@miraland-labs/conduit-bridge 0.16.142 → 0.16.147

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.16.125` — the workspace brief reports `declared_demonstration` so the planner knows whether the repository can show itself (KERNEL.md §51). Earlier (0.16.124) — when a project declares `.conduit/demonstrate`, Bridge runs that bounded command at the delivered head and attaches a stamped `preview` row (KERNEL.md §47). Earlier (0.16.95) — Conduit-fuel lanes bind organization aliases (T144), the Anthropic base URL is the origin (T148), the investigation lane resolves its model (T154); a hosted container image lives under `hosted/` (docs/HOSTED_RUNNER.md). Earlier (0.16.27) — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
+**Package version:** `0.16.125` — the workspace brief reports `declared_demonstration` so the planner knows whether the repository can show itself (docs/historical/KERNEL_HISTORY_2026-09.md §51). Earlier (0.16.124) — when a project declares `.conduit/demonstrate`, Bridge runs that bounded command at the delivered head and attaches a stamped `preview` row (docs/historical/KERNEL_HISTORY_2026-09.md §47). Earlier (0.16.95) — Conduit-fuel lanes bind organization aliases (T144), the Anthropic base URL is the origin (T148), the investigation lane resolves its model (T154); a hosted container image lives under `hosted/` (docs/HOSTED_RUNNER.md). Earlier (0.16.27) — work-package execution budgets reach every agent turn, are bounded by the machine ceiling, and expose their effective source for operations. Local-fuel provider refusals make the affected lane unavailable instead of repeatedly spending attempts; an operator who changes the lane's account or plan can invalidate that observation with `ops quota-clear <driver>`. Bridge discovers bounded repository verification commands, including Make targets `test`, `check`, `verify`, `replay`, `typecheck`, `lint`, and `build`. `ops disconnect` asks before it removes the runner service and clears credentials; pass `--yes` to skip the question. `ops.env` is enrollment/bootstrap defaults only: an explicit workspace does not inherit an old repository, and project switches do not rewrite global project state. `ops enroll` exchanges a single-use token, registers the machine, binds project affinity, provisions fuel keys, brings detected drivers online, and starts the runner in one command. On Linux, `ops install` refuses any effective systemd drop-in. A switch intent remains queued until the target runner heartbeat proves Bound. After every Bridge publish, operators must re-run `ops install` (LaunchAgent pins an absolute `cli.js`).
 
 ## Prerequisites
 

package/dist/attempt-worktree.js

@@ -2,7 +2,7 @@
  * F-07 slice 1: one Git worktree per attempt. The install-service source checkout is never the
  * agent cwd; retries must not inherit dirty files from a failed run.
  */
-import { access, appendFile, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { access, appendFile, mkdir, readFile, rm } from "node:fs/promises";
 import { constants } from "node:fs";
 import { basename, join, resolve } from "node:path";
 import { execFile } from "node:child_process";
@@ -136,28 +136,3 @@ export async function proveResumeWorktree(sourceWorkspace, attemptId, worktreePa
         return false;
     }
 }
-/** Hold a crashed attempt tree for local diagnosis; never reused as agent cwd. */
-export async function quarantineAttemptWorktree(sourceWorkspace, worktreePath, attemptId) {
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const dest = join(sourceWorkspace, ".conduit", "quarantine", `${attemptId}-${stamp}`);
-    await mkdir(join(sourceWorkspace, ".conduit", "quarantine"), { recursive: true });
-    try {
-        await execFileAsync("git", ["-C", sourceWorkspace, "worktree", "remove", "--force", worktreePath], { timeout: 60_000, maxBuffer: 2_000_000 });
-        return null;
-    }
-    catch {
-        try {
-            await rename(worktreePath, dest);
-            await execFileAsync("git", ["-C", sourceWorkspace, "worktree", "prune"], {
-                timeout: 30_000,
-                maxBuffer: 1_000_000,
-            }).catch(() => undefined);
-            await writeFile(join(dest, ".conduit-quarantine.json"), `${JSON.stringify({ attemptId, at: stamp })}\n`, "utf8");
-            return dest;
-        }
-        catch {
-            await removeAttemptWorktree(sourceWorkspace, worktreePath);
-            return null;
-        }
-    }
-}

package/dist/cli.js

@@ -14,15 +14,15 @@ import { runMcp } from "./mcp.js";
 import { detectInstalledClients, localFuelOnlyClients, suggestFuelSource } from "./detect.js";
 import { DRIVERS, MODEL_TIERS } from "./driver.js";
 import { driversHeartbeatReport, driverLabel, heartbeatStatusForDrivers, isSupportedDriverId, listDriverLanes, onlineDriverIds, seedDriversFromDetection, seedDriverLanes, setDriverFuel, setDriverModels, setDriversOnline, formatLaneTiers, laneDispatchBlock, laneStatuses, } from "./drivers.js";
-import { buildWorkspaceBrief } from "./brief.js";
+import { buildWorkspaceBrief, normalizeRepositoryUrl } from "./brief.js";
 import { parseAgentTimeoutMinutes, parseMaxTurns, resolveMaxTurns } from "./execution-budget.js";
-import { BOOTSTRAP_RESULTS, buildSovereignExecutionFacts } from "./execution-facts.js";
+import { BOOTSTRAP_RESULTS, buildSovereignExecutionFacts, workspaceIsClean } from "./execution-facts.js";
 import { ensureCheckout } from "./checkout.js";
-import { buildOnShiftIntentProof, maybeApplyOnShiftIntent } from "./on-shift-apply.js";
-import { loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
-import { pumpExecutionSlots, renewLeases } from "./execution.js";
+import { buildOnShiftIntentProof, managedWorkspacePath, maybeApplyOnShiftIntent } from "./on-shift-apply.js";
+import { expandOpsValue, loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
+import { discardWorktreeWrites, pumpExecutionSlots, renewLeases } from "./execution.js";
 import { applyRunnerToolPath, installRunnerService, uninstallRunnerService } from "./service.js";
-import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, PREFLIGHT_CACHE_TTL_MS, unavailableWorkspacePreflight } from "./preflight.js";
+import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, planGateRehearsals, PREFLIGHT_CACHE_TTL_MS, runGateRehearsal, unavailableWorkspacePreflight } from "./preflight.js";
 import { refreshSourceWorkspace } from "./workspace-refresh.js";
 import { executeNextInvestigation } from "./investigation.js";
 import { bridgeVersion } from "./version.js";
@@ -613,12 +613,20 @@ async function runner() {
             config.maxTurns = latest.maxTurns;
             // Refresh before discovery: the brief and the readiness report must describe origin's code,
             // not whatever this checkout was left on. Cadence is the readiness report's own, not the beat.
-            const refresh = workspace ? await reportedRefresh(workspace) : null;
+            // Not while the gate rehearses: a fast-forward would move the tree under the running gate, and
+            // the managed checkouts are not followed then either (rehearsalCheckouts is not called).
+            const refresh = workspace ? (gateRehearsalRunning ? lastRefresh?.result ?? null : await reportedRefresh(workspace)) : null;
             const currentBrief = workspace ? await buildWorkspaceBrief(workspace).catch(() => brief) : null;
+            const rehearsalPlan = workspace && currentBrief && !gateRehearsalRunning
+                ? await planGateRehearsals(await rehearsalCheckouts(workspace, currentBrief, refresh)).catch(() => null)
+                : null;
+            if (rehearsalPlan)
+                reportedGateRehearsals = rehearsalPlan.reports;
             const preflight = workspace
-                ? await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh })
-                : unavailableWorkspacePreflight({ config, managedRoot });
+                ? await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh, agentTimeoutMs: timeoutMs })
+                : unavailableWorkspacePreflight({ config, managedRoot, agentTimeoutMs: timeoutMs });
             const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
+            lastOnShift = hb.on_shift ?? null;
             if (hb.staleBridge) {
                 console.error(`Bridge update required: running protocol ${BRIDGE_PROTOCOL_VERSION}; control plane requires protocol ${hb.requiredProtocol ?? "unknown"} (minimum Bridge ${hb.minimumVersion ?? "unknown"}). Reinstall the latest Bridge, then restart this runner.`);
                 await new Promise((resolveSleep) => setTimeout(resolveSleep, Math.max(intervalMs, 60_000)));
@@ -658,12 +666,17 @@ async function runner() {
                 await heartbeat(client, config, workspace, currentBrief, preflight, intentProof, bootstrapResult);
             }
             await renewLeases(client, config);
-            if (workspace && onlineDriverIds(config).length) {
+            if (workspace && onlineDriverIds(config).length && !gateRehearsalRunning && rehearsalPlan?.due
+                && running.size === 0 && Object.keys(config.activeAttempts).length === 0) {
+                startGateRehearsal(rehearsalPlan.due.workspace, rehearsalPlan.due.plan);
+            }
+            // No claim while the gate rehearses: the rehearsal measures the gate alone, never beside an attempt.
+            if (workspace && onlineDriverIds(config).length && !gateRehearsalRunning) {
                 // Read the workspace again, then publish it. The last brief stands if the read fails.
                 const publishWorkspaceState = async (options = {}) => {
                     const refresh = await reportedRefresh(workspace, options);
                     const currentBrief = await buildWorkspaceBrief(workspace).catch(() => brief);
-                    const preflight = await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh }, options);
+                    const preflight = await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh, agentTimeoutMs: timeoutMs }, options);
                     const hb = await heartbeat(client, config, workspace, currentBrief, preflight, undefined, bootstrapResult);
                     return { preflight, hb };
                 };
@@ -706,6 +719,61 @@ async function runner() {
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
     }
 }
+/** True while the gate rehearsal runs in the background; the loop keeps beating but claims nothing. */
+let gateRehearsalRunning = false;
+/** The rehearsals the heartbeat reports, one per on-shift repository; empty reports no field. */
+let reportedGateRehearsals = [];
+/** The last on-shift snapshot, so the next cycle knows every repository this computer serves. */
+let lastOnShift = null;
+/** Managed checkouts follow origin on the readiness report's cadence, as the runner's own does. */
+const managedRefreshes = new Map();
+/**
+ * Every checkout this computer is on shift for: the runner's workspace, then the managed checkout of
+ * each repository the control plane lists. A folder under the managed root counts only when it sits
+ * at that repository's managed path and its origin is that repository; anything else is a leftover.
+ * A checkout may rehearse now only when it is clean and can follow origin.
+ */
+async function rehearsalCheckouts(workspace, brief, refresh) {
+    const checkouts = [{ workspace, brief, eligible: refresh?.state !== "diverged" && await workspaceIsClean(workspace) }];
+    const root = lastOnShift?.managed_workspace_root?.trim();
+    for (const repository of root ? lastOnShift?.repositories ?? [] : []) {
+        let path;
+        try {
+            path = resolve(expandOpsValue(managedWorkspacePath(root, repository)));
+        }
+        catch {
+            continue;
+        }
+        if (path === workspace || !existsSync(path))
+            continue;
+        let managedRefresh = managedRefreshes.get(path);
+        if (!managedRefresh || Date.now() - managedRefresh.at >= PREFLIGHT_CACHE_TTL_MS) {
+            managedRefresh = { at: Date.now(), result: await refreshSourceWorkspace(path).catch(() => null) };
+            managedRefreshes.set(path, managedRefresh);
+        }
+        const managedBrief = await buildWorkspaceBrief(path).catch(() => null);
+        if (!managedBrief?.repository || normalizeRepositoryUrl(managedBrief.repository) !== normalizeRepositoryUrl(repository))
+            continue;
+        checkouts.push({ workspace: path, brief: managedBrief, eligible: managedRefresh.result?.state !== "diverged" && await workspaceIsClean(path) });
+    }
+    return checkouts;
+}
+/**
+ * Run one on-shift repository's gate once in its checkout, off the loop: a ten-minute gate
+ * must not stop the heartbeat, or the computer reads offline while it measures. The workspace was
+ * clean when it started, so whatever is written there afterwards is the gate's and is discarded.
+ */
+function startGateRehearsal(workspace, plan) {
+    gateRehearsalRunning = true;
+    console.log(`Rehearsing the gate in ${workspace}: ${plan.commands.join(", ")}`);
+    void runGateRehearsal(workspace, plan)
+        .catch((error) => console.error(`Gate rehearsal failed: ${redactSecrets(error instanceof Error ? error.message : "unknown error")}`))
+        .finally(async () => {
+        if (!await workspaceIsClean(workspace))
+            await discardWorktreeWrites(workspace);
+        gateRehearsalRunning = false;
+    });
+}
 /** Last state announced, so a workspace that stays diverged does not print on every cycle. */
 let lastRefreshState = null;
 /** Last refresh and when it ran, so the fetch keeps the readiness report's cadence. */
@@ -755,6 +823,7 @@ async function heartbeat(client, config, workspacePath, brief, preflight, intent
         ...preflight,
         ...(assignmentPollBehindServer() ? { runner_behind_server: true } : {}),
         ...(process.env.CONDUIT_RUNNER_SERVICE === "container" ? { runner_service: "container" } : {}),
+        ...(workspacePath && reportedGateRehearsals.length ? { gate_rehearsals: reportedGateRehearsals } : {}),
     };
     const response = await client.request("/runner/v1/heartbeat", { method: "POST", body: JSON.stringify({
             status,

package/dist/config.js

@@ -58,8 +58,6 @@ export async function loadConfigIfPresent() {
     // Claims live only in runtime.json; a fresh install has none.
     config.activeAttempts = runtime?.activeAttempts ?? {};
     config.sessions = runtime?.sessions;
-    for (const active of Object.values(config.activeAttempts))
-        active.phase ??= "agent_running";
     if (config.fuelSource !== "local" && config.fuelSource !== "conduit")
         config.fuelSource = "conduit";
     // Clamp to what concurrent slot workers can run (1..BRIDGE_MAX_LEASE_CAPACITY).

package/dist/driver.js

@@ -152,16 +152,13 @@ export function tierForRisk(risk) {
 export function isSafeModelName(value) {
     return /^[A-Za-z0-9][A-Za-z0-9._/-]{0,99}$/.test(value);
 }
-/** Grants → Claude Code tool allow-list (mutate_repo mapping). Privileged grants are never mapped. */
-export function claudeToolsForGrants(grants, verificationCommands = [], capabilities = []) {
-    return projectClaude("mutate_repo", { grants, verificationCommands, capabilities }).allowedTools;
-}
-export const claudeDeniedTools = deniedCommands.map((command) => `Bash(${command}:*)`);
 function resolveRunClass(input) {
     if (input.executionClass)
         return input.executionClass;
     throw new Error("Driver run is missing stamped execution_class. Pass executionClass from the assignment stamp.");
 }
+/** Heads the prompt section that tells the agent to continue a timed-out run's work. */
+export const RESUME_PROMPT_HEADING = "CONTINUE THE EARLIER RUN";
 export function buildAssignmentPrompt(context) {
     const packageContext = context.workPackage;
     const spec = context.spec;
@@ -251,6 +248,9 @@ export function buildAssignmentPrompt(context) {
             : "REWORK FEEDBACK — an independent review returned this delivery; address every point";
         lines.push("", `${heading}\n${rework}`);
     }
+    if (context.resumeHead) {
+        lines.push("", `${RESUME_PROMPT_HEADING} — an earlier run of this same package ran out of time before it finished.`, `Its work is already on this branch at commit ${context.resumeHead}. Continue from that work: read what is there, keep what is correct, and finish the package. Do not start over.`);
+    }
     const mustCommit = context.grants.includes("repo_write") && context.grants.includes("branch_create");
     const mustOpenPr = mustCommit && context.grants.includes("pr_create");
     const executionClass = context.executionClass
@@ -288,7 +288,10 @@ export function buildAssignmentPrompt(context) {
     "- Every criterion you mark \"unknown\" must carry unverified_reason: not_attempted when you simply did not check it and another run could; needs_authority when this package has no grant or capability for it; needs_environment when it needs a running or deployed system you cannot start here; needs_third_party when it needs an account or platform outside this workspace; needs_human_judgment when only a person can assess it. Say which one — it decides whether the owner returns the work or accepts it.", 
     // A code can only say the class. The owner reads a sentence, and the sentence needs the
     // particular: which app, which authority, which account. The run already knows it.
-    "- With it, write unverified_detail: one sentence naming exactly what was missing, in the owner's terms. \"Checking this needs the app deployed and running, and this task cannot deploy\" — not \"environment unavailable\".", "", "When the work is finished, end your reply with exactly one fenced ```json block:", agentReportTemplate);
+    "- With it, write unverified_detail: one sentence naming exactly what was missing, in the owner's terms. \"Checking this needs the app deployed and running, and this task cannot deploy\" — not \"environment unavailable\".", 
+    // The owner reads outcome, limitations and unverified_detail on a phone. Dense prose was the
+    // complaint on every delivery this trial; ASD-STE100's rules are the shortest fix.
+    "- Write outcome, risks, limitations and every unverified_detail in Simplified Technical English (ASD-STE100): short sentences of at most 20 words, one fact or instruction per sentence, active voice, present tense, and the product's own terms (work package, delivery, gate, Hold) with no synonyms.", "", "When the work is finished, end your reply with exactly one fenced ```json block:", agentReportTemplate);
     return lines.join("\n");
 }
 /**
@@ -916,21 +919,6 @@ export const codexDriver = {
         return { status: "completed", resultText, sessionId: parsed.sessionId, usage: parsed.usage };
     },
 };
-/**
- * Grants + capabilities → Cursor CLI permissions via ExecutionClass.
- * Current Cursor Agent schema accepts only `permissions.{allow,deny}` (no
- * `version` / `approvalMode`). Outside the allow list is denied without --force.
- *
- * `observe_network` / networked mutate / publish_artifact use `--force` (see
- * cursorRunArgs). Field evidence: allow-listing WebFetch alone still yields
- * "User Rejected" under headless `-p`; `--force` is required for fetch and for
- * publish shell under open class policy. Research-only networked assignments
- * deny Shell(*) and Write(**).
- */
-export function cursorPermissionsForGrants(grants, verificationCommands, capabilities, executionClass) {
-    const { allow, deny } = projectCursor(executionClass, { grants, verificationCommands, capabilities });
-    return { allow, deny };
-}
 /**
  * Cursor CLI arguments. Deliberately no `--mode plan` for read-only assignments: plan mode is not an
  * enforcement boundary (in headless `-p` mode the agent can self-escalate out of it and edit anyway)
@@ -1996,7 +1984,8 @@ const LOCAL_VENDOR_ENV = [
     "CURSOR_API_KEY", "KIRO_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY",
     "XAI_API_KEY",
 ];
-function boundedEnvironment(fuel, fuelSource = "conduit", extraEnv) {
+/** The stripped process environment an agent CLI runs with, carrying Conduit fuel when given. */
+export function boundedEnvironment(fuel, fuelSource = "conduit", extraEnv) {
     // Proxy and TLS variables stay: fueled agents must reach Conduit's /v1 on
     // machines that only have network access through a proxy.
     const allowed = ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "TMPDIR", "TMP", "TEMP", "LANG", "LC_ALL", "TERM", "NO_COLOR", "FORCE_COLOR",
@@ -2071,7 +2060,3 @@ export function hasGrokLogin(env = process.env) {
     // `~/.grok` exists after install; auth.json is the `grok login` / cached_token file.
     return Boolean(home && existsSync(join(home, ".grok", "auth.json")));
 }
-/** Exported for tests — builds the stripped process env with optional Conduit fuel. */
-export function agentProcessEnv(fuel, fuelSource = "conduit", extraEnv) {
-    return boundedEnvironment(fuel, fuelSource, extraEnv);
-}

package/dist/drivers.js

@@ -400,15 +400,6 @@ export function setDriverFuel(config, driverId, fuel) {
 export function heartbeatStatusForDrivers(onlineIds) {
     return onlineIds.length > 0 ? "online" : "standby";
 }
-/**
- * Effective capacity advertised on heartbeat: full approved pool when any lane is online;
- * 0 (via standby + no claims) when none are. Caller still sends lease_capacity = approved when online.
- */
-export function advertiseLeaseCapacity(approved, onlineIds) {
-    if (onlineIds.length === 0)
-        return 1; // schema/heartbeat min; status standby prevents matching
-    return approved;
-}
 export function driversHeartbeatReport(config, activeAttempts, processOnlineIds, env = process.env) {
     const processOnline = new Set(processOnlineIds ?? []);
     const busyByDriver = new Map();

package/dist/ensure-demonstration-evidence.js

@@ -1,6 +1,6 @@
 /**
  * When the project declares how it shows itself, Bridge runs that command at the delivered head and
- * attaches what it printed. The agent never authors this entry (KERNEL.md §47, "See it").
+ * attaches what it printed. The agent never authors this entry (docs/historical/KERNEL_HISTORY_2026-09.md §47, "See it").
  *
  * `.conduit/demonstrate` is one bounded command, `#` comments allowed, absent by default. It runs
  * with the same shape check, runner and bound as a verification command, and it is never a gate:

package/dist/ensure-land-commit.js

@@ -3,33 +3,14 @@
  */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { commitsAheadOfBase } from "./ensure-pull-request.js";
-import { readHeadCommit } from "./git.js";
+import { commitsAheadOfBase, pushOriginHead } from "./ensure-pull-request.js";
+import { readHeadCommit, uncommittedPaths } from "./git.js";
+import { redactSecrets } from "./secret-redaction.js";
 import { AgentNoLandCommitError, filterPathsInScope, requiresLandCommit, } from "./land-contract.js";
 const execFileAsync = promisify(execFile);
-async function uncommittedPaths(workspace) {
-    const { stdout } = await execFileAsync("git", ["-C", workspace, "status", "--porcelain"], {
-        timeout: 30_000,
-        maxBuffer: 8_000_000,
-    });
-    const paths = [];
-    for (const line of stdout.split("\n")) {
-        if (!line.trim())
-            continue;
-        const entry = line.slice(3).trim();
-        if (!entry)
-            continue;
-        const path = entry.includes(" -> ")
-            ? entry.slice(entry.lastIndexOf(" -> ") + 4).trim()
-            : entry;
-        if (path)
-            paths.push(path.replace(/^"|"$/g, ""));
-    }
-    return paths;
-}
 const LAND_COMMIT_EMAIL = "conduit-bridge@miraland.io";
 const LAND_COMMIT_NAME = "Conduit Bridge";
-async function commitScopedPaths(workspace, paths) {
+async function commitScopedPaths(workspace, paths, message = "Conduit: land scoped agent changes") {
     if (!paths.length)
         throw new Error("Cannot land an empty path set");
     await execFileAsync("git", ["-C", workspace, "add", "--", ...paths], {
@@ -40,7 +21,7 @@ async function commitScopedPaths(workspace, paths) {
         "-C", workspace,
         "-c", `user.email=${LAND_COMMIT_EMAIL}`,
         "-c", `user.name=${LAND_COMMIT_NAME}`,
-        "commit", "-m", "Conduit: land scoped agent changes",
+        "commit", "-m", message,
     ], { timeout: 120_000, maxBuffer: 8_000_000 });
 }
 /**
@@ -73,3 +54,40 @@ export async function ensureLandCommit(input) {
     }
     return { kind: "committed", headCommit: await readHead(input.workspace), paths: pending };
 }
+async function currentBranch(workspace) {
+    const { stdout } = await execFileAsync("git", ["-C", workspace, "branch", "--show-current"], {
+        timeout: 30_000,
+        maxBuffer: 1_000_000,
+    });
+    return stdout.trim();
+}
+/**
+ * A run that spent Conduit's package budget keeps its work for the retry: commit the scoped files the
+ * agent left uncommitted, push the attempt branch where the grants allow a push, and name the head.
+ * Null when the attempt has nothing after base — the retry then starts fresh, as before.
+ */
+export async function checkpointWorkInProgress(input) {
+    if (!requiresLandCommit({ grants: input.grants, spec: input.spec }))
+        return null;
+    const pending = filterPathsInScope(await uncommittedPaths(input.workspace), input.spec.change_scope ?? []);
+    if (pending.length) {
+        await commitScopedPaths(input.workspace, pending, "Conduit: work in progress at the package budget");
+    }
+    const ahead = await commitsAheadOfBase(input.workspace, input.baseCommit);
+    if (!ahead)
+        return null;
+    // The same grant the delivery push needs (needsPullRequest). Without it the head stays on this
+    // computer, where the retained worktree still holds it.
+    if (input.grants.includes("pr_create")) {
+        try {
+            await pushOriginHead(input.workspace);
+        }
+        catch (error) {
+            console.error(`Work in progress was not pushed: ${redactSecrets(error instanceof Error ? error.message : String(error))}`);
+        }
+    }
+    return {
+        head: await readHeadCommit(input.workspace),
+        branch: await currentBranch(input.workspace),
+    };
+}

package/dist/ensure-test-evidence.js

@@ -319,8 +319,11 @@ export function boundedFailureDetail(command, stdoutLines, stderrLines, code, ma
 /**
  * The bounded runner every Bridge-run verification uses: the declared command, in the given
  * workspace, with the verification timeout and buffer. A non-zero exit is a result, not a throw.
+ *
+ * A gate the timeout stopped did not exit: `timedOut` says so, and stderr ends with the limit it
+ * reached. Read as exit 1, a gate that hung on the untouched base was a red base on the author.
  */
-export async function runBoundedVerificationCommand(command, workspace) {
+export async function runBoundedVerificationCommand(command, workspace, timeoutMs = VERIFICATION_TIMEOUT_MS) {
     const argv = argvForBoundedCommand(command);
     const bin = argv[0];
     if (!bin)
@@ -328,7 +331,7 @@ export async function runBoundedVerificationCommand(command, workspace) {
     try {
         const { stdout, stderr } = await execFileAsync(bin, argv.slice(1), {
             cwd: workspace,
-            timeout: VERIFICATION_TIMEOUT_MS,
+            timeout: timeoutMs,
             maxBuffer: VERIFICATION_MAX_BUFFER_BYTES,
             env: process.env,
         });
@@ -343,6 +346,14 @@ export async function runBoundedVerificationCommand(command, workspace) {
         // message reaches the `enoent` rule that Holds it on the computer operator.
         if (typeof err.code === "string")
             throw error;
+        if (err.killed === true) {
+            return {
+                stdout: String(err.stdout ?? ""),
+                stderr: `${String(err.stderr ?? "")}\nBridge stopped the gate: it did not exit within ${Math.round(timeoutMs / 1_000)} seconds.`.trimStart(),
+                code: 1,
+                timedOut: true,
+            };
+        }
         const stderr = String(err.stderr || err.message || "verification failed");
         return {
             stdout: String(err.stdout ?? ""),

package/dist/execution.js

@@ -11,24 +11,24 @@ import { saveDriverOutcome, saveDriverQuota, tierCandidates } from "./config.js"
 import { DRIVERS, acceptanceCriteriaLines, acceptanceReportSkeleton, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, extractAgentReportJsonText, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, parseJsonObjectCandidate, pickModelCandidate, isSafeModelName, driverExecutable, requireStampedExecutionClass, tierForRisk } from "./driver.js";
 import { assertClassFloor } from "./execution-class.js";
 import { pickDriverForClaim, recordDriverQuota, resolveDriverFuel, resolveDriverFuelProvenance, supportsReadOnlyDiagnosis, clearDriverOutcome, recordDriverTimeout } from "./drivers.js";
-import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
+import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, ensureCommitAvailable, fetchOrigin, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
 import { buildSovereignExecutionFacts, bootstrapResultForWorkspace, changedExecutionFact, resumeExecutionFacts, workspaceIsClean } from "./execution-facts.js";
-import { agentOutputCause, boundedDetail, bridgeCause, contractScopeConflictFailure, executionFactChangedSignal, verificationRedBaseSignal, verificationScopeConflictSignal } from "./failure-signal.js";
+import { agentOutputCause, boundedDetail, bridgeCause, contractScopeConflictFailure, executionFactChangedSignal, verificationGateTimeoutSignal, verificationRedBaseSignal, verificationScopeConflictSignal } from "./failure-signal.js";
 import { forgeTransportFailure } from "./transport-fault.js";
 import { managedWorkspacePath, switchManagedWorkspace } from "./on-shift-apply.js";
 import { formatResetMinute, parseQuotaResetAt } from "./quota-reset.js";
 import { headCommitOrNull } from "./git.js";
 import { BRIDGE_PROTOCOL_VERSION } from "./preflight.js";
 import { bridgeVersion } from "./version.js";
-import { PULL_REQUEST_OPEN_FAILURE_PREFIX, ensureDeliveryPullRequest } from "./ensure-pull-request.js";
-import { ensureLandCommit } from "./ensure-land-commit.js";
+import { PULL_REQUEST_OPEN_FAILURE_PREFIX, commitsMatch, ensureDeliveryPullRequest } from "./ensure-pull-request.js";
+import { checkpointWorkInProgress, ensureLandCommit } from "./ensure-land-commit.js";
 import { AGENT_NO_LAND_COMMIT_PREFIX, AgentNoLandCommitError, agentNoLandCommitMessage, requiresLandCommit } from "./land-contract.js";
 import { agentClaimsRepositoryWork, claimsVsGitMismatch, isLandTreeEmpty, reportClaimsRepositoryWork, } from "./land-git-reality.js";
 const execFileAsync = promisify(execFile);
-import { boundedTail, captureVerificationFailure, DeliveryReportDefectError, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationFailedError, VerificationGateRanNothingError } from "./ensure-test-evidence.js";
+import { boundedTail, captureVerificationFailure, DeliveryReportDefectError, detectGateRanNothing, ensureTestEvidence, needsTestEvidence, runBoundedVerificationCommand, verificationEvidenceCommands, VerificationFailedError, VerificationGateRanNothingError, VERIFICATION_TIMEOUT_MS } from "./ensure-test-evidence.js";
 import { ensureChangeEvidence } from "./ensure-change-evidence.js";
 import { ensureDemonstrationEvidence } from "./ensure-demonstration-evidence.js";
 import { ensureNormativeEvidence } from "./ensure-normative-evidence.js";
@@ -156,10 +156,14 @@ export function agentModelAborted(message) {
 function agentModelAbortPrefix(model) {
     return model ? `agent_model_abort: model=${model}; ` : "agent_model_abort: ";
 }
-function timeoutFailureBody(resolution, attemptId) {
-    const machineBound = resolution.source === "default"
+/** The computer's own ceiling ended the turn, not Conduit's package budget. */
+function machineBoundTimeout(resolution) {
+    return resolution.source === "default"
         || resolution.source === "machine"
         || resolution.source === "clamped_to_machine";
+}
+function timeoutFailureBody(resolution, attemptId, resume) {
+    const machineBound = machineBoundTimeout(resolution);
     const minutes = Math.round(resolution.timeoutMs / 60_000);
     return {
         failure: machineBound ? {
@@ -181,6 +185,7 @@ function timeoutFailureBody(resolution, attemptId) {
         },
         error: `agent_turn_timeout: agent turn exceeded ${resolution.timeoutMs}ms`,
         retryable: false,
+        ...(resume ? { resume } : {}),
         idempotency_key: `bridge:agent-timeout:${attemptId}`,
     };
 }
@@ -429,6 +434,9 @@ const executionContractSchema = z.object({
     // head reuses that change request instead of opening a second one at the same commit.
     prior_pull_request_url: z.string().nullable().optional().default(null),
     prior_head_commit: z.string().nullable().optional().default(null),
+    // A package-budget retry: the timed-out run's work is committed at prior_head_commit, which is also
+    // the claimed head this attempt starts from.
+    resume_from_attempt_id: z.string().uuid().nullable().optional().default(null),
 });
 const diagnosticRepairBriefSchema = z.object({
     root_cause: z.string().trim().min(1).max(2_000),
@@ -534,7 +542,17 @@ export function buildDiagnosticPrompt(input) {
  * control plane has ended.
  */
 const slotAborts = new Map();
-export async function renewLeases(client, config) {
+/**
+ * The renewal pass in flight. Each running slot and the runner loop all ask for a pass; one pass
+ * covers every attempt, so a caller that arrives while one runs waits for it instead of renewing
+ * the same leases and dropping the same attempts a second time.
+ */
+let renewalPass = null;
+export function renewLeases(client, config) {
+    renewalPass ??= renewEachLease(client, config).finally(() => { renewalPass = null; });
+    return renewalPass;
+}
+async function renewEachLease(client, config) {
     for (const active of Object.values(config.activeAttempts)) {
         if (Date.parse(active.leaseExpiresAt) - Date.now() < 120_000) {
             try {
@@ -633,14 +651,8 @@ function checkpointInstructionPrompt(instructions) {
         agentReportTemplate,
     ].join("\n");
 }
-function resolveAttemptDriver(config, active, fallback) {
-    if (active.driverId && DRIVERS[active.driverId])
-        return DRIVERS[active.driverId];
-    if (fallback)
-        return fallback;
-    // Crash between claim and driverId persist: pick any free online lane so recovery is not stranded.
-    const picked = pickDriverForClaim(config);
-    return picked ? DRIVERS[picked] ?? null : null;
+function resolveAttemptDriver(active, fallback) {
+    return (active.driverId ? DRIVERS[active.driverId] : undefined) ?? fallback ?? null;
 }
 export async function recoverActiveAttempt(client, config, driver, sourceWorkspace, brief, timeoutMs, supervision, taskId) {
     const active = taskId ? config.activeAttempts[taskId] : Object.values(config.activeAttempts)[0];
@@ -660,25 +672,15 @@ export async function recoverActiveAttempt(client, config, driver, sourceWorkspa
             await removeAttemptWorktree(workspace, worktree).catch(() => undefined);
         }
         else if (!diagnosis && response.retain_worktree !== true && worktree) {
-            if (active.terminal?.action === "fail") {
-                await quarantineAttemptWorktree(workspace, worktree, active.attemptId).catch(() => removeAttemptWorktree(workspace, worktree).catch(() => undefined));
-            }
-            else {
-                await removeAttemptWorktree(workspace, worktree).catch(() => undefined);
-            }
+            await removeAttemptWorktree(workspace, worktree).catch(() => undefined);
         }
         return true;
     }
-    const laneDriver = resolveAttemptDriver(config, active, driver);
+    const laneDriver = resolveAttemptDriver(active, driver);
     if (!laneDriver) {
         console.error(`No driver for attempt ${active.attemptId} (driverId=${active.driverId ?? "unset"})`);
         return false;
     }
-    if (!active.driverId) {
-        const assigned = Object.entries(DRIVERS).find(([, d]) => d === laneDriver)?.[0];
-        if (assigned)
-            await client.updateAttempt(active.taskId, { driverId: assigned });
-    }
     if (active.phase === "agent_running") {
         const diagnosis = active.executionKind === "diagnosis";
         const worktreeOwner = diagnosis ? active.sourceAttemptId : active.attemptId;
@@ -706,9 +708,9 @@ export async function recoverActiveAttempt(client, config, driver, sourceWorkspa
             await removeAttemptWorktree(workspace, worktree).catch(() => undefined);
         }
         else if (!diagnosis && response.retain_worktree !== true && worktree) {
-            // Do not quarantine before the terminal response: Conduit may need this exact tree for a
+            // Do not remove before the terminal response: Conduit may need this exact tree for a
             // pinned diagnosis even when Bridge restarted before it could preserve the agent session.
-            await quarantineAttemptWorktree(workspace, worktree, active.attemptId).catch(() => removeAttemptWorktree(workspace, worktree).catch(() => undefined));
+            await removeAttemptWorktree(workspace, worktree).catch(() => undefined);
         }
         return true;
     }
@@ -752,7 +754,7 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
         const active = config.activeAttempts[id];
         const laneDriver = active.phase === "terminal_pending"
             ? fallbackDriver
-            : resolveAttemptDriver(config, active, fallbackDriver);
+            : resolveAttemptDriver(active, fallbackDriver);
         if (!laneDriver && active.phase !== "terminal_pending") {
             console.error(`Slot recovery skipped for ${id}: no driver lane`);
             continue;
@@ -799,7 +801,7 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
             break;
         const taskId = claimed.taskId;
         driverId = claimed.driverId ?? driverId;
-        laneDriver = driverId ? DRIVERS[driverId] ?? laneDriver : laneDriver;
+        laneDriver = fallbackDriver ?? DRIVERS[driverId] ?? laneDriver;
         progressed = true;
         console.log(`Executing ${taskId} via ${laneDriver.name}`);
         // T86: the claim answers with the checkout it proved, which is this assignment's repository.
@@ -945,27 +947,6 @@ export async function claimNextAssignment(client, config, workspace, brief, driv
     });
     return { taskId: assignment.id, driverId: selectedDriverId, workspace: claimWorkspace };
 }
-export function claimedAssignmentDriver(fallback, driverId) {
-    if (!driverId)
-        return fallback;
-    const selected = DRIVERS[driverId];
-    if (!selected)
-        throw new Error(`Claimed assignment selected unavailable driver ${driverId}`);
-    return selected;
-}
-export async function executeNextAssignment(client, config, driver, workspace, brief, timeoutMs, supervision) {
-    if (Object.keys(config.activeAttempts).length)
-        return recoverActiveAttempt(client, config, driver, workspace, brief, timeoutMs, supervision);
-    const preferredDriverId = Object.entries(DRIVERS).find(([, candidate]) => candidate === driver)?.[0] ?? null;
-    const claimed = await claimNextAssignment(client, config, workspace, brief, preferredDriverId, null, {
-        beforeClaim: supervision?.beforeClaim,
-    });
-    if (!claimed)
-        return false;
-    const selectedDriver = claimedAssignmentDriver(driver, claimed.driverId);
-    await runClaimedAssignment(client, config, selectedDriver, claimed.workspace, brief, claimed.taskId, timeoutMs, supervision);
-    return true;
-}
 /**
  * T90: attempts whose stall report already ended them, by attempt id.
  *
@@ -1197,6 +1178,13 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         ?? (rework
             ? (executionContract.requested_base_commit ?? spec.repository?.base_commit ?? worktreeStart)
             : worktreeStart);
+    // Only when the worktree really stands at the timed-out run's head: a computer that cannot reach
+    // that commit starts at the base (resolveAttemptStartCommit), and the agent must not be told the
+    // work is there.
+    const resumeHead = !diagnosis && executionContract.resume_from_attempt_id && executionContract.prior_head_commit
+        && commitsMatch(executionContract.prior_head_commit, worktreeStart)
+        ? executionContract.prior_head_commit
+        : null;
     let normativeMaterialized = [];
     if (!diagnosis) {
         const normativeRefs = parseNormativeRefs(spec.normative_refs);
@@ -1342,13 +1330,15 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         return;
     }
     // T22/T24/T28: the gates run once here, before the first model call. A gate that started but
-    // tested nothing is the earliest fact and refuses first; then a gate already red on the untouched
-    // base; only a green base still runs the scope check, which refuses when a gate wrote outside the
-    // approved change scope.
+    // tested nothing is the earliest fact and refuses first; then a gate that never exited; then a gate
+    // already red on the untouched base; only a green base still runs the scope check, which refuses
+    // when a gate wrote outside the approved change scope.
+    // A resumed tree stands at the timed-out run's unfinished work, where red gates are expected; the
+    // timed-out run already passed these checks on the base.
     if (dryRunsVerification({
         executionKind,
         executionClass,
-        freshWorktree: options.freshWorktree ?? !options.existingWorktree,
+        freshWorktree: (options.freshWorktree ?? !options.existingWorktree) && !resumeHead,
     })) {
         watchdog.phase("verification");
         const dryRun = await verificationScopeDryRun({
@@ -1388,6 +1378,25 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
             return;
         }
+        if (dryRun.timedOut) {
+            const { command, stderrTail, stdoutTail } = dryRun.timedOut;
+            const detail = `Verification gate did not finish on the base commit ${worktreeStart}: ${command} (stopped after ${Math.round(VERIFICATION_TIMEOUT_MS / 60_000)} minutes)`;
+            const response = await queueTerminal(client, taskId, {
+                action: "fail",
+                body: {
+                    error: detail,
+                    retryable: false,
+                    signal: verificationGateTimeoutSignal({ command, baseCommit: worktreeStart, stderr: stderrTail, stdout: stdoutTail }),
+                    idempotency_key: `bridge:verification-gate-timeout:${active.attemptId}`,
+                },
+            });
+            // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
+            if (response.retain_worktree !== true) {
+                await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+            }
+            console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
+            return;
+        }
         if (dryRun.redBase) {
             const { command, exitCode, stderrTail, stdoutTail } = dryRun.redBase;
             const detail = `Verification fails on the base commit ${worktreeStart}: ${command} (exit ${exitCode ?? "unknown"})`;
@@ -1445,6 +1454,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             workspace: attemptWorkspace,
             currentHead: worktreeStart,
             reworkFeedback,
+            resumeHead,
             repairMode: task.repair_mode,
             workPackage,
             verificationCommands: attemptBrief?.verification ?? [],
@@ -1580,6 +1590,24 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             clearInterval(heartbeatTimer);
     };
     attemptDisposers.set(taskId, disposeTimers);
+    // A run that spent Conduit's package budget keeps its work: the control plane retries it once, and
+    // the retry resumes from the head reported here instead of starting over at the base. The tree
+    // stays on this computer, where that head is always reachable.
+    const reportTurnTimeout = async (message) => {
+        retainAttemptWorktree = true;
+        const resume = diagnosis || machineBoundTimeout(agentTimeout) ? null : await checkpointWorkInProgress({
+            workspace: attemptWorkspace, spec, grants, baseCommit: deliveryBaseCommit,
+        }).catch((error) => {
+            console.error(`Work in progress was not committed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
+            return null;
+        });
+        const response = await queueTerminal(client, taskId, {
+            action: "fail",
+            body: timeoutFailureBody(agentTimeout, active.attemptId, resume),
+        });
+        retainAttemptWorktree = Boolean(resume) || response.retain_worktree === true;
+        console.error(`Assignment ${taskId} timed out: ${redactSecrets(message)}`);
+    };
     try {
         // Resume for (1) Bridge restart with proven session+worktree, or (2) review rework.
         // A fresh attempt after a failed delivery must start clean: resuming a session whose last
@@ -1728,13 +1756,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         if (result.status === "failed") {
             const agentMessage = result.error ?? "Agent execution failed";
             if (agentTurnTimedOut(agentMessage)) {
-                retainAttemptWorktree = true;
-                const response = await queueTerminal(client, taskId, {
-                    action: "fail",
-                    body: timeoutFailureBody(agentTimeout, active.attemptId),
-                });
-                retainAttemptWorktree = response.retain_worktree === true;
-                console.error(`Assignment ${taskId} timed out: ${redactSecrets(agentMessage)}`);
+                await reportTurnTimeout(agentMessage);
                 return;
             }
             // The agent verifies inside its own tool loop, so its compiler/test output never reaches
@@ -2315,13 +2337,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     catch (error) {
         if (!(error instanceof AgentTurnTimeoutError))
             throw error;
-        retainAttemptWorktree = true;
-        const response = await queueTerminal(client, taskId, {
-            action: "fail",
-            body: timeoutFailureBody(agentTimeout, active.attemptId),
-        });
-        retainAttemptWorktree = response.retain_worktree === true;
-        console.error(`Assignment ${taskId} timed out: ${redactSecrets(error.message)}`);
+        await reportTurnTimeout(error.message);
     }
     finally {
         // The stall report already ended this attempt and its tree is the only evidence of the step
@@ -2888,15 +2904,28 @@ export function verificationScopeConflictDetail(paths, changeScope) {
 export async function verificationScopeDryRun(input) {
     const commands = verificationEvidenceCommands(input.verificationCommands, input.declaredVerificationCommands ?? [], input.acceptance ?? null);
     if (!commands.length)
-        return { ranNothing: null, redBase: null, outsideScope: [] };
+        return { ranNothing: null, timedOut: null, redBase: null, outsideScope: [] };
     const run = input.runCommand ?? runBoundedVerificationCommand;
     let ranNothing = null;
+    let timedOut = null;
     let redBase = null;
     for (const command of commands) {
         // A gate that cannot start says nothing about the scope; the next one still can.
         const result = await run(command, input.workspace).catch(() => null);
         if (!result)
             continue;
+        // A gate that never exited says nothing about the base commit: it is not a red base, and it
+        // does not go to the initiative author.
+        if (result.timedOut) {
+            if (!timedOut) {
+                timedOut = {
+                    command,
+                    ...(result.stderr.trim() ? { stderrTail: result.stderr } : {}),
+                    ...(result.stdout.trim() ? { stdoutTail: result.stdout } : {}),
+                };
+            }
+            continue;
+        }
         // Ahead of the exit code: a gate that discovered no test exits 5, and a no-op recipe exits 0
         // with no output. Neither is a red base, so neither goes to the initiative author.
         const reason = detectGateRanNothing(command, result.stdout, result.stderr, result.code)
@@ -2921,7 +2950,7 @@ export async function verificationScopeDryRun(input) {
     const outsideScope = written === null
         ? []
         : written.filter((path) => !input.changeScope.some((scope) => pathMatchesScope(path, scope)));
-    return { ranNothing, redBase, outsideScope };
+    return { ranNothing, timedOut, redBase, outsideScope };
 }
 /** Prompt and failure lines keep a short tail; the investigation brief caps each failure at 1,000. */
 const DELIVERY_VERIFICATION_GATE_TAIL_CHARS = 800;

package/dist/failure-signal.js

@@ -399,9 +399,30 @@ export function verificationRedBaseSignal(input) {
         ...(input.stdout?.trim() ? { stdout_tail: bounded2k(input.stdout) } : {}),
     };
 }
+/**
+ * The signal Bridge emits when the verification timeout stops a gate on the base commit, before the
+ * agent starts. The gate never exited, so it says nothing about the base: read as exit 1, a gate
+ * that hung (waiting for input or the network, or on a slow computer) was a red base on the author.
+ */
+export function verificationGateTimeoutSignal(input) {
+    return {
+        phase: "verification",
+        witness: "bridge",
+        kind: "timeout",
+        command: input.command,
+        base_commit: input.baseCommit,
+        exit_code: null,
+        ...(input.stderr?.trim() ? { stderr_tail: bounded2k(input.stderr) } : {}),
+        ...(input.stdout?.trim() ? { stdout_tail: bounded2k(input.stdout) } : {}),
+    };
+}
 /** A fact value as a person reads it on the card; an absent value says so in words. */
 function factValue(value) {
-    return value === null ? "none" : value;
+    return value === null ? "none" : shortCommit(value);
+}
+/** A commit hash on the card is its first 7 characters; diagnostic_detail keeps the full value. */
+function shortCommit(value) {
+    return /^[0-9a-f]{40}$/i.test(value) ? value.slice(0, 7) : value;
 }
 /** The vendor's own reason, kept inside the 2,000-char message bound; a stderr tail keeps its end. */
 function quotedVendorText(signal) {
@@ -421,17 +442,19 @@ function quotedVendorText(signal) {
  * 2. model_unbound → the tier has no other model to retry into: Hold, naming the tier and driver.
  * 3. denied_tool / usage_error → the driver and vendor cannot run this assignment: Hold.
  * 4. a changed pinned execution fact → the computer moved under the run: Hold, then Retry re-pins.
- * 5. a gate that already fails on the untouched base commit → no agent ran and none can repair a
+ * 5. a gate the verification timeout stopped on the base commit → it never exited, so it says
+ *    nothing about the base: Hold, on the computer operator, naming the gate.
+ * 6. a gate that already fails on the untouched base commit → no agent ran and none can repair a
  *    gate broken before it started: Hold, on the initiative author, naming the gate and the base.
- * 6. verification whose gates wrote outside the approved change scope → the work package is the
+ * 7. verification whose gates wrote outside the approved change scope → the work package is the
  *    defect: Hold, on the initiative author, who opens a revision.
- * 7. verification run by Bridge whose gate ran nothing → the gate is misconfigured, not failed:
+ * 8. verification run by Bridge whose gate ran nothing → the gate is misconfigured, not failed:
  *    Hold, on the computer operator, naming the command and the file that declares it. Never a
  *    repair attempt: the delivery pack may be entirely correct.
- * 8. verification run by Bridge, any other cause → the verify class: diagnose and brief a repair.
- * 9. contract, or a delivery_report phase → the delivery contract codes: rework.
- * 10. timeout → the turn reached its execution limit: stop.
- * 11. turn_cap → the run reached the computer's per-attempt turn cap: Hold, on the operator, who
+ * 9. verification run by Bridge, any other cause → the verify class: diagnose and brief a repair.
+ * 10. contract, or a delivery_report phase → the delivery contract codes: rework.
+ * 11. timeout → the turn reached its execution limit: stop.
+ * 12. turn_cap → the run reached the computer's per-attempt turn cap: Hold, on the operator, who
  *     decides whether the work was looping or the cap is too tight. Never a silent retry.
  */
 export function classifyFailureSignal(signal) {
@@ -532,7 +555,22 @@ export function classifyFailureSignal(signal) {
             responsible_party: "computer_operator",
             message: `The computer changed ${fact.name} while the work package ran, so the run no longer matched the work it claimed. It started with ${factValue(fact.pinned)} and found ${factValue(fact.observed)}.`,
             next_action: "Let the workspace settle on this computer, then Retry: the next attempt pins the facts again from the workspace as it is now.",
-            diagnostic_detail: `${fact.name}: pinned ${factValue(fact.pinned)}, found ${factValue(fact.observed)}`,
+            diagnostic_detail: `${fact.name}: pinned ${fact.pinned ?? "none"}, found ${fact.observed ?? "none"}`,
+        };
+    }
+    // Ahead of the red-base and generic verification rules: the gate never exited, so neither the
+    // base commit nor a change is known to be at fault. The generic rule read it as a failed test.
+    if (signal.phase === "verification" && signal.kind === "timeout") {
+        const command = signal.command ?? "the declared gate";
+        const base = signal.base_commit ? shortCommit(signal.base_commit) : "the base commit";
+        return {
+            code: "verification_gate_timeout",
+            class: "environment",
+            disposition: "hold",
+            responsible_party: "computer_operator",
+            message: `The verification gate \`${command}\` did not finish on the base commit ${base} within Bridge's 10-minute limit, so Bridge stopped it before any change was made.`,
+            next_action: `Run \`${command}\` on this computer and find where it hangs — a test that waits for input or the network, or a computer too slow for the gate — then fix it and Recheck. Conduit does not retry or repair a gate that does not finish.`,
+            diagnostic_detail: [`$ ${command}`, "stopped after 10 minutes", signal.stderr_tail, signal.stdout_tail].filter(Boolean).join("\n"),
         };
     }
     // Ahead of the scope and generic verification rules: the base commit itself does not pass the
@@ -542,7 +580,7 @@ export function classifyFailureSignal(signal) {
     if (signal.phase === "verification" && signal.kind === "contract"
         && signal.vendor_message === VERIFICATION_FAILS_ON_BASE) {
         const command = signal.command ?? "the declared gate";
-        const base = signal.base_commit ?? "the base commit";
+        const base = signal.base_commit ? shortCommit(signal.base_commit) : "the base commit";
         const output = [signal.stderr_tail, signal.stdout_tail].filter(Boolean).join("\n");
         // T198: a gate that could not start (`sh: tsc: not found`, exit 127) says nothing about the
         // base commit. It is the computer's checkout that lacks a tool — an environment Hold that

package/dist/git-witness.js

@@ -6,14 +6,16 @@ import { createHash } from "node:crypto";
 import { lstat, readFile, readlink } from "node:fs/promises";
 import { join } from "node:path";
 import { promisify } from "node:util";
+import { uncommittedPaths } from "./git.js";
 const execFileAsync = promisify(execFile);
-async function gitLines(worktree, args) {
+/** NUL-delimited git output as a list; git quotes and escapes unusual names in line output. */
+async function gitFields(worktree, args) {
     try {
         const { stdout } = await execFileAsync("git", ["-C", worktree, ...args], {
             timeout: 30_000,
             maxBuffer: 8_000_000,
         });
-        return stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+        return stdout.split("\0").filter(Boolean);
     }
     catch {
         return null;
@@ -24,13 +26,10 @@ async function gitLines(worktree, args) {
  * Null when git cannot answer — callers must not treat null as failure.
  */
 export async function changedPathsSince(worktree, startCommit) {
-    const committed = await gitLines(worktree, ["diff", "--name-only", `${startCommit}..HEAD`]);
+    const committed = await gitFields(worktree, ["diff", "--name-only", "-z", `${startCommit}..HEAD`]);
     if (committed === null)
         return null;
     const paths = new Set(committed);
-    // T133: porcelain lines must not be trimmed before the status columns are cut off. `gitLines`
-    // trims, so an unstaged modification (" M bureau/x.py") lost its first path character and the
-    // first production verification was discarded naming "ureau/claim_rules.py".
     const pending = await worktreeWrittenPaths(worktree);
     for (const path of pending ?? [])
         paths.add(path);
@@ -46,28 +45,12 @@ export async function changedPathsSince(worktree, startCommit) {
  * Null when git cannot answer — callers must not treat null as a violation.
  */
 export async function worktreeWrittenPaths(worktree) {
-    let stdout;
     try {
-        ({ stdout } = await execFileAsync("git", ["-C", worktree, "status", "--porcelain", "--untracked-files=all"], {
-            timeout: 30_000,
-            maxBuffer: 8_000_000,
-        }));
+        return [...new Set(await uncommittedPaths(worktree, { untracked: "all" }))];
     }
     catch {
         return null;
     }
-    const paths = new Set();
-    for (const line of stdout.split("\n")) {
-        // Porcelain v1 gives two status letters, a space, then the path. A rename names the source
-        // after " -> "; the destination is the file the command wrote.
-        if (line.length <= 3)
-            continue;
-        const entry = line.slice(3).trim();
-        const path = entry.includes(" -> ") ? entry.slice(entry.lastIndexOf(" -> ") + 4).trim() : entry;
-        if (path)
-            paths.add(path.replace(/^"|"$/g, ""));
-    }
-    return [...paths];
 }
 /**
  * Exact Git-visible state of a retained worktree, including the contents of untracked files.

package/dist/git.js

@@ -6,6 +6,31 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
+/**
+ * Every path `git status` reports as changed in the workspace: modified, staged, deleted, renamed
+ * (the destination) or untracked. The output is NUL-delimited, so a name git would otherwise quote
+ * and escape (`中文.txt` as `"\344\270\255\346\226\207.txt"`) comes back verbatim and can be
+ * handed back to git (review 2026-10-03, finding 3).
+ */
+export async function uncommittedPaths(workspace, options = {}) {
+    const { stdout } = await execFileAsync("git", ["-C", workspace, "status", "--porcelain=v1", "-z", `--untracked-files=${options.untracked ?? "normal"}`], { timeout: 30_000, maxBuffer: 8_000_000 });
+    return porcelainPaths(stdout);
+}
+/** Porcelain v1 with `-z`: `XY path`, and a rename or copy adds its source as the next field. */
+export function porcelainPaths(stdout) {
+    const fields = stdout.split("\0");
+    const paths = [];
+    for (let index = 0; index < fields.length; index++) {
+        const entry = fields[index];
+        if (entry.length < 4)
+            continue;
+        const status = entry.slice(0, 2);
+        paths.push(entry.slice(3));
+        if (status.includes("R") || status.includes("C"))
+            index++;
+    }
+    return paths;
+}
 /** A full object name, lowercased, or null when the text is not one. */
 export function commitOrNull(value) {
     const text = value?.trim() ?? "";

package/dist/land-git-reality.js

@@ -2,33 +2,11 @@
  * Claims vs git — detect when an agent's Delivery narrative claims repository work
  * that git cannot see on the attempt branch.
  */
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 import { commitsAheadOfBase } from "./ensure-pull-request.js";
 import { extractAgentReportJsonText, parseJsonObjectCandidate } from "./driver.js";
+import { uncommittedPaths as listUncommittedPaths } from "./git.js";
 import { filterPathsInScope, requiresLandCommit, } from "./land-contract.js";
-const execFileAsync = promisify(execFile);
 const NO_CHANGE_OUTCOME = /no code changes|no changes were made|working tree clean|did not (?:make|land)|nothing to (?:change|deliver)|no commit was made/i;
-async function listUncommittedPaths(workspace) {
-    const { stdout } = await execFileAsync("git", ["-C", workspace, "status", "--porcelain"], {
-        timeout: 30_000,
-        maxBuffer: 8_000_000,
-    });
-    const paths = [];
-    for (const line of stdout.split("\n")) {
-        if (!line.trim())
-            continue;
-        const entry = line.slice(3).trim();
-        if (!entry)
-            continue;
-        const path = entry.includes(" -> ")
-            ? entry.slice(entry.lastIndexOf(" -> ") + 4).trim()
-            : entry;
-        if (path)
-            paths.push(path.replace(/^"|"$/g, ""));
-    }
-    return paths;
-}
 /** True when the land contract applies and git shows no commit and no scoped dirty files. */
 export async function isLandTreeEmpty(input) {
     if (!requiresLandCommit({ grants: input.grants, spec: input.spec }))

package/dist/ops.js

@@ -191,14 +191,6 @@ export function resolveInstallDrivers(env, argv, detect = detectInstalledClients
         return [preferred];
     });
 }
-/** Quote args for a copy-pasteable shell/cmd line (paths with spaces). */
-export function shellQuoteArgs(args) {
-    return args.map((arg) => {
-        if (!/[^\w@%+=:,./\\-]/i.test(arg))
-            return arg;
-        return `"${arg.replaceAll('"', '\\"')}"`;
-    }).join(" ");
-}
 /** Ask the operator to approve a step that cannot be undone. Non-interactive shells must pass --yes. */
 async function confirmOps(question) {
     if (!input.isTTY || !output.isTTY) {

package/dist/preflight.js

@@ -1,8 +1,12 @@
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, normalizeRepositoryUrl } from "./brief.js";
-import { resolveMaxTurns } from "./execution-budget.js";
+import { bridgeConfigDirectory } from "./config.js";
+import { runBoundedVerificationCommand, verificationEvidenceCommands } from "./ensure-test-evidence.js";
+import { resolveAgentTimeout, resolveMaxTurns } from "./execution-budget.js";
 import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, driverExecutable, readSignInStatus, } from "./driver.js";
 import { laneQuota, laneTierBindings, localFuelOnlyDriver, onlineDriverIds, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
 /** Protocol 3: read-only diagnosis can reuse a retained failed-attempt worktree. */
@@ -256,7 +260,8 @@ export async function runBridgePreflight(input, deps = {}) {
     }
     return { ready: issues.length === 0, checked_at: new Date().toISOString(), workspace_clean: workspaceClean,
         drivers: driverChecks.map((check) => check.snapshot), models_fingerprint: modelsFingerprint(input.config),
-        max_turns: resolveMaxTurns(input.config.maxTurns), issues,
+        max_turns: resolveMaxTurns(input.config.maxTurns),
+        agent_timeout_ms: resolveAgentTimeout({ machineCeilingMs: input.agentTimeoutMs }).timeoutMs, issues,
         ...(input.managedRoot?.trim() ? { managed_root: input.managedRoot.trim() } : {}) };
 }
 let cached = null;
@@ -269,7 +274,7 @@ export const PREFLIGHT_CACHE_TTL_MS = 5 * 60_000;
 export async function cachedBridgePreflight(input, options = {}) {
     const online = input.processOnlineIds?.length ? input.processOnlineIds : onlineDriverIds(input.config);
     const key = JSON.stringify([input.workspace, input.expectedRepository ?? "", online, input.config.fuelSource, input.config.drivers, input.config.maxTurns ?? 0,
-        input.refresh?.state ?? "", input.refresh?.local_commits ?? 0, input.managedRoot ?? ""]);
+        input.agentTimeoutMs ?? 0, input.refresh?.state ?? "", input.refresh?.local_commits ?? 0, input.managedRoot ?? ""]);
     if (!options.force && cached?.key === key && Date.now() - cached.at < PREFLIGHT_CACHE_TTL_MS)
         return cached.report;
     const report = await runBridgePreflight(input);
@@ -291,10 +296,86 @@ export function unavailableWorkspacePreflight(input) {
             tiers: laneTierBindings(input.config, id) })),
         models_fingerprint: modelsFingerprint(input.config),
         max_turns: resolveMaxTurns(input.config.maxTurns),
+        agent_timeout_ms: resolveAgentTimeout({ machineCeilingMs: input.agentTimeoutMs }).timeoutMs,
         issues,
         ...(input.managedRoot?.trim() ? { managed_root: input.managedRoot.trim() } : {}),
     };
 }
+export function gateRehearsalStatePath() {
+    return join(bridgeConfigDirectory(), "gate-rehearsal.json");
+}
+async function readGateRehearsals(statePath) {
+    try {
+        const parsed = JSON.parse(await readFile(statePath, "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** UTC calendar day: a push to main costs no run, and a new day measures the cache again. */
+function rehearsalDay(at) {
+    return new Date(at).toISOString().slice(0, 10);
+}
+/** The last rehearsal of this workspace's repository, and the gate to run when one is due today. */
+export async function planGateRehearsal(brief, options = {}) {
+    const commands = verificationEvidenceCommands(brief.verification, brief.declared_verification, null);
+    if (!brief.repository || !brief.base_commit || !commands.length)
+        return { report: null, due: null };
+    const repository = normalizeRepositoryUrl(brief.repository);
+    const stored = (await readGateRehearsals(options.statePath ?? gateRehearsalStatePath()))[repository] ?? null;
+    const digest = createHash("sha256").update(commands.join("\n")).digest("hex").slice(0, 16);
+    const day = rehearsalDay((options.now ?? Date.now)());
+    if (stored && stored.day === day && stored.digest === digest)
+        return { report: stored.rehearsal, due: null };
+    return { report: stored?.rehearsal ?? null, due: { repository, commit: brief.base_commit, commands, digest } };
+}
+/**
+ * One runner cycle's view of every on-shift checkout: the rehearsals to report, and the first
+ * checkout whose gate is due. One repository per cycle, so a waiting assignment waits for one gate.
+ * The caller passes only checkouts that may run now (clean, not diverged) as `eligible`.
+ */
+export async function planGateRehearsals(checkouts, options = {}) {
+    const reports = [];
+    const seen = new Set();
+    let due = null;
+    for (const checkout of checkouts) {
+        const planned = await planGateRehearsal(checkout.brief, options);
+        const repository = planned.report?.repository ?? planned.due?.repository;
+        if (!repository || seen.has(repository))
+            continue;
+        seen.add(repository);
+        if (planned.report)
+            reports.push(planned.report);
+        if (!due && planned.due && checkout.eligible)
+            due = { workspace: checkout.workspace, plan: planned.due };
+    }
+    return { reports, due };
+}
+/** Run the planned gate once and remember it for the day. Null when no command could start. */
+export async function runGateRehearsal(workspace, plan, options = {}) {
+    const now = options.now ?? Date.now;
+    const run = options.runCommand ?? runBoundedVerificationCommand;
+    const commands = [];
+    for (const command of plan.commands) {
+        const started = now();
+        // A command that cannot start measured nothing; the dry run skips it the same way.
+        const result = await run(command, workspace).catch(() => null);
+        if (!result)
+            continue;
+        commands.push({ command, seconds: Math.round((now() - started) / 1_000), exit_code: result.code, timed_out: result.timedOut === true });
+    }
+    const at = now();
+    const rehearsal = commands.length
+        ? { repository: plan.repository, commit: plan.commit, rehearsed_at: new Date(at).toISOString(), commands }
+        : null;
+    const statePath = options.statePath ?? gateRehearsalStatePath();
+    const state = await readGateRehearsals(statePath);
+    state[plan.repository] = { day: rehearsalDay(at), digest: plan.digest, rehearsal };
+    await mkdir(dirname(statePath), { recursive: true });
+    await writeFile(statePath, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+    return rehearsal;
+}
 export function describePreflightIssue(issue) {
     const lane = issue.driver ? ` (${issue.driver})` : "";
     if (issue.code === "no_online_driver")

package/dist/service.js

@@ -262,7 +262,6 @@ export function runnerServiceWorkspaceWarnings(declaredWorkspace, home = homedir
     }
     return warnings;
 }
-export const WINDOWS_TASK_NAME = "ConduitBridgeRunner";
 /** Quote one argv token for a Windows Task Scheduler /TR command line. */
 export function quoteWindowsTaskArg(value) {
     if (!/[\s&<>|^()"]/.test(value))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.142",
+  "version": "0.16.147",
   "description": "Conduit Bridge CLI \u2014 join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {