@bridge_gpt/mcp-server 0.2.66 → 0.2.67

package/build/executor/observation.js

@@ -34,9 +34,14 @@ export async function collectGitTelemetry(deps, worktreePath, baseBranch) {
         /* degraded: omit last_commit_sha */
     }
     try {
+        // `--no-optional-locks`: a plain `git status` refreshes the index and takes
+        // `.git/index.lock`. This runs on every heartbeat against the LIVE worker's
+        // worktree, so without it a worker's own `git add`/`commit` can fail with
+        // "index.lock: File exists".
         const status = await deps.runCommand("git", [
             "-C",
             worktreePath,
+            "--no-optional-locks",
             "status",
             "--porcelain",
         ]);
@@ -293,7 +298,7 @@ const RATE_LIMIT_CONSEQUENCE_TEXT = "This warning is advisory only and triggers
     "rejection and the server advertised capacity recovery for this job; otherwise " +
     "the failure follows ordinary failure handling.";
 /** Fixed runbook reference appended to every rate-limit diagnostic (BAPI-898). */
-const RATE_LIMIT_RUNBOOK_REFERENCE = "See docs/claude/epic-implementer-v2-operator-runbook.md §8.";
+const RATE_LIMIT_RUNBOOK_REFERENCE = "See docs/epic-implementer/operator-runbook.md §8.";
 /**
  * Render the operator-facing rate-limit line (BAPI-828, BAPI-898).
  *

package/build/executor/preflight.js

@@ -2,7 +2,8 @@ import { DEFAULT_PROBE_TIMEOUT_MS } from "../agent-capabilities/types.js";
 import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "../agent-launchers/executor-adapter-inspection.js";
 import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
 import { resolveCompletionEvidenceCapability } from "../agent-launchers/executor-adapter.js";
-import { COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY, runtimeMatchesSupported, } from "./completion-contract.js";
+import { COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY, cliVersionAtLeast, normalizeCliVersion, parseCliVersion, runtimeMatchesSupported, } from "./completion-contract.js";
+import { buildHeadlessAgentEnv } from "./env.js";
 import { resolveExecutorAgentId } from "./agent-identity.js";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -123,20 +124,34 @@ export async function evaluateCompletionEvidenceQualification(adapter, deps) {
     if (probed === null) {
         return { qualified: false, refusal: "runtime identity probe did not run", runtime: null };
     }
-    const declared = capability.value.runtime;
+    const declared = capability.value.predicate;
     const mismatches = [];
-    for (const key of ["adapter", "cli_version", "platform", "event_schema"]) {
-        if (probed[key] !== declared[key]) {
-            mismatches.push(`${key} ${String(probed[key]).slice(0, 40)} != ${declared[key]}`);
-        }
+    if (probed.adapter !== declared.adapter) {
+        mismatches.push(`adapter ${String(probed.adapter).slice(0, 40)} != ${declared.adapter}`);
+    }
+    if (probed.event_schema !== declared.event_schema) {
+        mismatches.push(`event_schema ${String(probed.event_schema).slice(0, 40)} != ${declared.event_schema}`);
     }
     if (mismatches.length > 0) {
         return {
             qualified: false,
-            refusal: bounded(`probed runtime differs from the approved identity: ${mismatches.join("; ")}`),
+            refusal: bounded(`probed runtime differs from the declared predicate: ${mismatches.join("; ")}`),
             runtime: probed,
         };
     }
+    // Fixed reasons below: the probed version and platform are never echoed, because
+    // an unparseable value is arbitrary probe output.
+    const version = parseCliVersion(probed.cli_version);
+    const minimum = parseCliVersion(declared.min_cli_version);
+    if (version === null || minimum === null) {
+        return { qualified: false, refusal: "probed CLI version is not a recognized version", runtime: probed };
+    }
+    if (!cliVersionAtLeast(version, minimum)) {
+        return { qualified: false, refusal: "probed CLI version is older than the minimum", runtime: probed };
+    }
+    if (!declared.platforms.includes(probed.platform)) {
+        return { qualified: false, refusal: "probed platform is not a supported platform", runtime: probed };
+    }
     if (!runtimeMatchesSupported(probed)) {
         return {
             qualified: false,
@@ -144,7 +159,12 @@ export async function evaluateCompletionEvidenceQualification(adapter, deps) {
             runtime: probed,
         };
     }
-    return { qualified: true, refusal: null, runtime: probed };
+    // Normalized (suffix stripped) so the retained identity and the envelope carry one form.
+    const normalized = normalizeCliVersion(probed.cli_version);
+    if (normalized === null) {
+        return { qualified: false, refusal: "probed CLI version is not a recognized version", runtime: probed };
+    }
+    return { qualified: true, refusal: null, runtime: { ...probed, cli_version: normalized } };
 }
 /** Fail-fast report shape for a preflight that refused before probing. */
 function refusedPreflight(fatalFindings, warnings, adapter) {
@@ -160,23 +180,29 @@ function refusedPreflight(fatalFindings, warnings, adapter) {
         adapter,
     };
 }
-const CORRECTION_HOOK_FIXTURE_ID = "correction-entry-nested-v1";
+export const CORRECTION_HOOK_FIXTURE_ID = "correction-entry-nested-v2";
+const spawnCorrectionHook = (args, input, env) => {
+    const result = spawnSync(process.execPath, args, { input, encoding: "utf8", env, timeout: 5000 });
+    return { status: result.status, ...(result.error ? { error: result.error } : {}) };
+};
 /** Exercise the packaged hook process, including a nested-agent entry attempt. */
-export function probeInstalledCorrectionHook(worktreePath, binPath = defaultResolveBinPath("worker-guard-hook-bin.js")) {
+export function probeInstalledCorrectionHook(worktreePath, binPath = defaultResolveBinPath("worker-guard-hook-bin.js"), run = spawnCorrectionHook) {
     const args = [binPath, "--worktree-root", worktreePath,
         "--correction-intent-version", "1"];
     const env = { ...process.env, BAPI_CORRECTION_INTENT_VERSION: "1" };
     const fixtures = [
         { payload: { tool_name: "Skill", tool_input: { skill: "bridge-implement-ticket" } }, status: 2 },
         { payload: { tool_name: "Task", tool_input: { prompt: "/implement-ticket BAPI-1 --auto" } }, status: 2 },
-        { payload: { tool_name: "Read", tool_input: { file_path: "commands/src/implement-ticket.md" } }, status: 2 },
+        { payload: { tool_name: "Read", tool_input: { file_path: "commands/src/implement-ticket.md" } }, status: 0 },
+        {
+            payload: { tool_name: "Bash", tool_input: { command: 'claude -p "/implement-ticket BAPI-1"' } },
+            status: 2,
+        },
         { payload: { tool_name: "mcp__bridge_api__request_plan_generation", tool_input: {} }, status: 2 },
         { payload: { tool_name: "mcp__bridge_api__get_plan", tool_input: { ticket_number: "BAPI-1" } }, status: 0 },
     ];
     return fixtures.every(({ payload, status }) => {
-        const result = spawnSync(process.execPath, args, {
-            input: JSON.stringify(payload), encoding: "utf8", env, timeout: 5000,
-        });
+        const result = run(args, JSON.stringify(payload), env);
         return result.error === undefined && result.status === status;
     });
 }
@@ -411,8 +437,11 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
             if (denyCapability?.supported !== true) {
                 throw new Error("adapter declares no deny-enforcement capability");
             }
+            // The probe gets a worker-shaped environment so a nested-session variable in
+            // the executor's own process cannot change its verdict (BAPI-1386).
             const verdict = await denyCapability.value.probeEnforcement({
                 timeoutMs: resolveDenyProbeTimeoutMs(deps.env),
+                env: buildHeadlessAgentEnv(deps.env),
             });
             deny = {
                 enforced: verdict.enforced,
@@ -486,6 +515,13 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     if (!completion.qualified && completion.refusal !== null) {
         warnings.push(`completion evidence not advertised: ${completion.refusal}`);
     }
+    // One notice per qualifying collection, built only from validated fields: the
+    // adapter id the predicate matched, the normalized version, and a closed platform id.
+    const notices = [];
+    if (completion.qualified && completion.runtime !== null) {
+        notices.push(`completion evidence advertised: ${completion.runtime.adapter} ` +
+            `${completion.runtime.cli_version} ${completion.runtime.platform}`);
+    }
     let correction = {
         qualified: false, evidence: null,
     };
@@ -504,6 +540,7 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         ok: fatalFindings.length === 0,
         fatalFindings,
         warnings,
+        notices,
         agentVersion,
         wtVersion,
         diskFreeGb,

package/build/executor/required-work-ledger.js

@@ -877,6 +877,10 @@ export function createRequiredWorkLedger(init) {
         const readyToClose = resultsSeen > 0 && latestIsResult && !turnOpen && liveRequired.length === 0 && snap.required.length === 0;
         return { readyToClose, liveRequired, liveOptional, activitySeq, latestIsResult };
     };
+    // One predicate for "a required task is still pending", shared by the envelope
+    // and the observe-only query so the two cannot drift apart.
+    const hasPendingRequiredWork = () => effectiveTasks().some(({ o, state }) => o.required && state === "pending");
+    const observeLiveRequiredWork = () => hasPendingRequiredWork() ? "live_required_work" : null;
     const buildEnvelope = (facts) => {
         const reasons = new Set(insufficient);
         if (!lifecycleSupported || !runtimeMatchesSupported(facts.runtime))
@@ -897,7 +901,7 @@ export function createRequiredWorkLedger(init) {
             reasons.add("forced_kill_no_cli_teardown");
         const effective = effectiveTasks();
         // R6: a required task with no terminal after the stream ended is missing evidence.
-        if (effective.some(({ o, state }) => o.required && state === "pending"))
+        if (hasPendingRequiredWork())
             reasons.add("live_required_work");
         // R6b: a stale snapshot, or a snapshot-only task nothing ever explained.
         const snap = liveSnapshotIds();
@@ -993,6 +997,7 @@ export function createRequiredWorkLedger(init) {
         recordDeclarationRefused: () => {
             insufficient.add("declaration_refused");
         },
+        observeLiveRequiredWork,
         buildEnvelope,
     };
 }

package/build/executor/resume-pre-spawn.js

@@ -149,6 +149,8 @@ export function fillResumePromptPlaceholders(template, gitLog, gitDiff) {
 // ---------------------------------------------------------------------------
 /** The deterministic WIP checkpoint message for a continuation. */
 export const CONTINUATION_WIP_COMMIT_MESSAGE = "wip: auto-checkpoint before continuation";
+/** BAPI-1367: the WIP checkpoint message when a retry resumes its prior attempt's work. */
+export const PRIOR_ATTEMPT_WIP_COMMIT_MESSAGE = "wip: auto-checkpoint before retry resume";
 const FULL_SHA = /^[0-9a-f]{40}$/;
 /** Read the continuation binding from a claimed job's payload (pure). */
 export function readContinuationBinding(job) {

package/build/executor/runner.js

@@ -70,7 +70,7 @@ export function formatDispatcherUnavailableDiagnostic(liveness) {
     return (`executor: no fresh reconciler/dispatcher heartbeat is available ` +
         `(reconciler_liveness=${liveness}); the dispatcher may not be running. ` +
         "Check DISABLE_SCHEDULER and GET /automation/health; see " +
-        "docs/claude/epic-implementer-v2-operator-runbook.md. Continuing to poll.");
+        "docs/epic-implementer/operator-runbook.md. Continuing to poll.");
 }
 /** The recovery diagnostic, emitted once when an absent dispatcher comes back. */
 export function formatDispatcherRecoveredDiagnostic() {
@@ -94,7 +94,8 @@ export const PROCESS_HEARTBEAT_INTERVAL_MS = 60_000;
 /** Delivery-failure diagnostic. Bounded, credential-free, stderr-only. */
 export function formatProcessHeartbeatFailureDiagnostic() {
     return ("executor: process-heartbeat delivery is failing; the server may report this " +
-        "executor as stale. Claiming and running jobs are unaffected.");
+        "executor as stale. If the server is unreachable, job heartbeats and claims " +
+        "can fail too, and a running job can lose its lease.");
 }
 /** Emitted once when delivery starts working again. */
 export function formatProcessHeartbeatRecoveredDiagnostic() {
@@ -819,6 +820,11 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
             for (const warning of report.warnings) {
                 deps.errorLog(`executor preflight warning: ${warning}`);
             }
+            // BAPI-1386: informational lines (the completion-evidence advertisement) go to
+            // stderr like every other diagnostic here, never stdout.
+            for (const notice of report.notices ?? []) {
+                deps.errorLog(`executor preflight: ${notice}`);
+            }
             if (!report.ok) {
                 deps.errorLog(`executor preflight refused claiming: ${report.fatalFindings.join("; ")}`);
             }

package/build/executor/service-unit.js

@@ -929,7 +929,8 @@ export function resolvePackagedExecutorInvocation(deps) {
 /** User-facing usage for `executor install-service`. */
 export function getExecutorInstallServiceUsage() {
     return [
-        "Usage: mcp-server executor install-service --executor-id <id> --repo <name> [--repo <name> ...] [options]",
+        "Usage: mcp-server executor install-service --executor-id <id> --repo <name> [--repo <name> ...]",
+        "                                           (--epic-run-id <id> | --repo-wide) [options]",
         "",
         "The FILE-GENERATION LEG of durable-host mode. It writes one unit and stops there.",
         "For the supported composed bring-up — planning, consented write, consented start,",
@@ -947,6 +948,11 @@ export function getExecutorInstallServiceUsage() {
         "                                needs a durable identity, so the foreground",
         "                                <hostname>-<pid> default is never used here.",
         "  --repo <name>                 Repo to serve (repeatable; --repos=a,b also works).",
+        "  --epic-run-id <id>            Claim scope: dedicate the unit to an epic run",
+        "                                (repeatable). Or:",
+        "  --repo-wide                   Claim scope: claim from every authorized repo,",
+        "                                unscoped by run. Exactly one of the two is required;",
+        "                                the executor refuses to start without one.",
         "  --base-url <url>              Bridge API endpoint, or set BAPI_BASE_URL.",
         "                                There is NO production default.",
         "",

package/build/executor/worker-finalization.js

@@ -60,6 +60,15 @@
  * reports its head, publication is `unknown`
  * (`WorkerFinalizationPublicationUnverified`), never `ok`.
  *
+ * BAPI-1357: "absent" and "could not be checked" are different facts. Only the
+ * origin lookup's authoritative "no matching ref" (`git ls-remote --exit-code`
+ * exit code 2), or having no expected branch at all, is reported as
+ * `WorkerFinalizationMissingRemoteBranchAndPr`; a thrown command, an expired
+ * call bound, any other exit, or unusable output leaves publication unknown and is
+ * `WorkerFinalizationOriginUnverifiable`, which the server treats as transient.
+ * Both keep the `clean_exit` classification the process earned. No-expected-branch
+ * and absent-on-origin are still one cause, and may be refined later.
+ *
  * This check is deliberately fail-CLOSED, unlike the BAPI-586 base check it now
  * shares a lookup with. "The PR could not be verified" and "there is no PR" are
  * the same thing from the contract's point of view: neither is evidence that the
@@ -67,7 +76,7 @@
  * this ticket removes. The reconciler stays the decision-maker — the executor
  * only reports the observation (R14 rule 3).
  */
-import { ReconcileOverlapPushUnfinalized, secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationPublicationUnverified, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
+import { ReconcileOverlapPushUnfinalized, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationOriginUnverifiable, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationPublicationUnverified, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
 import { isImplementationStyleJobType } from "./job-types.js";
 /** A full, lower-case 40-hex commit SHA. */
 const FULL_SHA_RE = /^[0-9a-f]{40}$/;
@@ -129,40 +138,56 @@ function parseLsRemoteHeadSha(stdout, expectedRef) {
     }
     return null;
 }
+/** `git ls-remote --exit-code` exits with this status when no ref matched. */
+const LS_REMOTE_NO_MATCHING_REF_EXIT_CODE = 2;
 /**
- * Resolve the origin branch's authoritative current tip SHA (normalized), or
- * `null` if the ref is absent. Uses `git ls-remote` against the exact normalized
- * ref — never a local `origin/<branch>` remote-tracking ref, which can be stale
- * on a recovery worktree. A non-zero exit is treated as "branch not found"
- * without copying raw stderr into diagnostics.
+ * Resolve the origin branch's authoritative current tip. Uses `git ls-remote`
+ * against the exact normalized ref — never a local `origin/<branch>`
+ * remote-tracking ref, which can be stale on a recovery worktree.
+ *
+ * Only exit code 2 (`--exit-code`'s "no matching ref") is `absent`. A thrown
+ * command, an expired call bound, every other non-zero exit, and an exit-zero
+ * response with no usable SHA for the exact ref are all `unverifiable`: none of
+ * them is evidence the branch is missing. Neither stderr nor a thrown error's
+ * message is read or copied anywhere.
  */
 export async function resolveOriginBranchSha(runCommand, worktreePath, branch, bound) {
     const normalizedRef = normalizeBranchRef(branch);
     if (callExpired(bound))
-        return null;
-    const result = await runCommand("git", ["ls-remote", "--exit-code", "--heads", "origin", normalizedRef], callOptions(worktreePath, bound));
+        return { state: "unverifiable" };
+    let result;
+    try {
+        result = await runCommand("git", ["ls-remote", "--exit-code", "--heads", "origin", normalizedRef], callOptions(worktreePath, bound));
+    }
+    catch {
+        return { state: "unverifiable" };
+    }
+    if (result.exitCode === LS_REMOTE_NO_MATCHING_REF_EXIT_CODE)
+        return { state: "absent" };
     if (result.exitCode !== 0)
-        return null;
-    return parseLsRemoteHeadSha(result.stdout, normalizedRef);
+        return { state: "unverifiable" };
+    const sha = parseLsRemoteHeadSha(result.stdout, normalizedRef);
+    return sha === null ? { state: "unverifiable" } : { state: "found", sha };
 }
 /**
  * Repeatedly resolve the authoritative origin tip until it either satisfies
  * finalization or the bounded retry budget is exhausted. Stops early (no further
  * lookups) when the origin tip matches the worker HEAD, or when the branch exists
  * and the worker HEAD is unavailable (degraded telemetry, existence-only). Retries
- * when the tip is `null` (branch not yet visible) or, with a known HEAD, does not
- * yet match. Returns the LAST authoritative observation — the caller decides
- * loud-failure from that final value, so true negatives are preserved.
+ * an observed absence, a found tip that does not yet match a known HEAD, and an
+ * unverifiable read (a later read may succeed). Returns the LAST observation with
+ * its state intact — an unverifiable read is never turned into an absence here,
+ * so the caller decides loud-failure from what was actually established.
  */
 async function resolveOriginBranchShaForFinalization(runCommand, worktreePath, branch, trimmedHeadSha, attempts, retryDelayMs, sleep, bound) {
     const total = Math.max(1, attempts);
-    let remoteSha = null;
+    let lookup = { state: "unverifiable" };
     for (let attempt = 0; attempt < total; attempt++) {
-        remoteSha = await resolveOriginBranchSha(runCommand, worktreePath, branch, bound?.());
-        if (remoteSha !== null) {
+        lookup = await resolveOriginBranchSha(runCommand, worktreePath, branch, bound?.());
+        if (lookup.state === "found") {
             // Existence-only success when HEAD is unknown; exact-match success otherwise.
-            if (!trimmedHeadSha || remoteSha === trimmedHeadSha) {
-                return { sha: remoteSha, attemptsUsed: attempt + 1 };
+            if (!trimmedHeadSha || lookup.sha === trimmedHeadSha) {
+                return { lookup, attemptsUsed: attempt + 1 };
             }
         }
         if (attempt < total - 1)
@@ -170,7 +195,7 @@ async function resolveOriginBranchShaForFinalization(runCommand, worktreePath, b
     }
     // `attemptsUsed` is reported even on failure so the caller can tell a
     // first-try answer from one that needed the settling window (BAPI-862).
-    return { sha: remoteSha, attemptsUsed: total };
+    return { lookup, attemptsUsed: total };
 }
 /** The bounded, public projection finalization asks the provider for. */
 const PR_VIEW_JSON_FIELDS = "number,url,baseRefName,body,headRefOid";
@@ -385,12 +410,19 @@ function publicationUnverifiedFailure(job, branch, workerHeadSha, detail) {
     };
 }
 /**
- * `detail` describes a state with NO evidence any work reached origin (branch
- * unresolved, branch absent from origin, or the origin lookup itself failed).
+ * `detail` describes a state with NO evidence any work reached origin, and is
+ * used for exactly two cases: no expected branch to verify, or a branch the
+ * origin lookup OBSERVED absent (exit code 2). An origin lookup that merely
+ * failed is {@link originUnverifiableFailure}, never this. Those two cases stay
+ * one cause for now and may be refined later.
  * `hasPrUrl` only changes the wording — a PR existing is never treated as
  * evidence of a push, so the message must not claim "no PR URL" when one was
  * actually present (that would be false and would mislead the operator reading
  * it toward the wrong recovery step).
+ *
+ * The classification is `clean_exit` because the worker process did exit
+ * cleanly; the finalization failure rides in the error kind, not in a rewritten
+ * exit (the same rule the other finalization failures follow).
  */
 function missingBranchAndPrFailure(job, detail, hasPrUrl) {
     const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
@@ -398,7 +430,23 @@ function missingBranchAndPrFailure(job, detail, hasPrUrl) {
     return {
         error_kind: WorkerFinalizationMissingRemoteBranchAndPr,
         error_message: `${label} exited cleanly but ${prefix} ${detail}`,
-        classification: "crashed",
+        classification: "clean_exit",
+    };
+}
+/**
+ * BAPI-1357: the origin lookup could not be trusted, so the branch was neither
+ * seen nor observed missing. The wording is fixed and bounded: it names only the
+ * ticket, job and branch (public identifiers), never a command, stderr, a thrown
+ * error's text, a host, or a credential, and it does not claim the branch is
+ * absent. The server treats this kind as transient.
+ */
+function originUnverifiableFailure(job, branch) {
+    const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    return {
+        error_kind: WorkerFinalizationOriginUnverifiable,
+        error_message: `${label} exited cleanly, but whether branch '${branch}' reached origin could not be ` +
+            `verified. The branch was not observed to be missing; publication is unknown for this attempt.`,
+        classification: "clean_exit",
     };
 }
 /**
@@ -525,19 +573,24 @@ export async function validateWorkerFinalization(input) {
     try {
         origin = await resolveOriginBranchShaForFinalization(runCommand, worktreePath, trimmedBranch, trimmedHeadSha, attempts, retryDelayMs, sleep, bound);
     }
-    catch (err) {
-        return {
-            ok: false,
-            failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' could not be verified on origin: ${secretFreeErrorMessage(err)}`, hasPrUrl),
-        };
+    catch {
+        // BAPI-1357: nothing thrown here says anything about the branch, and its text
+        // is never rendered — the fixed unverifiable outcome is the whole report.
+        return { ok: false, failure: originUnverifiableFailure(job, trimmedBranch) };
+    }
+    // BAPI-1357: only an authoritative "no matching ref" is an absence. A lookup
+    // that could not be trusted stays unknown and never funds the deterministic
+    // missing-branch failure.
+    if (origin.lookup.state === "unverifiable") {
+        return { ok: false, failure: originUnverifiableFailure(job, trimmedBranch) };
     }
-    const remoteSha = origin.sha;
-    if (remoteSha === null) {
+    if (origin.lookup.state === "absent") {
         return {
             ok: false,
             failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' is not on origin`, hasPrUrl),
         };
     }
+    const remoteSha = origin.lookup.sha;
     // BAPI-762: an authoritative origin tip that does not match the worker's HEAD
     // is positive evidence of RECOVERABLE work — distinct from the sub-cases above,
     // which have no evidence any work reached origin at all. This is the only