@miraland-labs/conduit-bridge 0.10.0 → 0.11.0

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.10.0` — **ExecutionClass** permission policy (`observe` | `observe_network` | `publish_artifact` | `verify` | `mutate_repo`) compiled once from the assignment contract and projected into every driver, so prompts match enforcement without a growing publish-command allow-list. Artifact evidence digests still normalize bare 64-hex to `sha256:<hex>`. New **Experimental Pi** lane (`pi` from `@earendil-works/pi-coding-agent`, local fuel); `observe_network` is refused on Pi (no fetch-without-bash). Heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
+**Package version:** `0.11.0` — **ExecutionClass inversion:** the control plane stamps `execution_class` on the assignment; Bridge launches from that stamp (fail closed if missing), asserts the full class floor after ceilings, and projects permissions locally (“Bridge wins” on tools). Ordinary grants are derived server-side as classMax ∩ project ceiling; landing is package `lands`, not a class axiom. Workspace briefs discover verification commands for Node, Make, Cargo, Go, pytest, and Gradle. Control-plane `instruction` is **additive** evidence/class prose; Bridge always appends local RULES (shell allow-list, verbatim paste, criterion mapping, hard-denied). Prompt is data; permissions stay local — residual risk if the control plane is compromised (sharpest for `observe_network`). Artifact digests still normalize bare 64-hex to `sha256:<hex>`. Experimental Pi lane remains; `observe_network` is refused on Pi. Heartbeat protocol 2, worktrees, ops helpers, multi-driver lanes, and slots **1–4** unchanged. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
 
 ## Prerequisites
 
@@ -78,7 +78,7 @@ repository delivery with PR/evidence and a successful rework cycle. All other la
 
 ## Grant enforcement
 
-Assignments compile to an **ExecutionClass**, then each driver projects that class:
+The control plane authors **ExecutionClass**; Bridge requires the stamped class and projects it:
 
 | Driver | Fuel | Mechanism |
 | --- | --- | --- |

package/dist/brief.js

@@ -3,9 +3,13 @@ import { join, resolve } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
-const MANIFESTS = ["package.json", "wrangler.jsonc", "wrangler.toml", "tsconfig.json", "Cargo.toml", "pyproject.toml", "go.mod", "Makefile"];
+const MANIFESTS = [
+    "package.json", "wrangler.jsonc", "wrangler.toml", "tsconfig.json",
+    "Cargo.toml", "pyproject.toml", "pytest.ini", "setup.cfg", "go.mod",
+    "Makefile", "build.gradle", "build.gradle.kts", "gradlew",
+];
 const VERIFICATION_SCRIPTS = ["verify", "typecheck", "lint", "test", "build"];
-const EXCLUDED_DIRECTORIES = new Set(["node_modules", "dist", "build", "target", "coverage"]);
+const EXCLUDED_DIRECTORIES = new Set(["node_modules", "dist", "build", "target", "coverage", ".venv", "venv"]);
 export async function buildWorkspaceBrief(workspace) {
     const entries = await readdir(workspace, { withFileTypes: true });
     const modules = entries
@@ -18,7 +22,7 @@ export async function buildWorkspaceBrief(workspace) {
         base_commit: await gitHeadCommit(workspace),
         modules,
         manifests,
-        verification: await verificationCommands(workspace, files),
+        verification: await discoverVerificationCommands(workspace, files),
     };
 }
 export function normalizeRepositoryUrl(url) {
@@ -191,7 +195,8 @@ async function gitDirectories(workspace) {
         return { worktree, common: worktree };
     }
 }
-async function verificationCommands(workspace, files) {
+/** Exported for tests — discovers bounded verification commands from workspace manifests. */
+export async function discoverVerificationCommands(workspace, files) {
     const commands = [];
     if (files.has("package.json")) {
         try {
@@ -209,5 +214,36 @@ async function verificationCommands(workspace, files) {
         }
         catch { /* unreadable Makefiles do not broaden execution */ }
     }
-    return commands;
+    if (files.has("Cargo.toml")) {
+        commands.push("cargo test");
+    }
+    if (files.has("go.mod")) {
+        commands.push("go test ./...");
+    }
+    if (files.has("pyproject.toml") || files.has("pytest.ini") || files.has("setup.cfg")) {
+        let hasPytest = files.has("pytest.ini");
+        if (!hasPytest && files.has("pyproject.toml")) {
+            try {
+                const pyproject = await readFile(join(workspace, "pyproject.toml"), "utf8");
+                hasPytest = /\bpytest\b/i.test(pyproject);
+            }
+            catch { /* unreadable manifests do not broaden execution */ }
+        }
+        if (!hasPytest && files.has("setup.cfg")) {
+            try {
+                const setup = await readFile(join(workspace, "setup.cfg"), "utf8");
+                hasPytest = /\[tool:\s*pytest\]|\bpytest\b/i.test(setup);
+            }
+            catch { /* unreadable manifests do not broaden execution */ }
+        }
+        // Only when pytest is evidenced — bare pyproject.toml is often unittest/nox/poetry without pytest.
+        if (hasPytest) {
+            commands.push("python -m pytest");
+        }
+    }
+    if (files.has("build.gradle") || files.has("build.gradle.kts")) {
+        if (files.has("gradlew"))
+            commands.push("./gradlew test");
+    }
+    return [...new Set(commands)];
 }

package/dist/driver.js

@@ -3,8 +3,8 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { z } from "zod";
-import { deniedCommands, executionClassPromptRules, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectKiroTools, projectPi, resolveExecutionClass, } from "./execution-class.js";
-export { branchCreateCommands, deniedCommands, isBoundedVerificationCommand, prCreateCommands, resolveExecutionClass, } from "./execution-class.js";
+import { deniedCommands, executionClassPromptRules, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectKiroTools, projectPi, requireStampedExecutionClass, resolveExecutionClass, } from "./execution-class.js";
+export { branchCreateCommands, deniedCommands, isBoundedVerificationCommand, prCreateCommands, requireStampedExecutionClass, resolveExecutionClass, } from "./execution-class.js";
 function deliveryLanguageRule(language) {
     if (language === "zh") {
         return "- Write every human-facing delivery packet string (outcome, changes, verification, assumptions, risks, limitations, criterion text) in Chinese (Simplified). Keep JSON keys and enum token values in English.";
@@ -55,12 +55,7 @@ export const claudeDeniedTools = deniedCommands.map((command) => `Bash(${command
 function resolveRunClass(input) {
     if (input.executionClass)
         return input.executionClass;
-    return resolveExecutionClass({
-        grants: input.grants,
-        capabilities: input.capabilities,
-        deliverable: input.deliverable,
-        workRole: input.workRole,
-    });
+    throw new Error("Driver run is missing stamped execution_class. Pass executionClass from the assignment stamp.");
 }
 export function buildAssignmentPrompt(context) {
     const packageContext = context.workPackage;
@@ -91,7 +86,7 @@ export function buildAssignmentPrompt(context) {
         lines.push("", `BOUNDARIES — never violate these\n${boundaries.map((item) => `- ${item}`).join("\n")}`);
     if (acceptance?.length)
         lines.push("", `ACCEPTANCE CRITERIA — the delivery is judged against these\n${acceptance.map((item) => `- ${item}`).join("\n")}`);
-    if (evidence?.length) {
+    if (evidence?.length && !spec.instruction) {
         lines.push("", "REQUIRED EVIDENCE");
         for (const kind of evidence) {
             if (kind === "test") {
@@ -115,12 +110,14 @@ export function buildAssignmentPrompt(context) {
         lines.push("", `REWORK FEEDBACK — an independent review returned this delivery; address every point\n${rework}`);
     const mustCommit = context.grants.includes("repo_write") && context.grants.includes("branch_create");
     const mustOpenPr = mustCommit && context.grants.includes("pr_create") && Boolean(changeScope?.length);
-    const executionClass = context.executionClass ?? resolveExecutionClass({
-        grants: context.grants,
-        capabilities: spec.required_capabilities,
-        deliverable: packageContext?.deliverable ?? spec.deliverable,
-        workRole: role,
-    });
+    const executionClass = context.executionClass
+        ?? requireStampedExecutionClass(spec.execution_class);
+    // Phase B: control-plane instruction is additive evidence/class prose.
+    // Local permission projection + hardened delivery rules stay Bridge-authored (Bridge wins on tools;
+    // skipping them when instruction was present recreated the summarize/guess-shell canary failures).
+    if (typeof spec.instruction === "string" && spec.instruction.trim()) {
+        lines.push("", spec.instruction.trim());
+    }
     const languageRule = deliveryLanguageRule(packageContext?.working_language ?? spec.working_language);
     const classRules = executionClassPromptRules({
         executionClass,
@@ -131,6 +128,11 @@ export function buildAssignmentPrompt(context) {
         mustOpenPr,
     });
     lines.push("", "RULES", "- Stay within the change scope and boundaries.", ...(languageRule ? [languageRule] : []), ...classRules, "- Never merge, deploy, force-push, push to protected branches, or touch production.", `- Hard-denied commands (all drivers): ${deniedCommands.join("; ")}.`, "- Do not invent evidence. Report unknown when you could not verify a criterion.", 
+    // The reviewer requests changes when "verification output is only summarized (not verbatim)"
+    // (REVIEWER_PROMPT). Only the bounded-shell rule said to report real output, so publish_artifact
+    // — the class the reviewer scrutinises hardest — summarized, and every criterion came back
+    // unsupported. Stated once here so it holds for every class rather than per branch.
+    "- Paste the actual command output into the evidence details: the HTTP status line, the digest command's output, the fetched body. A summary of what a command printed (\"returned HTTP 200\", \"digest matches\") is treated as unsupported and returns the delivery. Writing the proof to a file does not count — only the delivery packet is reviewed, so the output must be in the evidence entry itself.", 
     // A met claim with nothing backing it is rejected server-side ("Met acceptance criteria require
     // mapped evidence"). Observed live: six criteria marked met, evidence mapped to four, whole
     // delivery lost. Say it here rather than let the agent discover it by failing.
@@ -422,9 +424,10 @@ export const codexDriver = {
  * publish shell under open class policy. Research-only networked assignments
  * deny Shell(*) and Write(**).
  */
-export function cursorPermissionsForGrants(grants, verificationCommands = [], capabilities = [], deliverable = "repository", workRole) {
-    const executionClass = resolveExecutionClass({ grants, capabilities, deliverable, workRole });
-    const { allow, deny } = projectCursor(executionClass, { grants, verificationCommands, capabilities });
+export function cursorPermissionsForGrants(grants, verificationCommands = [], capabilities = [], deliverable = "repository", workRole, executionClass) {
+    const cls = executionClass
+        ?? resolveExecutionClass({ grants, capabilities, deliverable, workRole });
+    const { allow, deny } = projectCursor(cls, { grants, verificationCommands, capabilities });
     return { allow, deny };
 }
 /**

package/dist/execution-class.js

@@ -4,7 +4,8 @@
  */
 /** Bounded verification commands a `test_run` grant may execute. */
 export function isBoundedVerificationCommand(command) {
-    return /^(npm run (verify|typecheck|lint|test|build)|pnpm (verify|typecheck|lint|test|build)|yarn (verify|typecheck|lint|test|build)|cargo (test|check)|go test(?: \.\/\.\.\.)?|make (test|check))$/.test(command);
+    // Exact forms only — a trailing `.*` on pytest would admit `pytest ; curl … | sh`.
+    return /^(npm run (verify|typecheck|lint|test|build)|pnpm (verify|typecheck|lint|test|build)|yarn (verify|typecheck|lint|test|build)|cargo (test|check)|go test(?: \.\/\.\.\.)?|make (test|check)|python -m pytest|pytest(?: [\w./=-]+)?|\.\/gradlew test)$/.test(command);
 }
 /** Shell commands each grant authorizes — mapped per driver so they cannot drift. */
 export const branchCreateCommands = [
@@ -26,6 +27,10 @@ export const EXECUTION_CLASSES = [
     "verify",
     "mutate_repo",
 ];
+/**
+ * Migrator / test helper only. Launch must use the control-plane stamped class
+ * via `requireStampedExecutionClass` — do not re-derive as source of truth.
+ */
 export function resolveExecutionClass(input) {
     const grants = input.grants;
     const capabilities = input.capabilities ?? [];
@@ -47,6 +52,34 @@ export function resolveExecutionClass(input) {
         return "observe";
     return "mutate_repo";
 }
+const STAMPED_CLASSES = new Set(EXECUTION_CLASSES);
+/** Fail closed when the assignment has no stamped class (upgrade Bridge / redeploy CP). */
+export function requireStampedExecutionClass(stamped) {
+    if (typeof stamped === "string" && STAMPED_CLASSES.has(stamped))
+        return stamped;
+    throw new Error("Assignment is missing stamped execution_class. Upgrade Bridge to 0.11+ and redeploy the control plane so plans author ExecutionClass.");
+}
+/** Minimum ordinary grants that must survive project/machine ceilings (mirrors control-plane classFloor). */
+export function classFloor(executionClass) {
+    switch (executionClass) {
+        case "observe":
+        case "observe_network":
+        case "verify":
+            return ["repo_read"];
+        case "publish_artifact":
+        case "mutate_repo":
+            return ["repo_read", "repo_write"];
+    }
+}
+export function assertClassFloor(executionClass, ordinaryGrants) {
+    const grants = new Set(ordinaryGrants);
+    for (const grant of classFloor(executionClass)) {
+        if (!grants.has(grant)) {
+            return { ok: false, reason: `${executionClass}_requires_${grant}` };
+        }
+    }
+    return { ok: true };
+}
 /**
  * Live HTTP is a property of the assignment's capabilities, not of its class.
  *

package/dist/execution.js

@@ -2,7 +2,8 @@ import { createHash } from "node:crypto";
 import { z } from "zod";
 import { ConduitRequestError } from "./client.js";
 import { redactSecrets } from "./config.js";
-import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, pickModelCandidate, resolveExecutionClass, tierForRisk } from "./driver.js";
+import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, pickModelCandidate, requireStampedExecutionClass, tierForRisk } from "./driver.js";
+import { assertClassFloor } from "./execution-class.js";
 import { pickDriverForClaim, resolveDriverFuel } from "./drivers.js";
 import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
@@ -50,6 +51,13 @@ const taskSpecSchema = z.object({
     repository: z.object({ url: z.string().optional(), base_commit: z.string().optional() }).nullable().optional(),
     risk_level: z.string().optional(),
     deliverable: z.enum(["repository", "artifact"]).optional().default("repository"),
+    execution_class: z.enum(["observe", "observe_network", "publish_artifact", "verify", "mutate_repo"]).optional(),
+    lands: z.boolean().optional(),
+    privileged_grants: z.array(z.string()).optional(),
+    external_network: z.boolean().optional(),
+    instruction: z.string().optional(),
+    evidence_standard: z.unknown().optional(),
+    working_language: z.enum(["en", "zh"]).optional(),
 });
 const executionContractSchema = z.object({
     repository_fingerprint: z.string().nullable().optional().default(null),
@@ -324,33 +332,43 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
         }
         await client.updateAttempt(taskId, { worktreePath: attemptWorkspace });
     }
-    // Same list the driver hands to the permission contract, so the prompt states exactly what is
-    // executable rather than leaving the agent to guess and hit rejections.
-    const executionClass = resolveExecutionClass({
-        grants,
-        capabilities: spec.required_capabilities,
-        deliverable,
-        workRole: workPackage?.work_role ?? spec.work_role,
-    });
-    if (typeof spec.execution_class === "string" && spec.execution_class !== executionClass) {
-        console.error(`Assignment ${taskId}: stamped execution_class=${spec.execution_class} differs from Bridge-derived ${executionClass}; using Bridge-derived class for launch`);
-    }
-    // An artifact deliverable that does not classify as publish_artifact cannot write the file it is
-    // being asked to publish, so the run is doomed before it starts. Refuse here rather than spend an
-    // agent run and fail at the delivery gate with a missing artifact and no stated cause. Reachable
-    // when a control plane older than the artifact-grant normalization dispatches such a package —
-    // exactly the window between publishing Bridge and deploying the control plane.
+    // Stamped class is the source of truth (Bridge 0.11+). Do not re-derive from grants.
+    let executionClass;
+    try {
+        executionClass = requireStampedExecutionClass(spec.execution_class);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : "missing stamped execution_class";
+        console.error(`Assignment ${taskId}: ${detail}`);
+        // Retryable: a machine that ops-installed Bridge 0.11 before the control-plane deploy can recover
+        // once assignments carry stamped execution_class (deploy CP → publish → ops install; see handoff).
+        await queueTerminal(client, taskId, {
+            action: "fail",
+            body: { error: detail, retryable: true, idempotency_key: `bridge:fail:${active.attemptId}:missing-class` },
+        });
+        return;
+    }
+    // An artifact deliverable that is not publish_artifact cannot write/publish — fail closed.
     if (artifactDelivery && executionClass !== "publish_artifact") {
-        const detail = `Artifact deliverable resolved to execution class ${executionClass}, which cannot write or publish it. The work package needs the repo_write grant.`;
+        const detail = `Artifact deliverable stamped as execution class ${executionClass}, which cannot write or publish it. Revise the plan to use publish_artifact.`;
         console.error(`Assignment ${taskId}: ${detail}`);
-        // Not retryable: retrying cannot add a grant, so this must reach the owner as a plan correction
-        // rather than burn attempts. Same terminal path every other launch failure uses.
         await queueTerminal(client, taskId, {
             action: "fail",
             body: { error: detail, retryable: false, idempotency_key: `bridge:fail:${active.attemptId}:artifact-class` },
         });
         return;
     }
+    // Full classFloor must survive project/machine ceilings (observe/verify need repo_read too).
+    const floor = assertClassFloor(executionClass, grants);
+    if (!floor.ok) {
+        const detail = `Class floor unmet: ${floor.reason}`;
+        console.error(`Assignment ${taskId}: ${detail}`);
+        await queueTerminal(client, taskId, {
+            action: "fail",
+            body: { error: detail, retryable: false, idempotency_key: `bridge:fail:${active.attemptId}:class-floor` },
+        });
+        return;
+    }
     const prompt = buildAssignmentPrompt({ taskId, objective: task.objective, spec, grants, workspace: attemptWorkspace, currentHead: worktreeStart, reworkFeedback, workPackage, verificationCommands: liveBrief?.verification ?? [], executionClass });
     const resuming = Boolean(options.forceResumeSessionId);
     await client.attemptRequest(taskId, "progress", {
@@ -449,6 +467,8 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                     grants: grants.filter((grant) => grant === "repo_read"),
                     capabilities: [],
                     verificationCommands: [],
+                    // Envelope repair is read-only observe authority regardless of the original class.
+                    executionClass: "observe",
                     resumeSessionId: result.sessionId ?? undefined,
                     timeoutMs,
                     model: selection.model,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {