@bridge_gpt/mcp-server 0.2.68 → 0.2.70

package/build/plan-discovery.js

@@ -8,6 +8,11 @@
  * inside the DAG — every one of those is a way to hand the wrong plan to a run
  * that then creates real tickets' worth of work.
  *
+ * A folder holding a regular DAG but no regular metadata is reported as a skipped
+ * `missing-meta` entry so the operator can see it. It is only reported: the DAG
+ * supplies no identity, so such a folder is never a candidate and never changes
+ * the result.
+ *
  * Every filesystem read goes through the injected {@link PlanDiscoveryFs}, so a
  * unit test reaches no real disk. Nothing here throws for a filesystem failure:
  * an unreadable or malformed entry is named in `skipped` with a fixed reason and
@@ -22,6 +27,7 @@ export const PLAN_DISCOVERY_SKIP_REASONS = [
     "not-an-object",
     "missing-or-non-string-epic-key",
     "missing-dag",
+    "missing-meta",
     "unlistable-directory",
 ];
 const META_FILE = "epic-plan.meta.json";
@@ -77,9 +83,16 @@ export async function discoverEpicPlan(epicKey, docsDir, fs) {
         }
         const isRegular = (entry) => entry.isFile() && entry.isSymbolicLink?.() !== true;
         const meta = files.find((entry) => entry.name === META_FILE && isRegular(entry));
-        if (meta === undefined)
-            continue;
         const metaPath = path.join(dirPath, META_FILE);
+        if (meta === undefined) {
+            // A folder with a regular DAG but no regular metadata is expected-but-
+            // missing metadata: name it, never count it. The DAG supplies no identity.
+            // A folder with neither regular file stays silent.
+            if (files.some((entry) => entry.name === DAG_FILE && isRegular(entry))) {
+                skipped.push({ path: metaPath, reason: "missing-meta" });
+            }
+            continue;
+        }
         let raw;
         try {
             raw = await fs.readFile(metaPath);

package/build/plan-execution-ledger.js

@@ -26,6 +26,14 @@
  *   chronological evidence and refuses to silently downgrade or drop a settled step,
  *   so the record survives an approval pause or a resumed session — the conversational
  *   hand-off it replaces did not.
+ * - **Post-PR ownership is server-accepted, never self-granted (BAPI-1426).** A
+ *   pre-PR verification step that genuinely needs an open PR escalates with a
+ *   `prDependency` mark. `post_pr_gap_close` owns exactly the steps whose effective
+ *   *server-accepted* record is such an escalation ({@link derivePostPrOwnedSteps}).
+ *   The effective record is the latest one, except that a same-identity `remote_ci`
+ *   deferral survives plain post-PR re-escalations (BAPI-1488). Without an accepted ledger context it owns nothing, so a local mark alone can
+ *   never route work past the PR boundary. This mirrors
+ *   `api/library/vcs/ticket_delivery_identity.py`; the server stays the authority.
  *
  * Pure domain logic: no I/O, no git, no network, no filesystem, no MCP transport.
  */
@@ -73,6 +81,46 @@ export const MECHANICAL_ADAPTATION_KINDS = [
     "repository-command-correction",
     "equivalent-implementation-recognized",
 ];
+/**
+ * BAPI-1426: the closed set of open-PR checks a pre-PR verification step may wait on.
+ *
+ * Mirrored from `PR_DEPENDENCY_VALUES` in `api/library/vcs/ticket_delivery_identity.py`.
+ * A mark is accepted only on an escalated `pre_pr_verification` record for a step whose
+ * class that phase owns. Missing implementation can never cross the pre-PR boundary.
+ */
+export const PR_DEPENDENCY_VALUES = [
+    "remote_ci",
+    "pr_review",
+    "pr_preview_environment",
+];
+/**
+ * BAPI-1492: the verification hand-off vocabulary. Mirrored from `HANDOFF_CAUSES`,
+ * `HANDOFF_ELIGIBLE_CLASSES`, and `HANDOFF_FIELDS` in
+ * `api/library/vcs/ticket_delivery_identity.py`; both sides must agree.
+ *
+ * A hand-off is additive metadata on an escalated `pre_pr_verification` record for
+ * an E2E or rendered-UI step whose check could not run because a prerequisite was
+ * missing. It is never a disposition and never a `prDependency` value. Whether it
+ * may satisfy the step is decided only by the server, from persisted run state.
+ */
+export const HANDOFF_CAUSES = [
+    "no_live_server",
+    "no_database",
+    "toolchain_unavailable",
+    "credential_unavailable",
+];
+export const HANDOFF_ELIGIBLE_CLASSES = ["e2e_tests", "rendered_ui_review"];
+export const HANDOFF_FIELDS = [
+    "cause",
+    "criterion",
+    "observation",
+    "observed_head_sha",
+    "next_action",
+];
+/** Mirrors the server's `MAX_EVIDENCE_TEXT`: longer text is truncated, not refused. */
+export const HANDOFF_MAX_TEXT = 4000;
+const HANDOFF_TEXT_FIELDS = ["criterion", "observation", "next_action"];
+const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/;
 /**
  * Change categories that may never be adapted. Meeting one of these means the step's
  * premise is wrong in a way only a human should resolve, so the run escalates.
@@ -198,13 +246,12 @@ export function validatePlanMetadata(value) {
         if (startStep <= previousEnd) {
             throw new PlanLedgerError(`plan metadata part '${partId}' range ${startStep}-${endStep} overlaps or precedes '${previousId}' ending at ${previousEnd}; ranges must be disjoint and ascending`);
         }
-        if (startStep > previousEnd + 1) {
-            // A gap is as dangerous as an overlap and far less visible. Routing iterates
-            // only the declared ranges, so a step falling in the gap is owned by no phase
-            // and settled by nobody — Miss 20's shape, reached by arithmetic rather than by
-            // a missing registry entry. Rejected here, before any phase runs.
-            throw new PlanLedgerError(`plan metadata part '${partId}' starts at step ${startStep} but '${previousId}' ended at ${previousEnd}; steps ${previousEnd + 1}-${startStep - 1} are claimed by no part and would be executed by no phase`);
-        }
+        // A numbering SKIP between parts (one ends at 16, the next starts at 18) is
+        // legal (BAPI-1487). Ranges come from the step numbers in each part's own body,
+        // so a skipped number is a step no part wrote. resolveOwnedSteps iterates only
+        // declared ranges, so it is owned by no phase, which is correct: it does not
+        // exist. The plan generator separately refuses a numbered step that sits in
+        // the assembled plan outside every declared range.
         previousEnd = endStep;
         previousId = partId;
         parts.push({
@@ -244,14 +291,164 @@ export function validatePlanMetadata(value) {
         total_steps: totalSteps,
     };
 }
-// ---------------------------------------------------------------------------
-// Routing
-// ---------------------------------------------------------------------------
-/** Inclusive step IDs owned by `phase`, in plan order. */
-export function resolveOwnedSteps(metadata, phase) {
+/** True when an accepted record is a pre-PR escalation carrying an accepted mark. */
+export function isAcceptedPrDependentEscalation(record) {
+    return (record.disposition === "escalated" &&
+        typeof record.pr_dependency === "string" &&
+        PR_DEPENDENCY_VALUES.includes(record.pr_dependency) &&
+        record.phase === "pre_pr_verification");
+}
+/** An absent or empty text marker; any other type is malformed. Mirrors the server. */
+function isEmptyMarker(value) {
+    return value === undefined || value === null || (typeof value === "string" && value.trim() === "");
+}
+/** The record's (plan digest, specification identity) pair, or undefined unless both are real. */
+function identityPair(record) {
+    const { plan_digest: planDigest, specification_identity: specification } = record;
+    if (typeof planDigest === "string" &&
+        planDigest.trim() !== "" &&
+        typeof specification === "string" &&
+        specification.trim() !== "") {
+        return [planDigest, specification];
+    }
+    return undefined;
+}
+/** An unmarked, unfailed escalation in `phase` that carries real identities. */
+function isCleanEscalation(record, phase) {
+    return (record.phase === phase &&
+        record.disposition === "escalated" &&
+        record.verification_failed === false &&
+        isEmptyMarker(record.invalidated_by) &&
+        identityPair(record) !== undefined);
+}
+/** A post-PR escalation that repeats no dependency mark and names no failure. */
+function isPlainPostPrReescalation(record) {
+    return isCleanEscalation(record, "post_pr_gap_close") && isEmptyMarker(record.pr_dependency);
+}
+/** A clean pre-PR escalation that deferred the step to the PR's remote CI. */
+function isRemoteCiDeferral(record) {
+    return isCleanEscalation(record, "pre_pr_verification") && record.pr_dependency === "remote_ci";
+}
+function sameIdentity(a, b) {
+    return a !== undefined && b !== undefined && a[0] === b[0] && a[1] === b[1];
+}
+/**
+ * The record that currently decides each step (BAPI-1488). Mirrors
+ * `effective_accepted_records_by_step` in `api/library/vcs/ticket_delivery_identity.py`.
+ *
+ * Normally that is the latest accepted record: highest `revision`, with ties (and
+ * absent revisions) broken by array order. When the latest is a plain post-PR
+ * re-escalation, the walk goes backward through the contiguous run of them and returns
+ * the preceding `remote_ci` deferral, but only if every record in the chain shares its
+ * non-empty plan digest and specification identity. The first record that does not
+ * fit is a barrier, and the literal latest record stays effective.
+ */
+function effectiveAcceptedRecords(records) {
+    const histories = new Map();
+    for (const record of records) {
+        if (!record || !isPositiveInteger(record.step_id))
+            continue;
+        const revision = typeof record.revision === "number" ? record.revision : -Infinity;
+        const history = histories.get(record.step_id) ?? [];
+        history.push({ record, revision });
+        histories.set(record.step_id, history);
+    }
+    const effective = new Map();
+    for (const [stepId, history] of histories) {
+        // Array.prototype.sort is stable, so equal revisions keep array order.
+        const ordered = history
+            .map((entry, index) => ({ ...entry, index }))
+            .sort((a, b) => (a.revision === b.revision ? a.index - b.index : a.revision < b.revision ? -1 : 1))
+            .map((entry) => entry.record);
+        const latest = ordered[ordered.length - 1];
+        effective.set(stepId, latest);
+        if (!isPlainPostPrReescalation(latest))
+            continue;
+        const identity = identityPair(latest);
+        for (let i = ordered.length - 2; i >= 0; i -= 1) {
+            const earlier = ordered[i];
+            if (!sameIdentity(identityPair(earlier), identity))
+                break;
+            if (isRemoteCiDeferral(earlier)) {
+                effective.set(stepId, earlier);
+                break;
+            }
+            if (!isPlainPostPrReescalation(earlier))
+                break;
+        }
+    }
+    return effective;
+}
+/**
+ * The steps `post_pr_gap_close` owns: those whose EFFECTIVE accepted record is an
+ * escalated `pre_pr_verification` record with an accepted `pr_dependency`.
+ *
+ * The effective record is the latest one (highest `revision`, ties and absent
+ * revisions broken by array order), except that a same-identity `remote_ci` deferral
+ * survives plain post-PR re-escalations: the server refuses `prDependency` on post-PR
+ * records, so a restated step cannot repeat the mark. Failures, invalidation markers,
+ * resolutions, other dependencies, and missing or mismatched identities stop the
+ * carry-forward. No context means no ownership — a local mark alone never routes work.
+ */
+export function derivePostPrOwnedSteps(accepted) {
+    if (!accepted || !Array.isArray(accepted.acceptedRecords))
+        return [];
+    return [...effectiveAcceptedRecords(accepted.acceptedRecords).entries()]
+        .filter(([, record]) => isAcceptedPrDependentEscalation(record))
+        .map(([stepId]) => stepId)
+        .sort((a, b) => a - b);
+}
+/**
+ * BAPI-1473: the latest server-accepted record per step, limited to `steps`.
+ *
+ * A head-moving engine job (`ci_fix`, `remediate`, `rebase`) can run in a fresh
+ * worktree whose local journal is empty. Its renewal call must still settle every
+ * step the phase owns, re-reporting a record that is still current as it stands,
+ * so it needs to see what the server last accepted. Latest uses the same rule as
+ * {@link derivePostPrOwnedSteps}: highest `revision`, ties broken by array order.
+ * No context means an empty list; the local journal is never rewritten from it.
+ */
+export function latestAcceptedRecordsForSteps(accepted, steps) {
+    if (!accepted || !Array.isArray(accepted.acceptedRecords))
+        return [];
+    const wanted = new Set(steps);
+    const latest = new Map();
+    for (const record of accepted.acceptedRecords) {
+        if (!record || !isPositiveInteger(record.step_id) || !wanted.has(record.step_id))
+            continue;
+        const revision = typeof record.revision === "number" ? record.revision : -Infinity;
+        const prior = latest.get(record.step_id);
+        if (prior === undefined || revision >= prior.revision) {
+            latest.set(record.step_id, { record, revision });
+        }
+    }
+    return [...latest.values()]
+        .map(({ record }) => ({
+        step_id: record.step_id,
+        phase: record.phase,
+        disposition: record.disposition,
+        pr_dependency: record.pr_dependency ?? null,
+        ...(typeof record.revision === "number" ? { revision: record.revision } : {}),
+    }))
+        .sort((a, b) => a.step_id - b.step_id);
+}
+/** Every step present in some part of the plan. */
+function stepIsInPlan(metadata, stepId) {
+    return metadata.parts.some((part) => stepId >= part.start_step && stepId <= part.end_step);
+}
+/**
+ * Inclusive step IDs owned by `phase`, in plan order.
+ *
+ * `produce` and `pre_pr_verification` own by provenance class. `post_pr_gap_close`
+ * owns dynamically, from the server-accepted ledger, limited to steps the plan has.
+ */
+export function resolveOwnedSteps(metadata, phase, accepted) {
     if (!PLAN_PHASES.includes(phase)) {
         throw new PlanLedgerError(`unknown phase '${phase}'`);
     }
+    if (phase === "post_pr_gap_close") {
+        return derivePostPrOwnedSteps(accepted).filter((step) => stepIsInPlan(metadata, step));
+    }
     const owned = [];
     for (const part of metadata.parts) {
         if (PLAN_CLASS_OWNERSHIP[part.provenance_class] !== phase)
@@ -298,7 +495,7 @@ export function assertStepClassCoverage(metadata, ownership = PLAN_CLASS_OWNERSH
 // ---------------------------------------------------------------------------
 // Phase results
 // ---------------------------------------------------------------------------
-function validateRecordShape(record, metadata) {
+function validateRecordShape(record, metadata, phase) {
     if (!isPositiveInteger(record.stepId)) {
         throw new PlanLedgerError(`ledger record has a non-positive stepId ${String(record.stepId)}`);
     }
@@ -328,6 +525,12 @@ function validateRecordShape(record, metadata) {
             throw new PlanLedgerError(`step ${record.stepId} is 'escalated' but gives no blocking reason; an escalation must never read as completion`);
         }
     }
+    if (record.handoff !== undefined) {
+        validateHandoff(record, metadata, phase);
+    }
+    if (record.prDependency !== undefined) {
+        validatePrDependency(record, metadata, phase);
+    }
     if (record.disposition === "unrun-advisory") {
         const owningPart = metadata.parts.find((part) => record.stepId >= part.start_step && record.stepId <= part.end_step);
         if (!owningPart || !owningPart.declared_advisory) {
@@ -356,14 +559,98 @@ function validateRecordShape(record, metadata) {
         }
     }
 }
+/**
+ * Structural rules for the BAPI-1426 `prDependency` mark, mirroring the server's
+ * `_validate_pr_dependency`. The server also checks that the reason names the check;
+ * here an escalation reason is already required, so only the shape is enforced.
+ */
+function validatePrDependency(record, metadata, phase) {
+    const value = record.prDependency;
+    if (typeof value !== "string" || !PR_DEPENDENCY_VALUES.includes(value)) {
+        throw new PlanLedgerError(`step ${record.stepId} has unsupported prDependency '${String(value)}'; expected one of ${PR_DEPENDENCY_VALUES.join(", ")}`);
+    }
+    if (record.disposition !== "escalated") {
+        throw new PlanLedgerError(`step ${record.stepId} carries prDependency but is '${record.disposition}'; the mark is accepted only on an escalated record`);
+    }
+    if (phase !== "pre_pr_verification") {
+        throw new PlanLedgerError(`step ${record.stepId} carries prDependency in phase '${phase}'; the mark is accepted only on a pre_pr_verification record, and post-PR records must omit it`);
+    }
+    const owningPart = metadata.parts.find((part) => record.stepId >= part.start_step && record.stepId <= part.end_step);
+    if (!owningPart || PLAN_CLASS_OWNERSHIP[owningPart.provenance_class] !== "pre_pr_verification") {
+        throw new PlanLedgerError(`step ${record.stepId} carries prDependency, which is never accepted on implementation or documentation work; missing implementation cannot cross the pre-PR boundary`);
+    }
+    if (typeof record.escalationReason !== "string" || record.escalationReason.trim() === "") {
+        throw new PlanLedgerError(`step ${record.stepId} carries prDependency but gives no escalationReason naming the check that needs an open PR`);
+    }
+}
+/**
+ * BAPI-1492: structural rules for a verification hand-off, mirroring the server's
+ * `_validate_handoff` with the same wording. Authority, prior-ledger history,
+ * verification failures, and the observed head are server-only decisions.
+ */
+export function validateHandoff(record, metadata, phase) {
+    const fail = (reason) => {
+        throw new PlanLedgerError(`step ${record.stepId}: ${reason}`);
+    };
+    const value = record.handoff;
+    const isObject = typeof value === "object" && value !== null && !Array.isArray(value);
+    const keys = isObject ? Object.keys(value).sort() : [];
+    const expected = [...HANDOFF_FIELDS].sort();
+    if (!isObject || keys.length !== expected.length || keys.some((k, i) => k !== expected[i])) {
+        fail(`handoff must be an object with exactly ${HANDOFF_FIELDS.join(", ")}`);
+    }
+    const handoff = value;
+    if (!HANDOFF_CAUSES.includes(handoff.cause)) {
+        fail(`handoff cause must be one of ${HANDOFF_CAUSES.join(", ")}`);
+    }
+    for (const field of HANDOFF_TEXT_FIELDS) {
+        const text = handoff[field];
+        if (typeof text !== "string" || text.trim() === "") {
+            fail(`handoff is missing ${field}`);
+        }
+    }
+    const sha = handoff.observed_head_sha;
+    if (typeof sha !== "string" || !FULL_SHA_PATTERN.test(sha.trim().toLowerCase())) {
+        fail("handoff observed_head_sha must be a full commit SHA");
+    }
+    if (record.disposition !== "escalated") {
+        fail("handoff is accepted only on an escalated record");
+    }
+    const owningPart = metadata.parts.find((part) => record.stepId >= part.start_step && record.stepId <= part.end_step);
+    if (phase !== "pre_pr_verification" ||
+        !owningPart ||
+        PLAN_CLASS_OWNERSHIP[owningPart.provenance_class] !== "pre_pr_verification") {
+        fail("handoff is accepted only on a pre_pr_verification record");
+    }
+    if (!HANDOFF_ELIGIBLE_CLASSES.includes(owningPart.provenance_class)) {
+        fail("handoff is accepted only for e2e_tests or rendered_ui_review steps; review and other verification steps always run");
+    }
+    if (record.prDependency !== undefined) {
+        fail("handoff cannot be combined with prDependency");
+    }
+}
+/** Trim, bound, and lowercase a validated hand-off the way the server stores it. */
+function normalizeHandoff(handoff) {
+    const bound = (text) => text.trim().slice(0, HANDOFF_MAX_TEXT);
+    return {
+        cause: handoff.cause,
+        criterion: bound(handoff.criterion),
+        observation: bound(handoff.observation),
+        observed_head_sha: handoff.observed_head_sha.trim().toLowerCase(),
+        next_action: bound(handoff.next_action),
+    };
+}
 /**
  * Validate one phase's reported outcome against the steps it owns.
  *
  * Every owned step must be settled exactly once. An omission is the historical bug
  * (work quietly not done), a duplicate makes the record ambiguous, and an unowned
  * step means the phase acted outside its routing.
+ *
+ * For `post_pr_gap_close`, `accepted` is the server-accepted ledger as it stood
+ * BEFORE this envelope, so an envelope cannot grant itself post-PR ownership.
  */
-export function validatePhaseResult(result, metadata, phase) {
+export function validatePhaseResult(result, metadata, phase, accepted) {
     if (!result || typeof result !== "object") {
         throw new PlanLedgerError("phase result is missing");
     }
@@ -376,10 +663,10 @@ export function validatePhaseResult(result, metadata, phase) {
     if (!Array.isArray(result.records)) {
         throw new PlanLedgerError(`phase '${phase}' result has no records array`);
     }
-    const owned = new Set(resolveOwnedSteps(metadata, phase));
+    const owned = new Set(resolveOwnedSteps(metadata, phase, accepted));
     const settled = new Set();
     for (const record of result.records) {
-        validateRecordShape(record, metadata);
+        validateRecordShape(record, metadata, phase);
         if (!owned.has(record.stepId)) {
             throw new PlanLedgerError(`phase '${phase}' reported step ${record.stepId}, which it does not own`);
         }
@@ -392,7 +679,9 @@ export function validatePhaseResult(result, metadata, phase) {
     if (missing.length > 0) {
         throw new PlanLedgerError(`phase '${phase}' left owned steps unsettled: ${missing.join(", ")}. Every owned step must end as executed, adapted, escalated, or declared-advisory — there is no silent skip.`);
     }
-    return result.records.map((record) => ({ ...record, phase }));
+    return result.records.map((record) => record.handoff !== undefined
+        ? { ...record, phase, handoff: normalizeHandoff(record.handoff) }
+        : { ...record, phase });
 }
 // ---------------------------------------------------------------------------
 // Durable merge

package/build/plan-phase-routing.js

@@ -89,17 +89,43 @@ function findPlanMetadataCandidate(value, depth) {
     }
     return undefined;
 }
-export function buildPhaseRoutingContext(metadata, phase, ledger, checkpoint) {
+/**
+ * The ranges a phase owns, for display alongside `ownedSteps`.
+ *
+ * Class-owned phases report whole canonical parts. `post_pr_gap_close` owns single
+ * steps picked from the accepted ledger (BAPI-1426), so it reports one single-step
+ * range per owned step and never claims the rest of the part.
+ */
+export function resolveOwnedRanges(metadata, phase, accepted) {
+    if (phase === "post_pr_gap_close") {
+        const ranges = [];
+        for (const step of resolveOwnedSteps(metadata, phase, accepted)) {
+            const part = metadata.parts.find((entry) => step >= entry.start_step && step <= entry.end_step);
+            if (!part)
+                continue;
+            ranges.push({
+                partId: part.part_id,
+                provenanceClass: part.provenance_class,
+                startStep: step,
+                endStep: step,
+                declaredAdvisory: part.declared_advisory,
+            });
+        }
+        return ranges;
+    }
+    return resolveOwnedParts(metadata, phase).map((part) => ({
+        partId: part.part_id,
+        provenanceClass: part.provenance_class,
+        startStep: part.start_step,
+        endStep: part.end_step,
+        declaredAdvisory: part.declared_advisory,
+    }));
+}
+export function buildPhaseRoutingContext(metadata, phase, ledger, checkpoint, accepted) {
     return {
         phase,
-        ownedSteps: resolveOwnedSteps(metadata, phase),
-        ownedRanges: resolveOwnedParts(metadata, phase).map((part) => ({
-            partId: part.part_id,
-            provenanceClass: part.provenance_class,
-            startStep: part.start_step,
-            endStep: part.end_step,
-            declaredAdvisory: part.declared_advisory,
-        })),
+        ownedSteps: resolveOwnedSteps(metadata, phase, accepted),
+        ownedRanges: resolveOwnedRanges(metadata, phase, accepted),
         ledger: sanitizePlanStepRecords(ledger),
         ...(checkpoint ? { checkpoint } : {}),
     };
@@ -120,7 +146,14 @@ export function injectPhaseRoutingContext(instruction, context) {
         `provenance routing and the durable ledger as it stands right now. Settle every ` +
         `step in \`ownedSteps\` — each must end as \`executed\`, \`adapted\`, \`escalated\`, ` +
         `or \`unrun-advisory\`. Steps outside \`ownedSteps\` belong to another phase.\n\n` +
-        `Entries already present in \`ledger\` are done; do not redo them.\n\n` +
+        `In \`ledger\`, a step whose latest record is \`executed\` or \`adapted\` is ` +
+        `settled; do not redo it. A step whose latest record is \`escalated\` is an ` +
+        `unresolved obligation, not finished work. A record marked \`invalidatedBy\` is ` +
+        `history only.\n\n` +
+        `Only an \`escalated\` \`pre_pr_verification\` record for a check that genuinely ` +
+        `needs an open PR may add \`"prDependency"\` (one of \`remote_ci\`, \`pr_review\`, ` +
+        `\`pr_preview_environment\`), with an \`escalationReason\` naming that check. ` +
+        `Post-PR records that resolve those steps omit \`prDependency\`.\n\n` +
         "```json\n" +
         `${block}\n` +
         "```\n\n" +
@@ -216,10 +249,12 @@ export function parseCheckpointResult(agentResult) {
  * as `escalated` with the reason, which is what surfaces as unresolved. The failure
  * this ticket exists to fix was work vanishing with no trace, not work being flagged.
  */
-export function settlePhaseResult(agentResult, metadata, phase, existingLedger) {
+export function settlePhaseResult(agentResult, metadata, phase, existingLedger, accepted) {
     const envelope = parsePhaseResultEnvelope(agentResult);
     if (!envelope) {
-        const owned = resolveOwnedSteps(metadata, phase);
+        // Generated escalations cover only steps owned right now; for post-PR work that
+        // means only the server-accepted PR-dependent steps.
+        const owned = resolveOwnedSteps(metadata, phase, accepted);
         if (owned.length === 0) {
             return { ledger: [...existingLedger], contractViolation: false };
         }
@@ -239,7 +274,7 @@ export function settlePhaseResult(agentResult, metadata, phase, existingLedger)
         };
     }
     try {
-        const validated = validatePhaseResult(envelope, metadata, phase);
+        const validated = validatePhaseResult(envelope, metadata, phase, accepted);
         return {
             ledger: mergePlanStepRecords(existingLedger, sanitizePlanStepRecords(validated)),
             contractViolation: false,