@bridge_gpt/mcp-server 0.2.43 → 0.2.45

package/build/conduct-epic/cli.js

@@ -40,7 +40,7 @@ import { getDefaultSpawnTerminalTabForPlatform, detectTerminal, createDefaultSta
 import { resolveWorktrunkBinary } from "../start-tickets-prereqs.js";
 import { resolveRequiredStartTicketsRepoName } from "../start-tickets-repo.js";
 import { bootstrapIndexScope, getConfigFieldBaseBranch, getConductorReadiness, getIndexScopeLifecycle, getIndexScopeStatus, getEffectiveSupervisorConfig, getEffectiveSupervisorSetup, getEpicRunState, getParseStatus, getPrReviewStatus, heartbeatIndexScope, pollCiChecks, putSupervisorConfigDefaults, reclaimIndexScope, recoverIndexScope, resolveCiChecks, retireIndexScope, } from "./bridge-client.js";
-import { appendTicketJournal, createInitialConductEpicCheckpoint, readConductEpicCheckpoint, resolveConductEpicCheckpointPath, resolveConductEpicLockPath, writeConductEpicCheckpointAtomic, CONDUCT_EPIC_TICKET_STATUSES, } from "./checkpoint-store.js";
+import { appendTicketJournal, createInitialConductEpicCheckpoint, readConductEpicCheckpoint, resolveConductEpicCheckpointPath, resolveConductEpicLockPath, writeConductEpicCheckpointAtomic, CONDUCT_EPIC_REVIEW_VERDICTLESS_CEILING, CONDUCT_EPIC_TICKET_STATUSES, } from "./checkpoint-store.js";
 import { acquireConductEpicLock, inspectConductEpicLock, isConductEpicLockOwnerAlive, } from "./lock.js";
 import { discoverConductEpicPrState, discoverTicketWorktree, parseGitWorktreePorcelain, } from "./pr-state.js";
 import { spawnConductEpicAgentTab, CONDUCT_EPIC_AGENTS, } from "./spawn.js";
@@ -75,6 +75,8 @@ const TICKET_FIELDS = [
     "spawned_at",
     "parse_requested_at",
     "parse_requested_for_sha",
+    "review_verdictless_observations",
+    "review_verdictless_for_sha",
     "respawns",
     "conflict_attempts",
     "counters.sessions_spawned",
@@ -1404,6 +1406,22 @@ export async function runConductEpicStatus(deps, options) {
     let doneGateRequired = null;
     let reviewOptedIn = false;
     let reviewSource = null;
+    let reviewDisposition = null;
+    // BAPI-915. An UNREADABLE review policy is not an absent one.
+    //
+    // Before this, an unparseable `done_gate_config` yielded `conditions: []`,
+    // which set `reviewOptedIn = false` — so the pilot read a malformed review
+    // policy as "no review opt-in" and merged on CI alone. That is precisely the
+    // accidental fail-open the Python `INVALID` sentinel exists to prevent, and it
+    // cannot coexist with this ticket's invariant that no malformed input can
+    // select `fail_open`.
+    //
+    // The parser's own `reason` draws the line: `unset` and `disabled` are a
+    // genuine operator opt-out and stay opted out; `malformed` and every
+    // `invalid: …` reason are a policy we could not read, and surface as
+    // opted-in / unavailable / config-invalid so the command's Row 10 handles them
+    // and — having no readable condition — parks under the default disposition.
+    let reviewConfigInvalid = false;
     if (access !== null) {
         const setup = await getEffectiveSupervisorSetup(access, deps.fetchImpl);
         if (!setup.ok) {
@@ -1411,6 +1429,14 @@ export async function runConductEpicStatus(deps, options) {
         }
         else {
             const gate = parseDoneGateConfig(setup.value.done_gate_config);
+            if (gate.reason === "malformed" || gate.reason.startsWith("invalid:")) {
+                reviewConfigInvalid = true;
+                reviewOptedIn = true;
+                // No readable condition exists, so no disposition may be read from one.
+                // `null` leaves the command's effective default at `park`.
+                reviewSource = null;
+                reviewDisposition = null;
+            }
             for (const condition of gate.conditions) {
                 if (condition.type === "required_ci_checks_green") {
                     doneGateRequired = [...condition.required_checks];
@@ -1418,6 +1444,7 @@ export async function runConductEpicStatus(deps, options) {
                 else if (condition.type === "review_state") {
                     reviewOptedIn = true;
                     reviewSource = condition.source;
+                    reviewDisposition = condition.verdictless_disposition ?? null;
                 }
             }
         }
@@ -1425,21 +1452,52 @@ export async function runConductEpicStatus(deps, options) {
     const ci = access === null || pr?.head_sha == null
         ? null
         : await collectCiFacts(deps, access, pr.head_sha, doneGateRequired, checkpoint.ci_last_poll, probeErrors);
+    // BAPI-915: the three additional fields are appended to every shape this
+    // sub-object takes, so a consumer never has to branch on whether they exist.
+    const reviewPolicyFacts = {
+        verdictless_disposition: reviewDisposition,
+        verdictless_ceiling: CONDUCT_EPIC_REVIEW_VERDICTLESS_CEILING,
+        config_invalid: reviewConfigInvalid,
+    };
     let review = {
         opted_in: reviewOptedIn,
         source: reviewSource,
         available: null,
         verdict: null,
         head_sha: null,
+        ...reviewPolicyFacts,
     };
-    if (access !== null && reviewOptedIn && pr?.number != null) {
+    // A config we could not read is reported as opted-in and UNAVAILABLE without
+    // any read being attempted: there is no condition to evaluate a review
+    // against, so `available: false` is the honest answer rather than `null`.
+    if (reviewConfigInvalid) {
+        review = {
+            opted_in: true,
+            source: null,
+            available: false,
+            verdict: null,
+            head_sha: null,
+            ...reviewPolicyFacts,
+        };
+    }
+    else if (access !== null && reviewOptedIn && pr?.number != null) {
         const status = await getPrReviewStatus(access, pr.number, deps.fetchImpl);
         if (!status.ok) {
             probeErrors.push({ probe: "review", reason: status.error });
-            review = { opted_in: true, source: reviewSource, available: null, verdict: null, head_sha: null };
+            review = {
+                opted_in: true,
+                source: reviewSource,
+                available: null,
+                verdict: null,
+                head_sha: null,
+                ...reviewPolicyFacts,
+            };
         }
         else {
-            review = normalizeReviewStatus(status.value, reviewOptedIn, reviewSource);
+            review = {
+                ...normalizeReviewStatus(status.value, reviewOptedIn, reviewSource),
+                ...reviewPolicyFacts,
+            };
         }
     }
     let parse = null;
@@ -1744,6 +1802,8 @@ export function projectConductEpicTicketFacts(ticket, discoveredBranch) {
         spawned_at: ticket.spawned_at,
         parse_requested_at: ticket.parse_requested_at,
         parse_requested_for_sha: ticket.parse_requested_for_sha,
+        review_verdictless_observations: ticket.review_verdictless_observations,
+        review_verdictless_for_sha: ticket.review_verdictless_for_sha,
         respawns: ticket.respawns,
         conflict_attempts: ticket.conflict_attempts,
         counters: { ...ticket.counters },
@@ -2064,7 +2124,11 @@ function applyFieldAssignment(checkpoint, ticketIndex, assignment) {
             return null;
         }
         case "parse_requested_at":
-        case "parse_requested_for_sha": {
+        case "parse_requested_for_sha":
+        // BAPI-915: the head the verdictless counter is bound to. Reuses this
+        // nullable-string branch so a tick can clear the binding as deliberately as
+        // it sets it — the counter resets by writing `null` here, not by hand-editing.
+        case "review_verdictless_for_sha": {
             // The durable half of the post-merge causal barrier (BAPI-825/A2). Both
             // follow the module's nullable-string convention so a tick can clear them
             // as deliberately as it sets them — an operator re-running a parse writes
@@ -2080,7 +2144,11 @@ function applyFieldAssignment(checkpoint, ticketIndex, assignment) {
             return null;
         }
         case "respawns":
-        case "conflict_attempts": {
+        case "conflict_attempts":
+        // BAPI-915: the head-bound verdictless observation count. Reuses this
+        // non-negative-integer branch, so a negative or non-integer value is
+        // refused by the same parser that guards every other per-ticket counter.
+        case "review_verdictless_observations": {
             const parsed = parseIntegerField(value);
             if (parsed === null)
                 return `${name} must be a non-negative integer.`;

package/build/conductor/done-gate.js

@@ -10,7 +10,7 @@
  * `repo + pr_number + head_sha` binding. This module is pure (no I/O) and never
  * throws for caller input.
  */
-import { DEFAULT_GATE_NAME, REQUIRED_CI_CHECKS_GREEN, REVIEW_STATE, normalizeCheckName, normalizeSha, stableJsonHash, } from "./git-ci-types.js";
+import { DEFAULT_GATE_NAME, REQUIRED_CI_CHECKS_GREEN, REVIEW_STATE, VERDICTLESS_DISPOSITIONS, normalizeCheckName, normalizeSha, stableJsonHash, } from "./git-ci-types.js";
 // ---------------------------------------------------------------------------
 // Config parsing
 // ---------------------------------------------------------------------------
@@ -148,6 +148,20 @@ function parseReviewStateCondition(entry) {
             return null;
         condition.logic = "and";
     }
+    // BAPI-915: exact match against the closed set, with the same all-or-nothing
+    // posture every field above uses. No case folding and no trimming, so "Park"
+    // and " park" are refused rather than repaired — a value we had to guess at is
+    // not a value the operator configured. A malformed spelling invalidates the
+    // WHOLE entry (`return null`) instead of dropping just this field, which is
+    // what makes "no malformed input can ever select fail_open" true: the only way
+    // to reach `fail_open` is to spell it exactly.
+    if (entry.verdictless_disposition !== undefined) {
+        if (typeof entry.verdictless_disposition !== "string" ||
+            !VERDICTLESS_DISPOSITIONS.includes(entry.verdictless_disposition)) {
+            return null;
+        }
+        condition.verdictless_disposition = entry.verdictless_disposition;
+    }
     // For combination source, at least one sub-source must be active; otherwise
     // the condition would trivially pass with an empty failures array (fail-open).
     if (condition.source === "combination") {
@@ -241,6 +255,18 @@ export function parseDoneGateConfig(value) {
                 r.min_approvals = c.min_approvals;
             if (c.logic !== undefined)
                 r.logic = c.logic;
+            // BAPI-915: the disposition belongs in the gate IDENTITY because the
+            // identity is signed into the merge action key (`merge-pull-request.ts`,
+            // `makeMergeActionKey`), and the disposition changes WHAT THE GATE ADMITS.
+            // Two configs that differ only in disposition are two different gates and
+            // must not share an action key.
+            //
+            // The `!== undefined` guard is load-bearing in the other direction: every
+            // config written before this field existed must hash BYTE-IDENTICALLY to
+            // what it hashed before, or every stored action key changes at once. That
+            // is why the effective `park` default is never materialized here.
+            if (c.verdictless_disposition !== undefined)
+                r.verdictless_disposition = c.verdictless_disposition;
             return r;
         }),
     });
@@ -453,6 +479,18 @@ export function normalizeReviewSnapshot(raw) {
  * Deterministically evaluate a review-state condition against a normalized snapshot.
  * Pure and fail-closed: a null snapshot or any unknown/missing source yields
  * `passed: false` and `changesRequested: false` (never a false positive).
+ *
+ * **`condition.verdictless_disposition` is deliberately IGNORED here (BAPI-915).**
+ * This function answers one question — does the review evidence satisfy the
+ * configured source? — and it decides `gate.met` for the v2 done-gate producer
+ * path. A disposition is a decision about what to do when the answer is "no", not
+ * a different answer; letting it flip a verdictless evaluation to `passed` would
+ * silently turn a v2 done gate fail-open for consumers that never asked for one,
+ * and those consumers cannot tell an evaluated pass from a waived one. The two
+ * merge seams apply the disposition themselves, where the waiver is recorded and
+ * visible. A test pins this inertness — a given snapshot must yield the same
+ * `{passed, changesRequested, reason}` under `park`, under `fail_open`, and with
+ * the field absent.
  */
 export function evaluateReviewCondition(condition, snapshot) {
     if (snapshot === null) {

package/build/conductor/git-ci-types.js

@@ -143,3 +143,37 @@ export function stableJsonHash(value) {
     const json = JSON.stringify(canonical) ?? "null";
     return createHash("sha256").update(json).digest("hex");
 }
+/**
+ * BAPI-915 — the terminal disposition a bounded verdictless-review ceiling commits.
+ *
+ * `park` is the pre-BAPI-915 behaviour and the effective default whenever the
+ * field is absent, so every configuration written before this existed keeps its
+ * exact terminal handling. `fail_open` is the CONFIGURED exception: it treats a
+ * readable, same-head, verdictless review as opted out for that decision and lets
+ * CI evidence alone carry the merge.
+ *
+ * The two literals are exported as named constants so no consumer spells them
+ * inline — a typo in one consumer would otherwise silently disagree with the
+ * parser about which disposition is configured. The Python mirror lives in
+ * `api/library/epic_conductor/conductor_readiness.py` and must carry the same
+ * closed set.
+ */
+export const VERDICTLESS_DISPOSITION_PARK = "park";
+export const VERDICTLESS_DISPOSITION_FAIL_OPEN = "fail_open";
+/** Every accepted disposition spelling, for exact-match validation. */
+export const VERDICTLESS_DISPOSITIONS = [
+    VERDICTLESS_DISPOSITION_PARK,
+    VERDICTLESS_DISPOSITION_FAIL_OPEN,
+];
+/**
+ * BAPI-915 — the TypeScript mirror of v2's
+ * `MERGE_REVIEW_WAIVED_BY_DEGRADATION_REASON`, whose Python owner is
+ * `api/models/epic_run.py`. ONE spelling exists across both conductors on
+ * purpose: an operator greps a single string to find every merge that advanced
+ * on a waiver rather than on a verdict.
+ *
+ * It never claims the pull request was reviewed or approved — it names the
+ * degradation exactly. `tests/pytest/library/epic_conductor/` carries the
+ * cross-language pin that keeps this literal equal to the Python one.
+ */
+export const MERGE_REVIEW_WAIVED_BY_DEGRADATION_REASON = "review_waived_verdictless_fail_open";