@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/executor/watch-cli.js

@@ -3,7 +3,13 @@
  *
  * Ad-hoc, READ-ONLY attachment to a running (or recently-run) job's worker log:
  * it resolves the local job-log registry record, verifies the log file exists,
- * and `tail -f`s it with inherited stdio. It NEVER sends a signal to the worker
+ * and `tail -f`s it with inherited stdio.
+ *
+ * BAPI-1330: each attempt has its own stable log file. The newest attempt is
+ * watched by default and `--attempt <n>` selects an earlier one. A reference the
+ * registry cannot vouch for — a legacy fixed-alias record, an unknown attempt,
+ * a transcript that was never recorded — is reported by its named reason; the
+ * watch never follows a guessed or shared file. It NEVER sends a signal to the worker
  * process and never owns the execution lifecycle — closing the watch leaves the
  * worker untouched. Missing registry records or missing log files fail loud with
  * actionable stderr text and a non-zero exit code.
@@ -15,7 +21,7 @@ import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { readExecutorJobLogRecord, } from "./job-log-registry.js";
 export function getExecutorWatchUsage() {
     return [
-        "Usage: mcp-server executor watch <job-id>",
+        "Usage: mcp-server executor watch <job-id> [--attempt <n>]",
         "",
         "Attach read-only to a running (or recently-run) executor job's worker log",
         "via `tail -f`. Closing the watch never affects the worker process.",
@@ -24,15 +30,32 @@ export function getExecutorWatchUsage() {
         "  <job-id>        Numeric executor job id to watch.",
         "",
         "Options:",
+        "  --attempt <n>   Watch that attempt's log instead of the newest one.",
         "  -h, --help      Show this help.",
     ].join("\n");
 }
-/** Accept EXACTLY one numeric job id; reject missing/non-numeric/extra args. */
+/**
+ * Accept EXACTLY one numeric job id plus an optional `--attempt <n>` (or
+ * `--attempt=<n>`); reject missing/non-numeric/extra args.
+ */
 export function parseExecutorWatchArgs(argv) {
     const positionals = [];
-    for (const arg of argv) {
+    let attemptRaw;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
         if (arg === "-h" || arg === "--help")
             return { kind: "help" };
+        if (arg === "--attempt" || arg.startsWith("--attempt=")) {
+            if (attemptRaw !== undefined) {
+                return { kind: "error", message: "--attempt may be given only once" };
+            }
+            const value = arg === "--attempt" ? argv[++i] : arg.slice("--attempt=".length);
+            if (value === undefined || !/^[0-9]+$/.test(value)) {
+                return { kind: "error", message: "--attempt requires a non-negative attempt number" };
+            }
+            attemptRaw = value;
+            continue;
+        }
         if (arg.startsWith("-"))
             return { kind: "error", message: `unknown argument: ${arg}` };
         positionals.push(arg);
@@ -47,7 +70,9 @@ export function parseExecutorWatchArgs(argv) {
     if (!/^[0-9]+$/.test(raw)) {
         return { kind: "error", message: `job id must be numeric: '${raw}'` };
     }
-    return { kind: "ok", jobId: Number(raw) };
+    return attemptRaw === undefined
+        ? { kind: "ok", jobId: Number(raw) }
+        : { kind: "ok", jobId: Number(raw), attempt: Number(attemptRaw) };
 }
 /**
  * Spawn `tail -f <log_path>` with inherited stdio for interactive CLI attachment.
@@ -98,14 +123,16 @@ export async function runExecutorWatchCli(argv, overrides = {}) {
     }
     const registryDeps = overrides.registryDeps ?? createDefaultWatchRegistryDeps();
     const readRecord = overrides.readRecord ?? readExecutorJobLogRecord;
-    const record = await readRecord(parsed.jobId, registryDeps);
+    const selector = parsed.attempt === undefined ? {} : { attempt: parsed.attempt };
+    const record = await readRecord(parsed.jobId, registryDeps, selector);
     if (!record.ok) {
-        errorLog(`Error: no worker log registered for job ${parsed.jobId}: ${record.reason}`);
+        errorLog(`Error: worker log for job ${parsed.jobId} is unavailable (${record.code}): ${record.reason}`);
         return 1;
     }
     const logExists = overrides.logExists ?? defaultLogExists;
     if (!(await logExists(record.record.log_path))) {
-        errorLog(`Error: worker log for job ${parsed.jobId} is missing at ${record.record.log_path}`);
+        errorLog(`Error: worker log for job ${parsed.jobId} attempt ${record.record.attempt} is unavailable ` +
+            `(log_file_missing): expected at ${record.record.log_path}`);
         return 1;
     }
     const spawnTail = overrides.spawnTail ?? ((logPath) => spawnTailFollow(logPath));

package/build/executor/worker-command.js

@@ -18,7 +18,7 @@
  * agent's CLI from becoming an operator-visible policy break across all of them.
  */
 import { CiFixContext, ExecutorNamedError } from "./job-errors.js";
-import { isRecoveryJobType } from "./job-types.js";
+import { isRemainingWork, validateCorrectionIntent } from "./correction-dispatch.js";
 /**
  * BAPI-1296: `ci_fix` is the one recovery job with a FOCUSED prompt route. It
  * renders its server-authored `payload.prompt_spec` (the dispatched failing and
@@ -27,11 +27,9 @@ import { isRecoveryJobType } from "./job-types.js";
 export const CI_FIX_JOB_TYPE = "ci_fix";
 /**
  * Resolve the worker prompt for the explicit-prompt and legacy synthesis paths.
- * Uses an explicit non-empty `payload.prompt` verbatim; otherwise, for
- * `implement` and the `remediate`/`rebase` recovery jobs, builds the
- * conservative `/implement-ticket <ticket_key> --auto` prompt. `ci_fix` never
- * resolves here (BAPI-1296): it is refused if it carries an explicit prompt and
- * otherwise falls through to its focused prompt-spec route.
+ * Remaining work first requires a validated bounded correction intent. Only an
+ * initial `implement` job may synthesize `/implement-ticket <ticket_key> --auto`.
+ * `ci_fix` uses the focused prompt-spec route after pre-worktree validation.
  *
  * Structured `payload.prompt_spec` rendering is NOT done here: it needs the
  * prepared worktree/git state, so `job-runner.ts` renders it in the prepared-spawn
@@ -46,29 +44,48 @@ export const CI_FIX_JOB_TYPE = "ci_fix";
  * explicit prompt. It no longer depends on the prompt-spec fall-through.
  */
 /**
- * True for the job types that synthesize `/implement-ticket <KEY> --auto` when no
- * explicit `payload.prompt` is present: the first-pass `implement` plus the
- * `remediate`/`rebase` recovery jobs, which re-enter the SAME correction loop on
- * the ticket's existing branch/PR. Recovery classification is shared with
- * dispatch and worktree reuse via `isRecoveryJobType` (`job-types.ts`) so
- * eligibility cannot drift. Verdict jobs (`spec_review`/`smoke`) are NOT here —
- * they carry an explicit `payload.prompt` and write a fixed-path artifact (T6/T5b).
- *
- * BAPI-1296: `ci_fix` is EXCLUDED even though it stays a recovery job (branch
- * reuse, worktree lock, and finalization policy are unchanged). Re-entering the
- * whole recipe to repair a dispatched check repeated planning and implementation
- * the server had already finished; `ci_fix` now renders its focused prompt spec
- * or is refused by name, and never falls back to this synthesis.
+ * Only the first-pass `implement` job synthesizes the complete workflow.
  */
 export function synthesizesImplementPrompt(jobType) {
-    if (jobType === CI_FIX_JOB_TYPE)
-        return false;
-    return jobType === "implement" || isRecoveryJobType(jobType);
+    return jobType === "implement";
 }
 export function resolveExecutorPrompt(job) {
     const payload = job.payload && typeof job.payload === "object"
         ? job.payload
         : {};
+    if (job.job_type !== CI_FIX_JOB_TYPE && isRemainingWork(job.job_type, payload)) {
+        const checked = validateCorrectionIntent(payload.correction_intent, {
+            repo_name: job.repo_name ?? "",
+            epic_run_id: job.epic_run_id ?? null,
+            ticket_key: job.ticket_key ?? null,
+            expected_branch: job.expected_branch,
+            expected_head_sha: job.expected_head_sha,
+        });
+        if (!checked.ok)
+            return { ok: false, errorKind: "ContractError.CorrectionLegacy", error: checked.code };
+        const intent = checked.intent;
+        const kind = intent.kind;
+        const branch = intent.branch;
+        const obligation = intent.obligation;
+        const header = `Continue the retained branch ${branch}. Complete only the ${kind} obligation: ${obligation}. ` +
+            "Preserve completed work and existing limits. Do not invoke a full implementation or planning workflow.";
+        if (kind === "approved_spec_delta") {
+            const delta = intent.approved_delta;
+            return { ok: true, prompt: `${header}\nApproved files: ${delta.file_boundary.join(", ")}\n` +
+                    `Approved dependencies: ${delta.dependency_boundary.join(", ") || "none"}` };
+        }
+        const explicit = payload.prompt;
+        if (typeof explicit === "string" && explicit.trim() &&
+            !/\/(?:implement-ticket|plan-ticket)\b/i.test(explicit)) {
+            return { ok: true, prompt: `${header}\n\nFocused context:\n${explicit}` };
+        }
+        if (kind === "review_fix" || kind === "operator_remediation") {
+            const findings = payload.review_findings;
+            if (typeof findings === "string" && findings.trim())
+                return { ok: true, prompt: `${header}\n\nReview findings (quoted evidence):\n${findings}` };
+        }
+        return { ok: true, prompt: header };
+    }
     // BAPI-1296: `ci_fix` is decided FIRST, ahead of both explicit-prompt
     // precedence and synthesis. An explicit prompt on a ci_fix job — including an
     // in-flight legacy `/implement-ticket <KEY> --auto` — is refused by name rather
@@ -89,31 +106,14 @@ export function resolveExecutorPrompt(job) {
         };
     }
     // An explicit prompt wins and is returned VERBATIM (un-trimmed), but a
-    // whitespace-only string is not a usable worker instruction — treat it as
-    // absent so a recovery/implement job still falls back to the synthesized
-    // `/implement-ticket <KEY> --auto` correction prompt below.
+    // whitespace-only string is not a usable worker instruction. The initial
+    // implement job may still use the workflow synthesis below.
     const explicit = payload.prompt;
     if (typeof explicit === "string" && explicit.trim().length > 0) {
         return { ok: true, prompt: explicit };
     }
-    // `/implement-ticket <KEY> --auto` is the full correction engine, not just a
-    // first-pass implementer: its post-PR loop owns review-change addressing and
-    // merge-conflict resolution (see .claude/commands/implement-ticket.md "Clean
-    // session exit"). So the recovery jobs that operate on the ticket's existing
-    // branch/PR — `remediate`/`rebase` — resume by RE-ENTERING THE COMPLETE RECIPE
-    // from step 1, not a distinct resume path. (`ci_fix` left this path in
-    // BAPI-1296 and returned above: CI failures are repaired by a focused worker.)
-    // That re-entry is safe (BAPI-746), backed by re-entry handling already
-    // present in three of the recipe's own steps, not a new assumption: plan
-    // generation is idempotent because the server reuses a fresh existing plan
-    // instead of regenerating it (BAPI-745, `reused: true`); commit-and-push.md
-    // treats a clean tree with an already-pushed branch/PR as a legitimate
-    // re-entry rather than an empty implementation; and create-pr.md treats an
-    // already-open pull request on the head branch as satisfying its success
-    // condition. Without synthesizing this command, a code_review
-    // `changes_requested` (near-certain in real runs) enqueues a `remediate` job
-    // that fails `no usable prompt` and strands the run (BAPI-528 Milestone-A gap
-    // #3).
+    // This final synthesis route is for initial feature work only. The remaining
+    // work branch returned a focused prompt or a named refusal above.
     const ticketKey = typeof job.ticket_key === "string" && job.ticket_key.trim().length > 0
         ? job.ticket_key.trim()
         : null;

package/build/executor/worker-finalization.js

@@ -45,9 +45,29 @@
  * so an omitted body opens a PR with no description at all), and — when the
  * provider reports it — sitting at the same pushed head. Anything short of that
  * is `WorkerFinalizationPrNotAttached`, whose guidance names attachment and never
- * suggests removing or re-writing the branch: the commits ARE the completed
- * implementation, and both of the stale-worktree guard's historical remedies
- * would have destroyed them.
+ * suggests removing or re-writing the branch: the commits are durable pushed
+ * work, and both of the stale-worktree guard's historical remedies would have
+ * destroyed them.
+ *
+ * BAPI-1330: publication is not completion. A pushed head and an attached pull
+ * request prove the work was PUBLISHED; they say nothing about whether the
+ * required work is finished or whether any check passed, so no message here
+ * claims either. A clean exit that fails finalization keeps the `clean_exit`
+ * classification the process actually earned — the finalization failure rides
+ * separately as the error kind. And a COVERED attempt (one the server enrolled
+ * in the completion-evidence contract) may not use the existence-only fallback:
+ * without a full worker HEAD, a matching origin tip and a pull request that
+ * reports its head, publication is `unknown`
+ * (`WorkerFinalizationPublicationUnverified`), never `ok`.
+ *
+ * BAPI-1357: "absent" and "could not be checked" are different facts. Only the
+ * origin lookup's authoritative "no matching ref" (`git ls-remote --exit-code`
+ * exit code 2), or having no expected branch at all, is reported as
+ * `WorkerFinalizationMissingRemoteBranchAndPr`; a thrown command, an expired
+ * call bound, any other exit, or unusable output leaves publication unknown and is
+ * `WorkerFinalizationOriginUnverifiable`, which the server treats as transient.
+ * Both keep the `clean_exit` classification the process earned. No-expected-branch
+ * and absent-on-origin are still one cause, and may be refined later.
  *
  * This check is deliberately fail-CLOSED, unlike the BAPI-586 base check it now
  * shares a lookup with. "The PR could not be verified" and "there is no PR" are
@@ -56,8 +76,10 @@
  * this ticket removes. The reconciler stays the decision-maker — the executor
  * only reports the observation (R14 rule 3).
  */
-import { ReconcileOverlapPushUnfinalized, secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
+import { ReconcileOverlapPushUnfinalized, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationOriginUnverifiable, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationPublicationUnverified, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
 import { isImplementationStyleJobType } from "./job-types.js";
+/** A full, lower-case 40-hex commit SHA. */
+const FULL_SHA_RE = /^[0-9a-f]{40}$/;
 /** The `runCommand` options for one bounded read; `{ cwd }` alone when unbounded. */
 function callOptions(worktreePath, bound) {
     return bound && typeof bound.timeoutMs === "number"
@@ -116,40 +138,56 @@ function parseLsRemoteHeadSha(stdout, expectedRef) {
     }
     return null;
 }
+/** `git ls-remote --exit-code` exits with this status when no ref matched. */
+const LS_REMOTE_NO_MATCHING_REF_EXIT_CODE = 2;
 /**
- * Resolve the origin branch's authoritative current tip SHA (normalized), or
- * `null` if the ref is absent. Uses `git ls-remote` against the exact normalized
- * ref — never a local `origin/<branch>` remote-tracking ref, which can be stale
- * on a recovery worktree. A non-zero exit is treated as "branch not found"
- * without copying raw stderr into diagnostics.
+ * Resolve the origin branch's authoritative current tip. Uses `git ls-remote`
+ * against the exact normalized ref — never a local `origin/<branch>`
+ * remote-tracking ref, which can be stale on a recovery worktree.
+ *
+ * Only exit code 2 (`--exit-code`'s "no matching ref") is `absent`. A thrown
+ * command, an expired call bound, every other non-zero exit, and an exit-zero
+ * response with no usable SHA for the exact ref are all `unverifiable`: none of
+ * them is evidence the branch is missing. Neither stderr nor a thrown error's
+ * message is read or copied anywhere.
  */
 export async function resolveOriginBranchSha(runCommand, worktreePath, branch, bound) {
     const normalizedRef = normalizeBranchRef(branch);
     if (callExpired(bound))
-        return null;
-    const result = await runCommand("git", ["ls-remote", "--exit-code", "--heads", "origin", normalizedRef], callOptions(worktreePath, bound));
+        return { state: "unverifiable" };
+    let result;
+    try {
+        result = await runCommand("git", ["ls-remote", "--exit-code", "--heads", "origin", normalizedRef], callOptions(worktreePath, bound));
+    }
+    catch {
+        return { state: "unverifiable" };
+    }
+    if (result.exitCode === LS_REMOTE_NO_MATCHING_REF_EXIT_CODE)
+        return { state: "absent" };
     if (result.exitCode !== 0)
-        return null;
-    return parseLsRemoteHeadSha(result.stdout, normalizedRef);
+        return { state: "unverifiable" };
+    const sha = parseLsRemoteHeadSha(result.stdout, normalizedRef);
+    return sha === null ? { state: "unverifiable" } : { state: "found", sha };
 }
 /**
  * Repeatedly resolve the authoritative origin tip until it either satisfies
  * finalization or the bounded retry budget is exhausted. Stops early (no further
  * lookups) when the origin tip matches the worker HEAD, or when the branch exists
  * and the worker HEAD is unavailable (degraded telemetry, existence-only). Retries
- * when the tip is `null` (branch not yet visible) or, with a known HEAD, does not
- * yet match. Returns the LAST authoritative observation — the caller decides
- * loud-failure from that final value, so true negatives are preserved.
+ * an observed absence, a found tip that does not yet match a known HEAD, and an
+ * unverifiable read (a later read may succeed). Returns the LAST observation with
+ * its state intact — an unverifiable read is never turned into an absence here,
+ * so the caller decides loud-failure from what was actually established.
  */
 async function resolveOriginBranchShaForFinalization(runCommand, worktreePath, branch, trimmedHeadSha, attempts, retryDelayMs, sleep, bound) {
     const total = Math.max(1, attempts);
-    let remoteSha = null;
+    let lookup = { state: "unverifiable" };
     for (let attempt = 0; attempt < total; attempt++) {
-        remoteSha = await resolveOriginBranchSha(runCommand, worktreePath, branch, bound?.());
-        if (remoteSha !== null) {
+        lookup = await resolveOriginBranchSha(runCommand, worktreePath, branch, bound?.());
+        if (lookup.state === "found") {
             // Existence-only success when HEAD is unknown; exact-match success otherwise.
-            if (!trimmedHeadSha || remoteSha === trimmedHeadSha) {
-                return { sha: remoteSha, attemptsUsed: attempt + 1 };
+            if (!trimmedHeadSha || lookup.sha === trimmedHeadSha) {
+                return { lookup, attemptsUsed: attempt + 1 };
             }
         }
         if (attempt < total - 1)
@@ -157,7 +195,7 @@ async function resolveOriginBranchShaForFinalization(runCommand, worktreePath, b
     }
     // `attemptsUsed` is reported even on failure so the caller can tell a
     // first-try answer from one that needed the settling window (BAPI-862).
-    return { sha: remoteSha, attemptsUsed: total };
+    return { lookup, attemptsUsed: total };
 }
 /** The bounded, public projection finalization asks the provider for. */
 const PR_VIEW_JSON_FIELDS = "number,url,baseRefName,body,headRefOid";
@@ -268,7 +306,7 @@ function evaluatePrBase(job, pr, expectedBase) {
  * means the provider has not yet reflected the push, not that the push is in
  * doubt.
  */
-function evaluatePrContract(pr, workerHeadSha) {
+function evaluatePrContract(pr, workerHeadSha, coveredAttempt = false) {
     if (!pr.found) {
         return {
             ok: false,
@@ -296,6 +334,17 @@ function evaluatePrContract(pr, workerHeadSha) {
             retryable: false,
         };
     }
+    if (coveredAttempt && pr.headRefOid === null) {
+        // BAPI-1330: a legacy attempt accepts a PR whose head the provider did not
+        // report; a covered one cannot, because the PR head is part of what binds
+        // the published work to this attempt's final head.
+        return {
+            ok: false,
+            detail: "its pull request reports no head commit",
+            retryable: true,
+            unverified: true,
+        };
+    }
     if (workerHeadSha && pr.headRefOid !== null && pr.headRefOid !== workerHeadSha) {
         return {
             ok: false,
@@ -317,9 +366,16 @@ function evaluatePrContract(pr, workerHeadSha) {
  *    so the executor failure and the reconciler's observation are searchable as
  *    one state instead of two vocabularies for the same thing.
  * 2. It recommends attachment and says plainly that removing or re-writing the
- *    branch destroys completed work. In the F4 incident the pushed branch WAS the
- *    finished implementation, and both remedies the stale-worktree guard offered
- *    would have thrown it away.
+ *    branch destroys pushed work. In the F4 incident the pushed branch held the
+ *    implementation, and both remedies the stale-worktree guard offered would
+ *    have thrown it away.
+ *
+ * BAPI-1330: it claims ONLY what finalization observed — durable pushed commits
+ * and an unmet pull-request attachment. Whether the required work is finished,
+ * and whether any check passed, is stated as not established here; only the
+ * completion evidence (when the attempt was covered) can speak to either. The
+ * classification is `clean_exit`, because that is how the process ended; the
+ * finalization failure is carried by the error kind, not by rewriting the exit.
  */
 function prNotAttachedFailure(job, branch, workerHeadSha, expectedBase, detail) {
     const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
@@ -328,21 +384,45 @@ function prNotAttachedFailure(job, branch, workerHeadSha, expectedBase, detail)
     return {
         error_kind: WorkerFinalizationPrNotAttached,
         error_message: `${label} exited cleanly and its HEAD${headLabel} is durable on origin branch '${branch}', ` +
-            `but ${detail}. This is the pr_not_attached state: the implementation is COMPLETE and ` +
-            `published, only its pull request is missing. Recovery: open or attach a pull request for ` +
-            `'${branch}'${baseLabel} with a non-empty description. Removing or re-writing that branch ` +
-            `would destroy finished work — the commits on it are the implementation.`,
-        classification: "crashed",
+            `but ${detail}. This is the pr_not_attached state: the commits are pushed and the pull ` +
+            `request attachment is unmet. Whether the required work is finished, and whether any ` +
+            `check passed, is not established by this observation. Recovery: open or attach a pull ` +
+            `request for '${branch}'${baseLabel} with a non-empty description. Removing or re-writing ` +
+            `that branch would destroy pushed work.`,
+        classification: "clean_exit",
         last_commit_sha: workerHeadSha || undefined,
     };
 }
 /**
- * `detail` describes a state with NO evidence any work reached origin (branch
- * unresolved, branch absent from origin, or the origin lookup itself failed).
+ * BAPI-1330: a covered attempt whose publication could not be PROVEN. Built only
+ * from public identifiers and a fixed detail phrase. It never says a pull request
+ * is absent, because none was observed to be — the verdict is `unknown`.
+ */
+function publicationUnverifiedFailure(job, branch, workerHeadSha, detail) {
+    const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    return {
+        error_kind: WorkerFinalizationPublicationUnverified,
+        error_message: `${label} exited cleanly, but publication of branch '${branch}' could not be verified: ` +
+            `${detail}. Publication, required-work completion and check status are unknown for this ` +
+            `attempt; nothing was observed to be missing and nothing on the branch was changed.`,
+        classification: "clean_exit",
+        last_commit_sha: FULL_SHA_RE.test(workerHeadSha) ? workerHeadSha : undefined,
+    };
+}
+/**
+ * `detail` describes a state with NO evidence any work reached origin, and is
+ * used for exactly two cases: no expected branch to verify, or a branch the
+ * origin lookup OBSERVED absent (exit code 2). An origin lookup that merely
+ * failed is {@link originUnverifiableFailure}, never this. Those two cases stay
+ * one cause for now and may be refined later.
  * `hasPrUrl` only changes the wording — a PR existing is never treated as
  * evidence of a push, so the message must not claim "no PR URL" when one was
  * actually present (that would be false and would mislead the operator reading
  * it toward the wrong recovery step).
+ *
+ * The classification is `clean_exit` because the worker process did exit
+ * cleanly; the finalization failure rides in the error kind, not in a rewritten
+ * exit (the same rule the other finalization failures follow).
  */
 function missingBranchAndPrFailure(job, detail, hasPrUrl) {
     const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
@@ -350,7 +430,23 @@ function missingBranchAndPrFailure(job, detail, hasPrUrl) {
     return {
         error_kind: WorkerFinalizationMissingRemoteBranchAndPr,
         error_message: `${label} exited cleanly but ${prefix} ${detail}`,
-        classification: "crashed",
+        classification: "clean_exit",
+    };
+}
+/**
+ * BAPI-1357: the origin lookup could not be trusted, so the branch was neither
+ * seen nor observed missing. The wording is fixed and bounded: it names only the
+ * ticket, job and branch (public identifiers), never a command, stderr, a thrown
+ * error's text, a host, or a credential, and it does not claim the branch is
+ * absent. The server treats this kind as transient.
+ */
+function originUnverifiableFailure(job, branch) {
+    const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    return {
+        error_kind: WorkerFinalizationOriginUnverifiable,
+        error_message: `${label} exited cleanly, but whether branch '${branch}' reached origin could not be ` +
+            `verified. The branch was not observed to be missing; publication is unknown for this attempt.`,
+        classification: "clean_exit",
     };
 }
 /**
@@ -459,6 +555,17 @@ export async function validateWorkerFinalization(input) {
     // runs unconditionally — including when `hasPrUrl` is true (BAPI-762, AC-5): a
     // PR being open is never accepted as proof this worker's own commit landed.
     const trimmedHeadSha = typeof headSha === "string" ? headSha.trim().toLowerCase() : "";
+    const covered = input.coveredAttempt === true;
+    // BAPI-1330: the existence-only fallback below is a LEGACY concession to
+    // degraded telemetry. A covered attempt cannot bind its final head to anything
+    // without the worker's full HEAD, so it stops here with an `unknown` verdict
+    // rather than accepting "the branch exists" as publication.
+    if (covered && !FULL_SHA_RE.test(trimmedHeadSha)) {
+        return {
+            ok: false,
+            failure: publicationUnverifiedFailure(job, trimmedBranch, trimmedHeadSha, "the worker's full HEAD commit could not be established"),
+        };
+    }
     const attempts = normalizeAttempts(input.originResolveAttempts);
     const retryDelayMs = normalizeRetryDelay(input.originResolveRetryDelayMs);
     const sleep = input.sleep ?? sleepMs;
@@ -466,19 +573,24 @@ export async function validateWorkerFinalization(input) {
     try {
         origin = await resolveOriginBranchShaForFinalization(runCommand, worktreePath, trimmedBranch, trimmedHeadSha, attempts, retryDelayMs, sleep, bound);
     }
-    catch (err) {
-        return {
-            ok: false,
-            failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' could not be verified on origin: ${secretFreeErrorMessage(err)}`, hasPrUrl),
-        };
+    catch {
+        // BAPI-1357: nothing thrown here says anything about the branch, and its text
+        // is never rendered — the fixed unverifiable outcome is the whole report.
+        return { ok: false, failure: originUnverifiableFailure(job, trimmedBranch) };
     }
-    const remoteSha = origin.sha;
-    if (remoteSha === null) {
+    // BAPI-1357: only an authoritative "no matching ref" is an absence. A lookup
+    // that could not be trusted stays unknown and never funds the deterministic
+    // missing-branch failure.
+    if (origin.lookup.state === "unverifiable") {
+        return { ok: false, failure: originUnverifiableFailure(job, trimmedBranch) };
+    }
+    if (origin.lookup.state === "absent") {
         return {
             ok: false,
             failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' is not on origin`, hasPrUrl),
         };
     }
+    const remoteSha = origin.lookup.sha;
     // BAPI-762: an authoritative origin tip that does not match the worker's HEAD
     // is positive evidence of RECOVERABLE work — distinct from the sub-cases above,
     // which have no evidence any work reached origin at all. This is the only
@@ -518,11 +630,17 @@ export async function validateWorkerFinalization(input) {
         if (refreshedBaseVerdict)
             return { ok: false, failure: refreshedBaseVerdict };
     }
-    let contract = evaluatePrContract(pr, trimmedHeadSha);
+    let contract = evaluatePrContract(pr, trimmedHeadSha, covered);
     for (let attempt = 1; attempt < attempts && !contract.ok && contract.retryable; attempt++) {
         await sleep(retryDelayMs);
         pr = await resolvePrForFinalization(runCommand, worktreePath, trimmedBranch, bound());
-        contract = evaluatePrContract(pr, trimmedHeadSha);
+        contract = evaluatePrContract(pr, trimmedHeadSha, covered);
+    }
+    if (!contract.ok && contract.unverified === true) {
+        return {
+            ok: false,
+            failure: publicationUnverifiedFailure(job, trimmedBranch, trimmedHeadSha, contract.detail),
+        };
     }
     if (!contract.ok) {
         return {