@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/executor/reconcile-overlap-job.js

@@ -17,8 +17,6 @@
  *   worker-completed   ONLY when the merge conflicted or the checks were red:
  *                      exactly one worker, holding both tickets' intents, edits
  *                      the working tree — it never commits and never pushes;
- *   governance-scanned the candidate is compared against the governance regions
- *                      the server read at the INPUT epic head;
  *   pushed             one fast-forward push, leased on the recorded child head;
  *   cleaned            every exit that does not push resets the worktree to the
  *                      recorded child head.
@@ -32,7 +30,7 @@
  * The job returns FACTS, never a verdict (R14 rule 3): the input heads, the
  * classification, whether a worker ran, every edited path and why, the local
  * checks observed, and either the pushed head or the reason nothing was pushed —
- * a governance fact or an observed moved head. The server verifies all of it
+ * an observed moved head. The server verifies all of it
  * against the provider (`reconcile_overlap_completion_contract.py`).
  *
  * Runtime prerequisite: the push runs in the executor's OWN process under the
@@ -47,7 +45,6 @@ import { allRequiredChecksGreen } from "../conductor/local-merge.js";
 import { buildExecutorBaseWorkerEnv } from "./env.js";
 import { ReconcileOverlapBranchMismatch, ReconcileOverlapConflictsUnresolved, ReconcileOverlapMergeFailed, ReconcileOverlapNothingToMerge, ReconcileOverlapPayload as ReconcileOverlapPayloadInvalid, ReconcileOverlapPushRejected, ReconcileOverlapPushUnauthorized, ReconcileOverlapTopologyRefused, ReconcileOverlapVerificationRed, ReconcileOverlapWorkerRewroteHistory, } from "./job-errors.js";
 import { classifyMergeTree } from "./merge-tree-classifier.js";
-import { scanGovernanceRegions } from "./reconcile-overlap-governance.js";
 import { RECONCILE_OVERLAP_PAYLOAD_SCHEMA_VERSION, } from "./reconcile-overlap-types.js";
 import { validateWorkerFinalization } from "./worker-finalization.js";
 export const RECONCILE_OVERLAP_JOB_TYPE = "reconcile_overlap";
@@ -65,7 +62,6 @@ const MAX_ARGV = 32;
 const MAX_ARG_CHARS = 1024;
 const MAX_COMMAND_TIMEOUT_SECONDS = 30 * 60;
 const MAX_CHANGED_FILES = 1000;
-const MAX_GOVERNANCE_REGIONS = 64;
 const REF_NAME_MAX_CHARS = 255;
 const CONFLICT_REPORT_DIR = ".conductor/";
 /** The executor's per-worktree artifact directory, never part of a candidate. */
@@ -92,8 +88,6 @@ const WRAPPER_STAGE_EXCLUDES = [
     ":(exclude).claude/settings.local.json",
 ];
 const SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
-const TAG_RE = /^[A-Z][A-Z0-9_]{0,31}$/;
-const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
 const FAILED_CHECK_CONCLUSIONS = new Set([
     "failure",
     "cancelled",
@@ -194,54 +188,6 @@ function ticketContext(value, field) {
         verificationCommands: verificationCommands(entry.verification_commands, `${field}.verification_commands`),
     };
 }
-function governanceRegions(value) {
-    if (!Array.isArray(value))
-        throw new PayloadError("governance.regions must be a list");
-    if (value.length > MAX_GOVERNANCE_REGIONS)
-        throw new PayloadError("governance.regions exceeds its bound");
-    return value.map((raw, index) => {
-        const entry = asRecord(raw, `governance.regions[${index}]`);
-        const tag = typeof entry.tag === "string" ? entry.tag : "";
-        const regionPath = normalizeRepoRelativePath(entry.path);
-        const begin = entry.begin_marker;
-        const end = entry.end_marker;
-        const sha = entry.content_sha256;
-        if (!TAG_RE.test(tag) ||
-            regionPath === null ||
-            typeof begin !== "string" ||
-            typeof end !== "string" ||
-            !begin.includes(tag) ||
-            !end.includes(tag) ||
-            typeof sha !== "string" ||
-            !SHA256_HEX_RE.test(sha) ||
-            !Number.isInteger(entry.begin_line) ||
-            !Number.isInteger(entry.end_line)) {
-            throw new PayloadError(`governance.regions[${index}] is malformed`);
-        }
-        return {
-            tag,
-            path: regionPath,
-            beginLine: entry.begin_line,
-            endLine: entry.end_line,
-            beginMarker: begin,
-            endMarker: end,
-            contentSha256: sha,
-        };
-    });
-}
-function governanceFindings(value) {
-    if (value === undefined || value === null)
-        return [];
-    if (!Array.isArray(value))
-        throw new PayloadError("governance.findings must be a list");
-    return value.map((raw, index) => {
-        const entry = asRecord(raw, `governance.findings[${index}]`);
-        const findingPath = normalizeRepoRelativePath(entry.path);
-        if (findingPath === null)
-            throw new PayloadError(`governance.findings[${index}].path is unsafe`);
-        return { path: findingPath, reason: typeof entry.reason === "string" ? entry.reason.slice(0, 300) : "" };
-    });
-}
 /**
  * Validate the claimed job's payload. Pure — no subprocess, no filesystem. A
  * payload missing either input SHA fails here, so the job never infers a head.
@@ -270,7 +216,9 @@ export function validateReconcileOverlapPayload(job) {
             .map((c) => c.trim());
         const child = ticketContext(payload.child, "payload.child");
         const peer = payload.peer === null || payload.peer === undefined ? null : ticketContext(payload.peer, "payload.peer");
-        const governanceRaw = asRecord(payload.governance, "payload.governance");
+        // BAPI-1215 — `payload.governance` is retired. A server that predates the
+        // retirement still sends it: it is accepted when present and never read, so
+        // this executor consumes both payload shapes at schema version 1.
         const conflictReportPath = normalizeRepoRelativePath(payload.conflict_report_path);
         if (conflictReportPath === null || !conflictReportPath.startsWith(CONFLICT_REPORT_DIR)) {
             throw new PayloadError("payload.conflict_report_path must name a file under .conductor/");
@@ -295,11 +243,6 @@ export function validateReconcileOverlapPayload(job) {
                 requiredChecks,
                 child,
                 peer,
-                governance: {
-                    regions: governanceRegions(governanceRaw.regions ?? []),
-                    findings: governanceFindings(governanceRaw.findings),
-                    scannedPaths: pathList(governanceRaw.scanned_paths ?? [], "governance.scanned_paths", MAX_CHANGED_FILES * 2),
-                },
                 declaredTouchedFilesUnion: pathList(payload.declared_touched_files_union ?? [], "payload.declared_touched_files_union", MAX_CHANGED_FILES * 4),
                 conflictReportPath,
                 prompt,
@@ -566,55 +509,6 @@ export function createReconcileOverlapDriver(job, payload, seams) {
         }
         return runs;
     };
-    /** Paths the candidate changes relative to the input epic head. */
-    const changedPathsAgainstEpic = async (ctx, candidate) => {
-        const r = await git(ctx, ["diff", "--name-only", "-z", "--no-renames", payload.requiredEpicSha, candidate]);
-        if (r.exitCode !== 0)
-            return null;
-        return r.stdout
-            .split("\0")
-            .map((p) => normalizeRepoRelativePath(p))
-            .filter((p) => p !== null);
-    };
-    const readTreeFile = async (ctx, treeish, filePath) => {
-        const r = await git(ctx, ["cat-file", "blob", `${treeish}:${filePath}`]);
-        if (r.exitCode !== 0) {
-            const exists = await git(ctx, ["cat-file", "-e", `${treeish}:${filePath}`]);
-            return exists.exitCode === 0 ? { kind: "unreadable" } : { kind: "absent" };
-        }
-        return r.stdout.includes("\0") ? { kind: "binary" } : { kind: "text", text: r.stdout };
-    };
-    /** Governance scan of a candidate tree or commit against the input epic head. */
-    const scanCandidate = async (ctx, candidate) => {
-        const changed = await changedPathsAgainstEpic(ctx, candidate);
-        if (changed === null)
-            return "unprovable";
-        return scanGovernanceRegions({
-            snapshot: payload.governance,
-            changedPaths: changed,
-            readCandidate: (p) => readTreeFile(ctx, candidate, p),
-            readInput: (p) => readTreeFile(ctx, payload.requiredEpicSha, p),
-        });
-    };
-    const unprovableFact = () => ({
-        tag: "GOVERNANCE_MARKERS_UNPROVABLE",
-        paths: [],
-        findings: [{ tag: "GOVERNANCE_MARKERS_UNPROVABLE", paths: [] }],
-        truncated: false,
-    });
-    /** `git write-tree` of the index: the candidate BEFORE a commit exists. */
-    const indexTree = async (ctx) => {
-        const r = await git(ctx, ["write-tree"]);
-        const oid = r.stdout.trim().toLowerCase();
-        return r.exitCode === 0 && SHA_RE.test(oid) ? oid : null;
-    };
-    const governanceGate = async (ctx, candidate) => {
-        const scanned = candidate === null ? "unprovable" : await scanCandidate(ctx, candidate);
-        if (scanned === null)
-            return null;
-        await resetToChildHead(ctx);
-        return complete({ governance_guard_change_required: scanned === "unprovable" ? unprovableFact() : scanned });
-    };
     const commitStaged = async (ctx, message) => {
         const r = await git(ctx, ["commit", "--no-verify", "--no-edit", "-m", message]);
         if (r.exitCode !== 0)
@@ -678,12 +572,12 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             await seams.sleep(Math.min(CI_WAIT_POLL_INTERVAL_MS, Math.max(0, ctx.remainingMs() - CI_WAIT_MARGIN_MS)));
         }
     };
-    /** Drift check, final governance scan, guarded push, finalization, CI wait. */
+    /** Drift check, guarded push, finalization, CI wait. */
     const pushFlow = async (ctx) => {
         const candidate = await revParse(ctx, "HEAD");
         if (candidate === null) {
             await resetToChildHead(ctx);
-            return fail(ReconcileOverlapTopologyRefused, "governance-scanned", "the candidate head could not be read");
+            return fail(ReconcileOverlapTopologyRefused, "pushed", "the candidate head could not be read");
         }
         // (1) Freshness: both remote heads must still be the dispatched ones. A moved
         // head is an OBSERVATION the server re-dispatches on; it is not a failure.
@@ -708,11 +602,7 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             }
             return complete({ observed_epic_head: heads.epic });
         }
-        // (2) Final governance scan of the exact tree about to be pushed.
-        const gated = await governanceGate(ctx, candidate);
-        if (gated !== null)
-            return gated;
-        // (3) The ONE push: a fast-forward of the child branch, leased on the
+        // (2) The ONE push: a fast-forward of the child branch, leased on the
         // recorded child head. Never plain --force, never a lease-less lease.
         const destination = `refs/heads/${payload.expectedBranch}`;
         const push = await git(ctx, [
@@ -741,7 +631,7 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             }
             return fail(ReconcileOverlapPushRejected, "pushed", "the remote refused the guarded push");
         }
-        // (4) Finalization runs ONCE, after the wrapper's push, against the pushed
+        // (3) Finalization runs ONCE, after the wrapper's push, against the pushed
         // head: origin must carry it and the PR must be attached at it.
         const finalize = seams.finalize ?? validateWorkerFinalization;
         const finalization = await finalize({
@@ -758,7 +648,7 @@ export function createReconcileOverlapDriver(job, payload, seams) {
         });
         if (!finalization.ok)
             return { kind: "fail", failure: finalization.failure };
-        // (5) Wait for provider checks at the pushed head, bounded by the job budget.
+        // (4) Wait for provider checks at the pushed head, bounded by the job budget.
         await waitForProviderChecks(ctx, candidate);
         return complete({ resulting_head: candidate }, candidate);
     };
@@ -835,10 +725,6 @@ export function createReconcileOverlapDriver(job, payload, seams) {
                     declaredTouchedFiles: payload.declaredTouchedFilesUnion,
                 };
             }
-            // Clean: scan the merged index BEFORE the wrapper creates the merge commit.
-            const gated = await governanceGate(ctx, await indexTree(ctx));
-            if (gated !== null)
-                return finish(gated);
             const mergeCommit = await commitStaged(ctx, `Reconcile overlap: merge ${payload.requiredEpicSha.slice(0, 12)} into ${payload.expectedBranch}`);
             if (mergeCommit === null) {
                 await resetToChildHead(ctx);
@@ -900,9 +786,6 @@ export function createReconcileOverlapDriver(job, payload, seams) {
                     await resetToChildHead(ctx);
                     return fail(ReconcileOverlapConflictsUnresolved, "worker-completed", "unmerged index entries remain");
                 }
-                const gated = await governanceGate(ctx, await indexTree(ctx));
-                if (gated !== null)
-                    return gated;
                 const mergeCommit = await commitStaged(ctx, `Reconcile overlap: merge ${payload.requiredEpicSha.slice(0, 12)} into ${payload.expectedBranch}`);
                 if (mergeCommit === null) {
                     await resetToChildHead(ctx);
@@ -913,9 +796,6 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             // Any remaining worker repair: one ordinary commit ON TOP of the merge.
             await git(ctx, ["add", "-A", "--", ".", ...WRAPPER_STAGE_EXCLUDES]);
             if (await stagedChanges(ctx)) {
-                const gated = await governanceGate(ctx, await indexTree(ctx));
-                if (gated !== null)
-                    return gated;
                 const repairPaths = await git(ctx, ["diff", "--cached", "--name-only", "-z"]);
                 const repairReason = facts.failingCommandNames.length > 0
                     ? `repair for failing check(s): ${facts.failingCommandNames.join(", ")}`
@@ -953,7 +833,7 @@ export function createReconcileOverlapDriver(job, payload, seams) {
                 !(await isAncestor(ctx, payload.childHead, candidate)) ||
                 !(await isAncestor(ctx, payload.requiredEpicSha, candidate))) {
                 await resetToChildHead(ctx);
-                return fail(ReconcileOverlapTopologyRefused, "governance-scanned", "the candidate is not a merge of the dispatched heads");
+                return fail(ReconcileOverlapTopologyRefused, "checked", "the candidate is not a merge of the dispatched heads");
             }
             return pushFlow(ctx);
         },

package/build/executor/reconcile-overlap-types.js

@@ -1,7 +1,7 @@
 /**
  * Types for the `reconcile_overlap` executor job (BAPI-1152).
  *
- * The server authors the payload (`api/library/epic_conductor/reconcile_overlap_payload.py`)
+ * The server authors the payload (`api/library/epic_implementer/reconcile_overlap_payload.py`)
  * and verifies the result (`reconcile_overlap_completion_contract.py`); these
  * interfaces are the executor's view of both. They are deliberately plain data —
  * validation lives in `reconcile-overlap-job.ts`, which refuses anything that does

package/build/executor/runner.js

@@ -64,7 +64,7 @@ export function formatDispatcherUnavailableDiagnostic(liveness) {
     return (`executor: no fresh reconciler/dispatcher heartbeat is available ` +
         `(reconciler_liveness=${liveness}); the dispatcher may not be running. ` +
         "Check DISABLE_SCHEDULER and GET /automation/health; see " +
-        "docs/claude/epic-conductor-v2-operator-runbook.md. Continuing to poll.");
+        "docs/claude/epic-implementer-v2-operator-runbook.md. Continuing to poll.");
 }
 /** The recovery diagnostic, emitted once when an absent dispatcher comes back. */
 export function formatDispatcherRecoveredDiagnostic() {

package/build/executor/service-lifecycle.js

@@ -36,6 +36,24 @@
  * The command forms address user-domain (per-user) services directly:
  * `launchctl` against `gui/<uid>/<label>` on darwin, and `systemctl --user`
  * on linux.
+ *
+ * FOUR INDEPENDENT FACTS (BAPI-1137). A durable host is described by four
+ * separate observations, and no one of them implies another:
+ *
+ *  1. **Unit-content compliance** — what the generated/on-disk unit DECLARES
+ *     (`service-unit.ts`). A perfect unit file can be sitting unloaded.
+ *  2. **Service-manager state** — what the manager is running RIGHT NOW
+ *     ({@link inspectExecutorServiceState}). The manager may still be running a
+ *     previously loaded definition rather than the current bytes on disk.
+ *  3. **Session persistence** — whether the host keeps running it once nobody is
+ *     logged in ({@link inspectExecutorServiceDurability}). An `active` service
+ *     with lingering off is active exactly until the operator logs out.
+ *  4. **Server-observed readiness** — whether BRIDGE has seen an executor claim.
+ *     Only this one can produce `executor_ready`, and rule 4 above is why:
+ *     nothing local, however green, is evidence for it.
+ *
+ * They are reported separately everywhere, and collapsing any pair of them would
+ * reintroduce exactly the dishonest-green this module is built to refuse.
  */
 import { posixShellQuote } from "../platform-escaping.js";
 /**
@@ -62,6 +80,10 @@ function renderCommand(command) {
 /**
  * Build the platform-specific start sequence.
  *
+ * UNCHANGED by BAPI-1137: start remains separately consented, one-shot, and
+ * non-retrying. The durability inspection added lower in this file is read-only
+ * and has no path to this function or to {@link startExecutorService}.
+ *
  * darwin: `launchctl bootstrap gui/<uid> <plist-path>`
  * linux:  `systemctl --user daemon-reload`, then
  *         `systemctl --user enable --now <unit-name>`
@@ -267,3 +289,117 @@ export async function inspectExecutorServiceState(target, run) {
         return { state: "inactive", probe };
     return { state: "unknown", probe };
 }
+/**
+ * The Linux remediation, verbatim and in one place so the lifecycle module, the
+ * installer, and doctor cannot print three subtly different commands.
+ */
+export const EXECUTOR_LINGER_REMEDIATION = "run `loginctl enable-linger $USER` yourself to keep this user's services running " +
+    "without an active login session (Bridge never runs it for you)";
+/**
+ * The macOS prerequisite. A LaunchAgent bootstrapped into `gui/<uid>` lives in a
+ * user-login domain, which `launchctl(1)` documents as created when the user logs
+ * in at the GUI — so it needs that login to exist, and after a reboot it needs
+ * the user to log in again (automatic login, or a human at the keyboard).
+ */
+export const EXECUTOR_MACOS_SESSION_REMEDIATION = "keep this user logged in at the GUI — a launchd LaunchAgent runs in the gui/<uid> " +
+    "login domain, so after a reboot the user must log in again (e.g. enable automatic " +
+    "login) for the executor to come back";
+/**
+ * Build the strictly read-only durability prerequisite probe for a target.
+ *
+ * linux:  `loginctl show-user <uid> --property=Linger` — a QUERY. `show-user`
+ * reads properties; it cannot enable or disable anything, which is what makes it
+ * safe to run unprompted where `enable-linger` would not be.
+ * darwin: `launchctl print gui/<uid>` — the login domain itself, not a service
+ * inside it. A zero exit means the GUI login domain exists for this uid.
+ *
+ * PURE: consults no runner, no environment, and no filesystem, so an
+ * incompletely described target is refused before anything could be executed.
+ */
+export function buildExecutorServiceDurabilityProbe(target) {
+    if (typeof target.uid !== "number" || !Number.isInteger(target.uid) || target.uid < 0) {
+        return null;
+    }
+    if (target.platform === "linux") {
+        return {
+            stage: "loginctl show-user --property=Linger",
+            executable: "loginctl",
+            args: ["show-user", String(target.uid), "--property=Linger"],
+        };
+    }
+    if (target.platform === "darwin") {
+        return {
+            stage: "launchctl print gui",
+            executable: "launchctl",
+            args: ["print", `gui/${target.uid}`],
+        };
+    }
+    return null;
+}
+/**
+ * Inspect the local session/linger durability prerequisite. STRICTLY read-only:
+ * it issues exactly one query and never enables lingering, starts a service,
+ * reloads a manager, or writes anything.
+ *
+ * Everything the runner returns beyond a recognized state token is DISCARDED —
+ * stdout past the token, stderr entirely, and any thrown value — because a
+ * service manager's output can name paths, units, and environment values that
+ * have no place in operator-facing text.
+ */
+export async function inspectExecutorServiceDurability(target, run) {
+    if (target.platform !== "darwin" && target.platform !== "linux") {
+        return { prerequisite: "not-applicable", probe: null, remediation: null };
+    }
+    const probe = buildExecutorServiceDurabilityProbe(target);
+    if (!probe)
+        return { prerequisite: "unverifiable", probe: null, remediation: null };
+    let exitCode;
+    let stdout;
+    try {
+        const result = await run(probe.executable, probe.args);
+        exitCode = typeof result?.exitCode === "number" ? result.exitCode : 1;
+        stdout = typeof result?.stdout === "string" ? result.stdout : "";
+    }
+    catch {
+        return { prerequisite: "unverifiable", probe, remediation: null };
+    }
+    if (target.platform === "darwin") {
+        // The login domain either exists for this uid or it does not; launchctl
+        // exposes no third answer here, and a non-zero exit is reported as an
+        // unavailable session rather than dressed up as a confirmed absence of
+        // durability the probe did not establish.
+        //
+        // A ZERO exit is NOT `configured`. It says the gui/<uid> domain exists at
+        // this instant — which it does whenever an operator runs `install conductor`
+        // or `doctor` from their own logged-in session — and a LaunchAgent in that
+        // domain is tied to the login, not to the machine being powered on. Calling
+        // it `configured` would let a renderer that means "survives logout" assert
+        // the opposite of what launchd guarantees, so darwin gets its own state and
+        // carries the session prerequisite as the thing to keep true.
+        if (exitCode === 0) {
+            return {
+                prerequisite: "session-bound",
+                probe,
+                remediation: EXECUTOR_MACOS_SESSION_REMEDIATION,
+            };
+        }
+        return {
+            prerequisite: "not-configured",
+            probe,
+            remediation: EXECUTOR_MACOS_SESSION_REMEDIATION,
+        };
+    }
+    if (exitCode !== 0)
+        return { prerequisite: "unverifiable", probe, remediation: null };
+    // `loginctl show-user --property=Linger` prints exactly `Linger=yes|no`. Only
+    // those two tokens are mapped; anything else is unverifiable rather than a
+    // guess derived from a format this module does not recognize.
+    const match = stdout.match(/^\s*Linger=(\S+)\s*$/m);
+    const value = match?.[1]?.toLowerCase();
+    if (value === "yes")
+        return { prerequisite: "configured", probe, remediation: null };
+    if (value === "no") {
+        return { prerequisite: "not-configured", probe, remediation: EXECUTOR_LINGER_REMEDIATION };
+    }
+    return { prerequisite: "unverifiable", probe, remediation: null };
+}