@miraland-labs/conduit-bridge 0.16.189 → 0.16.190

package/dist/execution.js

@@ -35,7 +35,7 @@ import { boundedTail, captureVerificationFailure, DeliveryReportDefectError, det
 import { ensureChangeEvidence } from "./ensure-change-evidence.js";
 import { ensureDemonstrationEvidence } from "./ensure-demonstration-evidence.js";
 import { ensureNormativeEvidence } from "./ensure-normative-evidence.js";
-import { changedPathsSince, compareWorktreeState, diffStatSince, worktreeStateFingerprint, worktreeWrittenPaths } from "./git-witness.js";
+import { changedPathsSince, compareWorktreeState, diffStatSince, mergeBaseWithDefaultBranch, trackedDefaultBranchRef, worktreeStateFingerprint, worktreeWrittenPaths } from "./git-witness.js";
 import { assertNormativeRefsMaterialized, checkNormativeMarkers, materializeNormativeRefs, NORMATIVE_MARKER_PREFIX, NORMATIVE_REF_PREFIX, parseNormativeRefs, } from "./normative-refs.js";
 import { checkIntegrationObligations, INTEGRATION_OBLIGATION_PREFIX, parseIntegrationObligations, } from "./integration-obligations.js";
 /** Keep a Mac awake only while an assignment is active; display sleep remains allowed. */
@@ -431,8 +431,9 @@ const executionContractSchema = z.object({
     repository_fingerprint: z.string().nullable().optional().default(null),
     requested_base_commit: z.string().nullable().optional().default(null),
     claimed_head: z.string().nullable().optional().default(null),
-    // For a rework, the control plane carries the first revision's resolved attempt start. Older
-    // contracts omit it and use the T136 worktree-start fallback below.
+    // The control plane may carry the first revision's resolved attempt start. Rework and resume
+    // measure from the default-branch fork point; this field is the fallback when that fork
+    // point cannot be computed.
     delivery_base_commit: z.string().nullable().optional().default(null),
     source_attempt_id: z.string().uuid().nullable().optional().default(null),
     // The change request and head commit the returned delivery left behind. A rework that keeps the
@@ -1231,21 +1232,30 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
         }
     };
-    // T136: a first revision's witness starts at the commit the attempt worktree actually checked
-    // out. When main has moved past the requested base, that resolved start is the claimed head;
-    // diffing from the requested base would report commits that predate the agent as its work.
-    // T138: a rework carries the first revision's resolved start, because its worktree starts at the
-    // previous delivery's head. That lets a prose-only rework witness the original pack while still
-    // including any new rework changes. A conflict rework is different: it is pinned to the live base
-    // tip and starts fresh there, so the control plane sends no carried base and the requested base --
-    // the pinned tip -- is the delivery base. Diffing from the first revision's start would report
-    // every commit the base gained in between as the agent's own work. Older contracts fall back to
-    // the T136 rule.
-    const rework = task.delivery_state === "changes_requested" || Boolean(executionContract.prior_head_commit);
-    const deliveryBaseCommit = executionContract.delivery_base_commit
-        ?? (rework
-            ? (executionContract.requested_base_commit ?? spec.repository?.base_commit ?? worktreeStart)
-            : worktreeStart);
+    // T136: a fresh attempt witnesses from the commit the worktree checked out. When main has
+    // moved past the requested base, that resolved start is the claimed head; diffing from the
+    // requested base would report commits that predate the agent as its work.
+    // A rework or a resumed delivery measures from the merge-base of HEAD with origin/<branch>,
+    // where <branch> is the branch the source checkout has checked out — the branch ensureCheckout
+    // tracks. fetch updates that ref. fetch does not update origin/HEAD. Contract
+    // delivery_base_commit and requested_base_commit apply only when that merge-base cannot be
+    // computed. A contract base from the first attempt's start counts later default-branch commits
+    // as the agent's writes (2026-10-23, task eff1253c). Diagnosis uses the same rule.
+    const reworkOrResume = isReworkOrResumeDelivery({
+        deliveryState: task.delivery_state,
+        priorHeadCommit: executionContract.prior_head_commit,
+        resumeFromAttemptId: executionContract.resume_from_attempt_id,
+    });
+    const deliveryBaseCommit = await resolveDeliveryBaseCommit({
+        worktree: attemptWorkspace,
+        sourceWorkspace: workspace,
+        reworkOrResume,
+        worktreeStart,
+        taskId,
+        deliveryBaseCommit: executionContract.delivery_base_commit,
+        requestedBaseCommit: executionContract.requested_base_commit,
+        repositoryBaseCommit: spec.repository?.base_commit,
+    });
     // Only when the worktree really stands at the timed-out run's head: a computer that cannot reach
     // that commit starts at the base (resolveAttemptStartCommit), and the agent must not be told the
     // work is there.
@@ -3008,6 +3018,37 @@ function referenceKind(kind) {
  * Implemented in git-witness.ts; re-exported for control-plane test pins and investigation.
  */
 export { changedPathsSince } from "./git-witness.js";
+/**
+ * A rework or a resumed delivery, from the signals the attempt contract carries.
+ *
+ * Diagnosis is not a separate case: the same three signals select the base.
+ */
+export function isReworkOrResumeDelivery(input) {
+    return input.deliveryState === "changes_requested"
+        || Boolean(input.priorHeadCommit)
+        || Boolean(input.resumeFromAttemptId);
+}
+/**
+ * Commit that changedPathsSince, diffStatSince, and the land checks measure from.
+ *
+ * A fresh attempt keeps the worktree start. A rework or a resumed delivery uses the merge-base
+ * of HEAD with `origin/<branch>` on the source checkout. Contract bases apply only when that
+ * merge-base cannot be computed. One log line names the base this attempt used.
+ */
+export async function resolveDeliveryBaseCommit(input) {
+    const ref = input.reworkOrResume ? await trackedDefaultBranchRef(input.sourceWorkspace) : null;
+    const fork = ref ? await mergeBaseWithDefaultBranch(input.worktree, ref) : null;
+    const base = !input.reworkOrResume
+        ? input.worktreeStart
+        : fork
+            ?? input.deliveryBaseCommit
+            ?? input.requestedBaseCommit
+            ?? input.repositoryBaseCommit
+            ?? input.worktreeStart;
+    const via = fork && ref ? ` (merge-base with ${ref})` : "";
+    console.log(`Assignment ${input.taskId} delivery base ${base}${via}`);
+    return base;
+}
 /**
  * Does this attempt earn a verification dry run?
  *

package/dist/git-witness.js

@@ -21,6 +21,44 @@ async function gitFields(worktree, args) {
         return null;
     }
 }
+/**
+ * Fork point of HEAD with the fetched default-branch ref.
+ *
+ * Null when the ref is missing or the two histories do not meet. Callers then use the
+ * contract base. A merge of that ref into the attempt branch moves this commit forward,
+ * so the diff still names only the branch's own files.
+ */
+export async function mergeBaseWithDefaultBranch(worktree, defaultBranchRef) {
+    try {
+        const { stdout } = await execFileAsync("git", ["-C", worktree, "merge-base", "HEAD", defaultBranchRef], { timeout: 30_000, maxBuffer: 1_000_000 });
+        const sha = stdout.trim().toLowerCase();
+        return /^[0-9a-f]{7,64}$/.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * `origin/<branch>` for the branch this checkout has checked out.
+ *
+ * `ensureCheckout` leaves that branch checked out. `fetchOrigin` and `refreshSourceWorkspace`
+ * update `origin/<branch>`. They do not update `origin/HEAD`, so this function never reads it.
+ * Null when HEAD is detached or `origin/<branch>` is absent; callers then use the contract base.
+ */
+export async function trackedDefaultBranchRef(workspace) {
+    try {
+        const { stdout } = await execFileAsync("git", ["-C", workspace, "rev-parse", "--abbrev-ref", "HEAD"], { timeout: 30_000, maxBuffer: 1_000_000 });
+        const branch = stdout.trim();
+        if (!branch || branch === "HEAD")
+            return null;
+        const ref = `origin/${branch}`;
+        await execFileAsync("git", ["-C", workspace, "rev-parse", "--verify", "--quiet", `${ref}^{commit}`], { timeout: 30_000, maxBuffer: 1_000_000 });
+        return ref;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Paths changed on the attempt branch since `startCommit`, including uncommitted work.
  * Null when git cannot answer — callers must not treat null as failure.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.189",
+  "version": "0.16.190",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {