@bridge_gpt/mcp-server 0.2.65 → 0.2.66

package/build/executor/job-runner.js

@@ -42,7 +42,7 @@ import { sendTerminalMutationWithRetry } from "./terminal-mutation.js";
 import { removeStaleVerdictArtifacts } from "./stale-artifacts.js";
 import { stripWorkerEnvFiles } from "./env-file-guard.js";
 import { isVerdictJobType, readVerdictArtifact } from "./verdict-artifact.js";
-import { createWorkerLogTee, closeWorkerLogTee, distinctWorkerLogSessionIds, formatWorkerLogSessionInvariantWarning, teeAsyncIterable, } from "./worker-log.js";
+import { createWorkerLogClaimId, createWorkerLogTee, closeWorkerLogTee, distinctWorkerLogSessionIds, formatWorkerLogSessionInvariantWarning, teeAsyncIterable, } from "./worker-log.js";
 import { acquireExecutorWorktreeLock, } from "./worktree-lock.js";
 import { resolveExecutorStateDir, activateJobLog, deactivateJobLog, registerExecutorJobLog, markExecutorJobLogFinished, } from "./job-log-registry.js";
 import { executorViewerTabsEnabled, openExecutorViewerTab } from "./viewer-tabs.js";
@@ -56,8 +56,10 @@ import { FOCUSED_REBASE_JOB_TYPE, focusedRebaseContextError, hasFocusedRebaseCon
 import { ensureExecutorWorktree, finalizeRetainedExecutorWorktree, } from "./worktree.js";
 import { buildPrBaseContractLaunchInstruction } from "../pr-base-contract.js";
 import { CI_FIX_JOB_TYPE, resolveExecutorPrompt, resolveWorkerPermissionPosture, } from "./worker-command.js";
+import { CORRECTION_INTENT_CAPABILITY, isRemainingWork, validateCorrectionIntent, } from "./correction-dispatch.js";
 import { collectGitTelemetry, collectRemoteTrackingSha, createMcpSurfaceObserver, evaluatePreSpawnGitVerification, formatWorkerRateLimitAdvisory, normalizeMcpServerNames, } from "./observation.js";
 import { TERMINAL_CAPACITY_PROTOCOL_VERSIONS, TERMINAL_CAPACITY_RUNTIME_CONTRACTS, TERMINAL_CAPACITY_RUNTIMES, } from "./types.js";
+import { probeInstalledCorrectionHook } from "./preflight.js";
 import { isRecognizedServerName, MCP_SERVER_NAME } from "../mcp-identity.js";
 /**
  * Bound on the pre-spawn git tracked-file lookup (BAPI-1104, R81).
@@ -174,6 +176,9 @@ function buildJobLogRegistryDeps(deps) {
         env: deps.env,
         tmpdir: () => os.tmpdir(),
         platform: deps.platform,
+        // BAPI-1330: atomic temp-file + rename replacement when the host has it.
+        ...(deps.rename ? { rename: deps.rename } : {}),
+        errorLog: deps.errorLog,
     };
 }
 /**
@@ -651,6 +656,23 @@ async function sendTerminalMutationWithAuthReport(params, job, control) {
  * `/executor/jobs`. Integration actions are NOT ordinary executor jobs.
  */
 export async function runIntegrationCorrectionSpawn(job, httpClient, options, deps, driver, seams = {}, control) {
+    const validated = validateCorrectionIntent(job.payload?.correction_intent, {
+        repo_name: job.repo_name,
+        epic_run_id: job.epic_run_id ?? null,
+        ticket_key: job.ticket_key ?? null,
+        expected_branch: job.expected_branch,
+        expected_head_sha: job.expected_head_sha,
+    });
+    if (!validated.ok || validated.intent.kind !== "integration_correction" ||
+        (validated.ok && validated.intent.context_ref.action_id !==
+            job.payload?.integration_action_id)) {
+        const reason = validated.ok ? "correction_contract_invalid" : validated.code;
+        await httpClient.fail(job, {
+            error_kind: "ContractError.CorrectionLegacy",
+            error_message: reason, classification: "crashed",
+        });
+        return { status: "failed", reason };
+    }
     const { ownership, observation } = createJobRunState(options, deps);
     return runSpawnJob(job, httpClient, options, deps, ownership, observation, seams, control, driver);
 }
@@ -1175,7 +1197,20 @@ async function superviseDriverPhase(params) {
         collectTelemetry: params.collectTelemetry,
         control: params.control,
     });
-    await Promise.race([flow.settled, params.deps.sleep(DRIVER_PHASE_SETTLE_MAX_MS)]);
+    let settleTimer;
+    try {
+        await Promise.race([
+            flow.settled,
+            new Promise((resolve) => {
+                settleTimer = params.deps.setTimer(resolve, DRIVER_PHASE_SETTLE_MAX_MS);
+            }),
+        ]);
+    }
+    finally {
+        // A normal phase must not leave its four-minute bound alive after it settles.
+        if (settleTimer !== undefined)
+            params.deps.clearTimer(settleTimer);
+    }
     if (procResult.serverStopRequested)
         return { kind: "server_stop" };
     if (params.ownership.abandoned)
@@ -1323,10 +1358,56 @@ async function ensureJobWorktree(job, options, deps, seams, policy) {
     }
 }
 async function prepareSpawn(job, httpClient, options, deps, seams) {
+    // A continuation passes no local head here (`head === undefined`): its retained
+    // worktree was already proven by `prepareRetainedContinuationWorktree` →
+    // `verifyContinuationHeadLineage`, which refuses before spawn unless HEAD
+    // descends from `continuation.bound_head_sha` — the same head as
+    // `correction_intent.head_sha`, including one the server derived for a first
+    // attempt with no bound ticket head (BAPI-1344). The spawn source is always
+    // that retained worktree, never an origin checkout.
+    const refuseCorrectionDrift = async (branch, head) => {
+        if (!isRemainingWork(job.job_type, job.payload))
+            return null;
+        const intent = job.payload?.correction_intent;
+        if (branch === intent.branch && (head === undefined || head === intent.head_sha))
+            return null;
+        const reason = "correction_context_missing";
+        await httpClient.fail(job, {
+            error_kind: "ContractError.CorrectionLegacy",
+            error_message: reason,
+            classification: "crashed",
+        });
+        return { ok: false, result: { status: "failed", reason } };
+    };
+    if (isRemainingWork(job.job_type, job.payload)) {
+        const intent = validateCorrectionIntent(job.payload?.correction_intent, {
+            repo_name: job.repo_name,
+            epic_run_id: job.epic_run_id ?? null,
+            ticket_key: job.ticket_key ?? null,
+            expected_branch: job.expected_branch,
+            expected_head_sha: job.expected_head_sha,
+        });
+        const reason = !intent.ok
+            ? intent.code
+            : !job.required_capabilities?.includes(CORRECTION_INTENT_CAPABILITY)
+                ? "correction_contract_invalid"
+                : null;
+        if (reason !== null) {
+            await httpClient.fail(job, {
+                error_kind: "ContractError.CorrectionLegacy",
+                error_message: reason,
+                classification: "crashed",
+            });
+            return { ok: false, result: { status: "failed", reason } };
+        }
+    }
     if (job.job_type === "resume") {
         const prepareResume = seams.prepareResumeSpawn ?? prepareResumeSpawn;
         try {
             const prepared = await prepareResume(job, options, buildResumeSeams(deps, options));
+            const drift = await refuseCorrectionDrift(prepared.branch);
+            if (drift)
+                return drift;
             return {
                 ok: true,
                 worktreePath: prepared.worktreePath,
@@ -1386,6 +1467,9 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
             await httpClient.fail(job, jobWorktreeFailure(wt));
             return { ok: false, result: { status: "failed", reason: "worktree_create_failed" } };
         }
+        const drift = await refuseCorrectionDrift(wt.branch, readContinuationBinding(job) ? undefined : wt.expectedHeadSha);
+        if (drift)
+            return drift;
         return {
             ok: true,
             worktreePath: wt.worktreePath,
@@ -1466,6 +1550,9 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
         await httpClient.fail(job, jobWorktreeFailure(wt));
         return { ok: false, result: { status: "failed", reason: "worktree_create_failed" } };
     }
+    const drift = await refuseCorrectionDrift(wt.branch, readContinuationBinding(job) ? undefined : wt.expectedHeadSha);
+    if (drift)
+        return drift;
     // Explicit/synthesized prompt wins verbatim, preserving existing behavior.
     // BAPI-1311: for a focused rebase that explicit prompt IS the validated
     // server-rendered prompt (`validateFocusedRebaseContext` required it).
@@ -1724,6 +1811,34 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
  * adds no second worktree entry and no second worker launcher.
  */
 driver) {
+    // A server-owned read precedes every worktree reset/cut and worker launch.
+    // Only this boundary can authorize a no-charge pre-work wait; a later plan
+    // retrieval failure is ordinary bounded worker failure.
+    if (job.epic_run_id && (httpClient.scopeReadiness ||
+        job.required_capabilities?.includes("scope_wait.v1"))) {
+        if (!httpClient.scopeReadiness) {
+            await httpClient.fail(job, {
+                error_kind: "ContractError.ScopeReadiness",
+                error_message: "Required pre-work scope protocol is unavailable.",
+                classification: "crashed",
+            });
+            return { status: "failed", reason: "scope_readiness_unsupported" };
+        }
+        try {
+            const readiness = await httpClient.scopeReadiness(job);
+            if (readiness.decision !== "ready") {
+                return { status: "failed", reason: `scope_${readiness.decision}` };
+            }
+        }
+        catch {
+            await httpClient.fail(job, {
+                error_kind: "ScopeReadinessUnavailable",
+                error_message: "Server scope readiness could not be confirmed.",
+                classification: "crashed",
+            });
+            return { status: "failed", reason: "scope_readiness_unavailable" };
+        }
+    }
     // --- Per-job base branch (BAPI-586) ----------------------------------
     // Resolve the effective logical base BEFORE any side effect: the persisted
     // run base (`payload.base_branch`) is authoritative, falling back to the
@@ -1824,11 +1939,12 @@ driver) {
     // --- Worktree mutual exclusion (FAIL-CLOSED, BAPI-793) ----------------
     // The FIRST thing that happens once a canonical worktree path exists, and
     // ahead of every executor-owned write to it: the deny layer, MCP
-    // provisioning, the `worker.log` truncation, the viewer tab, and the spawn
-    // itself all live inside the lock. `worker.log` in particular is created with
-    // an empty write, so a refused contender that got as far as the tee would
-    // erase the running worker's forensic log without ever spawning — which is
-    // why refusal returns from HERE rather than anywhere downstream.
+    // provisioning, the attempt log allocation, the viewer tab, and the spawn
+    // itself all live inside the lock. Before BAPI-1330 the shared `worker.log`
+    // was created with a truncating write, so a refused contender that got as far
+    // as the tee could erase the running worker's forensic log; per-attempt logs
+    // are now created exclusively, and refusal still returns from HERE rather
+    // than anywhere downstream.
     //
     // Known residual window, stated rather than papered over: `prepareSpawn`
     // above already ran `ensureWorktree`, which hard-resets and cleans the tree.
@@ -2114,6 +2230,12 @@ async function runPreparedSpawn(params) {
     // safety margin but must not kill a job. Refusing to CLAIM on unenforced deny
     // remains a separate, fatal preflight concern.
     const denyCapability = adapter.denyEnforcement;
+    const correctionWork = isRemainingWork(job.job_type, job.payload);
+    let correctionDenyInstalled = false;
+    const correctionHookBinPath = denyCapability?.supported === true
+        ? (seams.resolveWorkerGuardBinPath ??
+            (() => defaultResolveBinPath(WORKER_GUARD_BIN_FILENAME)))()
+        : "";
     if (denyCapability?.supported === true) {
         const deny = await denyCapability.value.provisionWorktreeDenyLayer({
             worktreePath,
@@ -2125,8 +2247,8 @@ async function runPreparedSpawn(params) {
             // "is this push destination mine?" by comparing against it, so a value the
             // payload could influence would let a job nominate its own safe branch.
             workerBranch: branch,
-            workerGuardHookBinPath: (seams.resolveWorkerGuardBinPath ??
-                (() => defaultResolveBinPath(WORKER_GUARD_BIN_FILENAME)))(),
+            ...(correctionWork ? { correctionIntentVersion: 1 } : {}),
+            workerGuardHookBinPath: correctionHookBinPath,
         });
         // Log on WARNING PRESENCE, not on `!ok` (BAPI-815/R2). The git-exclude
         // hygiene step can degrade without failing the deny layer — present-but-
@@ -2138,6 +2260,40 @@ async function runPreparedSpawn(params) {
         // fail-OPEN and the job continues to the spawn boundary.
         if (deny.warning)
             deps.errorLog(deny.warning);
+        correctionDenyInstalled = deny.ok;
+    }
+    if (correctionWork && !correctionDenyInstalled) {
+        await httpClient.fail(job, {
+            error_kind: "ContractError.CorrectionLegacy",
+            error_message: "correction_contract_invalid",
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "correction_hook_unavailable" };
+    }
+    if (correctionWork) {
+        let hookQualified = false;
+        try {
+            if (seams.verifyInstalledCorrectionHook) {
+                hookQualified = await seams.verifyInstalledCorrectionHook(worktreePath, correctionHookBinPath);
+            }
+            else {
+                const settings = await deps.readFile(`${worktreePath}/.claude/settings.local.json`);
+                hookQualified = settings.includes(correctionHookBinPath) &&
+                    settings.includes("--correction-intent-version 1") &&
+                    probeInstalledCorrectionHook(worktreePath, correctionHookBinPath);
+            }
+        }
+        catch {
+            hookQualified = false;
+        }
+        if (!hookQualified) {
+            await httpClient.fail(job, {
+                error_kind: "ContractError.CorrectionLegacy",
+                error_message: "correction_contract_invalid",
+                classification: "crashed",
+            });
+            return { status: "failed", reason: "correction_hook_unverified" };
+        }
     }
     // --- MCP registration + trust pre-approval (fail-open, BAPI-724) -----
     // Unconditional for every job type that reaches this shared spawn path
@@ -2187,28 +2343,45 @@ async function runPreparedSpawn(params) {
     }
     const mcpContract = registration.contract;
     // --- Worker log tee + watch registry + viewer tab (BAPI-535 §8) ------
+    // BAPI-1330: ONE attempt identity — the server's job id and attempt number
+    // plus a claim id minted here — names this attempt's log file, its registry
+    // entry, and its active-log key. It is allocated BEFORE the tee exists, the
+    // file is created exclusively, and every terminal branch below finishes and
+    // deactivates exactly this identity, so no later claim of the same job (a
+    // retry, a reclaim, a reused worktree) can overwrite or be confused with it.
     const registryDeps = buildJobLogRegistryDeps(deps);
     const markFinished = seams.markExecutorJobLogFinished ?? markExecutorJobLogFinished;
     const createTee = seams.createWorkerLogTee ?? createWorkerLogTee;
-    let tee = null;
+    let logClaimId = null;
     try {
-        tee = await createTee(worktreePath, {
-            mkdir: deps.mkdir,
-            writeFile: deps.writeFile,
-            appendFile: deps.appendFile,
-            platform: deps.platform,
-            // BAPI-1021 (AC-6): the archive seams. All optional on `ExecutorDeps`
-            // already, so this is source-compatible with every existing deps
-            // builder — archival simply does not run when either is absent.
-            rename: deps.rename,
-            stat: deps.stat,
-            now: deps.now,
-            errorLog: deps.errorLog,
-        });
+        logClaimId = (seams.createWorkerLogClaimId ?? createWorkerLogClaimId)();
     }
     catch {
-        tee = null;
+        logClaimId = null;
+    }
+    let tee = null;
+    if (logClaimId !== null) {
+        try {
+            tee = await createTee(worktreePath, {
+                mkdir: deps.mkdir,
+                writeFile: deps.writeFile,
+                appendFile: deps.appendFile,
+                writeFileExclusive: deps.writeFileExclusive,
+                stat: deps.stat,
+                platform: deps.platform,
+                errorLog: deps.errorLog,
+            }, { jobId: job.id, attempt: job.attempt_count, claimId: logClaimId });
+        }
+        catch {
+            tee = null;
+        }
+    }
+    if (tee === null) {
+        // A logging failure never changes the worker's disposition; it only means
+        // this attempt has no transcript, which is said once, without detail.
+        deps.errorLog(`worker log unavailable for job ${job.id} (allocation_failed); the attempt continues.`);
     }
+    const teeClaimId = tee?.identity.claimId;
     // BAPI-828 — idempotent worker-log closure, defined the moment a tee could
     // exist. Every terminal branch below calls this instead of `closeWorkerLogTee`
     // directly, and `runSpawnJob`'s `finally` calls it once more as a backstop for
@@ -2221,8 +2394,10 @@ async function runPreparedSpawn(params) {
             return;
         workerLogClosed = true;
         // Deactivate FIRST: once the tee is closing, an append from the suspend
-        // diagnostic would be writing to a log nobody is reading any more.
-        deactivateJobLog(job.id);
+        // diagnostic would be writing to a log nobody is reading any more. Only
+        // THIS attempt's entry is removed (BAPI-1330).
+        if (teeClaimId !== undefined)
+            deactivateJobLog(job.id, teeClaimId);
         await closeWorkerLogTee(tee);
     };
     lifecycle.closeWorkerLog = closeWorkerLog;
@@ -2233,7 +2408,9 @@ async function runPreparedSpawn(params) {
         // visibility nicety for a separate `executor watch` process), and chaining
         // the active marker to it would mean a failed registry write silently
         // disables suspend annotation for a worker whose tee is perfectly healthy.
-        activateJobLog(job.id, tee.logPath);
+        // BAPI-1330: an attempt whose file could not be allocated is never active.
+        if (tee.available)
+            activateJobLog(job.id, tee.logPath, tee.identity.claimId);
         const registerLog = seams.registerExecutorJobLog ?? registerExecutorJobLog;
         try {
             await registerLog({
@@ -2244,12 +2421,17 @@ async function runPreparedSpawn(params) {
                 worktree_path: worktreePath,
                 log_path: tee.logPath,
                 started_at: nowIso(deps),
+                attempt: tee.identity.attempt,
+                claim_id: tee.identity.claimId,
+                availability: tee.available ? "available" : "unavailable",
+                ...(tee.unavailableReason ? { unavailable_reason: tee.unavailableReason } : {}),
             }, registryDeps);
         }
         catch {
             /* registry is a visibility nicety — never fail the job */
+            deps.errorLog(`executor job-log registry: could not record job ${job.id}'s attempt log (non-fatal)`);
         }
-        if (executorViewerTabsEnabled(deps.platform, deps.env)) {
+        if (tee.available && executorViewerTabsEnabled(deps.platform, deps.env)) {
             const openViewer = seams.openExecutorViewerTab ?? openExecutorViewerTab;
             try {
                 const viewer = await openViewer({
@@ -2273,11 +2455,21 @@ async function runPreparedSpawn(params) {
     const finalizeRegistry = async () => {
         if (!tee)
             return;
+        const finishing = tee;
         try {
-            await markFinished(job.id, nowIso(deps), registryDeps);
+            // BAPI-1330: stamps only THIS attempt's entry, and records a transcript
+            // that became incomplete mid-run as unavailable rather than leaving a
+            // reader to trust it.
+            await markFinished(job.id, finishing.identity.claimId, nowIso(deps), registryDeps, finishing.available
+                ? {}
+                : {
+                    availability: "unavailable",
+                    ...(finishing.unavailableReason ? { unavailable_reason: finishing.unavailableReason } : {}),
+                });
         }
         catch {
             /* non-fatal */
+            deps.errorLog(`executor job-log registry: could not finish job ${job.id}'s attempt log (non-fatal)`);
         }
     };
     // --- Spawn -----------------------------------------------------------
@@ -2337,6 +2529,7 @@ async function runPreparedSpawn(params) {
             // denies every `git push` the worker attempts — the worker has no remote
             // write authority at all.
             ...(driver?.omitWorkerBranch ? {} : { workerBranch: branch }),
+            ...(correctionWork ? { correctionIntentVersion: 1 } : {}),
             ...(driverStep ? { declaredTouchedFiles: driverStep.declaredTouchedFiles } : {}),
             parentEnv: deps.env,
         });
@@ -2902,6 +3095,9 @@ async function runPreparedSpawn(params) {
                 kind: "fail",
                 send: () => httpClient.fail(job, {
                     ...finalization.failure,
+                    // BAPI-1330: the process's observed exit rides beside the
+                    // finalization failure; it is never rewritten to look like a crash.
+                    ...observedExitCode(procResult.exitCode),
                     ...commitResidue(git),
                     telemetry: observation.snapshot(),
                 }),
@@ -3016,6 +3212,7 @@ async function runPreparedSpawn(params) {
                 ? CLAUDE_NOT_AUTHENTICATED_MESSAGE
                 : `worker exited (${procResult.classification}, exit_code=${procResult.exitCode})`,
             classification: toWireClassification(procResult.classification),
+            ...observedExitCode(procResult.exitCode),
             ...commitResidue(git),
             telemetry: observation.snapshot(),
             ...(capacityEvidence !== undefined ? { capacity_evidence: capacityEvidence } : {}),
@@ -3037,6 +3234,16 @@ const INITIAL_PROMPT_WRITE_BOUND_MS = 30_000;
 /** Bound on closing the held stdin once the closure rule fires. */
 const STDIN_CLOSE_BOUND_MS = 5_000;
 const SUPPORTED_COMPLETION_MARKER = COMPLETION_CONTRACT_MARKER_VALUES[0];
+/**
+ * BAPI-1330 — the worker's observed exit code as a `/fail` field. Omitted (never
+ * null, never invented) when the process ended without a usable code, e.g. on a
+ * signal. Only ever read from the process result, never from worker output.
+ */
+function observedExitCode(exitCode) {
+    return typeof exitCode === "number" && Number.isInteger(exitCode) && exitCode >= 0
+        ? { exit_code: exitCode }
+        : {};
+}
 /**
  * Whether this claim runs under the covered completion contract.
  *
@@ -3604,6 +3811,7 @@ async function runCoveredAttempt(params) {
                 ? CLAUDE_NOT_AUTHENTICATED_MESSAGE
                 : `worker exited (${procResult.classification}, exit_code=${procResult.exitCode})`,
             classification: toWireClassification(procResult.classification),
+            ...observedExitCode(procResult.exitCode),
         }, envelope, capacityEvidence !== undefined ? { capacity_evidence: capacityEvidence } : {}));
     }
     // --- Phase 3: independent declared checks (BAPI-1302, D4c) ---------------------
@@ -3734,6 +3942,9 @@ async function runCoveredAttempt(params) {
         runCommand: deps.runCommand,
         headSha: git.last_commit_sha,
         expectedBaseBranch: effectiveBaseBranch,
+        // BAPI-1330: this host only runs claims the SERVER stamped as covered, so
+        // the existence-only legacy fallback is refused here.
+        coveredAttempt: true,
     });
     const facts = finalizationFacts(finalization.ok ? { ok: true } : { ok: false, errorKind: finalization.failure.error_kind });
     const envelope = envelopeWith({
@@ -3775,19 +3986,35 @@ async function runCoveredAttempt(params) {
     // Not a success. A completion cause (required work, cleanup, verification,
     // permission) outranks the finalization kind; with none, finalization keeps
     // its existing error kind and recovery lane.
+    //
+    // BAPI-1330: every branch below is reached only after the worker exited
+    // cleanly. A completion refusal reports that observed process fact —
+    // `clean_exit` and the real exit code — beside the refusal (the server decides
+    // it from the envelope's completion cause, never the classification). A
+    // finalization failure adds the exit code to its own kind and classification.
+    const observedExit = {
+        classification: toWireClassification(procResult.classification),
+        ...observedExitCode(procResult.exitCode),
+    };
     const cause = envelope.cause;
     if (cause) {
         return finish(await failWith({
             error_kind: COMPLETION_CAUSE_ERROR_KINDS[cause],
             error_message: `covered attempt did not prove completion (${successRefusalReason(envelope) ?? cause})`,
-            classification: "crashed",
+            ...observedExit,
         }, envelope));
     }
-    if (!finalization.ok)
-        return finish(await failWith(finalization.failure, envelope));
+    if (!finalization.ok) {
+        // The finalization failure keeps its OWN classification, exactly as the
+        // legacy path does: the kinds that mean "the process ended cleanly"
+        // (`PrNotAttached`, `PublicationUnverified`) already say `clean_exit`, and
+        // the rest keep the classification their existing recovery routing reads.
+        // Only the observed exit code is added.
+        return finish(await failWith({ ...finalization.failure, ...observedExitCode(procResult.exitCode) }, envelope));
+    }
     return finish(await failWith({
         error_kind: COMPLETION_CAUSE_ERROR_KINDS.required_work_incomplete,
         error_message: `covered attempt did not prove completion (${successRefusalReason(envelope) ?? "unknown"})`,
-        classification: "crashed",
+        ...observedExit,
     }, envelope));
 }

package/build/executor/job-types.js

@@ -4,10 +4,8 @@
  * Single source of truth for which claimed job types the executor spawns and
  * which of those are RECOVERY jobs. Recovery jobs (`remediate`/`ci_fix`/`rebase`/
  * `reconcile_overlap`) resume the ticket's existing branch/PR rather than cutting
- * a fresh branch off base — `remediate`/`rebase` through the `/implement-ticket
- * <KEY> --auto` correction loop, `ci_fix` through its focused prompt spec
- * (BAPI-1296: never the full recipe), `reconcile_overlap` through its own job
- * body. Dispatch
+ * a fresh branch off base. Each recovery worker requires a versioned focused
+ * correction intent; `ci_fix` also uses its focused prompt spec. Dispatch
  * (`job-runner.ts` `runClaimedJob`), prompt synthesis (`worker-command.ts`
  * `resolveExecutorPrompt`), and worktree reuse (`job-runner.ts` `prepareSpawn` →
  * `worktree.ts` `ensureExecutorWorktree`) all read from here so the recovery /
@@ -24,16 +22,13 @@
  * `reconcile_overlap`). They work on the ticket's EXISTING branch/PR, so the
  * executor reuses that branch instead of cutting a fresh one off base.
  *
- * BAPI-1296: `ci_fix` stays a recovery job — and an implementation-style job
- * below — for branch reuse, the worktree lock, and finalization, but prompt
- * selection no longer follows recovery membership for it: `worker-command.ts`
- * refuses to synthesize `/implement-ticket` for `ci_fix`, and `job-runner.ts`
- * renders its server-authored focused prompt spec instead.
+ * `ci_fix` stays a recovery job for branch reuse, the worktree lock, and
+ * finalization. `job-runner.ts` renders its server-authored focused prompt spec
+ * after the correction intent is validated.
  *
- * BAPI-1152: `reconcile_overlap` is a recovery job for worktree reuse and prompt
- * resolution, but it does NOT re-enter `/implement-ticket`: it always carries an
- * explicit server-rendered `payload.prompt`, which wins over the synthesis in
- * `worker-command.ts`, and `job-runner.ts` dispatches it to its own body.
+ * `reconcile_overlap` is a recovery job for worktree reuse and prompt
+ * resolution. Its server-rendered focused prompt is available only after
+ * validating the correction intent, and `job-runner.ts` dispatches its body.
  *
  * BAPI-1160: `ci_rerun` is DELIBERATELY ABSENT from this set and from
  * `SPAWN_JOB_TYPES` below. It is a deterministic actuator — one bounded

package/build/executor/preflight.js

@@ -4,8 +4,14 @@ import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter
 import { resolveCompletionEvidenceCapability } from "../agent-launchers/executor-adapter.js";
 import { COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY, runtimeMatchesSupported, } from "./completion-contract.js";
 import { resolveExecutorAgentId } from "./agent-identity.js";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { defaultResolveBinPath } from "../start-tickets-conductor.js";
+import { CORRECTION_INTENT_CAPABILITY } from "./correction-dispatch.js";
 import { resolveAllExecutorApiAccess, resolveBaseUrl, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
-import { FOCUSED_REBASE_CAPABILITY } from "./types.js";
+import { FOCUSED_REBASE_CAPABILITY, SCOPE_WAIT_CAPABILITY } from "./types.js";
 /**
  * Environment override for the deny probe's headless timeout (BAPI-722).
  *
@@ -154,6 +160,62 @@ function refusedPreflight(fatalFindings, warnings, adapter) {
         adapter,
     };
 }
+const CORRECTION_HOOK_FIXTURE_ID = "correction-entry-nested-v1";
+/** Exercise the packaged hook process, including a nested-agent entry attempt. */
+export function probeInstalledCorrectionHook(worktreePath, binPath = defaultResolveBinPath("worker-guard-hook-bin.js")) {
+    const args = [binPath, "--worktree-root", worktreePath,
+        "--correction-intent-version", "1"];
+    const env = { ...process.env, BAPI_CORRECTION_INTENT_VERSION: "1" };
+    const fixtures = [
+        { payload: { tool_name: "Skill", tool_input: { skill: "bridge-implement-ticket" } }, status: 2 },
+        { payload: { tool_name: "Task", tool_input: { prompt: "/implement-ticket BAPI-1 --auto" } }, status: 2 },
+        { payload: { tool_name: "Read", tool_input: { file_path: "commands/src/implement-ticket.md" } }, status: 2 },
+        { payload: { tool_name: "mcp__bridge_api__request_plan_generation", tool_input: {} }, status: 2 },
+        { payload: { tool_name: "mcp__bridge_api__get_plan", tool_input: { ticket_number: "BAPI-1" } }, status: 0 },
+    ];
+    return fixtures.every(({ payload, status }) => {
+        const result = spawnSync(process.execPath, args, {
+            input: JSON.stringify(payload), encoding: "utf8", env, timeout: 5000,
+        });
+        return result.error === undefined && result.status === status;
+    });
+}
+export async function qualifyCorrectionIntentRuntime(adapter, deps, probeHook = probeInstalledCorrectionHook) {
+    if (adapter.identity.strategyId !== "claude-strict-mcp-v1" ||
+        adapter.denyEnforcement?.supported !== true || !deps.writeFile || !deps.mkdir) {
+        return { qualified: false, evidence: null };
+    }
+    const worktree = await (deps.mkdtemp ?? mkdtemp)(join((deps.tmpdir ?? tmpdir)(), "bridge-correction-hook-"));
+    try {
+        const bin = defaultResolveBinPath("worker-guard-hook-bin.js");
+        const installed = await adapter.denyEnforcement.value.provisionWorktreeDenyLayer({
+            worktreePath: worktree, baseBranch: "main", homedir: deps.homedir(),
+            workerBranch: "feature/probe", workerGuardHookBinPath: bin,
+            correctionIntentVersion: 1,
+        });
+        const settings = await deps.readFile(join(worktree, ".claude", "settings.local.json"));
+        const hookInstalled = installed.ok && settings.includes(bin) &&
+            settings.includes("--correction-intent-version 1") && settings.includes("PreToolUse");
+        const nestedDenial = hookInstalled && probeHook(worktree, bin);
+        return {
+            qualified: hookInstalled && nestedDenial,
+            evidence: {
+                version: 1, hook_installed: hookInstalled, nested_denial: nestedDenial,
+                fixture_id: CORRECTION_HOOK_FIXTURE_ID,
+                runtime: `${adapter.identity.adapterId}:${process.version}`,
+            },
+        };
+    }
+    catch {
+        return { qualified: false, evidence: null };
+    }
+    finally {
+        if (deps.rmRecursive)
+            await deps.rmRecursive(worktree);
+        else
+            await rm(worktree, { recursive: true, force: true });
+    }
+}
 /**
  * Collect the executor preflight report. Populates the manifest fields and
  * accumulates fatal findings — the runner refuses to claim when any exist.
@@ -176,7 +238,15 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
             // preflight's own injected `readFile` keeps the inspection hermetic in
             // tests and read-only in production — the adapter never opens a file
             // handle this module did not hand it.
-            claude: { readFile: deps.readFile },
+            claude: {
+                readFile: deps.readFile,
+                ...(deps.writeFile && deps.mkdir ? {
+                    denyProvisioningDeps: {
+                        readFile: deps.readFile, writeFile: deps.writeFile,
+                        mkdir: deps.mkdir, homedir: deps.homedir,
+                    },
+                } : {}),
+            },
         }));
     const resolution = resolveAdapter(agentId);
     if (!resolution.supported) {
@@ -416,6 +486,20 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     if (!completion.qualified && completion.refusal !== null) {
         warnings.push(`completion evidence not advertised: ${completion.refusal}`);
     }
+    let correction = {
+        qualified: false, evidence: null,
+    };
+    if (fatalFindings.length === 0) {
+        try {
+            correction = await qualifyCorrectionIntentRuntime(adapter, deps);
+        }
+        catch {
+            correction = { qualified: false, evidence: null };
+        }
+    }
+    if (!correction.qualified) {
+        warnings.push("correction intent not advertised: installed nested hook unverified");
+    }
     return {
         ok: fatalFindings.length === 0,
         fatalFindings,
@@ -429,6 +513,8 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         completionEvidenceQualified: completion.qualified,
         completionEvidenceRefusal: completion.refusal,
         completionRuntime: completion.runtime,
+        correctionIntentQualified: correction.qualified,
+        correctionQualificationEvidence: correction.evidence,
     };
 }
 /**
@@ -490,6 +576,9 @@ export function buildClaimManifest(report, options, freeSlots) {
                 ? [COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY]
                 : []),
             FOCUSED_REBASE_CAPABILITY,
+            SCOPE_WAIT_CAPABILITY,
+            ...(report.correctionIntentQualified === true ? [CORRECTION_INTENT_CAPABILITY] : []),
+            ...(report.correctionIntentQualified === true ? ["ci_evidence.v1"] : []),
         ],
     };
 }