@miraland-labs/conduit-bridge 0.16.196 → 0.16.198

package/dist/cli.js

@@ -623,6 +623,14 @@ async function runner() {
                 : null;
             if (rehearsalPlan)
                 reportedGateRehearsals = rehearsalPlan.reports;
+            const rehearsalWaiting = Boolean(workspace && onlineDriverIds(config).length && rehearsalPlan?.due
+                && running.size === 0 && Object.keys(config.activeAttempts).length === 0 && !attemptsActiveOnComputer());
+            const waitingForRehearsalLock = rehearsalWaiting && gateRehearsalLockHeld();
+            rehearsalLockWaiting = waitingForRehearsalLock;
+            if (waitingForRehearsalLock && !reportedRehearsalLockWait) {
+                console.log(`Claim deferred for gate rehearsal in ${rehearsalPlan?.due?.workspace}: waiting for another runner's computer lock`);
+            }
+            reportedRehearsalLockWait = waitingForRehearsalLock;
             const preflight = workspace
                 ? await cachedBridgePreflight({ config, workspace, managedRoot, brief: currentBrief ?? undefined, refresh, agentTimeoutMs: timeoutMs })
                 : unavailableWorkspacePreflight({ config, managedRoot, agentTimeoutMs: timeoutMs });
@@ -739,6 +747,9 @@ async function runner() {
 }
 /** True while the gate rehearsal runs in the background. Waiting assignments do not interrupt it. */
 let gateRehearsalRunning = false;
+let claimsPaused;
+let rehearsalLockWaiting = false;
+let reportedRehearsalLockWait = false;
 let gateRehearsalAbort = null;
 let gateRehearsalDone = Promise.resolve();
 /** An observation fingerprints the source checkout; a fast-forward under it reads as the observer writing. */
@@ -844,6 +855,13 @@ async function reportedRefresh(workspace, options = {}) {
     }
     return refresh;
 }
+function pausedClaimsPreflight() {
+    const reason = gateRehearsalRunning ? "gate_rehearsal" : rehearsalLockWaiting ? "gate_rehearsal_lock" : undefined;
+    claimsPaused = reason
+        ? claimsPaused?.reason === reason ? claimsPaused : { reason, since: new Date().toISOString() }
+        : undefined;
+    return claimsPaused ? { claims_paused: claimsPaused } : {};
+}
 async function heartbeat(client, config, workspacePath, brief, preflight, intentProof, bootstrapResult) {
     const online = onlineDriverIds(config);
     const status = heartbeatStatusForDrivers(online);
@@ -867,6 +885,7 @@ async function heartbeat(client, config, workspacePath, brief, preflight, intent
         ...(assignmentPollBehindServer() ? { runner_behind_server: true } : {}),
         ...(process.env.CONDUIT_RUNNER_SERVICE === "container" ? { runner_service: "container" } : {}),
         ...(workspacePath && reportedGateRehearsals.length ? { gate_rehearsals: reportedGateRehearsals } : {}),
+        ...pausedClaimsPreflight(),
     };
     const response = await client.request("/runner/v1/heartbeat", { method: "POST", body: JSON.stringify({
             status,

package/dist/investigation.js

@@ -156,16 +156,20 @@ export function buildInvestigationPrompt(assignment, commit, context) {
  * verdict per criterion is the product; prose without verdicts is an unusable brief.
  */
 export function buildDeliveryVerificationPrompt(assignment, commit, context) {
-    // The lane's shell holds only the registered commands, so it cannot run git itself. Bridge ran the
-    // stat; the lane reads the named files at the pinned commit.
+    // Bridge supplies the stat; OS-sandboxed lanes can also read through their read-only shell.
+    const osSandbox = context.boundedBy === "os_sandbox";
+    const readFiles = osSandbox
+        ? `Read the tree with read-only shell commands such as cat, sed, ls, grep, and git show ${commit}:<path> at the pinned commit.`
+        : "Read the changed files that matter to each criterion at the pinned commit; you cannot run git.";
     const stat = context.diffStat?.trim() ?? "";
     const cut = stat.length > DIFF_STAT_MAX_CHARS;
     const diff = stat
-        ? `CHANGE SUMMARY (git diff --stat ${assignment.base_commit ?? "base"}..${commit}, computed by Bridge)\n${cut ? `${stat.slice(0, DIFF_STAT_MAX_CHARS)}\n[cut at ${DIFF_STAT_MAX_CHARS} characters]` : stat}\nRead the changed files that matter to each criterion at the pinned commit; you cannot run git.`
-        : "No change summary is available: read the files each criterion names at the pinned commit; you cannot run git.";
+        ? `CHANGE SUMMARY (git diff --stat ${assignment.base_commit ?? "base"}..${commit}, computed by Bridge)\n${cut ? `${stat.slice(0, DIFF_STAT_MAX_CHARS)}\n[cut at ${DIFF_STAT_MAX_CHARS} characters]` : stat}\n${readFiles}`
+        : osSandbox ? `No change summary is available: read the files each criterion names at the pinned commit. ${readFiles}`
+            : "No change summary is available: read the files each criterion names at the pinned commit; you cannot run git.";
     const commands = context.verificationCommands.length
-        ? `REGISTERED COMMANDS (the only commands your shell accepts)\n${context.verificationCommands.map((command) => `- ${command}`).join("\n")}`
-        : "REGISTERED COMMANDS\n- none: this repository registers no verification command, so judge from the files only";
+        ? `${osSandbox ? "REGISTERED COMMANDS (the only gate commands)" : "REGISTERED COMMANDS (the only commands your shell accepts)"}\n${context.verificationCommands.map((command) => `- ${command}`).join("\n")}`
+        : `${osSandbox ? "REGISTERED COMMANDS (the only gate commands)" : "REGISTERED COMMANDS"}\n- none: this repository registers no verification command, so judge from the files only`;
     const keys = (assignment.brief_keys ?? []).map((key) => key.trim()).filter(Boolean);
     const briefKeysBlock = keys.length ? `BRIEF KEYS\n${keys.join("\n")}` : "";
     const returns = (assignment.owner_returns ?? []).map((text) => text.trim()).filter(Boolean);
@@ -178,7 +182,9 @@ export function buildDeliveryVerificationPrompt(assignment, commit, context) {
         "You have repo_read and test_run only. Do not edit, create, delete, format, commit, branch, push, install, or change any file.",
         diff,
         formatGatesRunBlock(context.gatesRun ?? []),
-        "Bridge already ran the gates at this commit. The GATES RUN block is the only gate fact — use those exit codes and output tails; do not choose which commands count as gates. You may still run a REGISTERED COMMAND to read more. Run nothing that is not registered. Never start a server, deploy, or call a production system.",
+        osSandbox
+            ? "Bridge already ran the gates at this commit. The GATES RUN block is the only gate fact — use those exit codes and output tails; do not choose which commands count as gates. A registered-command rerun that fails on the read-only tree is not evidence against the delivery and is not a new gate. Never start a server, deploy, or call a production system."
+            : "Bridge already ran the gates at this commit. The GATES RUN block is the only gate fact — use those exit codes and output tails; do not choose which commands count as gates. You may still run a REGISTERED COMMAND to read more. Run nothing that is not registered. Never start a server, deploy, or call a production system.",
         // T132: three verifications ended at the time limit with no brief. Order the work so the brief
         // exists before the budget does not.
         "Order of work: read the GATES RUN facts first, then the changed files that matter, then write the brief. You may run a registered command to read more, one at a time and never two at once (a test suite that rewrites a source file and restores it races against itself when run concurrently, and a changed tree voids your run). Your time is limited: a brief with `unclear` verdicts for what you did not reach is the required outcome; a run that ends without a brief settles nothing.",
@@ -868,6 +874,7 @@ export async function executeNextInvestigation(client, config, workspace, brief,
             })
             : [];
         const context = {
+            boundedBy: boundedByForDriver(driverId),
             verificationCommands,
             diffStat: assignment.base_commit ? await diffStatSince(attemptWorkspace, assignment.base_commit) : null,
             gatesRun,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.196",
+  "version": "0.16.198",
   "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {