@bridge_gpt/mcp-server 0.2.67 → 0.2.68

package/build/executor/preflight.js

@@ -12,7 +12,7 @@ import { spawnSync } from "node:child_process";
 import { defaultResolveBinPath } from "../start-tickets-conductor.js";
 import { CORRECTION_INTENT_CAPABILITY } from "./correction-dispatch.js";
 import { resolveAllExecutorApiAccess, resolveBaseUrl, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
-import { FOCUSED_REBASE_CAPABILITY, SCOPE_WAIT_CAPABILITY } from "./types.js";
+import { FOCUSED_REBASE_CAPABILITY, GATE_QUALIFICATION_CAPABILITY, SCOPE_WAIT_CAPABILITY, } from "./types.js";
 /**
  * Environment override for the deny probe's headless timeout (BAPI-722).
  *
@@ -68,7 +68,7 @@ export function resolveDenyProbeTimeoutMs(env = {}) {
  * hang, a control refusal, and a degraded guess all report `layer: "none"` for the
  * posture they happened under, and none of them is cached.
  */
-function isCacheableDenyResult(result) {
+function isVerifiedDenyResult(result) {
     if (result.enforced !== true || result.layer === "none")
         return false;
     const postures = result.postures;
@@ -76,17 +76,38 @@ function isCacheableDenyResult(result) {
         return true;
     return postures.every((p) => p.enforced === true && p.layer !== "none");
 }
+function isCacheableDenyResult(result) {
+    return result.degraded !== true && isVerifiedDenyResult(result);
+}
 /** Create a fresh, empty executor-scoped deny-probe cache. */
 export function createDenyProbeCache() {
     let cached;
+    let failedProbe = false;
+    let retryAt = 0;
+    let failures = 0;
+    const schedule = (nowMs) => {
+        failures += 1;
+        retryAt = nowMs + Math.min(30, 2 ** Math.min(failures - 1, 5)) * 60_000;
+    };
     return {
-        get: () => cached,
-        set: (result) => {
-            if (isCacheableDenyResult(result))
-                cached = result;
+        get: (nowMs = Date.now()) => cached && (isCacheableDenyResult(cached) || nowMs < retryAt) ? cached : undefined,
+        failedProbeDue: (nowMs) => failedProbe && nowMs < retryAt,
+        recordFailedProbe: (nowMs) => { failedProbe = true; schedule(nowMs); },
+        set: (result, nowMs = Date.now()) => {
+            failedProbe = false;
+            cached = result;
+            if (isCacheableDenyResult(result)) {
+                failures = 0;
+                retryAt = 0;
+            }
+            else
+                schedule(nowMs);
         },
         reset: () => {
             cached = undefined;
+            failedProbe = false;
+            failures = 0;
+            retryAt = 0;
         },
     };
 }
@@ -412,7 +433,11 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     let denyEnforced = false;
     try {
         const cache = seams.bypassDenyProbeCache === true ? undefined : seams.denyProbeCache;
-        const cachedDeny = cache?.get();
+        if (cache?.failedProbeDue?.(deps.now?.() ?? Date.now())) {
+            fatalFindings.push("deny-layer enforcement probe failed; refusing to claim");
+            throw new Error("cached deny probe failure");
+        }
+        const cachedDeny = cache?.get(deps.now?.() ?? Date.now());
         let deny;
         if (cachedDeny !== undefined) {
             deny = cachedDeny;
@@ -421,7 +446,7 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
             // An explicitly injected probe still wins, so every existing test seam
             // keeps working unchanged across the extraction.
             deny = await seams.runDenyPreflight({ timeoutMs: resolveDenyProbeTimeoutMs(deps.env) });
-            seams.denyProbeCache?.set(deny);
+            seams.denyProbeCache?.set(deny, deps.now?.() ?? Date.now());
         }
         else {
             // Otherwise the ADAPTER's declared deny hook probes. The verdict is mapped
@@ -452,10 +477,10 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
             };
             // `set` itself refuses anything that is not a genuine success, so a failure
             // cannot become sticky even if this call site were later moved.
-            seams.denyProbeCache?.set(deny);
+            seams.denyProbeCache?.set(deny, deps.now?.() ?? Date.now());
         }
-        denyEnforced = deny.enforced === true;
-        if (!deny.enforced) {
+        denyEnforced = isVerifiedDenyResult(deny);
+        if (!denyEnforced) {
             fatalFindings.push(`deny-layer enforcement not verified (enforced=false, layer=${deny.layer}); refusing to claim`);
         }
         else if (deny.layer === "none") {
@@ -465,7 +490,11 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         }
     }
     catch {
-        fatalFindings.push("deny-layer enforcement probe failed; refusing to claim");
+        if (!fatalFindings.includes("deny-layer enforcement probe failed; refusing to claim")) {
+            fatalFindings.push("deny-layer enforcement probe failed; refusing to claim");
+            if (!seams.bypassDenyProbeCache)
+                seams.denyProbeCache?.recordFailedProbe?.(deps.now?.() ?? Date.now());
+        }
     }
     // --- Advisory MCP-shadowing inspection (BAPI-727 → BAPI-790 → BAPI-781) --
     // This was a refusal under BAPI-727, because a `bridge-api` entry in the
@@ -584,6 +613,13 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
  * once ordinary preflight permits claiming — independently of completion-evidence
  * qualification. The completion tokens keep their exact conditional behavior and
  * order; the focused token is appended after them.
+ *
+ * BAPI-1391 adds two things. `gate_qualification.v1` is appended to
+ * `capabilities` ONLY on a repository-wide executor (see the comment at the
+ * token). And `job_types` is emitted, by conditional spread under the same
+ * "truly absent" rule, ONLY when `options.jobTypes` is set and non-empty; with
+ * it unset every manifest keeps its exact pre-BAPI-1391 shape apart from that
+ * one capability token on repository-wide executors.
  */
 export function buildClaimManifest(report, options, freeSlots) {
     return {
@@ -616,6 +652,19 @@ export function buildClaimManifest(report, options, freeSlots) {
             SCOPE_WAIT_CAPABILITY,
             ...(report.correctionIntentQualified === true ? [CORRECTION_INTENT_CAPABILITY] : []),
             ...(report.correctionIntentQualified === true ? ["ci_evidence.v1"] : []),
+            // BAPI-1391: repository-wide executors only. A `gate_qualification` row is
+            // run-less (no `epic_run_id`), and run-less rows pass the server's
+            // run-scope filter, so a run-scoped executor advertising this token could
+            // pick up repository-level qualification work it was never dedicated to.
+            // Gating the token on `repoWide` keeps that work on the executor whose
+            // operator chose the whole repository.
+            ...(options.repoWide === true ? [GATE_QUALIFICATION_CAPABILITY] : []),
         ],
+        // BAPI-1391: an optional job-type filter, present only when configured. An
+        // older server rejects the key with a 422, so it must never appear by
+        // default.
+        ...(options.jobTypes !== undefined && options.jobTypes.length > 0
+            ? { job_types: [...options.jobTypes] }
+            : {}),
     };
 }

package/build/executor/process-containment.js

@@ -266,6 +266,15 @@ export function buildCleanupVerdict(verdict, survivors, reasons) {
 export function unconfirmedCleanup(reason) {
     return buildCleanupVerdict("unconfirmed", 0, [reason]);
 }
+/**
+ * The verdict when no sweep was attempted because ownership could not be
+ * proven (invalid token, malformed or unreadable ownership record). The extra
+ * `not_run` reason keeps this shape distinct from a completed sweep that merely
+ * could not verify ownership, so it is never treated as continuable.
+ */
+function noSweepCleanup() {
+    return buildCleanupVerdict("unconfirmed", 0, ["ownership_unverifiable", "not_run"]);
+}
 /** Hard cap on distinct processes tracked by one sweep or one descendant tracker. */
 const MAX_TRACKED_PROCESSES = 1024;
 /** Confirmation enumerations after SIGKILL (a killed process can take a moment to leave). */
@@ -302,8 +311,14 @@ export function createDescendantTracker(options) {
                     else
                         childrenOf.set(proc.ppid, [proc]);
                 }
-                // Seeds: the root (when its identity matches) and every tracked member
-                // still live with the SAME start time. A reused pid is not a seed.
+                // Prune first: a member survives only while its exact (pid, startedAt)
+                // is still in this successful listing. Exited descendants must not
+                // exhaust the cap, and a reused pid loses its old identity.
+                for (const [key, member] of members) {
+                    const live = byPid.get(member.pid);
+                    if (!live || live.startedAt !== member.startedAt)
+                        members.delete(key);
+                }
                 const frontier = [];
                 const rootNow = byPid.get(rootPid);
                 if (rootNow) {
@@ -312,12 +327,11 @@ export function createDescendantTracker(options) {
                     if (rootNow.startedAt === rootStartedAt)
                         frontier.push(rootPid);
                 }
-                for (const member of members.values()) {
-                    const live = byPid.get(member.pid);
-                    if (live && live.startedAt === member.startedAt)
-                        frontier.push(member.pid);
-                }
+                for (const member of members.values())
+                    frontier.push(member.pid);
                 const visited = new Set(frontier);
+                let liveCount = members.size;
+                let capHit = false;
                 while (frontier.length > 0) {
                     const parent = frontier.pop();
                     for (const child of childrenOf.get(parent) ?? []) {
@@ -326,8 +340,9 @@ export function createDescendantTracker(options) {
                         visited.add(child.pid);
                         const key = keyOf(child);
                         if (!members.has(key)) {
+                            liveCount += 1;
                             if (members.size >= MAX_TRACKED_PROCESSES) {
-                                overflow = true;
+                                capHit = true;
                                 continue;
                             }
                             members.set(key, { pid: child.pid, startedAt: child.startedAt });
@@ -335,6 +350,15 @@ export function createDescendantTracker(options) {
                         frontier.push(child.pid);
                     }
                 }
+                if (capHit && !overflow) {
+                    overflow = true;
+                    try {
+                        options.onOverflow?.(liveCount);
+                    }
+                    catch {
+                        /* a diagnostic failure never changes tracking or the verdict */
+                    }
+                }
             }
             catch {
                 /* sampling is best-effort; the sweep's own verdict stays authoritative */
@@ -399,7 +423,7 @@ export async function runOwnedProcessSweep(options) {
     const maxRounds = Math.max(quietRounds, options.maxRounds ?? 200);
     const roundDelayMs = Math.max(0, options.roundDelayMs ?? 15);
     if (!isOwnershipToken(token))
-        return unconfirmedCleanup("ownership_unverifiable");
+        return noSweepCleanup();
     const reasons = new Set();
     if (options.trackerOverflowed)
         reasons.add("ownership_unverifiable");
@@ -700,8 +724,8 @@ async function ownerMayBeAlive(inspector, pid) {
  * interrupted before its own sweep finished. The record holds the exact token,
  * so ownership is verified and the full sweep runs. Only the job id and the
  * verdict are logged — never the token. A malformed record cannot prove
- * ownership: it is reported `unconfirmed / ownership_unverifiable` and removed
- * without signalling anything. Never throws.
+ * ownership: it is reported `unconfirmed` with `ownership_unverifiable` and
+ * `not_run` (no sweep ran) and removed without signalling anything. Never throws.
  */
 export async function recoverInterruptedOwnership(options) {
     const { stateDir, inspector, deps, fsDeps, deadlineMs } = options;
@@ -712,7 +736,7 @@ export async function recoverInterruptedOwnership(options) {
         let verdict;
         try {
             if (record === null) {
-                verdict = unconfirmedCleanup("ownership_unverifiable");
+                verdict = noSweepCleanup();
             }
             else if (options.hostDigest !== undefined && record.hostDigest !== options.hostDigest) {
                 continue;

package/build/executor/process.js

@@ -11,17 +11,19 @@ export const DEFAULT_TERM_GRACE_MS = 10_000;
  */
 export function createProcessTerminationController(proc, deps, termGraceMs = DEFAULT_TERM_GRACE_MS) {
     let requested = false;
+    let cause = null;
     let escalated = false;
     let disposed = false;
     let graceTimer;
     const killListeners = [];
     return {
-        requestTermination() {
+        requestTermination(endCause = "executor_abort") {
             // A disposed controller belongs to a settled child: signalling it would
             // either hit nothing or, worse, a recycled pid.
             if (requested || disposed)
                 return;
             requested = true;
+            cause = endCause;
             proc.kill("SIGTERM");
             graceTimer = deps.setTimer(() => {
                 graceTimer = undefined;
@@ -42,6 +44,9 @@ export function createProcessTerminationController(proc, deps, termGraceMs = DEF
         isTerminationRequested() {
             return requested;
         },
+        endCause() {
+            return cause;
+        },
         dispose() {
             if (disposed)
                 return;
@@ -125,7 +130,7 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
     // shutdown, timeout, and MCP containment converge on a single `SIGTERM` and a
     // single grace timer rather than racing three of each.
     const controller = options.terminationController ?? createProcessTerminationController(proc, deps, termGraceMs);
-    const terminate = () => controller.requestTermination();
+    const terminate = (cause) => controller.requestTermination(cause);
     // BAPI-1301 (D4a): the authoritative consumer, when supplied. `drainClosed`
     // flips once the bounded post-exit drain gives up, so a chunk arriving after
     // the verdict was taken can never mutate the ledger behind the caller's back.
@@ -160,18 +165,16 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
         stdoutExcerpt = appendBounded(stdoutExcerpt, chunk, limit);
         if (options.onStdoutTerminationCheck?.(chunk) === true && !terminationRequested) {
             terminationRequested = true;
-            terminate();
+            terminate("executor_abort");
         }
     });
     const pumpStderr = pump(proc.stderr, (chunk) => {
         stderrExcerpt = appendBounded(stderrExcerpt, chunk, limit);
     });
-    let timedOut = false;
     const timeoutTimer = deps.setTimer(() => {
-        timedOut = true;
         // Same escalation the assertion uses; the guard inside makes a timeout that
         // races an already-requested termination a no-op rather than a double signal.
-        terminate();
+        terminate("job_timeout");
     }, timeoutSeconds * 1000);
     // BAPI-1301 (D4a): bounded waits, only when a drain deadline was supplied.
     // Every timer created here is cleared before returning.
@@ -226,9 +229,13 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
             deps.clearTimer(handle);
     }
     let classification;
-    if (timedOut) {
+    const endCause = controller.endCause?.() ?? null;
+    if (endCause === "job_timeout") {
         classification = "timeout";
     }
+    else if (endCause !== null) {
+        classification = "killed";
+    }
     else if (exitCode === 0) {
         classification = "clean_exit";
     }
@@ -241,6 +248,7 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
         signal,
         stdoutExcerpt,
         stderrExcerpt,
+        endCause: endCause ?? "worker_exit",
         ...(terminationRequested ? { terminationRequested: true } : {}),
         // BAPI-1301 fields appear only for callers that opted in, so every legacy
         // result keeps its exact shape.

package/build/executor/prompt-spec.js

@@ -1,3 +1,4 @@
+import { renderWorkerVerificationGuidance } from "./worker-verification-guidance.js";
 /**
  * Executor-side structured prompt-spec renderer (BAPI-550, TDD §6/§7).
  *
@@ -18,6 +19,35 @@
  * or reasons.
  */
 import { CiFixContext, ExecutorNamedError } from "./job-errors.js";
+import { EPIC_WORKAROUNDS_DIR, epicWorkaroundRecordPath } from "../epic-workarounds-path.js";
+/**
+ * BAPI-1399 — the workaround contract for a PR-producing Epic Implementer worker.
+ *
+ * A requirement the worker cannot meet unattended (a missing credential, an
+ * external setting, or access) is either MINOR — the ticket's essential
+ * behavior still works without it — or CORE. A minor gap gets a guarded
+ * workaround and a committed record at `.bridge/epic-workarounds/<TICKET>.md`;
+ * while that folder exists on the epic head the integration pull request stays
+ * in draft. A core gap is never worked around: the worker leaves the required
+ * work unfinished, which parks the ticket as `required_work_incomplete` through
+ * the unchanged completion contract.
+ *
+ * The worker decides from the ticket and the code alone; no supervisor scan
+ * result is injected here. Kept SINGLE-LINE and free of `;`, quotes, and
+ * apostrophes, like `buildPrBaseContractLaunchInstruction`, because it travels
+ * in the same launch prompt.
+ */
+export function buildEpicWorkaroundWorkerInstruction(ticketKey) {
+    const record = (ticketKey ? epicWorkaroundRecordPath(ticketKey) : null) ?? `${EPIC_WORKAROUNDS_DIR}<TICKET>.md`;
+    return ("Workaround contract: if a requirement of this ticket cannot be met unattended, such as a missing " +
+        "credential, external setting, or access, decide whether it is minor or core. It is minor only when " +
+        "the essential behavior of the ticket still works without it. For a minor gap, deliver a guarded " +
+        "workaround: guard exactly the deferred behavior (for example, check for a missing setting and skip " +
+        "only that feature), keep the core path working, and write " + record + " naming the requirement, " +
+        "the guarded substitute you delivered, and the step a human must still take. Commit that record on " +
+        "this ticket branch with git add -f " + record + ". For a core gap, never write a workaround or a " +
+        "record: leave the required work unfinished so the run parks this ticket for a human.");
+}
 /** Stable named-error kind used for every prompt-spec contract failure. */
 const PROMPT_CONTRACT_ERROR = "ContractError.Prompt";
 /** The prompt-spec version this renderer understands. */
@@ -647,5 +677,7 @@ export async function renderPromptSpecPrompt(job, context) {
     const values = await buildPromptSpecPlaceholderValues(job, spec, context);
     const systemPrompt = buildPromptSpecSystemPrompt(spec, values);
     const userPrompt = buildPromptSpecUserPrompt(spec, values);
-    return `${systemPrompt}\n\n${userPrompt}`;
+    return `${systemPrompt}\n\n${userPrompt}` +
+        (!context.deferComparisonGuidance && ["implement", "resume", "ci_fix"].includes(job.job_type)
+            ? "\n\n" + renderWorkerVerificationGuidance(context.comparisonSha) : "");
 }

package/build/executor/recently-failed-tests-file.js

@@ -0,0 +1,71 @@
+/** Atomic resolver refresh. Caller retains the exclusive worktree lock. */
+import path from "node:path";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, realpath, rename, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { parseRecentlyFailedTests, RECENTLY_FAILED_TESTS_PATH } from "./likely-tests.js";
+export function validatedRecentFailures(value) {
+    if (value === undefined)
+        return { version: 1, tests: [], truncated: false };
+    const parsed = parseRecentlyFailedTests(value);
+    if (!parsed.available || parsed.skipped || JSON.stringify(value).length > 16 * 1024 ||
+        value.tests.length > 20)
+        throw new Error("recent_failure_schema_invalid");
+    return parsed.value;
+}
+export async function writeRecentlyFailedTestsFile(worktree, value) {
+    const selection = validatedRecentFailures(value);
+    const root = await realpath(worktree);
+    const directory = path.join(root, ".conductor");
+    try {
+        await mkdir(directory);
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw new Error("recent_failure_directory_unavailable");
+    }
+    const directoryStat = await lstat(directory);
+    if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || await realpath(directory) !== directory)
+        throw new Error("recent_failure_directory_unsafe");
+    const destination = path.join(root, RECENTLY_FAILED_TESTS_PATH);
+    const safeDestination = async () => {
+        if (await realpath(directory) !== directory || !(await lstat(directory)).isDirectory() ||
+            (await lstat(directory)).isSymbolicLink())
+            throw new Error("recent_failure_directory_changed");
+        try {
+            const stat = await lstat(destination);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw new Error("recent_failure_destination_unsafe");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    };
+    await safeDestination();
+    const temporary = path.join(directory, `.recent-failures-${randomUUID()}.tmp`);
+    let created = false;
+    try {
+        const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        created = true;
+        try {
+            await handle.writeFile(JSON.stringify(selection) + "\n", "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        if (await realpath(temporary) !== temporary || !(await lstat(temporary)).isFile())
+            throw new Error("recent_failure_temporary_unsafe");
+        await safeDestination();
+        const current = await lstat(directory);
+        if (current.ino !== directoryStat.ino || current.dev !== directoryStat.dev)
+            throw new Error("recent_failure_directory_changed");
+        await rename(temporary, destination);
+        created = false;
+    }
+    finally {
+        if (created && await realpath(directory).catch(() => "") === directory)
+            await unlink(temporary).catch(() => { });
+    }
+}

package/build/executor/reconcile-overlap-job.js

@@ -1,3 +1,4 @@
+import { guardedFastForwardPush, PUSH_AUTH_FAILURE_RE } from "./guarded-fast-forward-push.js";
 /**
  * The `reconcile_overlap` executor job (BAPI-1152).
  *
@@ -71,7 +72,6 @@ const CONFLICT_REPORT_DIR = ".conductor/";
 const CONDUCTOR_ARTIFACT_DIR = ".conductor/";
 /** Command bounds. */
 const GIT_TIMEOUT_MS = 120_000;
-const PUSH_TIMEOUT_MS = 180_000;
 const COMMAND_OUTPUT_TAIL_CHARS = 4_000;
 /** Left in the job budget when the wrapper waits for provider checks. */
 const CI_WAIT_MARGIN_MS = 90_000;
@@ -91,8 +91,6 @@ const WRAPPER_STAGE_EXCLUDES = [
     ":(exclude).claude/settings.local.json",
 ];
 const SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
-const PUSH_AUTH_FAILURE_RE = /authentication failed|could not read username|permission denied|terminal prompts disabled|invalid username or password|returned error: 403|requested url returned error: 401/i;
-const PUSH_LEASE_FAILURE_RE = /stale info|\[rejected\]|non-fast-forward|fetch first/i;
 class PayloadError extends Error {
 }
 function asRecord(value, field) {
@@ -339,9 +337,13 @@ export function createReconcileOverlapDriver(job, payload, seams) {
     const git = async (ctx, args, timeoutMs = GIT_TIMEOUT_MS, env) => {
         if (ctx.signal?.aborted)
             throw new ReconcileOverlapAborted("reconciliation phase aborted");
+        const remaining = "remainingMs" in ctx ? ctx.remainingMs() : timeoutMs;
+        if (remaining <= 0)
+            throw new ReconcileOverlapAborted("reconciliation deadline expired");
         return seams.runCommand("git", args, {
             cwd: ctx.worktreePath,
-            timeoutMs,
+            timeoutMs: Math.min(timeoutMs, remaining),
+            signal: ctx.signal,
             ...(env ? { env } : {}),
         });
     };
@@ -374,8 +376,12 @@ export function createReconcileOverlapDriver(job, payload, seams) {
         result: envelope(extra),
         ...(lastCommitSha ? { lastCommitSha } : {}),
     });
+    let preserveHead = false;
+    let cleanupHead = payload.childHead;
     /** Reset to the recorded child head. Never throws. */
     const resetToChildHead = async (ctx) => {
+        if (preserveHead)
+            return;
         try {
             const mergeHead = await seams.runCommand("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"], {
                 cwd: ctx.worktreePath,
@@ -384,7 +390,7 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             if (mergeHead.exitCode === 0) {
                 await seams.runCommand("git", ["merge", "--abort"], { cwd: ctx.worktreePath, timeoutMs: GIT_TIMEOUT_MS });
             }
-            await seams.runCommand("git", ["reset", "--hard", payload.childHead], {
+            await seams.runCommand("git", ["reset", "--hard", cleanupHead], {
                 cwd: ctx.worktreePath,
                 timeoutMs: GIT_TIMEOUT_MS,
             });
@@ -595,35 +601,33 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             }
             return complete({ observed_epic_head: heads.epic });
         }
-        // (2) The ONE push: a fast-forward of the child branch, leased on the
-        // recorded child head. Never plain --force, never a lease-less lease.
-        const destination = `refs/heads/${payload.expectedBranch}`;
-        const push = await git(ctx, [
-            "push",
-            "--no-verify",
-            "--porcelain",
-            `--force-with-lease=${destination}:${payload.childHead}`,
-            "origin",
-            `HEAD:${destination}`,
-        ], PUSH_TIMEOUT_MS, { ...seams.env, GIT_TERMINAL_PROMPT: "0" });
-        if (push.exitCode !== 0) {
-            const text = `${push.stdout}\n${push.stderr}`;
-            if (PUSH_AUTH_FAILURE_RE.test(text)) {
+        const push = await guardedFastForwardPush({
+            branch: payload.expectedBranch, expectedOriginSha: payload.childHead,
+            candidateSha: candidate, trustedExcludedShas: [payload.requiredEpicSha],
+            worktreePath: ctx.worktreePath, runCommand: seams.runCommand, env: seams.env,
+            remainingMs: ctx.remainingMs, signal: ctx.signal, mayMutate: () => !ctx.signal.aborted,
+        });
+        if (push.status !== "published") {
+            if (push.reason === "auth_failed") {
                 await resetToChildHead(ctx);
                 return fail(ReconcileOverlapPushUnauthorized, "pushed", "the executor's git credential helper refused the push");
             }
-            if (PUSH_LEASE_FAILURE_RE.test(text)) {
+            if (push.reason === "lease_rejected") {
                 const reread = await readRemoteHeads(ctx);
                 await resetToChildHead(ctx);
-                if (reread.ok && reread.child !== null && reread.child !== payload.childHead) {
+                if (reread.ok && reread.child !== null && reread.child !== payload.childHead)
                     return complete({ observed_child_head: reread.child });
-                }
             }
-            else {
+            else if (push.reason !== "timeout" && !ctx.signal.aborted) {
                 await resetToChildHead(ctx);
             }
+            else {
+                preserveHead = true;
+            }
             return fail(ReconcileOverlapPushRejected, "pushed", "the remote refused the guarded push");
         }
+        preserveHead = true;
+        ctx.recordPublication?.(push);
         // (3) Finalization runs ONCE, after the wrapper's push, against the pushed
         // head: origin must carry it and the PR must be attached at it.
         const finalize = seams.finalize ?? validateWorkerFinalization;
@@ -633,6 +637,7 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             worktreePath: ctx.worktreePath,
             result: {},
             runCommand: seams.runCommand,
+            callTimeoutMs: () => Math.min(GIT_TIMEOUT_MS, ctx.remainingMs()),
             headSha: candidate,
             expectedBaseBranch: ctx.effectiveBaseBranch,
             originResolveAttempts: FINALIZATION_ATTEMPTS,
@@ -658,6 +663,16 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             if (ctx.branch !== payload.expectedBranch) {
                 return finish(fail(ReconcileOverlapBranchMismatch, "validated", "the prepared worktree is not on the job's expected branch"));
             }
+            if (ctx.preparationPublication) {
+                preserveHead = true;
+                const heads = await readRemoteHeads(ctx);
+                if (!heads.ok)
+                    return finish(heads.outcome);
+                if (heads.child === null)
+                    return finish(fail(ReconcileOverlapPushRejected, "validated", "the child branch no longer exists on origin"));
+                cleanupHead = heads.child;
+                return finish(complete({ observed_child_head: heads.child }));
+            }
             // Fetch the exact server-supplied inputs. The job never infers a head.
             await git(ctx, ["fetch", "--no-tags", "origin", payload.epicBranch], GIT_TIMEOUT_MS, {
                 ...seams.env,
@@ -831,6 +846,9 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             return pushFlow(ctx);
         },
         async abandon(ctx) {
+            // Wrapper-created merges are not retained worker progress until their
+            // verification/publication gate succeeds. Published or ambiguous pushes,
+            // including preparation publication, already set preserveHead above.
             await resetToChildHead(ctx);
         },
     };

package/build/executor/required-verification.js

@@ -236,7 +236,7 @@ export function createSupervisedCommandLauncher(input) {
         let cancelled = false;
         const onAbort = () => {
             cancelled = true;
-            controller.requestTermination();
+            controller.requestTermination("executor_abort");
         };
         request.signal.addEventListener("abort", onAbort, { once: true });
         try {