@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/mcp-install-state.js

@@ -16,6 +16,7 @@
  * All filesystem access is through injected dependencies so the module is fully
  * unit-testable with in-memory fakes.
  */
+import { validPackagedAssetInventory } from "./generated-assets-context.js";
 import { executorIdFromLaunchdFilename, executorIdFromSystemdFilename, } from "./executor/service-unit.js";
 import { HOST_PLATFORM_ORDER, isHostPlatformId, } from "./mcp-host-targets.js";
 /** Current on-disk schema version. */
@@ -217,8 +218,7 @@ export async function readMcpInstallState(cwd, deps) {
     catch (err) {
         if (isEnoent(err))
             return { status: "missing" };
-        // A non-ENOENT read error is treated as missing state, not a crash.
-        return { status: "missing" };
+        return { status: "unreadable" };
     }
     let parsed;
     try {
@@ -271,6 +271,9 @@ export async function readMcpInstallState(cwd, deps) {
         status: "valid",
         state: {
             version: MCP_INSTALL_STATE_VERSION,
+            ...(doc.packagedAssets === undefined ? {} : validPackagedAssetInventory(doc.packagedAssets)
+                ? { packagedAssets: doc.packagedAssets }
+                : { packagedAssetsStatus: (doc.packagedAssets && typeof doc.packagedAssets === "object" && doc.packagedAssets.version !== 1 ? "unsupported" : "invalid") }),
             selectedPlatforms: normalizePlatforms(rawPlatforms),
             projectConfigPaths: normalizeProjectPaths(projectConfigPaths),
             // Entries that are not generated-unit locators are DROPPED rather than
@@ -291,6 +294,7 @@ export function serializeMcpInstallState(state) {
     // Explicit key order — do not rely on object insertion order for stability.
     const ordered = {
         version: state.version,
+        ...(state.packagedAssets ? { packagedAssets: cleanAssetInventory(state.packagedAssets) } : {}),
         selectedPlatforms: state.selectedPlatforms,
         projectConfigPaths: state.projectConfigPaths,
         // Re-normalized at serialization time, not trusted from the input object:
@@ -315,10 +319,13 @@ export function serializeMcpInstallState(state) {
  */
 export async function writeMcpInstallState(cwd, input, deps) {
     const existing = await readMcpInstallState(cwd, deps);
+    if (!canPreserveAssetInventory(existing))
+        return { ok: false, error: "Existing installation state cannot be safely preserved." };
     const priorUnitPaths = existing.status === "valid" ? existing.state.executorServiceUnitPaths : [];
     const priorCapabilities = existing.status === "valid" ? (existing.state.capabilities ?? []) : [];
     const state = {
         version: MCP_INSTALL_STATE_VERSION,
+        ...(existing.status === "valid" && existing.state.packagedAssets ? { packagedAssets: existing.state.packagedAssets } : {}),
         selectedPlatforms: normalizePlatforms(input.selectedPlatforms),
         projectConfigPaths: normalizeProjectPaths(input.projectConfigPaths),
         executorServiceUnitPaths: normalizeExecutorServiceUnitPaths([
@@ -330,6 +337,11 @@ export async function writeMcpInstallState(cwd, input, deps) {
         // them (BAPI-775).
         capabilities: normalizeCapabilities(priorCapabilities),
     };
+    if (input.packagedAssets) {
+        if (!validPackagedAssetInventory(input.packagedAssets))
+            return { ok: false, error: "Invalid packaged-asset inventory." };
+        state.packagedAssets = cleanAssetInventory(input.packagedAssets);
+    }
     const finalPath = installStatePath(cwd);
     return persistMcpInstallState(cwd, state, finalPath, deps);
 }
@@ -351,8 +363,7 @@ async function persistMcpInstallState(cwd, state, finalPath, deps) {
                 // Best-effort cleanup only; ignore secondary failures.
             }
         }
-        const message = err instanceof Error ? err.message : String(err);
-        return { ok: false, error: `failed to persist install state: ${message}` };
+        return { ok: false, error: "failed to persist install state" };
     }
     return { ok: true, path: finalPath, state };
 }
@@ -379,11 +390,14 @@ export async function recordInstalledProjectArtifact(cwd, relPath, deps) {
         };
     }
     const existing = await readMcpInstallState(cwd, deps);
+    if (!canPreserveAssetInventory(existing))
+        return { ok: false, error: "Existing installation state cannot be safely preserved." };
     const priorPlatforms = existing.status === "valid" ? existing.state.selectedPlatforms : [];
     const priorPaths = existing.status === "valid" ? existing.state.projectConfigPaths : [];
     const priorUnitPaths = existing.status === "valid" ? existing.state.executorServiceUnitPaths : [];
     const state = {
         version: MCP_INSTALL_STATE_VERSION,
+        ...(existing.status === "valid" && existing.state.packagedAssets ? { packagedAssets: existing.state.packagedAssets } : {}),
         selectedPlatforms: normalizePlatforms(priorPlatforms),
         projectConfigPaths: normalizeProjectPaths([...priorPaths, relPath]),
         // Preserved, not rebuilt: recording a workflow file must not drop the
@@ -417,11 +431,14 @@ export async function recordInstalledExecutorServiceUnit(cwd, unitPath, homeDir,
         };
     }
     const existing = await readMcpInstallState(cwd, deps);
+    if (!canPreserveAssetInventory(existing))
+        return { ok: false, error: "Existing installation state cannot be safely preserved." };
     const priorPlatforms = existing.status === "valid" ? existing.state.selectedPlatforms : [];
     const priorPaths = existing.status === "valid" ? existing.state.projectConfigPaths : [];
     const priorUnitPaths = existing.status === "valid" ? existing.state.executorServiceUnitPaths : [];
     const state = {
         version: MCP_INSTALL_STATE_VERSION,
+        ...(existing.status === "valid" && existing.state.packagedAssets ? { packagedAssets: existing.state.packagedAssets } : {}),
         selectedPlatforms: normalizePlatforms(priorPlatforms),
         projectConfigPaths: normalizeProjectPaths(priorPaths),
         executorServiceUnitPaths: normalizeExecutorServiceUnitPaths([...priorUnitPaths, locator]),
@@ -453,12 +470,15 @@ export async function recordInstalledConductorCapability(cwd, capability, deps)
         };
     }
     const existing = await readMcpInstallState(cwd, deps);
+    if (!canPreserveAssetInventory(existing))
+        return { ok: false, error: "Existing installation state cannot be safely preserved." };
     const priorPlatforms = existing.status === "valid" ? existing.state.selectedPlatforms : [];
     const priorPaths = existing.status === "valid" ? existing.state.projectConfigPaths : [];
     const priorUnitPaths = existing.status === "valid" ? existing.state.executorServiceUnitPaths : [];
     const priorCapabilities = existing.status === "valid" ? (existing.state.capabilities ?? []) : [];
     const state = {
         version: MCP_INSTALL_STATE_VERSION,
+        ...(existing.status === "valid" && existing.state.packagedAssets ? { packagedAssets: existing.state.packagedAssets } : {}),
         selectedPlatforms: normalizePlatforms(priorPlatforms),
         projectConfigPaths: normalizeProjectPaths(priorPaths),
         executorServiceUnitPaths: normalizeExecutorServiceUnitPaths(priorUnitPaths),
@@ -466,3 +486,29 @@ export async function recordInstalledConductorCapability(cwd, capability, deps)
     };
     return persistMcpInstallState(cwd, state, installStatePath(cwd), deps);
 }
+function canPreserveAssetInventory(existing) {
+    return existing.status === "missing" || (existing.status === "valid" && !existing.state.packagedAssetsStatus);
+}
+function cleanAssetInventory(inventory) {
+    if (!validPackagedAssetInventory(inventory))
+        throw new Error("Invalid packaged-asset inventory.");
+    return { version: 1, packageVersion: inventory.packageVersion, rootBinding: inventory.rootBinding,
+        assets: inventory.assets.map(a => ({ id: a.id, destination: a.destination, host: a.host })) };
+}
+export async function recordPackagedAssetInventory(cwd, inventory, deps) {
+    if (!validPackagedAssetInventory(inventory))
+        return { ok: false, error: "Invalid packaged-asset inventory." };
+    const prior = await readMcpInstallState(cwd, deps);
+    if (!canPreserveAssetInventory(prior))
+        return { ok: false, error: "Existing installation state cannot be safely preserved." };
+    const state = prior.status === "valid" ? prior.state : undefined;
+    const records = new Map();
+    if (state?.packagedAssets?.rootBinding === inventory.rootBinding) {
+        for (const a of state.packagedAssets.assets)
+            records.set(`${a.host}:${a.id}`, a);
+    }
+    for (const a of inventory.assets)
+        records.set(`${a.host}:${a.id}`, a);
+    return writeMcpInstallState(cwd, { selectedPlatforms: state?.selectedPlatforms ?? [],
+        projectConfigPaths: state?.projectConfigPaths ?? [], packagedAssets: { ...inventory, assets: [...records.values()] } }, deps);
+}

package/build/merge-workflow-install.js

@@ -43,6 +43,7 @@
  * remediation sentence, because subprocess text is unbounded and can carry a
  * remote URL with an embedded token.
  */
+import { resolve } from "node:path";
 import { MERGE_WORKFLOW_EXPECTED_VERSION, MERGE_WORKFLOW_PATH, } from "./conductor/merge-execution-contract.js";
 import { MERGE_WORKFLOW_API_KEY_SECRET_NAME, } from "./merge-workflow-config.js";
 import { MERGE_WORKFLOW_CLASSIFICATION_TEXT, classifyMergeWorkflowContent, } from "./merge-workflow-drift.js";
@@ -247,10 +248,8 @@ export async function runMergeWorkflowPreflight(deps, options) {
     if (!repositoryRoot)
         return { ok: false, result: fail("not_repository_root") };
     const normalizedCwd = deps.cwd.endsWith("/") ? deps.cwd.slice(0, -1) : deps.cwd;
-    const normalizedRoot = repositoryRoot.endsWith("/")
-        ? repositoryRoot.slice(0, -1)
-        : repositoryRoot;
-    if (normalizedRoot !== normalizedCwd) {
+    const normalizedRoot = repositoryRoot.endsWith("/") ? repositoryRoot.slice(0, -1) : repositoryRoot;
+    if (resolve(normalizedRoot) !== resolve(normalizedCwd)) {
         return { ok: false, result: fail("not_repository_root") };
     }
     deps.log(`  repository root: ${normalizedRoot}`);

package/build/phase-context-git-probe.js

@@ -0,0 +1,68 @@
+/**
+ * BAPI-1363 — the bounded git probe behind `get_phase_context`.
+ *
+ * `phase-result-artifacts.ts` is filesystem-only by contract, so the question "is
+ * the recorded checkpoint actually in this worktree's history?" is answered here
+ * and passed to it as plain values. Every call is shell-free, rooted at the
+ * server-resolved project root, and bounded by a short timeout.
+ *
+ * Nothing in this module throws on a git problem. A failed probe degrades to
+ * `"unknown"` with a closed-vocabulary reason, which the artifact layer treats as
+ * "not evidence", so work is redone rather than trusted. Raw stderr, command text,
+ * and paths never leave this module.
+ */
+import { execFile } from "child_process";
+/** Bound on each local git call. */
+export const PHASE_CONTEXT_GIT_TIMEOUT_MS = 5000;
+const FULL_HEX_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
+/** Build a runner over `execFileImpl` (the real `execFile` unless a test injects one). */
+export function createPhaseContextGitRunner(execFileImpl = execFile) {
+    return (cwd, args) => new Promise((resolve, reject) => {
+        execFileImpl("git", args, { cwd, shell: false, timeout: PHASE_CONTEXT_GIT_TIMEOUT_MS, windowsHide: true }, (err, stdout) => {
+            if (err)
+                reject(err);
+            else
+                resolve(String(stdout));
+        });
+    });
+}
+/** Closed-vocabulary classification of a failed git call. Raw error text never escapes. */
+function classifyGitFailure(err) {
+    const code = err?.code;
+    return code === "ENOENT" ? "git_unavailable" : "probe_failed";
+}
+/**
+ * Capture HEAD once, then — only when a checkpoint SHA was recorded — probe its
+ * ancestry against that same captured HEAD.
+ *
+ * Only git's ordinary not-ancestor exit (status 1) is `false`. Anything else that
+ * goes wrong is `"unknown"`, never a guess.
+ */
+export async function evaluateCheckpointReachability(options) {
+    const run = options.run ?? createPhaseContextGitRunner();
+    let head;
+    try {
+        head = (await run(options.root, ["rev-parse", "HEAD"])).trim();
+    }
+    catch (err) {
+        const reason = classifyGitFailure(err);
+        return { reachable: "unknown", reason: reason === "git_unavailable" ? reason : "head_unavailable" };
+    }
+    if (!FULL_HEX_SHA.test(head))
+        return { reachable: "unknown", reason: "head_unavailable" };
+    if (options.checkpointSha === undefined) {
+        return { head, reachable: "unknown", reason: "not_evaluated" };
+    }
+    if (!FULL_HEX_SHA.test(options.checkpointSha)) {
+        return { head, reachable: "unknown", reason: "invalid_sha" };
+    }
+    try {
+        await run(options.root, ["merge-base", "--is-ancestor", options.checkpointSha, head]);
+        return { head, reachable: true };
+    }
+    catch (err) {
+        if (err?.code === 1)
+            return { head, reachable: false };
+        return { head, reachable: "unknown", reason: classifyGitFailure(err) };
+    }
+}

package/build/phase-result-artifacts.js

@@ -59,7 +59,7 @@ export const PHASE_RESULT_ARTIFACT_VERSION = 1;
  * it reaches the filesystem, rather than being sanitized into something that
  * silently addresses a different ticket's artifact.
  */
-const TICKET_KEY_PATTERN = /^[A-Za-z][A-Za-z0-9]*-\d+$/;
+const TICKET_KEY_PATTERN = /^[A-Za-z][A-Za-z0-9_]*-\d+$/;
 /** Terminal dispositions that mean "this step is done; do not redo it". */
 const REENTRY_TERMINAL_DISPOSITIONS = new Set([
     "executed",
@@ -74,6 +74,24 @@ const REENTRY_TERMINAL_DISPOSITIONS = new Set([
  */
 export const INLINE_ROUTING_SOURCE = "inline:get_plan_metadata+phase_result_artifacts";
 // ---------------------------------------------------------------------------
+// Shapes
+// ---------------------------------------------------------------------------
+/**
+ * Why a checkpoint is not trusted as commit evidence. Closed vocabulary: these
+ * tokens are the only diagnostics a response may carry about a failed probe, so
+ * no raw git output, path, or credential can ride along.
+ */
+export const CHECKPOINT_STALE_REASONS = [
+    "not_ancestor",
+    "git_unavailable",
+    "invalid_sha",
+    "probe_failed",
+    "head_unavailable",
+    "checkpoint_changed",
+    "coverage_mismatch",
+    "not_evaluated",
+];
+// ---------------------------------------------------------------------------
 // Path safety
 // ---------------------------------------------------------------------------
 function assertValidTicketKey(ticketKey) {
@@ -265,6 +283,9 @@ export async function loadInlinePhaseContext(options) {
     const fingerprint = planFingerprint(metadata);
     let ledger = [];
     const artifactPaths = [];
+    // Latest record index per produce step, within the produce artifact's own list.
+    const produceLatestIndex = new Map();
+    let produceRecordCount = 0;
     // Canonical phase order, not directory order: the ledger is chronological and
     // production always precedes the phases that verify it.
     for (const priorPhase of PLAN_PHASES) {
@@ -277,21 +298,72 @@ export async function loadInlinePhaseContext(options) {
         // Re-check against the CURRENT metadata: an artifact that was valid when
         // written must still describe steps this phase owns under the plan in play now.
         const routable = assertStoredRecordsRoutable(artifact.records, metadata, priorPhase, relativePath);
+        if (priorPhase === "produce") {
+            produceRecordCount = routable.length;
+            routable.forEach((record, index) => produceLatestIndex.set(record.stepId, index));
+        }
         ledger = [...ledger, ...sanitizePlanStepRecords(routable)];
         artifactPaths.push(relativePath);
     }
     const checkpoint = await readInlineCheckpoint(docsDir, ticketKey);
     if (checkpoint)
         artifactPaths.push(checkpointRelativePath(ticketKey));
+    // Reachability is decided by the caller's git probe. Anything other than a
+    // confirmed `true` fails toward redo, and a checkpoint that changed between the
+    // probe and this load is not the one that was probed.
+    let reachable = options.checkpointReachable ?? "unknown";
+    let staleReason;
+    if (reachable === "unknown") {
+        staleReason = options.checkpointUnknownReason ?? "not_evaluated";
+    }
+    else if (reachable === false) {
+        staleReason = "not_ancestor";
+    }
+    if (checkpoint &&
+        reachable !== "unknown" &&
+        options.probedCheckpoint !== undefined &&
+        !sameCheckpoint(options.probedCheckpoint, checkpoint)) {
+        reachable = "unknown";
+        staleReason = "checkpoint_changed";
+    }
+    // A checkpoint covers the produce prefix only when its binding is intact.
+    const coverageIntact = checkpoint !== undefined &&
+        checkpoint.producedRecordCount > 0 &&
+        checkpoint.producedRecordCount <= produceRecordCount &&
+        checkpoint.producePlanFingerprint === fingerprint;
+    const coveredCount = checkpoint && reachable === true && coverageIntact
+        ? checkpoint.producedRecordCount
+        : 0;
+    if (checkpoint &&
+        reachable === true &&
+        checkpoint.producedRecordCount > 0 &&
+        !coverageIntact) {
+        staleReason = "coverage_mismatch";
+    }
     const current = currentLedgerState(ledger);
     const currentRecordsByStep = {};
     const terminalStepIds = [];
+    const uncommittedStepIds = [];
     for (const [stepId, record] of current) {
         currentRecordsByStep[stepId] = record;
-        if (REENTRY_TERMINAL_DISPOSITIONS.has(record.disposition))
+        if (!REENTRY_TERMINAL_DISPOSITIONS.has(record.disposition))
+            continue;
+        const producedAt = produceLatestIndex.get(stepId);
+        if (producedAt !== undefined && producedAt >= coveredCount) {
+            // Latest produce record is not inside the committed prefix: the work it
+            // describes is not evidenced at the evaluated HEAD.
+            uncommittedStepIds.push(stepId);
+        }
+        else {
             terminalStepIds.push(stepId);
+        }
     }
     terminalStepIds.sort((a, b) => a - b);
+    uncommittedStepIds.sort((a, b) => a - b);
+    const checkpointIsEvidence = checkpoint !== undefined && reachable === true && staleReason === undefined;
+    const ledgerNote = uncommittedStepIds.length > 0
+        ? "Produce steps listed in uncommittedStepIds are recorded as done but no reachable checkpoint covers them, so redo them (checking for equivalent existing work first) and do not report them as already done."
+        : "";
     return {
         phase,
         routingSource: INLINE_ROUTING_SOURCE,
@@ -306,12 +378,40 @@ export async function loadInlinePhaseContext(options) {
         ledger,
         currentRecordsByStep,
         terminalStepIds,
+        uncommittedStepIds,
+        ledgerNote,
         unresolved: unresolvedLedgerRecords(ledger),
-        ...(checkpoint ? { checkpoint } : {}),
+        ...(options.evaluatedHead ? { evaluatedHead: options.evaluatedHead } : {}),
+        ...(checkpoint && checkpointIsEvidence
+            ? { checkpoint: { branch: checkpoint.branch, sha: checkpoint.sha } }
+            : {}),
+        ...(checkpoint && !checkpointIsEvidence
+            ? {
+                staleCheckpoint: {
+                    branch: checkpoint.branch,
+                    sha: checkpoint.sha,
+                    reason: staleReason ?? "not_evaluated",
+                },
+            }
+            : {}),
         artifactPaths,
     };
 }
-async function readInlineCheckpoint(docsDir, ticketKey) {
+function sameCheckpoint(a, b) {
+    return (a.branch === b.branch &&
+        a.sha === b.sha &&
+        a.producedRecordCount === b.producedRecordCount &&
+        a.producePlanFingerprint === b.producePlanFingerprint);
+}
+/**
+ * Read and structurally validate the checkpoint artifact.
+ *
+ * Filesystem only. A legacy checkpoint with no coverage fields reads as covering
+ * zero produce records; it is never upgraded by inferring coverage from the
+ * current ledger. Malformed coverage, or a mis-versioned artifact, fails closed.
+ */
+export async function readInlineCheckpoint(docsDir, ticketKey) {
+    ticketKey = assertValidTicketKey(ticketKey);
     const relativePath = checkpointRelativePath(ticketKey);
     const absolutePath = resolveWithinRoot(docsDir, relativePath);
     const parsed = await readJsonArtifact(absolutePath, relativePath);
@@ -333,7 +433,69 @@ async function readInlineCheckpoint(docsDir, ticketKey) {
         artifact.sha.trim() === "") {
         throw new PlanLedgerError(`${relativePath} is missing its branch or sha`);
     }
-    return { branch: artifact.branch, sha: artifact.sha };
+    const hasCount = artifact.produce_record_count !== undefined;
+    const fingerprintValue = artifact.produce_plan_fingerprint;
+    if (!hasCount) {
+        if (fingerprintValue !== undefined && fingerprintValue !== null) {
+            throw new PlanLedgerError(`${relativePath} has a produce fingerprint but no record count`);
+        }
+        return {
+            branch: artifact.branch,
+            sha: artifact.sha,
+            producedRecordCount: 0,
+            producePlanFingerprint: null,
+        };
+    }
+    const count = artifact.produce_record_count;
+    if (typeof count !== "number" || !Number.isInteger(count) || count < 0) {
+        throw new PlanLedgerError(`${relativePath} has an invalid produce_record_count`);
+    }
+    if (count > 0 && (typeof fingerprintValue !== "string" || fingerprintValue === "")) {
+        throw new PlanLedgerError(`${relativePath} covers produce records but has no valid produce_plan_fingerprint`);
+    }
+    if (count === 0 &&
+        fingerprintValue !== undefined &&
+        fingerprintValue !== null &&
+        typeof fingerprintValue !== "string") {
+        throw new PlanLedgerError(`${relativePath} has an invalid produce_plan_fingerprint`);
+    }
+    return {
+        branch: artifact.branch,
+        sha: artifact.sha,
+        producedRecordCount: count,
+        producePlanFingerprint: typeof fingerprintValue === "string" && fingerprintValue !== "" ? fingerprintValue : null,
+    };
+}
+/**
+ * How much of the produce artifact a checkpoint written now would cover.
+ *
+ * Structural validation only, with no plan metadata fetch: the count and the
+ * artifact's stored fingerprint are read as written. An absent artifact covers
+ * zero records, and nothing is created to calculate that.
+ */
+async function readProduceCoverage(docsDir, ticketKey) {
+    const relativePath = phaseResultRelativePath(ticketKey, "produce");
+    const absolutePath = resolveWithinRoot(docsDir, relativePath);
+    const parsed = await readJsonArtifact(absolutePath, relativePath);
+    if (parsed === undefined)
+        return { count: 0, fingerprint: null };
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new PlanLedgerError(`${relativePath} is not a phase-result artifact object`);
+    }
+    const artifact = parsed;
+    if (artifact.artifact_version !== PHASE_RESULT_ARTIFACT_VERSION) {
+        throw new PlanLedgerError(`${relativePath} has unsupported artifact_version ${String(artifact.artifact_version)}; expected ${PHASE_RESULT_ARTIFACT_VERSION}`);
+    }
+    if (artifact.ticket_key !== ticketKey || artifact.phase !== "produce") {
+        throw new PlanLedgerError(`${relativePath} does not describe the produce phase of '${ticketKey}'`);
+    }
+    if (typeof artifact.plan_fingerprint !== "string" || artifact.plan_fingerprint === "") {
+        throw new PlanLedgerError(`${relativePath} has no plan_fingerprint`);
+    }
+    if (!Array.isArray(artifact.records)) {
+        throw new PlanLedgerError(`${relativePath} has no records array`);
+    }
+    return { count: artifact.records.length, fingerprint: artifact.plan_fingerprint };
 }
 // ---------------------------------------------------------------------------
 // Writing
@@ -435,6 +597,10 @@ export async function writeInlineCheckpoint(options) {
     if (checkpoint.pushed !== true || checkpoint.remoteMatchesHead !== true) {
         throw new PlanLedgerError("checkpoint must report pushed and remoteMatchesHead true; a checkpoint that is not on origin is not a checkpoint");
     }
+    // Coverage is derived here from the produce artifact as it stands, never taken
+    // from the caller: the push facts above are the caller's claim, but what the
+    // push covers is a fact about the ledger this module owns.
+    const coverage = await readProduceCoverage(docsDir, ticketKey);
     const relativePath = checkpointRelativePath(ticketKey);
     const absolutePath = resolveWithinRoot(docsDir, relativePath);
     const artifact = {
@@ -444,6 +610,8 @@ export async function writeInlineCheckpoint(options) {
         sha,
         pushed: true,
         remote_matches_head: true,
+        produce_record_count: coverage.count,
+        produce_plan_fingerprint: coverage.fingerprint,
     };
     await writeAtomically(absolutePath, relativePath, artifact);
     return { branch, sha, artifactPath: relativePath };

package/build/pipeline-utils.js

@@ -178,7 +178,7 @@ export const UPGRADE_ADVICE_SURFACING_INSTRUCTIONS = " Upgrade advice: when any
 export function resolveRecipe(pipeline, instructions, variables, skipSteps, autoApprove, options) {
     // Validate required variables are provided
     const declared = pipeline.variables ?? [];
-    const missing = declared.filter((v) => !(v in variables));
+    const missing = declared.filter((v) => v !== "verification_scope" && !(v in variables));
     if (missing.length > 0) {
         throw new Error(`Missing required variable(s): ${missing.join(", ")}. ` +
             `Pipeline "${pipeline.name}" declares: [${declared.join(", ")}].`);
@@ -189,7 +189,11 @@ export function resolveRecipe(pipeline, instructions, variables, skipSteps, auto
     // `execution_mode` must not be able to make a phase believe an orchestrator is
     // watching when none is.
     const executionMode = options?.executionMode ?? "inline";
-    variables = { ...variables, [EXECUTION_MODE_VARIABLE]: executionMode };
+    variables = {
+        ...variables,
+        verification_scope: variables.verification_scope === "targeted" ? "targeted" : "full",
+        [EXECUTION_MODE_VARIABLE]: executionMode,
+    };
     // Filter and resolve steps
     const resolvedSteps = [];
     let stepIndex = 1;