@bridge_gpt/mcp-server 0.2.62 → 0.2.65

package/build/executor/job-types.js

@@ -4,8 +4,10 @@
  * Single source of truth for which claimed job types the executor spawns and
  * which of those are RECOVERY jobs. Recovery jobs (`remediate`/`ci_fix`/`rebase`/
  * `reconcile_overlap`) resume the ticket's existing branch/PR rather than cutting
- * a fresh branch off base — the first three through the `/implement-ticket <KEY>
- * --auto` correction loop, `reconcile_overlap` through its own job body. Dispatch
+ * a fresh branch off base — `remediate`/`rebase` through the `/implement-ticket
+ * <KEY> --auto` correction loop, `ci_fix` through its focused prompt spec
+ * (BAPI-1296: never the full recipe), `reconcile_overlap` through its own job
+ * body. Dispatch
  * (`job-runner.ts` `runClaimedJob`), prompt synthesis (`worker-command.ts`
  * `resolveExecutorPrompt`), and worktree reuse (`job-runner.ts` `prepareSpawn` →
  * `worktree.ts` `ensureExecutorWorktree`) all read from here so the recovery /
@@ -22,6 +24,12 @@
  * `reconcile_overlap`). They work on the ticket's EXISTING branch/PR, so the
  * executor reuses that branch instead of cutting a fresh one off base.
  *
+ * BAPI-1296: `ci_fix` stays a recovery job — and an implementation-style job
+ * below — for branch reuse, the worktree lock, and finalization, but prompt
+ * selection no longer follows recovery membership for it: `worker-command.ts`
+ * refuses to synthesize `/implement-ticket` for `ci_fix`, and `job-runner.ts`
+ * renders its server-authored focused prompt spec instead.
+ *
  * BAPI-1152: `reconcile_overlap` is a recovery job for worktree reuse and prompt
  * resolution, but it does NOT re-enter `/implement-ticket`: it always carries an
  * explicit server-rendered `payload.prompt`, which wins over the synthesis in

package/build/executor/preflight.js

@@ -1,8 +1,11 @@
 import { DEFAULT_PROBE_TIMEOUT_MS } from "../agent-capabilities/types.js";
 import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "../agent-launchers/executor-adapter-inspection.js";
 import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
+import { resolveCompletionEvidenceCapability } from "../agent-launchers/executor-adapter.js";
+import { COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY, runtimeMatchesSupported, } from "./completion-contract.js";
 import { resolveExecutorAgentId } from "./agent-identity.js";
 import { resolveAllExecutorApiAccess, resolveBaseUrl, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
+import { FOCUSED_REBASE_CAPABILITY } from "./types.js";
 /**
  * Environment override for the deny probe's headless timeout (BAPI-722).
  *
@@ -80,6 +83,63 @@ export function createDenyProbeCache() {
         },
     };
 }
+/** Bound on a completion-evidence refusal reason (it is logged every cycle). */
+const COMPLETION_REFUSAL_MAX_CHARS = 200;
+/**
+ * BAPI-1301 (D4a) — decide whether this executor may advertise
+ * `completion_evidence.v1`.
+ *
+ * Probes the installed runtime through the adapter's declared probe and compares
+ * it with BOTH the adapter's declared identity and the approved identity the
+ * executor's lifecycle parser was measured against. Every mismatched field is
+ * named in the bounded reason; values are safe by construction (a parsed version
+ * or the `unrecognized` placeholder, closed platform ids, fixed schema names).
+ * Never throws and never produces a fatal finding.
+ */
+export async function evaluateCompletionEvidenceQualification(adapter, deps) {
+    const bounded = (text) => text.slice(0, COMPLETION_REFUSAL_MAX_CHARS);
+    const capability = resolveCompletionEvidenceCapability(adapter);
+    if (!capability.supported) {
+        return { qualified: false, refusal: bounded(capability.reason), runtime: null };
+    }
+    let probed;
+    try {
+        probed = await capability.value.probeRuntime({
+            runCommand: deps.runCommand,
+            platform: deps.platform,
+            // Absent → the adapter's default (`process.arch`); injectable for tests.
+            ...(deps.arch !== undefined ? { arch: deps.arch } : {}),
+        });
+    }
+    catch {
+        probed = null;
+    }
+    if (probed === null) {
+        return { qualified: false, refusal: "runtime identity probe did not run", runtime: null };
+    }
+    const declared = capability.value.runtime;
+    const mismatches = [];
+    for (const key of ["adapter", "cli_version", "platform", "event_schema"]) {
+        if (probed[key] !== declared[key]) {
+            mismatches.push(`${key} ${String(probed[key]).slice(0, 40)} != ${declared[key]}`);
+        }
+    }
+    if (mismatches.length > 0) {
+        return {
+            qualified: false,
+            refusal: bounded(`probed runtime differs from the approved identity: ${mismatches.join("; ")}`),
+            runtime: probed,
+        };
+    }
+    if (!runtimeMatchesSupported(probed)) {
+        return {
+            qualified: false,
+            refusal: "adapter-declared runtime is not the approved completion-evidence runtime",
+            runtime: probed,
+        };
+    }
+    return { qualified: true, refusal: null, runtime: probed };
+}
 /** Fail-fast report shape for a preflight that refused before probing. */
 function refusedPreflight(fatalFindings, warnings, adapter) {
     return {
@@ -346,6 +406,16 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         }
     }
     warnings.push(...adapterInspection.inspection.warnings);
+    // --- Completion-evidence qualification (never fatal, BAPI-1301) --------
+    // Last, and outside `fatalFindings` on purpose: an executor that cannot
+    // supervise required work to completion is still a correct executor for every
+    // other job. It simply omits `completion_evidence.v1` from its claim manifest,
+    // and the server's claim filter keeps covered work away from it. One bounded
+    // line says why, so an operator expecting covered work can see the cause.
+    const completion = await evaluateCompletionEvidenceQualification(adapter, deps);
+    if (!completion.qualified && completion.refusal !== null) {
+        warnings.push(`completion evidence not advertised: ${completion.refusal}`);
+    }
     return {
         ok: fatalFindings.length === 0,
         fatalFindings,
@@ -356,6 +426,9 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         ghAuthed,
         denyEnforced,
         adapter: adapterInspection.inspection,
+        completionEvidenceQualified: completion.qualified,
+        completionEvidenceRefusal: completion.refusal,
+        completionRuntime: completion.runtime,
     };
 }
 /**
@@ -379,6 +452,15 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
  * `undefined`-valued. For the same reason `repo_wide` is never serialized as
  * `false`: `false` is the server's default and means "not an opt-out", so
  * sending it would add a key that carries no information.
+ *
+ * BAPI-1301 (D4a) adds a third optional key, `capabilities`, under the same
+ * rule: `["completion_evidence.v1"]` only when preflight qualified the runtime.
+ *
+ * BAPI-1311 makes `capabilities` ADDITIVE: `focused_rebase.v1` is advertised by
+ * every executor this function builds a manifest for — a manifest is only built
+ * once ordinary preflight permits claiming — independently of completion-evidence
+ * qualification. The completion tokens keep their exact conditional behavior and
+ * order; the focused token is appended after them.
  */
 export function buildClaimManifest(report, options, freeSlots) {
     return {
@@ -392,5 +474,22 @@ export function buildClaimManifest(report, options, freeSlots) {
         disk_free_gb: report.diskFreeGb ?? 0,
         ...(options.epicRunIds !== undefined ? { epic_run_ids: options.epicRunIds } : {}),
         ...(options.repoWide === true ? { repo_wide: true } : {}),
+        // BAPI-1301 (D4a): advertised ONLY when preflight qualified the exact
+        // runtime; otherwise the key is absent (never `[]`), keeping the manifest's
+        // `Object.keys()` shape for every unqualified executor and older server.
+        // BAPI-1302 (D4c): a qualified executor also runs declared checks itself
+        // (`required-verification.ts`), so it advertises that it can claim a job
+        // carrying a required-verification declaration. An older server drops the
+        // unknown token (`normalize_declared_capabilities`), so it is safe to send.
+        // BAPI-1311: the focused-rebase token rides every claiming manifest, after
+        // any completion tokens. It is NOT a completion-evidence statement — rebase is
+        // not a covered job type — so it never waits on that qualification. An older
+        // server drops the unknown token (`normalize_declared_capabilities`).
+        capabilities: [
+            ...(report.completionEvidenceQualified === true
+                ? [COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY]
+                : []),
+            FOCUSED_REBASE_CAPABILITY,
+        ],
     };
 }