Engineering Bridge v1.5.0

中文

Engineering Bridge v1.5.0

v1.5.0 新增 retained、service-owned 的异步 controlled-patch validation，同时不改变原有同步 validation API。长时间 validation 不再要求单个 MCP 请求一直保持打开，直到所有 validation steps 完成。

新增

• 新增 start_controlled_patch_validation(patch_task_id, idempotency_key)，用于持久化接纳异步 validation run，并快速返回启动响应。
• 新增 get_controlled_patch_validation(validation_run_id)，用于独立、只读地查询已保留的进度，以及终态 PASS / FAIL / INCOMPLETE 结果。
• MCP catalog 从 13 个工具扩展到 15 个工具。
• 新增 durable immutable proposal/profile identities、idempotency-key replay、private atomic validation-run store、single service ownership、supervised process-group termination，以及 ownership-verified normal worktree cleanup。
• 已完成的终态结果在重新连接和 Bridge 重启后仍会保留，且不会重新执行。

兼容性与安全

• 现有同步 validate_controlled_patch contract 保持不变。
• 异步调用方不能注入 executable argv、shell commands、validation profiles 或 timeouts。Validation 使用可信的已配置 workspace profile。
• PASS 永远不授权 APPLY。
• 异步 validation 永远不会自动 apply、commit、push、retry、resume，也不会 attach 到被中断的工作。
• Bridge 重启后，被中断的非终态 run 会变为 INCOMPLETE；stale worktree identity 与 recovery fences 会被保留。
• Async v1 要求 POSIX process-group supervision。不支持的 Windows async execution 会安全失败，同时 legacy tools 仍保持可用。
• 此实现有意不增加 generic job queue、scheduler、streaming progress API、retry engine 或 automatic stale-worktree cleanup。

验证

Release candidate 验证包括：

• npm ci — PASS
• npm run typecheck — PASS
• npm run build — PASS
• npm test — PASS
• git diff --check — PASS

GitHub Actions 在以下两个平台均通过：

• Ubuntu
• Windows Server 2025

最终 PR CI 与 post-merge main CI 均在两个平台通过 tests 与 build。

Production acceptance 还确认了：

• ChatGPT/Tunnel 的 15-tool catalog
• 新 async handlers 的真实调用
• durable async admission
• initiating MCP request 返回后，service-owned execution 仍继续执行
• 可通过独立 query calls 获取 retained terminal results

Release 边界

此 GitHub Release 发布现有 v1.5.0 tag；该 tag 位于 merge commit：

33904f37f5aea530fa02da948a6f54d3968d0bf8

此 Release 不表示 npm publication。

---

English

Engineering Bridge v1.5.0

v1.5.0 adds retained, service-owned async controlled-patch validation without changing the original synchronous validation API. Long validation no longer requires one MCP request to remain open until all validation steps finish.

Added

• Added start_controlled_patch_validation(patch_task_id, idempotency_key) for durable admission of async validation runs with a prompt start response.
• Added get_controlled_patch_validation(validation_run_id) for independent read-only queries of retained progress and terminal PASS / FAIL / INCOMPLETE results.
• Expanded the MCP catalog from 13 to 15 tools.
• Added durable immutable proposal/profile identities, idempotency-key replay, a private atomic validation-run store, single service ownership, supervised process-group termination, and ownership-verified normal worktree cleanup.
• Completed terminal results survive reconnect and Bridge restart without re-execution.

Compatibility and safety

• The existing synchronous validate_controlled_patch contract is preserved unchanged.
• Async callers cannot inject executable argv, shell commands, validation profiles, or timeouts. Validation uses the trusted configured workspace profile.
• PASS never authorizes APPLY.
• Async validation never automatically applies, commits, pushes, retries, resumes, or attaches to interrupted work.
• Interrupted non-terminal runs become INCOMPLETE after restart; stale worktree identity and recovery fences are preserved.
• Async v1 requires POSIX process-group supervision. Unsupported Windows async execution fails safely while legacy tools remain available.
• The implementation intentionally does not add a generic job queue, scheduler, streaming progress API, retry engine, or automatic stale-worktree cleanup.

Verification

Release candidate verification included:

• npm ci — PASS
• npm run typecheck — PASS
• npm run build — PASS
• npm test — PASS
• git diff --check — PASS

GitHub Actions passed on both:

• Ubuntu
• Windows Server 2025

The final PR CI and post-merge main CI both passed tests and build on both platforms.

Production acceptance also confirmed:

• the 15-tool ChatGPT/Tunnel catalog
• real invocation of the new async handlers
• durable async admission
• service-owned execution continuing after the initiating MCP request returned
• retained terminal results available through independent query calls

Release boundary

This GitHub Release publishes the existing v1.5.0 tag at merge commit:

33904f37f5aea530fa02da948a6f54d3968d0bf8

This release does not imply npm publication.