@bridge_gpt/mcp-server 0.2.59 → 0.2.62

package/build/executor/ci-rerun-job.js

@@ -0,0 +1,269 @@
+/**
+ * Deterministic `ci_rerun` executor job (BAPI-1160).
+ *
+ * Re-runs ONE failed workflow run whose failure the SERVER already proved to be
+ * infrastructure rather than code. It has no worktree, no branch, no prompt, and
+ * no worker: it validates a server-authored payload, invokes
+ * `gh run rerun --failed <run_id> --repo <owner/repo>` through the executor's
+ * ambient `gh`, polls the run under a bounded deadline, and reports a FACT
+ * ENVELOPE.
+ *
+ * Three properties are load-bearing, and each exists because its absence caused
+ * or would cause a real failure:
+ *
+ * 1. **No transition authority (R14 rule 3).** The envelope carries a run id, a
+ *    conductor attempt, a lane, an observed conclusion, and optionally the
+ *    provider's own run-attempt counter. It carries NO verdict, gate name, or
+ *    requested transition, and the backend model is `extra="forbid"` so one
+ *    cannot be smuggled in. Successful actuation is not a CI verdict: the
+ *    ordinary CI observer must independently re-observe the current head before
+ *    the `ci` gate may move, exactly as it would had a human re-run the lane.
+ *
+ * 2. **The claude-review workflow is never re-run.** That workflow joins a
+ *    per-PR concurrency group with `cancel-in-progress: true`, so re-running it
+ *    could CANCEL a legitimately in-flight review of a NEWER head. The rendered
+ *    workflow is pinned never to contain `gh run rerun` for this reason; this
+ *    job enforces the other half, refusing any payload or looked-up run that
+ *    identifies it — BEFORE any subprocess is invoked.
+ *
+ * 3. **Ambient `gh` authentication only.** The Bridge GitHub App is
+ *    `contents: read` and gains no `actions: write` for this feature. The re-run
+ *    is actuated by the executor machine's own `gh`, so no token, credential
+ *    bundle, or environment credential is injected, added to argv, or returned.
+ *
+ * Diagnostics go to `console.error` only. MCP stdout is a protocol channel and
+ * writing child output to it corrupts the session.
+ */
+import { createProductionEpicIntegrationGhRunner, } from "../epic-integration-pr.js";
+import { CLAUDE_REVIEW_WORKFLOW_RELPATH } from "../claude-review-workflow-drift.js";
+/** Machine-readable, sanitized failure kinds for a refused or failed re-run. */
+export const CI_RERUN_REFUSED = "CiRerunRefused";
+export const CI_RERUN_FAILED = "CiRerunFailed";
+/** Bounded deadline for the post-rerun poll. */
+export const CI_RERUN_POLL_DEADLINE_MS = 3 * 60 * 1000;
+/** Interval between bounded poll reads. */
+export const CI_RERUN_POLL_INTERVAL_MS = 10 * 1000;
+/** Per-`gh`-invocation timeout. */
+export const CI_RERUN_GH_TIMEOUT_MS = 60 * 1000;
+const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+const CLAUDE_REVIEW_WORKFLOW_BASENAME = CLAUDE_REVIEW_WORKFLOW_RELPATH.split("/").pop() ?? "claude-review.yml";
+/**
+ * True when a workflow identity names the claude-review workflow.
+ *
+ * Matches on the workflow file BASENAME and on the conventional display name, so
+ * a `path` (`.github/workflows/claude-review.yml`) and a `name`
+ * (`claude-review`) are both recognized. Deliberately permissive in the REFUSING
+ * direction: a false positive costs one un-actuated re-run, while a false
+ * negative could cancel a real review of a newer head.
+ */
+export function identifiesClaudeReviewWorkflow(identity) {
+    if (typeof identity !== "string")
+        return false;
+    const normalized = identity.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    return (normalized.endsWith(CLAUDE_REVIEW_WORKFLOW_BASENAME.toLowerCase()) ||
+        normalized.includes("claude-review") ||
+        normalized.includes("claude review"));
+}
+/**
+ * Validate a raw server payload into typed fields, SYNCHRONOUSLY and before any
+ * subprocess is invoked.
+ *
+ * Fails closed on every unusable shape. A job that cannot prove what it is about
+ * to re-run must not run `gh` and then discover the problem — that is how a
+ * malformed payload becomes a re-run of the wrong workflow.
+ */
+export function parseCiRerunPayload(payload) {
+    const refuse = (reason) => ({ ok: false, failure: { errorKind: CI_RERUN_REFUSED, reason } });
+    if (typeof payload !== "object" || payload === null) {
+        return refuse("payload_not_an_object");
+    }
+    const raw = payload;
+    const repoFullName = raw.repo_full_name;
+    if (typeof repoFullName !== "string" || !OWNER_REPO_RE.test(repoFullName.trim())) {
+        return refuse("repo_full_name_invalid");
+    }
+    const workflowRunId = raw.workflow_run_id;
+    if (typeof workflowRunId !== "number" ||
+        !Number.isInteger(workflowRunId) ||
+        workflowRunId <= 0) {
+        return refuse("workflow_run_id_invalid");
+    }
+    const lane = raw.required_check_lane;
+    if (typeof lane !== "string" || !lane.trim()) {
+        return refuse("required_check_lane_missing");
+    }
+    const attempt = raw.conductor_infra_attempt;
+    if (typeof attempt !== "number" || !Number.isInteger(attempt) || attempt <= 0) {
+        return refuse("conductor_infra_attempt_invalid");
+    }
+    const identityRaw = raw.workflow_identity;
+    const workflowIdentity = typeof identityRaw === "string" && identityRaw.trim() ? identityRaw.trim() : null;
+    // The review-workflow refusal, evaluated on the SERVER-SUPPLIED identity and
+    // on the lane name, before any subprocess exists.
+    if (identifiesClaudeReviewWorkflow(workflowIdentity) ||
+        identifiesClaudeReviewWorkflow(lane)) {
+        return refuse("claude_review_workflow_refused");
+    }
+    return {
+        ok: true,
+        fields: {
+            repoFullName: repoFullName.trim().toLowerCase(),
+            workflowRunId,
+            requiredCheckLane: lane.trim(),
+            conductorInfraAttempt: attempt,
+            workflowIdentity,
+        },
+    };
+}
+function parseRunView(stdout) {
+    let decoded;
+    try {
+        decoded = JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+    if (typeof decoded !== "object" || decoded === null)
+        return null;
+    const raw = decoded;
+    const str = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+    const repo = raw.repository;
+    return {
+        name: str(raw.name),
+        path: str(raw.path) ?? str(raw.workflowName),
+        status: str(raw.status),
+        conclusion: str(raw.conclusion),
+        runAttempt: typeof raw.attempt === "number" && Number.isInteger(raw.attempt) && raw.attempt > 0
+            ? raw.attempt
+            : null,
+        repoFullName: typeof repo === "object" && repo !== null
+            ? str(repo.nameWithOwner)
+            : str(raw.repository),
+    };
+}
+const RUN_VIEW_FIELDS = "name,status,conclusion,attempt,workflowName";
+/**
+ * Run one deterministic `ci_rerun` job.
+ *
+ * Returns the fact envelope on success, or a sanitized failure. Never throws for
+ * a provider or process condition, and never returns provider text.
+ */
+export async function runCiRerunJob(payload, deps) {
+    const parsed = parseCiRerunPayload(payload);
+    if (!parsed.ok) {
+        console.error(`[ci_rerun] payload refused: ${parsed.failure.reason}`);
+        return parsed;
+    }
+    const fields = parsed.fields;
+    const gh = deps.gh;
+    const now = deps.now ?? (() => Date.now());
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const refuse = (reason) => {
+        console.error(`[ci_rerun] refused: ${reason}`);
+        return { ok: false, failure: { errorKind: CI_RERUN_REFUSED, reason } };
+    };
+    // A CONDITIONAL lookup. It is issued only when the server supplied no workflow
+    // identity, because then nothing yet proves the run is not the review
+    // workflow. When the server DID supply one, it was already checked above and a
+    // second read would buy nothing.
+    let view = null;
+    if (fields.workflowIdentity === null) {
+        const lookup = await gh([
+            "run",
+            "view",
+            String(fields.workflowRunId),
+            "--repo",
+            fields.repoFullName,
+            "--json",
+            RUN_VIEW_FIELDS,
+        ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+        if (lookup.exitCode !== 0) {
+            return refuse("run_lookup_failed");
+        }
+        view = parseRunView(lookup.stdout);
+        if (view === null) {
+            return refuse("run_lookup_unreadable");
+        }
+        if (identifiesClaudeReviewWorkflow(view.name) ||
+            identifiesClaudeReviewWorkflow(view.path)) {
+            return refuse("claude_review_workflow_refused");
+        }
+        if (view.repoFullName !== null &&
+            view.repoFullName.toLowerCase() !== fields.repoFullName) {
+            return refuse("run_repository_mismatch");
+        }
+    }
+    // The actuation. An ARGUMENT ARRAY with `shell: false` (the injected runner's
+    // contract), so no value here is ever interpolated into a command line. No
+    // token, credential, or environment addition: `gh` uses the executor
+    // machine's ambient authentication and nothing else.
+    const rerun = await gh([
+        "run",
+        "rerun",
+        "--failed",
+        String(fields.workflowRunId),
+        "--repo",
+        fields.repoFullName,
+    ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+    if (rerun.exitCode !== 0) {
+        // The reserved infrastructure attempt stays CONSUMED. A re-run that the
+        // provider refused is a spent attempt, not a free retry: treating it as free
+        // would let a permanently refusing provider buy unbounded jobs.
+        console.error(`[ci_rerun] rerun invocation failed (exit=${rerun.exitCode ?? "null"}` +
+            `${rerun.timedOut ? ", timed out" : ""})`);
+        return {
+            ok: false,
+            failure: {
+                errorKind: CI_RERUN_FAILED,
+                reason: rerun.timedOut ? "rerun_timed_out" : "rerun_invocation_failed",
+            },
+        };
+    }
+    // Bounded poll for the conclusion. An expired deadline is a REPORTABLE
+    // outcome, not a failure: the re-run was actuated, the attempt was spent, and
+    // the server re-observes the head on its own schedule either way.
+    const deadline = now() + CI_RERUN_POLL_DEADLINE_MS;
+    let observedConclusion = null;
+    let providerRunAttempt = view?.runAttempt ?? null;
+    while (now() < deadline) {
+        await sleep(CI_RERUN_POLL_INTERVAL_MS);
+        const poll = await gh([
+            "run",
+            "view",
+            String(fields.workflowRunId),
+            "--repo",
+            fields.repoFullName,
+            "--json",
+            RUN_VIEW_FIELDS,
+        ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+        if (poll.exitCode !== 0)
+            continue;
+        const polled = parseRunView(poll.stdout);
+        if (polled === null)
+            continue;
+        if (polled.runAttempt !== null)
+            providerRunAttempt = polled.runAttempt;
+        if (polled.status === "completed") {
+            observedConclusion = polled.conclusion;
+            break;
+        }
+    }
+    const result = {
+        run_id: fields.workflowRunId,
+        conductor_attempt: fields.conductorInfraAttempt,
+        lane: fields.requiredCheckLane,
+        observed_conclusion: observedConclusion,
+    };
+    if (providerRunAttempt !== null) {
+        result.provider_run_attempt = providerRunAttempt;
+    }
+    console.error(`[ci_rerun] run=${fields.workflowRunId} attempt=${fields.conductorInfraAttempt} ` +
+        `conclusion=${observedConclusion ?? "pending"}`);
+    return { ok: true, result };
+}
+/** Production dependency bundle: the existing bounded `execFile`-based runner. */
+export function createProductionCiRerunDeps() {
+    return { gh: createProductionEpicIntegrationGhRunner() };
+}

package/build/executor/cli.js

@@ -13,8 +13,10 @@ import { resolveStartTicketsRepoName } from "../start-tickets-repo.js";
 import { DEFAULT_EXECUTOR_AGENT_ID } from "./agent-identity.js";
 import { executorEpicRunIdRefusal, isValidExecutorEpicRunId, validateExecutorClaimScope, } from "./claim-scope.js";
 import { createDefaultExecutorDeps } from "./deps.js";
+import { scrubExecutorProcessGithubCredentials } from "./env.js";
 import { resolveBaseUrl, resolveExecutorApiAccess, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
 import { createExecutorHttpClient } from "./http-client.js";
+import { createIntegrationActionHttpClient, } from "./integration-job.js";
 import { startExecutorSleepAssertion } from "./platform.js";
 import { runExecutor } from "./runner.js";
 import { runExecutorWatchCli } from "./watch-cli.js";
@@ -78,6 +80,7 @@ export function parseExecutorArgs(argv, context) {
     const repos = [];
     const epicRunIds = [];
     let repoWide = false;
+    let scrubInheritedGithubCredentials = false;
     let executorId;
     let maxConcurrent = DEFAULT_MAX_CONCURRENT;
     let once = false;
@@ -123,6 +126,9 @@ export function parseExecutorArgs(argv, context) {
         else if (arg === "--repo-wide") {
             repoWide = true;
         }
+        else if (arg === "--scrub-inherited-github-credentials") {
+            scrubInheritedGithubCredentials = true;
+        }
         else if (arg === "--executor-id") {
             executorId = argv[++i];
             if (!executorId)
@@ -231,6 +237,9 @@ export function parseExecutorArgs(argv, context) {
         // BAPI-1026 (R54) — same "truly absent, never a falsy placeholder"
         // discipline: `repoWide` is either `true` or the key is missing.
         ...(repoWide ? { repoWide: true } : {}),
+        // BAPI-1137: absent unless explicitly requested, so an ordinary executor's
+        // options object is byte-for-byte what it was before this slice.
+        ...(scrubInheritedGithubCredentials ? { scrubInheritedGithubCredentials: true } : {}),
     };
     return { kind: "ok", options };
 }
@@ -290,6 +299,29 @@ export async function runExecutorCli(argv, overrides = {}) {
         return 1;
     }
     const options = parsed.options;
+    // BAPI-1137 (R-4) — scrub inherited GitHub write variables, when this process
+    // was asked to. This is the earliest point the request is KNOWN, and it is
+    // still ahead of everything that could observe or forward the credential:
+    // base-URL resolution, Bridge credential resolution, the HTTP client,
+    // preflight, worker spawn, and even the claim-scope status line below.
+    //
+    // OPT-IN, and that is the load-bearing part. The executor's own `merge` job
+    // reaches `gh` through this very object (`deps.env` is `process.env`, which
+    // `buildDefaultMergeLocalDeps` hands to `local-merge.ts`'s `ghEnv`), and a
+    // token in the environment is a supported `gh` auth mechanism. An
+    // unconditional scrub would therefore break `merge_execution_mode: local` on
+    // any host whose operator started the executor from a shell exporting
+    // `GH_TOKEN` — a working merge turned into `local_gh_unauthenticated`. The
+    // durable host sets the flag in its generated unit because it holds no
+    // standing GitHub write credential by design and its merges leave the host.
+    //
+    // `process.env` deliberately, not `deps.env`: the deps bundle may be a test
+    // fake, while the thing children inherit is the real process environment.
+    // Values are never read — only key names are matched — so nothing here can
+    // log or leak what it deleted.
+    if (options.scrubInheritedGithubCredentials === true) {
+        scrubExecutorProcessGithubCredentials(process.env);
+    }
     // BAPI-794/BAPI-1026 — startup diagnostics: a bounded MODE label and, when
     // scoped, only the COUNT of runs. Never credentials, job payloads, command
     // arguments — and, since BAPI-1026, never the run IDs either, matching the
@@ -366,8 +398,16 @@ export async function runExecutorCli(argv, overrides = {}) {
         clearTimer: deps.clearTimer,
         errorLog,
     });
+    const createIntegrationClient = overrides.createIntegrationClient ?? createIntegrationActionHttpClient;
     const runnerSeams = {
         onSignal: overrides.onSignal ?? defaultSignalRegistrar,
+        integrationActions: createIntegrationClient({
+            baseUrl,
+            apiKey: apiKeyByRepo[options.repoName],
+            apiKeyByRepo,
+            mcpVersion: VERSION,
+            fetch: deps.fetch,
+        }),
     };
     try {
         return await run(runtimeOptions, deps, httpClient, runnerSeams);

package/build/executor/credentials.js

@@ -5,8 +5,19 @@
  * through the shared credential store (`resolveBapiCredentials`) — never by
  * reading worktree-local MCP config, and never leaking secret values into
  * diagnostics/results.
+ *
+ * BAPI-1137 (R-4) leaves that lookup exactly as it was — parent environment
+ * first, then the user-scoped `bapi:<repo>` store — and adds nothing beside it.
+ * This module resolves ONE credential for ONE purpose: authenticating the
+ * executor's own Bridge calls. It gains no GitHub bundle, no GitHub registration
+ * field, no GitHub CLI argument, and no GitHub-derived diagnostic value, which is
+ * what lets a durable host assert it holds no standing GitHub write credential.
+ * `CLAUDE_CODE_OAUTH_TOKEN` is not part of that assertion either way: it is
+ * host-local worker authentication the operator manages independently, Bridge
+ * never resolves or stores it, and `ANTHROPIC_API_KEY` remains absolutely denied
+ * to a worker (`executor/env.ts`).
  */
-import { resolveBapiCredentials } from "../credential-store.js";
+import { readStoredBinding, resolveBapiCredentials } from "../credential-store.js";
 import { normalizeBaseUrlCandidate } from "../base-url.js";
 /**
  * The documented production Bridge API base URL — the value an operator pastes
@@ -68,6 +79,22 @@ export async function resolveExecutorApiAccess(repoName, deps, explicitBaseUrl)
             error: `could not resolve Bridge API credentials for repo '${trimmed}' (${result.kind})`,
         };
     }
+    // BAPI-1260: a stored key that guided setup approved for ONE endpoint is never
+    // sent to another. A restarted executor re-reads the binding here, so a unit
+    // whose --base-url drifted from the approved target refuses before its first
+    // authenticated request. An unbound (legacy) entry keeps today's behavior —
+    // the explicit-target requirement above still applies to it.
+    if (result.credentials.source === "file") {
+        const bound = await readStoredBinding(`bapi:${trimmed}`, storeDeps);
+        if (bound !== null && bound !== url.baseUrl) {
+            return {
+                ok: false,
+                error: `the stored credential for repo '${trimmed}' is approved for a different Bridge API ` +
+                    "endpoint than this executor's base URL; it was not sent. Re-run guided setup " +
+                    "(install conductor) to re-bind it, or correct --base-url.",
+            };
+        }
+    }
     return {
         ok: true,
         apiKey: result.credentials.apiKey,

package/build/executor/env.js

@@ -170,6 +170,66 @@ export const EXPLICIT_DENY_KEYS = [
     // the allowlist.
     ...WORKER_SENTINEL_DATABASE_ENV_KEYS,
 ];
+// ---------------------------------------------------------------------------
+// Executor-PROCESS GitHub credential deny-list (BAPI-1137, R-4)
+//
+// Everything above this line governs what reaches a spawned WORKER. This block
+// governs the executor process itself, and it exists because the worker
+// allowlist cannot reach far enough: a manager-level environment injection — a
+// `launchctl setenv`, a systemd drop-in, a `~/.zprofile` that ran before the
+// operator started the executor by hand — puts a GitHub write token in the
+// executor's own environment, where a subprocess that builds its own environment
+// (or any future code path that reads one) could still find it.
+//
+// The durable-host claim is that the host holds NO STANDING GitHub write
+// credential. A unit that declares none (see `service-unit.ts`) and a process
+// that scrubs any it inherited are the two halves of that claim; without the
+// second, the first only proves the token did not come from the file Bridge
+// generated.
+// ---------------------------------------------------------------------------
+/**
+ * The GitHub write-credential variable names the executor process refuses to
+ * carry. Exactly the two names this repository's environment-safety conventions
+ * already recognize (`EXPLICIT_DENY_KEYS` above denies the same pair for a
+ * worker), so there is ONE vocabulary for "a GitHub write credential" rather
+ * than a second, drifting list.
+ */
+export const EXECUTOR_PROCESS_GITHUB_CREDENTIAL_DENY_KEYS = [
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+];
+/**
+ * Delete every prohibited GitHub credential variable from the executor's own
+ * environment, and report only HOW MANY were removed.
+ *
+ * Three properties are load-bearing and are what the return type is shaped
+ * around:
+ *
+ *  - **Names are compared case-insensitively.** `GH_TOKEN`, `gh_token`, and
+ *    `Gh_Token` are the same variable to a shell on a case-preserving platform,
+ *    and a scrubber that matched only the canonical spelling would leave the
+ *    other two in place.
+ *  - **Values are never read.** Nothing here dereferences a prohibited key
+ *    before deleting it, so no credential value can be logged, returned,
+ *    compared, or classified — not even as "looks like a PAT". A count is the
+ *    most a caller can learn.
+ *  - **It mutates in place.** The executor spawns children that inherit
+ *    `process.env`; returning a filtered COPY would leave the real environment
+ *    untouched and the guarantee imaginary.
+ */
+export function scrubExecutorProcessGithubCredentials(env = process.env) {
+    const prohibited = new Set(EXECUTOR_PROCESS_GITHUB_CREDENTIAL_DENY_KEYS.map((key) => key.toUpperCase()));
+    let removedCount = 0;
+    // A snapshot of the key names, because deleting while iterating the live
+    // object is exactly the kind of thing that silently skips an entry.
+    for (const key of Object.keys(env)) {
+        if (!prohibited.has(key.toUpperCase()))
+            continue;
+        delete env[key];
+        removedCount++;
+    }
+    return { removedCount };
+}
 /**
  * True only when `key` is a safe, allowlisted operational key. Exported so the
  * allowlist is locally auditable/testable. A key is allowed iff it is in the

package/build/executor/http-client.js

@@ -9,6 +9,30 @@
  */
 import { RECONCILER_LIVENESS_VALUES } from "./types.js";
 import { readEpicRunCompletionState, } from "../conductor/bridge-api-client.js";
+/** BAPI-1258 — the server's stable `error_code` for refused capacity evidence. */
+export const UNSUPPORTED_TERMINAL_CAPACITY_ERROR_CODE = "UNSUPPORTED_TERMINAL_CAPACITY";
+/**
+ * Whether a `/fail` response refused the capacity evidence it carried: a 422
+ * (malformed envelope) or a 409 whose `error_code` is the stable unsupported
+ * code. A 409 `STALE_CLAIM` is NOT a refusal — the claim is gone, and resending
+ * cannot help. The body is inspected only for that one closed token.
+ */
+function isCapacityEvidenceRefusal(status, bodyText) {
+    if (status === 422)
+        return true;
+    if (status !== 409)
+        return false;
+    try {
+        const parsed = JSON.parse(bodyText);
+        const detail = parsed && typeof parsed === "object" ? parsed.detail : undefined;
+        return (!!detail &&
+            typeof detail === "object" &&
+            detail.error_code === UNSUPPORTED_TERMINAL_CAPACITY_ERROR_CODE);
+    }
+    catch {
+        return false;
+    }
+}
 /** Bound a server-provided diagnostic snippet included in error strings. */
 function boundedDetail(text) {
     const trimmed = (text ?? "").trim();
@@ -269,7 +293,7 @@ export function createExecutorHttpClient(config) {
             };
             return mutate(`/${job.id}/complete`, body, true, job.repo_name);
         },
-        fail(job, failure) {
+        async fail(job, failure) {
             const body = {
                 repo_name: job.repo_name,
                 claim_token: job.claim_token,
@@ -280,6 +304,26 @@ export function createExecutorHttpClient(config) {
                 last_commit_sha: failure.last_commit_sha,
                 telemetry: failure.telemetry,
             };
+            if (failure.capacity_evidence === undefined) {
+                return mutate(`/${job.id}/fail`, body, false, job.repo_name);
+            }
+            // BAPI-1258 — send the evidence once. If the server refuses it (unsupported
+            // protocol, or a malformed envelope), re-send the SAME ordinary failure
+            // without it, exactly once, so the job still reaches a terminal state and
+            // the original error kind/classification are preserved. Refused evidence
+            // never becomes an automatic recovery.
+            let first;
+            try {
+                first = await post(`/${job.id}/fail`, { ...body, capacity_evidence: failure.capacity_evidence }, job.repo_name);
+            }
+            catch {
+                return { outcome: "fatal_http_error" };
+            }
+            if (!isCapacityEvidenceRefusal(first.status, first.text)) {
+                return mapMutationResponse(first.status, first.text, false);
+            }
+            (config.warn ?? ((message) => console.error(message)))(`executor: server refused terminal capacity evidence for job ${job.id} ` +
+                `(HTTP ${first.status}); reporting an ordinary failure without automatic recovery.`);
             return mutate(`/${job.id}/fail`, body, false, job.repo_name);
         },
         /**

package/build/executor/index.js

@@ -7,16 +7,33 @@
  */
 export { runExecutorCli, getExecutorUsage, parseExecutorArgs } from "./cli.js";
 export { runExecutor } from "./runner.js";
-// Persistent-service packaging (BAPI-688). The CLI entry plus the PURE helpers
-// doctor needs to enumerate and inspect generated units — doctor must share this
+// Persistent-service packaging (BAPI-688), the file-generation leg of
+// durable-host mode (BAPI-1137). The CLI entry plus the PURE helpers doctor
+// needs to enumerate and inspect generated units — doctor must share this
 // module's naming/format contract instead of maintaining a second parser.
+//
+// This group grants GENERATION only. It confers no lifecycle capability, which
+// is why the lifecycle exports stay in their own group below: a caller that
+// imports the generator still cannot start a persistent daemon.
 export { runExecutorInstallServiceCli, getExecutorInstallServiceUsage, buildExecutorServiceArtifact, writeExecutorServiceArtifact, inspectExecutorServiceArtifact, executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, 
 // Programmatic, lifecycle-free plan/write seam (BAPI-779) — how
 // `install conductor` reaches the generator without shelling out to the CLI.
-planExecutorServiceInstall, writeExecutorServicePlan, resolvePackagedExecutorInvocation, EXECUTOR_SERVICE_BASE_URL_ENV, EXECUTOR_SERVICE_PATH_ENV, } from "./service-unit.js";
+planExecutorServiceInstall, writeExecutorServicePlan, resolvePackagedExecutorInvocation, 
+// Durable-host credential declaration contract (BAPI-1137, R-4). doctor needs
+// the shared inspector and the postcondition helper so its diagnostic and the
+// generator's write check are literally the same rule; exporting the allowlist
+// and the argument-contract predicate keeps the contract locally auditable
+// rather than discoverable only by reading the renderer.
+inspectExecutorServiceCredentialDeclaration, assertExecutorServiceCredentialPostcondition, checkExecutorServiceArgumentContract, isAllowedExecutorServiceUnitEnvKey, executorLaunchdLogPathsForId, EXECUTOR_SERVICE_BASE_URL_ENV, EXECUTOR_SERVICE_PATH_ENV, EXECUTOR_SERVICE_UNIT_ENV_ALLOWLIST, EXECUTOR_SERVICE_UNIT_FILE_MODE, } from "./service-unit.js";
 // Consented lifecycle (BAPI-779, R-1). Deliberately a SEPARATE module from the
 // generator above: importing the writer never grants the ability to start a
 // persistent daemon.
-export { buildExecutorServiceStartPlan, buildExecutorServiceStateProbe, formatExecutorServiceStartFailure, inspectExecutorServiceState, startExecutorService, } from "./service-lifecycle.js";
+export { buildExecutorServiceStartPlan, buildExecutorServiceStateProbe, formatExecutorServiceStartFailure, inspectExecutorServiceState, startExecutorService, 
+// Durability prerequisites (BAPI-1137). Exported SEPARATELY from the
+// generation group above, and alongside — not inside — the start group: these
+// are strictly read-only probes, so importing them grants the ability to ASK
+// whether this host survives logout, never the ability to change it. Nothing
+// here runs `loginctl enable-linger`.
+buildExecutorServiceDurabilityProbe, inspectExecutorServiceDurability, EXECUTOR_LINGER_REMEDIATION, EXECUTOR_MACOS_SESSION_REMEDIATION, } from "./service-lifecycle.js";
 export { collectExecutorInstallPreflight, formatExecutorInstallPreflight, EXECUTOR_INSTALL_REQUIRED_TOOLS, EXECUTOR_INSTALL_CLAUDE_LOGIN_REMEDIATION, } from "./install-preflight.js";
 export { runExecutorWatchCli, getExecutorWatchUsage, parseExecutorWatchArgs, } from "./watch-cli.js";