@miraland-labs/conduit-bridge 0.16.190 → 0.16.193

package/dist/cli.js

@@ -23,7 +23,7 @@ import { expandOpsValue, loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
 import { assignmentsPending, pumpExecutionSlots, renewLeases } from "./execution.js";
 import { createRehearsalWorktree, rehearsalWorktreePath, removeAttemptWorktree } from "./attempt-worktree.js";
 import { applyRunnerToolPath, installRunnerService, uninstallRunnerService } from "./service.js";
-import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, gateRehearsalLockHeld, planGateRehearsals, PREFLIGHT_CACHE_TTL_MS, runGateRehearsal, unavailableWorkspacePreflight } from "./preflight.js";
+import { attemptsActiveOnComputer, BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, gateRehearsalLockHeld, planGateRehearsals, PREFLIGHT_CACHE_TTL_MS, runGateRehearsal, unavailableWorkspacePreflight } from "./preflight.js";
 import { refreshSourceWorkspace } from "./workspace-refresh.js";
 import { executeNextInvestigation } from "./investigation.js";
 import { bridgeVersion } from "./version.js";
@@ -667,16 +667,19 @@ async function runner() {
                 await heartbeat(client, config, workspace, currentBrief, preflight, intentProof, bootstrapResult);
             }
             await renewLeases(client, config);
-            // Dispatched work outranks a rehearsal already running. Stop it with nothing recorded, release
-            // the lock, and claim on this same cycle. The rehearsal stays due.
-            if (gateRehearsalRunning && await assignmentsPending(client)) {
+            // Dispatched work outranks a rehearsal already running, and so does an attempt on this
+            // computer (this runner or another). Stop it with nothing recorded, release the lock, and
+            // claim on this same cycle. The rehearsal stays due.
+            if (gateRehearsalRunning && (attemptsActiveOnComputer() || await assignmentsPending(client))) {
                 gateRehearsalAbort?.abort();
                 await gateRehearsalDone;
             }
-            // Another runner on this computer rehearsing its gate: claim as usual, rehearse on a later cycle.
-            // An assignment already waiting is claimed below; this cycle does not start a rehearsal.
+            // Another runner on this computer rehearsing its gate, or any runner with an attempt in
+            // flight: claim as usual, rehearse on a later cycle. An assignment already waiting is
+            // claimed below; this cycle does not start a rehearsal.
             if (workspace && onlineDriverIds(config).length && !gateRehearsalRunning && rehearsalPlan?.due
                 && running.size === 0 && Object.keys(config.activeAttempts).length === 0 && !gateRehearsalLockHeld()
+                && !attemptsActiveOnComputer()
                 && !await assignmentsPending(client)) {
                 startGateRehearsal(rehearsalPlan.due.workspace, rehearsalPlan.due.plan);
             }
@@ -802,6 +805,8 @@ function startGateRehearsal(workspace, plan) {
         .then((rehearsal) => {
         if (rehearsal === "busy")
             console.log("Gate rehearsal deferred: another runner on this computer is rehearsing");
+        else if (abort.signal.aborted && attemptsActiveOnComputer())
+            console.log("Gate rehearsal stopped: an attempt is in flight on this computer");
         else if (abort.signal.aborted)
             console.log("Gate rehearsal stopped: an assignment is waiting");
     })

package/dist/execution.js

@@ -9,7 +9,7 @@ import { AttemptStalledError, createAttemptWatchdog, withTimeout } from "./attem
 import { workPackageSchema } from "./work-package-schema.js";
 import { ConduitRequestError, reportAssignmentPollShapeMismatch } from "./client.js";
 import { saveDriverOutcome, saveDriverQuota, tierCandidates } from "./config.js";
-import { DRIVERS, acceptanceCriteriaLines, acceptanceReportSkeleton, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, parseReplyObject, pickModelCandidate, ReplyInvalid, isSafeModelName, driverExecutable, requireStampedExecutionClass, tierForRisk } from "./driver.js";
+import { DRIVERS, acceptanceCriteriaLines, acceptanceReportSkeleton, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, parseReplyObject, pickModelCandidate, ReplyInvalid, isSafeModelName, driverExecutable, requireStampedExecutionClass, stopTrackedProcessGroups, tierForRisk } from "./driver.js";
 import { assertClassFloor } from "./execution-class.js";
 import { pickDriverForClaim, recordDriverQuota, resolveDriverFuel, resolveDriverFuelProvenance, supportsReadOnlyDiagnosis, clearDriverOutcome, recordDriverTimeout } from "./drivers.js";
 import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, removeAttemptWorktree, sweepStaleAttemptWorktrees, } from "./attempt-worktree.js";
@@ -22,7 +22,7 @@ import { forgeTransportFailure } from "./transport-fault.js";
 import { managedWorkspacePath, switchManagedWorkspace } from "./on-shift-apply.js";
 import { formatResetMinute, parseQuotaResetAt } from "./quota-reset.js";
 import { headCommitOrNull } from "./git.js";
-import { BRIDGE_PROTOCOL_VERSION } from "./preflight.js";
+import { BRIDGE_PROTOCOL_VERSION, markAttemptActive } from "./preflight.js";
 import { bridgeVersion } from "./version.js";
 import { CONTROL_PLANE_TRANSIENT_PREFIX, PULL_REQUEST_OPEN_FAILURE_PREFIX, commitsMatch, ensureDeliveryPullRequest } from "./ensure-pull-request.js";
 import { checkpointWorkInProgress, ensureLandCommit } from "./ensure-land-commit.js";
@@ -571,7 +571,9 @@ export function renewLeases(client, config) {
 }
 async function renewEachLease(client, config) {
     for (const active of Object.values(config.activeAttempts)) {
-        if (Date.parse(active.leaseExpiresAt) - Date.now() < 120_000) {
+        // Every pass asks, not only when the lease is about to lapse: the answer is also how this
+        // computer learns within a minute that the control plane ended the attempt (CR28).
+        {
             try {
                 const response = await client.attemptRequest(active.taskId, "lease", { idempotency_key: `bridge:lease:${active.attemptId}:${Math.floor(Date.now() / 60_000)}` });
                 await client.updateAttempt(active.taskId, { leaseExpiresAt: String(response.lease_expires_at) });
@@ -764,6 +766,17 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
         ?? (fallbackDriver
             ? [Object.entries(DRIVERS).find(([, d]) => d === fallbackDriver)?.[0]].filter((id) => Boolean(id))
             : null);
+    // The marker is the computer-wide record that this slot is in flight. Release it when the
+    // promise settles, success or failure, so a gate rehearsal can use the CPU again.
+    const holdAttempt = (id, work) => {
+        const releaseMarker = markAttemptActive();
+        const slot = work.finally(() => {
+            releaseMarker();
+            if (running.get(id) === slot)
+                running.delete(id);
+        });
+        running.set(id, slot);
+    };
     let progressed = running.size > 0;
     for (const id of Object.keys(config.activeAttempts)) {
         if (running.has(id))
@@ -777,7 +790,7 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
             continue;
         }
         progressed = true;
-        const slot = recoverActiveAttempt(client, config, laneDriver, active.sourceWorkspace ?? workspace, brief, timeoutMs, supervision, id)
+        const recovery = recoverActiveAttempt(client, config, laneDriver, active.sourceWorkspace ?? workspace, brief, timeoutMs, supervision, id)
             .catch(async (error) => {
             // One changed execution fact is terminal for this attempt. Recovery must not run again on
             // the same slot: the workspace will not go back, so every later pass fails identically.
@@ -790,10 +803,8 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
             }
             console.error(`Slot recovery failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
         })
-            .then(() => undefined)
-            .finally(() => { if (running.get(id) === slot)
-            running.delete(id); });
-        running.set(id, slot);
+            .then(() => undefined);
+        holdAttempt(id, recovery);
     }
     while (running.size < config.leaseCapacity) {
         let laneDriver = null;
@@ -822,14 +833,12 @@ export async function pumpExecutionSlots(client, config, workspace, brief, timeo
         progressed = true;
         console.log(`Executing ${taskId} via ${laneDriver.name}`);
         // T86: the claim answers with the checkout it proved, which is this assignment's repository.
-        const slot = runClaimedAssignment(client, config, laneDriver, claimed.workspace, brief, taskId, timeoutMs, supervision)
+        const claimedRun = runClaimedAssignment(client, config, laneDriver, claimed.workspace, brief, taskId, timeoutMs, supervision)
             .catch((error) => {
             console.error(`Slot execution failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`);
         })
-            .then(() => undefined)
-            .finally(() => { if (running.get(taskId) === slot)
-            running.delete(taskId); });
-        running.set(taskId, slot);
+            .then(() => undefined);
+        holdAttempt(taskId, claimedRun);
     }
     return progressed;
 }
@@ -1246,7 +1255,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         priorHeadCommit: executionContract.prior_head_commit,
         resumeFromAttemptId: executionContract.resume_from_attempt_id,
     });
-    const deliveryBaseCommit = await resolveDeliveryBaseCommit({
+    let deliveryBaseCommit = await resolveDeliveryBaseCommit({
         worktree: attemptWorkspace,
         sourceWorkspace: workspace,
         reworkOrResume,
@@ -1424,129 +1433,152 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
     // when a gate wrote outside the approved change scope.
     // A resumed tree stands at the timed-out run's unfinished work, where red gates are expected; the
     // timed-out run already passed these checks on the base.
-    if (dryRunsVerification({
-        executionKind,
-        executionClass,
-        freshWorktree: (options.freshWorktree ?? !options.existingWorktree) && !resumeHead,
-    })) {
-        watchdog.phase("verification");
-        const dryRun = await verificationScopeDryRun({
-            workspace: attemptWorkspace,
-            verificationCommands: attemptBrief?.verification ?? [],
-            declaredVerificationCommands: attemptBrief?.declared_verification ?? [],
-            acceptance: spec.acceptance ?? [],
-            changeScope: spec.change_scope ?? [],
-        }).catch(async (error) => {
-            if (!(error instanceof VerificationCommandUnavailableError))
-                throw error;
-            retainAttemptWorktree = true;
-            const response = await queueTerminal(client, taskId, { action: "fail", body: {
-                    error: error.message, retryable: false, failure: error.failure,
-                    idempotency_key: `bridge:verification-command-unavailable:${active.attemptId}`,
-                } });
-            retainAttemptWorktree = retainDiagnosticWorktree(response);
-            if (!retainAttemptWorktree)
-                await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
-            console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(error.message)}`);
-            return null;
-        });
-        if (!dryRun)
-            return;
-        if (dryRun.ranNothing) {
-            const { command, exitCode, reason } = dryRun.ranNothing;
-            const detail = `Verification gate ran nothing on the base commit ${worktreeStart}: ${command} (${reason}, exit ${exitCode})`;
-            // The same T13 signal the delivery gate emits: a Hold on the computer operator, never a
-            // repair attempt and never a retry, because no change can make a misconfigured gate prove
-            // anything. Emitted here it costs no model turn.
-            const signal = {
-                phase: "verification",
-                witness: "bridge",
-                kind: "verification_failed",
-                command,
-                exit_code: exitCode,
-                vendor_message: reason,
-            };
-            retainAttemptWorktree = true;
-            const response = await queueTerminal(client, taskId, {
-                action: "fail",
-                body: {
-                    error: detail,
-                    retryable: false,
-                    signal,
-                    idempotency_key: `bridge:verification-gate-ran-nothing:${active.attemptId}`,
-                },
+    // The control plane can end this attempt while the gates run on the base (an owner cancel), so
+    // the lease loop and the abort start here, before the dry run, not after it (CR28, 2026-10-24:
+    // a cancelled attempt's `cargo test` ran to its own end and the next gate started after it).
+    const abort = new AbortController();
+    slotAborts.set(taskId, abort);
+    const renewTimer = setInterval(() => { void renewLeases(client, config).catch((error) => console.error(`Lease renewal failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`)); }, 60_000);
+    let dryRunPassed = false;
+    try {
+        if (dryRunsVerification({
+            executionKind,
+            executionClass,
+            freshWorktree: (options.freshWorktree ?? !options.existingWorktree) && !resumeHead,
+        })) {
+            watchdog.phase("verification");
+            const dryRun = await verificationScopeDryRun({
+                workspace: attemptWorkspace,
+                verificationCommands: attemptBrief?.verification ?? [],
+                declaredVerificationCommands: attemptBrief?.declared_verification ?? [],
+                acceptance: spec.acceptance ?? [],
+                changeScope: spec.change_scope ?? [],
+                signal: abort.signal,
+            }).catch(async (error) => {
+                if (!(error instanceof VerificationCommandUnavailableError))
+                    throw error;
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, { action: "fail", body: {
+                        error: error.message, retryable: false, failure: error.failure,
+                        idempotency_key: `bridge:verification-command-unavailable:${active.attemptId}`,
+                    } });
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
+                if (!retainAttemptWorktree)
+                    await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+                console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(error.message)}`);
+                return null;
             });
-            retainAttemptWorktree = retainDiagnosticWorktree(response);
-            // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
-            if (!retainAttemptWorktree) {
-                await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+            if (abort.signal.aborted) {
+                // `renewLeases` cleared the local state: the control plane ended this attempt during the dry run.
+                console.log(`Assignment ${taskId} stopped during the verification dry run: the control plane ended this attempt.`);
+                if (!retainAttemptWorktree)
+                    await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+                return;
             }
-            console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
-            return;
-        }
-        if (dryRun.timedOut) {
-            const { command, stderrTail, stdoutTail } = dryRun.timedOut;
-            const detail = `Verification gate did not finish on the base commit ${worktreeStart}: ${command} (stopped after ${Math.round(VERIFICATION_TIMEOUT_MS / 60_000)} minutes)`;
-            retainAttemptWorktree = true;
-            const response = await queueTerminal(client, taskId, {
-                action: "fail",
-                body: {
-                    error: detail,
-                    retryable: false,
-                    signal: verificationGateTimeoutSignal({ command, baseCommit: worktreeStart, stderr: stderrTail, stdout: stdoutTail }),
-                    idempotency_key: `bridge:verification-gate-timeout:${active.attemptId}`,
-                },
-            });
-            retainAttemptWorktree = retainDiagnosticWorktree(response);
-            // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
-            if (!retainAttemptWorktree) {
-                await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+            if (!dryRun)
+                return;
+            if (dryRun.ranNothing) {
+                const { command, exitCode, reason } = dryRun.ranNothing;
+                const detail = `Verification gate ran nothing on the base commit ${worktreeStart}: ${command} (${reason}, exit ${exitCode})`;
+                // The same T13 signal the delivery gate emits: a Hold on the computer operator, never a
+                // repair attempt and never a retry, because no change can make a misconfigured gate prove
+                // anything. Emitted here it costs no model turn.
+                const signal = {
+                    phase: "verification",
+                    witness: "bridge",
+                    kind: "verification_failed",
+                    command,
+                    exit_code: exitCode,
+                    vendor_message: reason,
+                };
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, {
+                    action: "fail",
+                    body: {
+                        error: detail,
+                        retryable: false,
+                        signal,
+                        idempotency_key: `bridge:verification-gate-ran-nothing:${active.attemptId}`,
+                    },
+                });
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
+                // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
+                if (!retainAttemptWorktree) {
+                    await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+                }
+                console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
+                return;
             }
-            console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
-            return;
-        }
-        if (dryRun.redBase) {
-            const { command, exitCode, stderrTail, stdoutTail } = dryRun.redBase;
-            const detail = `Verification fails on the base commit ${worktreeStart}: ${command} (exit ${exitCode ?? "unknown"})`;
-            retainAttemptWorktree = true;
-            const response = await queueTerminal(client, taskId, {
-                action: "fail",
-                body: {
-                    error: detail,
-                    retryable: false,
-                    signal: verificationRedBaseSignal({ command, baseCommit: worktreeStart, exitCode, stderr: stderrTail, stdout: stdoutTail }),
-                    idempotency_key: `bridge:verification-red-base:${active.attemptId}`,
-                },
-            });
-            retainAttemptWorktree = retainDiagnosticWorktree(response);
-            // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
-            if (!retainAttemptWorktree) {
-                await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+            if (dryRun.timedOut) {
+                const { command, stderrTail, stdoutTail } = dryRun.timedOut;
+                const detail = `Verification gate did not finish on the base commit ${worktreeStart}: ${command} (stopped after ${Math.round(VERIFICATION_TIMEOUT_MS / 60_000)} minutes)`;
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, {
+                    action: "fail",
+                    body: {
+                        error: detail,
+                        retryable: false,
+                        signal: verificationGateTimeoutSignal({ command, baseCommit: worktreeStart, stderr: stderrTail, stdout: stdoutTail }),
+                        idempotency_key: `bridge:verification-gate-timeout:${active.attemptId}`,
+                    },
+                });
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
+                // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
+                if (!retainAttemptWorktree) {
+                    await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+                }
+                console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
+                return;
             }
-            console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
-            return;
-        }
-        if (dryRun.outsideScope.length) {
-            const detail = verificationScopeConflictDetail(dryRun.outsideScope, spec.change_scope ?? []);
-            retainAttemptWorktree = true;
-            const response = await queueTerminal(client, taskId, {
-                action: "fail",
-                body: {
-                    error: detail,
-                    retryable: false,
-                    signal: verificationScopeConflictSignal(dryRun.outsideScope),
-                    idempotency_key: `bridge:verification-scope-conflict:${active.attemptId}`,
-                },
-            });
-            retainAttemptWorktree = retainDiagnosticWorktree(response);
-            // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
-            // Keep it only when the control plane says it still needs it.
-            if (!retainAttemptWorktree) {
-                await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+            if (dryRun.redBase) {
+                const { command, exitCode, stderrTail, stdoutTail } = dryRun.redBase;
+                const detail = `Verification fails on the base commit ${worktreeStart}: ${command} (exit ${exitCode ?? "unknown"})`;
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, {
+                    action: "fail",
+                    body: {
+                        error: detail,
+                        retryable: false,
+                        signal: verificationRedBaseSignal({ command, baseCommit: worktreeStart, exitCode, stderr: stderrTail, stdout: stdoutTail }),
+                        idempotency_key: `bridge:verification-red-base:${active.attemptId}`,
+                    },
+                });
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
+                // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
+                if (!retainAttemptWorktree) {
+                    await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+                }
+                console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
+                return;
+            }
+            if (dryRun.outsideScope.length) {
+                const detail = verificationScopeConflictDetail(dryRun.outsideScope, spec.change_scope ?? []);
+                retainAttemptWorktree = true;
+                const response = await queueTerminal(client, taskId, {
+                    action: "fail",
+                    body: {
+                        error: detail,
+                        retryable: false,
+                        signal: verificationScopeConflictSignal(dryRun.outsideScope),
+                        idempotency_key: `bridge:verification-scope-conflict:${active.attemptId}`,
+                    },
+                });
+                retainAttemptWorktree = retainDiagnosticWorktree(response);
+                // No agent ran and the tree stands at the base commit, so it holds no diagnostic value.
+                // Keep it only when the control plane says it still needs it.
+                if (!retainAttemptWorktree) {
+                    await removeAttemptWorktree(workspace, attemptWorkspace).catch(() => undefined);
+                }
+                console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
+                return;
             }
-            console.error(`Assignment ${taskId} refused before the agent started: ${redactSecrets(detail)}`);
-            return;
         }
+        dryRunPassed = true;
+    }
+    finally {
+        // An attempt refused before the agent leaves here; the agent phase below owns the loop otherwise.
+        if (!dryRunPassed)
+            clearInterval(renewTimer);
     }
     const prompt = diagnosis
         ? buildDiagnosticPrompt({
@@ -1683,10 +1715,7 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
         sourceAttemptId: sourceAttemptId ?? undefined,
     });
     const releaseIdleSleep = startIdleSleepGuard();
-    const abort = new AbortController();
-    slotAborts.set(taskId, abort);
     watchdog.phase("agent");
-    const renewTimer = setInterval(() => { void renewLeases(client, config).catch((error) => console.error(`Lease renewal failed: ${redactSecrets(error instanceof Error ? error.message : "unknown")}`)); }, 60_000);
     let heartbeatRunning = false;
     const heartbeatTimer = supervision ? setInterval(() => {
         if (heartbeatRunning)
@@ -2002,6 +2031,21 @@ async function runAttempt(client, config, driver, workspace, brief, taskId, watc
             retainAttemptWorktree = await failAttemptFromDriverResult(result);
             return;
         }
+        // The agent may have rebased or merged the default branch during its turn (CR25 rework,
+        // 2026-10-24: the base fixed at attempt start counted the default branch's own commits as the
+        // agent's writes). Measure a rework from where the tree stands now.
+        if (reworkOrResume) {
+            deliveryBaseCommit = await resolveDeliveryBaseCommit({
+                worktree: attemptWorkspace,
+                sourceWorkspace: workspace,
+                reworkOrResume,
+                worktreeStart,
+                taskId,
+                deliveryBaseCommit: executionContract.delivery_base_commit,
+                requestedBaseCommit: executionContract.requested_base_commit,
+                repositoryBaseCommit: spec.repository?.base_commit,
+            });
+        }
         watchdog.phase("land");
         if (requiresLandCommit({ grants, spec })) {
             try {
@@ -3120,46 +3164,55 @@ export async function verificationScopeDryRun(input) {
     let ranNothing = null;
     let timedOut = null;
     let redBase = null;
-    for (const command of commands) {
-        // A gate that cannot start says nothing about the scope; the next one still can.
-        const result = await run(command, input.workspace).catch((error) => {
-            if (error instanceof VerificationCommandUnavailableError)
-                throw error;
-            return null;
-        });
-        if (!result)
-            continue;
-        // A gate that never exited says nothing about the base commit: it is not a red base, and it
-        // does not go to the initiative author.
-        if (result.timedOut) {
-            if (!timedOut) {
-                timedOut = {
+    const stopOnAbort = () => stopTrackedProcessGroups();
+    input.signal?.addEventListener("abort", stopOnAbort, { once: true });
+    try {
+        for (const command of commands) {
+            if (input.signal?.aborted)
+                break;
+            // A gate that cannot start says nothing about the scope; the next one still can.
+            const result = await run(command, input.workspace).catch((error) => {
+                if (error instanceof VerificationCommandUnavailableError)
+                    throw error;
+                return null;
+            });
+            if (!result || input.signal?.aborted)
+                continue;
+            // A gate that never exited says nothing about the base commit: it is not a red base, and it
+            // does not go to the initiative author.
+            if (result.timedOut) {
+                if (!timedOut) {
+                    timedOut = {
+                        command,
+                        ...(result.stderr.trim() ? { stderrTail: result.stderr } : {}),
+                        ...(result.stdout.trim() ? { stdoutTail: result.stdout } : {}),
+                    };
+                }
+                continue;
+            }
+            // Ahead of the exit code: a gate that discovered no test exits 5, and a no-op recipe exits 0
+            // with no output. Neither is a red base, so neither goes to the initiative author.
+            const reason = detectGateRanNothing(command, result.stdout, result.stderr, result.code)
+                ?? (result.code === 0 && !result.stdout.trim() && !result.stderr.trim() ? "gate ran no tests" : null);
+            if (reason) {
+                if (!ranNothing)
+                    ranNothing = { command, exitCode: result.code, reason };
+                continue;
+            }
+            // First non-zero wins: the earliest gate to fail on the base is the one the operator fixes first.
+            if (result.code !== 0 && !redBase) {
+                redBase = {
                     command,
+                    exitCode: result.code,
                     ...(result.stderr.trim() ? { stderrTail: result.stderr } : {}),
                     ...(result.stdout.trim() ? { stdoutTail: result.stdout } : {}),
                 };
             }
-            continue;
-        }
-        // Ahead of the exit code: a gate that discovered no test exits 5, and a no-op recipe exits 0
-        // with no output. Neither is a red base, so neither goes to the initiative author.
-        const reason = detectGateRanNothing(command, result.stdout, result.stderr, result.code)
-            ?? (result.code === 0 && !result.stdout.trim() && !result.stderr.trim() ? "gate ran no tests" : null);
-        if (reason) {
-            if (!ranNothing)
-                ranNothing = { command, exitCode: result.code, reason };
-            continue;
-        }
-        // First non-zero wins: the earliest gate to fail on the base is the one the operator fixes first.
-        if (result.code !== 0 && !redBase) {
-            redBase = {
-                command,
-                exitCode: result.code,
-                ...(result.stderr.trim() ? { stderrTail: result.stderr } : {}),
-                ...(result.stdout.trim() ? { stdoutTail: result.stdout } : {}),
-            };
         }
     }
+    finally {
+        input.signal?.removeEventListener("abort", stopOnAbort);
+    }
     const written = input.changeScope.length ? await worktreeWrittenPaths(input.workspace) : null;
     await discardWorktreeWrites(input.workspace);
     const outsideScope = written === null

package/dist/preflight.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { linkSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { link, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -385,6 +385,10 @@ export function gateRehearsalLockHeld(lockPath = gateRehearsalLockPath()) {
     catch {
         return false;
     }
+    return processAlive(pid);
+}
+/** True when `pid` is a running process. EPERM counts: the process exists and we cannot signal it. */
+function processAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0)
         return false;
     try {
@@ -421,6 +425,102 @@ async function acquireGateRehearsalLock(lockPath) {
         await unlink(claim).catch(() => undefined);
     }
 }
+/**
+ * In-flight attempts on this computer. Each runner has its own config directory, so the markers
+ * live in the user cache beside the gate-rehearsal lock. One file per attempt, stamped with the
+ * holder's pid. A marker whose process is gone is not an attempt.
+ */
+/** The runner loop sleeps for the heartbeat. A gate already inside a command cannot wait that long. */
+const ATTEMPT_ACTIVE_POLL_MS = 20;
+export function attemptActiveDirectory() {
+    const override = process.env.CONDUIT_ATTEMPT_ACTIVE_DIR?.trim();
+    return override ? override : join(homedir(), ".cache", "conduit", "attempts-active");
+}
+/** Record one attempt in flight. The returned function removes that marker and no other. */
+export function markAttemptActive(directory = attemptActiveDirectory()) {
+    mkdirSync(directory, { recursive: true });
+    const marker = join(directory, `${process.pid}.${randomUUID()}`);
+    const claim = `${marker}.claim`;
+    writeFileSync(claim, `${process.pid}\n`);
+    try {
+        linkSync(claim, marker);
+    }
+    finally {
+        try {
+            unlinkSync(claim);
+        }
+        catch { /* the claim is already gone */ }
+    }
+    let released = false;
+    return () => {
+        if (released)
+            return;
+        released = true;
+        try {
+            unlinkSync(marker);
+        }
+        catch { /* a crash already removed it */ }
+    };
+}
+/**
+ * True when any live attempt marker is in `directory`. A marker whose pid is not alive is removed
+ * and does not count. An unreadable directory counts as active: a rehearsal must not start when
+ * this computer cannot see whether an attempt is in flight.
+ */
+export function attemptsActiveOnComputer(directory = attemptActiveDirectory()) {
+    let names;
+    try {
+        names = readdirSync(directory);
+    }
+    catch (error) {
+        return error.code !== "ENOENT";
+    }
+    let active = false;
+    for (const name of names) {
+        if (name.endsWith(".claim"))
+            continue;
+        const path = join(directory, name);
+        let pid = Number.NaN;
+        try {
+            pid = Number.parseInt(readFileSync(path, "utf8"), 10);
+        }
+        catch {
+            continue;
+        }
+        if (!processAlive(pid)) {
+            try {
+                unlinkSync(path);
+            }
+            catch { /* removed by the holder, or not a file */ }
+            continue;
+        }
+        active = true;
+    }
+    return active;
+}
+/** Abort `abort` while an attempt marker is present. The caller stops the watch. */
+function watchAttemptMarkers(directory, abort) {
+    const stop = () => {
+        if (attemptsActiveOnComputer(directory))
+            abort();
+    };
+    stop();
+    const timer = setInterval(stop, ATTEMPT_ACTIVE_POLL_MS);
+    timer.unref();
+    return () => clearInterval(timer);
+}
+/** Abort `to` when `from` aborts. An absent signal does nothing. */
+function forwardAbort(from, to) {
+    if (!from)
+        return () => undefined;
+    if (from.aborted) {
+        to.abort();
+        return () => undefined;
+    }
+    const abort = () => to.abort();
+    from.addEventListener("abort", abort, { once: true });
+    return () => from.removeEventListener("abort", abort);
+}
 /** Resolve when `work` settles, or with "aborted" when `signal` aborts first. */
 function untilAbort(work, signal) {
     if (!signal)
@@ -459,24 +559,33 @@ async function runRehearsalCommand(run, command, cwd, timeoutMs, signal) {
     return result;
 }
 /**
- * Run the planned gate once and remember it for the day. Null when no command could start, or when
- * `signal` aborts: the command is stopped, nothing is remembered, and the lock is released, so the
- * gate stays due. "busy" when another rehearsal on this computer holds the lock: nothing is run or
- * remembered, so the gate is still due and the next cycle tries again.
+ * Run the planned gate once and remember it for the day. Null when no command could start, when
+ * `signal` aborts, or when an attempt marker is present: the command is stopped, nothing is
+ * remembered, and the lock is released, so the gate stays due. "busy" when another rehearsal on
+ * this computer holds the lock: nothing is run or remembered, so the gate is still due and the
+ * next cycle tries again.
  */
 export async function runGateRehearsal(workspace, plan, options = {}) {
     if (options.signal?.aborted)
         return null;
+    const attemptDirectory = options.attemptDirectory ?? attemptActiveDirectory();
+    if (attemptsActiveOnComputer(attemptDirectory))
+        return null;
     const lockPath = options.lockPath ?? gateRehearsalLockPath();
     if (!await acquireGateRehearsalLock(lockPath))
         return "busy";
-    const releaseAbort = stopWhenAborted(options.signal, stopTrackedProcessGroups);
+    const abort = new AbortController();
+    const stopForward = forwardAbort(options.signal, abort);
+    const stopWatch = watchAttemptMarkers(attemptDirectory, () => abort.abort());
+    const releaseAbort = stopWhenAborted(abort.signal, stopTrackedProcessGroups);
     try {
-        if (options.signal?.aborted)
+        if (abort.signal.aborted)
             return null;
-        return await rehearseGate(workspace, plan, options);
+        return await rehearseGate(workspace, plan, { ...options, signal: abort.signal });
     }
     finally {
+        stopWatch();
+        stopForward();
         releaseAbort();
         await unlink(lockPath).catch(() => undefined);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.190",
+  "version": "0.16.193",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {