@bridge_gpt/mcp-server 0.2.68 → 0.2.70

package/build/executor/permissions.js

@@ -35,6 +35,7 @@
  * (claude 2.1.201), so plain `permissions.deny` is provisioned; the PreToolUse
  * fallback is available for CLIs where settings-deny is not enforced.
  */
+import { randomUUID } from "node:crypto";
 import path from "node:path";
 import { mergeClaudeSettingsWithAutoMemoryDisabled, mergeClaudeSettingsWithCommandHook, provisionClaudeSettingsForWorktree, DEFAULT_PRE_TOOL_USE_MATCHER, } from "../claude-settings.js";
 /**
@@ -276,139 +277,234 @@ function excludeWarning(worktreePath, category) {
         `${EXECUTOR_EXCLUDE_LINES.join(" and ")} are not protected from worker commits on this ` +
         "worktree; inspect it before trusting the worktree's staged changes; continuing fail-open.");
 }
+const EXCLUDE_UNRESOLVED_CATEGORY = {
+    no_gitdir_pointer: "git metadata carries no gitdir pointer",
+    metadata_unreadable: "git metadata could not be read",
+    metadata_invalid: "git metadata does not reference a usable git directory",
+    commondir_unusable: "the git common-directory pointer is unusable",
+    exclude_unreadable: "the exclude file could not be read",
+    writability_unknown: "exclude writability could not be determined",
+};
+function errnoCode(err) {
+    return err && typeof err === "object" ? err.code : undefined;
+}
+const S_IFMT = 0o170000;
+const S_IFDIR = 0o040000;
+/** `true` / `false` for a directory / non-directory; `null` when it is absent. */
+async function directoryState(deps, dirPath) {
+    try {
+        return ((await deps.stat(dirPath)).mode & S_IFMT) === S_IFDIR;
+    }
+    catch (err) {
+        if (errnoCode(err) === "ENOENT")
+            return null;
+        throw err;
+    }
+}
 /**
- * Keep the executor-owned `.claude/settings.local.json` and the conductor's
- * `.conductor/` artifacts out of worker commits (BAPI-740/F2, BAPI-814/D2).
- * Worker-config isolation redirects `XDG_CONFIG_HOME`, so the
- * operator's global git excludes (`~/.config/git/ignore`) no longer apply inside
- * a worker — empirically, a worker `git add -A` commits the deny-layer file this
- * module just wrote. A per-worktree `.git/info/exclude` entry is invisible to
- * the diff and travels with the gitdir, so it closes that without touching the
- * worktree's tracked `.gitignore`.
- *
- * A linked worktree's `.git` is a FILE containing `gitdir: <path>` pointing at
- * the main repository's per-worktree gitdir; that indirection is resolved rather
- * than assuming a directory (`EISDIR` on the read identifies a real main-checkout
- * `.git` directory). The per-worktree gitdir is then resolved onward to the
- * COMMON dir, because that — not the per-worktree dir — is where git reads
- * `info/exclude` from; see the comment at the resolution site. Idempotent: the
- * line is appended once, never duplicated.
+ * Locate the COMMON `info/exclude` for a checkout, with filesystem reads only (no
+ * Git subprocess, no writes). Shared by the writer and the read-only resolver so
+ * they can never disagree about the destination.
  *
- * Fail-open at every step, matching the rest of this module — but NOT silent
- * (BAPI-815/R2). Two outcomes that used to be the same `{ ok: true }` are now
- * told apart:
- *
- *   - **No checkout at all** (`ENOENT` on `.git`) — a benign no-op. There is
- *     nothing to protect, so there is nothing to warn about.
- *   - **Present but unresolvable** (`.git` exists but carries no `gitdir:`
- *     pointer, or cannot be read) — non-blocking, but WARNED. Git metadata is
- *     there and the executor could not use it, which means the settings file is
- *     unprotected on this worktree and a human should look.
- *
- * That distinction is the whole fix: a total failure to ever write was invisible
- * precisely because "could not resolve" and "nothing to do" returned the same
- * silent success.
- *
- * Warnings are bounded to a failure category plus the affected worktree path.
- * They never carry `.git` contents, exception text, environment values, or
- * settings-file content.
+ * `info/` is a COMMON-dir file: git reads exclusions from `<common>/info/exclude`,
+ * and for a linked worktree the common dir is the MAIN repository's `.git`, not
+ * `<main>/.git/worktrees/<name>` (BAPI-815/R2 — writing to the per-worktree gitdir
+ * made the whole mechanism a no-op). `<gitdir>/commondir` holds the pointer. Its
+ * ABSENCE (`ENOENT`) is the only case that falls back to the git dir itself (a main
+ * checkout); any other read error, or a pointer that does not name a directory, is
+ * unresolved rather than a guess.
  */
-async function provisionWorktreeSettingsExclude(worktreePath, deps) {
+async function resolveWorktreeExcludePath(worktreePath, deps) {
     const gitPath = path.join(worktreePath, ".git");
     let gitDir;
     try {
         const raw = await deps.readFile(gitPath);
         const match = /^gitdir:\s*(.+?)\s*$/m.exec(raw);
-        if (!match) {
-            // A readable `.git` file with no gitdir pointer is not git metadata this
-            // function understands; do not guess at a location to write into. Present
-            // but unusable — degrade loudly rather than reporting a clean success.
-            return {
-                ok: true,
-                warning: excludeWarning(worktreePath, "git metadata carries no gitdir pointer"),
-            };
-        }
+        if (!match)
+            return { kind: "unresolved", reason: "no_gitdir_pointer" };
         const target = match[1];
         gitDir = path.isAbsolute(target) ? target : path.resolve(worktreePath, target);
-    }
-    catch (err) {
-        const code = err && typeof err === "object" ? err.code : undefined;
-        if (code === "EISDIR") {
-            // Main-checkout shape: `.git` is a real directory.
-            gitDir = gitPath;
-        }
-        else if (code === "ENOENT") {
-            // No git checkout here at all — nothing to protect, nothing to report.
-            return { ok: true };
+        try {
+            const isDir = await directoryState(deps, gitDir);
+            if (isDir !== true)
+                return { kind: "unresolved", reason: "metadata_invalid" };
         }
-        else {
-            // Git metadata is present but could not be read (EACCES, EIO, …). The
-            // error CODE is a bounded category; the exception itself never escapes.
-            return {
-                ok: true,
-                warning: excludeWarning(worktreePath, "git metadata could not be read"),
-            };
+        catch {
+            return { kind: "unresolved", reason: "metadata_unreadable" };
         }
     }
-    // Resolve the COMMON directory before choosing where to write (BAPI-815/R2).
-    //
-    // THIS IS THE DEFECT THAT MADE THE WHOLE MECHANISM A NO-OP. `info/` is one of
-    // git's COMMON-dir files, not a per-worktree one: git reads exclusions from
-    // `<common>/info/exclude`, and for a linked worktree the common dir is the
-    // MAIN repository's `.git`, not `<main>/.git/worktrees/<name>`. Writing to
-    // the per-worktree gitdir put the rule somewhere git never looks, so
-    // `.claude/settings.local.json` stayed stageable in every linked worktree
-    // regardless of this function succeeding. Trees looked clean only because the
-    // operator's `~/.config/git/ignore` carried the same rule — the protection
-    // built to be machine-independent was supplied entirely by machine-specific
-    // config, and the day that global ignore is absent a worker commits the file.
-    //
-    // `<gitdir>/commondir` holds the pointer (usually the relative `../..`), and
-    // it is a plain file, so this needs no new command-runner dependency. Its
-    // absence means this IS the common dir (a main checkout), which is why the
-    // fallback is `gitDir` itself rather than an error.
+    catch (err) {
+        const code = errnoCode(err);
+        if (code === "EISDIR")
+            gitDir = gitPath; // main-checkout shape
+        else if (code === "ENOENT")
+            return { kind: "unresolved", reason: "no_checkout" };
+        else
+            return { kind: "unresolved", reason: "metadata_unreadable" };
+    }
     let commonDir = gitDir;
     try {
         const pointer = (await deps.readFile(path.join(gitDir, "commondir"))).trim();
-        if (pointer.length > 0) {
-            commonDir = path.isAbsolute(pointer) ? pointer : path.resolve(gitDir, pointer);
+        if (pointer.length === 0)
+            return { kind: "unresolved", reason: "commondir_unusable" };
+        commonDir = path.isAbsolute(pointer) ? pointer : path.resolve(gitDir, pointer);
+        try {
+            if ((await directoryState(deps, commonDir)) !== true) {
+                return { kind: "unresolved", reason: "commondir_unusable" };
+            }
+        }
+        catch {
+            return { kind: "unresolved", reason: "commondir_unusable" };
         }
     }
-    catch {
+    catch (err) {
+        if (errnoCode(err) !== "ENOENT")
+            return { kind: "unresolved", reason: "commondir_unusable" };
         /* no commondir pointer: `gitDir` is already the common dir */
     }
+    const infoDir = path.join(commonDir, "info");
+    return { kind: "resolved", excludePath: path.join(infoDir, "exclude"), infoDir };
+}
+/**
+ * Report the local exclude readiness for a checkout WITHOUT changing anything.
+ *
+ * `present` means the exclude file is readable and already contains every
+ * canonical {@link EXECUTOR_EXCLUDE_LINES} entry as an exact line — not merely that
+ * a file exists. An absent file or a missing entry is not present. `writable` comes
+ * from non-writing access checks: the existing file when there is one, otherwise
+ * the nearest existing ancestor that would have to receive the new file.
+ *
+ * This is a local filesystem snapshot. It performs no `mkdir`, write, rename, or
+ * remediation, and it does not verify worker protection or detect remote executor
+ * clones.
+ */
+export async function resolveWorktreeSettingsExclude(worktreePath, deps) {
+    const resolved = await resolveWorktreeExcludePath(worktreePath, deps);
+    if (resolved.kind === "unresolved")
+        return resolved;
+    let content = null;
+    try {
+        content = await deps.readFile(resolved.excludePath);
+    }
+    catch (err) {
+        if (errnoCode(err) !== "ENOENT")
+            return { kind: "unresolved", reason: "exclude_unreadable" };
+    }
+    const lines = new Set((content ?? "").split(/\r?\n/));
+    const present = content !== null && EXECUTOR_EXCLUDE_LINES.every((line) => lines.has(line));
+    let probe = content !== null ? resolved.excludePath : resolved.infoDir;
+    if (content === null) {
+        // Nearest existing ancestor that would have to receive the new file.
+        for (;;) {
+            let exists;
+            try {
+                exists = (await directoryState(deps, probe)) !== null;
+            }
+            catch {
+                return { kind: "unresolved", reason: "writability_unknown" };
+            }
+            if (exists)
+                break;
+            const parent = path.dirname(probe);
+            if (parent === probe)
+                return { kind: "unresolved", reason: "writability_unknown" };
+            probe = parent;
+        }
+    }
+    let writable = true;
+    try {
+        await deps.accessWritable(probe);
+    }
+    catch (err) {
+        const code = errnoCode(err);
+        if (code === "EACCES" || code === "EPERM" || code === "EROFS")
+            writable = false;
+        else
+            return { kind: "unresolved", reason: "writability_unknown" };
+    }
+    return { kind: "resolved", excludePath: resolved.excludePath, present, writable };
+}
+/**
+ * Keep the executor-owned `.claude/settings.local.json` and the conductor's
+ * `.conductor/` artifacts out of worker commits (BAPI-740/F2, BAPI-814/D2).
+ * Worker-config isolation redirects `XDG_CONFIG_HOME`, so the
+ * operator's global git excludes (`~/.config/git/ignore`) no longer apply inside
+ * a worker — empirically, a worker `git add -A` commits the deny-layer file this
+ * module just wrote. A per-worktree `.git/info/exclude` entry is invisible to
+ * the diff and travels with the gitdir, so it closes that without touching the
+ * worktree's tracked `.gitignore`.
+ *
+ * The destination is the COMMON `info/exclude`, located by
+ * {@link resolveWorktreeExcludePath}. Fail-open at every step, but NOT silent
+ * (BAPI-815/R2): no checkout (`ENOENT` on `.git`) is a benign silent success;
+ * present-but-unresolvable metadata is non-blocking but WARNED; a failed read or
+ * publish keeps `ok: false`.
+ *
+ * Publication contract: the file is re-read immediately before composing the
+ * replacement (only `ENOENT` counts as empty), existing content is kept verbatim —
+ * ordering, comments, line endings, and duplicates — and only absent canonical
+ * lines are appended. The result is written to a uniquely named temporary file in
+ * the same `info/` directory and renamed into place; no lockfile is used, and
+ * nothing is published when no canonical line is missing. Competing executor
+ * writers add the same canonical entries, so fresh reads plus atomic publication
+ * prevent torn files and executor-created duplicates. This does not serialize
+ * against unrelated external editors.
+ *
+ * Warnings are bounded to a failure category plus the affected worktree path.
+ * They never carry `.git` contents, exception text, environment values, or
+ * settings-file content.
+ */
+export async function provisionWorktreeSettingsExclude(worktreePath, deps) {
+    const resolved = await resolveWorktreeExcludePath(worktreePath, deps);
+    if (resolved.kind === "unresolved") {
+        if (resolved.reason === "no_checkout")
+            return { ok: true };
+        return {
+            ok: true,
+            warning: excludeWarning(worktreePath, EXCLUDE_UNRESOLVED_CATEGORY[resolved.reason]),
+        };
+    }
+    const { excludePath, infoDir } = resolved;
+    let tempPath;
     try {
-        const infoDir = path.join(commonDir, "info");
         await deps.mkdir(infoDir, { recursive: true });
-        const excludePath = path.join(infoDir, "exclude");
         let existing = "";
         try {
             existing = await deps.readFile(excludePath);
         }
-        catch {
-            existing = "";
+        catch (err) {
+            if (errnoCode(err) !== "ENOENT") {
+                return {
+                    ok: false,
+                    warning: excludeWarning(worktreePath, "the exclude file could not be read"),
+                };
+            }
         }
         // Idempotent per LINE, not per file: the settings entry predates the
         // `.conductor/` one, so a worktree provisioned by an earlier executor build
-        // already contains the first and still needs the second. A single
-        // "does the file mention anything of ours?" check would skip it forever.
+        // already contains the first and still needs the second.
         const present = new Set(existing.split(/\r?\n/));
         const missing = EXECUTOR_EXCLUDE_LINES.filter((line) => !present.has(line));
-        if (missing.length === 0) {
+        if (missing.length === 0)
             return { ok: true };
-        }
-        // One write. Unrelated user-authored entries are preserved verbatim, and a
-        // file that did not end in a newline gets one first so the appended lines
-        // cannot fuse onto the operator's last entry.
         const prefix = existing.length === 0 || existing.endsWith("\n") ? existing : `${existing}\n`;
-        await deps.writeFile(excludePath, `${prefix}${missing.map((line) => `${line}\n`).join("")}`);
+        tempPath = path.join(infoDir, `exclude.${process.pid}.${randomUUID()}.tmp`);
+        await deps.writeFile(tempPath, `${prefix}${missing.map((line) => `${line}\n`).join("")}`);
+        await deps.rename(tempPath, excludePath);
         return { ok: true };
     }
     catch {
-        // The gitdir resolved but the exclude could not be written. Unlike the
-        // resolution failures above this keeps `ok: false`, because the caller's
-        // established contract treats a failed WRITE as the degraded case worth
-        // aggregating into the deny layer's own result.
+        if (tempPath !== undefined) {
+            try {
+                await deps.removeFile(tempPath);
+            }
+            catch {
+                /* best effort: only this writer's own temporary file */
+            }
+        }
+        // The gitdir resolved but the exclude could not be published. This keeps
+        // `ok: false`, because the caller's established contract treats a failed
+        // WRITE as the degraded case worth aggregating into the deny layer's result.
         return {
             ok: false,
             warning: excludeWarning(worktreePath, "the exclude file could not be written"),

package/build/executor/preflight.js

@@ -2,10 +2,10 @@ import { DEFAULT_PROBE_TIMEOUT_MS } from "../agent-capabilities/types.js";
 import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "../agent-launchers/executor-adapter-inspection.js";
 import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
 import { resolveCompletionEvidenceCapability } from "../agent-launchers/executor-adapter.js";
-import { COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY, cliVersionAtLeast, normalizeCliVersion, parseCliVersion, runtimeMatchesSupported, } from "./completion-contract.js";
+import { CLEANUP_REPORT_CAPABILITY, COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY, REQUIRED_VERIFICATION_CI_DEFERRAL_CAPABILITY, cliVersionAtLeast, normalizeCliVersion, parseCliVersion, runtimeMatchesSupported, } from "./completion-contract.js";
 import { buildHeadlessAgentEnv } from "./env.js";
 import { resolveExecutorAgentId } from "./agent-identity.js";
-import { mkdtemp, rm } from "node:fs/promises";
+import { mkdtemp, rm, rename as fsRename } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
@@ -291,6 +291,9 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
                     denyProvisioningDeps: {
                         readFile: deps.readFile, writeFile: deps.writeFile,
                         mkdir: deps.mkdir, homedir: deps.homedir,
+                        stat: deps.stat,
+                        rename: (from, to) => fsRename(from, to),
+                        removeFile: (filePath) => rm(filePath, { force: true }),
                     },
                 } : {}),
             },
@@ -646,7 +649,15 @@ export function buildClaimManifest(report, options, freeSlots) {
         // server drops the unknown token (`normalize_declared_capabilities`).
         capabilities: [
             ...(report.completionEvidenceQualified === true
-                ? [COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY]
+                ? [
+                    COMPLETION_EVIDENCE_CAPABILITY,
+                    REQUIRED_VERIFICATION_CAPABILITY,
+                    REQUIRED_VERIFICATION_CI_DEFERRAL_CAPABILITY,
+                    // BAPI-1504: this executor persists ownership before spawning a
+                    // covered worker and delivers cleanup reports, so it may claim a job
+                    // that requires the capability. An older server drops the token.
+                    CLEANUP_REPORT_CAPABILITY,
+                ]
                 : []),
             FOCUSED_REBASE_CAPABILITY,
             SCOPE_WAIT_CAPABILITY,

package/build/executor/process-containment.js

@@ -773,8 +773,34 @@ export async function recoverInterruptedOwnership(options) {
         catch {
             /* logging is best-effort */
         }
-        await removeOwnershipRecord(stateDir, fileJobId, fsDeps);
-        results.push({ jobId: fileJobId, verdict });
+        // A malformed record proved nothing and has no token to report: it is removed
+        // exactly as before. A real record is reported only after a CONFIRMED sweep.
+        let removeRecord = true;
+        if (options.reportCleanup !== undefined && record !== null) {
+            removeRecord = false;
+            if (verdict.verdict === "confirmed" && verdict.survivors === 0) {
+                try {
+                    const outcome = await options.reportCleanup({
+                        jobId: record.jobId,
+                        repoName: record.repoName,
+                        token: record.token,
+                    });
+                    removeRecord = outcome.kind === "accepted" || outcome.kind === "not_applicable";
+                    try {
+                        log(`[executor] BAPI-1504 cleanup report job=${fileJobId} outcome=${outcome.kind === "retained" ? `retained:${outcome.reason}` : outcome.kind}`);
+                    }
+                    catch {
+                        /* logging is best-effort */
+                    }
+                }
+                catch {
+                    removeRecord = false;
+                }
+            }
+        }
+        if (removeRecord)
+            await removeOwnershipRecord(stateDir, fileJobId, fsDeps);
+        results.push({ jobId: fileJobId, verdict, recordRemoved: removeRecord });
     }
     return results;
 }

package/build/executor/prompt-spec.js

@@ -1,4 +1,4 @@
-import { renderWorkerVerificationGuidance } from "./worker-verification-guidance.js";
+import { renderWorkerVerificationGuidance, renderWorkerTimeBudgetGuidance } from "./worker-verification-guidance.js";
 /**
  * Executor-side structured prompt-spec renderer (BAPI-550, TDD §6/§7).
  *
@@ -32,6 +32,18 @@ import { EPIC_WORKAROUNDS_DIR, epicWorkaroundRecordPath } from "../epic-workarou
  * work unfinished, which parks the ticket as `required_work_incomplete` through
  * the unchanged completion contract.
  *
+ * BAPI-1454 adds planned hand-offs: a capability needed only to VERIFY an
+ * acceptance criterion (a running app or database, a toolchain version, live
+ * credentials) is recorded as a hand-off, never as a core gap, and the worker
+ * continues without reporting that criterion as passed.
+ *
+ * BAPI-1492 adds the verification hand-off order for an E2E or rendered-UI step:
+ * run it locally (the disposable job database when one is provided), defer to
+ * `remote_ci` only when a named required workflow, job, or command runs it, and
+ * otherwise record it escalated with a `handoff` object carrying the observed
+ * failure. Review steps always run and are recorded executed. The server alone
+ * decides whether a hand-off counts, from persisted run state.
+ *
  * The worker decides from the ticket and the code alone; no supervisor scan
  * result is injected here. Kept SINGLE-LINE and free of `;`, quotes, and
  * apostrophes, like `buildPrBaseContractLaunchInstruction`, because it travels
@@ -46,7 +58,24 @@ export function buildEpicWorkaroundWorkerInstruction(ticketKey) {
         "only that feature), keep the core path working, and write " + record + " naming the requirement, " +
         "the guarded substitute you delivered, and the step a human must still take. Commit that record on " +
         "this ticket branch with git add -f " + record + ". For a core gap, never write a workaround or a " +
-        "record: leave the required work unfinished so the run parks this ticket for a human.");
+        "record: leave the required work unfinished so the run parks this ticket for a human. Planned " +
+        "hand-offs: if a running app or database, a toolchain version, or live credentials are needed only " +
+        "to verify an acceptance criterion and not to implement it safely, that is a planned hand-off and " +
+        "not a core gap. Record the affected acceptance criterion and the human verification step in " + record +
+        " and continue. Never report an unverified acceptance criterion as passed. A dependency needed to " +
+        "implement safely keeps ordinary core gap handling. " +
+        "Verification hand-off for an e2e_tests or rendered_ui_review step: first run it locally, using the " +
+        "disposable job database when one is provided. Record it escalated with prDependency remote_ci only " +
+        "when a named required CI workflow, job, or command runs that check. Otherwise, if a missing live " +
+        "server, database, toolchain, or credential stopped the check before it produced any result, record " +
+        "the step escalated with a handoff object giving the cause, the affected criterion, an observation " +
+        "naming the command you ran and the missing capability it hit, the head SHA it ran against, and the " +
+        "next human action. Never put credentials or secrets in the observation. A failed assertion, an " +
+        "application error from a check that did run, and unfinished implementation or test authoring stay " +
+        "blockers, and an unclear failure stays an ordinary escalation. Review steps (test_gap_review, " +
+        "final_plan_review, and combined_review_test) always run, acknowledge the handed-off criterion from " +
+        "that escalated record and the workaround record written in the same job, and are recorded executed, " +
+        "never handed off. A new head needs a fresh handoff observation.");
 }
 /** Stable named-error kind used for every prompt-spec contract failure. */
 const PROMPT_CONTRACT_ERROR = "ContractError.Prompt";
@@ -391,19 +420,33 @@ export function readCiFixDispatchContext(job) {
     if (repoName !== job.repo_name || (jobExpectedBranch && jobExpectedBranch !== expectedBranch)) {
         throw ciFixContextError(job, "identity_mismatch");
     }
-    const logExcerpts = readLogExcerpts(raw.log_excerpts, headSha, seen);
+    const candidateAnchor = typeof raw.failing_head_sha === "string"
+        ? raw.failing_head_sha.trim().toLowerCase() : "";
+    const failingHeadSha = CI_FIX_HEAD_SHA_RE.test(candidateAnchor) ? candidateAnchor : undefined;
+    // BAPI-1514: a refreshed payload re-reads CI at the bound head and says so with
+    // `evidence_head_sha === head_sha`; its checks, snapshot, and excerpts are then
+    // bound to that head, not to the original failing anchor. A legacy payload
+    // (no or mismatched `evidence_head_sha`) keeps the anchor-bound evidence.
+    const candidateEvidence = typeof raw.evidence_head_sha === "string"
+        ? raw.evidence_head_sha.trim().toLowerCase() : "";
+    const evidenceHeadSha = /^[0-9a-f]{40}$/.test(candidateEvidence) && candidateEvidence === headSha
+        ? candidateEvidence : undefined;
+    const evidenceHead = evidenceHeadSha ?? failingHeadSha ?? headSha;
+    const logExcerpts = readLogExcerpts(raw.log_excerpts, evidenceHead, seen);
     if (logExcerpts === null) {
         throw ciFixContextError(job, "log_excerpts_invalid");
     }
     return {
         headSha,
+        ...(failingHeadSha ? { failingHeadSha } : {}),
+        ...(evidenceHeadSha ? { evidenceHeadSha } : {}),
         repoName,
         expectedBranch,
         failingChecks: failing,
         missingChecks: missing,
         requiredClaimChecks: required,
         logExcerpts,
-        evidence: readCiEvidence(raw.evidence_snapshot, headSha, new Set(failing)),
+        evidence: readCiEvidence(raw.evidence_snapshot, evidenceHead, new Set(failing)),
     };
 }
 function formatCheckList(names, none) {
@@ -679,5 +722,7 @@ export async function renderPromptSpecPrompt(job, context) {
     const userPrompt = buildPromptSpecUserPrompt(spec, values);
     return `${systemPrompt}\n\n${userPrompt}` +
         (!context.deferComparisonGuidance && ["implement", "resume", "ci_fix"].includes(job.job_type)
-            ? "\n\n" + renderWorkerVerificationGuidance(context.comparisonSha) : "");
+            ? "\n\n" + renderWorkerVerificationGuidance(context.comparisonSha) : "") +
+        (!context.deferComparisonGuidance && job.job_type === "ci_fix"
+            ? "\n\n" + renderWorkerTimeBudgetGuidance(context.timeoutSeconds) : "");
 }

package/build/executor/rebase-finalization.js

@@ -27,8 +27,10 @@
  * rule 3).
  */
 import { ExecutorNamedError, FocusedRebaseContext } from "./job-errors.js";
+import { readRequiredVerification } from "./completion-supervision.js";
 import { allRequiredChecksGreen, anyRequiredCheckFailed, ProviderChecksUnobservable, } from "./provider-checks.js";
 import { FOCUSED_REBASE_CAPABILITY, FOCUSED_REBASE_CONTEXT_VERSION, } from "./types.js";
+import { deliveryRenewedWithRemoteCiDeferrals } from "./delivery-outcome.js";
 /** The job type the focused context is valid on. */
 export const FOCUSED_REBASE_JOB_TYPE = "rebase";
 /** The payload key the server writes the context under. */
@@ -120,6 +122,12 @@ export function validateFocusedRebaseContext(job) {
     const required = Array.isArray(job.required_capabilities) ? job.required_capabilities : [];
     if (!required.includes(FOCUSED_REBASE_CAPABILITY))
         return fail("capability_not_required");
+    if (required.includes("required_verification.ci_deferral.v2")) {
+        const declaration = readRequiredVerification(payload);
+        if (ctx.verification_policy_version !== 2 || !["renewal", "conflict"].includes(String(ctx.mode)) ||
+            declaration.kind !== "ok" || declaration.declaration.policyVersion !== 2)
+            return fail("version_unsupported");
+    }
     const prompt = payload.prompt;
     if (typeof prompt !== "string" || prompt.trim().length === 0)
         return fail("prompt_missing");
@@ -233,6 +241,11 @@ function boundedRace(work, ms, signal) {
  * explicitly empty server-derived check set is satisfied vacuously, but only once
  * every pull-request condition holds.
  *
+ * BAPI-1473: while checks are pending with none failed, `readDelivery` (when
+ * given) is consulted; a server decision of `awaiting_post_pr` at exactly the
+ * pushed head with only `remote_ci` deferrals also ends `ready` (`ciDeferred`).
+ * Missing renewal, mixed dependencies, or an unavailable read stay pending.
+ *
  * Proven failures stop at once: a required check concluded red, the pull request
  * closed or reads `CONFLICTING`, or its number, head, head branch, or base moved.
  * Running or missing checks, `UNKNOWN` mergeability, and unavailable reads stay
@@ -297,6 +310,19 @@ export async function waitForFocusedRebase(input) {
             return { kind: "stopped", reason: "required_check_failed" };
         if (allRequiredChecksGreen(poll, ctx.requiredChecks))
             return { kind: "ready", ciVacuous: false };
+        // BAPI-1473: checks are pending and none failed. A rebase that renewed its
+        // evidence and deferred CI-only steps may end here, once the server confirms
+        // it at exactly the pushed head; the server's completion contract re-checks.
+        if (input.readDelivery && budget() > 0) {
+            const delivery = await boundedRace(input.readDelivery(), Math.min(readMax, budget()), input.signal);
+            if (delivery === "aborted")
+                return "aborted";
+            if (delivery !== "timeout" &&
+                !(delivery instanceof ProviderChecksUnobservable) &&
+                deliveryRenewedWithRemoteCiDeferrals(delivery, pushed)) {
+                return { kind: "ready", ciVacuous: false, ciDeferred: true };
+            }
+        }
         return { kind: "pending", reason: "checks_pending" };
     };
     const unverifiedReason = () => {
@@ -321,10 +347,19 @@ export async function waitForFocusedRebase(input) {
         if (reading === "timeout")
             continue;
         if (reading.kind === "ready") {
+            const checksText = reading.ciDeferred
+                ? "required checks pending; renewed evidence with CI deferrals"
+                : reading.ciVacuous
+                    ? "no required checks are configured (vacuous CI)"
+                    : "every required check is green";
             input.errorLog(`[executor] Ready: focused rebase evidence current — pushed work at the pull request head is mergeable ` +
-                `and ${reading.ciVacuous ? "no required checks are configured (vacuous CI)" : "every required check is green"}; ` +
-                `submitting completion once; ${ids}; elapsed=${secs()}`);
-            return { kind: "ready", ciVacuous: reading.ciVacuous, elapsedMs: elapsed() };
+                `and ${checksText}; submitting completion once; ${ids}; elapsed=${secs()}`);
+            return {
+                kind: "ready",
+                ciVacuous: reading.ciVacuous,
+                ...(reading.ciDeferred ? { ciDeferred: true } : {}),
+                elapsedMs: elapsed(),
+            };
         }
         if (reading.kind === "stopped") {
             input.errorLog(`[executor] Stopped: ${reading.reason} — pushed work preserved, no further repair launched; ${ids}; elapsed=${secs()}`);