@bridge_gpt/mcp-server 0.2.53 → 0.2.55

package/build/executor/job-errors.js

@@ -139,6 +139,51 @@ export const StaleArtifactCleanupFailed = "ContractError.StaleArtifactCleanupFai
  * than proceeding on an unverified premise.
  */
 export const WorkerEnvFilePresent = "ContractError.WorkerEnvFilePresent";
+/**
+ * BAPI-1152 — `reconcile_overlap` failure kinds. Each names ONE way the
+ * wrapper's merge-into-child could not reach a verified push, so an operator
+ * reading the row knows which fact to go look at. None of them is a verdict: a
+ * refused governance change and a moved head are NOT failures — they complete
+ * with a fact envelope — so they have no kind here.
+ *
+ *  - `ContractError.ReconcileOverlapPayload` — the payload failed validation
+ *    before any subprocess ran (missing/blank input SHA, unknown schema version,
+ *    malformed command or region record).
+ *  - `ContractError.ReconcileOverlapBranchMismatch` — the prepared worktree's
+ *    branch is not the job's top-level `expected_branch`, so the push destination
+ *    cannot be trusted.
+ *  - `ReconcileOverlapMergeFailed` — fetching the inputs, `git merge-tree`, or the
+ *    materialized `git merge` failed operationally (not a conflict).
+ *  - `ReconcileOverlapNothingToMerge` — the child head already contains the
+ *    required epic commit; there is nothing to reconcile.
+ *  - `ReconcileOverlapConflictsUnresolved` — the worker exited with conflict
+ *    markers or unmerged index entries still present.
+ *  - `ReconcileOverlapWorkerRewroteHistory` — the worker moved `HEAD`, committed,
+ *    or removed `MERGE_HEAD`; commits are the wrapper's alone.
+ *  - `ReconcileOverlapVerificationRed` — a local verification command stayed red,
+ *    timed out, or could not run after the reconciliation.
+ *  - `ReconcileOverlapTopologyRefused` — the candidate is not a merge containing
+ *    both input heads with the dispatched parents.
+ *  - `ReconcileOverlapPushUnauthorized` — the executor machine's git credential
+ *    helper refused the push or the remote read.
+ *  - `ReconcileOverlapPushRejected` — the remote refused the guarded push for a
+ *    reason other than a moved head.
+ *  - `ReconcileOverlapPushUnfinalized` — the push reported success but origin does
+ *    not carry the pushed head (the reconcile-specific counterpart of
+ *    `WorkerFinalizationSavedButUnfinalized`, whose "resume from the branch"
+ *    guidance would mislead here: the worktree has been reset).
+ */
+export const ReconcileOverlapPayload = "ContractError.ReconcileOverlapPayload";
+export const ReconcileOverlapBranchMismatch = "ContractError.ReconcileOverlapBranchMismatch";
+export const ReconcileOverlapMergeFailed = "ReconcileOverlapMergeFailed";
+export const ReconcileOverlapNothingToMerge = "ReconcileOverlapNothingToMerge";
+export const ReconcileOverlapConflictsUnresolved = "ReconcileOverlapConflictsUnresolved";
+export const ReconcileOverlapWorkerRewroteHistory = "ReconcileOverlapWorkerRewroteHistory";
+export const ReconcileOverlapVerificationRed = "ReconcileOverlapVerificationRed";
+export const ReconcileOverlapTopologyRefused = "ReconcileOverlapTopologyRefused";
+export const ReconcileOverlapPushUnauthorized = "ReconcileOverlapPushUnauthorized";
+export const ReconcileOverlapPushRejected = "ReconcileOverlapPushRejected";
+export const ReconcileOverlapPushUnfinalized = "ReconcileOverlapPushUnfinalized";
 /** Rendered in place of an empty name list, so "none" is never ambiguous. */
 export const EMPTY_MCP_SERVER_NAME_MARKER = "none";
 /** Bound the rendered name lists so a pathological registration cannot spam a job row. */

package/build/executor/job-runner.js

@@ -40,6 +40,8 @@ import { acquireExecutorWorktreeLock, } from "./worktree-lock.js";
 import { activateJobLog, deactivateJobLog, registerExecutorJobLog, markExecutorJobLogFinished, } from "./job-log-registry.js";
 import { executorViewerTabsEnabled, openExecutorViewerTab } from "./viewer-tabs.js";
 import { isImplementationStyleJobType, isRecoveryJobType, isSpawnJobType } from "./job-types.js";
+import { cleanupInterruptedWorktree } from "./interrupted-worktree.js";
+import { lazyProviderCheckPoller, runReconcileOverlapJob, } from "./reconcile-overlap-job.js";
 import { resolveExecutorJobBaseBranch } from "./base-branch.js";
 import { resolveExecutorJobIndexScope } from "./index-scope.js";
 import { validateWorkerFinalization } from "./worker-finalization.js";
@@ -48,6 +50,23 @@ import { buildPrBaseContractLaunchInstruction } from "../pr-base-contract.js";
 import { resolveExecutorPrompt, resolveWorkerPermissionPosture, } from "./worker-command.js";
 import { collectGitTelemetry, collectRemoteTrackingSha, createMcpSurfaceObserver, evaluatePreSpawnGitVerification, formatWorkerRateLimitAdvisory, normalizeMcpServerNames, } from "./observation.js";
 import { isRecognizedServerName, MCP_SERVER_NAME } from "../mcp-identity.js";
+/**
+ * Bound on the pre-spawn git tracked-file lookup (BAPI-1104, R81).
+ *
+ * This runs at the LAST step before every worker spawn, so a hung `git ls-files`
+ * would stall spawning rather than merely delay one exemption. Five seconds is
+ * far beyond what an index read of a handful of pathspecs takes, and a timeout
+ * degrades to "exempt nothing" rather than to a refusal.
+ */
+const ENV_FILE_TRACKED_LOOKUP_TIMEOUT_MS = 5_000;
+/**
+ * The ONE fixed line emitted when that lookup fails. No path (a worktree path
+ * carries an operator's username), no filename, no errno, no command output, no
+ * exception text — the same bar `WORKER_ENV_FILE_PRESENT_MESSAGE` and the guard's
+ * closed categories hold. It is advisory: the spawn proceeds, with nothing
+ * exempted.
+ */
+const ENV_FILE_TRACKED_LOOKUP_FAILED_MESSAGE = "[executor] tracked env-file lookup unavailable; exempting nothing";
 /** Default runtime for the no-op smoke process (ms). */
 const DEFAULT_SMOKE_DURATION_MS = 100;
 /** ProcessClassification maps 1:1 onto the wire ExecutorClassification. */
@@ -596,6 +615,21 @@ control) {
     if (job.job_type === "smoke") {
         return runSmokeJob(job, httpClient, options, deps, ownership, observation, control);
     }
+    // BAPI-1152: `reconcile_overlap` takes its OWN branch, after `merge`/`smoke`
+    // and before the generic spawn path. It needs a prepared, locked worktree like
+    // a spawn job, but its body is the reconcile module's state machine: the
+    // payload is validated there BEFORE any subprocess, and the worker — when one
+    // is needed at all — is launched through the SAME locked `runSpawnJob` path
+    // via a driver, so there is still exactly one worker spawn boundary.
+    if (job.job_type === "reconcile_overlap") {
+        return await runReconcileOverlapJob(job, {
+            fail: async (failure) => {
+                await httpClient.fail(job, failure);
+                return { status: "failed", reason: "reconcile_overlap_payload" };
+            },
+            runLockedSpawn: (driver) => runSpawnJob(job, httpClient, options, deps, ownership, observation, seams, control, driver),
+        }, buildReconcileOverlapSeams(deps));
+    }
     // `implement`/`resume`/`spec_review` and the recovery jobs (`remediate`/
     // `ci_fix`/`rebase`) all run through the real headless-spawn path — dispatched
     // via the shared `isSpawnJobType` policy (`job-types.ts`) AFTER the dedicated
@@ -629,6 +663,18 @@ control) {
  * from the supervised `ProcessRunResult`/`ownership`, not from this adapter).
  */
 function createMergeFlowProcess(startMerge) {
+    const flow = createFlowProcess(startMerge, (result) => result.ok);
+    return { proc: flow.proc, getOutcome: flow.getOutcome, getError: flow.getError };
+}
+/**
+ * The generic form of {@link createMergeFlowProcess} (BAPI-1152): adapt any
+ * in-process flow into an {@link OwnedChildProcess} so it is supervised by the
+ * SAME heartbeat/deadman/timeout path as a worker. `settled` resolves once the
+ * flow's own promise has settled — after a timeout or kill the supervised
+ * process resolves immediately, but the flow may still be finishing a bounded
+ * subprocess, and a caller that is about to reset the worktree must wait for it.
+ */
+function createFlowProcess(start, isOk) {
     const controller = new AbortController();
     let outcome;
     let error;
@@ -637,12 +683,12 @@ function createMergeFlowProcess(startMerge) {
     const waitPromise = new Promise((resolve) => {
         settleWait = resolve;
     });
-    // Start the merge flow immediately; capture its resolution/rejection.
-    startMerge(controller.signal).then((result) => {
+    // Start the flow immediately; capture its resolution/rejection.
+    const settled = start(controller.signal).then((result) => {
         outcome = result;
         if (!done) {
             done = true;
-            settleWait({ exitCode: result.ok ? 0 : 1, signal: null });
+            settleWait({ exitCode: isOk(result) ? 0 : 1, signal: null });
         }
     }, (err) => {
         error = err;
@@ -670,6 +716,7 @@ function createMergeFlowProcess(startMerge) {
         proc,
         getOutcome: () => outcome,
         getError: () => error,
+        settled,
     };
 }
 /**
@@ -867,6 +914,131 @@ async function runSmokeJob(job, httpClient, options, deps, ownership, observatio
     }, job, control);
     return terminalToRunResult(terminal, "completed");
 }
+/** Build the reconcile module's seams from executor deps (BAPI-1152). */
+function buildReconcileOverlapSeams(deps) {
+    return {
+        runCommand: deps.runCommand,
+        readFile: deps.readFile,
+        writeFile: deps.writeFile,
+        mkdir: deps.mkdir,
+        now: deps.now,
+        sleep: deps.sleep,
+        env: deps.env,
+        pollProviderChecks: lazyProviderCheckPoller({
+            env: deps.env,
+            cwd: deps.cwd,
+            homedir: deps.homedir,
+            platform: deps.platform,
+            readFile: deps.readFile,
+            stat: deps.stat,
+        }),
+        errorLog: deps.errorLog,
+    };
+}
+/** Bound on waiting for an aborted driver phase to finish its in-flight command. */
+const DRIVER_PHASE_SETTLE_MAX_MS = 240_000;
+/**
+ * Run one driver phase under the SAME heartbeat/deadman/timeout supervision a
+ * worker gets (BAPI-1152). A deterministic phase can run for many minutes — local
+ * verification commands, a CI wait — and without heartbeats the janitor would
+ * re-queue a healthy job. On a timeout or a lost claim the phase is aborted and
+ * then AWAITED (bounded) before returning, so the caller never resets the
+ * worktree underneath a git command the phase is still running.
+ */
+async function superviseDriverPhase(params) {
+    const flow = createFlowProcess(params.run, () => true);
+    const procResult = await superviseProcess({
+        job: params.job,
+        httpClient: params.httpClient,
+        options: params.options,
+        deps: params.deps,
+        ownership: params.ownership,
+        observation: params.observation,
+        proc: flow.proc,
+        timeoutSeconds: Math.max(1, params.timeoutSeconds),
+        collectTelemetry: params.collectTelemetry,
+        control: params.control,
+    });
+    await Promise.race([flow.settled, params.deps.sleep(DRIVER_PHASE_SETTLE_MAX_MS)]);
+    if (procResult.serverStopRequested)
+        return { kind: "server_stop" };
+    if (params.ownership.abandoned)
+        return { kind: "abandoned" };
+    if (procResult.classification === "timeout")
+        return { kind: "timeout" };
+    const error = flow.getError();
+    if (error !== undefined)
+        return { kind: "error", error };
+    const value = flow.getOutcome();
+    if (value === undefined)
+        return { kind: "error", error: new Error("driver phase produced no outcome") };
+    return { kind: "result", value };
+}
+/** Report a driver's terminal decision through the shared terminal-mutation path. */
+async function reportDriverOutcome(outcome, ctx) {
+    if (outcome.kind === "complete") {
+        const completion = {
+            job_type: ctx.job.job_type,
+            exit_code: 0,
+            classification: "clean_exit",
+            result: outcome.result,
+            // ONLY a pushed head is reported: the server binds `last_commit_sha` as the
+            // job's produced head, and a job that pushed nothing produced none.
+            ...(outcome.lastCommitSha ? { last_commit_sha: outcome.lastCommitSha } : {}),
+            telemetry: ctx.observation.snapshot(),
+        };
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "complete",
+            send: () => ctx.httpClient.complete(ctx.job, completion),
+            deps: ctx.deps,
+            options: ctx.options,
+            ownership: ctx.ownership,
+            log: ctx.deps.log,
+        }, ctx.job, ctx.control);
+        return terminalToRunResult(terminal, "completed");
+    }
+    const terminal = await sendTerminalMutationWithAuthReport({
+        kind: "fail",
+        send: () => ctx.httpClient.fail(ctx.job, { ...outcome.failure, telemetry: ctx.observation.snapshot() }),
+        deps: ctx.deps,
+        options: ctx.options,
+        ownership: ctx.ownership,
+        log: ctx.deps.log,
+    }, ctx.job, ctx.control);
+    return terminalToRunResult(terminal, "failed");
+}
+/** Restore the worktree and report a driver phase that did not finish. */
+async function reportDriverPhaseInterruption(phase, ctx) {
+    await ctx.driver.abandon(ctx.driverBaseContext);
+    if (phase.kind === "abandoned") {
+        return { status: "abandoned", reason: ctx.ownership.abandonReason };
+    }
+    if (phase.kind === "server_stop") {
+        await ctx.httpClient.fail(ctx.job, {
+            error_kind: "ServerStopRequested",
+            error_message: "the server requested this run stop; the reconciliation was stopped",
+            classification: "killed",
+            telemetry: ctx.observation.snapshot(),
+        });
+        ctx.ownership.abandoned = true;
+        ctx.ownership.abandonReason = "server_stop";
+        return { status: "abandoned", reason: "server_stop" };
+    }
+    return await reportDriverOutcome({
+        kind: "fail",
+        failure: phase.kind === "timeout"
+            ? {
+                error_kind: "Timeout",
+                error_message: `${ctx.job.job_type} phase exceeded the job timeout`,
+                classification: "timeout",
+            }
+            : {
+                error_kind: "WorkerCrashed",
+                error_message: `${ctx.job.job_type} phase failed: ${secretFreeErrorMessage(phase.error)}`,
+                classification: "crashed",
+            },
+    }, ctx);
+}
 /**
  * BAPI-862: the payload key the reconciler stamps with the implement gate's last
  * observation reason code. Server-minted and opaque to the executor beyond the
@@ -1031,7 +1203,13 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
  * returns BEFORE either the deny layer or MCP provisioning runs — neither ever
  * touches a worktree that will not become a runnable worker.
  */
-async function runSpawnJob(job, httpClient, options, deps, ownership, observation, seams, control) {
+async function runSpawnJob(job, httpClient, options, deps, ownership, observation, seams, control, 
+/**
+ * BAPI-1152: an optional spawn-job driver (`reconcile_overlap`). It runs inside
+ * the SAME lock and the SAME prepared-spawn path as every other spawn job, so it
+ * adds no second worktree entry and no second worker launcher.
+ */
+driver) {
     // --- Per-job base branch (BAPI-586) ----------------------------------
     // Resolve the effective logical base BEFORE any side effect: the persisted
     // run base (`payload.base_branch`) is authoritative, falling back to the
@@ -1222,6 +1400,7 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
             adapter,
             control,
             lifecycle: spawnLifecycle,
+            driver,
         });
     }
     finally {
@@ -1256,12 +1435,12 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
  * rather than a 500-line indentation nobody can verify by eye.
  */
 async function runPreparedSpawn(params) {
-    const { job, httpClient, options, jobOptions, deps, ownership, observation, seams, worktreePath, branch, prep, effectiveBaseBranch, indexScope, permissionPosture, adapter, control, lifecycle, } = params;
+    const { job, httpClient, options, jobOptions, deps, ownership, observation, seams, worktreePath, branch, prep, effectiveBaseBranch, indexScope, permissionPosture, adapter, control, lifecycle, driver, } = params;
     // BAPI-586: PR-producing spawn jobs (implement/resume/remediate/ci_fix/rebase)
     // are told to open the PR against the injected run base. Verdict-only
     // `spec_review` produces no PR, so it is excluded from the instruction while
     // still using the pinned base for its fresh worktree.
-    const prompt = isImplementationStyleJobType(job.job_type)
+    let prompt = isImplementationStyleJobType(job.job_type)
         ? `${prep.prompt} ${buildPrBaseContractLaunchInstruction()}`
         : prep.prompt;
     // --- Timeout contract ------------------------------------------------
@@ -1274,6 +1453,49 @@ async function runPreparedSpawn(params) {
         });
         return { status: "failed", reason: "timeout_contract" };
     }
+    // --- Spawn-job driver: the pre-worker phase (BAPI-1152) --------------
+    // Runs INSIDE the lock and before every worker-owned side effect. A driver may
+    // finish the whole job here (a clean, green reconciliation pushes with no
+    // worker at all), or hand back the ONE worker it needs and the pre-spawn state
+    // it has already proven. The job's overall timeout budget spans every phase.
+    const jobDeadlineMs = deps.now() + timeout.timeoutSeconds * 1000;
+    const remainingMs = () => Math.max(0, jobDeadlineMs - deps.now());
+    const driverBaseContext = {
+        worktreePath,
+        branch,
+        preparedHeadSha: prep.expectedHeadSha,
+        effectiveBaseBranch,
+    };
+    const driverTelemetry = () => collectGitTelemetry({ runCommand: deps.runCommand, now: deps.now }, worktreePath, effectiveBaseBranch);
+    let driverStep;
+    if (driver) {
+        const phase = await superviseDriverPhase({
+            job,
+            httpClient,
+            options: jobOptions,
+            deps,
+            ownership,
+            observation,
+            control,
+            timeoutSeconds: Math.ceil(remainingMs() / 1000),
+            collectTelemetry: driverTelemetry,
+            run: (signal) => driver.beforeWorker({ ...driverBaseContext, signal, remainingMs }),
+        });
+        if (phase.kind !== "result") {
+            return await reportDriverPhaseInterruption(phase, {
+                job, httpClient, options, deps, ownership, observation, control, driver, driverBaseContext,
+            });
+        }
+        if (phase.value.kind === "finish") {
+            return await reportDriverOutcome(phase.value.outcome, {
+                job, httpClient, options, deps, ownership, observation, control,
+            });
+        }
+        driverStep = phase.value;
+        // The driver's prompt is used VERBATIM: it is server-rendered, and the PR-base
+        // launch instruction would tell a worker with no push authority to open a PR.
+        prompt = driverStep.prompt;
+    }
     // --- Pre-spawn git verification (FAIL-CLOSED, BAPI-731 WS-E) ---------
     // FIRST of the pre-spawn contracts, and deliberately BEFORE every
     // executor-owned write to the worktree (deny layer, MCP provisioning, worker
@@ -1287,8 +1509,15 @@ async function runPreparedSpawn(params) {
     // untracked-clean / head-verify behavior in `worktree-core.ts`; it is an
     // additional independent check on top of them.
     const preSpawnTelemetry = await collectGitTelemetry({ runCommand: deps.runCommand, now: deps.now }, worktreePath, effectiveBaseBranch);
-    const verification = evaluatePreSpawnGitVerification(preSpawnTelemetry, prep.expectedHeadSha);
+    // BAPI-1152: a driver proves its own pre-spawn state (a reconciliation worker
+    // may start inside an in-progress merge, which the generic "clean at the
+    // prepared commit" check would refuse by design).
+    const verification = driverStep
+        ? driverStep.preSpawnVerification
+        : evaluatePreSpawnGitVerification(preSpawnTelemetry, prep.expectedHeadSha);
     if (!verification.ok) {
+        if (driver)
+            await driver.abandon(driverBaseContext);
         // Record the attempt boundary even for a refusal: an attempt that never
         // spawned still started and ended at the observed commit, so the reconciler
         // sees a machine-readable "went nowhere" rather than a silent gap.
@@ -1538,7 +1767,12 @@ async function runPreparedSpawn(params) {
             // BAPI-1020 — becomes `BAPI_WORKER_BRANCH` in the worker environment, which
             // is the deterministic guard's only source of branch identity. Same
             // provenance as the deny-provisioning value above: the prepared worktree.
-            workerBranch: branch,
+            //
+            // BAPI-1152: a driver that holds the push itself OMITS it, so the guard
+            // denies every `git push` the worker attempts — the worker has no remote
+            // write authority at all.
+            ...(driver?.omitWorkerBranch ? {} : { workerBranch: branch }),
+            ...(driverStep ? { declaredTouchedFiles: driverStep.declaredTouchedFiles } : {}),
             parentEnv: deps.env,
         });
         assertUsableSpawnShape(spawnShape, adapter);
@@ -1599,6 +1833,49 @@ async function runPreparedSpawn(params) {
         // enforcement: no `stat`, `readlink`, or `readFile` is reachable from here.
         lstat: (target) => lstat(target),
         unlink: (target) => unlink(target),
+        // BAPI-1104 (R81): which candidates git reports as TRACKED. This repository's
+        // own `.env.example` is tracked content, not an operator's environment file,
+        // and the `.env.` prefix rule was deleting it from every worker worktree.
+        //
+        // `deps.runCommand` is `execFile` with `shell: false`, so the basenames are
+        // delivered as inert argv elements and no shell parses them. `--` is
+        // mandatory: it stops git reading any argument as an option (unreachable for
+        // `.env*` names, but the separator is what makes that a property rather than
+        // an argument). `--error-unmatch` is deliberately NOT used — it exits 1 and
+        // prints nothing for the WHOLE invocation as soon as one pathspec is
+        // untracked, so on the mixed tracked/untracked worktree this feature exists
+        // for it would silently report "nothing is tracked" and delete the
+        // `.env.example` anyway. Plain `ls-files` lists only tracked paths and exits
+        // zero, so the tracked subset falls out of stdout directly.
+        listTrackedNames: async (root, candidates) => {
+            let result;
+            try {
+                result = await deps.runCommand("git", ["ls-files", "-z", "--", ...candidates], { cwd: root, timeoutMs: ENV_FILE_TRACKED_LOOKUP_TIMEOUT_MS });
+            }
+            catch {
+                // `runCommand` surfaces a non-zero exit as `exitCode` rather than
+                // throwing, so reaching here means the process could not be run at all.
+                deps.errorLog(ENV_FILE_TRACKED_LOOKUP_FAILED_MESSAGE);
+                return [];
+            }
+            if (result.exitCode !== 0 || typeof result.stdout !== "string") {
+                // Fail-OPEN into "nothing is exempt": the guard then strips every match,
+                // which is strictly safer than refusing a spawn it can still confirm
+                // clean. One fixed line, and nothing from the command in it — stdout
+                // would carry worktree-relative paths and stderr an errno.
+                deps.errorLog(ENV_FILE_TRACKED_LOOKUP_FAILED_MESSAGE);
+                return [];
+            }
+            // NUL-delimited, never logged. Filtered to the exact candidate set here as
+            // well as in the guard: the seam's contract is basenames-in / basenames-out
+            // restricted to what was asked about, and a producer that honors its own
+            // contract is easier to reason about than one that relies on its consumer
+            // to clean up after it. The guard's re-intersection stays the enforcement.
+            const asked = new Set(candidates);
+            return result.stdout
+                .split("\0")
+                .filter((name) => name.length > 0 && asked.has(name));
+        },
         platform: deps.platform,
     });
     if (!stripped.ok) {
@@ -1676,7 +1953,9 @@ async function runPreparedSpawn(params) {
         ownership,
         observation,
         proc: supervisedProc,
-        timeoutSeconds: timeout.timeoutSeconds,
+        // BAPI-1152: a driver's worker gets what is LEFT of the job budget, since the
+        // pre-worker phase has already spent some of it.
+        timeoutSeconds: driver ? Math.max(1, Math.ceil(remainingMs() / 1000)) : timeout.timeoutSeconds,
         collectTelemetry,
         collectRemoteMarker,
         mcpSurface,
@@ -1726,6 +2005,8 @@ async function runPreparedSpawn(params) {
     if (procResult.serverStopRequested) {
         await closeWorkerLog();
         await finalizeRegistry();
+        if (driver)
+            await driver.abandon(driverBaseContext);
         await httpClient.fail(job, {
             error_kind: "ServerStopRequested",
             error_message: "the server requested this run stop; the owned worker was terminated",
@@ -1753,6 +2034,8 @@ async function runPreparedSpawn(params) {
     await reportWorkerLogSessionInvariant(tee, deps);
     if (ownership.abandoned) {
         await finalizeRegistry();
+        if (driver)
+            await driver.abandon(driverBaseContext);
         return { status: "abandoned", reason: ownership.abandonReason };
     }
     // --- MCP surface containment verdict (FAIL-CLOSED, BAPI-790) ----------
@@ -1773,6 +2056,8 @@ async function runPreparedSpawn(params) {
     const surfaceVerdict = mcpSurface.verdict();
     if (surfaceVerdict.kind === "mismatch") {
         await finalizeRegistry();
+        if (driver)
+            await driver.abandon(driverBaseContext);
         await httpClient.fail(job, {
             error_kind: McpSurfaceMismatch,
             error_message: formatMcpSurfaceMismatch(surfaceVerdict.expected, surfaceVerdict.observed),
@@ -1800,6 +2085,8 @@ async function runPreparedSpawn(params) {
         procResult.classification === "crashed" &&
         procResult.stdoutExcerpt.trim().length === 0) {
         await finalizeRegistry();
+        if (driver)
+            await driver.abandon(driverBaseContext);
         await httpClient.fail(job, {
             error_kind: WorkerStartupFatal,
             error_message: WORKER_STARTUP_FATAL_MESSAGE,
@@ -1826,6 +2113,31 @@ async function runPreparedSpawn(params) {
                 "for this spawn");
     }
     const git = observation.git();
+    // BAPI-1152: a driver owns everything after a clean worker exit — staging, the
+    // governance scan, the commits, the guarded push, and finalization.
+    if (driver && procResult.classification === "clean_exit") {
+        await finalizeRegistry();
+        const phase = await superviseDriverPhase({
+            job,
+            httpClient,
+            options: jobOptions,
+            deps,
+            ownership,
+            observation,
+            control,
+            timeoutSeconds: Math.max(1, Math.ceil(remainingMs() / 1000)),
+            collectTelemetry: driverTelemetry,
+            run: (signal) => driver.afterWorker({ ...driverBaseContext, signal, remainingMs }, { classification: procResult.classification, exitCode: procResult.exitCode }),
+        });
+        if (phase.kind !== "result") {
+            return await reportDriverPhaseInterruption(phase, {
+                job, httpClient, options, deps, ownership, observation, control, driver, driverBaseContext,
+            });
+        }
+        return await reportDriverOutcome(phase.value, {
+            job, httpClient, options, deps, ownership, observation, control,
+        });
+    }
     if (procResult.classification === "clean_exit") {
         // Verdict jobs (`spec_review`) forward the fixed-path artifact verbatim; a
         // missing/invalid artifact is a fail-loud `MissingVerdictArtifact`.
@@ -1968,6 +2280,19 @@ async function runPreparedSpawn(params) {
     // a verdict and a reason code only — never the matched line — so nothing from
     // the worker's stream reaches `/fail` through this path.
     await finalizeRegistry();
+    // BAPI-1152: an interrupted worker (timeout or kill) can leave a stale
+    // `index.lock` or an in-progress merge behind — the BAPI-1111 residue that made
+    // the next job's reset fail. Removed for EVERY spawn job, never with a hard
+    // reset; only a driver (`reconcile_overlap`) additionally resets to its anchor.
+    if (procResult.classification === "timeout" || procResult.classification === "killed") {
+        await cleanupInterruptedWorktree(worktreePath, {
+            runCommand: deps.runCommand,
+            removeFile: deps.removeFile ?? ((filePath) => rm(filePath)),
+            errorLog: deps.errorLog,
+        });
+    }
+    if (driver)
+        await driver.abandon(driverBaseContext);
     const authDetection = adapter.authFailureDetection;
     const authFailure = authDetection?.supported === true &&
         authDetection.value.classify(procResult.stdoutExcerpt).notAuthenticated;

package/build/executor/job-types.js

@@ -2,9 +2,10 @@
  * Shared executor job-type policy (BAPI-542, TDD §9).
  *
  * Single source of truth for which claimed job types the executor spawns and
- * which of those are RECOVERY jobs. Recovery jobs (`remediate`/`ci_fix`/`rebase`)
- * resume the ticket's existing branch/PR through the `/implement-ticket <KEY>
- * --auto` correction loop rather than cutting a fresh branch off base. Dispatch
+ * which of those are RECOVERY jobs. Recovery jobs (`remediate`/`ci_fix`/`rebase`/
+ * `reconcile_overlap`) resume the ticket's existing branch/PR rather than cutting
+ * a fresh branch off base — the first three through the `/implement-ticket <KEY>
+ * --auto` correction loop, `reconcile_overlap` through its own job body. Dispatch
  * (`job-runner.ts` `runClaimedJob`), prompt synthesis (`worker-command.ts`
  * `resolveExecutorPrompt`), and worktree reuse (`job-runner.ts` `prepareSpawn` →
  * `worktree.ts` `ensureExecutorWorktree`) all read from here so the recovery /
@@ -17,21 +18,33 @@
 /**
  * Recovery job types: enqueued by the server-side reconciler when a gate is
  * ACTIONABLE (review changes requested → `remediate`, CI failed → `ci_fix`,
- * merge conflict → `rebase`). They re-enter the correction loop on the ticket's
- * EXISTING branch/PR, so the executor reuses that branch instead of cutting a
- * fresh one off base.
+ * merge conflict → `rebase`, overlapping sibling at `code_review` →
+ * `reconcile_overlap`). They work on the ticket's EXISTING branch/PR, so the
+ * executor reuses that branch instead of cutting a fresh one off base.
+ *
+ * BAPI-1152: `reconcile_overlap` is a recovery job for worktree reuse and prompt
+ * resolution, but it does NOT re-enter `/implement-ticket`: it always carries an
+ * explicit server-rendered `payload.prompt`, which wins over the synthesis in
+ * `worker-command.ts`, and `job-runner.ts` dispatches it to its own body.
  */
 export const RECOVERY_JOB_TYPES = new Set([
     "remediate",
     "ci_fix",
     "rebase",
+    "reconcile_overlap",
 ]);
 /**
  * Real headless-spawn job types (worktree + worker LLM): the first-pass
  * `implement`, the `resume` continuation (own pre-spawn protocol), the
- * `spec_review` verdict job, and the three recovery jobs. `merge` (deterministic,
+ * `spec_review` verdict job, and the recovery jobs. `merge` (deterministic,
  * no worktree/worker) and `smoke` (no-op acceptance) are intentionally EXCLUDED —
  * they have dedicated dispatch branches BEFORE the generic spawn path.
+ *
+ * BAPI-1152: `reconcile_overlap` is here because it needs a prepared, locked
+ * worktree and MAY spawn a worker — but only CONDITIONALLY. A clean merge whose
+ * local checks pass is pushed with no worker at all. It also has a dedicated
+ * dispatch branch ahead of the generic spawn path; membership here is what makes
+ * worktree preparation and `isImplementationStyleJobType` treat it as a spawn job.
  */
 export const SPAWN_JOB_TYPES = new Set([
     "implement",
@@ -40,6 +53,7 @@ export const SPAWN_JOB_TYPES = new Set([
     "remediate",
     "ci_fix",
     "rebase",
+    "reconcile_overlap",
 ]);
 /** True only for the exact lowercase recovery job types. */
 export function isRecoveryJobType(jobType) {
@@ -52,8 +66,10 @@ export function isSpawnJobType(jobType) {
 /**
  * Implementation-style spawn jobs (BAPI-551): every spawn job type expected to
  * end with a pushed origin branch or an opened PR — `implement`, `resume`, and
- * the recovery jobs. Excludes `spec_review`, the one spawn type that is a
- * verdict job (it produces `.conductor/result.json` instead of a branch/PR).
+ * the recovery jobs (`reconcile_overlap` included: when it pushes, finalization
+ * verifies the push against origin). Excludes `spec_review`, the one spawn type
+ * that is a verdict job (it produces `.conductor/result.json` instead of a
+ * branch/PR).
  */
 export function isImplementationStyleJobType(jobType) {
     return isSpawnJobType(jobType) && jobType !== "spec_review";