@bridge_gpt/mcp-server 0.2.9 → 0.2.10

package/build/conductor/epic-state.js

@@ -1,44 +1,63 @@
 /**
  * Pure, deterministic observed-state rebuild + ready-set computation for the
- * Epic Supervisor (BAPI-408).
+ * Epic Supervisor (BAPI-408, BAPI-436).
  *
  * This module has NO I/O, NO timers, and NO LLM calls. Every time-dependent
  * function takes an explicit `now` (epoch ms) so tests are wall-clock
  * independent. Truth precedence: raw local ledger events override non-terminal
  * Postgres states.
+ *
+ * Status mapping (BAPI-436 — merge-gated dependent dispatch):
+ *   gate.met      → ready_for_review  (implementation done; awaiting merge)
+ *   run.stopped   → ready_for_review  (worker session ended; awaiting merge)
+ *   merge.succeeded → done            (merged; dependents may now dispatch)
+ *   ci.failed     → blocked           (unchanged)
  */
 // ---------------------------------------------------------------------------
 // Status sets (module-private)
 // ---------------------------------------------------------------------------
 const NOT_STARTED_STATUS = "planned";
 const DONE_STATUSES = new Set(["done"]);
+// "blocked" is intentionally non-terminal: a merge.succeeded arriving in a
+// subsequent tick (cross-tick) can still advance a blocked ticket to done.
+// This is the expected path when an operator merges a PR despite failed CI.
+// Contrast with the same-tick case: ci.failed wins over merge.succeeded in
+// the same ledger batch (first-signal-wins; see the foldedTicketKeys guard).
 const NON_TERMINAL_STATUSES = new Set([
     "planned",
     "ready",
     "dispatched",
     "running",
     "blocked",
+    "ready_for_review",
 ]);
 const TERMINAL_SIGNAL_TYPES = new Set([
     "gate.met",
     "merge.succeeded",
     "ci.failed",
     "run.stopped",
+    "review.changes_requested",
 ]);
 function isNonTerminal(status) {
     return NON_TERMINAL_STATUSES.has(status);
 }
-function signalToNextStatus(signalType) {
+export function signalToNextStatus(signalType) {
     if (signalType === "ci.failed")
         return "blocked";
-    return "done";
+    if (signalType === "review.changes_requested")
+        return "blocked";
+    if (signalType === "merge.succeeded")
+        return "done";
+    return "ready_for_review"; // gate.met and run.stopped: awaiting merge
 }
 // ---------------------------------------------------------------------------
 // computeReadySet
 // ---------------------------------------------------------------------------
 /**
  * Pure deterministic ready-set computation. Returns ticket keys that:
- *   1. Have status "planned" (not yet started), AND
+ *   1. Have status "planned" (not yet started) or "ready" (crash-recovery —
+ *      a ticket already advanced to ready on a prior tick that crashed before
+ *      dispatch must not be silently dropped), AND
  *   2. Whose full `depends_on` list is satisfied (all deps have "done" status).
  *
  * Never calls an LLM or performs I/O. Goal 8 invariant.
@@ -47,7 +66,7 @@ export function computeReadySet(plan, ticketStatuses) {
     const ready = [];
     for (const ticket of plan.tickets) {
         const currentStatus = ticketStatuses.get(ticket.ticket_key) ?? "planned";
-        if (currentStatus !== NOT_STARTED_STATUS)
+        if (currentStatus !== NOT_STARTED_STATUS && currentStatus !== "ready")
             continue;
         const allDepsResolved = ticket.depends_on.every((dep) => DONE_STATUSES.has(ticketStatuses.get(dep) ?? "planned"));
         if (allDepsResolved)
@@ -55,6 +74,46 @@ export function computeReadySet(plan, ticketStatuses) {
     }
     return ready;
 }
+/**
+ * Pure, deterministic remediation decision (no I/O, no clock). Given the current
+ * budget counters, the ledger-derived worker liveness, and the configured
+ * ceilings, decide whether to NUDGE (worker still alive), RE-DISPATCH (worker
+ * gone, budget remaining), or ESCALATE (budget exhausted).
+ *
+ * Budget exhaustion is checked FIRST so an at-ceiling ticket always escalates
+ * regardless of liveness. A counter at-or-above its ceiling exhausts the budget.
+ */
+export function decideRemediation(attempts, noProgressAttempts, alive, config) {
+    if (attempts >= config.max_remediation_attempts ||
+        noProgressAttempts >= config.max_remediation_no_progress_attempts) {
+        return "escalate";
+    }
+    return alive ? "nudge" : "redispatch";
+}
+/**
+ * Pure liveness extraction (no I/O, explicit `nowMs`). Finds the most recent
+ * `message.delivered`/`message.acked` heartbeat event for `runId` and reports
+ * the worker alive when that heartbeat's age is within
+ * `windowSeconds`. An empty ledger (no heartbeat for the run) defaults to
+ * `{ alive: false, workerId: null }` (fail-closed: never misjudge a worker
+ * alive without evidence).
+ */
+export function extractWorkerLiveness(events, runId, nowMs, windowSeconds) {
+    let latest = null;
+    for (const ev of events) {
+        if (ev.run_id !== runId)
+            continue;
+        if (ev.type !== "message.delivered" && ev.type !== "message.acked")
+            continue;
+        if (!latest || new Date(ev.time).getTime() > new Date(latest.time).getTime()) {
+            latest = ev;
+        }
+    }
+    if (!latest)
+        return { alive: false, workerId: null };
+    const age = nowMs - new Date(latest.time).getTime();
+    return { alive: age <= windowSeconds * 1000, workerId: latest.worker_id ?? null };
+}
 // ---------------------------------------------------------------------------
 // rebuildObservedState
 // ---------------------------------------------------------------------------
@@ -75,14 +134,23 @@ export function rebuildObservedState(postgresState, events, _now) {
     // Populate base maps from Postgres
     const ticketStatusMap = new Map();
     const ticketRowVersionMap = new Map();
+    const ticketRemediationMap = new Map();
     for (const ts of ticket_statuses) {
         ticketStatusMap.set(ts.ticket_key, ts.status);
         ticketRowVersionMap.set(ts.ticket_key, ts.row_version);
+        ticketRemediationMap.set(ts.ticket_key, {
+            attempts: ts.remediation_attempts ?? 0,
+            no_progress: ts.remediation_no_progress_attempts ?? 0,
+        });
     }
     const unfoldedSignals = [];
     const pendingMergeEvents = [];
     // Track which tickets already have a folded signal (one override per ticket)
     const foldedTicketKeys = new Set();
+    // BAPI-441: per-ticket latest blocking reason (ci.failed / review.changes_requested),
+    // tracked across the full ledger so an already-blocked ticket still carries a
+    // reason for the remediation pass to frame the nudge.
+    const ticketBlockedReasons = new Map();
     for (const event of events) {
         if (!TERMINAL_SIGNAL_TYPES.has(event.type))
             continue;
@@ -91,16 +159,45 @@ export function rebuildObservedState(postgresState, events, _now) {
         const ticketKey = runId ? runIdToTicketKey.get(runId) : undefined;
         if (!ticketKey)
             continue;
-        if (event.type === "gate.met") {
-            pendingMergeEvents.push(event);
+        // Record the blocking reason (latest wins; events are seq-ordered) regardless
+        // of fold state, so a ticket blocked on a prior tick still resolves a reason.
+        if (event.type === "ci.failed" || event.type === "review.changes_requested") {
+            ticketBlockedReasons.set(ticketKey, event.type);
         }
         const postgresStatus = ticketStatusMap.get(ticketKey) ?? "planned";
         if (!isNonTerminal(postgresStatus))
             continue;
-        if (foldedTicketKeys.has(ticketKey))
-            continue;
+        // Only queue for merge actioning if this ticket hasn't already been folded
+        // this tick. Without this guard, two gate.met events for the same ticket
+        // would both enqueue, and a ci.failed → gate.met sequence would enqueue a
+        // merge action for a ticket whose effective status is "blocked".
+        if (event.type === "gate.met" && !foldedTicketKeys.has(ticketKey)) {
+            pendingMergeEvents.push(event);
+        }
         const signalType = event.type;
         const nextStatus = signalToNextStatus(signalType);
+        if (foldedTicketKeys.has(ticketKey)) {
+            // Allow a same-tick upgrade from ready_for_review → done when
+            // merge.succeeded arrives after gate.met in the same ledger batch.
+            // First-signal-wins for everything else: if ci.failed arrived first,
+            // currentLocalStatus is "blocked" (not "ready_for_review"), so the
+            // upgrade guard below is false and merge.succeeded is intentionally
+            // dropped — a failed-CI ticket must not be silently advanced to done.
+            const currentLocalStatus = ticketStatusMap.get(ticketKey);
+            if (currentLocalStatus === "ready_for_review" && nextStatus === "done") {
+                const existingIdx = unfoldedSignals.findIndex((s) => s.ticket_key === ticketKey);
+                if (existingIdx >= 0) {
+                    unfoldedSignals[existingIdx] = {
+                        ...unfoldedSignals[existingIdx],
+                        next_status: nextStatus,
+                        signal_type: signalType,
+                        event,
+                    };
+                    ticketStatusMap.set(ticketKey, nextStatus);
+                }
+            }
+            continue;
+        }
         const rowVersion = ticketRowVersionMap.get(ticketKey) ?? 0;
         unfoldedSignals.push({
             ticket_key: ticketKey,
@@ -119,6 +216,8 @@ export function rebuildObservedState(postgresState, events, _now) {
         plan_version: epic_run.current_plan_version,
         ticket_statuses: ticketStatusMap,
         ticket_row_versions: ticketRowVersionMap,
+        ticket_remediation_counters: ticketRemediationMap,
+        ticket_blocked_reasons: ticketBlockedReasons,
         unfolded_terminal_signals: unfoldedSignals,
         pending_merge_events: pendingMergeEvents,
     };

package/build/conductor/git-ci-types.js

@@ -25,8 +25,14 @@ export const GIT_CI_PRODUCER = "git-pr-ci-producer";
 export const GIT_HOOK_PRODUCER = "git-hook";
 /** The single v1 done-gate condition type. */
 export const REQUIRED_CI_CHECKS_GREEN = "required_ci_checks_green";
+/** The v2 review-state done-gate condition type. */
+export const REVIEW_STATE = "review_state";
 /** Default gate name surfaced in `gate.met` event data. */
 export const DEFAULT_GATE_NAME = "done";
+/** Event type emitted when the configured review source is satisfied. */
+export const REVIEW_PASSED = "review.passed";
+/** Event type emitted when a reviewer requests changes. */
+export const REVIEW_CHANGES_REQUESTED = "review.changes_requested";
 /** Matches ASCII control characters (C0 range plus DEL). */
 const CONTROL_CHAR_RE = /[\u0000-\u001F\u007F]/;
 /** Matches a 40- or 64-character hex string (git SHA-1 / SHA-256 object ids). */

package/build/conductor/pr-ci-producer.js

@@ -11,7 +11,16 @@
  */
 import { GIT_CI_PRODUCER, } from "./git-ci-types.js";
 import { evaluateDoneGate, normalizeCiSnapshot, parseDoneGateConfig } from "./done-gate.js";
-import { fetchDoneGateConfigField, pollCiChecksForCommit, resolveConductorBridgeApiAccess, } from "./bridge-api-client.js";
+import { observeReviewWithResolved } from "./pr-review-producer.js";
+import { fetchEffectiveSupervisorSetup, fetchActiveEpicRuns, fetchEpicRunState, pollCiChecksForCommit, resolveConductorBridgeApiAccess, } from "./bridge-api-client.js";
+/** Default gate-config fetcher: reads done_gate_config from the supervisor setup. */
+async function _fetchGateConfigDefault(access) {
+    const setup = await fetchEffectiveSupervisorSetup(access);
+    // Fail closed when no row exists (source="none")
+    if (setup.source === "none")
+        return undefined;
+    return setup.done_gate_config ?? undefined;
+}
 import { resolvePrHeadBinding } from "./pr-discovery.js";
 import { emitConductorEventIfNew } from "./producer-ledger.js";
 const PRODUCER_OBSERVED_VIA = "pr-ci-producer";
@@ -24,7 +33,7 @@ export const WAIT_FOR_GATE_POLL_INTERVAL_MIN_MS = 500;
 // Event builders
 // ---------------------------------------------------------------------------
 /** Build a `git.pr_opened` event bound to repo + PR number + head SHA. */
-export function buildPrOpenedEventInput(binding) {
+export function buildPrOpenedEventInput(binding, runId = null, workerId = null) {
     const details = {
         repo: binding.repo,
         pr_number: binding.pr_number,
@@ -43,6 +52,8 @@ export function buildPrOpenedEventInput(binding) {
         source: "git",
         type: "git.pr_opened",
         subject: binding.subject,
+        run_id: runId,
+        worker_id: workerId,
         producer: GIT_CI_PRODUCER,
         observed_via: PRODUCER_OBSERVED_VIA,
         data,
@@ -54,7 +65,7 @@ export function buildPrOpenedEventInput(binding) {
  * `ci.passed` requires every polled check complete and green; `ci.failed` requires
  * every polled check complete with at least one not green.
  */
-export function buildCiObservationEventInput(binding, snapshot) {
+export function buildCiObservationEventInput(binding, snapshot, runId = null, workerId = null) {
     if (snapshot.checks.length === 0)
         return null;
     const allComplete = snapshot.checks.every((c) => c.complete);
@@ -74,6 +85,8 @@ export function buildCiObservationEventInput(binding, snapshot) {
         source: "ci",
         type,
         subject: binding.subject,
+        run_id: runId,
+        worker_id: workerId,
         producer: GIT_CI_PRODUCER,
         observed_via: PRODUCER_OBSERVED_VIA,
         data: {
@@ -87,13 +100,15 @@ export function buildCiObservationEventInput(binding, snapshot) {
  * Build a canonical `gate.met` event from a successful {@link GateEvaluationResult}.
  * Returns `null` when the gate was not met (no event data to emit).
  */
-export function buildGateMetEventInput(binding, evaluation) {
+export function buildGateMetEventInput(binding, evaluation, runId = null, workerId = null) {
     if (!evaluation.met || !evaluation.gateEventData)
         return null;
     return {
         source: "conductor",
         type: "gate.met",
         subject: binding.subject,
+        run_id: runId,
+        worker_id: workerId,
         producer: GIT_CI_PRODUCER,
         observed_via: PRODUCER_OBSERVED_VIA,
         data: { ...evaluation.gateEventData },
@@ -112,6 +127,18 @@ async function observeWithResolved(binding, access, gateConfig, deps) {
     const emitIfNew = deps.emitIfNew ?? emitConductorEventIfNew;
     const pollCi = deps.pollCi ?? pollCiChecksForCommit;
     const now = deps.now ?? (() => new Date().toISOString());
+    // Resolve run_id/worker_id for attribution. Env takes precedence; fall back
+    // to the injected resolution seam when the env identity is absent.
+    let run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    if (run_id === null && deps.resolveRunId) {
+        try {
+            run_id = await deps.resolveRunId(access, binding) ?? null;
+        }
+        catch {
+            run_id = null;
+        }
+    }
     const result = {
         binding,
         pr_opened_emitted: false,
@@ -122,7 +149,7 @@ async function observeWithResolved(binding, access, gateConfig, deps) {
         reason: "observed",
     };
     // 1. PR opened telemetry (independent of CI / gate).
-    const prDecision = emitIfNew(buildPrOpenedEventInput(binding), {
+    const prDecision = emitIfNew(buildPrOpenedEventInput(binding, run_id, worker_id), {
         event_type: "git.pr_opened",
         repo: binding.repo,
         pr_number: binding.pr_number,
@@ -141,7 +168,7 @@ async function observeWithResolved(binding, access, gateConfig, deps) {
     }
     const snapshot = normalizeCiSnapshot(rawPoll);
     // 3. CI observation telemetry (only for terminal states).
-    const ciEvent = buildCiObservationEventInput(binding, snapshot);
+    const ciEvent = buildCiObservationEventInput(binding, snapshot, run_id, worker_id);
     if (ciEvent === null) {
         result.ci_status = "pending";
     }
@@ -161,13 +188,27 @@ async function observeWithResolved(binding, access, gateConfig, deps) {
         result.reason = `gate inactive: ${gateConfig.reason}`;
         return result;
     }
-    const evaluation = evaluateDoneGate(gateConfig, binding, snapshot, now());
+    // 4a. Observe review state (alongside CI) for composite gate evaluation.
+    // A review poll failure must not block the CI observation — fail open here.
+    let reviewSnapshot = null;
+    try {
+        const reviewObservation = await observeReviewWithResolved(binding, access, gateConfig, {
+            emitIfNew: deps.emitIfNew ?? emitConductorEventIfNew,
+            env: deps.env,
+        });
+        reviewSnapshot = reviewObservation.snapshot;
+    }
+    catch {
+        // fail open: a review observation error does not block CI/gate evaluation
+        reviewSnapshot = null;
+    }
+    const evaluation = evaluateDoneGate(gateConfig, binding, snapshot, now(), reviewSnapshot);
     if (!evaluation.met) {
         result.reason = evaluation.reason;
         return result;
     }
     result.gate_met = true;
-    const gateEvent = buildGateMetEventInput(binding, evaluation);
+    const gateEvent = buildGateMetEventInput(binding, evaluation, run_id, worker_id);
     if (gateEvent !== null) {
         const gateDecision = emitIfNew(gateEvent, {
             event_type: "gate.met",
@@ -190,7 +231,7 @@ async function observeWithResolved(binding, access, gateConfig, deps) {
 export async function observePrCiOnce(params = {}, deps = {}) {
     const resolveBinding = deps.resolveBinding ?? resolvePrHeadBinding;
     const resolveAccess = deps.resolveAccess ?? (() => resolveConductorBridgeApiAccess({ env: deps.env, cwd: deps.cwd }));
-    const fetchGateConfig = deps.fetchGateConfig ?? fetchDoneGateConfigField;
+    const fetchGateConfig = deps.fetchGateConfig ?? _fetchGateConfigDefault;
     const bindingResult = resolveBinding({ repoName: params.repoName, prNumber: params.prNumber, headSha: params.headSha, cwd: params.cwd ?? deps.cwd, env: deps.env }, deps.bindingDeps ?? {});
     if (!bindingResult.ok) {
         return {
@@ -239,7 +280,7 @@ function clampInt(value, fallback, min, max) {
 export async function waitForDoneGate(params = {}, deps = {}) {
     const resolveBinding = deps.resolveBinding ?? resolvePrHeadBinding;
     const resolveAccess = deps.resolveAccess ?? (() => resolveConductorBridgeApiAccess({ env: deps.env, cwd: params.worktreePath ?? deps.cwd }));
-    const fetchGateConfig = deps.fetchGateConfig ?? fetchDoneGateConfigField;
+    const fetchGateConfig = deps.fetchGateConfig ?? _fetchGateConfigDefault;
     const sleep = deps.sleep ?? defaultSleep;
     const now = deps.now ?? (() => new Date().toISOString());
     const timeoutMs = clampInt(params.timeoutMs, WAIT_FOR_GATE_TIMEOUT_DEFAULT_MS, 0, WAIT_FOR_GATE_TIMEOUT_MAX_MS);
@@ -355,6 +396,10 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
             reason: "commit ref does not match PR head",
         };
     }
+    // Env-stamp identity; fall back to the resolution seam when env is absent.
+    // Access resolution for the seam is attempted inline within the gate block.
+    let run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
     const result = {
         binding,
         pr_opened_emitted: false,
@@ -364,7 +409,7 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
         gate_emitted: false,
         reason: "observed",
     };
-    const prDecision = emitIfNew(buildPrOpenedEventInput(binding), {
+    const prDecision = emitIfNew(buildPrOpenedEventInput(binding, run_id, worker_id), {
         event_type: "git.pr_opened",
         repo: binding.repo,
         pr_number: binding.pr_number,
@@ -372,7 +417,7 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
     });
     result.pr_opened_emitted = prDecision.emitted;
     const snapshot = normalizeCiSnapshot(pollResponse);
-    const ciEvent = buildCiObservationEventInput(binding, snapshot);
+    const ciEvent = buildCiObservationEventInput(binding, snapshot, run_id, worker_id);
     if (ciEvent === null) {
         result.ci_status = "pending";
         return result;
@@ -388,13 +433,23 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
     result.ci_emitted = ciDecision.emitted;
     // Best-effort gate evaluation when access + config are available.
     const resolveAccess = deps.resolveAccess ?? (() => resolveConductorBridgeApiAccess({ env: deps.env, cwd: deps.cwd }));
-    const fetchGateConfig = deps.fetchGateConfig ?? fetchDoneGateConfigField;
+    const fetchGateConfig = deps.fetchGateConfig ?? _fetchGateConfigDefault;
     try {
         const accessResult = await resolveAccess();
         if (accessResult.ok) {
+            const access = accessResult.access;
+            // If run_id is still null, try the resolution seam now that we have access.
+            if (run_id === null && deps.resolveRunId) {
+                try {
+                    run_id = await deps.resolveRunId(access, binding) ?? null;
+                }
+                catch {
+                    run_id = null;
+                }
+            }
             let rawConfig;
             try {
-                rawConfig = await fetchGateConfig(accessResult.access);
+                rawConfig = await fetchGateConfig(access);
             }
             catch {
                 rawConfig = undefined;
@@ -404,7 +459,7 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
                 const evaluation = evaluateDoneGate(gateConfig, binding, snapshot, now());
                 if (evaluation.met) {
                     result.gate_met = true;
-                    const gateEvent = buildGateMetEventInput(binding, evaluation);
+                    const gateEvent = buildGateMetEventInput(binding, evaluation, run_id, worker_id);
                     if (gateEvent !== null) {
                         const gateDecision = emitIfNew(gateEvent, {
                             event_type: "gate.met",
@@ -425,3 +480,47 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
     }
     return result;
 }
+// ---------------------------------------------------------------------------
+// Dispatch run_id resolution seam (Approach B: binding → ticket → dispatch)
+// ---------------------------------------------------------------------------
+/** Extract a Jira ticket key from a git branch name, e.g. `feature/BAPI-437-slug` → `BAPI-437`. */
+function extractTicketKeyFromRef(headRef) {
+    if (!headRef)
+        return null;
+    const match = /([A-Z][A-Z0-9]+-\d+)/i.exec(headRef);
+    return match ? match[1].toUpperCase() : null;
+}
+/**
+ * Resolve the dispatch `run_id` for a PR binding by extracting the ticket key
+ * from `binding.head_ref`, listing active epic runs, and searching each epic's
+ * dispatch rows for a match. Returns `null` when the lookup yields no result or
+ * any step fails — the producer never crashes on a resolution failure.
+ *
+ * Intended to be injected as `PrCiProducerDeps.resolveRunId` at call sites
+ * that lack `BAPI_CONDUCTOR_RUN_ID` in the environment (git-hook / CI-poll
+ * contexts). A production `fetchImpl` is optional; defaults to the global fetch.
+ */
+export async function resolveDispatchRunIdForBinding(access, binding, fetchImpl = fetch) {
+    const ticketKey = extractTicketKeyFromRef(binding.head_ref);
+    if (!ticketKey)
+        return null;
+    let activeRuns;
+    try {
+        activeRuns = await fetchActiveEpicRuns(access, fetchImpl);
+    }
+    catch {
+        return null;
+    }
+    for (const run of activeRuns) {
+        try {
+            const state = await fetchEpicRunState(access, run.epic_key, fetchImpl);
+            const dispatch = state.dispatches.find((d) => d.ticket_key === ticketKey && d.run_id !== null);
+            if (dispatch?.run_id)
+                return dispatch.run_id;
+        }
+        catch {
+            // Skip this epic on any error; try the next one.
+        }
+    }
+    return null;
+}

package/build/conductor/pr-review-producer.js

@@ -0,0 +1,116 @@
+/**
+ * PR review event production (BAPI-440).
+ *
+ * Polls the backend-owned review-status endpoint and emits `review.passed` /
+ * `review.changes_requested` exactly once per stable review state (deduped by
+ * review_state_hash). A poll failure never emits `review.changes_requested`
+ * (mirroring the CI rule that a failed poll is never a failed check).
+ *
+ * This module is pure of VCS credentials — the backend endpoint owns them.
+ */
+import { GIT_CI_PRODUCER, REVIEW_CHANGES_REQUESTED, REVIEW_PASSED, } from "./git-ci-types.js";
+import { evaluateReviewCondition, normalizeReviewSnapshot } from "./done-gate.js";
+import { fetchPrReviewStatus } from "./bridge-api-client.js";
+import { emitConductorEventIfNew } from "./producer-ledger.js";
+export const REVIEW_PRODUCER_OBSERVED_VIA = "pr-review-producer";
+// ---------------------------------------------------------------------------
+// Event builders
+// ---------------------------------------------------------------------------
+/**
+ * Build a `review.passed` or `review.changes_requested` event input from a
+ * normalized snapshot, or `null` when neither outcome is determinable.
+ */
+export function buildReviewObservationEventInput(binding, snapshot, eventType, reason, runId = null, workerId = null) {
+    return {
+        source: "review",
+        type: eventType,
+        subject: binding.subject,
+        run_id: runId,
+        worker_id: workerId,
+        producer: GIT_CI_PRODUCER,
+        observed_via: REVIEW_PRODUCER_OBSERVED_VIA,
+        data: {
+            summary: eventType === REVIEW_PASSED
+                ? `Review passed for ${binding.subject}`
+                : `Review changes requested for ${binding.subject}`,
+            status: eventType === REVIEW_PASSED ? "passed" : "changes_requested",
+            details: {
+                repo: binding.repo,
+                pr_number: binding.pr_number,
+                head_sha: binding.head_sha,
+                review_decision: snapshot.review_decision,
+                approvals: snapshot.approvals,
+                sticky_verdict: snapshot.sticky_verdict,
+                review_state_hash: snapshot.review_state_hash,
+                reason,
+            },
+        },
+    };
+}
+/**
+ * Observe the PR review state for an already-resolved binding/access/config.
+ * Polls the backend endpoint, normalizes the snapshot, evaluates the review
+ * condition, and emits the appropriate event through the dedupe layer.
+ *
+ * A poll failure or unavailable envelope returns `null` snapshot and emits
+ * nothing — it is never a `review.changes_requested`.
+ */
+export async function observeReviewWithResolved(binding, access, gateConfig, deps = {}) {
+    const fetchStatus = deps.fetchReviewStatus ?? fetchPrReviewStatus;
+    const emitIfNew = deps.emitIfNew ?? emitConductorEventIfNew;
+    const run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    const result = {
+        snapshot: null,
+        review_passed_emitted: false,
+        review_changes_requested_emitted: false,
+        reason: "observed",
+    };
+    // Find the review_state condition from the gate config (if present).
+    const reviewCondition = gateConfig.conditions.find((c) => c.type === "review_state") ?? null;
+    // CI-only gate: no review condition, skip the backend round-trip entirely.
+    if (reviewCondition === null) {
+        result.reason = "no-review-condition";
+        return result;
+    }
+    // Poll the backend endpoint. A thrown error means unavailable — fail open,
+    // emit nothing (mirroring CI producer rule: "a failed poll is never a failure").
+    let rawStatus;
+    try {
+        rawStatus = await fetchStatus(access, binding.pr_number);
+    }
+    catch {
+        result.reason = "review-poll-failed";
+        return result;
+    }
+    const snapshot = normalizeReviewSnapshot(rawStatus);
+    result.snapshot = snapshot;
+    if (snapshot === null) {
+        result.reason = "review-snapshot-unavailable";
+        return result;
+    }
+    // Evaluate the review condition (reviewCondition is non-null — null is handled above).
+    const evalResult = evaluateReviewCondition(reviewCondition, snapshot);
+    const baseDimensions = {
+        repo: binding.repo,
+        pr_number: binding.pr_number,
+        head_sha: binding.head_sha,
+        review_state_hash: snapshot.review_state_hash,
+    };
+    if (evalResult.changesRequested) {
+        const event = buildReviewObservationEventInput(binding, snapshot, REVIEW_CHANGES_REQUESTED, evalResult.reason, run_id, worker_id);
+        const decision = emitIfNew(event, { event_type: REVIEW_CHANGES_REQUESTED, ...baseDimensions });
+        result.review_changes_requested_emitted = decision.emitted;
+        result.reason = "review changes requested";
+    }
+    else if (evalResult.passed) {
+        const event = buildReviewObservationEventInput(binding, snapshot, REVIEW_PASSED, evalResult.reason, run_id, worker_id);
+        const decision = emitIfNew(event, { event_type: REVIEW_PASSED, ...baseDimensions });
+        result.review_passed_emitted = decision.emitted;
+        result.reason = "review passed";
+    }
+    else {
+        result.reason = `review not yet passed: ${evalResult.reason}`;
+    }
+    return result;
+}

package/build/conductor/store.js

@@ -32,7 +32,7 @@ const RETENTION_MAX_ROWS_DEFAULT = 50_000;
 const RETENTION_MAX_ROWS_MIN = 100;
 const RETENTION_MAX_ROWS_MAX = 10_000_000;
 const POLL_LIMIT_DEFAULT = 100;
-const POLL_LIMIT_MAX = 1000;
+export const POLL_LIMIT_MAX = 1000;
 // Message relay per-type cooldown bounds (BAPI-397). A value <= 0 disables the
 // cooldown; positive values are clamped to [1s, 24h].
 const MESSAGE_COOLDOWN_DEFAULT_MS = 300_000;
@@ -552,6 +552,13 @@ function buildFilterClause(filter) {
         conditions.push("run_id = @f_run_id");
         params.f_run_id = filter.run_id;
     }
+    if (filter.run_ids && filter.run_ids.length > 0) {
+        const placeholders = filter.run_ids.map((_r, i) => `@f_run_ids_${i}`);
+        filter.run_ids.forEach((r, i) => {
+            params[`f_run_ids_${i}`] = r;
+        });
+        conditions.push(`run_id IN (${placeholders.join(", ")})`);
+    }
     if (filter.worker_id) {
         conditions.push("worker_id = @f_worker_id");
         params.f_worker_id = filter.worker_id;

package/build/conductor/supervisor-message-relay.js

@@ -47,6 +47,37 @@ export function buildSupervisorEscalationWorkerMessage(candidate, assessment, st
         producer: "worker-message-relay",
     };
 }
+/**
+ * Build the remediation NUDGE relay message for a blocked epic ticket whose
+ * worker is still alive. Mirrors {@link buildSupervisorEscalationWorkerMessage}'s
+ * allowlisted top-level keys (`summary`, `status`, `details`) and `cause_seq`
+ * idempotency contract. `status` is fixed to `"remediation_requested"`; all
+ * remediation detail (reason, attempt, the bounded review digest, and its
+ * truncation flag) is nested under `details`. The `review_digest` text is passed
+ * through unchanged — redaction/size-capping is the backend's responsibility.
+ */
+export function buildSupervisorRemediationWorkerMessage(input) {
+    const messageType = input.reason === "ci.failed" ? "supervisor.ci_failed" : "supervisor.changes_requested";
+    const summaryLabel = input.reason === "ci.failed" ? "ci failed" : "review changes requested";
+    return {
+        run_id: input.runId,
+        worker_id: input.workerId,
+        type: messageType,
+        cause_seq: input.causeSeq,
+        payload: {
+            summary: `${summaryLabel}: ${input.ticketKey}`,
+            status: "remediation_requested",
+            details: {
+                reason: input.reason,
+                attempt: input.attempt,
+                review_digest: input.reviewDigest,
+                truncated: input.truncated,
+            },
+        },
+        source: "conductor-supervisor",
+        producer: "worker-message-relay",
+    };
+}
 /**
  * Build the escalation message and enqueue it through {@link sendWorkerMessage}.
  * The store result already encodes the expected idempotency/cooldown outcomes

package/build/conductor/taxonomy.js

@@ -35,6 +35,9 @@ export const SEMANTIC_EVENT_TYPES = [
     "merge.succeeded",
     "merge.failed",
     "merge.pending_approval",
+    // BAPI-440 PR review-state telemetry event types.
+    "review.passed",
+    "review.changes_requested",
 ];
 /**
  * Type guard: returns `true` only when `value` is one of the exact taxonomy