isadeks
diff --git a/‎agent/src/hooks.py‎
Lines changed: 105 additions & 0 deletions b/‎agent/src/hooks.py‎
Lines changed: 105 additions & 0 deletions
diff --git a/‎agent/src/pipeline.py‎
Lines changed: 129 additions & 0 deletions b/‎agent/src/pipeline.py‎
Lines changed: 129 additions & 0 deletions
diff --git a/‎agent/src/post_hooks.py‎
Lines changed: 91 additions & 0 deletions b/‎agent/src/post_hooks.py‎
Lines changed: 91 additions & 0 deletions
@@ -244,6 +244,86 @@ def _allow_response(reason: str = "permitted") -> dict:
     }
 
 
+# ABCA-815 layer 1 (workspace-integrity guard). The repo is ALREADY cloned and
+# checked out at the agent's cwd (``repo_dir``); the platform tracks that dir for
+# commit/branch/PR/push. Live on backgroundagent-dev the agent sometimes ran its
+# OWN ``gh repo clone``/``git clone`` of the SAME repo into a sibling dir
+# (``/workspace/<repo-name>``) and did all its work there, leaving repo_dir empty
+# → the platform saw no commits (delivery gate: ``deliverable=lost``) and, for a
+# #247 stacked child, the successor had no branch to stack on. The industry norm
+# is a filesystem sandbox that makes a divergent clone impossible; lacking that
+# (raw Bash + bypassPermissions + open GitHub egress), a harness-enforced deny of
+# the re-clone is the closest robust analog — and Claude Code hook denies fire
+# even under bypassPermissions and survive prompt-injection. We match ONLY a
+# re-clone of the TASK's OWN repo (not legitimate dependency/submodule clones),
+# keyed off the ``owner/repo`` slug in any of the URL forms gh/git accept.
+#
+# The clone verb must appear as an actual COMMAND — at the start of the string or
+# right after a shell separator (``&&``, ``||``, ``|``, ``;``, newline, ``(``) —
+# NOT as text buried inside a quoted argument. Live-caught on ABCA-856: a
+# ``gh pr create --body "…do not run gh repo clone…"`` was wrongly blocked because
+# the phrase appeared inside the PR body. Anchoring to command position (and, in
+# ``_is_self_reclone``, truncating at the first argument that carries free text)
+# removes that false positive while still catching every real re-clone.
+_CLONE_CMD_RE = re.compile(
+    r"(?:^|[;&|\n(]|&&|\|\|)\s*(?:gh\s+repo\s+clone|git\s+(?:-C\s+\S+\s+)?clone)\b",
+    re.IGNORECASE,
+)
+
+# Arguments after which the rest of the command is free-form TEXT (a PR/issue/
+# commit body or title), where a mention of "gh repo clone" is prose, not a
+# command. We stop scanning for the clone verb at the first of these so a body
+# quoting the clone command can't trip the guard (ABCA-856 false positive).
+_FREE_TEXT_ARG_RE = re.compile(
+    r"(?:^|\s)(?:-m|--message|--body|--body-file|-b|--title|-t|-F|--field|--raw-field)\b",
+    re.IGNORECASE,
+)
+
+
+def _repo_slug_variants(repo_url: str) -> list[str]:
+    """Return the ``owner/repo`` slug forms a clone command could name.
+
+    ``config.repo_url`` is the canonical ``owner/repo``. A clone command may
+    reference it as ``owner/repo``, ``https://github.com/owner/repo(.git)``, or
+    ``git@github.com:owner/repo(.git)`` — all normalize to the same slug, so we
+    just need the bare ``owner/repo`` (with and without ``.git``) to substring-
+    match against the command text after normalization."""
+    slug = (repo_url or "").strip().removesuffix(".git").strip("/").lower()
+    if not slug:
+        return []
+    return [slug, f"{slug}.git"]
+
+
+def _is_self_reclone(command: str, repo_url: str) -> bool:
+    """True when *command* clones the task's OWN repo (any URL form).
+
+    Deliberately narrow on two axes so legitimate commands pass:
+      * the clone verb must be in COMMAND position (start / after a shell
+        separator), not inside a quoted argument — see ``_CLONE_CMD_RE``; and
+      * the scan stops at the first free-text argument (``--body``/``-m``/…), so a
+        PR/commit body that merely QUOTES "gh repo clone" is not treated as a
+        clone (ABCA-856); and
+      * a clone of a DIFFERENT repo (dependency, fixture, example) is allowed —
+        only a re-clone of the TASK repo threatens the workspace invariant."""
+    if not command or not repo_url:
+        return False
+    # Only consider the segment BEFORE any free-text argument — a --body/-m value
+    # that quotes the clone command is prose, not an executed clone.
+    m = _FREE_TEXT_ARG_RE.search(command)
+    scan = command[: m.start()] if m else command
+    if not _CLONE_CMD_RE.search(scan):
+        return False
+    variants = _repo_slug_variants(repo_url)
+    if not variants:
+        return False
+    # Normalize the command's URL punctuation to the bare slug space: drop the
+    # scheme/host and the scp-style ``git@host:`` prefix so ``.../owner/repo.git``
+    # and ``git@github.com:owner/repo`` both reduce to a substring carrying
+    # ``owner/repo``. Search the SAME pre-free-text segment.
+    haystack = scan.lower().replace("git@github.com:", "github.com/")
+    return any(v in haystack for v in variants)
+
+
 async def pre_tool_use_hook(
     hook_input: Any,
     tool_use_id: str | None,
@@ -255,6 +335,7 @@ async def pre_tool_use_hook(
     user_id: str | None = None,
     progress: Any = None,
     task_state_module: Any = None,
+    repo_url: str | None = None,
 ) -> dict:
     """PreToolUse hook: three-outcome Cedar policy enforcement (§6.5).
 
@@ -303,6 +384,28 @@ async def pre_tool_use_hook(
         log("WARN", f"PreToolUse hook received non-dict tool_input — denying {tool_name}")
         return _deny_response("tool input is not an object")
 
+    # ABCA-815 layer 1: block a Bash re-clone of the task's OWN repo before Cedar
+    # eval. The repo is already checked out at the agent's cwd; a self-reclone
+    # into a sibling dir strands the work off the platform-tracked branch (the
+    # delivery gate then fails it as ``deliverable=lost``). Deny it here with a
+    # redirect so the agent works in place instead. Scoped to the task repo only
+    # (dependency/fixture clones pass). Fires even under bypassPermissions.
+    if tool_name == "Bash" and repo_url:
+        command = tool_input.get("command", "")
+        if isinstance(command, str) and _is_self_reclone(command, repo_url):
+            reason = (
+                f"The repository '{repo_url}' is ALREADY cloned and checked out in "
+                "your working directory — do NOT clone it again or work in another "
+                "directory. Your commits must land in the current working directory "
+                "so the platform can open the pull request on the correct branch. "
+                "Remove the clone command and work in place (edit, commit, and push "
+                "from where you already are)."
+            )
+            log("POLICY", f"DENIED self-reclone of {repo_url}: {command[:160]}")
+            if trajectory:
+                trajectory.write_policy_decision("Bash", False, "self_reclone_blocked", 0)
+            return _deny_response(reason)
+
     decision = engine.evaluate_tool_use(tool_name, tool_input)
 
     # Telemetry: ALLOW "permitted" is the quiet happy path; everything else
@@ -1588,6 +1691,7 @@ def build_hook_matchers(
     task_id: str = "",
     progress: Any = None,
     user_id: str = "",
+    repo_url: str = "",
 ) -> dict:
     """Build hook matchers dict for ClaudeAgentOptions.
 
@@ -1638,6 +1742,7 @@ async def _pre(
                 task_id=task_id or None,
                 user_id=user_id or None,
                 progress=progress,
+                repo_url=repo_url or None,
             )
         except Exception as exc:
             log(
 
@@ -37,6 +37,7 @@
     _extract_agent_notes,
     ensure_committed,
     ensure_pr,
+    reconcile_agent_branch,
     verify_build,
     verify_lint,
 )
@@ -629,6 +630,94 @@ def _resolve_overall_task_status(
     return "error", err
 
 
+def _branch_has_new_commits(repo_dir: str, default_branch: str) -> bool:
+    """True if HEAD carries commits beyond ``origin/<default_branch>``.
+
+    The same ``origin/<default_branch>..HEAD`` diff ``ensure_pr`` consults to
+    decide whether there is anything to open a PR from (see
+    ``post_hooks._ensure_pr``). Used by the ABCA-815 delivery gate to tell
+    "a commit landed but the PR failed to open" (recoverable) from "no commit
+    ever reached the branch — the work was lost". For a #247 A4 stacked child
+    ``default_branch`` IS its predecessor branch (``config.base_branch``), so
+    this asks the right question: did this child add anything on top of its
+    base? Best-effort — a git failure returns ``False`` (assume nothing landed,
+    the conservative read for a gate whose job is to catch a lost deliverable)."""
+    try:
+        res = subprocess.run(
+            ["git", "log", f"origin/{default_branch}..HEAD", "--oneline"],
+            cwd=repo_dir,
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=60,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return False
+    return res.returncode == 0 and bool(res.stdout.strip())
+
+
+def _apply_delivery_gate(
+    overall_status: str,
+    result_error: str | None,
+    *,
+    workflow_read_only: bool,
+    artifact_workflow: bool,
+    needs_input: bool,
+    ensure_pr_strategy: str,
+    pr_url: str | None,
+    commit_landed: bool,
+) -> tuple[str, str | None]:
+    """ABCA-815: fail a new-work coding task that reported success but shipped
+    nothing (no PR AND no commit on its branch) — the deliverable was lost.
+
+    Live cause: a #247 A4 stacked child edited its files in a NESTED working tree
+    (persistent-storage residue left the clone one level deep inside repo_dir),
+    so every pipeline git op ran against the outer clean tree —
+    ``ensure_committed`` saw nothing, ``ensure_pr`` found no commits and skipped —
+    yet the task reported COMPLETED/build_passed. That silent success poisoned the
+    integration: the child's feature never reached the branch its successor
+    stacked on. This gate turns that into a loud, retryable FAILED.
+
+    Mirrors the repo-LESS artifact gate (``run_task`` arm 2): a sanctioned no-op
+    is EXPECTED to ship nothing, so this fires ONLY for create-strategy new work —
+      * read-only (pr_review) / artifact (decompose) ship no PR by design;
+      * push_resolve / resolve (pr_iteration) legitimately add no NEW PR, and a
+        question-only iteration is handled via the ``code_changed=False``
+        "answered" path — none MUST open a PR;
+      * clarify-and-hold (needs_input) is the one intentional new_task no-op, and
+        the caller forces it to success right after this gate.
+
+    ``commit_landed`` (from :func:`_branch_has_new_commits`) distinguishes
+    "a commit reached the branch but the PR failed to open" (``deliverable=no_pr``
+    — recoverable, the work is safe on the branch) from "no commit ever landed"
+    (``deliverable=lost`` — the work is gone) so the failure copy is honest.
+    Returns the (possibly unchanged) ``(overall_status, result_error)``.
+    """
+    delivery_expected = (
+        not workflow_read_only
+        and not artifact_workflow
+        and not needs_input
+        and ensure_pr_strategy == "create"
+    )
+    if not (overall_status == "success" and delivery_expected and not pr_url):
+        return overall_status, result_error
+    if commit_landed:
+        reason = (
+            "Task did not succeed (agent_status=success, deliverable=no_pr): a "
+            "commit reached the branch but no PR was opened — the change is on the "
+            "branch but was not delivered."
+        )
+    else:
+        reason = (
+            "Task did not succeed (agent_status=success, deliverable=lost): the "
+            "coding task reported success but no commit reached the branch and no "
+            "PR was opened — the agent's changes did not land in the task's "
+            "repository."
+        )
+    log("WARN", f"ABCA-815 delivery gate: {reason}")
+    return "error", reason
+
+
 def _compute_turns_completed(
     agent_status: str,
     turns_attempted: int | None,
@@ -1281,6 +1370,17 @@ def _on_trace_truncated(max_bytes: int, first_dropped: int) -> None:
                     )
                     post_span.set_attribute("artifact.uri", artifact_uri or "")
                 else:
+                    # ABCA-815 root cause: if the agent switched off the platform
+                    # branch (it sometimes runs `git checkout -b <own-branch>` and
+                    # commits/opens its PR there — live-caught on backgroundagent-dev),
+                    # re-point the platform branch at the agent's HEAD so the
+                    # safety-net commit, build verify, PR, and push below all run on
+                    # the branch the platform tracks. No-op on the healthy case
+                    # (agent stayed on the platform branch). Skip for read-only
+                    # (no commit/PR to deliver). The delivery gate stays as the
+                    # backstop if reconcile can't recover the work.
+                    if not workflow_read_only:
+                        reconcile_agent_branch(setup.repo_dir, setup.branch)
                     # Safety net: commit any uncommitted tracked changes (skip read-only tasks)
                     safety_committed = (
                         False if workflow_read_only else ensure_committed(setup.repo_dir)
@@ -1396,6 +1496,35 @@ def _on_trace_truncated(max_bytes: int, first_dropped: int) -> None:
                 build_timed_out=build_timed_out,
                 build_infra_failed=build_infra_failed,
             )
+            # ABCA-815 delivery gate: a create-strategy new-work task that
+            # reported success but opened no PR AND landed no commit shipped
+            # nothing — fail it loudly (retryable) instead of a false COMPLETED
+            # that would poison a #247 stacked DAG. The branch-diff is only run
+            # when the gate is actually in play (success + no pr_url) so a normal
+            # PR-producing run pays nothing. See :func:`_apply_delivery_gate`.
+            gate_in_play = (
+                overall_status == "success"
+                and not pr_url
+                and not workflow_read_only
+                and not artifact_workflow
+                and not needs_input
+                and ensure_pr_strategy == "create"
+            )
+            commit_landed = (
+                _branch_has_new_commits(setup.repo_dir, setup.default_branch)
+                if gate_in_play
+                else False
+            )
+            overall_status, result_error = _apply_delivery_gate(
+                overall_status,
+                result_error,
+                workflow_read_only=workflow_read_only,
+                artifact_workflow=artifact_workflow,
+                needs_input=needs_input,
+                ensure_pr_strategy=ensure_pr_strategy,
+                pr_url=pr_url,
+                commit_landed=commit_landed,
+            )
             # Clarify-before-spend: a hold-for-input run is a SUCCESSFUL outcome
             # (the agent did the right thing by asking), not a failure — the
             # deliverable is the question. Force success + clear any error so the
 
@@ -324,6 +324,97 @@ def ensure_committed(repo_dir: str) -> bool:
     return False
 
 
+def _current_branch(repo_dir: str) -> str | None:
+    """Return the checked-out branch name, or None if detached / git fails."""
+    try:
+        res = subprocess.run(
+            ["git", "rev-parse", "--abbrev-ref", "HEAD"],
+            cwd=repo_dir,
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if res.returncode != 0:
+        return None
+    name = res.stdout.strip()
+    # "HEAD" is git's sentinel for a detached HEAD — not a branch name.
+    return name or None if name != "HEAD" else None
+
+
+def reconcile_agent_branch(repo_dir: str, branch: str) -> bool:
+    """ABCA-815 root cause: make delivery tolerant of the agent switching off the
+    platform-provided branch.
+
+    The platform checks out ``branch`` (``config.branch_name``, e.g.
+    ``bgagent/<task_id>/<slug>``) BEFORE the agent runs, and every delivery git op
+    (ensure_committed / ensure_pr's commit-diff / ensure_pushed) is keyed to it.
+    But the agent doesn't always stay there: live on backgroundagent-dev it
+    sometimes ran ``git checkout -b <its-own-short-branch>``, committed + opened
+    its own PR there, and left the platform branch empty. ensure_pr then saw no
+    commits on ``branch`` → skipped → the task looked delivered-nothing (the
+    ABCA-815 signature), and for a #247 stacked child the successor had no branch
+    to stack on. It is NON-deterministic (the same task succeeds on a retry when
+    the agent happens to stay put), so a prompt tweak alone can't be relied on.
+
+    This reconciles deterministically: if HEAD is on a DIFFERENT branch than the
+    platform ``branch`` and that HEAD carries commits, fast-forward the platform
+    branch to the agent's HEAD (``git branch -f`` + checkout) so all downstream
+    delivery runs against the branch the platform tracks. The agent's commits are
+    preserved verbatim — we only re-point the platform branch label at them.
+
+    Returns True if it moved the platform branch, False otherwise (already on it,
+    detached HEAD with no branch to adopt, or a git failure — all handled by the
+    existing ensure_committed/ensure_pr/delivery-gate chain). Best-effort: never
+    raises, so a reconcile failure degrades to the pre-existing behavior."""
+    head_branch = _current_branch(repo_dir)
+    if head_branch is None or head_branch == branch:
+        # On the platform branch already (the common, healthy case) or detached
+        # with nothing to adopt — nothing to reconcile.
+        return False
+    log(
+        "POST",
+        f"Agent left the platform branch: HEAD is on '{head_branch}', expected "
+        f"'{branch}'. Reconciling the platform branch to the agent's commits so "
+        "the work is delivered on the tracked branch (ABCA-815).",
+    )
+    try:
+        # Re-point the platform branch at the agent's HEAD (force: the platform
+        # branch was created empty at setup, so this only ever fast-forwards it
+        # to the work the agent actually did). Then check it out so ensure_committed
+        # / ensure_pr / ensure_pushed all operate on the tracked branch.
+        force_res = run_cmd(
+            ["git", "branch", "-f", branch, "HEAD"],
+            label="reconcile-branch-force",
+            cwd=repo_dir,
+            check=False,
+        )
+        if force_res.returncode != 0:
+            stderr = (force_res.stderr or "").strip()[:200]
+            log("WARN", f"reconcile: git branch -f failed (exit {force_res.returncode}): {stderr}")
+            return False
+        checkout_res = run_cmd(
+            ["git", "checkout", branch],
+            label="reconcile-branch-checkout",
+            cwd=repo_dir,
+            check=False,
+        )
+        if checkout_res.returncode != 0:
+            stderr = (checkout_res.stderr or "").strip()[:200]
+            log(
+                "WARN",
+                f"reconcile: checkout '{branch}' failed (exit {checkout_res.returncode}): {stderr}",
+            )
+            return False
+    except (OSError, subprocess.SubprocessError) as e:
+        log("WARN", f"reconcile: git op raised {type(e).__name__}: {e}")
+        return False
+    log("POST", f"Reconciled: platform branch '{branch}' now points at the agent's work")
+    return True
+
+
 def ensure_pushed(repo_dir: str, branch: str) -> bool:
     """Push the branch if there are unpushed commits."""
     result = subprocess.run(