@bridge_gpt/mcp-server 0.2.53 → 0.2.55

package/build/executor/reconcile-overlap-types.js

@@ -0,0 +1,14 @@
+/**
+ * Types for the `reconcile_overlap` executor job (BAPI-1152).
+ *
+ * The server authors the payload (`api/library/epic_conductor/reconcile_overlap_payload.py`)
+ * and verifies the result (`reconcile_overlap_completion_contract.py`); these
+ * interfaces are the executor's view of both. They are deliberately plain data —
+ * validation lives in `reconcile-overlap-job.ts`, which refuses anything that does
+ * not match before a single subprocess runs.
+ *
+ * ARCHITECTURE BOUNDARY: executor-local. Imports nothing from the conductor
+ * runtime or the server-side reconciler graph.
+ */
+/** The payload schema version this executor understands. */
+export const RECONCILE_OVERLAP_PAYLOAD_SCHEMA_VERSION = 1;

package/build/executor/spawn-job-driver.js

@@ -0,0 +1 @@
+export {};

package/build/executor/types.js

@@ -17,6 +17,8 @@ export const EXECUTOR_JOB_TYPE_VALUES = [
     "ci_fix",
     "merge",
     "smoke",
+    // BAPI-1151 registered it server-side; BAPI-1152 lands the executor body.
+    "reconcile_overlap",
 ];
 /**
  * Server-authoritative completion classification (T2 `ExecutorClassification`,

package/build/executor/worker-finalization.js

@@ -56,7 +56,7 @@
  * this ticket removes. The reconciler stays the decision-maker — the executor
  * only reports the observation (R14 rule 3).
  */
-import { secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
+import { ReconcileOverlapPushUnfinalized, secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
 import { isImplementationStyleJobType } from "./job-types.js";
 /** Bounded settling re-check defaults for the authoritative origin-tip lookup. */
 const DEFAULT_ORIGIN_FINALIZATION_ATTEMPTS = 3;
@@ -361,6 +361,27 @@ function savedButUnfinalizedFailure(job, branch, originSha, workerHeadSha) {
         last_commit_sha: originSha,
     };
 }
+/**
+ * BAPI-1152: the `reconcile_overlap` counterpart of
+ * {@link savedButUnfinalizedFailure}. For that job the push is the WRAPPER's,
+ * made once and guarded by a lease on the recorded child head, and the worktree is
+ * reset to that head on every non-pushing exit. "Resume/finalize from the branch"
+ * would therefore send an operator to recover work that was deliberately
+ * discarded; what they need to know is that the guarded push did not land and
+ * which head origin actually carries.
+ */
+function reconcilePushUnfinalizedFailure(job, branch, originSha, pushedSha) {
+    const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    return {
+        error_kind: ReconcileOverlapPushUnfinalized,
+        error_message: `${label}: the reconciliation's guarded push of ${pushedSha.slice(0, 12)} did not land — ` +
+            `origin branch '${branch}' is at ${originSha.slice(0, 12)}. Nothing was lost: the ` +
+            `worktree was reset to the recorded child head, and the next reconciliation attempt ` +
+            `starts from origin's head.`,
+        classification: "crashed",
+        last_commit_sha: originSha,
+    };
+}
 /**
  * Validate that an implementation-style job's clean exit actually published its
  * work to origin AND left an attached pull request. Non-implementation-style jobs
@@ -451,7 +472,9 @@ export async function validateWorkerFinalization(input) {
     if (trimmedHeadSha && remoteSha !== trimmedHeadSha) {
         return {
             ok: false,
-            failure: savedButUnfinalizedFailure(job, trimmedBranch, remoteSha, trimmedHeadSha),
+            failure: job.job_type === "reconcile_overlap"
+                ? reconcilePushUnfinalizedFailure(job, trimmedBranch, remoteSha, trimmedHeadSha)
+                : savedButUnfinalizedFailure(job, trimmedBranch, remoteSha, trimmedHeadSha),
         };
     }
     // BAPI-862: the work is provably ON ORIGIN. That was the whole of the success

package/build/executor/worker-guard-hook.js

@@ -315,10 +315,12 @@ function isOwnBranchDestination(destination, workerBranch) {
  * `git push` — allowed ONLY when every explicit destination is the worker's own
  * branch.
  *
- * A push with no explicit destination at all is allowed: it follows the branch's
- * configured upstream, which for a conductor worker is the branch it is standing
- * on. Everything else — a tag, a deletion refspec, another branch, a destination
- * that cannot be resolved because the branch identity is missing — denies. The
+ * A worker with NO branch identity is denied every push, before anything else is
+ * considered (BAPI-1152 — the `reconcile_overlap` worker holds no remote write
+ * authority; its wrapper pushes). For a worker WITH an identity, a push with no
+ * explicit destination is allowed: it follows the branch's configured upstream,
+ * which for a conductor worker is the branch it is standing on. Everything else —
+ * a tag, a deletion refspec, another branch — denies. The
  * per-flag globs in `permissions.ts` (`--tags`, `--delete`, `refs/tags/`, ` main`,
  * `epic/`) cover the common spellings; this is the general rule underneath them.
  */
@@ -352,12 +354,18 @@ function evaluateGitPush(args, ctx) {
         }
         positional.push(token);
     }
-    // `git push` / `git push <remote>` with no refspec: the configured upstream.
-    if (positional.length <= 1)
-        return { kind: "allow" };
+    // BAPI-1152: branch identity is checked FIRST. A worker launched with no branch
+    // identity (a `reconcile_overlap` worker, which must never write to a remote)
+    // is denied EVERY push, including the refspec-less `git push` / `git push
+    // <remote>` forms below. Before this ordering those forms were allowed ahead of
+    // the branch check, so omitting the branch did not in fact deny a bare push.
     const workerBranch = ctx.workerBranch;
     if (typeof workerBranch !== "string" || workerBranch.length === 0)
         return deny;
+    // `git push` / `git push <remote>` with no refspec: the configured upstream,
+    // which for a worker with a branch identity is its own job branch.
+    if (positional.length <= 1)
+        return { kind: "allow" };
     const destinations = positional.slice(1);
     return destinations.every((d) => isOwnBranchDestination(d, workerBranch))
         ? { kind: "allow" }