@bridge_gpt/mcp-server 0.2.59 → 0.2.62

package/build/executor/job-runner.js

@@ -19,6 +19,7 @@ import os from "node:os";
 import { runHeartbeatLoop } from "./heartbeat.js";
 import { isExecutorNamedError, toExecutorFailure, secretFreeErrorMessage, MissingVerdictArtifact, PreSpawnVerification, RequiredMcpRegistration, McpSurfaceMismatch, WorkerStartupFatal, WORKER_STARTUP_FATAL_MESSAGE, formatMcpSurfaceMismatch, ClaudeNotAuthenticated, CLAUDE_NOT_AUTHENTICATED_MESSAGE, ExecutorAdapterUnavailable, ExecutorNamedError, WorktreeBusy, StaleArtifactCleanupFailed, WORKTREE_BUSY_MESSAGE, WorkerEnvFilePresent, WORKER_ENV_FILE_PRESENT_MESSAGE, } from "./job-errors.js";
 import { buildConductorMergeAccessForExecutorJob, buildDefaultMergeLocalDeps, runExecutorMergeJob, MERGE_RETRYABLE, MERGE_FAILED, } from "./merge-job.js";
+import { createProductionCiRerunDeps, runCiRerunJob, } from "./ci-rerun-job.js";
 import { createObservationState } from "./observation.js";
 import { getWorktreeMcpRegistrationTargets, normalizeWorktreePathForRegistration, provisionMcpRegistrationForWorktree, } from "../mcp-provisioning.js";
 import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
@@ -49,6 +50,7 @@ import { ensureExecutorWorktree } from "./worktree.js";
 import { buildPrBaseContractLaunchInstruction } from "../pr-base-contract.js";
 import { resolveExecutorPrompt, resolveWorkerPermissionPosture, } from "./worker-command.js";
 import { collectGitTelemetry, collectRemoteTrackingSha, createMcpSurfaceObserver, evaluatePreSpawnGitVerification, formatWorkerRateLimitAdvisory, normalizeMcpServerNames, } from "./observation.js";
+import { TERMINAL_CAPACITY_PROTOCOL_VERSIONS, TERMINAL_CAPACITY_RUNTIME_CONTRACTS, TERMINAL_CAPACITY_RUNTIMES, } from "./types.js";
 import { isRecognizedServerName, MCP_SERVER_NAME } from "../mcp-identity.js";
 /**
  * Bound on the pre-spawn git tracked-file lookup (BAPI-1104, R81).
@@ -83,6 +85,52 @@ function classificationToErrorKind(c) {
             return "WorkerCrashed";
     }
 }
+/**
+ * BAPI-1258 — build terminal capacity evidence for a FAILED worker, or
+ * `undefined` when the evidence is not usable.
+ *
+ * Usable only when all of these hold: the claim advertised a capability this
+ * executor recognizes; that capability's runtime is the agent that actually ran
+ * the job (the runtime check is by agent id, so this module stays agent-neutral);
+ * and the observation state holds exactly one non-contradictory rejection. The
+ * job id and attempt are the CLAIM's, never anything read from worker output.
+ * The caller decides precedence: this is never consulted for a successful
+ * process, an authentication refusal, or an integrity failure.
+ */
+export function buildTerminalCapacityEvidence(job, observation, runningAgentId) {
+    const capability = job.terminal_capacity_capability;
+    if (!capability || typeof capability !== "object")
+        return undefined;
+    if (!TERMINAL_CAPACITY_PROTOCOL_VERSIONS.includes(capability.protocol_version)) {
+        return undefined;
+    }
+    if (!TERMINAL_CAPACITY_RUNTIMES.includes(capability.runtime))
+        return undefined;
+    if (!TERMINAL_CAPACITY_RUNTIME_CONTRACTS.includes(capability.runtime_contract)) {
+        return undefined;
+    }
+    if (capability.runtime !== runningAgentId)
+        return undefined;
+    if (!Number.isInteger(job.id) || job.id < 1)
+        return undefined;
+    if (!Number.isInteger(job.attempt_count) || job.attempt_count < 1)
+        return undefined;
+    const observed = observation.terminalCapacity();
+    if (observed === undefined)
+        return undefined;
+    const evidence = {
+        protocol_version: capability.protocol_version,
+        runtime: capability.runtime,
+        runtime_contract: capability.runtime_contract,
+        job_id: job.id,
+        attempt: job.attempt_count,
+        cause: observed.cause,
+        observed_at: observed.observed_at,
+    };
+    if (observed.retry_not_before !== undefined)
+        evidence.retry_not_before = observed.retry_not_before;
+    return evidence;
+}
 function boundedError(err) {
     const message = err instanceof Error ? err.message : String(err);
     return message.slice(0, 200);
@@ -579,18 +627,28 @@ async function sendTerminalMutationWithAuthReport(params, job, control) {
     return terminal;
 }
 /** Dispatch and run a single claimed job. */
-export async function runClaimedJob(job, httpClient, options, deps, _report, seams = {}, 
 /**
- * BAPI-828: the runner-scoped control object, carrying the live worker
- * registry this job's worker registers with.
+ * Run ONE integration-correction worker under a spawn-job driver (BAPI-1259).
  *
- * A SEVENTH positional parameter, appended after the existing seams argument so
- * every current caller — the runner's default `runJob`, the many tests that
- * invoke this directly with four to six arguments — keeps compiling unchanged.
- * Absent means no executor-level shutdown control, which is exactly right for a
- * caller that has no executor loop around it.
+ * The same locked spawn path `reconcile_overlap` uses (BAPI-1152): the worktree
+ * lock, deny layer, MCP containment, env-file strip, worker log, and the
+ * heartbeat/timeout supervision all apply unchanged, and there is still exactly
+ * one worker spawn boundary. The integration action's driver prepares the epic
+ * branch before the worker, and after it owns the commit and the single
+ * authorized push; the worker is launched WITHOUT a worker branch, so the
+ * deterministic guard denies every push it attempts, and it gets the usual
+ * worker environment — no operational database, no write credential.
+ *
+ * `job` is the driver's synthetic recovery job and `httpClient` an adapter that
+ * maps heartbeats onto the integration action's lease; neither reaches
+ * `/executor/jobs`. Integration actions are NOT ordinary executor jobs.
  */
-control) {
+export async function runIntegrationCorrectionSpawn(job, httpClient, options, deps, driver, seams = {}, control) {
+    const { ownership, observation } = createJobRunState(options, deps);
+    return runSpawnJob(job, httpClient, options, deps, ownership, observation, seams, control, driver);
+}
+/** The per-job ownership and observation state every job runner starts from. */
+function createJobRunState(options, deps) {
     const ownership = {
         abandoned: false,
         lastSuccessfulHeartbeatAt: deps.now(),
@@ -606,6 +664,21 @@ control) {
             deps.errorLog(formatWorkerRateLimitAdvisory(advisory));
         },
     });
+    return { ownership, observation };
+}
+export async function runClaimedJob(job, httpClient, options, deps, _report, seams = {}, 
+/**
+ * BAPI-828: the runner-scoped control object, carrying the live worker
+ * registry this job's worker registers with.
+ *
+ * A SEVENTH positional parameter, appended after the existing seams argument so
+ * every current caller — the runner's default `runJob`, the many tests that
+ * invoke this directly with four to six arguments — keeps compiling unchanged.
+ * Absent means no executor-level shutdown control, which is exactly right for a
+ * caller that has no executor loop around it.
+ */
+control) {
+    const { ownership, observation } = createJobRunState(options, deps);
     // `merge` is a deterministic executor action: dispatched BEFORE any worktree
     // ensure/recreate or worker-spawn logic — it ensures no worktree and spawns no
     // worker (TDD §5/§9).
@@ -615,6 +688,16 @@ control) {
     if (job.job_type === "smoke") {
         return runSmokeJob(job, httpClient, options, deps, ownership, observation, control);
     }
+    // BAPI-1160: `ci_rerun` is a deterministic executor action, dispatched here
+    // beside `merge`/`smoke` and BEFORE the generic spawn path. It ensures no
+    // worktree and spawns no worker, and it must NEVER fall back to one: spawning
+    // an LLM worker to "fix" a failure the server already proved to be
+    // infrastructure is exactly the behavior this job type replaces. `job-types.ts`
+    // keeps it out of both `SPAWN_JOB_TYPES` and `RECOVERY_JOB_TYPES`, so reaching
+    // the spawn path below is structurally impossible rather than merely unlikely.
+    if (job.job_type === "ci_rerun") {
+        return runCiRerunExecutorJob(job, httpClient, options, deps, ownership, observation, seams, control);
+    }
     // BAPI-1152: `reconcile_overlap` takes its OWN branch, after `merge`/`smoke`
     // and before the generic spawn path. It needs a prepared, locked worktree like
     // a spawn job, but its body is the reconcile module's state machine: the
@@ -652,6 +735,121 @@ control) {
     });
     return { status: "failed", reason: "unsupported_job_type" };
 }
+/**
+ * Run a deterministic `ci_rerun` job (BAPI-1160).
+ *
+ * Supervised through the SAME ownership, heartbeat, dead-man, and timeout
+ * protocol as {@link runMergeJob} — via {@link createFlowProcess} — so a
+ * deterministic job is not a second, weaker lifecycle. The body itself spawns no
+ * subprocess of its own beyond the bounded `gh` invocations inside
+ * `ci-rerun-job.ts`, and there is NO fallback to a worker on failure.
+ *
+ * The completion carries only the job's fact envelope. It names no gate,
+ * requests no transition, and asserts no verdict: the reconciler re-observes the
+ * head independently and remains the sole transition authority (R14 rule 3).
+ */
+async function runCiRerunExecutorJob(job, httpClient, options, deps, ownership, observation, seams, control) {
+    // Resolve + enforce payload.timeout_seconds BEFORE any provider work, exactly
+    // as the merge branch does.
+    const timeout = resolveJobTimeoutSeconds(job, options.defaultJobTimeoutSeconds);
+    if (!timeout.ok) {
+        await httpClient.fail(job, {
+            error_kind: "ContractError.Timeout",
+            error_message: timeout.error,
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "timeout_contract" };
+    }
+    const runCiRerun = seams.runCiRerun ??
+        ((payload) => runCiRerunJob(payload, createProductionCiRerunDeps()));
+    const flow = createFlowProcess(() => runCiRerun(job.payload), (result) => result.ok);
+    const procResult = await superviseProcess({
+        job,
+        httpClient,
+        options,
+        deps,
+        ownership,
+        observation,
+        proc: flow.proc,
+        timeoutSeconds: timeout.timeoutSeconds,
+        collectTelemetry: async () => ({}),
+        control,
+    });
+    if (ownership.abandoned) {
+        return { status: "abandoned", reason: ownership.abandonReason };
+    }
+    if (procResult.classification === "timeout") {
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "fail",
+            send: () => httpClient.fail(job, {
+                error_kind: "CiRerunFailed",
+                error_message: "ci_rerun exceeded its job timeout",
+                classification: "timeout",
+                telemetry: observation.snapshot(),
+            }),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "failed");
+    }
+    const outcome = flow.getOutcome();
+    if (outcome === undefined) {
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "fail",
+            send: () => httpClient.fail(job, {
+                error_kind: "CiRerunFailed",
+                error_message: "ci_rerun completed without an outcome",
+                classification: "crashed",
+                telemetry: observation.snapshot(),
+            }),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "failed");
+    }
+    if (outcome.ok) {
+        const completion = {
+            job_type: "ci_rerun",
+            exit_code: 0,
+            classification: "clean_exit",
+            // The FACT ENVELOPE, verbatim. No gate, no transition, no verdict — the
+            // backend model is `extra="forbid"`, so anything else fails validation
+            // rather than being silently ignored.
+            result: outcome.result,
+            telemetry: observation.snapshot(),
+        };
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "complete",
+            send: () => httpClient.complete(job, completion),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "completed");
+    }
+    // A refused or failed re-run. The reserved infrastructure attempt stays
+    // CONSUMED — see `ci-rerun-job.ts` — and the reason is a closed token, never
+    // provider text.
+    const terminal = await sendTerminalMutationWithAuthReport({
+        kind: "fail",
+        send: () => httpClient.fail(job, {
+            error_kind: outcome.failure.errorKind,
+            error_message: outcome.failure.reason,
+            classification: "crashed",
+            telemetry: observation.snapshot(),
+        }),
+        deps,
+        options,
+        ownership,
+        log: deps.log,
+    }, job, control);
+    return terminalToRunResult(terminal, "failed");
+}
 /**
  * Adapt a `runMerge(...)` promise into an {@link OwnedChildProcess} so the merge
  * flow is supervised by the SAME heartbeat/deadman/timeout path as spawn/smoke
@@ -2296,6 +2494,16 @@ async function runPreparedSpawn(params) {
     const authDetection = adapter.authFailureDetection;
     const authFailure = authDetection?.supported === true &&
         authDetection.value.classify(procResult.stdoutExcerpt).notAuthenticated;
+    // BAPI-1258: capacity evidence is attached only AFTER authentication has been
+    // ruled out (an auth refusal keeps its own terminal kind and never waits), and
+    // only on this failed-process branch — a clean exit completes normally even if
+    // the worker saw a rejection on the way. The ordinary error kind, message,
+    // classification, commit residue, and attempt SHAs are sent unchanged; the
+    // evidence rides beside them, so a server refusal can re-send the identical
+    // ordinary failure.
+    const capacityEvidence = authFailure
+        ? undefined
+        : buildTerminalCapacityEvidence(job, observation, adapter.identity.agentId);
     const terminal = await sendTerminalMutationWithAuthReport({
         kind: "fail",
         send: () => httpClient.fail(job, {
@@ -2306,6 +2514,7 @@ async function runPreparedSpawn(params) {
             classification: toWireClassification(procResult.classification),
             ...commitResidue(git),
             telemetry: observation.snapshot(),
+            ...(capacityEvidence !== undefined ? { capacity_evidence: capacityEvidence } : {}),
         }),
         deps,
         options,

package/build/executor/job-types.js

@@ -26,6 +26,15 @@
  * resolution, but it does NOT re-enter `/implement-ticket`: it always carries an
  * explicit server-rendered `payload.prompt`, which wins over the synthesis in
  * `worker-command.ts`, and `job-runner.ts` dispatches it to its own body.
+ *
+ * BAPI-1160: `ci_rerun` is DELIBERATELY ABSENT from this set and from
+ * `SPAWN_JOB_TYPES` below. It is a deterministic actuator — one bounded
+ * `gh run rerun --failed` and a bounded poll — with no worktree, no branch to
+ * reuse, no prompt, and no worker. It has a dedicated dispatch branch in
+ * `job-runner.ts` beside `merge` and `smoke`, ahead of the generic spawn path,
+ * and it must NEVER fall back to a worker subprocess: spawning an LLM worker to
+ * "fix" a failure the server already PROVED to be infrastructure is the exact
+ * behavior this job type exists to replace.
  */
 export const RECOVERY_JOB_TYPES = new Set([
     "remediate",
@@ -37,8 +46,9 @@ export const RECOVERY_JOB_TYPES = new Set([
  * Real headless-spawn job types (worktree + worker LLM): the first-pass
  * `implement`, the `resume` continuation (own pre-spawn protocol), the
  * `spec_review` verdict job, and the recovery jobs. `merge` (deterministic,
- * no worktree/worker) and `smoke` (no-op acceptance) are intentionally EXCLUDED —
- * they have dedicated dispatch branches BEFORE the generic spawn path.
+ * no worktree/worker), `smoke` (no-op acceptance), and BAPI-1160's `ci_rerun`
+ * (deterministic, no worktree/worker) are intentionally EXCLUDED — they have
+ * dedicated dispatch branches BEFORE the generic spawn path.
  *
  * BAPI-1152: `reconcile_overlap` is here because it needs a prepared, locked
  * worktree and MAY spawn a worker — but only CONDITIONALLY. A clean merge whose

package/build/executor/merge-job.js

@@ -21,7 +21,7 @@
  *    {@link MERGE_FAILED} `error_kind` (via {@link classifyMergeFailureErrorKind})
  *    so the companion re-fire lane can route retry-vs-rebase without string parsing.
  */
-import { makeLocalMergeExecutor, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
+import { makeLocalMergeExecutor, resolveLocalMergeCredential, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
 import { resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
 import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, EPIC_BRANCH_PREFIX, } from "../epic-integration-pr.js";
 import { secretFreeErrorMessage } from "./job-errors.js";
@@ -353,5 +353,14 @@ export async function runExecutorMergeJob(job, seams) {
  * unchanged (no App token is ever placed here).
  */
 export function buildDefaultMergeLocalDeps(deps, signal) {
-    return { env: deps.env, signal };
+    // BAPI-1136: the executor's merge job runs on the operator's own machine, which
+    // is typed `local`, so it reads the local configuration key and no other. The
+    // environment is still passed for the allowlisted operational base (PATH, HOME,
+    // certificates); it no longer supplies the identity, and an ambient GH_TOKEN in
+    // it is dropped rather than inherited.
+    return {
+        env: deps.env,
+        credential: resolveLocalMergeCredential(deps.env, "local"),
+        signal,
+    };
 }

package/build/executor/observation.js

@@ -288,8 +288,10 @@ function parseRateLimitEvent(obj) {
  * Stated exactly once per line so an operator reading it cold understands what
  * happens next without cross-referencing the runbook.
  */
-const RATE_LIMIT_CONSEQUENCE_TEXT = "The executor keeps claiming: a worker that hits the ceiling fails fast and its " +
-    "job classifies as a worker failure under the normal retry budget.";
+const RATE_LIMIT_CONSEQUENCE_TEXT = "This warning is advisory only and triggers no waiting. Automatic capacity " +
+    "waiting happens only when the worker then fails with the supported terminal " +
+    "rejection and the server advertised capacity recovery for this job; otherwise " +
+    "the failure follows ordinary failure handling.";
 /** Fixed runbook reference appended to every rate-limit diagnostic (BAPI-898). */
 const RATE_LIMIT_RUNBOOK_REFERENCE = "See docs/claude/epic-implementer-v2-operator-runbook.md §8.";
 /**
@@ -354,6 +356,67 @@ export function parseClaudeStreamJsonLine(line) {
 function pickString(value) {
     return typeof value === "string" && value.length > 0 ? value : undefined;
 }
+/**
+ * The exact status that marks a terminal rejection. `allowed_warning`,
+ * `blocked`, and any unknown status are NOT terminal capacity: the first is a
+ * warning, and the others are not part of the supported contract.
+ */
+const TERMINAL_CAPACITY_REJECTED_STATUS = "rejected";
+/** Closed shape for a `rateLimitType` token the terminal parser will accept. */
+const TERMINAL_CAPACITY_LIMIT_TYPE_PATTERN = /^[a-z0-9_]{1,64}$/;
+/**
+ * Map the provider's limit window to a normalized cause. Long windows (the
+ * weekly ceilings) are account quota; shorter windows are rate limits.
+ */
+function terminalCapacityCauseFor(rateLimitType) {
+    return rateLimitType.startsWith("seven_day") ? "quota_exhausted" : "rate_limit_exhausted";
+}
+/**
+ * Parse ONE stream-json line for the supported terminal-capacity event, or
+ * `undefined` for anything else (BAPI-1258).
+ *
+ * Accepts only `{"type":"rate_limit_event","rate_limit_info":{"status":"rejected",
+ * "rateLimitType":<closed token>, "resetsAt"?:<number>}}`. Unknown event types,
+ * unknown statuses, malformed tokens, and malformed reset values all yield
+ * `undefined` (a bad reset drops only the reset, not the rejection). Never
+ * throws: a failure here only means "no confirmed evidence".
+ */
+export function parseClaudeTerminalCapacityLine(line, nowMs) {
+    try {
+        const trimmed = typeof line === "string" ? line.trim() : "";
+        if (trimmed.length === 0)
+            return undefined;
+        const parsed = JSON.parse(trimmed);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return undefined;
+        const obj = parsed;
+        if (obj.type !== "rate_limit_event")
+            return undefined;
+        const info = obj.rate_limit_info;
+        if (!info || typeof info !== "object" || Array.isArray(info))
+            return undefined;
+        const record = info;
+        if (record.status !== TERMINAL_CAPACITY_REJECTED_STATUS)
+            return undefined;
+        const rateLimitType = record.rateLimitType;
+        if (typeof rateLimitType !== "string" || !TERMINAL_CAPACITY_LIMIT_TYPE_PATTERN.test(rateLimitType)) {
+            return undefined;
+        }
+        if (!Number.isFinite(nowMs))
+            return undefined;
+        const observation = {
+            cause: terminalCapacityCauseFor(rateLimitType),
+            observed_at: new Date(nowMs).toISOString(),
+        };
+        const resetAt = normalizeRateLimitResetAt(record.resetsAt, nowMs);
+        if (resetAt !== undefined)
+            observation.retry_not_before = resetAt;
+        return observation;
+    }
+    catch {
+        return undefined;
+    }
+}
 // ---------------------------------------------------------------------------
 // MCP surface assertion (BAPI-790)
 // ---------------------------------------------------------------------------
@@ -528,8 +591,11 @@ export function createMcpSurfaceObserver(expectedServerNames, parseInitEvent) {
 export const MAX_BUFFERED_ADVISORY_LINE_CHARS = 1_048_576;
 /**
  * Create the observation state. When `advisoryParserEnabled` is false, stdout is
- * still timestamped (`last_stdout_at`) but never parsed — proving the advisory
- * parser is not load-bearing.
+ * still timestamped (`last_stdout_at`) but never parsed for advisory hints —
+ * proving the advisory parser is not load-bearing. The separate BAPI-1258
+ * terminal-capacity parser still reads lines unless
+ * `terminalCapacityParserEnabled` is `false`; it only ever yields "no evidence"
+ * on bad input, so ordinary success never depends on it either.
  */
 export function createObservationState(deps, options) {
     let git = {};
@@ -544,6 +610,15 @@ export function createObservationState(deps, options) {
      * — leaves this unchanged.
      */
     let rateLimit;
+    /**
+     * BAPI-1258: the terminal-capacity channel. The FIRST rejection fixes the
+     * cause and `observed_at`; a repeat of the same cause may only carry a later
+     * reset forward. A rejection with a DIFFERENT cause makes the evidence
+     * contradictory, and contradictory evidence is never reported.
+     */
+    let terminalCapacity;
+    let terminalCapacityContradictory = false;
+    const terminalCapacityParserEnabled = options.terminalCapacityParserEnabled !== false;
     /** Residual partial line carried across stdout chunks (BAPI-828). */
     let buffer = "";
     /** True while skipping the remainder of a line that blew the size cap. */
@@ -579,10 +654,37 @@ export function createObservationState(deps, options) {
             }
         }
     };
+    const consumeTerminalCapacityLine = (line) => {
+        if (terminalCapacityContradictory)
+            return;
+        const observed = parseClaudeTerminalCapacityLine(line, deps.now());
+        if (observed === undefined)
+            return;
+        if (terminalCapacity === undefined) {
+            terminalCapacity = observed;
+            return;
+        }
+        if (terminalCapacity.cause !== observed.cause) {
+            terminalCapacityContradictory = true;
+            terminalCapacity = undefined;
+            return;
+        }
+        if (observed.retry_not_before !== undefined &&
+            (terminalCapacity.retry_not_before === undefined ||
+                observed.retry_not_before > terminalCapacity.retry_not_before)) {
+            terminalCapacity = { ...terminalCapacity, retry_not_before: observed.retry_not_before };
+        }
+    };
+    const consumeLine = (line) => {
+        if (options.advisoryParserEnabled)
+            consumeAdvisoryLine(line);
+        if (terminalCapacityParserEnabled)
+            consumeTerminalCapacityLine(line);
+    };
     return {
         recordStdout(chunk) {
             advisory.last_stdout_at = new Date(deps.now()).toISOString();
-            if (!options.advisoryParserEnabled)
+            if (!options.advisoryParserEnabled && !terminalCapacityParserEnabled)
                 return;
             if (typeof chunk !== "string" || chunk.length === 0)
                 return;
@@ -605,7 +707,7 @@ export function createObservationState(deps, options) {
             buffer += input;
             let newlineAt = buffer.indexOf("\n");
             while (newlineAt !== -1) {
-                consumeAdvisoryLine(buffer.slice(0, newlineAt));
+                consumeLine(buffer.slice(0, newlineAt));
                 buffer = buffer.slice(newlineAt + 1);
                 newlineAt = buffer.indexOf("\n");
             }
@@ -625,7 +727,7 @@ export function createObservationState(deps, options) {
             // is harmless: a truncated line does not parse, and the first-wins guard
             // above makes a repeat parse of a complete line a no-op.
             if (buffer.length > 0)
-                consumeAdvisoryLine(buffer);
+                consumeLine(buffer);
         },
         setGitTelemetry(telemetry) {
             git = telemetry;
@@ -667,5 +769,10 @@ export function createObservationState(deps, options) {
                 residue.attempt_end_sha = attemptEndSha;
             return residue;
         },
+        terminalCapacity() {
+            if (terminalCapacityContradictory || terminalCapacity === undefined)
+                return undefined;
+            return { ...terminalCapacity };
+        },
     };
 }

package/build/executor/runner.js

@@ -7,10 +7,12 @@
  * after all active jobs finish. Depends on NO v1 conductor event/ledger module.
  */
 import { collectExecutorPreflight, buildClaimManifest, createDenyProbeCache, } from "./preflight.js";
-import { runClaimedJob } from "./job-runner.js";
+import { runClaimedJob, runIntegrationCorrectionSpawn } from "./job-runner.js";
 import { appendToActiveJobLogs } from "./job-log-registry.js";
 import { createLiveWorkerRegistry, } from "./live-worker-registry.js";
 import { sweepExecutorWorktrees } from "./worktree-gc.js";
+import { INTEGRATION_ACTION_PROTOCOL_VERSION, } from "./types.js";
+import { buildIntegrationCorrectionJob, createIntegrationCorrectionLeaseAdapter, runIntegrationAction, } from "./integration-job.js";
 import { validateBranchName } from "../base-ref.js";
 import { ensureEpicIntegrationPullRequest, createProductionEpicIntegrationGhRunner, formatEpicIntegrationPullRequestOutcome, EPIC_BRANCH_PREFIX, } from "../epic-integration-pr.js";
 /**
@@ -94,6 +96,13 @@ export function formatProcessHeartbeatFailureDiagnostic() {
 export function formatProcessHeartbeatRecoveredDiagnostic() {
     return "executor: process-heartbeat delivery has recovered.";
 }
+/** Seconds a correction worker may run: what the action deadline leaves, less a margin. */
+function correctionTimeoutSeconds(deadlineAt, nowMs) {
+    const deadline = Date.parse(deadlineAt);
+    if (!Number.isFinite(deadline))
+        return 60;
+    return Math.max(60, Math.floor((deadline - nowMs) / 1000) - 60);
+}
 /**
  * Run the executor loop. Returns 0 on the `once` path (a single cycle drained);
  * in continuous mode it does not return (the process is long-lived).
@@ -113,6 +122,13 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
             platform: deps.platform,
         }));
     const active = new Map();
+    // BAPI-1259 — integration actions share `active` (and therefore the same
+    // capacity budget and shutdown drain) with ordinary jobs, keyed by negative
+    // numbers so they can never collide with a server job id.
+    let integrationSeq = 0;
+    // Set once when the server says it has no integration-action route (an older
+    // deployment), so the executor stops asking rather than logging every poll.
+    let integrationActionsUnsupported = false;
     // BAPI-794 — process-local cross-run claim observability. Retains only the
     // last successfully claimed job's `epic_run_id` (never job payloads,
     // credentials, or arguments) so an unintended repo-wide move between epic
@@ -536,6 +552,85 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
         })();
         active.set(job.id, promise);
     }
+    const runOneIntegrationAction = seams.runIntegrationAction ??
+        ((action) => runIntegrationAction(action, seams.integrationActions, {
+            env: deps.env,
+            runCommand: deps.runCommand,
+            sleep: deps.sleep,
+            errorLog: deps.errorLog,
+            cwd: deps.cwd,
+        }, {
+            // A correction reuses the executor's ONE locked spawn path: the same
+            // worktree lock, containment, and supervision every worker gets.
+            runCorrection: async (claimed, driver, heartbeat) => {
+                const adapter = createIntegrationCorrectionLeaseAdapter(heartbeat);
+                const job = buildIntegrationCorrectionJob(claimed, correctionTimeoutSeconds(claimed.deadline_at, deps.now()));
+                await runIntegrationCorrectionSpawn(job, adapter.client, options, deps, driver, undefined, control);
+                return adapter.captured();
+            },
+        }));
+    function dispatchIntegrationAction(action) {
+        const key = --integrationSeq;
+        const promise = (async () => {
+            try {
+                await runOneIntegrationAction(action);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                deps.errorLog(`executor integration action crashed: ${message.slice(0, 200)}`);
+            }
+            finally {
+                active.delete(key);
+            }
+        })();
+        active.set(key, promise);
+    }
+    /**
+     * Claim durable integration actions into whatever capacity is left
+     * (BAPI-1259). The claim scope is the executor's own: `--epic-run-id` runs,
+     * or the whole repository for `--repo-wide`. The action driver chooses no
+     * next ticket and no gate — it performs one action and reports facts.
+     */
+    async function claimIntegrationActions() {
+        const client = seams.integrationActions;
+        if (!client || integrationActionsUnsupported)
+            return;
+        for (const repoName of options.repos) {
+            while (!shutdownRequested && options.maxConcurrent - active.size > 0) {
+                const result = await client.claim({
+                    protocol_version: INTEGRATION_ACTION_PROTOCOL_VERSION,
+                    repo_name: repoName,
+                    executor_id: options.executorId,
+                    ...(options.epicRunIds !== undefined
+                        ? { epic_run_ids: options.epicRunIds }
+                        : { repo_wide: true }),
+                });
+                if (result.kind === "claimed") {
+                    dispatchIntegrationAction(result.action);
+                    continue;
+                }
+                if (result.kind === "fatal") {
+                    if (result.authHttpStatus === 401 || result.authHttpStatus === 403) {
+                        control.reportAuthFatal?.({
+                            repoName,
+                            category: "claim",
+                            httpStatus: result.authHttpStatus,
+                        });
+                    }
+                    else {
+                        integrationActionsUnsupported = true;
+                        deps.errorLog(`executor: integration actions unavailable on this server (${result.error}); ` +
+                            "not claiming them again in this process");
+                    }
+                    return;
+                }
+                if (result.kind === "retryable") {
+                    deps.errorLog(`executor integration action claim retryable: ${result.error}`);
+                }
+                break;
+            }
+        }
+    }
     // Handlers go on BEFORE preflight and before the first claim (BAPI-828).
     // Preflight can take seconds and the first claim can spawn a worker immediately
     // after it, so registering any later would leave a real window in which a
@@ -654,6 +749,11 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
                 // cycle's claim loop (a claim-time auth-fatal is the case that matters —
                 // it can flip `shutdownRequested` while `active.size` is still 0). No
                 // worktree-mutating sweep may run once the auth-fatal flag is set.
+                // BAPI-1259 — integration actions take whatever capacity ordinary jobs
+                // left this cycle, under the same shutdown gate.
+                if (!shutdownRequested) {
+                    await claimIntegrationActions();
+                }
                 if (!shutdownRequested) {
                     await maybeSweepWorktrees();
                 }