@bridge_gpt/mcp-server 0.2.60 → 0.2.65

package/build/executor/process.js

@@ -14,6 +14,7 @@ export function createProcessTerminationController(proc, deps, termGraceMs = DEF
     let escalated = false;
     let disposed = false;
     let graceTimer;
+    const killListeners = [];
     return {
         requestTermination() {
             // A disposed controller belongs to a settled child: signalling it would
@@ -28,6 +29,14 @@ export function createProcessTerminationController(proc, deps, termGraceMs = DEF
                     return;
                 escalated = true;
                 proc.kill("SIGKILL");
+                for (const listener of killListeners.splice(0)) {
+                    try {
+                        listener();
+                    }
+                    catch {
+                        /* a listener must never break the escalation path */
+                    }
+                }
             }, termGraceMs);
         },
         isTerminationRequested() {
@@ -41,6 +50,16 @@ export function createProcessTerminationController(proc, deps, termGraceMs = DEF
                 deps.clearTimer(graceTimer);
                 graceTimer = undefined;
             }
+            killListeners.length = 0;
+        },
+        onKillSent(listener) {
+            if (escalated) {
+                listener();
+                return;
+            }
+            if (disposed)
+                return;
+            killListeners.push(listener);
         },
     };
 }
@@ -55,16 +74,23 @@ function appendBounded(existing, chunk, limitBytes) {
         return combined;
     return Buffer.from(combined, "utf8").subarray(0, limitBytes).toString("utf8");
 }
+/**
+ * Drain one output stream into `onChunk`. Resolves `"eof"` at end of stream and
+ * `"stream_error"` when iteration threw (BAPI-1301 reports which, for the
+ * authoritative stdout path; legacy callers ignore it). A null stream is `"eof"`.
+ */
 async function pump(iterable, onChunk) {
     if (!iterable)
-        return;
+        return "eof";
     try {
         for await (const chunk of iterable) {
             onChunk(typeof chunk === "string" ? chunk : String(chunk));
         }
+        return "eof";
     }
     catch {
         /* stream errors degrade observability, never correctness */
+        return "stream_error";
     }
 }
 /**
@@ -100,10 +126,37 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
     // single grace timer rather than racing three of each.
     const controller = options.terminationController ?? createProcessTerminationController(proc, deps, termGraceMs);
     const terminate = () => controller.requestTermination();
+    // BAPI-1301 (D4a): the authoritative consumer, when supplied. `drainClosed`
+    // flips once the bounded post-exit drain gives up, so a chunk arriving after
+    // the verdict was taken can never mutate the ledger behind the caller's back.
+    const authoritative = options.authoritativeStdout;
+    const supervised = authoritative !== undefined || options.drainDeadlineMs !== undefined;
+    let authoritativeStreamError = false;
+    let drainClosed = false;
     const pumpStdout = pump(proc.stdout, (chunk) => {
+        if (drainClosed)
+            return;
         // Advisory observation ALWAYS runs first and always runs: the tee and the
         // telemetry must see every chunk regardless of what the assertion decides.
-        options.onStdout?.(chunk);
+        if (authoritative !== undefined) {
+            // Guarded only on the authoritative path: an advisory throw must not end
+            // the pump and truncate the stream the ledger depends on.
+            try {
+                options.onStdout?.(chunk);
+            }
+            catch {
+                /* advisory — never affects the run */
+            }
+            try {
+                authoritative(chunk);
+            }
+            catch {
+                authoritativeStreamError = true;
+            }
+        }
+        else {
+            options.onStdout?.(chunk);
+        }
         stdoutExcerpt = appendBounded(stdoutExcerpt, chunk, limit);
         if (options.onStdoutTerminationCheck?.(chunk) === true && !terminationRequested) {
             terminationRequested = true;
@@ -120,14 +173,58 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
         // races an already-requested termination a no-op rather than a double signal.
         terminate();
     }, timeoutSeconds * 1000);
-    const { exitCode, signal } = await proc.wait();
+    // BAPI-1301 (D4a): bounded waits, only when a drain deadline was supplied.
+    // Every timer created here is cleared before returning.
+    const drainMs = options.drainDeadlineMs === undefined ? undefined : Math.max(0, options.drainDeadlineMs);
+    const drainTimers = [];
+    const after = (ms) => new Promise((resolve) => {
+        drainTimers.push(deps.setTimer(resolve, ms));
+    });
+    let exitCode;
+    let signal;
+    let exitUnconfirmed = false;
+    if (drainMs === undefined) {
+        ({ exitCode, signal } = await proc.wait());
+    }
+    else {
+        const racers = [
+            proc.wait().then((r) => ({ kind: "closed", ...r })),
+        ];
+        // The process `exit`, independent of its pipes: a descendant holding stdout
+        // open must not stop supervision from noticing the child itself is gone.
+        if (proc.exited)
+            racers.push(proc.exited().then((r) => ({ kind: "exited", ...r })));
+        // After SIGKILL, `wait()` gets at most `drainMs` more before the exit is
+        // reported unconfirmed rather than awaited forever.
+        racers.push(new Promise((resolve) => controller.onKillSent?.(resolve))
+            .then(() => after(drainMs))
+            .then(() => ({ kind: "kill_bound", exitCode: null, signal: null })));
+        const settled = await Promise.race(racers);
+        exitCode = settled.exitCode;
+        signal = settled.signal;
+        exitUnconfirmed = settled.kind === "kill_bound";
+    }
     deps.clearTimer(timeoutTimer);
     // The child has settled, so any outstanding escalation is now aimed at a
     // finished process. Disposal is idempotent and safe for a controller this call
     // did not create — the job runner's `finally` may dispose it again.
     controller.dispose();
-    await pumpStdout;
-    await pumpStderr;
+    let stdoutEnd;
+    if (drainMs === undefined) {
+        stdoutEnd = await pumpStdout;
+        await pumpStderr;
+    }
+    else {
+        const drained = await Promise.race([
+            Promise.all([pumpStdout, pumpStderr]).then(([out]) => out),
+            after(drainMs).then(() => "drain_deadline"),
+        ]);
+        if (drained === "drain_deadline")
+            drainClosed = true;
+        stdoutEnd = drained;
+        for (const handle of drainTimers)
+            deps.clearTimer(handle);
+    }
     let classification;
     if (timedOut) {
         classification = "timeout";
@@ -145,6 +242,11 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
         stdoutExcerpt,
         stderrExcerpt,
         ...(terminationRequested ? { terminationRequested: true } : {}),
+        // BAPI-1301 fields appear only for callers that opted in, so every legacy
+        // result keeps its exact shape.
+        ...(supervised ? { stdoutEnd } : {}),
+        ...(authoritativeStreamError ? { authoritativeStreamError: true } : {}),
+        ...(exitUnconfirmed ? { exitUnconfirmed: true } : {}),
     };
 }
 /**
@@ -155,3 +257,131 @@ export function killOwnedProcess(proc, reason) {
     proc.kill("SIGKILL");
     return { classification: "killed", reason };
 }
+/**
+ * Wait for `success` on `stdin`, bounded by abort, deadline, `close`, and `error`.
+ * `action` runs AFTER every listener is registered, so an implementation (or a
+ * fake) that emits synchronously inside `end()` is still observed. Every
+ * listener and timer is removed on settle. Never rejects.
+ */
+function awaitStdinOutcome(stdin, success, options, action) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let timer;
+        const registered = [];
+        const onAbort = () => finish({ ok: false, reason: "aborted" });
+        function finish(result) {
+            if (settled)
+                return;
+            settled = true;
+            if (timer !== undefined)
+                options.deps.clearTimer(timer);
+            for (const [event, listener] of registered) {
+                try {
+                    stdin.off?.(event, listener);
+                }
+                catch {
+                    /* best-effort listener cleanup */
+                }
+            }
+            options.signal?.removeEventListener("abort", onAbort);
+            resolve(result);
+        }
+        const listen = (event, result) => {
+            const listener = () => finish(result);
+            registered.push([event, listener]);
+            try {
+                stdin.once(event, listener);
+            }
+            catch {
+                finish({ ok: false, reason: "write_error" });
+            }
+        };
+        listen(success, { ok: true });
+        listen("error", { ok: false, reason: "write_error" });
+        listen("close", { ok: false, reason: "closed" });
+        if (settled)
+            return;
+        if (options.signal) {
+            if (options.signal.aborted) {
+                finish({ ok: false, reason: "aborted" });
+                return;
+            }
+            options.signal.addEventListener("abort", onAbort, { once: true });
+        }
+        const remaining = options.deadlineAtMs - options.deps.now();
+        if (remaining <= 0) {
+            finish({ ok: false, reason: "deadline" });
+            return;
+        }
+        timer = options.deps.setTimer(() => {
+            timer = undefined;
+            finish({ ok: false, reason: "deadline" });
+        }, remaining);
+        if (action) {
+            try {
+                action();
+            }
+            catch {
+                finish({ ok: false, reason: "write_error" });
+            }
+        }
+    });
+}
+/** Pre-checks shared by write and close: stdin present, not aborted, deadline not passed. */
+function stdinPrecheck(proc, options) {
+    const stdin = proc.stdin;
+    if (!stdin)
+        return { failure: { ok: false, reason: "no_stdin" } };
+    if (options.signal?.aborted)
+        return { failure: { ok: false, reason: "aborted" } };
+    if (options.deps.now() >= options.deadlineAtMs)
+        return { failure: { ok: false, reason: "deadline" } };
+    return { stdin };
+}
+/**
+ * Write `data` to a held child stdin, observing Node backpressure (BAPI-1301).
+ *
+ * When `write()` accepts the data below the high-water mark this resolves at
+ * once. When it returns `false`, it awaits `drain` — but only until the attempt
+ * deadline, the abort signal, the pipe closing, or a pipe error, whichever comes
+ * first. It NEVER throws: every failure is a normalized
+ * {@link StdinTransportResult} the caller turns into an evidence fact
+ * (`transport_failed_before_work` / `transport_failed_after_progress`).
+ */
+export async function writeStdinBounded(proc, data, options) {
+    const checked = stdinPrecheck(proc, options);
+    if ("failure" in checked)
+        return checked.failure;
+    const { stdin } = checked;
+    if (stdin.destroyed === true || stdin.writableEnded === true) {
+        return { ok: false, reason: "closed" };
+    }
+    let accepted;
+    try {
+        accepted = stdin.write(data);
+    }
+    catch {
+        return { ok: false, reason: "write_error" };
+    }
+    if (accepted)
+        return { ok: true };
+    return awaitStdinOutcome(stdin, "drain", options);
+}
+/**
+ * Half-close a held child stdin — EOF for the child — bounded the same way
+ * (BAPI-1301). Tolerates an already-ended pipe (`{ ok: true }`: EOF was already
+ * delivered); a destroyed pipe is `closed`. Waits for `finish` (the flush) only
+ * until deadline/abort/close/error. Never throws.
+ */
+export async function closeStdinBounded(proc, options) {
+    // An already-ended pipe is success even past the deadline: EOF was delivered.
+    if (proc.stdin?.writableEnded === true)
+        return { ok: true };
+    const checked = stdinPrecheck(proc, options);
+    if ("failure" in checked)
+        return checked.failure;
+    const { stdin } = checked;
+    if (stdin.destroyed === true)
+        return { ok: false, reason: "closed" };
+    return awaitStdinOutcome(stdin, "finish", options, () => stdin.end());
+}

package/build/executor/prompt-spec.js

@@ -17,7 +17,7 @@
  * placeholder name). This module NEVER logs prompt text, ticket specs, git logs,
  * or reasons.
  */
-import { ExecutorNamedError } from "./job-errors.js";
+import { CiFixContext, ExecutorNamedError } from "./job-errors.js";
 /** Stable named-error kind used for every prompt-spec contract failure. */
 const PROMPT_CONTRACT_ERROR = "ContractError.Prompt";
 /** The prompt-spec version this renderer understands. */
@@ -55,7 +55,253 @@ const SUPPORTED_PLACEHOLDERS = new Set([
     "REVISE_REASONS",
     "RELATED_CONTEXT",
     "SPEC_CITATION_FRESHNESS_WARNING",
+    // BAPI-1296 — resolved ONLY from a validated `ci_fix` dispatch context
+    // (`readCiFixDispatchContext`), never from configured required checks.
+    "FAILING_CHECKS",
+    "MISSING_CHECKS",
+    "LOG_EXCERPTS",
 ]);
+// ---------------------------------------------------------------------------
+// BAPI-1296 — the focused `ci_fix` dispatch contract (executor half).
+//
+// The reconciler writes `payload.ci_resolved_inputs` from the per-head CI
+// observation (`_ci_fix_resolved_inputs_from_observation` in
+// `api/library/epic_implementer/reconciler.py`). These bounds MIRROR the
+// server's, and an over-bound essential value is REFUSED, never truncated: a
+// check silently dropped here would be a check the worker is never told about.
+// Only excerpt diagnostic TEXT may be cut, and visibly.
+// ---------------------------------------------------------------------------
+/** Most distinct actionable (failing ∪ missing) checks. */
+export const CI_FIX_MAX_ACTIONABLE_CHECKS = 32;
+/** Longest check name, in UTF-8 bytes. */
+export const CI_FIX_MAX_CHECK_NAME_BYTES = 200;
+/** Most log excerpts carried into the prompt. */
+export const CI_FIX_MAX_LOG_EXCERPTS = 8;
+/** Longest single excerpt text, in UTF-8 bytes (cut visibly beyond it). */
+export const CI_FIX_MAX_LOG_EXCERPT_BYTES = 512;
+/** Total excerpt text across all excerpts, in UTF-8 bytes. */
+export const CI_FIX_MAX_LOG_EXCERPTS_TOTAL_BYTES = 4_096;
+/** Longest excerpt `source` label, in UTF-8 bytes. */
+const CI_FIX_MAX_EXCERPT_SOURCE_BYTES = 200;
+/**
+ * Ceiling on the ticket spec a ci_fix prompt carries. The server bounds the spec
+ * to 64,000 characters plus a truncation marker; anything past this is not a
+ * spec the server produced.
+ */
+export const CI_FIX_TICKET_SPEC_MAX_CHARS = 70_000;
+/** The exact placeholder set a focused ci_fix prompt spec must declare. */
+const CI_FIX_PLACEHOLDERS = [
+    "TICKET_SPEC",
+    "WORK_BRANCH",
+    "FAILING_CHECKS",
+    "MISSING_CHECKS",
+    "LOG_EXCERPTS",
+];
+const CI_FIX_EXCERPT_TRUNCATION_MARKER = " …[excerpt truncated]";
+const CI_FIX_HEAD_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+/** Build the named, bounded refusal for a focused ci_fix job. */
+export function ciFixContextError(job, reason) {
+    return new ExecutorNamedError(CiFixContext, `ci_fix job ${job.id} refused before worker effects (reason=${reason})`);
+}
+function utf8Bytes(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function hasControlCharacter(value) {
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+/** Validate + de-duplicate one check-name list; `null` when a name is unusable. */
+function readCheckNames(raw) {
+    if (raw === undefined || raw === null)
+        return [];
+    if (!Array.isArray(raw))
+        return null;
+    const names = [];
+    const seen = new Set();
+    for (const item of raw) {
+        if (typeof item !== "string")
+            return null;
+        const name = item.trim();
+        if (name.length === 0 ||
+            utf8Bytes(name) > CI_FIX_MAX_CHECK_NAME_BYTES ||
+            hasControlCharacter(name)) {
+            return null;
+        }
+        if (!seen.has(name)) {
+            seen.add(name);
+            names.push(name);
+        }
+    }
+    return names;
+}
+function sliceUtf8(value, maxBytes) {
+    if (utf8Bytes(value) <= maxBytes)
+        return value;
+    // Decoding a cut multi-byte sequence yields U+FFFD; drop it so the kept
+    // prefix is clean text.
+    return Buffer.from(value, "utf8").subarray(0, maxBytes).toString("utf8").replace(/\uFFFD+$/u, "");
+}
+function readLogExcerpts(raw, headSha, dispatched) {
+    // An ABSENT record is not a reason to refuse targeted work: excerpts are
+    // optional evidence. It renders as plainly unavailable.
+    if (raw === undefined || raw === null) {
+        return { status: "unavailable", reason: "not_supplied" };
+    }
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const record = raw;
+    if (record.status === "unavailable") {
+        const reason = typeof record.reason === "string" &&
+            /^[a-z0-9_]{1,64}$/.test(record.reason)
+            ? record.reason
+            : "unspecified";
+        return { status: "unavailable", reason };
+    }
+    if (record.status !== "supplied" || !Array.isArray(record.excerpts))
+        return null;
+    if (record.excerpts.length === 0 || record.excerpts.length > CI_FIX_MAX_LOG_EXCERPTS) {
+        return null;
+    }
+    const excerpts = [];
+    let totalBytes = 0;
+    for (const entry of record.excerpts) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return null;
+        const e = entry;
+        // Provenance is ESSENTIAL: an excerpt that cannot name a dispatched check, a
+        // source, and the dispatch head is not verified evidence for this attempt.
+        if (typeof e.check !== "string" ||
+            !dispatched.has(e.check.trim()) ||
+            typeof e.source !== "string" ||
+            e.source.trim().length === 0 ||
+            utf8Bytes(e.source.trim()) > CI_FIX_MAX_EXCERPT_SOURCE_BYTES ||
+            hasControlCharacter(e.source.trim()) ||
+            typeof e.head_sha !== "string" ||
+            e.head_sha.trim().toLowerCase() !== headSha ||
+            typeof e.text !== "string") {
+            return null;
+        }
+        let text = e.text;
+        if (utf8Bytes(text) > CI_FIX_MAX_LOG_EXCERPT_BYTES) {
+            text =
+                sliceUtf8(text, CI_FIX_MAX_LOG_EXCERPT_BYTES - utf8Bytes(CI_FIX_EXCERPT_TRUNCATION_MARKER)) +
+                    CI_FIX_EXCERPT_TRUNCATION_MARKER;
+        }
+        const remaining = CI_FIX_MAX_LOG_EXCERPTS_TOTAL_BYTES - totalBytes;
+        if (remaining <= utf8Bytes(CI_FIX_EXCERPT_TRUNCATION_MARKER))
+            break;
+        if (utf8Bytes(text) > remaining) {
+            text =
+                sliceUtf8(text, remaining - utf8Bytes(CI_FIX_EXCERPT_TRUNCATION_MARKER)) +
+                    CI_FIX_EXCERPT_TRUNCATION_MARKER;
+        }
+        totalBytes += utf8Bytes(text);
+        excerpts.push({ check: e.check.trim(), source: e.source.trim(), text });
+    }
+    return { status: "supplied", excerpts };
+}
+/**
+ * Validate a claimed `ci_fix` job's focused contract WITHOUT touching a worktree.
+ *
+ * Checks, in order: no explicit `payload.prompt` (a legacy full-recipe prompt
+ * must not silently replace the focused route); a valid `ci_fix` prompt spec
+ * declaring exactly the five focused placeholders; a non-blank, bounded ticket
+ * spec; and a head-bound `ci_resolved_inputs` whose repository and expected
+ * branch agree with the claimed job. Throws `ContractError.CiFixContext` with a
+ * fixed reason token on the first failure — never a fallback prompt.
+ */
+export function readCiFixDispatchContext(job) {
+    const payload = job.payload && typeof job.payload === "object"
+        ? job.payload
+        : {};
+    if (typeof payload.prompt === "string" && payload.prompt.trim().length > 0) {
+        throw ciFixContextError(job, "explicit_prompt_unsupported");
+    }
+    let spec;
+    try {
+        spec = readPromptSpecPayload(payload.prompt_spec, "ci_fix");
+    }
+    catch {
+        throw ciFixContextError(job, "prompt_spec_invalid");
+    }
+    if (spec.placeholders.length !== CI_FIX_PLACEHOLDERS.length ||
+        !CI_FIX_PLACEHOLDERS.every((name) => spec.placeholders.includes(name))) {
+        throw ciFixContextError(job, "prompt_spec_invalid");
+    }
+    if (!isNonBlankString(payload.ticket_spec)) {
+        throw ciFixContextError(job, "ticket_spec_missing");
+    }
+    if (payload.ticket_spec.length > CI_FIX_TICKET_SPEC_MAX_CHARS) {
+        throw ciFixContextError(job, "ticket_spec_oversized");
+    }
+    const inputs = payload.ci_resolved_inputs;
+    if (!inputs || typeof inputs !== "object" || Array.isArray(inputs)) {
+        throw ciFixContextError(job, "dispatched_checks_missing");
+    }
+    const raw = inputs;
+    const failing = readCheckNames(raw.failing_checks);
+    const missing = readCheckNames(raw.missing_checks);
+    if (failing === null || missing === null) {
+        throw ciFixContextError(job, "check_name_invalid");
+    }
+    const required = [];
+    const seen = new Set();
+    for (const name of [...failing, ...missing]) {
+        if (!seen.has(name)) {
+            seen.add(name);
+            required.push(name);
+        }
+    }
+    if (required.length === 0) {
+        throw ciFixContextError(job, "dispatched_checks_missing");
+    }
+    if (required.length > CI_FIX_MAX_ACTIONABLE_CHECKS) {
+        throw ciFixContextError(job, "too_many_checks");
+    }
+    const headSha = typeof raw.head_sha === "string" ? raw.head_sha.trim().toLowerCase() : "";
+    const repoName = typeof raw.repo_name === "string" ? raw.repo_name.trim() : "";
+    const expectedBranch = typeof raw.expected_branch === "string" ? raw.expected_branch.trim() : "";
+    if (!CI_FIX_HEAD_SHA_RE.test(headSha) || !repoName || !expectedBranch) {
+        // A pre-BAPI-1296 payload carries the check lists without a head binding:
+        // it cannot be proven to describe the checkout this executor will prepare.
+        throw ciFixContextError(job, "identity_missing");
+    }
+    const jobExpectedBranch = typeof job.expected_branch === "string" ? job.expected_branch.trim() : "";
+    if (repoName !== job.repo_name || (jobExpectedBranch && jobExpectedBranch !== expectedBranch)) {
+        throw ciFixContextError(job, "identity_mismatch");
+    }
+    const logExcerpts = readLogExcerpts(raw.log_excerpts, headSha, seen);
+    if (logExcerpts === null) {
+        throw ciFixContextError(job, "log_excerpts_invalid");
+    }
+    return {
+        headSha,
+        repoName,
+        expectedBranch,
+        failingChecks: failing,
+        missingChecks: missing,
+        requiredClaimChecks: required,
+        logExcerpts,
+    };
+}
+function formatCheckList(names, none) {
+    return names.length > 0 ? names.map((name) => `- ${name}`).join("\n") : none;
+}
+function formatLogExcerpts(excerpts) {
+    if (excerpts.status === "unavailable") {
+        return ("UNAVAILABLE — no log excerpt was supplied with this job " +
+            `(reason: ${excerpts.reason}). No log content is provided below or ` +
+            "anywhere else in this prompt. Diagnose from the check names, the code, " +
+            "and local reproduction; do not assume what any log said.");
+    }
+    return excerpts.excerpts
+        .map((e) => `--- check: ${e.check} (source: ${e.source}) ---\n${e.text}`)
+        .join("\n\n");
+}
 /**
  * Explicit "no stale-citation advisory" value (BAPI-722) — never an empty string.
  *
@@ -229,6 +475,21 @@ export async function buildPromptSpecPlaceholderValues(job, spec, context) {
                     : RELATED_CONTEXT_NONE;
                 break;
             }
+            case "FAILING_CHECKS":
+            case "MISSING_CHECKS":
+            case "LOG_EXCERPTS": {
+                // BAPI-1296: only a validated ci_fix dispatch context resolves these.
+                // Any other job type declaring them is a contract failure, and the
+                // repository's required-check configuration is never a source.
+                if (job.job_type !== "ci_fix") {
+                    throw promptContractError(`prompt_spec for job ${job.id} declares ci_fix-only placeholder '${name}'`);
+                }
+                const ci = readCiFixDispatchContext(job);
+                values.FAILING_CHECKS = formatCheckList(ci.failingChecks, "(none — no check was observed failing on the dispatched head)");
+                values.MISSING_CHECKS = formatCheckList(ci.missingChecks, "(none — every required check reported on the dispatched head)");
+                values.LOG_EXCERPTS = formatLogExcerpts(ci.logExcerpts);
+                break;
+            }
             case "SPEC_CITATION_FRESHNESS_WARNING": {
                 // OPTIONAL by contract (BAPI-722): an absent field is the normal case and
                 // resolves to the explicit "none" text, NEVER a thrown contract error and

package/build/executor/provider-checks.js

@@ -0,0 +1,69 @@
+/**
+ * Read-only provider-check helpers shared by the executor's post-push waits
+ * (BAPI-1152, extracted in BAPI-1311).
+ *
+ * `reconcile_overlap` waited on provider CI after its guarded push; BAPI-1311's
+ * focused `rebase` waits on the same evidence after its worker's push. Both need
+ * one poller and one pair of predicates, so they live here rather than being
+ * copied. Everything in this module is READ-ONLY: it polls the Bridge API's
+ * existing `/poll-ci-checks` read and classifies the response. It resets no
+ * worktree, pushes nothing, and decides no gate — the server's completion
+ * verifier stays the authority for both lanes (R14 rule 3).
+ */
+import { pollCiChecksForCommit, resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
+import { allRequiredChecksGreen } from "../conductor/local-merge.js";
+export { allRequiredChecksGreen };
+/** Thrown by a provider-check poller that has no Bridge API access at all. */
+export class ProviderChecksUnobservable extends Error {
+}
+/**
+ * A provider-check poller that resolves Bridge API access once, on first use —
+ * the same read-only CI poll the `merge` job waits on. Without access it throws
+ * {@link ProviderChecksUnobservable}, so a caller can end its wait immediately
+ * rather than sleeping out the job budget on evidence it can never read.
+ */
+export function lazyProviderCheckPoller(accessDeps) {
+    let access;
+    return async (sha) => {
+        if (access === undefined) {
+            const resolved = await resolveConductorBridgeApiAccess(accessDeps);
+            access = resolved.ok ? resolved.access : null;
+        }
+        if (access === null)
+            throw new ProviderChecksUnobservable("bridge api access unavailable");
+        return pollCiChecksForCommit(access, sha);
+    };
+}
+/** Conclusions that PROVE a check failed, as opposed to not having finished. */
+export const FAILED_CHECK_CONCLUSIONS = new Set([
+    "failure",
+    "cancelled",
+    "timed_out",
+    "action_required",
+    "startup_failure",
+    "stale",
+]);
+/**
+ * True when any REQUIRED check reports a conclusion in
+ * {@link FAILED_CHECK_CONCLUSIONS}. A running, queued, or missing check is not a
+ * failure. Envelope-tolerant: `pollCiChecksForCommit` returns
+ * `{available, reason, action, detail}` with the checks under `detail`.
+ */
+export function anyRequiredCheckFailed(pollResponse, required) {
+    if (pollResponse === null || typeof pollResponse !== "object")
+        return false;
+    let obj = pollResponse;
+    const detail = obj.detail;
+    if (detail && typeof detail === "object" && Array.isArray(detail.checks)) {
+        obj = detail;
+    }
+    const checks = Array.isArray(obj.checks) ? obj.checks : [];
+    const wanted = new Set(required);
+    return checks.some((c) => {
+        if (!c || typeof c !== "object")
+            return false;
+        const name = typeof c.name === "string" ? c.name : "";
+        const conclusion = typeof c.conclusion === "string" ? c.conclusion.toLowerCase() : "";
+        return wanted.has(name) && FAILED_CHECK_CONCLUSIONS.has(conclusion);
+    });
+}