@bridge_gpt/mcp-server 0.2.52 → 0.2.54

package/build/conductor/epic-runtime.js

@@ -39,6 +39,7 @@ import { createDefaultStartTicketsDeps, orchestrateStartTickets } from "../start
 import { orchestrateReviewTickets } from "../review-tickets.js";
 import { createStartTicketsConductorContext, provisionConductorHooksForRows, emitStartTicketsRunStarted, } from "../start-tickets-conductor.js";
 import { validateBranchName } from "../base-ref.js";
+import { resolveDeclaredRunBaseBranch } from "./run-branch.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -1108,15 +1109,26 @@ export async function runEpicTick(options, deps = {}) {
             // tickets, gated by quiescence. Invert the impl-dispatch maps so ledger
             // events can be attributed back to a ticket for local-first PR binding.
             const dispatchedBackstopPolicy = resolveDispatchedBackstopPolicy(epicRunState.epic_run.policy_json);
-            // BAPI-586: resolve the run's configured base branch so the done-gate pass
-            // can catch a wrong-base PR (one not targeting the run base) at
-            // reconciliation time — the backstop to the executor's own finalization
-            // guard. A malformed configured base defaults to undefined (base check
-            // skipped) rather than failing the whole tick; dispatch already fails
-            // closed on a malformed base separately.
-            const runBaseResolution = resolveConfiguredRunBaseBranch(epicRunState.epic_run.policy_json);
+            // BAPI-586/BAPI-1127: resolve the run's EFFECTIVE base branch so the
+            // done-gate pass can catch a wrong-base PR (one not targeting the run
+            // base) at reconciliation time — the backstop to the executor's own
+            // finalization guard.
+            //
+            // BAPI-1127 moved branch-name validation out of the shared declaration
+            // resolver and into this operational wrapper, so this call site now owns
+            // the fail-closed disposition it used to inherit. It fails CLOSED: when
+            // the declared base is not a usable ref the pass is SKIPPED entirely
+            // rather than run with the base comparison silently disabled. A pass that
+            // cannot verify a PR's base cannot honestly admit one as done, and the
+            // wrong-base PR this check exists to catch is exactly what would slip
+            // through. The skip happens BEFORE any PR binding resolution, CI
+            // observation, or provider call, and reports only the failed rule.
+            const runBaseResolution = resolveEffectiveRunBaseBranch(epicRunState.epic_run.policy_json);
+            if (!runBaseResolution.ok) {
+                errorLog(`[epic-tick] done-gate pass skipped for ${epic_key}: ${runBaseResolution.error}`);
+            }
             const doneGateExpectedBaseBranch = runBaseResolution.ok
-                ? runBaseResolution.baseBranch
+                ? runBaseResolution.effectiveBaseBranch
                 : undefined;
             const ticketForRunId = new Map();
             for (const [tk, rid] of ticketRunIdMap)
@@ -1134,63 +1146,65 @@ export async function runEpicTick(options, deps = {}) {
                 policy: dispatchedBackstopPolicy,
                 resolveImplRunId: resolveTicketRunId,
             });
-            await runConductorDoneGatePass(observed.ticket_statuses, {
-                observePrCi: observePrCiSeamFn,
-                // BAPI-586: the run base so the done-gate pass fails a wrong-base PR
-                // before CI/review evaluation (reconciliation backstop to executor
-                // finalization).
-                expectedBaseBranch: doneGateExpectedBaseBranch,
-                resolvePrBinding,
-                // BAPI-525 Change B: local-first binding + quiescence gate for the new
-                // dispatched/running admission (policy default OFF ⇒ no behavior change).
-                resolveActivePrBinding,
-                dispatchedBackstopPolicy,
-                resolveActiveTicketQuiescence,
-                // BAPI-487: re-evaluate a blocked ticket only when its PR head advanced
-                // past the head recorded on its latest blocking signal.
-                resolveBlockedHeadSha: (tk) => observed.ticket_blocked_heads?.get(tk) ?? null,
-                resolveRunId: resolveTicketRunId,
-                resolveWorkerId: resolveDoneGateWorkerId,
-                // BAPI-494: convert a detected conflict into a durable, head-scoped
-                // `merge.conflict` ledger event stamped with the ticket's dispatch run/worker
-                // so the fold correlates it and the remediation pass redispatches. Emitted via
-                // the shared injectable emitter, idempotent per conflict head. Folded next tick
-                // (this pass runs after rebuildObservedState), matching the gate.met latency.
-                emitConflictSignal: (input) => {
-                    emitConductorEventFn({
-                        source: MERGE_CONFLICT_EVENT_SOURCE,
-                        type: "merge.conflict",
-                        subject: input.ticketKey,
-                        run_id: input.runId,
-                        worker_id: input.workerId,
-                        producer: MERGE_CONFLICT_EVENT_PRODUCER,
-                        observed_via: "supervisor",
-                        time: new Date(nowFn()).toISOString(),
-                        data: {
-                            summary: `PR #${input.prNumber} for ${input.ticketKey} is not mergeable`,
-                            status: "blocked",
-                            reason: "merge.conflict",
-                            details: {
-                                epic_key,
-                                ticket_key: input.ticketKey,
-                                repo: input.repoName,
-                                pr_number: input.prNumber,
-                                head_sha: input.headSha,
-                                mergeable: input.mergeable,
-                                mergeStateStatus: input.mergeStateStatus,
+            if (runBaseResolution.ok) {
+                await runConductorDoneGatePass(observed.ticket_statuses, {
+                    observePrCi: observePrCiSeamFn,
+                    // BAPI-586: the run base so the done-gate pass fails a wrong-base PR
+                    // before CI/review evaluation (reconciliation backstop to executor
+                    // finalization).
+                    expectedBaseBranch: doneGateExpectedBaseBranch,
+                    resolvePrBinding,
+                    // BAPI-525 Change B: local-first binding + quiescence gate for the new
+                    // dispatched/running admission (policy default OFF ⇒ no behavior change).
+                    resolveActivePrBinding,
+                    dispatchedBackstopPolicy,
+                    resolveActiveTicketQuiescence,
+                    // BAPI-487: re-evaluate a blocked ticket only when its PR head advanced
+                    // past the head recorded on its latest blocking signal.
+                    resolveBlockedHeadSha: (tk) => observed.ticket_blocked_heads?.get(tk) ?? null,
+                    resolveRunId: resolveTicketRunId,
+                    resolveWorkerId: resolveDoneGateWorkerId,
+                    // BAPI-494: convert a detected conflict into a durable, head-scoped
+                    // `merge.conflict` ledger event stamped with the ticket's dispatch run/worker
+                    // so the fold correlates it and the remediation pass redispatches. Emitted via
+                    // the shared injectable emitter, idempotent per conflict head. Folded next tick
+                    // (this pass runs after rebuildObservedState), matching the gate.met latency.
+                    emitConflictSignal: (input) => {
+                        emitConductorEventFn({
+                            source: MERGE_CONFLICT_EVENT_SOURCE,
+                            type: "merge.conflict",
+                            subject: input.ticketKey,
+                            run_id: input.runId,
+                            worker_id: input.workerId,
+                            producer: MERGE_CONFLICT_EVENT_PRODUCER,
+                            observed_via: "supervisor",
+                            time: new Date(nowFn()).toISOString(),
+                            data: {
+                                summary: `PR #${input.prNumber} for ${input.ticketKey} is not mergeable`,
+                                status: "blocked",
+                                reason: "merge.conflict",
+                                details: {
+                                    epic_key,
+                                    ticket_key: input.ticketKey,
+                                    repo: input.repoName,
+                                    pr_number: input.prNumber,
+                                    head_sha: input.headSha,
+                                    mergeable: input.mergeable,
+                                    mergeStateStatus: input.mergeStateStatus,
+                                },
                             },
-                        },
-                    }, {
-                        event_type: "merge.conflict",
-                        run_id: input.runId ?? undefined,
-                        commit_sha: input.headSha,
-                    });
-                },
-                access,
-                env,
-                log,
-                errorLog,
-            });
+                        }, {
+                            event_type: "merge.conflict",
+                            run_id: input.runId ?? undefined,
+                            commit_sha: input.headSha,
+                        });
+                    },
+                    access,
+                    env,
+                    log,
+                    errorLog,
+                });
+            }
             const maxSeqForRun = (runId) => {
                 let maxSeq = 0;
                 for (const ev of localEvents) {
@@ -1554,39 +1568,46 @@ export async function runEpicTick(options, deps = {}) {
     }
 }
 /**
- * BAPI-586: resolve the epic run's configured base branch from `policy_json`
- * (`base_branch`, else `baseBranch`), mirroring the server-side reconciler's
- * spec-review base resolution. The authoritative run base — NOT a hard-coded
- * `main` — is what every fresh dispatch and PR must target.
+ * BAPI-586/BAPI-1127: resolve the epic run's EFFECTIVE base branch — the branch
+ * every fresh dispatch cuts from and every child PR targets.
+ *
+ * Two layers, deliberately kept apart:
  *
- * - absent/empty → `main` (the legacy/default value).
- * - present and a valid branch name → that branch (e.g. `develop`).
- * - present but malformed (non-string, `..`, `.lock`, control chars, leading `-`)
- *   → a contract failure so dispatch fails CLOSED rather than emitting a malformed
- *   base (a wrong base is exactly the BAPI-586 defect).
+ * 1. DECLARATION, delegated in full to the dependency-free
+ *    {@link resolveDeclaredRunBaseBranch} leaf, which is the shared cross-runtime
+ *    contract this function does not get a second opinion about. The ordered
+ *    `base_branch` → `baseBranch` scan, the skip-and-continue treatment of a
+ *    non-string or blank candidate, and the trim all live there.
+ * 2. OPERATIONAL POLICY, which is this function's own and is NOT shared with
+ *    Python: an undeclared policy defaults to `main`, and the branch that will
+ *    actually be handed to git is validated before it is returned.
+ *
+ * The frozen dispositions (BAPI-1127) show up here as follows:
+ *
+ * - A NON-STRING candidate is absent, not fatal. `{base_branch: 42,
+ *   baseBranch: "epic/X"}` now resolves to `epic/X`; before BAPI-1127 it failed
+ *   closed, and `{base_branch: "", baseBranch: "epic/X"}` reported `main` — a
+ *   different real branch from the one the server provisioned.
+ * - A MALFORMED declared name does NOT fall back to `main`. Silently
+ *   substituting the default for a bad declaration is how a wrong base becomes
+ *   invisible (the BAPI-586 defect), so it fails closed and dispatch refuses.
+ *   Only an ACTUAL absence of a declaration reaches the default.
+ *
+ * Validation happens here, once, ahead of both operational consumers (dispatch
+ * and the done gate) rather than inside the shared resolver, so that Python and
+ * TypeScript agree about what a policy declares while each keeps its own
+ * judgment about what is safe to use. The failure carries only the rule that
+ * failed — never the policy document or an unbounded branch value.
  */
-export function resolveConfiguredRunBaseBranch(policyJson) {
+export function resolveEffectiveRunBaseBranch(policyJson) {
     const DEFAULT_BASE = "main";
-    if (!policyJson || typeof policyJson !== "object") {
-        return { ok: true, baseBranch: DEFAULT_BASE };
-    }
-    const raw = policyJson.base_branch ??
-        policyJson.baseBranch;
-    if (raw === undefined || raw === null) {
-        return { ok: true, baseBranch: DEFAULT_BASE };
-    }
-    if (typeof raw !== "string") {
-        return { ok: false, error: "epic run policy base_branch is present but is not a string." };
-    }
-    const trimmed = raw.trim();
-    if (trimmed.length === 0) {
-        return { ok: true, baseBranch: DEFAULT_BASE };
-    }
-    const validationError = validateBranchName(trimmed);
+    const declaredBaseBranch = resolveDeclaredRunBaseBranch(policyJson);
+    const effectiveBaseBranch = declaredBaseBranch ?? DEFAULT_BASE;
+    const validationError = validateBranchName(effectiveBaseBranch);
     if (validationError) {
         return { ok: false, error: `epic run policy base_branch is invalid: ${validationError}` };
     }
-    return { ok: true, baseBranch: trimmed };
+    return { ok: true, declaredBaseBranch, effectiveBaseBranch };
 }
 /**
  * Build the production EpicRuntimeDeps for use inside `runEpicTickCommand`.
@@ -1615,13 +1636,23 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
     // error (observe-only would already default to `main`); a malformed configured
     // base is captured as an error and re-raised at dispatch time so a bad base
     // never silently dispatches.
-    let cachedRunBase = { ok: true, baseBranch: "main" };
+    //
+    // BAPI-1127: the fetch-failure fallback declares NOTHING and dispatches from
+    // `main`, which is what "we could not read the policy" honestly means — the
+    // two values are kept separate so a later reader cannot mistake the default
+    // for a declaration the run never made.
+    const UNDECLARED_MAIN = {
+        ok: true,
+        declaredBaseBranch: undefined,
+        effectiveBaseBranch: "main",
+    };
+    let cachedRunBase = UNDECLARED_MAIN;
     try {
         const runState = await fetchEpicRunState(access, epicKey);
-        cachedRunBase = resolveConfiguredRunBaseBranch(runState.epic_run.policy_json);
+        cachedRunBase = resolveEffectiveRunBaseBranch(runState.epic_run.policy_json);
     }
     catch {
-        cachedRunBase = { ok: true, baseBranch: "main" };
+        cachedRunBase = UNDECLARED_MAIN;
     }
     // Shared closure state populated by fetchPlan and consumed by dispatchSeam.
     let cachedPlanVersion = 0;
@@ -1687,12 +1718,17 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         if (cachedPlanVersion === 0) {
             throw new Error(`dispatchSeam called before fetchPlan for epic ${ek} ticket ${tk}; cachedPlanVersion is 0`);
         }
-        // BAPI-586: fail CLOSED on a malformed configured run base rather than
-        // dispatching a worker (and opening a PR) against a bad base.
+        // BAPI-586/BAPI-1127: fail CLOSED on a malformed configured run base rather
+        // than dispatching a worker (and opening a PR) against a bad base. The check
+        // is here — ahead of the dispatch claim, the spawn command, and any git or
+        // provider work — because `resolveEffectiveRunBaseBranch` validates the ref
+        // but this is the boundary that actually uses it. Only `effectiveBaseBranch`
+        // (declaration, else `main`) is handed on; the declaration itself stays
+        // separately readable on `cachedRunBase` and is never overwritten.
         if (!cachedRunBase.ok) {
             throw new Error(`invalid configured base branch for epic ${ek}: ${cachedRunBase.error}`);
         }
-        const runBaseBranch = cachedRunBase.baseBranch;
+        const runBaseBranch = cachedRunBase.effectiveBaseBranch;
         // BAPI-441: a remediation re-dispatch (attempt > 0) reuses the existing
         // branch/worktree (resume mode) and claims an attempt-scoped dispatch key so
         // it is not deduped against the original epic dispatch.