@bridge_gpt/mcp-server 0.2.60 → 0.2.65

package/build/executor/rebase-finalization.js

@@ -0,0 +1,351 @@
+/**
+ * Focused merge-stage conflict repair: context validation and the supervised
+ * post-push wait (BAPI-1311).
+ *
+ * Before BAPI-1311 a `merging`-gate `rebase` re-ran the whole `/implement-ticket`
+ * recipe, and its worker also owned the post-push CI wait. A check that was still
+ * running when that wait ended turned a completed repair into a failed attempt,
+ * which the gate then answered with ANOTHER full repair.
+ *
+ * This module holds the two executor halves of the replacement:
+ *
+ * 1. {@link validateFocusedRebaseContext} — the narrow boundary validator for the
+ *    server's versioned `payload.focused_rebase` context. It runs at claimed-job
+ *    entry, before any worktree effect. A malformed context is REFUSED by name; it
+ *    is never reinterpreted as a legacy rebase and never downgraded to the full
+ *    recipe.
+ * 2. {@link waitForFocusedRebase} — after the worker exited cleanly and
+ *    finalization PROVED its push landed, wait for the evidence the server's
+ *    completion verifier will read: the same open pull request, at the exact
+ *    pushed head, on the expected head branch and base, mergeable, with every
+ *    effective required check green at that head. Every read and sleep is bounded
+ *    by the claim's remaining absolute deadline and abort signal.
+ *
+ * The wait READS; it never acts. It launches no worker, enqueues nothing, resets
+ * nothing, and pushes nothing. `ready` is permission to submit `/complete` once,
+ * not a gate verdict: the server re-reads the provider and may still refuse (R14
+ * rule 3).
+ */
+import { ExecutorNamedError, FocusedRebaseContext } from "./job-errors.js";
+import { allRequiredChecksGreen, anyRequiredCheckFailed, ProviderChecksUnobservable, } from "./provider-checks.js";
+import { FOCUSED_REBASE_CAPABILITY, FOCUSED_REBASE_CONTEXT_VERSION, } from "./types.js";
+/** The job type the focused context is valid on. */
+export const FOCUSED_REBASE_JOB_TYPE = "rebase";
+/** The payload key the server writes the context under. */
+export const FOCUSED_REBASE_PAYLOAD_KEY = "focused_rebase";
+/**
+ * Bounds shared with the server (`focused_rebase_dispatch.py`). Over-bound input
+ * is refused, never truncated: a truncated identity is a different identity.
+ */
+export const FOCUSED_REBASE_IDENTITY_MAX_CHARS = 255;
+export const FOCUSED_REBASE_MAX_REQUIRED_CHECKS = 64;
+export const FOCUSED_REBASE_CHECK_NAME_MAX_CHARS = 200;
+/**
+ * Time reserved at the end of the job for the one terminal report, mirroring the
+ * overlap lane's `CI_WAIT_MARGIN_MS` precedent. Clamped to half the remaining
+ * time, so a repair that finishes close to its deadline still gets one bounded
+ * look at the evidence instead of none.
+ */
+export const FOCUSED_REBASE_REPORT_MARGIN_MS = 90_000;
+/** Poll cadence while evidence is pending. */
+export const FOCUSED_REBASE_POLL_INTERVAL_MS = 30_000;
+/** Cap on any single provider read, before the deadline clamp. */
+export const FOCUSED_REBASE_READ_MAX_MS = 60_000;
+/** Does this claimed job carry a focused context at all? (Presence, not validity.) */
+export function hasFocusedRebaseContext(job) {
+    const payload = job.payload;
+    if (!payload || typeof payload !== "object")
+        return false;
+    const raw = payload[FOCUSED_REBASE_PAYLOAD_KEY];
+    return raw !== undefined && raw !== null;
+}
+/** The named refusal the runner reports for an invalid focused context. */
+export function focusedRebaseContextError(job, reason) {
+    return new ExecutorNamedError(FocusedRebaseContext, `rebase job ${job.id} refused before worker effects (reason=${reason})`);
+}
+function identity(value) {
+    if (typeof value !== "string")
+        return null;
+    const text = value.trim();
+    if (text.length === 0 || text.length > FOCUSED_REBASE_IDENTITY_MAX_CHARS)
+        return null;
+    if (/[\r\n\0]/.test(text))
+        return null;
+    return text;
+}
+function positiveInt(value) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
+}
+function checkList(value) {
+    if (!Array.isArray(value) || value.length > FOCUSED_REBASE_MAX_REQUIRED_CHECKS)
+        return null;
+    const out = [];
+    for (const item of value) {
+        if (typeof item !== "string" ||
+            item.trim().length === 0 ||
+            item.length > FOCUSED_REBASE_CHECK_NAME_MAX_CHARS ||
+            /[\n\0]/.test(item)) {
+            return null;
+        }
+        out.push(item);
+    }
+    return out;
+}
+const CHECK_SOURCES = ["policy", "plan", "none"];
+/**
+ * Validate `payload.focused_rebase` against the CLAIMED job, before any effect.
+ *
+ * Every identity the context binds must equal what the claim itself carries:
+ * run, ticket, repository, and branch against the claim's top-level fields; the
+ * attempt, pull request, base, and required checks against the payload fields
+ * the server wrote beside the context (the completion verifier reads the payload
+ * copies, so a disagreement would make the executor wait on one set while the
+ * server verifies another). The claim must also REQUIRE the focused capability,
+ * which is what kept an executor unable to honor the context from claiming it.
+ *
+ * Nothing is coerced and nothing falls back: a conflicting value is a refusal,
+ * not a choice between the two.
+ */
+export function validateFocusedRebaseContext(job) {
+    const fail = (reason) => ({ ok: false, reason });
+    if (job.job_type !== FOCUSED_REBASE_JOB_TYPE)
+        return fail("not_rebase_job");
+    const payload = job.payload && typeof job.payload === "object" ? job.payload : {};
+    const raw = payload[FOCUSED_REBASE_PAYLOAD_KEY];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return fail("context_not_object");
+    const ctx = raw;
+    if (ctx.version !== FOCUSED_REBASE_CONTEXT_VERSION)
+        return fail("version_unsupported");
+    const required = Array.isArray(job.required_capabilities) ? job.required_capabilities : [];
+    if (!required.includes(FOCUSED_REBASE_CAPABILITY))
+        return fail("capability_not_required");
+    const prompt = payload.prompt;
+    if (typeof prompt !== "string" || prompt.trim().length === 0)
+        return fail("prompt_missing");
+    const epicRunId = identity(ctx.epic_run_id);
+    const dedupKey = identity(ctx.dedup_key);
+    const ticketKey = identity(ctx.ticket_key);
+    const repoName = identity(ctx.repo_name);
+    const workBranch = identity(ctx.work_branch);
+    const attempt = positiveInt(ctx.attempt);
+    if (epicRunId === null ||
+        dedupKey === null ||
+        ticketKey === null ||
+        repoName === null ||
+        workBranch === null ||
+        attempt === null) {
+        return fail("identity_malformed");
+    }
+    if (epicRunId !== (typeof job.epic_run_id === "string" ? job.epic_run_id.trim() : null)) {
+        return fail("run_mismatch");
+    }
+    if (ticketKey !== (typeof job.ticket_key === "string" ? job.ticket_key.trim() : null)) {
+        return fail("ticket_mismatch");
+    }
+    if (repoName !== job.repo_name.trim())
+        return fail("repository_mismatch");
+    if (workBranch !== (typeof job.expected_branch === "string" ? job.expected_branch.trim() : null)) {
+        return fail("branch_mismatch");
+    }
+    if (!dedupKey.includes(ticketKey) || attempt !== payload.attempt) {
+        return fail("job_identity_mismatch");
+    }
+    const prNumber = positiveInt(ctx.pr_number);
+    if (prNumber === null)
+        return fail("pr_malformed");
+    if (prNumber !== payload.pr_number)
+        return fail("pr_mismatch");
+    let baseBranch = null;
+    if (ctx.base_branch !== null) {
+        baseBranch = identity(ctx.base_branch);
+        if (baseBranch === null)
+            return fail("identity_malformed");
+    }
+    const payloadBase = typeof payload.base_branch === "string" ? payload.base_branch.trim() : null;
+    if (baseBranch !== payloadBase)
+        return fail("base_mismatch");
+    const checks = checkList(ctx.required_checks);
+    const source = ctx.required_checks_source;
+    if (checks === null ||
+        typeof source !== "string" ||
+        !CHECK_SOURCES.includes(source) ||
+        (source === "none" && checks.length > 0)) {
+        return fail("required_checks_malformed");
+    }
+    const payloadChecks = payload.required_checks;
+    if (!Array.isArray(payloadChecks) ||
+        payloadChecks.length !== checks.length ||
+        !checks.every((name, i) => payloadChecks[i] === name)) {
+        return fail("required_checks_mismatch");
+    }
+    return {
+        ok: true,
+        context: {
+            version: FOCUSED_REBASE_CONTEXT_VERSION,
+            epicRunId,
+            dedupKey,
+            attempt,
+            ticketKey,
+            repoName,
+            workBranch,
+            prNumber,
+            baseBranch,
+            requiredChecks: checks,
+            requiredChecksSource: source,
+            prompt,
+        },
+    };
+}
+/** A promise that rejects when `signal` aborts or `ms` elapses, whichever first. */
+function boundedRace(work, ms, signal) {
+    if (signal.aborted)
+        return Promise.resolve("aborted");
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            resolve(value);
+        };
+        const onAbort = () => finish("aborted");
+        const timer = setTimeout(() => finish("timeout"), Math.max(0, ms));
+        signal.addEventListener("abort", onAbort, { once: true });
+        work.then((value) => finish(value), (err) => {
+            if (err instanceof ProviderChecksUnobservable) {
+                finish(err);
+                return;
+            }
+            finish("timeout");
+        });
+    });
+}
+/**
+ * Wait for the focused repair's current-head evidence under the original claim
+ * deadline. Never throws for a provider problem; every read failure is PENDING.
+ *
+ * `ready` requires, in one iteration: the SAME open pull request (by number), at
+ * the exact pushed head, on the bound work branch, targeting the expected base,
+ * reading `MERGEABLE`, and every effective required check green AT THAT HEAD. An
+ * explicitly empty server-derived check set is satisfied vacuously, but only once
+ * every pull-request condition holds.
+ *
+ * Proven failures stop at once: a required check concluded red, the pull request
+ * closed or reads `CONFLICTING`, or its number, head, head branch, or base moved.
+ * Running or missing checks, `UNKNOWN` mergeability, and unavailable reads stay
+ * pending while time remains. When the deadline (less the report margin) arrives
+ * first, the outcome is an UNVERIFIED stop naming what was still missing — never
+ * a red-CI claim.
+ */
+export async function waitForFocusedRebase(input) {
+    const started = input.now();
+    const elapsed = () => Math.max(0, input.now() - started);
+    const remainingAtStart = Math.max(0, input.deadlineMs - started);
+    const margin = Math.min(input.reportMarginMs ?? FOCUSED_REBASE_REPORT_MARGIN_MS, Math.floor(remainingAtStart / 2));
+    const waitUntil = input.deadlineMs - margin;
+    const budget = () => Math.max(0, waitUntil - input.now());
+    const readMax = input.readMaxMs ?? FOCUSED_REBASE_READ_MAX_MS;
+    const interval = input.pollIntervalMs ?? FOCUSED_REBASE_POLL_INTERVAL_MS;
+    const pushed = input.pushedHeadSha.trim().toLowerCase();
+    const ctx = input.context;
+    const ids = `job=${input.jobId} ticket=${ctx.ticketKey} pr=#${ctx.prNumber} branch=${ctx.workBranch} ` +
+        `head=${pushed.slice(0, 12)} base=${input.expectedBaseBranch}`;
+    const secs = () => `${Math.round(elapsed() / 1000)}s`;
+    let lastPending = null;
+    const observe = async () => {
+        const prRead = await boundedRace(input.readPullRequest(Math.min(readMax, budget())), Math.min(readMax, budget()), input.signal);
+        if (prRead === "aborted" || prRead === "timeout") {
+            return prRead === "aborted" ? "aborted" : { kind: "pending", reason: "pr_unavailable" };
+        }
+        if (prRead instanceof ProviderChecksUnobservable)
+            return { kind: "pending", reason: "pr_unavailable" };
+        const pr = prRead;
+        if (!pr.available)
+            return { kind: "pending", reason: "pr_unavailable" };
+        if (pr.number !== ctx.prNumber)
+            return { kind: "stopped", reason: "pr_identity_changed" };
+        if (pr.state === null)
+            return { kind: "pending", reason: "pr_unavailable" };
+        if (pr.state !== "OPEN")
+            return { kind: "stopped", reason: "pr_closed" };
+        if (pr.headRefOid !== pushed)
+            return { kind: "stopped", reason: "head_changed" };
+        if (pr.headRefName !== ctx.workBranch)
+            return { kind: "stopped", reason: "head_branch_changed" };
+        if (pr.baseRefName !== input.expectedBaseBranch)
+            return { kind: "stopped", reason: "base_changed" };
+        if (pr.mergeable === "conflicting")
+            return { kind: "stopped", reason: "pr_not_mergeable" };
+        if (pr.mergeable !== "mergeable")
+            return { kind: "pending", reason: "mergeability_computing" };
+        if (ctx.requiredChecks.length === 0)
+            return { kind: "ready", ciVacuous: true };
+        if (budget() <= 0)
+            return "timeout";
+        const poll = await boundedRace(input.pollChecks(pushed), Math.min(readMax, budget()), input.signal);
+        if (poll === "aborted")
+            return "aborted";
+        if (poll instanceof ProviderChecksUnobservable)
+            return { kind: "unobservable" };
+        if (poll === "timeout" || poll === undefined || poll === null) {
+            return { kind: "pending", reason: "checks_unavailable" };
+        }
+        if (anyRequiredCheckFailed(poll, ctx.requiredChecks))
+            return { kind: "stopped", reason: "required_check_failed" };
+        if (allRequiredChecksGreen(poll, ctx.requiredChecks))
+            return { kind: "ready", ciVacuous: false };
+        return { kind: "pending", reason: "checks_pending" };
+    };
+    const unverifiedReason = () => {
+        if (lastPending === "checks_pending")
+            return "checks_still_pending";
+        if (lastPending === "mergeability_computing")
+            return "mergeability_still_computing";
+        return "evidence_unavailable";
+    };
+    for (;;) {
+        if (input.signal.aborted)
+            return { kind: "cancelled", elapsedMs: elapsed() };
+        if (budget() <= 0) {
+            const reason = unverifiedReason();
+            input.errorLog(`[executor] Stopped: ${reason === "evidence_unavailable" ? "evidence unavailable" : reason} at the job ` +
+                `deadline — pushed work preserved; the repair is UNVERIFIED, not failed CI; ${ids}; elapsed=${secs()}`);
+            return { kind: "stopped", proven: false, reason, elapsedMs: elapsed() };
+        }
+        const reading = await observe();
+        if (reading === "aborted")
+            return { kind: "cancelled", elapsedMs: elapsed() };
+        if (reading === "timeout")
+            continue;
+        if (reading.kind === "ready") {
+            input.errorLog(`[executor] Ready: focused rebase evidence current — pushed work at the pull request head is mergeable ` +
+                `and ${reading.ciVacuous ? "no required checks are configured (vacuous CI)" : "every required check is green"}; ` +
+                `submitting completion once; ${ids}; elapsed=${secs()}`);
+            return { kind: "ready", ciVacuous: reading.ciVacuous, elapsedMs: elapsed() };
+        }
+        if (reading.kind === "stopped") {
+            input.errorLog(`[executor] Stopped: ${reading.reason} — pushed work preserved, no further repair launched; ${ids}; elapsed=${secs()}`);
+            return { kind: "stopped", proven: true, reason: reading.reason, elapsedMs: elapsed() };
+        }
+        if (reading.kind === "unobservable") {
+            input.errorLog(`[executor] Stopped: checks_unobservable — this executor has no Bridge API access to read required ` +
+                `checks; pushed work preserved; the repair is UNVERIFIED; ${ids}; elapsed=${secs()}`);
+            return { kind: "stopped", proven: false, reason: "checks_unobservable", elapsedMs: elapsed() };
+        }
+        // Pending: log once per distinct reason so a long wait stays bounded in stderr.
+        if (reading.reason !== lastPending) {
+            input.errorLog(`[executor] Waiting for mergeability/required checks (${reading.reason}) — pushed work preserved; the ` +
+                `executor supervises this wait and will not launch another worker; ${ids}; elapsed=${secs()}`);
+        }
+        lastPending = reading.reason;
+        const pause = Math.min(interval, budget());
+        if (pause > 0) {
+            const slept = await boundedRace(input.sleep(pause), pause + 1_000, input.signal);
+            if (slept === "aborted")
+                return { kind: "cancelled", elapsedMs: elapsed() };
+        }
+    }
+}

package/build/executor/reconcile-overlap-job.js

@@ -39,13 +39,16 @@
  * refuses the push is reported as `ReconcileOverlapPushUnauthorized`.
  */
 import path from "node:path";
-import { pollCiChecksForCommit, resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
 import { normalizeRepoRelativePath } from "../conductor/file-scope-guard.js";
-import { allRequiredChecksGreen } from "../conductor/local-merge.js";
+// BAPI-1311: the read-only poller and predicates moved to `provider-checks.ts` so
+// the focused rebase wait shares them; re-exported here for existing importers.
+import { allRequiredChecksGreen, anyRequiredCheckFailed, lazyProviderCheckPoller, ProviderChecksUnobservable, } from "./provider-checks.js";
+export { lazyProviderCheckPoller, ProviderChecksUnobservable };
 import { buildExecutorBaseWorkerEnv } from "./env.js";
 import { ReconcileOverlapBranchMismatch, ReconcileOverlapConflictsUnresolved, ReconcileOverlapMergeFailed, ReconcileOverlapNothingToMerge, ReconcileOverlapPayload as ReconcileOverlapPayloadInvalid, ReconcileOverlapPushRejected, ReconcileOverlapPushUnauthorized, ReconcileOverlapTopologyRefused, ReconcileOverlapVerificationRed, ReconcileOverlapWorkerRewroteHistory, } from "./job-errors.js";
 import { classifyMergeTree } from "./merge-tree-classifier.js";
 import { RECONCILE_OVERLAP_PAYLOAD_SCHEMA_VERSION, } from "./reconcile-overlap-types.js";
+import { runRequiredVerificationCommands } from "./required-verification.js";
 import { validateWorkerFinalization } from "./worker-finalization.js";
 export const RECONCILE_OVERLAP_JOB_TYPE = "reconcile_overlap";
 /** Result-envelope bounds, mirrored from the server's result model. */
@@ -88,14 +91,6 @@ const WRAPPER_STAGE_EXCLUDES = [
     ":(exclude).claude/settings.local.json",
 ];
 const SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
-const FAILED_CHECK_CONCLUSIONS = new Set([
-    "failure",
-    "cancelled",
-    "timed_out",
-    "action_required",
-    "startup_failure",
-    "stale",
-]);
 const PUSH_AUTH_FAILURE_RE = /authentication failed|could not read username|permission denied|terminal prompts disabled|invalid username or password|returned error: 403|requested url returned error: 401/i;
 const PUSH_LEASE_FAILURE_RE = /stale info|\[rejected\]|non-fast-forward|fetch first/i;
 class PayloadError extends Error {
@@ -259,28 +254,6 @@ export function validateReconcileOverlapPayload(job) {
 /** Thrown between steps when the supervising phase has been aborted. */
 export class ReconcileOverlapAborted extends Error {
 }
-/** Thrown by a provider-check poller that has no Bridge API access at all. */
-export class ProviderChecksUnobservable extends Error {
-}
-/**
- * A provider-check poller that resolves Bridge API access once, on first use —
- * the same read-only CI poll the `merge` job waits on. Without access it throws
- * {@link ProviderChecksUnobservable}, and the wait ends immediately rather than
- * sleeping out the job budget; the server's completion contract then reads the
- * checks itself.
- */
-export function lazyProviderCheckPoller(accessDeps) {
-    let access;
-    return async (sha) => {
-        if (access === undefined) {
-            const resolved = await resolveConductorBridgeApiAccess(accessDeps);
-            access = resolved.ok ? resolved.access : null;
-        }
-        if (access === null)
-            throw new ProviderChecksUnobservable("bridge api access unavailable");
-        return pollCiChecksForCommit(access, sha);
-    };
-}
 function bounded(text, max) {
     if (text.length <= max)
         return text;
@@ -290,6 +263,18 @@ function bounded(text, max) {
 function tail(text) {
     return text.length <= COMMAND_OUTPUT_TAIL_CHARS ? text : "…" + text.slice(-COMMAND_OUTPUT_TAIL_CHARS);
 }
+/**
+ * The overlap result contract's conclusion for each shared-core outcome. The
+ * vocabulary is this lane's own and predates BAPI-1302; it does not change.
+ */
+const OVERLAP_CONCLUSIONS = {
+    exited_zero: "success",
+    exited_nonzero: "failure",
+    timed_out: "timed_out",
+    launch_error: "error",
+    cancelled: "error",
+    not_run: "not_run",
+};
 /** The deduplicated union of both tickets' commands, child first. */
 export function verificationCommandUnion(child, peer) {
     const seen = new Set();
@@ -329,24 +314,6 @@ export function buildReconcileEnvelope(payload, facts, extra = {}) {
     }
     return envelope;
 }
-function anyRequiredCheckFailed(pollResponse, required) {
-    if (pollResponse === null || typeof pollResponse !== "object")
-        return false;
-    let obj = pollResponse;
-    const detail = obj.detail;
-    if (detail && typeof detail === "object" && Array.isArray(detail.checks)) {
-        obj = detail;
-    }
-    const checks = Array.isArray(obj.checks) ? obj.checks : [];
-    const wanted = new Set(required);
-    return checks.some((c) => {
-        if (!c || typeof c !== "object")
-            return false;
-        const name = typeof c.name === "string" ? c.name : "";
-        const conclusion = typeof c.conclusion === "string" ? c.conclusion.toLowerCase() : "";
-        return wanted.has(name) && FAILED_CHECK_CONCLUSIONS.has(conclusion);
-    });
-}
 // ---------------------------------------------------------------------------
 // The driver
 // ---------------------------------------------------------------------------
@@ -469,43 +436,69 @@ export function createReconcileOverlapDriver(job, payload, seams) {
         }
         return lines.join("\n");
     };
-    /** Run the union of local verification commands. Never a provider check. */
+    /**
+     * Run the union of local verification commands. Never a provider check.
+     *
+     * BAPI-1302: the subprocess work goes through the shared list-based core in
+     * `required-verification.ts`. Everything that is overlap POLICY stays here:
+     * the child/peer union and its order, the `CI_WAIT_MARGIN_MS` reservation,
+     * running every command even after one fails or times out, the conclusion
+     * vocabulary its result contract reports, and the worker environment passed
+     * explicitly on every check. The launch seam keeps this lane's historical
+     * `runCommand` behavior, including its elapsed-time timeout reading.
+     */
     const runVerification = async (ctx) => {
-        const runs = [];
-        for (const command of commands) {
-            if (ctx.signal.aborted)
-                throw new ReconcileOverlapAborted("reconciliation phase aborted");
-            const budget = Math.min(command.timeoutSeconds * 1000, ctx.remainingMs() - CI_WAIT_MARGIN_MS);
-            let conclusion;
-            let output = "";
-            if (budget <= 0) {
-                conclusion = "not_run";
+        if (ctx.signal.aborted)
+            throw new ReconcileOverlapAborted("reconciliation phase aborted");
+        const launch = async (request) => {
+            const [file, ...args] = request.argv;
+            const started = seams.now();
+            try {
+                const result = await seams.runCommand(file, args, {
+                    cwd: request.cwd,
+                    timeoutMs: request.timeoutMs,
+                    // The SAME secret-free environment a worker gets, including the
+                    // sentinel database target: a verification command can no more reach
+                    // the operator's real database than a worker can.
+                    env: request.env,
+                });
+                const output = `${result.stdout}\n${result.stderr}`;
+                if (result.exitCode === 0)
+                    return { outcome: { kind: "exited", exitCode: 0 }, output };
+                return seams.now() - started >= request.timeoutMs - 50
+                    ? { outcome: { kind: "timed_out" }, output }
+                    : { outcome: { kind: "exited", exitCode: result.exitCode }, output };
             }
-            else {
-                const started = seams.now();
-                try {
-                    const [file, ...args] = command.argv;
-                    const result = await seams.runCommand(file, args, {
-                        cwd: ctx.worktreePath,
-                        timeoutMs: budget,
-                        // The SAME secret-free environment a worker gets, including the
-                        // sentinel database target: a verification command can no more reach
-                        // the operator's real database than a worker can.
-                        env: workerEnv,
-                    });
-                    output = `${result.stdout}\n${result.stderr}`;
-                    if (result.exitCode === 0)
-                        conclusion = "success";
-                    else
-                        conclusion = seams.now() - started >= budget - 50 ? "timed_out" : "failure";
-                }
-                catch {
-                    conclusion = "error";
-                }
+            catch {
+                return { outcome: { kind: "launch_error" } };
             }
-            const observation = { name: command.name, conclusion };
-            facts.checks.set(command.name, conclusion);
-            runs.push({ observation, green: conclusion === "success", output });
+        };
+        const { facts: runFacts } = await runRequiredVerificationCommands({
+            commands: commands.map((command, position) => ({
+                identity: `overlap-${position}`,
+                position,
+                name: command.name,
+                argv: command.argv,
+                timeoutSeconds: command.timeoutSeconds,
+            })),
+            worktreePath: ctx.worktreePath,
+            env: workerEnv,
+            launch,
+            now: seams.now,
+            // The overlap lane keeps its CI margin: checks may use only what is left
+            // after reserving the post-push CI wait.
+            deadlineAtMs: seams.now() + ctx.remainingMs() - CI_WAIT_MARGIN_MS,
+            signal: ctx.signal,
+            onInterruption: "continue",
+        });
+        if (ctx.signal.aborted)
+            throw new ReconcileOverlapAborted("reconciliation phase aborted");
+        const runs = [];
+        for (const fact of runFacts) {
+            const conclusion = OVERLAP_CONCLUSIONS[fact.outcome];
+            const observation = { name: fact.name, conclusion };
+            facts.checks.set(fact.name, conclusion);
+            runs.push({ observation, green: conclusion === "success", output: fact.output });
         }
         return runs;
     };