@miraland-labs/conduit-bridge 0.11.1 → 0.11.2

package/dist/execution.js

@@ -24,7 +24,10 @@ function changesRequestedFeedback(summary) {
 }
 /** Failures that require an operator/configuration change must never burn the remaining attempts. */
 export function retryableAgentFailure(message) {
-    return !/unknown (?:option|argument)|unrecognized (?:option|argument)|not logged in|no login|not authenticated|login required|\bENOENT\b|could not verify the installed CLI|requires local fuel|No Bridge-mapped|preflight/i.test(message);
+    // `cannot enforce` is a driver projection refusing a class it structurally cannot bound (Pi and
+    // observe_network). No number of retries on that lane changes it, and retrying an immutable input
+    // is how one assignment burned ~80 attempts. Fail closed; the message names the drivers that work.
+    return !/unknown (?:option|argument)|unrecognized (?:option|argument)|not logged in|no login|not authenticated|login required|\bENOENT\b|could not verify the installed CLI|requires local fuel|No Bridge-mapped|cannot enforce|preflight/i.test(message);
 }
 const assignmentSchema = z.object({
     id: z.string().uuid(),
@@ -54,7 +57,6 @@ const taskSpecSchema = z.object({
     execution_class: z.enum(["observe", "observe_network", "publish_artifact", "verify", "mutate_repo"]).optional(),
     lands: z.boolean().optional(),
     privileged_grants: z.array(z.string()).optional(),
-    external_network: z.boolean().optional(),
     instruction: z.string().optional(),
     evidence_standard: z.unknown().optional(),
     working_language: z.enum(["en", "zh"]).optional(),
@@ -706,10 +708,12 @@ async function prepareDelivery(client, attemptId, taskId, report) {
     };
 }
 export function validateDeliveryReport(report, spec, grants = []) {
-    validateChangeScope(report, spec.change_scope ?? []);
     // Research findings live in the report. Do not demand a published pack URL for work_role=research
     // even when a planner mis-labeled the package as deliverable=artifact.
     const artifactDelivery = spec.deliverable === "artifact" && spec.work_role !== "research";
+    // Artifact packs are not git landings — do not demand head_commit when the planner put
+    // `.conduit/artifacts/**` in change_scope as a write hint (path-4 canary incident).
+    validateChangeScope(report, spec.change_scope ?? [], { requireHeadCommit: !artifactDelivery });
     if (artifactDelivery) {
         const published = report.evidence.some((item) => {
             if (!["preview", "research", "documentation"].includes(item.kind))
@@ -776,11 +780,15 @@ function referenceKind(kind) {
         return "document";
     return "other";
 }
-export function validateChangeScope(report, changeScope) {
+export function validateChangeScope(report, changeScope, options = {}) {
     if (!changeScope.length)
         return;
-    if (!report.head_commit)
+    const requireHeadCommit = options.requireHeadCommit !== false;
+    if (requireHeadCommit && !report.head_commit) {
         throw new Error("Repository changes require a delivered head commit");
+    }
+    if (!report.changes.length)
+        return;
     const paths = report.changes.map((change) => change.split(/\s+[—-]\s+/, 1)[0].trim().replaceAll("\\", "/"));
     const outside = paths.filter((path) => !path || path.startsWith("/") || path.split("/").includes("..") || !changeScope.some((scope) => pathMatchesScope(path, scope)));
     if (outside.length)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {