@miraland-labs/conduit-bridge 0.16.108 → 0.16.109

package/dist/execution.js

@@ -25,7 +25,7 @@ import { ensureLandCommit } from "./ensure-land-commit.js";
 import { AGENT_NO_LAND_COMMIT_PREFIX, AgentNoLandCommitError, agentNoLandCommitMessage, requiresLandCommit } from "./land-contract.js";
 import { agentClaimsRepositoryWork, claimsVsGitMismatch, isLandTreeEmpty, reportClaimsRepositoryWork, } from "./land-git-reality.js";
 const execFileAsync = promisify(execFile);
-import { captureVerificationFailure, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationGateRanNothingError } from "./ensure-test-evidence.js";
+import { boundedTail, captureVerificationFailure, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationGateRanNothingError } from "./ensure-test-evidence.js";
 import { ensureChangeEvidence } from "./ensure-change-evidence.js";
 import { ensureNormativeEvidence } from "./ensure-normative-evidence.js";
 import { changedPathsSince, compareWorktreeState, diffStatSince, worktreeStateFingerprint, worktreeWrittenPaths } from "./git-witness.js";
@@ -2872,6 +2872,42 @@ export async function verificationScopeDryRun(input) {
         : written.filter((path) => !input.changeScope.some((scope) => pathMatchesScope(path, scope)));
     return { ranNothing, redBase, outsideScope };
 }
+/** Prompt and failure lines keep a short tail; the investigation brief caps each failure at 1,000. */
+const DELIVERY_VERIFICATION_GATE_TAIL_CHARS = 800;
+/**
+ * Run the T191 gate set in the verification worktree at the delivered commit: declared
+ * `.conduit/verification` ∪ the commands the criteria name, else the discovered set. One at a
+ * time, same bounded runner as the pre-agent dry run. Writes the gates made are discarded so the
+ * agent still reads the delivered tree.
+ */
+export async function runDeliveryVerificationGates(input) {
+    const commands = verificationEvidenceCommands([...input.verificationCommands], input.declaredVerificationCommands ?? [], input.acceptance ?? []);
+    const run = input.runCommand ?? runBoundedVerificationCommand;
+    const results = [];
+    for (const command of commands) {
+        try {
+            const result = await run(command, input.workspace);
+            results.push({
+                command,
+                exitCode: result.code,
+                stdoutTail: boundedTail(result.stdout, DELIVERY_VERIFICATION_GATE_TAIL_CHARS),
+                stderrTail: boundedTail(result.stderr, DELIVERY_VERIFICATION_GATE_TAIL_CHARS),
+            });
+        }
+        catch (error) {
+            // A gate that could not run is a failed gate: record it so settlement still names it.
+            const message = error instanceof Error ? error.message : String(error);
+            results.push({
+                command,
+                exitCode: -1,
+                stdoutTail: "",
+                stderrTail: boundedTail(message, DELIVERY_VERIFICATION_GATE_TAIL_CHARS),
+            });
+        }
+    }
+    await discardWorktreeWrites(input.workspace);
+    return results;
+}
 /** Return the worktree to its commit: tracked files restored, new files removed, ignored files kept. */
 async function discardWorktreeWrites(worktree) {
     const options = { timeout: 60_000, maxBuffer: 2_000_000 };

package/dist/failure-signal.js

@@ -75,6 +75,32 @@ export const failureSignalSchema = z.object({
      */
     model: z.string().max(200).optional(),
 });
+/**
+ * The class–disposition pairs a classified failure may carry. Disposition is a function of the
+ * cause, not of class: the six canonical pairs plus `contract`/`hold` (the work package is the
+ * defect; a rework would spend repair on code that is not at fault) and `environment`/`retry`
+ * (the computer hiccupped; the next lane runs it again).
+ *
+ * Declared once so the envelope schema and both twins share one list. `ClassifiedFailure` stays a
+ * free pair; this list is the boundary check.
+ */
+export const ADMITTED_FAILURE_PAIRS = [
+    ["transient", "retry"],
+    ["environment", "hold"],
+    ["environment", "retry"],
+    ["contract", "rework"],
+    ["contract", "hold"],
+    ["quality", "rework"],
+    ["authority", "decision"],
+    ["platform", "stop"],
+];
+/**
+ * Whether this class and disposition are one of the admitted pairs. The envelope schema calls it
+ * so a supplied envelope cannot carry a pairing the builders never emit.
+ */
+export function isAdmittedFailurePair(failureClass, disposition) {
+    return ADMITTED_FAILURE_PAIRS.some(([admittedClass, admittedDisposition]) => admittedClass === failureClass && admittedDisposition === disposition);
+}
 /**
  * The causes Bridge names itself — before the agent starts, or while finishing its report — as one
  * table keyed by code, so Bridge sends the envelope and the control plane validates it (K3).

package/dist/investigation.js

@@ -11,10 +11,9 @@ import { createAttemptWorktree, removeAttemptWorktree } from "./attempt-worktree
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl } from "./brief.js";
 import { headCommitOrNull } from "./git.js";
 import { redactSecrets } from "./config.js";
-import { learnDriverFuel, resolveAssignmentModel } from "./execution.js";
+import { learnDriverFuel, resolveAssignmentModel, changedPathsSince, runDeliveryVerificationGates } from "./execution.js";
 import { DRIVERS, extractAgentReportJsonText, parseJsonObjectCandidate } from "./driver.js";
 import { pickDriverForClaim, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
-import { changedPathsSince } from "./execution.js";
 import { diffStatSince } from "./git-witness.js";
 import { switchManagedWorkspace } from "./on-shift-apply.js";
 import { execFile } from "node:child_process";
@@ -36,6 +35,8 @@ export const investigationAssignmentSchema = z.object({
     /** T122: present on a delivery verification — the contract base the delivered head was built on. */
     base_commit: z.string().nullable().optional().default(null),
     source_attempt_id: z.string().uuid().nullable().optional().default(null),
+    /** Delivery verification: the task's acceptance strings. Absent or [] on a plain investigation. */
+    acceptance: z.array(z.string().trim().min(1).max(4_000)).max(20).optional().default([]),
 });
 /**
  * Enforcement is a vendor's claim; verification is ours. Both run on every investigation — this only
@@ -95,7 +96,7 @@ export function buildInvestigationPrompt(assignment, commit, context) {
 }
 /**
  * T122: the Conductor's own check of a delivery, done the way a careful reviewer does it by hand —
- * run the registered commands at the delivered head, read the diff, judge every criterion. The
+ * read the gates Bridge already ran at the delivered head, read the diff, judge every criterion. The
  * verdict per criterion is the product; prose without verdicts is an unusable brief.
  */
 export function buildDeliveryVerificationPrompt(assignment, commit, context) {
@@ -113,10 +114,11 @@ export function buildDeliveryVerificationPrompt(assignment, commit, context) {
         "You are Conductor's independent delivery verification. A coding agent delivered this commit against approved acceptance criteria; you check it the way a careful reviewer would, and you never take the agent's word for anything.",
         "You have repo_read and test_run only. Do not edit, create, delete, format, commit, branch, push, install, or change any file.",
         diff,
-        "Run every REGISTERED COMMAND the criteria name, exactly as registered, and read its real output. Run nothing that is not registered. Never start a server, deploy, or call a production system.",
+        formatGatesRunBlock(context.gatesRun ?? []),
+        "Bridge already ran the gates at this commit. The GATES RUN block is the only gate fact — use those exit codes and output tails; do not choose which commands count as gates. You may still run a REGISTERED COMMAND to read more. Run nothing that is not registered. Never start a server, deploy, or call a production system.",
         // T132: three verifications ended at the time limit with no brief. Order the work so the brief
         // exists before the budget does not.
-        "Order of work: run the registered commands first, one at a time and never two at once (a test suite that rewrites a source file and restores it races against itself when run concurrently, and a changed tree voids your run), then read the changed files that matter, then write the brief. Your time is limited: a brief with `unclear` verdicts for what you did not reach is the required outcome; a run that ends without a brief settles nothing.",
+        "Order of work: read the GATES RUN facts first, then the changed files that matter, then write the brief. You may run a registered command to read more, one at a time and never two at once (a test suite that rewrites a source file and restores it races against itself when run concurrently, and a changed tree voids your run). Your time is limited: a brief with `unclear` verdicts for what you did not reach is the required outcome; a run that ends without a brief settles nothing.",
         "Judge each ACCEPTANCE criterion by its key: supported only when you saw the code or the command output that meets it; unsupported when you saw it is not met, with the file or output that shows it; unclear when this commit and these commands cannot settle it. A criterion about wording in a pull request or a report is unclear here — you cannot see those.",
         "Do not quote secrets, credentials, tokens, or file bodies. Name paths, symbols, and command output lines instead.",
         "",
@@ -130,6 +132,41 @@ export function buildDeliveryVerificationPrompt(assignment, commit, context) {
         "criteria has one entry per ACCEPTANCE key. Close the fence and add no prose after it.",
     ].join("\n");
 }
+function formatGatesRunBlock(gates) {
+    const header = "GATES RUN (Bridge ran these at the pinned commit before you started; these are the only gate facts)";
+    if (!gates.length)
+        return `${header}\n- none`;
+    return `${header}\n${gates.map((gate) => {
+        const tail = gate.stderrTail.trim() || gate.stdoutTail.trim();
+        return tail
+            ? `- ${gate.command} — exit ${gate.exitCode}\n  ${tail.replace(/\n/g, "\n  ")}`
+            : `- ${gate.command} — exit ${gate.exitCode}`;
+    }).join("\n")}`;
+}
+function gateFailureLine(tail) {
+    const lines = tail.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    const marked = lines.find((line) => /FAIL|Error|error|failed|✗/.test(line));
+    const chosen = marked ?? lines.at(-1) ?? tail;
+    return chosen.length > 1_000 ? chosen.slice(0, 1_000) : chosen;
+}
+function gateFailureFact(gate) {
+    const tail = gate.stderrTail.trim() || gate.stdoutTail.trim() || "exited non-zero";
+    return boundedTail(`${gate.command} — exit ${gate.exitCode}: ${gateFailureLine(tail)}`, 1_000);
+}
+function settleCommandsRun(gates, reported) {
+    const out = [];
+    const seen = new Set();
+    for (const command of [...gates.map((gate) => gate.command), ...reported]) {
+        const trimmed = command.trim();
+        if (!trimmed || seen.has(trimmed))
+            continue;
+        seen.add(trimmed);
+        out.push(trimmed);
+        if (out.length === 10)
+            break;
+    }
+    return out;
+}
 /** One message for every unusable answer, so the retry decision reads it rather than guessing. */
 export const UNUSABLE_BRIEF = "Investigation returned no usable brief";
 /** T130: how much of an unusable reply travels with the failure, so the next run can be diagnosed. */
@@ -303,9 +340,20 @@ export async function executeNextInvestigation(client, config, workspace, brief,
             : undefined;
         // T126: the prompt names the commands of the repository this lane opened — not the control
         // plane's idea of them — and carries the diff stat Bridge computed, since the lane cannot run git.
+        const deliveryVerification = isDeliveryVerification(assignment);
+        const gatesRun = deliveryVerification
+            ? await runDeliveryVerificationGates({
+                workspace: attemptWorkspace,
+                verificationCommands: liveBrief?.verification ?? [],
+                declaredVerificationCommands: liveBrief?.declared_verification ?? [],
+                acceptance: assignment.acceptance ?? [],
+                runCommand: options.runVerificationCommand,
+            })
+            : [];
         const context = {
             verificationCommands: liveBrief?.verification ?? [],
             diffStat: assignment.base_commit ? await diffStatSince(attemptWorkspace, assignment.base_commit) : null,
+            gatesRun,
         };
         // T154: the lane resolves its model the way the authoring lane does. Without it Claude Code ran
         // at its CLI default, which Conduit's /v1 rejects as an unknown alias (hosted-1, 2026-09-10:
@@ -354,7 +402,9 @@ export async function executeNextInvestigation(client, config, workspace, brief,
                 verification: observed.verification,
                 limitations: observed.limitations,
                 criteria: observed.criteria,
-                command_failures: observed.command_failures,
+                command_failures: deliveryVerification
+                    ? gatesRun.filter((gate) => gate.exitCode !== 0).map(gateFailureFact).slice(0, 10)
+                    : observed.command_failures,
                 witness: {
                     repository_fingerprint: assignment.repository_fingerprint ?? liveRepository ?? "unknown",
                     commit,
@@ -362,7 +412,9 @@ export async function executeNextInvestigation(client, config, workspace, brief,
                     bounded_by: boundedByForDriver(driverId),
                     files_read: observed.files_read,
                     bytes_read: observed.bytes_read,
-                    commands_run: observed.commands_run,
+                    commands_run: deliveryVerification
+                        ? settleCommandsRun(gatesRun, observed.commands_run)
+                        : observed.commands_run,
                 },
             },
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.108",
+  "version": "0.16.109",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {