?.supported === true
+                ? redactAdapterDiagnostic(raw, deps.env, redactionCapability.value)
+                : raw,
             classification: "crashed",
         });
         return { status: "failed", reason: "spawn_failed" };
@@ -1190,7 +1418,30 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
         timeoutSeconds: timeout.timeoutSeconds,
         collectTelemetry,
         collectRemoteMarker,
+        mcpSurface,
     });
+    // --- Adapter lifecycle (EXPLICIT, BAPI-781) ---------------------------
+    // Consumed rather than assumed. Claude declares `{ kind: "none" }` and so
+    // nothing runs here — which is correct, because BAPI-790 deleted the per-job
+    // configuration directory that used to need cleanup and orphan sweeping. The
+    // declaration is still READ, because "no work to do" and "nobody said" must
+    // reach different code: an absent lifecycle was already refused by preflight
+    // and by capability validation, and treating absence as a silent no-op here
+    // would undo both.
+    const lifecycleCapability = adapter.lifecycle;
+    if (lifecycleCapability?.supported === true) {
+        const declaration = lifecycleCapability.value.declaration;
+        if (declaration.kind === "managed") {
+            try {
+                await declaration.cleanupAfterJob({ worktreePath });
+            }
+            catch (err) {
+                // Cleanup is best-effort: a failure here must not turn a completed job
+                // into a failed one, and the worker's real outcome is already decided.
+                deps.errorLog(`adapter lifecycle cleanup failed (non-fatal): ${boundedError(err)}`);
+            }
+        }
+    }
     // Final telemetry snapshot from the worktree.
     const finalTelemetry = await collectTelemetry();
     observation.setGitTelemetry(finalTelemetry);
@@ -1222,10 +1473,92 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
     }
     // Finalize the log tee WITHOUT signaling the worker (it has already exited).
     await closeWorkerLogTee(tee);
+    // --- Worker-log session invariant (ADVISORY, BAPI-793) ----------------
+    // "`.conductor/worker.log` for any completed job contains exactly one
+    // `session_id`" — the cheap, durable invariant from the ticket that would have
+    // caught the original incident on the first job rather than after three
+    // misdiagnosed failures.
+    //
+    // Advisory ON PURPOSE. The lock above is the enforcement; this is the detector
+    // that proves the lock held. Failing an otherwise-successful job because of an
+    // observation about its log file would discard real work over a forensic
+    // artifact — and a violation here means the lock was bypassed, which is a fact
+    // about the host, not about the worker's output.
+    await reportWorkerLogSessionInvariant(tee, deps);
     if (ownership.abandoned) {
         await finalizeRegistry();
         return { status: "abandoned", reason: ownership.abandonReason };
     }
+    // --- MCP surface containment verdict (FAIL-CLOSED, BAPI-790) ----------
+    // Placed AFTER the server-stop and abandonment checks and BEFORE every
+    // classification branch below. That ordering is the whole precedence rule:
+    //
+    //   - a deliberate server cancellation and a lost claim still win, because
+    //     reporting under a dead claim (or overriding an explicit cancel) would be
+    //     wrong regardless of what the worker's MCP surface looked like;
+    //   - but a containment failure outranks the generic `killed`/`crashed`
+    //     classification, because the worker was terminated BY US, on purpose, and
+    //     labeling that a worker fault would hide the actual cause and make the
+    //     condition unqueryable in `executor_jobs.error_kind`.
+    //
+    // The surface verdict is also consulted for a worker that finished on its own:
+    // an assertion mismatch observed moments before a fast exit is still a
+    // containment failure, not a successful run.
+    const surfaceVerdict = mcpSurface.verdict();
+    if (surfaceVerdict.kind === "mismatch") {
+        await finalizeRegistry();
+        await httpClient.fail(job, {
+            error_kind: McpSurfaceMismatch,
+            error_message: formatMcpSurfaceMismatch(surfaceVerdict.expected, surfaceVerdict.observed),
+            classification: "crashed",
+            ...commitResidue(finalTelemetry),
+            telemetry: observation.snapshot(),
+        });
+        return { status: "failed", reason: "mcp_surface_mismatch" };
+    }
+    // --- Fatal startup, before any MCP surface was reported (BAPI-790) ----
+    // A worker that exits non-zero having produced NO stream-json output at all
+    // did not fail during work — it failed to start. Under strict MCP loading the
+    // known cause is an enterprise `managed-mcp.json` policy rejecting the strict
+    // flags, so this gets its own queryable kind instead of a generic
+    // `WorkerCrashed`. The signature is deliberately structural (no output + a
+    // non-zero exit) rather than a stderr text match: the enterprise fatal shape
+    // has never been measured on a host available to this repository (inventory
+    // Finding 6), and a guessed marker would be a fabricated diagnosis. Nothing
+    // here retries without the strict flags — a fallback would silently restore
+    // full inheritance on exactly the hosts with the strictest policy.
+    //
+    // A worker that produced output but no init event is NOT this case; it is the
+    // advisory warning below.
+    if (surfaceVerdict.kind === "absent" &&
+        procResult.classification === "crashed" &&
+        procResult.stdoutExcerpt.trim().length === 0) {
+        await finalizeRegistry();
+        await httpClient.fail(job, {
+            error_kind: WorkerStartupFatal,
+            error_message: WORKER_STARTUP_FATAL_MESSAGE,
+            classification: "crashed",
+            ...commitResidue(finalTelemetry),
+            telemetry: observation.snapshot(),
+        });
+        return { status: "failed", reason: "worker_startup_fatal" };
+    }
+    if (surfaceVerdict.kind === "absent") {
+        // Warn, never fail. The CLI's event shape is not ours to pin, and an
+        // observability gap must not become a new way for jobs to die — that is the
+        // opposite trade from the mismatch above, and both are deliberate.
+        //
+        // The two reasons are reported distinctly because they point at different
+        // things to go look at: `no-init-event` at the worker/CLI, `oversized-line`
+        // at this executor's own buffering bound.
+        deps.errorLog(surfaceVerdict.reason === "oversized-line"
+            ? "worker MCP surface could not be verified: a stream-json line exceeded the observer's " +
+                "buffering bound and was discarded, so a system/init event may have been missed; " +
+                "the job continues, but containment was not confirmed for this spawn"
+            : "worker MCP surface could not be verified: no system/init event was observed in the " +
+                "worker's stream-json output; the job continues, but containment was not confirmed " +
+                "for this spawn");
+    }
     const git = observation.git();
     if (procResult.classification === "clean_exit") {
         // Verdict jobs (`spec_review`) forward the fixed-path artifact verbatim; a
@@ -1344,12 +1677,30 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
         return terminalToRunResult(terminal, "completed");
     }
     // crashed / timeout / killed → fail
+    //
+    // BAPI-791: a recognized agent authentication failure is checked FIRST and,
+    // when matched, wins over the generic classification below — it is reported as
+    // `ContractError.ClaudeNotAuthenticated` instead of a generic `WorkerCrashed`,
+    // even though the underlying process classification is still `crashed`. There
+    // is no separate probe spawn and no retry: this is the SAME real worker spawn
+    // that just ran, classified after the fact from its own captured output.
+    //
+    // BAPI-781: DETECTION is the adapter's (it recognizes its own runtime's output
+    // shape); the ERROR KIND and the operator-facing message stay executor-owned,
+    // so an adapter cannot invent its own failure vocabulary. The adapter returns
+    // a verdict and a reason code only — never the matched line — so nothing from
+    // the worker's stream reaches `/fail` through this path.
     await finalizeRegistry();
+    const authDetection = adapter.authFailureDetection;
+    const authFailure = authDetection?.supported === true &&
+        authDetection.value.classify(procResult.stdoutExcerpt).notAuthenticated;
     const terminal = await sendTerminalMutationWithRetry({
         kind: "fail",
         send: () => httpClient.fail(job, {
-            error_kind: classificationToErrorKind(procResult.classification),
-            error_message: `worker exited (${procResult.classification}, exit_code=${procResult.exitCode})`,
+            error_kind: authFailure ? ClaudeNotAuthenticated : classificationToErrorKind(procResult.classification),
+            error_message: authFailure
+                ? CLAUDE_NOT_AUTHENTICATED_MESSAGE
+                : `worker exited (${procResult.classification}, exit_code=${procResult.exitCode})`,
             classification: toWireClassification(procResult.classification),
             ...commitResidue(git),
             telemetry: observation.snapshot(),