@bridge_gpt/mcp-server 0.2.68 → 0.2.70

package/build/phase-result-artifacts.js

@@ -38,12 +38,17 @@
  * Filesystem only: no MCP transport, no network, no git, no subprocesses, and no
  * process-level state. The caller supplies the trusted docs directory and the
  * already-fetched plan metadata.
+ *
+ * BAPI-1426: post-PR ownership comes from a server-accepted ledger the adapter
+ * fetched and passed in as `acceptedLedger`; this module never fetches it. Stored
+ * post-PR records stay readable when their step was authorized at the time they
+ * were written, even if today's accepted state has moved on.
  */
 import { createHash } from "crypto";
 import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
 import path from "path";
-import { PLAN_PHASES, PLAN_STEP_DISPOSITIONS, PlanLedgerError, currentLedgerState, resolveOwnedParts, resolveOwnedSteps, sanitizePlanStepRecords, unresolvedLedgerRecords, validatePhaseResult, validatePlanMetadata, } from "./plan-execution-ledger.js";
-import { assertPlanIsRoutable } from "./plan-phase-routing.js";
+import { PLAN_PHASES, PLAN_STEP_DISPOSITIONS, PlanLedgerError, currentLedgerState, isAcceptedPrDependentEscalation, resolveOwnedSteps, sanitizePlanStepRecords, unresolvedLedgerRecords, validatePhaseResult, validatePlanMetadata, } from "./plan-execution-ledger.js";
+import { assertPlanIsRoutable, resolveOwnedRanges } from "./plan-phase-routing.js";
 // ---------------------------------------------------------------------------
 // Layout
 // ---------------------------------------------------------------------------
@@ -94,7 +99,7 @@ export const CHECKPOINT_STALE_REASONS = [
 // ---------------------------------------------------------------------------
 // Path safety
 // ---------------------------------------------------------------------------
-function assertValidTicketKey(ticketKey) {
+export function assertValidTicketKey(ticketKey) {
     if (typeof ticketKey !== "string" || !TICKET_KEY_PATTERN.test(ticketKey.trim())) {
         throw new PlanLedgerError("ticket key must match PROJ-123; it becomes a filename segment and is never sanitized into a different one");
     }
@@ -106,7 +111,7 @@ function assertValidPhase(phase) {
     }
     return phase;
 }
-function assertDocsDir(docsDir) {
+export function assertDocsDir(docsDir) {
     if (typeof docsDir !== "string" || docsDir.trim() === "") {
         throw new PlanLedgerError("docs directory is required and must be a non-empty path");
     }
@@ -121,7 +126,7 @@ function assertDocsDir(docsDir) {
  * Checked before any `mkdir`, read, temporary write, or rename — a containment
  * check that runs after the directory exists has already had its side effect.
  */
-function resolveWithinRoot(root, ...segments) {
+export function resolveWithinRoot(root, ...segments) {
     const resolved = path.resolve(root, ...segments);
     const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
     if (resolved !== root && !resolved.startsWith(rootWithSep)) {
@@ -169,7 +174,7 @@ function isMissingFileError(err) {
         err !== null &&
         err.code === "ENOENT");
 }
-async function readJsonArtifact(absolutePath, relativePath) {
+export async function readJsonArtifact(absolutePath, relativePath) {
     let raw;
     try {
         raw = await readFile(absolutePath, "utf8");
@@ -221,9 +226,16 @@ function validateArtifactEnvelope(parsed, relativePath, ticketKey, phase, finger
  * vocabulary are still enforced — a record naming a step this phase does not own,
  * or a disposition outside the set, means the artifact does not describe this
  * plan and is refused rather than partially trusted.
+ *
+ * Post-PR records are the exception to "owned under the current plan": post-PR
+ * ownership moves as steps resolve, so a stored post-PR record is checked against
+ * `postPrAuthorized` — the steps authorized at the time it was written — rather
+ * than today's ownership set. See {@link postPrHistoricalAuthorization}.
  */
-function assertStoredRecordsRoutable(records, metadata, phase, relativePath) {
-    const owned = new Set(resolveOwnedSteps(metadata, phase));
+function assertStoredRecordsRoutable(records, metadata, phase, relativePath, postPrAuthorized = new Set()) {
+    const owned = phase === "post_pr_gap_close"
+        ? new Set([...postPrAuthorized].filter((step) => stepIsInPlan(metadata, step)))
+        : new Set(resolveOwnedSteps(metadata, phase));
     for (const record of records) {
         if (typeof record !== "object" || record === null) {
             throw new PlanLedgerError(`${relativePath} holds a record that is not an object`);
@@ -237,6 +249,46 @@ function assertStoredRecordsRoutable(records, metadata, phase, relativePath) {
     }
     return records.map((record) => ({ ...record, phase }));
 }
+function stepIsInPlan(metadata, stepId) {
+    return metadata.parts.some((part) => stepId >= part.start_step && stepId <= part.end_step);
+}
+/**
+ * Steps a stored post-PR record may name: those authorized for post-PR work at any
+ * point in history.
+ *
+ * With an accepted ledger, that is every step that ever had an accepted PR-dependent
+ * escalation — not just the ones still open today, since a resolved step's post-PR
+ * record is exactly what resolved it. Without one, the local pre-PR records stand in
+ * for reading history only: a local escalated record carrying `prDependency` makes
+ * an already-written post-PR record readable. Ownership for a NEW post-PR write
+ * still comes only from the accepted ledger.
+ */
+function postPrHistoricalAuthorization(accepted, localPrePrRecords) {
+    const authorized = new Set();
+    if (accepted && Array.isArray(accepted.acceptedRecords)) {
+        for (const record of accepted.acceptedRecords) {
+            if (record && isAcceptedPrDependentEscalation(record))
+                authorized.add(record.step_id);
+        }
+        return authorized;
+    }
+    for (const record of localPrePrRecords) {
+        if (record.disposition === "escalated" && record.prDependency !== undefined) {
+            authorized.add(record.stepId);
+        }
+    }
+    return authorized;
+}
+/** Read and route-check the stored pre-PR records, or none when absent. */
+async function readStoredPrePrRecords(docsDir, ticketKey, metadata, fingerprint) {
+    const relativePath = phaseResultRelativePath(ticketKey, "pre_pr_verification");
+    const absolutePath = resolveWithinRoot(docsDir, relativePath);
+    const parsed = await readJsonArtifact(absolutePath, relativePath);
+    if (parsed === undefined)
+        return [];
+    return assertStoredRecordsRoutable(validateArtifactEnvelope(parsed, relativePath, ticketKey, "pre_pr_verification", fingerprint)
+        .records, metadata, "pre_pr_verification", relativePath);
+}
 /**
  * Append `incoming` to `existing`, refusing to walk a settled step backwards.
  *
@@ -282,6 +334,7 @@ export async function loadInlinePhaseContext(options) {
     assertPlanIsRoutable(metadata);
     const fingerprint = planFingerprint(metadata);
     let ledger = [];
+    let prePrRecords = [];
     const artifactPaths = [];
     // Latest record index per produce step, within the produce artifact's own list.
     const produceLatestIndex = new Map();
@@ -297,7 +350,11 @@ export async function loadInlinePhaseContext(options) {
         const artifact = validateArtifactEnvelope(parsed, relativePath, ticketKey, priorPhase, fingerprint);
         // Re-check against the CURRENT metadata: an artifact that was valid when
         // written must still describe steps this phase owns under the plan in play now.
-        const routable = assertStoredRecordsRoutable(artifact.records, metadata, priorPhase, relativePath);
+        const routable = assertStoredRecordsRoutable(artifact.records, metadata, priorPhase, relativePath, priorPhase === "post_pr_gap_close"
+            ? postPrHistoricalAuthorization(options.acceptedLedger, prePrRecords)
+            : undefined);
+        if (priorPhase === "pre_pr_verification")
+            prePrRecords = routable;
         if (priorPhase === "produce") {
             produceRecordCount = routable.length;
             routable.forEach((record, index) => produceLatestIndex.set(record.stepId, index));
@@ -367,14 +424,8 @@ export async function loadInlinePhaseContext(options) {
     return {
         phase,
         routingSource: INLINE_ROUTING_SOURCE,
-        ownedSteps: resolveOwnedSteps(metadata, phase),
-        ownedRanges: resolveOwnedParts(metadata, phase).map((part) => ({
-            partId: part.part_id,
-            provenanceClass: part.provenance_class,
-            startStep: part.start_step,
-            endStep: part.end_step,
-            declaredAdvisory: part.declared_advisory,
-        })),
+        ownedSteps: resolveOwnedSteps(metadata, phase, options.acceptedLedger),
+        ownedRanges: resolveOwnedRanges(metadata, phase, options.acceptedLedger),
         ledger,
         currentRecordsByStep,
         terminalStepIds,
@@ -507,7 +558,7 @@ async function readProduceCoverage(docsDir, ticketKey) {
  * half-written ledger. The temp file is removed on failure so a rejected write
  * leaves nothing behind to be mistaken for state.
  */
-async function writeAtomically(absolutePath, relativePath, payload) {
+export async function writeAtomically(absolutePath, relativePath, payload) {
     const tempPath = `${absolutePath}.tmp`;
     await mkdir(path.dirname(absolutePath), { recursive: true });
     try {
@@ -539,7 +590,7 @@ export async function writeInlinePhaseResult(options) {
         throw new PlanLedgerError("phase result must be an object");
     }
     const phase = assertValidPhase(envelope.phase);
-    const validated = validatePhaseResult(envelope, metadata, phase);
+    const validated = validatePhaseResult(envelope, metadata, phase, options.acceptedLedger);
     const sanitized = sanitizePlanStepRecords(validated);
     const relativePath = phaseResultRelativePath(ticketKey, phase);
     const absolutePath = resolveWithinRoot(docsDir, relativePath);
@@ -549,7 +600,11 @@ export async function writeInlinePhaseResult(options) {
     const existing = await readJsonArtifact(absolutePath, relativePath);
     let priorRecords = [];
     if (existing !== undefined) {
-        priorRecords = assertStoredRecordsRoutable(validateArtifactEnvelope(existing, relativePath, ticketKey, phase, fingerprint).records, metadata, phase, relativePath);
+        priorRecords = assertStoredRecordsRoutable(validateArtifactEnvelope(existing, relativePath, ticketKey, phase, fingerprint).records, metadata, phase, relativePath, phase === "post_pr_gap_close"
+            ? postPrHistoricalAuthorization(options.acceptedLedger, options.acceptedLedger
+                ? []
+                : await readStoredPrePrRecords(docsDir, ticketKey, metadata, fingerprint))
+            : undefined);
     }
     const merged = appendInlineRecords(priorRecords, sanitized);
     const artifact = {

package/build/pipeline-orchestrator.js

@@ -19,7 +19,10 @@
 import { createHash } from "node:crypto";
 import { resolveRecipe } from "./pipeline-utils.js";
 import { parseUnsupportedInLocalModeEnvelope } from "./tool-error-envelope.js";
+import { TICKET_KEY_PATTERN } from "./ticket-key-utils.js";
 import { PlanLedgerError } from "./plan-execution-ledger.js";
+import { enqueueAndSync, enqueueExistingLocalRecords, ensureDeliveryBinding, fetchAcceptedLedgerContext, serverShaOrUndefined, syncPendingSubmissions, } from "./ticket-delivery-enrollment.js";
+import { getReadiness, } from "./ticket-delivery.js";
 import { assertPlanIsRoutable, buildPhaseRoutingContext, extractPlanMetadata, injectPhaseRoutingContext, parseCheckpointResult, phaseForInstructionFile, settlePhaseResult, } from "./plan-phase-routing.js";
 /**
  * Derive a STABLE, content-addressed hash of an idea — the basis for the
@@ -363,7 +366,15 @@ export async function resumePipeline(deps, input) {
         const phase = phaseForInstructionFile(step.instruction_file);
         const planMetadata = recordedPlanMetadata(accumulatedResults);
         if (phase && planMetadata) {
-            const outcome = settlePhaseResult(input.agent_result, planMetadata, phase, recordedLedger(accumulatedResults));
+            // BAPI-1426: the binding normally exists already (made before the first
+            // routed phase paused). Post-PR settlement uses the freshly accepted server
+            // ledger, so a local-only dependency mark cannot claim ownership.
+            const binding = await ensureOrchestratedBinding(deps, recipe, accumulatedResults);
+            const accepted = phase === "post_pr_gap_close"
+                ? await refreshAcceptedLedger(deps, recipe, binding)
+                : undefined;
+            const existingLedger = recordedLedger(accumulatedResults);
+            const outcome = settlePhaseResult(input.agent_result, planMetadata, phase, existingLedger, accepted);
             entry.plan_step_records = outcome.ledger;
             if (outcome.diagnostic) {
                 entry.plan_routing_diagnostic = outcome.diagnostic;
@@ -397,6 +408,13 @@ export async function resumePipeline(deps, input) {
                     results: accumulatedResults,
                 };
             }
+            // BAPI-1426: queue the records this phase settled (a reported envelope or
+            // a generated escalation) and sync them. The ledger only ever appends, so
+            // the new records are the tail past the prior ledger. A sync failure keeps
+            // the batch pending; it never fails the run or claims delivery.
+            const deliverySync = await syncSettledPhase(deps, recipe, binding, phase, outcome.ledger.slice(existingLedger.length));
+            if (deliverySync)
+                entry.delivery_sync = deliverySync;
         }
         accumulatedResults.push(entry);
         nextIndex = stepIndex + 1;
@@ -570,6 +588,214 @@ function attachPlanMetadata(entry) {
         console.error(`[pipeline] plan routing unavailable: ${message}`);
     }
 }
+// ---------------------------------------------------------------------------
+// BAPI-1426 — managed delivery, shared with the inline tools
+// ---------------------------------------------------------------------------
+/** Full adapter deps for this run, or undefined when delivery is not wired. */
+function deliveryAdapter(deps) {
+    const delivery = deps.ticketDelivery;
+    if (!delivery)
+        return undefined;
+    return {
+        client: delivery.client ?? {
+            baseUrl: deps.baseUrl,
+            headers: async () => ({ "X-API-Key": deps.apiKey }),
+        },
+        repoName: deps.repoName,
+        docsDir: deps.docsDir,
+        resolveSourceBranch: delivery.resolveSourceBranch,
+        resolvedBaseBranch: delivery.resolvedBaseBranch?.trim() || "main",
+        ...(delivery.executorJobId !== undefined ? { executorJobId: delivery.executorJobId } : {}),
+        ...(delivery.store ? { store: delivery.store } : {}),
+    };
+}
+/** The ticket a recipe works on, read from its resolved `ticket_number` params. */
+function recipeTicketKey(recipe) {
+    for (const step of recipe.steps) {
+        const value = step.params?.ticket_number;
+        if (typeof value !== "string")
+            continue;
+        const key = value.trim().toUpperCase();
+        if (TICKET_KEY_PATTERN.test(key))
+            return key;
+    }
+    return undefined;
+}
+/** True when the recipe has at least one routed plan phase. */
+function recipeHasRoutedPhases(recipe) {
+    return recipe.steps.some((step) => phaseForInstructionFile(step.instruction_file) !== undefined);
+}
+/** The binding recorded on an earlier entry, if any. */
+function recordedDeliveryBinding(results) {
+    for (let i = results.length - 1; i >= 0; i -= 1) {
+        const binding = results[i].delivery_binding;
+        if (binding)
+            return binding;
+    }
+    return undefined;
+}
+/**
+ * Bind this run to a server attempt, once, and record the binding on the latest
+ * entry so the next persistence write carries it. Never throws. A run that was
+ * refused enrollment (`disabled`) is not asked again; an `unavailable` one is.
+ */
+async function ensureOrchestratedBinding(deps, recipe, results) {
+    const adapter = deliveryAdapter(deps);
+    const ticketKey = recipeTicketKey(recipe);
+    if (!adapter || !ticketKey || results.length === 0)
+        return undefined;
+    const recorded = recordedDeliveryBinding(results);
+    if (recorded?.binding)
+        return recorded.binding;
+    if (recorded?.enrollment === "disabled")
+        return undefined;
+    const ensured = await ensureDeliveryBinding(adapter, ticketKey);
+    if (ensured.binding && ensured.newlyRegistered) {
+        // Work recorded before this attempt existed is sent once for reconciliation.
+        try {
+            await enqueueExistingLocalRecords(adapter, ticketKey, recordedLedger(results));
+        }
+        catch (err) {
+            console.error(`[pipeline] could not queue existing local records: ${String(err)}`);
+        }
+    }
+    const last = results.length - 1;
+    results[last] = {
+        ...results[last],
+        delivery_binding: {
+            enrollment: ensured.enrollment,
+            attempt_id: ensured.binding?.attempt_id ?? null,
+            ...(ensured.binding ? { binding: ensured.binding } : {}),
+            ...(ensured.reason ? { reason: ensured.reason } : {}),
+        },
+    };
+    return ensured.binding;
+}
+/**
+ * The server-accepted ledger, refreshed right before post-PR routing or
+ * settlement. Pending batches are retried first so ownership reflects the latest
+ * accepted evidence. Undefined (owns nothing) when unbound or unreadable: an
+ * unsynchronized local `prDependency` mark never creates post-PR ownership.
+ */
+async function refreshAcceptedLedger(deps, recipe, binding) {
+    const adapter = deliveryAdapter(deps);
+    const ticketKey = recipeTicketKey(recipe);
+    if (!adapter || !ticketKey || !binding)
+        return undefined;
+    await syncPendingSubmissions(adapter, ticketKey, binding);
+    const fetched = await fetchAcceptedLedgerContext(adapter, binding);
+    if (!fetched.ok) {
+        console.error(`[pipeline] accepted ledger unavailable: ${fetched.error}`);
+        return undefined;
+    }
+    return fetched.context;
+}
+/**
+ * Queue and sync the records one routed phase just settled — a reported envelope
+ * or a generated missing-envelope escalation alike. The journal write is local and
+ * comes first; a server or network failure leaves the batch pending.
+ */
+async function syncSettledPhase(deps, recipe, binding, phase, newRecords) {
+    const adapter = deliveryAdapter(deps);
+    const ticketKey = recipeTicketKey(recipe);
+    if (!adapter || !ticketKey || newRecords.length === 0)
+        return undefined;
+    const read = deps.ticketDelivery?.readGitValue;
+    const head = read ? serverShaOrUndefined(await read(["rev-parse", "HEAD"]).catch(() => undefined)) : undefined;
+    const tree = read
+        ? serverShaOrUndefined(await read(["rev-parse", "HEAD^{tree}"]).catch(() => undefined))
+        : undefined;
+    const payload = {
+        phase_result: { version: 1, phase, records: newRecords },
+        ...(head ? { tested_head_sha: head } : {}),
+        ...(tree ? { tested_tree_sha: tree } : {}),
+    };
+    try {
+        const { submission, sync } = await enqueueAndSync(adapter, ticketKey, binding, { phase, payload });
+        const report = sync?.reports.find((r) => r.submission_id === submission.submission_id);
+        const stored = report !== undefined && report.operation_status !== null && !report.retryable;
+        const error = report?.error ??
+            (!binding
+                ? "no managed binding; the batch is kept locally"
+                : !report
+                    ? "an earlier pending batch was not accepted yet; this batch stays pending"
+                    : undefined);
+        return {
+            submission_id: submission.submission_id,
+            operation_status: report?.operation_status ?? null,
+            refusals: report?.refusals ?? [],
+            pending: !stored,
+            ...(error ? { error } : {}),
+            readiness_outcome: sync?.readiness?.outcome ?? null,
+        };
+    }
+    catch (err) {
+        return {
+            submission_id: null,
+            operation_status: null,
+            refusals: [],
+            pending: false,
+            error: `the local delivery journal could not be updated: ${String(err instanceof Error ? err.message : err)}`,
+        };
+    }
+}
+/** The server's delivery decision for the completed envelope. Never throws. */
+async function deliveryOutcomeForCompletion(deps, recipe, results) {
+    const recorded = recordedDeliveryBinding(results);
+    const base = {
+        managed: false,
+        enrollment: recorded?.enrollment ?? "not_configured",
+        attempt_id: recorded?.attempt_id ?? null,
+        outcome: null,
+        blockers: [],
+        identities: {},
+        preserved_branch: null,
+        preserved_head_sha: null,
+        publication: null,
+        checkpoint_only: false,
+        delivery_complete: false,
+    };
+    const adapter = deliveryAdapter(deps);
+    const ticketKey = recipeTicketKey(recipe);
+    if (!adapter || !ticketKey)
+        return { ...base, enrollment: "not_configured" };
+    const binding = recorded?.binding;
+    if (!binding) {
+        return {
+            ...base,
+            ...(recorded?.reason ? { unavailable_reason: recorded.reason } : {}),
+        };
+    }
+    const pass = await syncPendingSubmissions(adapter, ticketKey, binding);
+    const response = await getReadiness(adapter.client, binding.attempt_id, {
+        repo_name: deps.repoName,
+        boundary: "publish",
+    });
+    if (!response.ok) {
+        return {
+            ...base,
+            managed: true,
+            pending_submissions: pass.pending,
+            unavailable_reason: `${response.error}: ${response.message}`,
+        };
+    }
+    const readiness = response.body.readiness;
+    const publication = readiness?.publication ?? null;
+    return {
+        ...base,
+        managed: true,
+        outcome: readiness?.outcome ?? null,
+        boundary: readiness?.boundary,
+        blockers: Array.isArray(readiness?.blockers) ? readiness.blockers : [],
+        identities: readiness?.identities ?? {},
+        preserved_branch: readiness?.preserved_branch ?? binding.source_branch,
+        preserved_head_sha: readiness?.preserved_head_sha ?? null,
+        publication,
+        checkpoint_only: publication?.action === "checkpoint_only",
+        delivery_complete: readiness?.delivery_complete === true,
+        pending_submissions: pass.pending,
+    };
+}
 async function continuePipelineExecution(deps, persistence, row, recipe, autoApprove, forceExecuteAtIndex, approvalAgentResult) {
     let pipelineRunId = row.pipeline_run_id;
     let stepIndex = row.current_step_index;
@@ -618,6 +844,19 @@ async function continuePipelineExecution(deps, persistence, row, recipe, autoApp
             };
         }
         if (step.type === "agent_task") {
+            const phase = phaseForInstructionFile(step.instruction_file);
+            const planMetadata = recordedPlanMetadata(results);
+            // BAPI-1426: enroll before the first routed phase (the production task)
+            // starts, and persist the binding with the pause below so a resumed run or
+            // a fresh process reuses the same attempt. Before post-PR routing, refresh
+            // the server-accepted ledger: it alone decides post-PR ownership.
+            let accepted;
+            if (phase && planMetadata) {
+                const binding = await ensureOrchestratedBinding(deps, recipe, results);
+                if (phase === "post_pr_gap_close") {
+                    accepted = await refreshAcceptedLedger(deps, recipe, binding);
+                }
+            }
             try {
                 await persistence.patchRun(pipelineRunId, {
                     current_step_index: stepIndex,
@@ -639,10 +878,8 @@ async function continuePipelineExecution(deps, persistence, row, recipe, autoApp
             // hand-off did not survive — the recipe pauses, and the session that resumes
             // may be a different one.
             let instruction = step.instruction ?? "";
-            const phase = phaseForInstructionFile(step.instruction_file);
-            const planMetadata = recordedPlanMetadata(results);
             if (phase && planMetadata) {
-                instruction = injectPhaseRoutingContext(instruction, buildPhaseRoutingContext(planMetadata, phase, recordedLedger(results), recordedCheckpoint(results)));
+                instruction = injectPhaseRoutingContext(instruction, buildPhaseRoutingContext(planMetadata, phase, recordedLedger(results), recordedCheckpoint(results), accepted));
             }
             return {
                 status: "needs_agent_task",
@@ -752,12 +989,18 @@ async function continuePipelineExecution(deps, persistence, row, recipe, autoApp
             step_index: step.step,
         });
     }
+    // BAPI-1426: recipe completion is not ticket delivery. A routed recipe reports
+    // the server's delivery decision separately; a checkpoint-only outcome is a
+    // supported exit and leaves the recipe status `completed`.
     return {
         status: "completed",
         pipeline_run_id: pipelineRunId,
         pipeline: recipe.pipeline,
         total_steps: totalSteps,
         results,
+        ...(recipeHasRoutedPhases(recipe)
+            ? { delivery: await deliveryOutcomeForCompletion(deps, recipe, results) }
+            : {}),
     };
 }
 function handlePersistenceErrorForEnvelope(err, extras) {